@push.rocks/smartdb 2.7.0 → 2.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartdb",
-  "version": "2.7.0",
+  "version": "2.8.0",
   "private": false,
   "description": "A MongoDB-compatible embedded database server with wire protocol support, backed by a high-performance Rust engine.",
   "exports": {

package/readme.md

@@ -248,6 +248,64 @@ const server = new SmartdbServer({
   persistPath: './data/snapshot.json',
   persistIntervalMs: 30000, // Save every 30s
 });
+
+// TLS transport for TCP mode
+const tlsServer = new SmartdbServer({
+  port: 27017,
+  tls: {
+    enabled: true,
+    certPath: './certs/server.pem',
+    keyPath: './certs/server.key',
+    // caPath: './certs/client-ca.pem',
+    // requireClientCert: true, // Enables mTLS client certificate checks
+  },
+});
+
+// SCRAM-SHA-256 authentication
+const secureServer = new SmartdbServer({
+  port: 27017,
+  auth: {
+    enabled: true,
+    usersPath: './data/smartdb-users.json', // Optional: persists derived SCRAM credentials
+    users: [
+      {
+        username: 'root',
+        password: 'change-me',
+        database: 'admin',
+        roles: ['root'],
+      },
+    ],
+  },
+});
+```
+
+When `auth.enabled` is true, protected commands require successful SCRAM-SHA-256 authentication through the official MongoDB driver:
+
+```typescript
+const client = new MongoClient('mongodb://root:change-me@127.0.0.1:27017/admin?authSource=admin', {
+  directConnection: true,
+});
+await client.connect();
+```
+
+TLS is available for TCP listeners. `getConnectionUri()` includes `?tls=true` when TLS is enabled; pass the trusted CA to the MongoDB driver with `tlsCAFile`, `ca`, or `secureContext`.
+
+Authentication verifies SCRAM credentials, denies unauthenticated commands, and enforces command-level built-in roles for supported operations. `connectionStatus` reports the authenticated users and roles for the current socket.
+
+Supported built-in role names are `root`, `read`, `readWrite`, `dbAdmin`, `userAdmin`, `clusterMonitor`, plus `readAnyDatabase`, `readWriteAnyDatabase`, `dbAdminAnyDatabase`, and `userAdminAnyDatabase`. When `usersPath` is set, SmartDB persists SCRAM credential material atomically and does not store plaintext passwords.
+
+Single-node transactions are supported through official MongoDB driver sessions. Writes with `startTransaction` and `autocommit: false` are buffered per logical session, reads inside the transaction see the buffered overlay, `commitTransaction` applies the write set with conflict checks, and `abortTransaction` discards it.
+
+Basic user management commands are available for authenticated users with `root` or `userAdmin` privileges:
+
+```typescript
+await client.db('admin').command({
+  createUser: 'reader',
+  pwd: 'readpass',
+  roles: [{ role: 'read', db: 'myapp' }],
+});
+
+await client.db('admin').command({ usersInfo: 'reader' });
 ```
 
 #### Methods & Properties
@@ -261,7 +319,7 @@ const server = new SmartdbServer({
 | `port` | `number` | Configured port (TCP mode) |
 | `host` | `string` | Configured host (TCP mode) |
 | `socketPath` | `string \| undefined` | Socket path (socket mode) |
-| `getMetrics()` | `Promise<ISmartDbMetrics>` | Server metrics (db/collection counts, uptime) |
+| `getMetrics()` | `Promise<ISmartDbMetrics>` | Server metrics (db/collection counts, sessions, transactions, auth, uptime) |
 | `getOpLog(params?)` | `Promise<IOpLogResult>` | Query oplog entries with optional filters |
 | `getOpLogStats()` | `Promise<IOpLogStats>` | Aggregate oplog statistics |
 | `revertToSeq(seq, dryRun?)` | `Promise<IRevertResult>` | Revert to a specific oplog sequence |
@@ -475,7 +533,7 @@ const names = await collection.distinct('name');
 | **Aggregation** | `aggregate`, `count`, `distinct` |
 | **Indexes** | `createIndexes`, `dropIndexes`, `listIndexes` |
 | **Sessions** | `startSession`, `endSessions` |
-| **Transactions** | `commitTransaction`, `abortTransaction` |
+| **Transactions** | `startTransaction`, `commitTransaction`, `abortTransaction` through driver sessions |
 | **Admin** | `ping`, `listDatabases`, `listCollections`, `drop`, `dropDatabase`, `create`, `serverStatus`, `buildInfo`, `dbStats`, `collStats`, `connectionStatus`, `currentOp`, `renameCollection` |
 
 Compatible with wire protocol versions 0–21 (driver versions 3.6 through 7.0).
@@ -484,7 +542,7 @@ Compatible with wire protocol versions 0–21 (driver versions 3.6 through 7.0).
 
 ## Rust Crate Architecture 🦀
 
-The Rust engine is organized as a Cargo workspace with 8 focused crates:
+The Rust engine is organized as a Cargo workspace with 9 focused crates:
 
 | Crate | Purpose |
 |---|---|
@@ -495,6 +553,7 @@ The Rust engine is organized as a Cargo workspace with 8 focused crates:
 | `rustdb-storage` | Storage backends (memory, file), OpLog with point-in-time replay |
 | `rustdb-index` | B-tree/hash indexes, query planner (IXSCAN/COLLSCAN) |
 | `rustdb-txn` | Transaction + session management with snapshot isolation |
+| `rustdb-auth` | SCRAM-SHA-256 credential handling, user metadata persistence, RBAC checks |
 | `rustdb-commands` | 40+ command handlers wiring everything together |
 
 Cross-compiled for `linux_amd64` and `linux_arm64` via [@git.zone/tsrust](https://www.npmjs.com/package/@git.zone/tsrust).
