admindb 2.1.1 → 2.3.0

package/dist/app.js

@@ -1 +1,227 @@
-var __importDefault=this&&this.__importDefault||function(mod){return mod&&mod.__esModule?mod:{default:mod}};Object.defineProperty(exports,"__esModule",{value:!0}),exports.createRouter=function(options={}){return options.manager?function(options){const isServerless=void 0!==options.serverless?options.serverless:(0,serverless_1.isServerlessEnvironment)(),readonly=isServerless||Boolean(options.readonly),manager=options.manager,basePath=(options.basePath??"").replace(/\/+$/,""),logger=options.logger??(0,logger_1.createLogger)(options.logLevel??"info","admindb"),authConfig=(0,auth_1.resolveAuthConfig)(options.auth),app=(0,express_1.default)();app.disable("x-powered-by"),app.use(express_1.default.static(node_path_1.default.join(__dirname,"public"))),setupViewEngine(app,logger),app.use(express_1.default.json({limit:"10mb"})),app.use(express_1.default.urlencoded({extended:!1})),(0,auth_1.registerAuthRoutes)(app,authConfig,basePath,logger),app.use((0,auth_1.createAuthMiddleware)(authConfig,basePath,logger)),app.use(async(req,res,next)=>{try{res.locals.basePath=basePath,res.locals.currentPath=req.path,res.locals.currentTable=null,res.locals.dbPath=manager.directory,res.locals.dbId=null,res.locals.databasesUrl=null,res.locals.databasesMode=!0,res.locals.readonly=readonly,res.locals.serverless=isServerless,res.locals.version=APP_VERSION,res.locals.authEnabled=authConfig.enabled,res.locals.isDefaultPassword=authConfig.isDefaultPassword,req.path.startsWith("/api/")||(res.locals.tables=[],res.locals.internalTables=[]),next()}catch(err){next(err)}});const subApps=new Map;return(0,databases_1.registerDatabasesRoutes)(app,{manager:manager,logger:logger,basePath:basePath,readonly:readonly,allowBrowse:!isServerless&&options.allowBrowse,browseRoot:options.browseRoot,invalidate:id=>subApps.delete(id)}),app.use("/:dbId",(req,res,next)=>{const dbId=String(req.params.dbId);if(!manager.has(dbId))return req.path.startsWith("/api/")?res.status(404).json({success:!1,error:`Database "${dbId}" does not exist.`}):res.status(404).render("pages/error",{title:"Not found",status:404,error:`Database "${dbId}" does not exist.`});const rawRo=req.query.readonly;if(void 0!==rawRo){const explicitRo="1"===rawRo||"true"===rawRo;readonly&&!explicitRo||(manager.setReadonly(dbId,explicitRo),subApps.delete(dbId))}let sub=subApps.get(dbId);if(!sub){const subBase=`${basePath||""}/${encodeURIComponent(dbId)}`,effectiveRo=readonly||manager.isDbReadOnly(dbId);sub=createSingleDbApp({db:manager.open(dbId,effectiveRo),basePath:subBase,logger:logger,logLevel:options.logLevel,dbId:dbId,databasesUrl:`${basePath||""}/`,readonly:effectiveRo,serverless:isServerless,auth:authConfig}),subApps.set(dbId,sub)}return sub(req,res,next)}),addErrorHandlers(app,logger),app}(options):createSingleDbApp(options)};const express_1=__importDefault(require("express")),node_path_1=__importDefault(require("node:path")),express_handlebars_1=require("express-handlebars"),database_1=require("./db/database"),postgres_1=require("./db/postgres"),logger_1=require("./utils/logger"),pages_1=require("./routes/pages"),index_1=require("./routes/api/index"),databases_1=require("./routes/databases"),args_1=require("./cli/args"),common_1=require("./utils/common"),icons_1=require("./utils/icons"),serverless_1=require("./serverless"),auth_1=require("./auth"),APP_VERSION=(0,args_1.getPackageVersion)();function setupViewEngine(app,_logger){app.engine("hbs",(0,express_handlebars_1.engine)({extname:".hbs",defaultLayout:"main",layoutsDir:node_path_1.default.join(__dirname,"views","layouts"),partialsDir:node_path_1.default.join(__dirname,"views","partials"),helpers:{eq:(a,b)=>a===b,startsWith:(a,b)=>String(a??"").startsWith(String(b??"")),isNull:v=>null==v,truncate:(v,n)=>{const s=null==v?"":String(v);return s.length>n?`${s.slice(0,n)}…`:s},json:v=>(JSON.stringify(v??null)??"null").replace(/</g,"\\u003c"),add:(a,b)=>Number(a)+Number(b),sub:(a,b)=>Number(a)-Number(b),gt:(a,b)=>Number(a)>Number(b),lt:(a,b)=>Number(a)<Number(b),join:(arr,sep)=>Array.isArray(arr)?arr.join(String(sep??",")):String(arr??""),icon:(name,options)=>{const customClass=options&&options.hash&&options.hash.class||void 0;return(0,icons_1.renderIcon)(String(name??""),customClass)}}})),app.set("view engine","hbs"),app.set("views",node_path_1.default.join(__dirname,"views"))}function addErrorHandlers(app,logger){app.use((req,res)=>{if(req.path.startsWith("/api/"))return res.status(404).json({success:!1,error:"Not found."});res.status(404).render("pages/error",{title:"Not found",status:404,error:"The page you requested does not exist."})}),app.use((err,req,res,_next)=>{if(logger.error("Unhandled error",err),req.path.startsWith("/api/"))return res.status(500).json({success:!1,error:(0,common_1.errorMessage)(err)});res.status(500).render("pages/error",{title:"Error",status:500,error:(0,common_1.errorMessage)(err)})})}function createSingleDbApp(options){const isServerless=void 0!==options.serverless?options.serverless:(0,serverless_1.isServerlessEnvironment)(),rawTarget=options.connection||options.dbPath||"",isPg=Boolean(options.pgOptions)||"string"==typeof rawTarget&&(rawTarget.startsWith("postgres://")||rawTarget.startsWith("postgresql://"))||"postgres"===options.db?.dialect,readonly=void 0!==options.readonly?Boolean(options.readonly):isServerless&&!isPg,basePath=(options.basePath??"").replace(/\/+$/,""),logger=options.logger??