admindb 2.0.0 → 2.1.1

package/README.md

@@ -20,7 +20,7 @@
 
 ![Home dashboard](docs/screenshots/home.png)
 
-> 📸 **Visual Tour:** See [`docs/screenshots/`](docs/screenshots/) for screenshots of the Table Browser, Query Editor, Visual Schema Designer, Inline Grid Editor, and Multi-Database Manager.
+> 📸 **Visual Tour:** See [`docs/screenshots/`](docs/screenshots/) for screenshots of the Table Browser, Inline Grid Editor, Read-Only Mode, Query Workbench, Visual Schema Designer, Universal Data Inspector, Mock Data Seeder, and Multi-Database Manager.
 
 ---
 
@@ -73,7 +73,7 @@ admindb
 AdminDB features a clean, colorized CLI startup banner and streamlined, low-noise runtime logging:
 
 ```text
-  ⚡ AdminDB v2.0.0
+  ⚡ AdminDB v2.1.1
 
   ➜  Local:    http://localhost:45531/
   ➜  Network:  http://192.168.1.15:45531/

package/dist/app.d.ts

@@ -1,69 +1 @@
-import express from 'express';
-import type { IDatabase, PostgresOptions } from './db/types';
-import { DbManager } from './db/manager';
-import { type Logger, type LogLevel } from './utils/logger';
-import { type AuthConfig } from './auth';
-export interface AppOptions {
-    /** Path to the SQLite file (single-db mode) or connection string. Defaults to `admindb.db`. */
-    dbPath?: string;
-    /** PostgreSQL or database connection string (e.g. `postgresql://user:pass@host:5432/db`). */
-    connection?: string;
-    /** Explicit PostgreSQL connection options. */
-    pgOptions?: PostgresOptions;
-    /** URL prefix used by templates/static assets (e.g. `/admin`). Defaults to `''`. */
-    basePath?: string;
-    logger?: Logger;
-    logLevel?: LogLevel;
-    /** Provide an existing database instance (single-db embedding). */
-    db?: IDatabase;
-    /** Enable multi-database mode with a manager over a directory of `.db` files. */
-    manager?: DbManager;
-    /** Open the database read-only — all write routes are rejected with 403. */
-    readonly?: boolean;
-    /**
-     * Serverless mode flag.
-     * When enabled (or auto-detected in Vercel/AWS Lambda/Netlify/etc.),
-     * all write operations, mutations, schema alterations, and seeder generators
-     * are disabled, enforcing strict read-only safety for ephemeral environments.
-     *
-     * Defaults to `undefined` (auto-detected via environment).
-     */
-    serverless?: boolean;
-    /**
-     * Authentication configuration.
-     * - `true` (default): authentication enabled with default or env credentials.
-     * - `false`: completely disables authentication (no protection / developer's own auth).
-     * - `{ username, password, secret, ... }`: custom credentials and options.
-     */
-    auth?: boolean | AuthConfig;
-    /**
-     * Manager mode: show the filesystem file-browser on the databases landing
-     * page. Defaults to `true`. Set to `false` to disable browsing (e.g. when the
-     * server was started with specific database files only).
-     */
-    allowBrowse?: boolean;
-    /**
-     * Manager mode: restrict the file-browser to this folder (absolute path).
-     * When set, the browser cannot navigate above it and only databases inside it
-     * can be opened.
-     */
-    browseRoot?: string;
-    /** Internal: URL of the databases list (used by per-db apps to link "switch database"). */
-    databasesUrl?: string;
-    /** Internal: current database id (for locals/display). */
-    dbId?: string;
-}
-/**
- * Build a fully configured, mountable Express app (pages + JSON API + static
- * assets + view engine).
- *
- * - Single database: pass `dbPath` (or `db`). Mount under your own prefix with
- *   `basePath`. This is also the mode used per-database in multi-db mode.
- * - Multiple databases: pass a `manager`. The app then shows a "Databases"
- *   landing page and scopes every database under `/{dbFile}/…` (e.g.
- *   `/{base}/app.db/tables/users`, `/{base}/app.db/api/tables`).
- *
- * An Express app is valid middleware, so `app.use('/admin', createRouter({...}))`
- * works and shares the same port.
