admindb 2.1.0 → 2.2.1

package/README.md

@@ -10,10 +10,12 @@
 
 - **SQLite & PostgreSQL Multi-Engine:** Seamlessly manage local SQLite files, remote PostgreSQL connections, or multi-database environments with distinct engine badges and credentials protection.
 - **Secure JSON Config Files:** Pass database credentials securely in `.json` files (`name.postgres.json`) without exposing secrets on the CLI.
-- **Zero frontend build step:** Server-rendered Handlebars UI + vanilla JS + Tailwind/DaisyUI; a single lightweight Express process serves pages, static assets, and the REST API.
+- **Zero frontend build step:** Server-rendered Handlebars UI + vanilla JS + heavily refined DaisyUI/TailwindCSS styling; a single lightweight Express process serves pages, static assets, and the REST API.
 - **Standalone CLI or embeddable library:** Run instantly via `npx admindb` or mount it directly into your existing Express application under any subpath.
+- **Intelligent SQL Error Analyzer:** Intercepts raw SQL errors and provides human-readable explanations and suggested fixes for syntax errors, missing columns, and constraint violations.
 - **Modern terminal experience:** Clean, colorized startup banner with auto-detected local/network URLs and streamlined runtime logs.
 - **Rich Data Types & Calendar Controls:** In-place calendar pickers with presets (`Now`, `Yesterday`, `Tomorrow`, `+7 Days`, `+30 Days`), PostgreSQL Array chip managers, JSON modal inspector, UUID generators, and byte dump inspector.
+- **Interactive ER Diagram & Relationship Graph:** Interactive SVG schema visualizer with 3 layout modes (Hierarchy, Force, Circular), relationship filtering, hover edge inspectors, and clean SVG export.
 - **Safe SQL by construction:** Quoted identifiers, escaped literals, parameterized queries, and non-executing SQL preview modes.
 
 ---
@@ -73,7 +75,7 @@ admindb
 AdminDB features a clean, colorized CLI startup banner and streamlined, low-noise runtime logging:
 
 ```text
-  ⚡ AdminDB v2.1.0
+  ⚡ AdminDB v2.2.1
 
   ➜  Local:    http://localhost:45531/
   ➜  Network:  http://192.168.1.15:45531/
@@ -126,16 +128,28 @@ Runtime operations produce crisp, color-coded status logs:
 * **Full Database Dump:** Download the entire database as a standard SQL file (`CREATE TABLE` + `INSERT` statements).
 
 ### 🗂️ Visual Schema Designer & Indexes
+* **Database Info & Settings:** View active database configuration parameters (e.g. `journal_mode`, `max_connections`) and a complete database-wide syntax-highlighted Schema DDL extraction with an easy 1-click copy tool.
 * **Visual Table Designer:** Create tables interactively with column types (including `UUID`, `JSONB`, `TIMESTAMP`, `TIMESTAMPTZ`, `INTERVAL`, `BYTEA`, `INET`, `SERIAL`, `BIGINT`), primary keys, autoincrement, nullable/unique constraints, default values, and foreign keys.
 * **Relationship-Safe Schema Editor:** Rename tables, add columns, modify column types, rename columns, and drop columns/tables with safety checks to protect active foreign keys and unique constraints.
 * **Index Manager:** Create single or multi-column indexes (plain or unique) with live SQL previews, and drop existing indexes safely.
 
+### 📊 Interactive ER Diagram & Relationship Visualization
+* **3 Layout Modes:**
+  * **Hierarchy (default):** Layered topological layout organizing master/root tables on the left with dependencies progressing to the right, barycenter-sorted to minimize edge crossings.
+  * **Force-Directed:** Organic physics simulation balancing node repulsion and edge spring tension.
+  * **Circular:** Clean circular arrangement for connected tables with isolated/unreferenced tables placed cleanly in a side column.
+* **Interactive Canvas & Controls:** Smooth zoom & pan, node dragging, minimap overview, live table search filter with auto-pan, compact mode toggle, and keyboard shortcuts (<kbd>F</kbd> fit, <kbd>L</kbd> cycle layout, <kbd>C</kbd> compact).