(0,logger_1.createLogger)(options.logLevel??"info","admindb");let db;if(options.db)db=options.db;else if(isPg){const conn=options.pgOptions||rawTarget;db=new postgres_1.PostgresDatabase(conn,logger,{readonly:readonly})}else db=new database_1.SqliteDatabase(options.dbPath??"admindb.db",logger,{readonly:readonly});const databasesUrl=options.databasesUrl,authConfig=(0,auth_1.resolveAuthConfig)(options.auth),router=(0,express_1.default)();return router.disable("x-powered-by"),router.use(express_1.default.static(node_path_1.default.join(__dirname,"public"))),setupViewEngine(router),router.use(express_1.default.json({limit:"10mb"})),router.use(express_1.default.urlencoded({extended:!1})),(0,auth_1.registerAuthRoutes)(router,authConfig,basePath,logger),router.use((0,auth_1.createAuthMiddleware)(authConfig,basePath,logger)),router.use(async(req,res,next)=>{try{if(res.locals.basePath=basePath,res.locals.currentPath=req.path,res.locals.currentTable=null,res.locals.dbPath=db.path,res.locals.dbId=options.dbId??("postgres"===db.dialect?"PostgreSQL":node_path_1.default.basename(db.path)||"SQLite"),res.locals.dialect=db.dialect,res.locals.isPostgres="postgres"===db.dialect,res.locals.isSqlite="sqlite"===db.dialect,res.locals.dialectName="postgres"===db.dialect?"PostgreSQL":"SQLite",res.locals.databasesUrl=databasesUrl??null,res.locals.databasesMode=!1,res.locals.readonly=db.isReadOnly,res.locals.serverless=isServerless,res.locals.version=APP_VERSION,res.locals.authEnabled=authConfig.enabled,res.locals.isDefaultPassword=authConfig.isDefaultPassword,!req.path.startsWith("/api/")){const names=((await db.listTables()).data??[]).map(t=>t.name);res.locals.tables=names.filter(n=>!n.startsWith("_")),res.locals.internalTables=names.filter(n=>n.startsWith("_"))}next()}catch(err){next(err)}}),(0,pages_1.registerPages)(router,{db:db,logger:logger}),(0,index_1.registerApi)(router,{db:db,logger:logger}),addErrorHandlers(router,logger),router}
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRouter = createRouter;
+const express_1 = __importDefault(require("express"));
+const node_path_1 = __importDefault(require("node:path"));
+const express_handlebars_1 = require("express-handlebars");
+const database_1 = require("./db/database");
+const postgres_1 = require("./db/postgres");
+const logger_1 = require("./utils/logger");
+const pages_1 = require("./routes/pages");
+const index_1 = require("./routes/api/index");
+const databases_1 = require("./routes/databases");
+const args_1 = require("./cli/args");
+const common_1 = require("./utils/common");
+const icons_1 = require("./utils/icons");
+const serverless_1 = require("./serverless");
+const auth_1 = require("./auth");
+const APP_VERSION = (0, args_1.getPackageVersion)();
+function createRouter(options = {}) {
+    return options.manager ? createManagerApp(options) : createSingleDbApp(options);
+}
+function setupViewEngine(app, _logger) {
+    app.engine('hbs', (0, express_handlebars_1.engine)({
+        extname: '.hbs',
+        defaultLayout: 'main',
+        layoutsDir: node_path_1.default.join(__dirname, 'views', 'layouts'),
+        partialsDir: node_path_1.default.join(__dirname, 'views', 'partials'),
+        helpers: {
+            eq: (a, b) => a === b,
+            startsWith: (a, b) => String(a ?? '').startsWith(String(b ?? '')),
+            isNull: (v) => v === null || v === undefined,
+            truncate: (v, n) => {
+                const s = v == null ? '' : String(v);
+                return s.length > n ? `${s.slice(0, n)}…` : s;
+            },
+            json: (v) => (JSON.stringify(v ?? null) ?? 'null').replace(/</g, '\\u003c'),
+            add: (a, b) => Number(a) + Number(b),
+            sub: (a, b) => Number(a) - Number(b),
+            gt: (a, b) => Number(a) > Number(b),
+            lt: (a, b) => Number(a) < Number(b),
+            join: (arr, sep) => (Array.isArray(arr) ? arr.join(String(sep ?? ',')) : String(arr ?? '')),
+            icon: (name, options) => {
+                const customClass = (options && options.hash && options.hash.class) || undefined;
+                return (0, icons_1.renderIcon)(String(name ?? ''), customClass);
+            },
+        },
+    }));
+    app.set('view engine', 'hbs');
+    app.set('views', node_path_1.default.join(__dirname, 'views'));
+}
+function addErrorHandlers(app, logger) {
+    app.use((req, res) => {
+        if (req.path.startsWith('/api/')) {
+            return res.status(404).json({ success: false, error: 'Not found.' });
+        }
+        res.status(404).render('pages/error', { title: 'Not found', status: 404, error: 'The page you requested does not exist.' });
+    });
+    app.use((err, req, res, _next) => {
+        logger.error('Unhandled error', err);
+        if (req.path.startsWith('/api/')) {
+            return res.status(500).json({ success: false, error: (0, common_1.errorMessage)(err) });
+        }
+        res.status(500).render('pages/error', { title: 'Error', status: 500, error: (0, common_1.errorMessage)(err) });
+    });
+}
+function createSingleDbApp(options) {
+    const isServerless = options.serverless !== undefined ? options.serverless : (0, serverless_1.isServerlessEnvironment)();
+    const rawTarget = options.connection || options.dbPath || '';
+    const isPg = Boolean(options.pgOptions) ||
+        (0, common_1.isPostgresConnectionString)(rawTarget) ||
+        options.db?.dialect === 'postgres';
+    const readonly = options.readonly !== undefined
+        ? Boolean(options.readonly)
+        : (isServerless && !isPg);
+    const basePath = (options.basePath ?? '').replace(/\/+$/, '');
+    const logger = options.logger ?? (0, logger_1.createLogger)(options.logLevel ?? 'info', 'admindb');
+    let db;
+    if (options.db) {
+        db = options.db;
+    }
+    else if (isPg) {
+        db = new postgres_1.PostgresDatabase(options.pgOptions || rawTarget, logger, { readonly });
+    }
+    else {
+        db = new database_1.SqliteDatabase(options.dbPath ?? 'admindb.db', logger, { readonly });