- */
-export declare function createRouter(options?: AppOptions): express.Express;
+import express from 'express';import type {IDatabase,PostgresOptions} from './db/types';import{DbManager} from './db/manager';import{type Logger,type LogLevel} from './utils/logger';import{type AuthConfig} from './auth';export interface AppOptions{dbPath?:string;connection?:string;pgOptions?:PostgresOptions;basePath?:string;logger?:Logger;logLevel?:LogLevel;db?:IDatabase;manager?:DbManager;readonly ?:boolean;serverless?:boolean;auth?:boolean|AuthConfig;allowBrowse?:boolean;browseRoot?:string;databasesUrl?:string;dbId?:string;}export declare function createRouter(options?:AppOptions):express.Express;

package/dist/app.js

@@ -1,257 +1 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createRouter = createRouter;
-const express_1 = __importDefault(require("express"));
-const node_path_1 = __importDefault(require("node:path"));
-const express_handlebars_1 = require("express-handlebars");
-const database_1 = require("./db/database");
-const postgres_1 = require("./db/postgres");
-const logger_1 = require("./utils/logger");
-const pages_1 = require("./routes/pages");
-const index_1 = require("./routes/api/index");
-const databases_1 = require("./routes/databases");
-const args_1 = require("./cli/args");
-const common_1 = require("./utils/common");
-const icons_1 = require("./utils/icons");
-const serverless_1 = require("./serverless");
-const auth_1 = require("./auth");
-/** Installed package version, exposed to every template as `{{version}}`. */
-const APP_VERSION = (0, args_1.getPackageVersion)();
-/**
- * Build a fully configured, mountable Express app (pages + JSON API + static
- * assets + view engine).
- *
- * - Single database: pass `dbPath` (or `db`). Mount under your own prefix with
- *   `basePath`. This is also the mode used per-database in multi-db mode.
- * - Multiple databases: pass a `manager`. The app then shows a "Databases"
- *   landing page and scopes every database under `/{dbFile}/…` (e.g.
- *   `/{base}/app.db/tables/users`, `/{base}/app.db/api/tables`).
- *
- * An Express app is valid middleware, so `app.use('/admin', createRouter({...}))`
- * works and shares the same port.
- */
-function createRouter(options = {}) {
-    return options.manager ? createManagerApp(options) : createSingleDbApp(options);
-}
-function setupViewEngine(app, _logger) {
-    app.engine('hbs', (0, express_handlebars_1.engine)({
-        extname: '.hbs',
-        defaultLayout: 'main',
-        layoutsDir: node_path_1.default.join(__dirname, 'views', 'layouts'),
-        partialsDir: node_path_1.default.join(__dirname, 'views', 'partials'),
-        helpers: {
-            eq: (a, b) => a === b,
-            startsWith: (a, b) => String(a ?? '').startsWith(String(b ?? '')),
-            isNull: (v) => v === null || v === undefined,
-            truncate: (v, n) => {
-                const s = v == null ? '' : String(v);
-                return s.length > n ? `${s.slice(0, n)}…` : s;
-            },
-            json: (v) => (JSON.stringify(v ?? null) ?? 'null').replace(/</g, '\\u003c'),
-            add: (a, b) => Number(a) + Number(b),
-            sub: (a, b) => Number(a) - Number(b),
-            gt: (a, b) => Number(a) > Number(b),
-            lt: (a, b) => Number(a) < Number(b),
-            join: (arr, sep) => (Array.isArray(arr) ? arr.join(String(sep ?? ',')) : String(arr ?? '')),
-            icon: (name, options) => {
-                const customClass = (options && options.hash && options.hash.class) || undefined;
-                return (0, icons_1.renderIcon)(String(name ?? ''), customClass);
-            },
-        },
-    }));
-    app.set('view engine', 'hbs');
-    app.set('views', node_path_1.default.join(__dirname, 'views'));
-}
-function addErrorHandlers(app, logger) {
-    // 404 handler.
-    app.use((req, res) => {
-        if (req.path.startsWith('/api/')) {
-            return res.status(404).json({ success: false, error: 'Not found.' });
-        }
-        res.status(404).render('pages/error', { title: 'Not found', status: 404, error: 'The page you requested does not exist.' });
-    });
-    // Central error handler.
-    app.use((err, req, res, _next) => {
-        logger.error('Unhandled error', err);
-        if (req.path.startsWith('/api/')) {
-            return res.status(500).json({ success: false, error: (0, common_1.errorMessage)(err) });
-        }
-        res.status(500).render('pages/error', { title: 'Error', status: 500, error: (0, common_1.errorMessage)(err) });
-    });
-}
-/** Single-database app (also used as the per-database app in multi-db mode). */
-function createSingleDbApp(options) {
-    const isServerless = options.serverless !== undefined ? options.serverless : (0, serverless_1.isServerlessEnvironment)();
-    const rawTarget = options.connection || options.dbPath || '';
-    const isPg = Boolean(options.pgOptions) ||
-        (typeof rawTarget === 'string' && (rawTarget.startsWith('postgres://') || rawTarget.startsWith('postgresql://'))) ||
-        options.db?.dialect === 'postgres';
-    // In serverless environments, SQLite local files are ephemeral/read-only,
-    // whereas PostgreSQL connects to a remote networked database and is fully editable.