+* **Relationship Highlighting & Inspector:** Select any table to highlight its incoming & outgoing foreign-key connections with dimmed backdrop, hover relationship curves to inspect column mappings, and access direct Schema / Browse shortcuts from the sliding side panel or right-click context menu.
+* **Standalone SVG Export:** Export clean, production-ready SVG diagrams with inlined styling and proper viewBox bounds for documentation and architecture reviews.
+
 ### 🔄 Import, Export & Seed Data Generation
 * **CSV Import:** Upload or paste CSV files with column matching, executed transactionally.
 * **Data Export:** Download table data or arbitrary SQL query results as CSV or JSON.
 * **Intelligent Seed Generator:** Populate tables with up to 5,000 realistic rows using intelligent heuristic strategy detection (names, emails, phones, addresses, dates, UUIDs, custom templates, or sampled foreign keys). Includes live table preview before execution.
+* **Cross-Table Relational Chain Seeder:** Automatically detects and resolves foreign key dependencies, allowing you to seed an entire branch of related tables in topological order in a single click.
 
-### 📁 Multi-Database Manager
+### 📁 Multi-Database Manager & Schema Operations
+* **Bulk Table Operations:** Select multiple tables from the home dashboard to bulk drop or bulk truncate them simultaneously, with force cascade options that temporarily disable and bypass foreign key checks.
 * Manage directories of SQLite files, explicit file lists, or named JSON connections.
 * Dedicated landing page with engine badges (`PostgreSQL` / `SQLite`), table counts, connection paths, and seamless database switching.
 
@@ -150,33 +164,42 @@ Runtime operations produce crisp, color-coded status logs:
 
 ## 🚀 Embed AdminDB in Express
 
-AdminDB can be mounted directly into any existing Express application under any subpath on the same port:
+AdminDB is built to work natively with both **CommonJS (`require`)** and **ES Modules (`import`)**. You can mount it directly into any existing Express application under any subpath:
 
+### ES Modules (ESM) or TypeScript
 ```ts
 import express from 'express';
 import { createRouter } from 'admindb';
 
 const app = express();
 
-app.get('/', (_req, res) => res.send('Main App'));
-
 // Mount AdminDB for SQLite
 app.use('/admin', createRouter({
   dbPath: './data/app.db',
   basePath: '/admin',
 }));
 
-// Or mount AdminDB for PostgreSQL
-app.use('/admin-pg', createRouter({
+app.listen(45531);
+```
+
+### CommonJS (CJS)
+```js
+const express = require('express');
+const { createRouter } = require('admindb');
+
+const app = express();
+
+app.use('/admin', createRouter({
   connection: 'postgresql://postgres:secret@localhost:5432/mydb',
-  basePath: '/admin-pg',
+  basePath: '/admin',
 }));
 
-app.listen(45531, () => {
-  console.log('App running on http://localhost:45531 (Admin: http://localhost:45531/admin)');
-});
+app.listen(45531);
 ```
 
+> **💡 Try the Embedded Test App:**
+> You can see a complete, working example of an embedded host application by running `npm run testapp` from the project root. This spins up a standalone Express server that imports and mounts AdminDB.
+
 > 📖 **Full Options & Advanced Embedding Recipes:**
 > See [**`docs/EXAMPLES.md`**](docs/EXAMPLES.md#-part-2-programmatic-code-examples-express--typescript) for the complete `createRouter` options reference, multi-database management (`DbManager`), custom loggers, read-only mode, and custom authentication configurations.
 
@@ -330,6 +353,12 @@ npm test           # Run comprehensive unit test suite
 
 ---
 
+## 🙌 Credits
+
+AdminDB is built and maintained by **[Muhammad Bin Khalid](https://github.com/MIbnEKhalid)** under the umbrella of **[MBKTech.org](https://mbktech.org)**.