+    }
+    const databasesUrl = options.databasesUrl;
+    const authConfig = (0, auth_1.resolveAuthConfig)(options.auth);
+    const router = (0, express_1.default)();
+    router.disable('x-powered-by');
+    router.use(express_1.default.static(node_path_1.default.join(__dirname, 'public')));
+    setupViewEngine(router, logger);
+    router.use(express_1.default.json({ limit: '10mb' }));
+    router.use(express_1.default.urlencoded({ extended: false }));
+    (0, auth_1.registerAuthRoutes)(router, authConfig, basePath, logger);
+    router.use((0, auth_1.createAuthMiddleware)(authConfig, basePath, logger));
+    router.use(async (req, res, next) => {
+        try {
+            res.locals.basePath = basePath;
+            res.locals.currentPath = req.path;
+            res.locals.currentTable = null;
+            res.locals.dbPath = db.path;
+            res.locals.dbId = options.dbId ?? (db.dialect === 'postgres' ? 'PostgreSQL' : (node_path_1.default.basename(db.path) || 'SQLite'));
+            res.locals.dialect = db.dialect;
+            res.locals.isPostgres = db.dialect === 'postgres';
+            res.locals.isSqlite = db.dialect === 'sqlite';
+            res.locals.dialectName = db.dialect === 'postgres' ? 'PostgreSQL' : 'SQLite';
+            res.locals.databasesUrl = databasesUrl ?? null;
+            res.locals.databasesMode = false;
+            res.locals.readonly = db.isReadOnly;
+            res.locals.serverless = isServerless;
+            res.locals.version = APP_VERSION;
+            res.locals.authEnabled = authConfig.enabled;
+            res.locals.isDefaultPassword = authConfig.isDefaultPassword;
+            res.locals.icons = icons_1.ICONS;
+            if (!req.path.startsWith('/api/')) {
+                const all = await db.listTables();
+                const names = (all.data ?? []).map((t) => t.name);
+                res.locals.tables = names.filter((n) => !n.startsWith('_'));
+                res.locals.internalTables = names.filter((n) => n.startsWith('_'));
+            }
+            next();
+        }
+        catch (err) {
+            next(err);
+        }
+    });
+    (0, pages_1.registerPages)(router, { db, logger });
+    (0, index_1.registerApi)(router, { db, logger });
+    addErrorHandlers(router, logger);
+    return router;
+}
+function createManagerApp(options) {
+    const isServerless = options.serverless !== undefined ? options.serverless : (0, serverless_1.isServerlessEnvironment)();
+    const readonly = isServerless || Boolean(options.readonly);
+    const manager = options.manager;
+    const basePath = (options.basePath ?? '').replace(/\/+$/, '');
+    const logger = options.logger ?? (0, logger_1.createLogger)(options.logLevel ?? 'info', 'admindb');
+    const authConfig = (0, auth_1.resolveAuthConfig)(options.auth);
+    const app = (0, express_1.default)();
+    app.disable('x-powered-by');
+    app.use(express_1.default.static(node_path_1.default.join(__dirname, 'public')));
+    setupViewEngine(app, logger);
+    app.use(express_1.default.json({ limit: '10mb' }));
+    app.use(express_1.default.urlencoded({ extended: false }));
+    (0, auth_1.registerAuthRoutes)(app, authConfig, basePath, logger);
+    app.use((0, auth_1.createAuthMiddleware)(authConfig, basePath, logger));
+    app.use(async (req, res, next) => {
+        try {
+            res.locals.basePath = basePath;
+            res.locals.currentPath = req.path;
+            res.locals.currentTable = null;
+            res.locals.dbPath = manager.directory;
+            res.locals.dbId = null;
+            res.locals.databasesUrl = null;
+            res.locals.databasesMode = true;
+            res.locals.readonly = readonly;
+            res.locals.serverless = isServerless;
+            res.locals.version = APP_VERSION;
+            res.locals.authEnabled = authConfig.enabled;
+            res.locals.isDefaultPassword = authConfig.isDefaultPassword;
+            res.locals.icons = icons_1.ICONS;
+            if (!req.path.startsWith('/api/')) {
+                res.locals.tables = [];
+                res.locals.internalTables = [];
+            }
+            next();
+        }
+        catch (err) {
+            next(err);
+        }
+    });
+    const subApps = new Map();
+    (0, databases_1.registerDatabasesRoutes)(app, {
+        manager,
+        logger,
+        basePath,
+        readonly,
+        allowBrowse: isServerless ? false : options.allowBrowse,
+        browseRoot: options.browseRoot,
+        invalidate: (id) => subApps.delete(id),
+    });
+    app.use('/:dbId', (req, res, next) => {
+        const dbId = String(req.params.dbId);
+        if (!manager.has(dbId)) {
+            if (req.path.startsWith('/api/')) {
+                return res.status(404).json({ success: false, error: `Database "${dbId}" does not exist.` });
+            }
+            return res.status(404).render('pages/error', {
+                title: 'Not found',
+                status: 404,
+                error: `Database "${dbId}" does not exist.`,
+            });
+        }
+        const rawRo = req.query.readonly;
+        if (rawRo !== undefined) {
+            const explicitRo = rawRo === '1' || rawRo === 'true';
+            if (!readonly || explicitRo) {
+                manager.setReadonly(dbId, explicitRo);
+                subApps.delete(dbId);
+            }
+        }
+        let sub = subApps.get(dbId);
+        if (!sub) {
+            const subBase = `${basePath || ''}/${encodeURIComponent(dbId)}`;
+            const effectiveRo = readonly || manager.isDbReadOnly(dbId);
+            sub = createSingleDbApp({
+                db: manager.open(dbId, effectiveRo),