-    const readonly = options.readonly !== undefined
-        ? Boolean(options.readonly)
-        : (isServerless && !isPg);
-    const basePath = (options.basePath ?? '').replace(/\/+$/, '');
-    const logger = options.logger ?? (0, logger_1.createLogger)(options.logLevel ?? 'info', 'admindb');
-    let db;
-    if (options.db) {
-        db = options.db;
-    }
-    else {
-        if (isPg) {
-            const conn = options.pgOptions || rawTarget;
-            db = new postgres_1.PostgresDatabase(conn, logger, { readonly });
-        }
-        else {
-            db = new database_1.SqliteDatabase(options.dbPath ?? 'admindb.db', logger, { readonly });
-        }
-    }
-    const databasesUrl = options.databasesUrl;
-    const authConfig = (0, auth_1.resolveAuthConfig)(options.auth);
-    const router = (0, express_1.default)();
-    router.disable('x-powered-by');
-    // Static assets (relative to the mount point, so a prefix "just works").
-    router.use(express_1.default.static(node_path_1.default.join(__dirname, 'public')));
-    setupViewEngine(router, logger);
-    router.use(express_1.default.json({ limit: '10mb' }));
-    router.use(express_1.default.urlencoded({ extended: false }));
-    // Register authentication endpoints (/login, /logout)
-    (0, auth_1.registerAuthRoutes)(router, authConfig, basePath, logger);
-    // Authentication gatekeeper middleware
-    router.use((0, auth_1.createAuthMiddleware)(authConfig, basePath, logger));
-    // Page locals (skipped for API + static paths).
-    router.use(async (req, res, next) => {
-        try {
-            res.locals.basePath = basePath;
-            res.locals.currentPath = req.path;
-            res.locals.currentTable = null;
-            res.locals.dbPath = db.path;
-            res.locals.dbId = options.dbId ?? (db.dialect === 'postgres' ? 'PostgreSQL' : (node_path_1.default.basename(db.path) || 'SQLite'));
-            res.locals.dialect = db.dialect;
-            res.locals.isPostgres = db.dialect === 'postgres';
-            res.locals.isSqlite = db.dialect === 'sqlite';
-            res.locals.dialectName = db.dialect === 'postgres' ? 'PostgreSQL' : 'SQLite';
-            res.locals.databasesUrl = databasesUrl ?? null;
-            res.locals.databasesMode = false;
-            res.locals.readonly = db.isReadOnly;
-            res.locals.serverless = isServerless;
-            res.locals.version = APP_VERSION;
-            res.locals.authEnabled = authConfig.enabled;
-            res.locals.isDefaultPassword = authConfig.isDefaultPassword;
-            if (!req.path.startsWith('/api/')) {
-                const all = await db.listTables();
-                const names = (all.data ?? []).map((t) => t.name);
-                res.locals.tables = names.filter((n) => !n.startsWith('_'));
-                res.locals.internalTables = names.filter((n) => n.startsWith('_'));
-            }
-            next();
-        }
-        catch (err) {
-            next(err);
-        }
-    });
-    (0, pages_1.registerPages)(router, { db, logger });
-    (0, index_1.registerApi)(router, { db, logger });
-    addErrorHandlers(router, logger);
-    return router;
-}
-/** Multi-database app: databases landing page + a per-database sub-app per file. */
-function createManagerApp(options) {
-    const isServerless = options.serverless !== undefined ? options.serverless : (0, serverless_1.isServerlessEnvironment)();
-    const readonly = isServerless || Boolean(options.readonly);
-    const manager = options.manager;
-    const basePath = (options.basePath ?? '').replace(/\/+$/, '');
-    const logger = options.logger ?? (0, logger_1.createLogger)(options.logLevel ?? 'info', 'admindb');
-    const authConfig = (0, auth_1.resolveAuthConfig)(options.auth);
-    const app = (0, express_1.default)();
-    app.disable('x-powered-by');
-    app.use(express_1.default.static(node_path_1.default.join(__dirname, 'public')));
-    setupViewEngine(app, logger);
-    app.use(express_1.default.json({ limit: '10mb' }));
-    app.use(express_1.default.urlencoded({ extended: false }));
-    // Register authentication endpoints (/login, /logout)
-    (0, auth_1.registerAuthRoutes)(app, authConfig, basePath, logger);
-    // Authentication gatekeeper middleware
-    app.use((0, auth_1.createAuthMiddleware)(authConfig, basePath, logger));
-    // Locals for the databases landing page.
-    app.use(async (req, res, next) => {
-        try {
-            res.locals.basePath = basePath;
-            res.locals.currentPath = req.path;
-            res.locals.currentTable = null;
-            res.locals.dbPath = manager.directory;
-            res.locals.dbId = null;
-            res.locals.databasesUrl = null;
-            res.locals.databasesMode = true;
-            res.locals.readonly = readonly;
-            res.locals.serverless = isServerless;
-            res.locals.version = APP_VERSION;
-            res.locals.authEnabled = authConfig.enabled;
-            res.locals.isDefaultPassword = authConfig.isDefaultPassword;
-            if (!req.path.startsWith('/api/')) {
-                res.locals.tables = [];
-                res.locals.internalTables = [];
-            }
-            next();
-        }
-        catch (err) {
-            next(err);
-        }
-    });
-    // Per-database dispatch: mount a cached single-db app at /:dbId.