+
+---
+
 ## 📄 License
 
 [MIT](./LICENSE) © MIbnEKhalid

package/dist/app.d.ts

@@ -1,69 +1 @@
-import express from 'express';
-import type { IDatabase, PostgresOptions } from './db/types';
-import { DbManager } from './db/manager';
-import { type Logger, type LogLevel } from './utils/logger';
-import { type AuthConfig } from './auth';
-export interface AppOptions {
-    /** Path to the SQLite file (single-db mode) or connection string. Defaults to `admindb.db`. */
-    dbPath?: string;
-    /** PostgreSQL or database connection string (e.g. `postgresql://user:pass@host:5432/db`). */
-    connection?: string;
-    /** Explicit PostgreSQL connection options. */
-    pgOptions?: PostgresOptions;
-    /** URL prefix used by templates/static assets (e.g. `/admin`). Defaults to `''`. */
-    basePath?: string;
-    logger?: Logger;
-    logLevel?: LogLevel;
-    /** Provide an existing database instance (single-db embedding). */
-    db?: IDatabase;
-    /** Enable multi-database mode with a manager over a directory of `.db` files. */
-    manager?: DbManager;
-    /** Open the database read-only — all write routes are rejected with 403. */
-    readonly?: boolean;
-    /**
-     * Serverless mode flag.
-     * When enabled (or auto-detected in Vercel/AWS Lambda/Netlify/etc.),
-     * all write operations, mutations, schema alterations, and seeder generators
-     * are disabled, enforcing strict read-only safety for ephemeral environments.
-     *
-     * Defaults to `undefined` (auto-detected via environment).
-     */
-    serverless?: boolean;
-    /**
-     * Authentication configuration.
-     * - `true` (default): authentication enabled with default or env credentials.
-     * - `false`: completely disables authentication (no protection / developer's own auth).
-     * - `{ username, password, secret, ... }`: custom credentials and options.
-     */
-    auth?: boolean | AuthConfig;
-    /**
-     * Manager mode: show the filesystem file-browser on the databases landing
-     * page. Defaults to `true`. Set to `false` to disable browsing (e.g. when the
-     * server was started with specific database files only).
-     */
-    allowBrowse?: boolean;
-    /**
-     * Manager mode: restrict the file-browser to this folder (absolute path).
-     * When set, the browser cannot navigate above it and only databases inside it
-     * can be opened.
-     */
-    browseRoot?: string;
-    /** Internal: URL of the databases list (used by per-db apps to link "switch database"). */
-    databasesUrl?: string;
-    /** Internal: current database id (for locals/display). */
-    dbId?: string;
-}
-/**
- * Build a fully configured, mountable Express app (pages + JSON API + static
- * assets + view engine).
- *
- * - Single database: pass `dbPath` (or `db`). Mount under your own prefix with
- *   `basePath`. This is also the mode used per-database in multi-db mode.
- * - Multiple databases: pass a `manager`. The app then shows a "Databases"
- *   landing page and scopes every database under `/{dbFile}/…` (e.g.
- *   `/{base}/app.db/tables/users`, `/{base}/app.db/api/tables`).
- *
- * An Express app is valid middleware, so `app.use('/admin', createRouter({...}))`
- * works and shares the same port.
- */
-export declare function createRouter(options?: AppOptions): express.Express;
+import express from 'express';import type {IDatabase,PostgresOptions} from './db/types';import{DbManager} from './db/manager';import{type Logger,type LogLevel} from './utils/logger';import{type AuthConfig} from './auth';export interface AppOptions{dbPath?:string;connection?:string;pgOptions?:PostgresOptions;basePath?:string;logger?:Logger;logLevel?:LogLevel;db?:IDatabase;manager?:DbManager;readonly ?:boolean;serverless?:boolean;auth?:boolean|AuthConfig;allowBrowse?:boolean;browseRoot?:string;databasesUrl?:string;dbId?:string;}export declare function createRouter(options?:AppOptions):express.Express;

package/dist/app.js

@@ -18,21 +18,7 @@ const common_1 = require("./utils/common");
 const icons_1 = require("./utils/icons");
 const serverless_1 = require("./serverless");
 const auth_1 = require("./auth");
-/** Installed package version, exposed to every template as `{{version}}`. */
 const APP_VERSION = (0, args_1.getPackageVersion)();
-/**
- * Build a fully configured, mountable Express app (pages + JSON API + static
- * assets + view engine).
- *
- * - Single database: pass `dbPath` (or `db`). Mount under your own prefix with
- *   `basePath`. This is also the mode used per-database in multi-db mode.
- * - Multiple databases: pass a `manager`. The app then shows a "Databases"
- *   landing page and scopes every database under `/{dbFile}/…` (e.g.
- *   `/{base}/app.db/tables/users`, `/{base}/app.db/api/tables`).
