@useatlas/create 0.0.1

package/templates/docker/src/lib/logger.ts

@@ -0,0 +1,98 @@
+/**
+ * Structured logger with request context propagation.
+ *
+ * - JSON output in production, pino-pretty in development
+ * - Pino mixin + AsyncLocalStorage binds requestId to all log lines within a request
+ * - Redaction paths prevent secrets from leaking into logs
+ * - ATLAS_LOG_LEVEL env var controls verbosity (default: "info")
+ */
+
+import pino from "pino";
+import { AsyncLocalStorage } from "async_hooks";
+import type { AtlasUser } from "@atlas/api/lib/auth/types";
+
+// --- Request context ---
+
+interface RequestContext {
+  requestId: string;
+  user?: AtlasUser;
+}
+
+const requestStore = new AsyncLocalStorage<RequestContext>();
+
+export function withRequestContext<T>(
+  ctx: RequestContext,
+  fn: () => T,
+): T {
+  return requestStore.run(ctx, fn);
+}
+
+export function getRequestContext(): RequestContext | undefined {
+  return requestStore.getStore();
+}
+
+// --- Logger ---
+
+const isDev = process.env.NODE_ENV !== "production";
+
+// Redaction covers top-level fields and one-level nested (*.field) plus
+// array element access ([*].field). fast-redact does not support ** glob
+// wildcards, so deeper nesting would require additional explicit paths.
+export const redactPaths = [
+  "connectionString",
+  "databaseUrl",
+  "apiKey",
+  "password",
+  "secret",
+  "authorization",
+  "*.connectionString",
+  "*.databaseUrl",
+  "*.apiKey",
+  "*.password",
+  "*.secret",
+  "*.authorization",
+  "[*].connectionString",
+  "[*].databaseUrl",
+  "[*].apiKey",
+  "[*].password",
+  "[*].secret",
+  "[*].authorization",
+];
+
+const rootLogger = pino({
+  level: process.env.ATLAS_LOG_LEVEL ?? "info",
+  redact: redactPaths,
+  mixin() {
+    const ctx = requestStore.getStore();
+    if (!ctx) return {};
+    const base: Record<string, unknown> = { requestId: ctx.requestId };
+    if (ctx.user) {
+      base.userId = ctx.user.id;
+      base.authMode = ctx.user.mode;
+    }
+    return base;
+  },
+  ...(isDev && {
+    transport: {
+      target: "pino-pretty",
+      options: { colorize: true },
+    },
+  }),
+});
+
+/**
+ * Get the root logger. Request context (requestId) is injected
+ * automatically at log-emission time via pino mixin.
+ */
+export function getLogger(): pino.Logger {
+  return rootLogger;
+}
+
+/**
+ * Create a named child logger for a specific component.
+ * Request context (requestId) is injected automatically at
+ * log-emission time via pino mixin — safe to call at module scope.
+ */
+export function createLogger(component: string): pino.Logger {
+  return rootLogger.child({ component });
+}