@@ -507,6 +566,7 @@ The Bitcask-style file storage engine includes several reliability features:
 - **CRC32 checksums** — every record is integrity-checked on read
 - **Automatic compaction** — dead records are reclaimed when they exceed 50% of file size, runs on startup and after every write
 - **Hint file staleness detection** — the hint file records the data file size at write time; if data.rdb changed since (e.g. crash after a delete), the engine falls back to a full scan to ensure tombstones are not lost
+- **Torn-tail repair** — startup scans `data.rdb` to the last valid record, truncates invalid trailing bytes, and preserves all verified records after interrupted writes
 - **Stale socket cleanup** — orphaned `/tmp/smartdb-*.sock` files from crashed instances are automatically cleaned up on startup
 
 ### Data Integrity CLI 🔍

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartdb',
-  version: '2.7.0',
+  version: '2.8.0',
   description: 'A MongoDB-compatible embedded database server with wire protocol support, backed by a high-performance Rust engine.'
 }

package/ts/ts_smartdb/index.ts

@@ -2,7 +2,12 @@
 
 // Export server (the main entry point for using SmartDB)
 export { SmartdbServer } from './server/SmartdbServer.js';
-export type { ISmartdbServerOptions } from './server/SmartdbServer.js';
+export type {
+  ISmartdbAuthOptions,
+  ISmartdbAuthUser,
+  ISmartdbServerOptions,
+  ISmartdbTlsOptions,
+} from './server/SmartdbServer.js';
 
 // Export bridge for advanced usage
 export { RustDbBridge } from './rust-db-bridge.js';

package/ts/ts_smartdb/rust-db-bridge.ts

@@ -76,6 +76,10 @@ export interface ISmartDbMetrics {
   collections: number;
   oplogEntries: number;
   oplogCurrentSeq: number;
+  sessions: number;
+  activeTransactions: number;
+  authEnabled: boolean;
+  authUsers: number;
   uptimeSeconds: number;
 }
 
@@ -117,6 +121,24 @@ interface ISmartDbRustConfig {
   storagePath?: string;
   persistPath?: string;
   persistIntervalMs?: number;
+  auth?: {
+    enabled?: boolean;
+    users?: Array<{
+      username: string;
+      password: string;
+      database?: string;
+      roles?: string[];
+    }>;
+    usersPath?: string;
+    scramIterations?: number;
+  };
+  tls?: {
+    enabled?: boolean;
+    certPath?: string;
+    keyPath?: string;
+    caPath?: string;
+    requireClientCert?: boolean;
+  };
 }
 
 /**

package/ts/ts_smartdb/server/SmartdbServer.ts

@@ -28,6 +28,32 @@ export interface ISmartdbServerOptions {
   persistPath?: string;
   /** Persistence interval in ms (default: 60000) */
   persistIntervalMs?: number;
+  /** Authentication configuration. Disabled by default. */
+  auth?: ISmartdbAuthOptions;
+  /** TLS transport configuration for TCP listeners. Disabled by default. */
+  tls?: ISmartdbTlsOptions;
+}
+
+export interface ISmartdbAuthOptions {
+  enabled?: boolean;
+  users?: ISmartdbAuthUser[];
+  usersPath?: string;
+  scramIterations?: number;
+}
+
+export interface ISmartdbAuthUser {
+  username: string;
+  password: string;
+  database?: string;
+  roles?: string[];
+}
+
+export interface ISmartdbTlsOptions {
+  enabled?: boolean;
+  certPath?: string;
+  keyPath?: string;
+  caPath?: string;
+  requireClientCert?: boolean;
 }
 
 /**
@@ -64,6 +90,8 @@ export class SmartdbServer {
       storagePath: options.storagePath ?? './data',
       persistPath: options.persistPath,
       persistIntervalMs: options.persistIntervalMs ?? 60000,
+      auth: options.auth,
+      tls: options.tls,
     };
     this.bridge = new RustDbBridge();
   }
@@ -106,6 +134,8 @@ export class SmartdbServer {
       storagePath: this.options.storagePath,
       persistPath: this.options.persistPath,
       persistIntervalMs: this.options.persistIntervalMs,
+      auth: this.options.auth,
+      tls: this.options.tls,
     });
 
     this.resolvedConnectionUri = result.connectionUri;
@@ -142,7 +172,8 @@ export class SmartdbServer {
       const encodedPath = encodeURIComponent(this.options.socketPath);
       return `mongodb://${encodedPath}`;
     }
-    return `mongodb://${this.options.host ?? '127.0.0.1'}:${this.options.port ?? 27017}`;
+    const baseUri = `mongodb://${this.options.host ?? '127.0.0.1'}:${this.options.port ?? 27017}`;
+    return this.options.tls?.enabled ? `${baseUri}/?tls=true` : baseUri;
   }
 
   /**