- *
- * An Express app is valid middleware, so `app.use('/admin', createRouter({...}))`
- * works and shares the same port.
- */
 function createRouter(options = {}) {
     return options.manager ? createManagerApp(options) : createSingleDbApp(options);
 }
@@ -66,14 +52,12 @@ function setupViewEngine(app, _logger) {
     app.set('views', node_path_1.default.join(__dirname, 'views'));
 }
 function addErrorHandlers(app, logger) {
-    // 404 handler.
     app.use((req, res) => {
         if (req.path.startsWith('/api/')) {
             return res.status(404).json({ success: false, error: 'Not found.' });
         }
         res.status(404).render('pages/error', { title: 'Not found', status: 404, error: 'The page you requested does not exist.' });
     });
-    // Central error handler.
     app.use((err, req, res, _next) => {
         logger.error('Unhandled error', err);
         if (req.path.startsWith('/api/')) {
@@ -82,15 +66,12 @@ function addErrorHandlers(app, logger) {
         res.status(500).render('pages/error', { title: 'Error', status: 500, error: (0, common_1.errorMessage)(err) });
     });
 }
-/** Single-database app (also used as the per-database app in multi-db mode). */
 function createSingleDbApp(options) {
     const isServerless = options.serverless !== undefined ? options.serverless : (0, serverless_1.isServerlessEnvironment)();
     const rawTarget = options.connection || options.dbPath || '';
     const isPg = Boolean(options.pgOptions) ||
-        (typeof rawTarget === 'string' && (rawTarget.startsWith('postgres://') || rawTarget.startsWith('postgresql://'))) ||
+        (0, common_1.isPostgresConnectionString)(rawTarget) ||
         options.db?.dialect === 'postgres';
-    // In serverless environments, SQLite local files are ephemeral/read-only,
-    // whereas PostgreSQL connects to a remote networked database and is fully editable.
     const readonly = options.readonly !== undefined
         ? Boolean(options.readonly)
         : (isServerless && !isPg);
@@ -113,16 +94,12 @@ function createSingleDbApp(options) {
     const authConfig = (0, auth_1.resolveAuthConfig)(options.auth);
     const router = (0, express_1.default)();
     router.disable('x-powered-by');
-    // Static assets (relative to the mount point, so a prefix "just works").
     router.use(express_1.default.static(node_path_1.default.join(__dirname, 'public')));
     setupViewEngine(router, logger);
     router.use(express_1.default.json({ limit: '10mb' }));
     router.use(express_1.default.urlencoded({ extended: false }));
-    // Register authentication endpoints (/login, /logout)
     (0, auth_1.registerAuthRoutes)(router, authConfig, basePath, logger);
-    // Authentication gatekeeper middleware
     router.use((0, auth_1.createAuthMiddleware)(authConfig, basePath, logger));
-    // Page locals (skipped for API + static paths).
     router.use(async (req, res, next) => {
         try {
             res.locals.basePath = basePath;
@@ -141,6 +118,7 @@ function createSingleDbApp(options) {
             res.locals.version = APP_VERSION;
             res.locals.authEnabled = authConfig.enabled;
             res.locals.isDefaultPassword = authConfig.isDefaultPassword;
+            res.locals.icons = icons_1.ICONS;
             if (!req.path.startsWith('/api/')) {
                 const all = await db.listTables();
                 const names = (all.data ?? []).map((t) => t.name);
@@ -158,7 +136,6 @@ function createSingleDbApp(options) {
     addErrorHandlers(router, logger);
     return router;
 }
-/** Multi-database app: databases landing page + a per-database sub-app per file. */
 function createManagerApp(options) {
     const isServerless = options.serverless !== undefined ? options.serverless : (0, serverless_1.isServerlessEnvironment)();
     const readonly = isServerless || Boolean(options.readonly);
@@ -172,11 +149,8 @@ function createManagerApp(options) {
     setupViewEngine(app, logger);
     app.use(express_1.default.json({ limit: '10mb' }));
     app.use(express_1.default.urlencoded({ extended: false }));
-    // Register authentication endpoints (/login, /logout)
     (0, auth_1.registerAuthRoutes)(app, authConfig, basePath, logger);
-    // Authentication gatekeeper middleware
     app.use((0, auth_1.createAuthMiddleware)(authConfig, basePath, logger));
-    // Locals for the databases landing page.