+                basePath: subBase,
+                logger,
+                logLevel: options.logLevel,
+                dbId,
+                databasesUrl: `${basePath || ''}/`,
+                readonly: effectiveRo,
+                serverless: isServerless,
+                auth: authConfig,
+            });
+            subApps.set(dbId, sub);
+        }
+        return sub(req, res, next);
+    });
+    addErrorHandlers(app, logger);
+    return app;
+}

package/dist/auth/config.d.ts

@@ -1 +1 @@
-import{type AuthConfig,type ResolvedAuthConfig} from './types';export declare function resetPersistentSecretCache():void;export declare function getOrCreatePersistentSecret(env?:NodeJS.ProcessEnv):string;export declare function resolveAuthConfig(optionsAuth?:boolean|AuthConfig,env?:NodeJS.ProcessEnv):ResolvedAuthConfig;
+import{type AuthConfig,type ResolvedAuthConfig} from './types';export declare const resetPersistentSecretCache:()=>void;export declare function getOrCreatePersistentSecret(env?:NodeJS.ProcessEnv):string;export declare function resolveAuthConfig(optionsAuth?:boolean|AuthConfig,env?:NodeJS.ProcessEnv):ResolvedAuthConfig;

package/dist/auth/config.js

@@ -1 +1,109 @@
-var __importDefault=this&&this.__importDefault||function(mod){return mod&&mod.__esModule?mod:{default:mod}};Object.defineProperty(exports,"__esModule",{value:!0}),exports.resetPersistentSecretCache=function(){cachedFallbackSecret=null},exports.getOrCreatePersistentSecret=getOrCreatePersistentSecret,exports.resolveAuthConfig=function(optionsAuth,env=process.env){const envDisabled=["0","false","no","off"].includes(String(env.ADMINDB_AUTH??"").trim().toLowerCase())||["1","true","yes"].includes(String(env.ADMINDB_NO_AUTH??env.ADMINDB_DISABLE_AUTH??"").trim().toLowerCase());let enabled=!0,username=env.ADMINDB_USERNAME??env.ADMINDB_USER?String(env.ADMINDB_USERNAME??env.ADMINDB_USER).trim():types_1.DEFAULT_USERNAME,password=env.ADMINDB_PASSWORD??env.ADMINDB_PASS?String(env.ADMINDB_PASSWORD??env.ADMINDB_PASS).trim():types_1.DEFAULT_PASSWORD_HASH,secret=env.ADMINDB_SECRET??env.SESSION_SECRET?String(env.ADMINDB_SECRET??env.SESSION_SECRET).trim():getOrCreatePersistentSecret(env),sessionDurationMs=types_1.DEFAULT_SESSION_DURATION_MS;!1===optionsAuth||envDisabled?enabled=!1:"object"==typeof optionsAuth&&null!==optionsAuth&&(!1===optionsAuth.enabled&&(enabled=!1),void 0!==optionsAuth.username&&(username=String(optionsAuth.username).trim()),void 0!==optionsAuth.password&&(password=String(optionsAuth.password).trim()),void 0!==optionsAuth.secret&&String(optionsAuth.secret).trim()&&(secret=String(optionsAuth.secret).trim()),void 0!==optionsAuth.sessionDurationMs&&(sessionDurationMs=optionsAuth.sessionDurationMs));const isDefaultPassword=username===types_1.DEFAULT_USERNAME&&(password===types_1.DEFAULT_PASSWORD_HASH||"admin"===password);return{enabled:enabled,username:username,password:password,secret:secret,sessionDurationMs:sessionDurationMs,isDefaultPassword:isDefaultPassword}};const node_crypto_1=require("node:crypto"),node_fs_1=require("node:fs"),node_os_1=__importDefault(require("node:os")),node_path_1=__importDefault(require("node:path")),types_1=require("./types");let cachedFallbackSecret=null;function getOrCreatePersistentSecret(env=process.env){const envSecret=env.ADMINDB_SECRET??env.SESSION_SECRET;if(envSecret&&String(envSecret).trim())return String(envSecret).trim();const customSecretFile=env.ADMINDB_SECRET_FILE?String(env.ADMINDB_SECRET_FILE).trim():void 0;if(!customSecretFile&&cachedFallbackSecret)return cachedFallbackSecret;const candidatePaths=[];if(customSecretFile)candidatePaths.push(node_path_1.default.resolve(customSecretFile));else{try{const home=node_os_1.default.homedir();home&&candidatePaths.push(node_path_1.default.join(home,".admindb-secret"))}catch{}try{const tmp=node_os_1.default.tmpdir();tmp&&candidatePaths.push(node_path_1.default.join(tmp,".admindb-secret"))}catch{}}for(const filePath of candidatePaths)try{if((0,node_fs_1.existsSync)(filePath)){const content=(0,node_fs_1.readFileSync)(filePath,"utf8").trim();if(content.length>=16)return customSecretFile||(cachedFallbackSecret=content),content}}catch{}const newSecret=(0,node_crypto_1.randomBytes)(32).toString("hex");for(const filePath of candidatePaths)try{const dir=node_path_1.default.dirname(filePath);return(0,node_fs_1.existsSync)(dir)||(0,node_fs_1.mkdirSync)(dir,{recursive:!0}),(0,node_fs_1.writeFileSync)(filePath,newSecret,{encoding:"utf8",mode:384}),customSecretFile||(cachedFallbackSecret=newSecret),newSecret}catch{}return customSecretFile||(cachedFallbackSecret=newSecret),newSecret}
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resetPersistentSecretCache = void 0;
+exports.getOrCreatePersistentSecret = getOrCreatePersistentSecret;
+exports.resolveAuthConfig = resolveAuthConfig;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const types_1 = require("./types");
+let cachedFallbackSecret = null;
+const resetPersistentSecretCache = () => {
+    cachedFallbackSecret = null;
+};
+exports.resetPersistentSecretCache = resetPersistentSecretCache;
+function getOrCreatePersistentSecret(env = process.env) {
+    const envSecret = env.ADMINDB_SECRET ?? env.SESSION_SECRET;
+    if (envSecret && String(envSecret).trim()) {
+        return String(envSecret).trim();
+    }
+    const customSecretFile = env.ADMINDB_SECRET_FILE ? String(env.ADMINDB_SECRET_FILE).trim() : undefined;
+    if (!customSecretFile && cachedFallbackSecret)
+        return cachedFallbackSecret;
+    const candidatePaths = [];
+    if (customSecretFile) {
+        candidatePaths.push(node_path_1.default.resolve(customSecretFile));
+    }
+    else {
+        try {
+            const home = node_os_1.default.homedir();
+            if (home)