-    const subApps = new Map();
-    (0, databases_1.registerDatabasesRoutes)(app, {
-        manager,
-        logger,
-        basePath,
-        readonly,
-        allowBrowse: isServerless ? false : options.allowBrowse,
-        browseRoot: options.browseRoot,
-        invalidate: (id) => subApps.delete(id),
-    });
-    app.use('/:dbId', (req, res, next) => {
-        const dbId = String(req.params.dbId);
-        if (!manager.has(dbId)) {
-            if (req.path.startsWith('/api/')) {
-                return res.status(404).json({ success: false, error: `Database "${dbId}" does not exist.` });
-            }
-            return res.status(404).render('pages/error', {
-                title: 'Not found',
-                status: 404,
-                error: `Database "${dbId}" does not exist.`,
-            });
-        }
-        const rawRo = req.query.readonly;
-        if (rawRo !== undefined) {
-            const explicitRo = rawRo === '1' || rawRo === 'true';
-            if (!readonly || explicitRo) {
-                manager.setReadonly(dbId, explicitRo);
-                subApps.delete(dbId);
-            }
-        }
-        let sub = subApps.get(dbId);
-        if (!sub) {
-            const subBase = `${basePath ? basePath : ''}/${encodeURIComponent(dbId)}`;
-            const effectiveRo = readonly || manager.isDbReadOnly(dbId);
-            sub = createSingleDbApp({
-                db: manager.open(dbId, effectiveRo),
-                basePath: subBase,
-                logger,
-                logLevel: options.logLevel,
-                dbId,
-                databasesUrl: `${basePath ? basePath : ''}/`,
-                readonly: effectiveRo,
-                serverless: isServerless,
-                auth: authConfig,
-            });
-            subApps.set(dbId, sub);
-        }
-        return sub(req, res, next);
-    });
-    addErrorHandlers(app, logger);
-    return app;
-}
-//# sourceMappingURL=app.js.map
+var __importDefault=this&&this.__importDefault||function(mod){return mod&&mod.__esModule?mod:{default:mod}};Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRouter=function(options={}){return options.manager?function(options){const isServerless=void 0!==options.serverless?options.serverless:(0,serverless_1.isServerlessEnvironment)(),readonly=isServerless||Boolean(options.readonly),manager=options.manager,basePath=(options.basePath??"").replace(/\/+$/,""),logger=options.logger??(0,logger_1.createLogger)(options.logLevel??"info","admindb"),authConfig=(0,auth_1.resolveAuthConfig)(options.auth),app=(0,express_1.default)();app.disable("x-powered-by"),app.use(express_1.default.static(node_path_1.default.join(__dirname,"public"))),setupViewEngine(app,logger),app.use(express_1.default.json({limit:"10mb"})),app.use(express_1.default.urlencoded({extended:!1})),(0,auth_1.registerAuthRoutes)(app,authConfig,basePath,logger),app.use((0,auth_1.createAuthMiddleware)(authConfig,basePath,logger)),app.use(async(req,res,next)=>{try{res.locals.basePath=basePath,res.locals.currentPath=req.path,res.locals.currentTable=null,res.locals.dbPath=manager.directory,res.locals.dbId=null,res.locals.databasesUrl=null,res.locals.databasesMode=!0,res.locals.readonly=readonly,res.locals.serverless=isServerless,res.locals.version=APP_VERSION,res.locals.authEnabled=authConfig.enabled,res.locals.isDefaultPassword=authConfig.isDefaultPassword,req.path.startsWith("/api/")||(res.locals.tables=[],res.locals.internalTables=[]),next()}catch(err){next(err)}});const subApps=new Map;return(0,databases_1.registerDatabasesRoutes)(app,{manager:manager,logger:logger,basePath:basePath,readonly:readonly,allowBrowse:!isServerless&&options.allowBrowse,browseRoot:options.browseRoot,invalidate:id=>subApps.delete(id)}),app.use("/:dbId",(req,res,next)=>{const dbId=String(req.params.dbId);if(!manager.has(dbId))return req.path.startsWith("/api/")?res.status(404).json({success:!1,error:`Database "${dbId}" does not exist.`}):res.status(404).render("pages/error",{title:"Not found",status:404,error:`Database "${dbId}" does not exist.`});const rawRo=req.query.readonly;if(void 0!