     app.use(async (req, res, next) => {
         try {
             res.locals.basePath = basePath;
@@ -191,6 +165,7 @@ function createManagerApp(options) {
             res.locals.version = APP_VERSION;
             res.locals.authEnabled = authConfig.enabled;
             res.locals.isDefaultPassword = authConfig.isDefaultPassword;
+            res.locals.icons = icons_1.ICONS;
             if (!req.path.startsWith('/api/')) {
                 res.locals.tables = [];
                 res.locals.internalTables = [];
@@ -201,7 +176,6 @@ function createManagerApp(options) {
             next(err);
         }
     });
-    // Per-database dispatch: mount a cached single-db app at /:dbId.
     const subApps = new Map();
     (0, databases_1.registerDatabasesRoutes)(app, {
         manager,
@@ -254,4 +228,3 @@ function createManagerApp(options) {
     addErrorHandlers(app, logger);
     return app;
 }
-//# sourceMappingURL=app.js.map

package/dist/auth/config.d.ts

@@ -1,19 +1 @@
-import { type AuthConfig, type ResolvedAuthConfig } from './types';
-/**
- * Clears the in-memory fallback secret cache (primarily for testing).
- */
-export declare function resetPersistentSecretCache(): void;
-/**
- * Returns a persistent secret key for signing session cookies.
- *
- * Priority order:
- * 1. `ADMINDB_SECRET` or `SESSION_SECRET` environment variables.
- * 2. `ADMINDB_SECRET_FILE` path if specified in environment.
- * 3. User home directory `.admindb-secret` (or temp directory if home is not writable).
- * 4. In-memory random fallback if filesystem is completely read-only.
- */
-export declare function getOrCreatePersistentSecret(env?: NodeJS.ProcessEnv): string;
-/**
- * Resolves the authentication options against environment variables.
- */
-export declare function resolveAuthConfig(optionsAuth?: boolean | AuthConfig, env?: NodeJS.ProcessEnv): ResolvedAuthConfig;
+import{type AuthConfig,type ResolvedAuthConfig} from './types';export declare function resetPersistentSecretCache():void;export declare function getOrCreatePersistentSecret(env?:NodeJS.ProcessEnv):string;export declare function resolveAuthConfig(optionsAuth?:boolean|AuthConfig,env?:NodeJS.ProcessEnv):ResolvedAuthConfig;

package/dist/auth/config.js

@@ -11,29 +11,15 @@ const node_fs_1 = require("node:fs");
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const types_1 = require("./types");
-// In-memory cache of resolved secret to avoid repeated disk reads per process
 let cachedFallbackSecret = null;
-/**
- * Clears the in-memory fallback secret cache (primarily for testing).
- */
 function resetPersistentSecretCache() {
     cachedFallbackSecret = null;
 }
-/**
- * Returns a persistent secret key for signing session cookies.
- *
- * Priority order:
- * 1. `ADMINDB_SECRET` or `SESSION_SECRET` environment variables.
- * 2. `ADMINDB_SECRET_FILE` path if specified in environment.
- * 3. User home directory `.admindb-secret` (or temp directory if home is not writable).
- * 4. In-memory random fallback if filesystem is completely read-only.