+                candidatePaths.push(node_path_1.default.join(home, '.admindb-secret'));
+        }
+        catch { }
+        try {
+            const tmp = node_os_1.default.tmpdir();
+            if (tmp)
+                candidatePaths.push(node_path_1.default.join(tmp, '.admindb-secret'));
+        }
+        catch { }
+    }
+    for (const filePath of candidatePaths) {
+        try {
+            if ((0, node_fs_1.existsSync)(filePath)) {
+                const content = (0, node_fs_1.readFileSync)(filePath, 'utf8').trim();
+                if (content.length >= 16) {
+                    if (!customSecretFile)
+                        cachedFallbackSecret = content;
+                    return content;
+                }
+            }
+        }
+        catch { }
+    }
+    const newSecret = (0, node_crypto_1.randomBytes)(32).toString('hex');
+    for (const filePath of candidatePaths) {
+        try {
+            const dir = node_path_1.default.dirname(filePath);
+            if (!(0, node_fs_1.existsSync)(dir))
+                (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+            (0, node_fs_1.writeFileSync)(filePath, newSecret, { encoding: 'utf8', mode: 0o600 });
+            if (!customSecretFile)
+                cachedFallbackSecret = newSecret;
+            return newSecret;
+        }
+        catch { }
+    }
+    if (!customSecretFile)
+        cachedFallbackSecret = newSecret;
+    return newSecret;
+}
+function resolveAuthConfig(optionsAuth, env = process.env) {
+    const envDisabled = ['0', 'false', 'no', 'off'].includes(String(env.ADMINDB_AUTH ?? '').trim().toLowerCase()) ||
+        ['1', 'true', 'yes'].includes(String(env.ADMINDB_NO_AUTH ?? env.ADMINDB_DISABLE_AUTH ?? '').trim().toLowerCase());
+    let enabled = true;
+    let username = String(env.ADMINDB_USERNAME ?? env.ADMINDB_USER ?? types_1.DEFAULT_USERNAME).trim();
+    let password = String(env.ADMINDB_PASSWORD ?? env.ADMINDB_PASS ?? types_1.DEFAULT_PASSWORD_HASH).trim();
+    let secret = String(env.ADMINDB_SECRET ?? env.SESSION_SECRET ?? '').trim() || getOrCreatePersistentSecret(env);
+    let sessionDurationMs = types_1.DEFAULT_SESSION_DURATION_MS;
+    if (optionsAuth === false || envDisabled) {
+        enabled = false;
+    }
+    else if (typeof optionsAuth === 'object' && optionsAuth !== null) {
+        if (optionsAuth.enabled === false)
+            enabled = false;
+        if (optionsAuth.username !== undefined)
+            username = String(optionsAuth.username).trim();
+        if (optionsAuth.password !== undefined)
+            password = String(optionsAuth.password).trim();
+        if (optionsAuth.secret !== undefined && String(optionsAuth.secret).trim()) {
+            secret = String(optionsAuth.secret).trim();
+        }
+        if (optionsAuth.sessionDurationMs !== undefined)
+            sessionDurationMs = optionsAuth.sessionDurationMs;
+    }
+    const isDefaultPassword = username === types_1.DEFAULT_USERNAME &&
+        (password === types_1.DEFAULT_PASSWORD_HASH || password === 'admin');
+    return {
+        enabled,
+        username,
+        password,
+        secret,
+        sessionDurationMs,
+        isDefaultPassword,
+    };
+}

package/dist/auth/crypto.js

@@ -1 +1,98 @@
-Object.defineProperty(exports,"__esModule",{value:!0}),exports.hashPassword=function(password,salt){const saltHex=salt||(0,node_crypto_1.randomBytes)(16).toString("hex"),derivedKey=(0,node_crypto_1.scryptSync)(password,saltHex,64).toString("hex");return`scrypt:${saltHex}:${derivedKey}`},exports.constantTimeCompare=constantTimeCompare,exports.verifyPassword=function(candidatePassword,storedPasswordOrHash){if("string"!=typeof candidatePassword||"string"!=typeof storedPasswordOrHash)return!1;if(storedPasswordOrHash.startsWith("scrypt:")){const parts=storedPasswordOrHash.split(":");if(3===parts.length&&parts[1]&&parts[2]){const salt=parts[1],expectedKeyHex=parts[2];try{return constantTimeCompare((0,node_crypto_1.scryptSync)(candidatePassword,salt,64).toString("hex"),expectedKeyHex)}catch{return!1}}}return constantTimeCompare(candidatePassword,storedPasswordOrHash)},exports.parseCookies=function(cookieHeader){const cookies={};if(!cookieHeader)return cookies;for(const pair of cookieHeader.split(";")){const idx=pair.indexOf("=");if(-1===idx)continue;const key=pair.slice(0,idx).trim();let val=pair.slice(idx+1).trim();if(val.startsWith('"')&&val.endsWith('"')&&val.length>=2&&(val=val.slice(1,-1)),key)try{cookies[key]=decodeURIComponent(val)}catch{cookies[key]=val}}return cookies},exports.createSessionToken=function(username,secret,durationMs=types_1.DEFAULT_SESSION_DURATION_MS){const expiresAt=Date.now()+durationMs,data=`${Buffer.from(username,"utf8").toString("base64url")}.${expiresAt}`,signature=(0,node_crypto_1.createHmac)("sha256",secret).update(data).digest("base64url");return`${data}.${signature}`},exports.verifySessionToken=function(token,secret,expectedUser){if(!token||"string"!=typeof token)return null;const parts=token.split(".");if(3!==parts.length)return null;const[userPayload,expiresStr,providedSignature]=parts,data=`${userPayload}.${expiresStr}`,expectedSignature=(0,node_crypto_1.createHmac)("sha256",secret).update(data).digest("base64url");if(!constantTimeCompare(providedSignature,expectedSignature))return null;const expiresAt=Number.parseInt(expiresStr,10);if(!Number.isFinite(expiresAt)||Date.now()>expiresAt)return null;let username;try{username=Buffer.from(userPayload,"base64url").toString("utf8")}catch{return null}if(expectedUser&&!constantTimeCompare(username,expectedUser))return null;return username};const node_crypto_1=require("node:crypto"),types_1=require("./types");function constantTimeCompare(a,b){try{const bufA=Buffer.from(String(a),"utf8"),bufB=Buffer.from(String(b),"utf8");return bufA.length!==bufB.length?((0,node_crypto_1.timingSafeEqual)(bufA,bufA),!1):(0,node_crypto_1.timingSafeEqual)(bufA,bufB)}catch{return!1}}