==rawRo){const explicitRo="1"===rawRo||"true"===rawRo;readonly&&!explicitRo||(manager.setReadonly(dbId,explicitRo),subApps.delete(dbId))}let sub=subApps.get(dbId);if(!sub){const subBase=`${basePath||""}/${encodeURIComponent(dbId)}`,effectiveRo=readonly||manager.isDbReadOnly(dbId);sub=createSingleDbApp({db:manager.open(dbId,effectiveRo),basePath:subBase,logger:logger,logLevel:options.logLevel,dbId:dbId,databasesUrl:`${basePath||""}/`,readonly:effectiveRo,serverless:isServerless,auth:authConfig}),subApps.set(dbId,sub)}return sub(req,res,next)}),addErrorHandlers(app,logger),app}(options):createSingleDbApp(options)};const express_1=__importDefault(require("express")),node_path_1=__importDefault(require("node:path")),express_handlebars_1=require("express-handlebars"),database_1=require("./db/database"),postgres_1=require("./db/postgres"),logger_1=require("./utils/logger"),pages_1=require("./routes/pages"),index_1=require("./routes/api/index"),databases_1=require("./routes/databases"),args_1=require("./cli/args"),common_1=require("./utils/common"),icons_1=require("./utils/icons"),serverless_1=require("./serverless"),auth_1=require("./auth"),APP_VERSION=(0,args_1.getPackageVersion)();function setupViewEngine(app,_logger){app.engine("hbs",(0,express_handlebars_1.engine)({extname:".hbs",defaultLayout:"main",layoutsDir:node_path_1.default.join(__dirname,"views","layouts"),partialsDir:node_path_1.default.join(__dirname,"views","partials"),helpers:{eq:(a,b)=>a===b,startsWith:(a,b)=>String(a??"").startsWith(String(b??"")),isNull:v=>null==v,truncate:(v,n)=>{const s=null==v?"":String(v);return s.length>n?`${s.slice(0,n)}…`:s},json:v=>(JSON.stringify(v??null)??"null").replace(/</g,"\\u003c"),add:(a,b)=>Number(a)+Number(b),sub:(a,b)=>Number(a)-Number(b),gt:(a,b)=>Number(a)>Number(b),lt:(a,b)=>Number(a)<Number(b),join:(arr,sep)=>Array.isArray(arr)?arr.join(String(sep??",")):String(arr??""),icon:(name,options)=>{const customClass=options&&options.hash&&options.hash.class||void 0;return(0,icons_1.renderIcon)(String(name??""),customClass)}}})),app.set("view engine","hbs"),app.set("views",node_path_1.default.join(__dirname,"views"))}function addErrorHandlers(app,logger){app.use((req,res)=>{if(req.path.startsWith("/api/"))return res.status(404).json({success:!1,error:"Not found."});res.status(404).render("pages/error",{title:"Not found",status:404,error:"The page you requested does not exist."})}),app.use((err,req,res,_next)=>{if(logger.error("Unhandled error",err),req.path.startsWith("/api/"))return res.status(500).json({success:!1,error:(0,common_1.errorMessage)(err)});res.status(500).render("pages/error",{title:"Error",status:500,error:(0,common_1.errorMessage)(err)})})}function createSingleDbApp(options){const isServerless=void 0!==options.serverless?options.serverless:(0,serverless_1.isServerlessEnvironment)(),rawTarget=options.connection||options.dbPath||"",isPg=Boolean(options.pgOptions)||"string"==typeof rawTarget&&(rawTarget.startsWith("postgres://")||rawTarget.startsWith("postgresql://"))||"postgres"===options.db?.dialect,readonly=void 0!==options.readonly?Boolean(options.readonly):isServerless&&!isPg,basePath=(options.basePath??"").replace(/\/+$/,""),logger=options.logger??(0,logger_1.createLogger)(options.logLevel??"info","admindb");let db;if(options.db)db=options.db;else if(isPg){const conn=options.pgOptions||rawTarget;db=new postgres_1.PostgresDatabase(conn,logger,{readonly:readonly})}else db=new database_1.SqliteDatabase(options.dbPath??"admindb.db",logger,{readonly:readonly});const databasesUrl=options.databasesUrl,authConfig=(0,auth_1.resolveAuthConfig)(options.auth),router=(0,express_1.default)();return router.disable("x-powered-by"),router.use(express_1.default.static(node_path_1.default.join(__dirname,"public"))),setupViewEngine(router),router.use(express_1.default.json({limit:"10mb"})),router.use(express_1.default.urlencoded({extended:!1})),(0,auth_1.registerAuthRoutes)(router,authConfig,basePath,logger),router.use((0,auth_1.createAuthMiddleware)(authConfig,basePath,logger)),router.use(async(req,res,next)=>{try{if(res.locals.basePath=basePath,res.locals.currentPath=req.path,res.locals.currentTable=null,res.locals.dbPath=db.path,res.locals.dbId=options.dbId??("postgres"===db.dialect?"PostgreSQL":node_path_1.default.basename(db.path)||"SQLite"),res.locals.dialect=db.dialect,res.locals.isPostgres="postgres"===db.dialect,res.locals.isSqlite="sqlite"===db.dialect,res.locals.dialectName="postgres"===db.dialect?"PostgreSQL":"SQLite",res.locals.databasesUrl=databasesUrl??null,res.locals.databasesMode=!1,res.locals.readonly=db.isReadOnly,res.locals.serverless=isServerless,res.locals.version=APP_VERSION,res.locals.authEnabled=authConfig.enabled,res.locals.isDefaultPassword=authConfig.isDefaultPassword,!req.path.startsWith("/api/")){const names=((await db.listTables()).data??[]).map(t=>t.name);res.locals.tables=names.filter(n=>!n.startsWith("_")),res.locals.internalTables=names.filter(n=>n.startsWith("_"))}next()}catch(err){next(err)}}),(0,pages_1.registerPages)(router,{db:db,logger:logger}),(0,index_1.registerApi)(router,{db:db,logger:logger}),addErrorHandlers(router,logger),router}

package/dist/auth/config.d.ts

@@ -1,19 +1 @@
-import { type AuthConfig, type ResolvedAuthConfig } from './types';
-/**
- * Clears the in-memory fallback secret cache (primarily for testing).