- */
 function getOrCreatePersistentSecret(env = process.env) {
     const envSecret = env.ADMINDB_SECRET ?? env.SESSION_SECRET;
     if (envSecret && String(envSecret).trim()) {
         return String(envSecret).trim();
     }
-    // If a custom secret file is specified, don't use default home cache
     const customSecretFile = env.ADMINDB_SECRET_FILE ? String(env.ADMINDB_SECRET_FILE).trim() : undefined;
     if (!customSecretFile && cachedFallbackSecret) {
         return cachedFallbackSecret;
@@ -50,7 +36,6 @@ function getOrCreatePersistentSecret(env = process.env) {
             }
         }
         catch {
-            /* ignore */
         }
         try {
             const tmp = node_os_1.default.tmpdir();
@@ -59,10 +44,8 @@ function getOrCreatePersistentSecret(env = process.env) {
             }
         }
         catch {
-            /* ignore */
         }
     }
-    // 1. Try reading existing secret from candidate paths
     for (const filePath of candidatePaths) {
         try {
             if ((0, node_fs_1.existsSync)(filePath)) {
@@ -76,10 +59,8 @@ function getOrCreatePersistentSecret(env = process.env) {
             }
         }
         catch {
-            // Continue to next candidate or write attempt
         }
     }
-    // 2. Generate new secret and attempt writing to the first writable candidate path
     const newSecret = (0, node_crypto_1.randomBytes)(32).toString('hex');
     for (const filePath of candidatePaths) {
         try {
@@ -94,20 +75,14 @@ function getOrCreatePersistentSecret(env = process.env) {
             return newSecret;
         }
         catch {
-            // Continue to next candidate if write fails
         }
     }
-    // 3. Last-resort fallback to in-memory secret if disk is not writable
     if (!customSecretFile) {
         cachedFallbackSecret = newSecret;
     }
     return newSecret;
 }
-/**
- * Resolves the authentication options against environment variables.
- */
 function resolveAuthConfig(optionsAuth, env = process.env) {
-    // Check if explicitly disabled via options or environment variable
     const envDisabled = ['0', 'false', 'no', 'off'].includes(String(env.ADMINDB_AUTH ?? '').trim().toLowerCase()) ||
         ['1', 'true', 'yes'].includes(String(env.ADMINDB_NO_AUTH ?? env.ADMINDB_DISABLE_AUTH ?? '').trim().toLowerCase());
     let enabled = true;
@@ -144,4 +119,3 @@ function resolveAuthConfig(optionsAuth, env = process.env) {
         isDefaultPassword,
     };
 }
-//# sourceMappingURL=config.js.map

package/dist/auth/crypto.d.ts

@@ -1,27 +1 @@
-/**
- * Generates a secure scrypt password hash with a random or provided salt.
- * Format: `scrypt:<saltHex>:<derivedKeyHex>`
- */
-export declare function hashPassword(password: string, salt?: string): string;
-/**
- * Constant-time comparison between two strings to prevent timing attacks.
- */
-export declare function constantTimeCompare(a: string, b: string): boolean;
-/**
- * Verifies a candidate plaintext password against a stored password or scrypt hash.
- */
-export declare function verifyPassword(candidatePassword: string, storedPasswordOrHash: string): boolean;
-/**
- * Parses raw Cookie header string into key-value map.
- */
-export declare function parseCookies(cookieHeader?: string): Record<string, string>;
-/**
- * Creates a tamper-proof signed session token using HMAC-SHA256.
- * Format: `<base64url(username)>.<expiresAtTimestamp>.<hmacSignature>`
- */
-export declare function createSessionToken(username: string, secret: string, durationMs?: number): string;
-/**
- * Verifies a signed session token in constant time.
- * Returns the authenticated username if valid and non-expired, or null otherwise.
- */
-export declare function verifySessionToken(token: string, secret: string, expectedUser?: string): string | null;
+export declare function hashPassword(password:string,salt?:string):string;export declare function constantTimeCompare(a:string,b:string):boolean;export declare function verifyPassword(candidatePassword:string,storedPasswordOrHash:string):boolean;export declare function parseCookies(cookieHeader?:string):Record<string,string>;export declare function createSessionToken(username:string,secret:string,durationMs?:number):string;export declare function verifySessionToken(token:string,secret:string,expectedUser?:string):string|null;

package/dist/auth/crypto.js

@@ -8,24 +8,16 @@ exports.createSessionToken = createSessionToken;
 exports.verifySessionToken = verifySessionToken;
 const node_crypto_1 = require("node:crypto");
 const types_1 = require("./types");
-/**
- * Generates a secure scrypt password hash with a random or provided salt.
- * Format: `scrypt:<saltHex>:<derivedKeyHex>`
- */
 function hashPassword(password, salt) {
     const saltHex = salt || (0, node_crypto_1.randomBytes)(16).toString('hex');
     const derivedKey = (0, node_crypto_1.scryptSync)(password, saltHex, 64).toString('hex');
     return `scrypt:${saltHex}:${derivedKey}`;
 }
-/**
- * Constant-time comparison between two strings to prevent timing attacks.