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashPassword = hashPassword;
+exports.constantTimeCompare = constantTimeCompare;
+exports.verifyPassword = verifyPassword;
+exports.parseCookies = parseCookies;
+exports.createSessionToken = createSessionToken;
+exports.verifySessionToken = verifySessionToken;
+const node_crypto_1 = require("node:crypto");
+const types_1 = require("./types");
+function hashPassword(password, salt) {
+    const saltHex = salt || (0, node_crypto_1.randomBytes)(16).toString('hex');
+    const derivedKey = (0, node_crypto_1.scryptSync)(password, saltHex, 64).toString('hex');
+    return `scrypt:${saltHex}:${derivedKey}`;
+}
+function constantTimeCompare(a, b) {
+    try {
+        const bufA = Buffer.from(String(a), 'utf8');
+        const bufB = Buffer.from(String(b), 'utf8');
+        if (bufA.length !== bufB.length) {
+            (0, node_crypto_1.timingSafeEqual)(bufA, bufA);
+            return false;
+        }
+        return (0, node_crypto_1.timingSafeEqual)(bufA, bufB);
+    }
+    catch {
+        return false;
+    }
+}
+function verifyPassword(candidatePassword, storedPasswordOrHash) {
+    if (typeof candidatePassword !== 'string' || typeof storedPasswordOrHash !== 'string')
+        return false;
+    if (storedPasswordOrHash.startsWith('scrypt:')) {
+        const parts = storedPasswordOrHash.split(':');
+        if (parts.length === 3 && parts[1] && parts[2]) {
+            try {
+                const derivedKey = (0, node_crypto_1.scryptSync)(candidatePassword, parts[1], 64).toString('hex');
+                return constantTimeCompare(derivedKey, parts[2]);
+            }
+            catch {
+                return false;
+            }
+        }
+    }
+    return constantTimeCompare(candidatePassword, storedPasswordOrHash);
+}
+function parseCookies(cookieHeader) {
+    const cookies = {};
+    if (!cookieHeader)
+        return cookies;
+    for (const pair of cookieHeader.split(';')) {
+        const idx = pair.indexOf('=');
+        if (idx === -1)
+            continue;
+        const key = pair.slice(0, idx).trim();
+        let val = pair.slice(idx + 1).trim();
+        if (val.startsWith('"') && val.endsWith('"') && val.length >= 2)
+            val = val.slice(1, -1);
+        if (key) {
+            try {
+                cookies[key] = decodeURIComponent(val);
+            }
+            catch {
+                cookies[key] = val;
+            }
+        }
+    }
+    return cookies;
+}
+function createSessionToken(username, secret, durationMs = types_1.DEFAULT_SESSION_DURATION_MS) {
+    const data = `${Buffer.from(username, 'utf8').toString('base64url')}.${Date.now() + durationMs}`;
+    const signature = (0, node_crypto_1.createHmac)('sha256', secret).update(data).digest('base64url');
+    return `${data}.${signature}`;
+}
+function verifySessionToken(token, secret, expectedUser) {
+    if (!token || typeof token !== 'string')
+        return null;
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        return null;
+    const [userPayload, expiresStr, providedSignature] = parts;
+    const data = `${userPayload}.${expiresStr}`;
+    const expectedSignature = (0, node_crypto_1.createHmac)('sha256', secret).update(data).digest('base64url');
+    if (!constantTimeCompare(providedSignature, expectedSignature))
+        return null;
+    const expiresAt = Number.parseInt(expiresStr, 10);
+    if (!Number.isFinite(expiresAt) || Date.now() > expiresAt)
+        return null;
+    try {
+        const username = Buffer.from(userPayload, 'base64url').toString('utf8');
+        if (expectedUser && !constantTimeCompare(username, expectedUser))
+            return null;
+        return username;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/auth/index.js

@@ -1 +1,21 @@
-var __createBinding=this&&this.__createBinding||(Object.create?function(o,m,k,k2){void 0===k2&&(k2=k);var desc=Object.getOwnPropertyDescriptor(m,k);desc&&!("get"in desc?!m.__esModule:desc.writable||desc.configurable)||(desc={enumerable:!0,get:function(){return m[k]}}),Object.defineProperty(o,k2,desc)}:function(o,m,k,k2){void 0===k2&&(k2=k),o[k2]=m[k]}),__exportStar=this&&this.__exportStar||function(m,exports){for(var p in m)"default"===p||Object.prototype.hasOwnProperty.call(exports,p)||__createBinding(exports,m,p)};Object.defineProperty(exports,"__esModule",{value:!0}),__exportStar(require("./types"),exports),__exportStar(require("./crypto"),exports),__exportStar(require("./config"),exports),__exportStar(require("./middleware"),exports),__exportStar(require("./routes"),exports);
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types"), exports);
+__exportStar(require("./crypto"), exports);
+__exportStar(require("./config"), exports);
+__exportStar(require("./middleware"), exports);
+__exportStar(require("./routes"), exports);

package/dist/auth/middleware.js

@@ -1 +1,78 @@