- */
-export declare function resetPersistentSecretCache(): void;
-/**
- * Returns a persistent secret key for signing session cookies.
- *
- * Priority order:
- * 1. `ADMINDB_SECRET` or `SESSION_SECRET` environment variables.
- * 2. `ADMINDB_SECRET_FILE` path if specified in environment.
- * 3. User home directory `.admindb-secret` (or temp directory if home is not writable).
- * 4. In-memory random fallback if filesystem is completely read-only.
- */
-export declare function getOrCreatePersistentSecret(env?: NodeJS.ProcessEnv): string;
-/**
- * Resolves the authentication options against environment variables.
- */
-export declare function resolveAuthConfig(optionsAuth?: boolean | AuthConfig, env?: NodeJS.ProcessEnv): ResolvedAuthConfig;
+import{type AuthConfig,type ResolvedAuthConfig} from './types';export declare function resetPersistentSecretCache():void;export declare function getOrCreatePersistentSecret(env?:NodeJS.ProcessEnv):string;export declare function resolveAuthConfig(optionsAuth?:boolean|AuthConfig,env?:NodeJS.ProcessEnv):ResolvedAuthConfig;

package/dist/auth/config.js

@@ -1,147 +1 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.resetPersistentSecretCache = resetPersistentSecretCache;
-exports.getOrCreatePersistentSecret = getOrCreatePersistentSecret;
-exports.resolveAuthConfig = resolveAuthConfig;
-const node_crypto_1 = require("node:crypto");
-const node_fs_1 = require("node:fs");
-const node_os_1 = __importDefault(require("node:os"));
-const node_path_1 = __importDefault(require("node:path"));
-const types_1 = require("./types");
-// In-memory cache of resolved secret to avoid repeated disk reads per process
-let cachedFallbackSecret = null;
-/**
- * Clears the in-memory fallback secret cache (primarily for testing).
- */
-function resetPersistentSecretCache() {
-    cachedFallbackSecret = null;
-}
-/**
- * Returns a persistent secret key for signing session cookies.
- *
- * Priority order:
- * 1. `ADMINDB_SECRET` or `SESSION_SECRET` environment variables.
- * 2. `ADMINDB_SECRET_FILE` path if specified in environment.
- * 3. User home directory `.admindb-secret` (or temp directory if home is not writable).
- * 4. In-memory random fallback if filesystem is completely read-only.