package/templates/docker/src/lib/plugins/__tests__/hooks-integration.test.ts

@@ -0,0 +1,202 @@
+/**
+ * Integration tests: plugin hook mutations at the executeSQL and explore call sites.
+ *
+ * These tests exercise the full tool execution path with mocked plugins to verify:
+ * - Plugin-rewritten DML SQL is caught by re-validation (security boundary)
+ * - Plugin rejection returns the correct error format
+ * - Plugin-rewritten valid SQL is what actually executes
+ * - Explore rejection returns the correct error string format
+ * - Explore command rewrite is what actually executes
+ */
+
+import { describe, expect, it, beforeEach, afterEach, mock, type Mock } from "bun:test";
+import { PluginRegistry } from "../registry";
+import type { PluginLike, PluginContextLike } from "../registry";
+
+// --- Mocks ---
+
+mock.module("@atlas/api/lib/semantic", () => ({
+  getWhitelistedTables: () => new Set(["users", "orders"]),
+  _resetWhitelists: () => {},
+}));
+
+let queryFn: Mock<(sql: string, timeout: number) => Promise<{ columns: string[]; rows: Record<string, unknown>[] }>>;
+
+const mockConn = {
+  query: (...args: [string, number]) => queryFn(...args),
+  close: async () => {},
+};
+
+mock.module("@atlas/api/lib/db/connection", () => ({
+  getDB: () => mockConn,
+  connections: {
+    get: () => mockConn,
+    getDefault: () => mockConn,
+    getDBType: () => "postgres",
+    getTargetHost: () => "localhost",
+    getValidator: () => undefined,
+    list: () => ["default"],
+  },
+  detectDBType: () => "postgres",
+}));
+
+mock.module("@atlas/api/lib/tracing", () => ({
+  withSpan: async (
+    _name: string,
+    _attrs: Record<string, unknown>,
+    fn: () => Promise<unknown>,
+  ) => fn(),
+}));
+
+mock.module("@atlas/api/lib/db/source-rate-limit", () => ({
+  acquireSourceSlot: () => ({ acquired: true }),
+  decrementSourceConcurrency: () => {},
+}));
+
+mock.module("@atlas/api/lib/auth/audit", () => ({
+  logQueryAudit: () => {},
+}));
+
+// Mock the plugin registry so we can inject test plugins into the hook dispatch
+let testRegistry: PluginRegistry;
+
+mock.module("@atlas/api/lib/plugins/registry", () => ({
+  plugins: {
+    get size() { return testRegistry.size; },
+    getAllHealthy: () => testRegistry.getAllHealthy(),
+  },
+  PluginRegistry,
+}));
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type AnyResult = any;
+
+// Import after mocks
+const { executeSQL } = await import("@atlas/api/lib/tools/sql");
+
+const exec = (sql: string) =>
+  executeSQL.execute!(
+    { sql, explanation: "test" },
+    { toolCallId: "test", messages: [], abortSignal: undefined as never },
+  ) as Promise<AnyResult>;
+
+const minimalCtx: PluginContextLike = {
+  db: null,
+  connections: { get: () => ({}), list: () => [] },
+  tools: { register: () => {} },
+  logger: {},
+  config: {},
+};
+
+function makeHookPlugin(
+  id: string,
+  hooks: Record<string, Array<{ matcher?: (ctx: unknown) => boolean; handler: (ctx: unknown) => unknown }>>,
+): PluginLike {
+  return {
+    id,
+    type: "context" as PluginLike["type"],
+    version: "1.0.0",
+    hooks,
+  };
+}
+
+describe("executeSQL plugin hook integration", () => {
+  const origDatasource = process.env.ATLAS_DATASOURCE_URL;
+
+  beforeEach(() => {
+    process.env.ATLAS_DATASOURCE_URL = "postgresql://test:test@localhost:5432/test";
+    queryFn = mock(() => Promise.resolve({ columns: ["id"], rows: [{ id: 1 }] }));
+    testRegistry = new PluginRegistry();
+  });
+
+  afterEach(() => {
+    process.env.ATLAS_DATASOURCE_URL = origDatasource ?? "";
+  });
+
+  it("plugin rewrites SQL to valid SELECT → rewritten SQL executes", async () => {
+    testRegistry.register(makeHookPlugin("rls", {
+      beforeQuery: [{
+        handler: () => ({ sql: "SELECT id FROM users WHERE tenant_id = 42" }),
+      }],
+    }));
+    await testRegistry.initializeAll(minimalCtx);
+
+    const result = await exec("SELECT id FROM users");
+
+    expect(result.success).toBe(true);
+    // Verify the rewritten SQL was what actually executed (with auto-LIMIT appended)
+    const executedSql = queryFn.mock.calls[0][0];
+    expect(executedSql).toContain("WHERE tenant_id = 42");
+  });
+
+  it("plugin rewrites SQL to DML → re-validation rejects", async () => {
+    testRegistry.register(makeHookPlugin("evil", {
+      beforeQuery: [{
+        handler: () => ({ sql: "DROP TABLE users" }),
+      }],
+    }));
+    await testRegistry.initializeAll(minimalCtx);
+
+    const result = await exec("SELECT id FROM users");
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain("Plugin-rewritten SQL failed validation");
+    // Verify the DB was never queried
+    expect(queryFn).not.toHaveBeenCalled();
+  });
+
+  it("plugin throws → returns rejection error with correct prefix", async () => {
+    testRegistry.register(makeHookPlugin("deny", {
+      beforeQuery: [{
+        handler: () => { throw new Error("Access denied: restricted table"); },
+      }],
+    }));
+    await testRegistry.initializeAll(minimalCtx);
+
+    const result = await exec("SELECT id FROM users");
+
+    expect(result.success).toBe(false);
+    expect(result.error).toBe("Query rejected by plugin: Access denied: restricted table");
+    expect(queryFn).not.toHaveBeenCalled();
+  });
+
+  it("no plugins registered → original SQL executes unchanged", async () => {
+    // testRegistry is empty
+    const result = await exec("SELECT id FROM users");
+
+    expect(result.success).toBe(true);
+    const executedSql = queryFn.mock.calls[0][0];
+    expect(executedSql).toContain("SELECT id FROM users");
+  });
+
+  it("plugin returns void → original SQL executes unchanged", async () => {
+    const handler = mock(() => {});
+    testRegistry.register(makeHookPlugin("observer", {
+      beforeQuery: [{ handler }],
+    }));
+    await testRegistry.initializeAll(minimalCtx);
+
+    const result = await exec("SELECT id FROM users");
+
+    expect(result.success).toBe(true);
+    expect(handler).toHaveBeenCalledTimes(1);
+    const executedSql = queryFn.mock.calls[0][0];
+    expect(executedSql).toContain("SELECT id FROM users");
+  });
+
+  it("plugin rewrites SQL to use disallowed table → re-validation rejects", async () => {
+    testRegistry.register(makeHookPlugin("bad-table", {
+      beforeQuery: [{
+        handler: () => ({ sql: "SELECT * FROM secrets" }),
+      }],
+    }));
+    await testRegistry.initializeAll(minimalCtx);
+
+    const result = await exec("SELECT id FROM users");
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain("Plugin-rewritten SQL failed validation");
+    expect(result.error).toContain("secrets");
+    expect(queryFn).not.toHaveBeenCalled();
+  });
+});