-Object.defineProperty(exports,"__esModule",{value:!0}),exports.authenticateRequest=authenticateRequest,exports.createAuthMiddleware=function(config,basePath,_logger){return(req,res,next)=>{if(res.locals.authEnabled=config.enabled,res.locals.isDefaultPassword=config.isDefaultPassword,!config.enabled)return res.locals.authUser=null,next();const p=req.path;if(p.startsWith("/css/")||p.startsWith("/js/")||"/favicon.ico"===p||"/login"===p||"/logout"===p)return next();const auth=authenticateRequest(req,config);if(auth.authenticated&&auth.user)return res.locals.authUser=auth.user,req.user=auth.user,next();if(p.startsWith("/api/")||req.xhr||req.headers.accept&&req.headers.accept.includes("application/json"))return res.setHeader("WWW-Authenticate",'Basic realm="AdminDB", Bearer'),void res.status(401).json({success:!1,error:"Authentication required. Please log in or provide valid credentials."});const returnUrl=req.originalUrl||`${basePath}${req.url}`,loginUrl=`${basePath}/login${returnUrl&&returnUrl!==`${basePath}/`?`?next=${encodeURIComponent(returnUrl)}`:""}`;res.redirect(loginUrl)}};const types_1=require("./types"),crypto_1=require("./crypto");function authenticateRequest(req,config){if(!config.enabled)return{authenticated:!0,user:"anonymous"};const authHeader=req.headers.authorization;if(authHeader){const[scheme,credentials]=authHeader.split(/\s+/,2);if(scheme&&credentials)if("basic"===scheme.toLowerCase())try{const decoded=Buffer.from(credentials,"base64").toString("utf8"),colonIdx=decoded.indexOf(":");if(-1!==colonIdx){const user=decoded.slice(0,colonIdx),pass=decoded.slice(colonIdx+1);if((0,crypto_1.constantTimeCompare)(user,config.username)&&(0,crypto_1.verifyPassword)(pass,config.password))return{authenticated:!0,user:user}}}catch{}else if("bearer"===scheme.toLowerCase()){const user=(0,crypto_1.verifySessionToken)(credentials,config.secret,config.username);if(user)return{authenticated:!0,user:user};if((0,crypto_1.verifyPassword)(credentials,config.password))return{authenticated:!0,user:config.username}}}const sessionCookie=(0,crypto_1.parseCookies)(req.headers.cookie)[types_1.SESSION_COOKIE_NAME];if(sessionCookie){const user=(0,crypto_1.verifySessionToken)(sessionCookie,config.secret,config.username);if(user)return{authenticated:!0,user:user}}return{authenticated:!1}}
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authenticateRequest = authenticateRequest;
+exports.createAuthMiddleware = createAuthMiddleware;
+const types_1 = require("./types");
+const crypto_1 = require("./crypto");
+function authenticateRequest(req, config) {
+    if (!config.enabled)
+        return { authenticated: true, user: 'anonymous' };
+    const authHeader = req.headers.authorization;
+    if (authHeader) {
+        const [scheme, credentials] = authHeader.split(/\s+/, 2);
+        if (scheme && credentials) {
+            const lowerScheme = scheme.toLowerCase();
+            if (lowerScheme === 'basic') {
+                try {
+                    const decoded = Buffer.from(credentials, 'base64').toString('utf8');
+                    const colonIdx = decoded.indexOf(':');
+                    if (colonIdx !== -1) {
+                        const user = decoded.slice(0, colonIdx);
+                        const pass = decoded.slice(colonIdx + 1);
+                        if ((0, crypto_1.constantTimeCompare)(user, config.username) && (0, crypto_1.verifyPassword)(pass, config.password)) {
+                            return { authenticated: true, user };
+                        }
+                    }
+                }
+                catch {
+                }
+            }
+            else if (lowerScheme === 'bearer') {
+                const user = (0, crypto_1.verifySessionToken)(credentials, config.secret, config.username);
+                if (user)
+                    return { authenticated: true, user };
+                if ((0, crypto_1.verifyPassword)(credentials, config.password)) {
+                    return { authenticated: true, user: config.username };
+                }
+            }
+        }
+    }
+    const sessionCookie = (0, crypto_1.parseCookies)(req.headers.cookie)[types_1.SESSION_COOKIE_NAME];
+    if (sessionCookie) {
+        const user = (0, crypto_1.verifySessionToken)(sessionCookie, config.secret, config.username);
+        if (user)
+            return { authenticated: true, user };
+    }
+    return { authenticated: false };
+}
+function createAuthMiddleware(config, basePath, _logger) {
+    return (req, res, next) => {
+        res.locals.authEnabled = config.enabled;
+        res.locals.isDefaultPassword = config.isDefaultPassword;
+        if (!config.enabled) {
+            res.locals.authUser = null;
+            return next();
+        }
+        const p = req.path;
+        if (p.startsWith('/css/') || p.startsWith('/js/') || p === '/favicon.ico' || p === '/login' || p === '/logout') {
+            return next();
+        }
+        const auth = authenticateRequest(req, config);
+        if (auth.authenticated && auth.user) {
+            res.locals.authUser = auth.user;
+            req.user = auth.user;
+            return next();
+        }
+        if (p.startsWith('/api/') || req.xhr || req.headers.accept?.includes('application/json')) {
+            res.setHeader('WWW-Authenticate', 'Basic realm="AdminDB", Bearer');
+            res.status(401).json({
+                success: false,
+                error: 'Authentication required. Please log in or provide valid credentials.',
+            });
+            return;
+        }
+        const returnUrl = req.originalUrl || `${basePath}${req.url}`;
+        const loginUrl = `${basePath}/login${returnUrl && returnUrl !== `${basePath}/` ? `?next=${encodeURIComponent(returnUrl)}` : ''}`;
+        res.redirect(loginUrl);
+    };
+}

package/dist/auth/routes.js

@@ -1 +1,64 @@