- */
 function constantTimeCompare(a, b) {
     try {
         const bufA = Buffer.from(String(a), 'utf8');
         const bufB = Buffer.from(String(b), 'utf8');
         if (bufA.length !== bufB.length) {
-            // Dummy comparison to prevent timing leak on length mismatch
             (0, node_crypto_1.timingSafeEqual)(bufA, bufA);
             return false;
         }
@@ -35,14 +27,10 @@ function constantTimeCompare(a, b) {
         return false;
     }
 }
-/**
- * Verifies a candidate plaintext password against a stored password or scrypt hash.
- */
 function verifyPassword(candidatePassword, storedPasswordOrHash) {
     if (typeof candidatePassword !== 'string' || typeof storedPasswordOrHash !== 'string') {
         return false;
     }
-    // Handle scrypt formatted hash: `scrypt:<salt>:<hash>`
     if (storedPasswordOrHash.startsWith('scrypt:')) {
         const parts = storedPasswordOrHash.split(':');
         if (parts.length === 3 && parts[1] && parts[2]) {
@@ -57,12 +45,8 @@ function verifyPassword(candidatePassword, storedPasswordOrHash) {
             }
         }
     }
-    // Fallback for plaintext passwords (legacy or plain string configs)
     return constantTimeCompare(candidatePassword, storedPasswordOrHash);
 }
-/**
- * Parses raw Cookie header string into key-value map.
- */
 function parseCookies(cookieHeader) {
     const cookies = {};
     if (!cookieHeader)
@@ -87,10 +71,6 @@ function parseCookies(cookieHeader) {
     }
     return cookies;
 }
-/**
- * Creates a tamper-proof signed session token using HMAC-SHA256.
- * Format: `<base64url(username)>.<expiresAtTimestamp>.<hmacSignature>`
- */
 function createSessionToken(username, secret, durationMs = types_1.DEFAULT_SESSION_DURATION_MS) {
     const expiresAt = Date.now() + durationMs;
     const userPayload = Buffer.from(username, 'utf8').toString('base64url');
@@ -98,10 +78,6 @@ function createSessionToken(username, secret, durationMs = types_1.DEFAULT_SESSI
     const signature = (0, node_crypto_1.createHmac)('sha256', secret).update(data).digest('base64url');
     return `${data}.${signature}`;
 }
-/**
- * Verifies a signed session token in constant time.
- * Returns the authenticated username if valid and non-expired, or null otherwise.
- */
 function verifySessionToken(token, secret, expectedUser) {
     if (!token || typeof token !== 'string')
         return null;
@@ -116,7 +92,7 @@ function verifySessionToken(token, secret, expectedUser) {
     }
     const expiresAt = Number.parseInt(expiresStr, 10);
     if (!Number.isFinite(expiresAt) || Date.now() > expiresAt) {
-        return null; // Expired
+        return null;
     }
     let username;
     try {
@@ -130,4 +106,3 @@ function verifySessionToken(token, secret, expectedUser) {
     }
     return username;
 }
-//# sourceMappingURL=crypto.js.map

package/dist/auth/index.d.ts

@@ -1,5 +1 @@
-export * from './types';
-export * from './crypto';
-export * from './config';
-export * from './middleware';
-export * from './routes';
+export * from './types';export * from './crypto';export * from './config';export * from './middleware';export * from './routes';

package/dist/auth/index.js

@@ -19,4 +19,3 @@ __exportStar(require("./crypto"), exports);
 __exportStar(require("./config"), exports);
 __exportStar(require("./middleware"), exports);
 __exportStar(require("./routes"), exports);
-//# sourceMappingURL=index.js.map

package/dist/auth/middleware.d.ts

@@ -1,14 +1 @@
-import type { Request, Response, NextFunction } from 'express';
-import type { Logger } from '../utils/logger';
-import { type ResolvedAuthConfig } from './types';
-/**
- * Checks incoming request headers and cookies for valid authentication.
- */
-export declare function authenticateRequest(req: Request, config: ResolvedAuthConfig): {
-    authenticated: boolean;
-    user?: string;
-};
-/**
- * Express middleware to protect routes.