- */
-function getOrCreatePersistentSecret(env = process.env) {
-    const envSecret = env.ADMINDB_SECRET ?? env.SESSION_SECRET;
-    if (envSecret && String(envSecret).trim()) {
-        return String(envSecret).trim();
-    }
-    // If a custom secret file is specified, don't use default home cache
-    const customSecretFile = env.ADMINDB_SECRET_FILE ? String(env.ADMINDB_SECRET_FILE).trim() : undefined;
-    if (!customSecretFile && cachedFallbackSecret) {
-        return cachedFallbackSecret;
-    }
-    const candidatePaths = [];
-    if (customSecretFile) {
-        candidatePaths.push(node_path_1.default.resolve(customSecretFile));
-    }
-    else {
-        try {
-            const home = node_os_1.default.homedir();
-            if (home) {
-                candidatePaths.push(node_path_1.default.join(home, '.admindb-secret'));
-            }
-        }
-        catch {
-            /* ignore */
-        }
-        try {
-            const tmp = node_os_1.default.tmpdir();
-            if (tmp) {
-                candidatePaths.push(node_path_1.default.join(tmp, '.admindb-secret'));
-            }
-        }
-        catch {
-            /* ignore */
-        }
-    }
-    // 1. Try reading existing secret from candidate paths
-    for (const filePath of candidatePaths) {
-        try {
-            if ((0, node_fs_1.existsSync)(filePath)) {
-                const content = (0, node_fs_1.readFileSync)(filePath, 'utf8').trim();
-                if (content.length >= 16) {
-                    if (!customSecretFile) {
-                        cachedFallbackSecret = content;
-                    }
-                    return content;
-                }
-            }
-        }
-        catch {
-            // Continue to next candidate or write attempt
-        }
-    }
-    // 2. Generate new secret and attempt writing to the first writable candidate path
-    const newSecret = (0, node_crypto_1.randomBytes)(32).toString('hex');
-    for (const filePath of candidatePaths) {
-        try {
-            const dir = node_path_1.default.dirname(filePath);
-            if (!(0, node_fs_1.existsSync)(dir)) {
-                (0, node_fs_1.mkdirSync)(dir, { recursive: true });
-            }
-            (0, node_fs_1.writeFileSync)(filePath, newSecret, { encoding: 'utf8', mode: 0o600 });
-            if (!customSecretFile) {
-                cachedFallbackSecret = newSecret;
-            }
-            return newSecret;
-        }
-        catch {
-            // Continue to next candidate if write fails
-        }
-    }
-    // 3. Last-resort fallback to in-memory secret if disk is not writable
-    if (!customSecretFile) {
-        cachedFallbackSecret = newSecret;
-    }
-    return newSecret;
-}
-/**
- * Resolves the authentication options against environment variables.
- */
-function resolveAuthConfig(optionsAuth, env = process.env) {
-    // Check if explicitly disabled via options or environment variable
-    const envDisabled = ['0', 'false', 'no', 'off'].includes(String(env.ADMINDB_AUTH ?? '').trim().toLowerCase()) ||
-        ['1', 'true', 'yes'].includes(String(env.ADMINDB_NO_AUTH ?? env.ADMINDB_DISABLE_AUTH ?? '').trim().toLowerCase());
-    let enabled = true;
-    let username = (env.ADMINDB_USERNAME ?? env.ADMINDB_USER) ? String(env.ADMINDB_USERNAME ?? env.ADMINDB_USER).trim() : types_1.DEFAULT_USERNAME;
-    let password = (env.ADMINDB_PASSWORD ?? env.ADMINDB_PASS) ? String(env.ADMINDB_PASSWORD ?? env.ADMINDB_PASS).trim() : types_1.DEFAULT_PASSWORD_HASH;
-    let secret = (env.ADMINDB_SECRET ?? env.SESSION_SECRET)
-        ? String(env.ADMINDB_SECRET ?? env.SESSION_SECRET).trim()
-        : getOrCreatePersistentSecret(env);
-    let sessionDurationMs = types_1.DEFAULT_SESSION_DURATION_MS;
-    if (optionsAuth === false || envDisabled) {
-        enabled = false;
-    }
-    else if (typeof optionsAuth === 'object' && optionsAuth !== null) {
-        if (optionsAuth.enabled === false)
-            enabled = false;
-        if (optionsAuth.username !== undefined)
-            username = String(optionsAuth.username).trim();
-        if (optionsAuth.password !== undefined)
-            password = String(optionsAuth.password).trim();
-        if (optionsAuth.secret !== undefined && String(optionsAuth.secret).trim()) {
-            secret = String(optionsAuth.secret).trim();
-        }
-        if (optionsAuth.sessionDurationMs !== undefined)
-            sessionDurationMs = optionsAuth.sessionDurationMs;
-    }
-    const isDefaultPassword = username === types_1.DEFAULT_USERNAME &&
-        (password === types_1.DEFAULT_PASSWORD_HASH || password === 'admin');
-    return {
-        enabled,
-        username,
-        password,
-        secret,
-        sessionDurationMs,
-        isDefaultPassword,
-    };
-}
-//# sourceMappingURL=config.js.map