-Object.defineProperty(exports,"__esModule",{value:!0}),exports.registerAuthRoutes=function(router,config,basePath,logger){router.get("/login",(req,res)=>{if(!config.enabled)return res.redirect(`${basePath}/`);if((0,middleware_1.authenticateRequest)(req,config).authenticated){const nextUrl=String(req.query.next??"").trim();return res.redirect(nextUrl.startsWith("/")?nextUrl:`${basePath}/`)}const nextUrl=String(req.query.next??"").trim();res.render("pages/login",{title:"Sign in",noSidebar:!0,next:nextUrl.startsWith("/")?nextUrl:"",isDefaultPassword:config.isDefaultPassword,error:req.query.error?String(req.query.error):null})}),router.post("/login",(req,res)=>{if(!config.enabled)return res.redirect(`${basePath}/`);const username=String(req.body?.username??"").trim(),password=String(req.body?.password??"").trim(),nextUrl=String(req.body?.next??req.query.next??"").trim();if(!((0,crypto_1.constantTimeCompare)(username,config.username)&&(0,crypto_1.verifyPassword)(password,config.password)))return logger.warn(`Failed login attempt for user "${username||"<empty>"}"`),req.xhr||req.headers.accept&&req.headers.accept.includes("application/json")?res.status(401).json({success:!1,error:"Invalid username or password."}):res.status(401).render("pages/login",{title:"Sign in",noSidebar:!0,username:username,next:nextUrl.startsWith("/")?nextUrl:"",isDefaultPassword:config.isDefaultPassword,error:"Invalid username or password. Please check your credentials."});const token=(0,crypto_1.createSessionToken)(config.username,config.secret,config.sessionDurationMs),maxAgeSec=Math.floor(config.sessionDurationMs/1e3),expiresUtc=new Date(Date.now()+config.sessionDurationMs).toUTCString(),cookiePath=basePath||"/";if(res.setHeader("Set-Cookie",`${types_1.SESSION_COOKIE_NAME}=${encodeURIComponent(token)}; Path=${cookiePath}; Max-Age=${maxAgeSec}; Expires=${expiresUtc}; HttpOnly; SameSite=Lax`),req.xhr||req.headers.accept&&req.headers.accept.includes("application/json"))return res.json({success:!0,message:"Logged in successfully.",user:config.username,token:token});const target=nextUrl.startsWith("/")?nextUrl:`${basePath}/`;res.redirect(target)});const handleLogout=(req,res)=>{const cookiePath=basePath||"/";if(res.setHeader("Set-Cookie",`${types_1.SESSION_COOKIE_NAME}=; Path=${cookiePath}; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; HttpOnly; SameSite=Lax`),req.xhr||req.headers.accept&&req.headers.accept.includes("application/json"))return res.json({success:!0,message:"Logged out successfully."});res.redirect(`${basePath}/login`)};router.post("/logout",handleLogout),router.get("/logout",handleLogout)};const types_1=require("./types"),middleware_1=require("./middleware"),crypto_1=require("./crypto");
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAuthRoutes = registerAuthRoutes;
+const types_1 = require("./types");
+const middleware_1 = require("./middleware");
+const crypto_1 = require("./crypto");
+function registerAuthRoutes(router, config, basePath, logger) {
+    router.get('/login', (req, res) => {
+        if (!config.enabled)
+            return res.redirect(`${basePath}/`);
+        const auth = (0, middleware_1.authenticateRequest)(req, config);
+        const nextUrl = String(req.query.next ?? '').trim();
+        if (auth.authenticated) {
+            return res.redirect(nextUrl.startsWith('/') ? nextUrl : `${basePath}/`);
+        }
+        res.render('pages/login', {
+            title: 'Sign in',
+            noSidebar: true,
+            next: nextUrl.startsWith('/') ? nextUrl : '',
+            isDefaultPassword: config.isDefaultPassword,
+            error: req.query.error ? String(req.query.error) : null,
+        });
+    });
+    router.post('/login', (req, res) => {
+        if (!config.enabled)
+            return res.redirect(`${basePath}/`);
+        const username = String(req.body?.username ?? '').trim();
+        const password = String(req.body?.password ?? '').trim();
+        const nextUrl = String(req.body?.next ?? req.query.next ?? '').trim();
+        const isValid = (0, crypto_1.constantTimeCompare)(username, config.username) && (0, crypto_1.verifyPassword)(password, config.password);
+        if (!isValid) {
+            logger.warn(`Failed login attempt for user "${username || '<empty>'}"`);
+            if (req.xhr || req.headers.accept?.includes('application/json')) {
+                return res.status(401).json({ success: false, error: 'Invalid username or password.' });
+            }
+            return res.status(401).render('pages/login', {
+                title: 'Sign in',
+                noSidebar: true,
+                username,
+                next: nextUrl.startsWith('/') ? nextUrl : '',
+                isDefaultPassword: config.isDefaultPassword,
+                error: 'Invalid username or password. Please check your credentials.',
+            });
+        }
+        const token = (0, crypto_1.createSessionToken)(config.username, config.secret, config.sessionDurationMs);
+        const maxAgeSec = Math.floor(config.sessionDurationMs / 1000);
+        const expiresUtc = new Date(Date.now() + config.sessionDurationMs).toUTCString();
+        const cookiePath = basePath || '/';
+        res.setHeader('Set-Cookie', `${types_1.SESSION_COOKIE_NAME}=${encodeURIComponent(token)}; Path=${cookiePath}; Max-Age=${maxAgeSec}; Expires=${expiresUtc}; HttpOnly; SameSite=Lax`);
+        if (req.xhr || req.headers.accept?.includes('application/json')) {
+            return res.json({ success: true, message: 'Logged in successfully.', user: config.username, token });
+        }
+        res.redirect(nextUrl.startsWith('/') ? nextUrl : `${basePath}/`);
+    });
+    const handleLogout = (req, res) => {
+        res.setHeader('Set-Cookie', `${types_1.SESSION_COOKIE_NAME}=; Path=${basePath || '/'}; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; HttpOnly; SameSite=Lax`);
+        if (req.xhr || req.headers.accept?.includes('application/json')) {
+            return res.json({ success: true, message: 'Logged out successfully.' });
+        }
+        res.redirect(`${basePath}/login`);
+    };
+    router.post('/logout', handleLogout);
+    router.get('/logout', handleLogout);
+}