- */
-export declare function createAuthMiddleware(config: ResolvedAuthConfig, basePath: string, _logger: Logger): (req: Request, res: Response, next: NextFunction) => void;
+import type {Request,Response,NextFunction} from 'express';import type {Logger} from '../utils/logger';import{type ResolvedAuthConfig} from './types';export declare function authenticateRequest(req:Request,config:ResolvedAuthConfig):{authenticated:boolean;user?:string;};export declare function createAuthMiddleware(config:ResolvedAuthConfig,basePath:string,_logger:Logger):(req:Request,res:Response,next:NextFunction)=>void;

package/dist/auth/middleware.js

@@ -4,14 +4,10 @@ exports.authenticateRequest = authenticateRequest;
 exports.createAuthMiddleware = createAuthMiddleware;
 const types_1 = require("./types");
 const crypto_1 = require("./crypto");
-/**
- * Checks incoming request headers and cookies for valid authentication.
- */
 function authenticateRequest(req, config) {
     if (!config.enabled) {
         return { authenticated: true, user: 'anonymous' };
     }
-    // 1. Check HTTP Authorization header (Basic or Bearer)
     const authHeader = req.headers.authorization;
     if (authHeader) {
         const [scheme, credentials] = authHeader.split(/\s+/, 2);
@@ -29,7 +25,6 @@ function authenticateRequest(req, config) {
                     }
                 }
                 catch {
-                    // Ignore parse errors
                 }
             }
             else if (scheme.toLowerCase() === 'bearer') {
@@ -37,14 +32,12 @@ function authenticateRequest(req, config) {
                 if (user) {
                     return { authenticated: true, user };
                 }
-                // Direct password comparison as bearer token
                 if ((0, crypto_1.verifyPassword)(credentials, config.password)) {
                     return { authenticated: true, user: config.username };
                 }
             }
         }
     }
-    // 2. Check Cookie session
     const cookies = (0, crypto_1.parseCookies)(req.headers.cookie);
     const sessionCookie = cookies[types_1.SESSION_COOKIE_NAME];
     if (sessionCookie) {
@@ -55,12 +48,8 @@ function authenticateRequest(req, config) {
     }
     return { authenticated: false };
 }
-/**
- * Express middleware to protect routes.
- */
 function createAuthMiddleware(config, basePath, _logger) {
     return (req, res, next) => {
-        // Expose auth state to templates
         res.locals.authEnabled = config.enabled;
         res.locals.isDefaultPassword = config.isDefaultPassword;
         if (!config.enabled) {
@@ -68,7 +57,6 @@ function createAuthMiddleware(config, basePath, _logger) {
             return next();
         }
         const p = req.path;
-        // Public static assets and auth endpoints bypass authentication
         if (p.startsWith('/css/') ||
             p.startsWith('/js/') ||
             p === '/favicon.ico' ||
@@ -82,7 +70,6 @@ function createAuthMiddleware(config, basePath, _logger) {
             req.user = auth.user;
             return next();
         }
-        // Unauthenticated: API requests get 401 JSON
         if (p.startsWith('/api/') || req.xhr || (req.headers.accept && req.headers.accept.includes('application/json'))) {
             res.setHeader('WWW-Authenticate', 'Basic realm="AdminDB", Bearer');
             res.status(401).json({
@@ -91,10 +78,8 @@ function createAuthMiddleware(config, basePath, _logger) {
             });
             return;
         }
-        // Web UI: Redirect to login with return path
         const returnUrl = req.originalUrl || `${basePath}${req.url}`;
         const loginUrl = `${basePath}/login${returnUrl && returnUrl !== `${basePath}/` ? `?next=${encodeURIComponent(returnUrl)}` : ''}`;
         res.redirect(loginUrl);
     };
 }
-//# sourceMappingURL=middleware.js.map

package/dist/auth/routes.d.ts

@@ -1,7 +1 @@
-import type { Router } from 'express';
-import type { Logger } from '../utils/logger';
-import { type ResolvedAuthConfig } from './types';
-/**
- * Registers /login and /logout routes.
- */
-export declare function registerAuthRoutes(router: Router, config: ResolvedAuthConfig, basePath: string, logger: Logger): void;
+import type {Router} from 'express';import type {Logger} from '../utils/logger';import{type ResolvedAuthConfig} from './types';export declare function registerAuthRoutes(router:Router,config:ResolvedAuthConfig,basePath:string,logger:Logger):void;