+var __importDefault=this&&this.__importDefault||function(mod){return mod&&mod.__esModule?mod:{default:mod}};Object.defineProperty(exports,"__esModule",{value:!0}),exports.resetPersistentSecretCache=function(){cachedFallbackSecret=null},exports.getOrCreatePersistentSecret=getOrCreatePersistentSecret,exports.resolveAuthConfig=function(optionsAuth,env=process.env){const envDisabled=["0","false","no","off"].includes(String(env.ADMINDB_AUTH??"").trim().toLowerCase())||["1","true","yes"].includes(String(env.ADMINDB_NO_AUTH??env.ADMINDB_DISABLE_AUTH??"").trim().toLowerCase());let enabled=!0,username=env.ADMINDB_USERNAME??env.ADMINDB_USER?String(env.ADMINDB_USERNAME??env.ADMINDB_USER).trim():types_1.DEFAULT_USERNAME,password=env.ADMINDB_PASSWORD??env.ADMINDB_PASS?String(env.ADMINDB_PASSWORD??env.ADMINDB_PASS).trim():types_1.DEFAULT_PASSWORD_HASH,secret=env.ADMINDB_SECRET??env.SESSION_SECRET?String(env.ADMINDB_SECRET??env.SESSION_SECRET).trim():getOrCreatePersistentSecret(env),sessionDurationMs=types_1.DEFAULT_SESSION_DURATION_MS;!1===optionsAuth||envDisabled?enabled=!1:"object"==typeof optionsAuth&&null!==optionsAuth&&(!1===optionsAuth.enabled&&(enabled=!1),void 0!==optionsAuth.username&&(username=String(optionsAuth.username).trim()),void 0!==optionsAuth.password&&(password=String(optionsAuth.password).trim()),void 0!==optionsAuth.secret&&String(optionsAuth.secret).trim()&&(secret=String(optionsAuth.secret).trim()),void 0!==optionsAuth.sessionDurationMs&&(sessionDurationMs=optionsAuth.sessionDurationMs));const isDefaultPassword=username===types_1.DEFAULT_USERNAME&&(password===types_1.DEFAULT_PASSWORD_HASH||"admin"===password);return{enabled:enabled,username:username,password:password,secret:secret,sessionDurationMs:sessionDurationMs,isDefaultPassword:isDefaultPassword}};const node_crypto_1=require("node:crypto"),node_fs_1=require("node:fs"),node_os_1=__importDefault(require("node:os")),node_path_1=__importDefault(require("node:path")),types_1=require("./types");let cachedFallbackSecret=null;function getOrCreatePersistentSecret(env=process.env){const envSecret=env.ADMINDB_SECRET??env.SESSION_SECRET;if(envSecret&&String(envSecret).trim())return String(envSecret).trim();const customSecretFile=env.ADMINDB_SECRET_FILE?String(env.ADMINDB_SECRET_FILE).trim():void 0;if(!customSecretFile&&cachedFallbackSecret)return cachedFallbackSecret;const candidatePaths=[];if(customSecretFile)candidatePaths.push(node_path_1.default.resolve(customSecretFile));else{try{const home=node_os_1.default.homedir();home&&candidatePaths.push(node_path_1.default.join(home,".admindb-secret"))}catch{}try{const tmp=node_os_1.default.tmpdir();tmp&&candidatePaths.push(node_path_1.default.join(tmp,".admindb-secret"))}catch{}}for(const filePath of candidatePaths)try{if((0,node_fs_1.existsSync)(filePath)){const content=(0,node_fs_1.readFileSync)(filePath,"utf8").trim();if(content.length>=16)return customSecretFile||(cachedFallbackSecret=content),content}}catch{}const newSecret=(0,node_crypto_1.randomBytes)(32).toString("hex");for(const filePath of candidatePaths)try{const dir=node_path_1.default.dirname(filePath);return(0,node_fs_1.existsSync)(dir)||(0,node_fs_1.mkdirSync)(dir,{recursive:!0}),(0,node_fs_1.writeFileSync)(filePath,newSecret,{encoding:"utf8",mode:384}),customSecretFile||(cachedFallbackSecret=newSecret),newSecret}catch{}return customSecretFile||(cachedFallbackSecret=newSecret),newSecret}

package/dist/auth/crypto.d.ts

@@ -1,27 +1 @@
-/**
- * Generates a secure scrypt password hash with a random or provided salt.
- * Format: `scrypt:<saltHex>:<derivedKeyHex>`
- */
-export declare function hashPassword(password: string, salt?: string): string;
-/**
- * Constant-time comparison between two strings to prevent timing attacks.
- */
-export declare function constantTimeCompare(a: string, b: string): boolean;
-/**
- * Verifies a candidate plaintext password against a stored password or scrypt hash.
- */
-export declare function verifyPassword(candidatePassword: string, storedPasswordOrHash: string): boolean;
-/**
- * Parses raw Cookie header string into key-value map.
- */
-export declare function parseCookies(cookieHeader?: string): Record<string, string>;
-/**
- * Creates a tamper-proof signed session token using HMAC-SHA256.
- * Format: `<base64url(username)>.<expiresAtTimestamp>.<hmacSignature>`
- */
-export declare function createSessionToken(username: string, secret: string, durationMs?: number): string;
-/**
- * Verifies a signed session token in constant time.
- * Returns the authenticated username if valid and non-expired, or null otherwise.
- */
-export declare function verifySessionToken(token: string, secret: string, expectedUser?: string): string | null;
+export declare function hashPassword(password:string,salt?:string):string;export declare function constantTimeCompare(a:string,b:string):boolean;export declare function verifyPassword(candidatePassword:string,storedPasswordOrHash:string):boolean;export declare function parseCookies(cookieHeader?:string):Record<string,string>;export declare function createSessionToken(username:string,secret:string,durationMs?:number):string;export declare function verifySessionToken(token:string,secret:string,expectedUser?:string):string|null;