atoo-studio 0.0.1 → 0.0.2

package/dist/src/auth/password.js

@@ -0,0 +1,12 @@
+import argon2 from 'argon2';
+export async function hashPassword(plain) {
+    return argon2.hash(plain, {
+        type: argon2.argon2id,
+        memoryCost: 65536,
+        timeCost: 3,
+        parallelism: 1,
+    });
+}
+export async function verifyPassword(plain, hash) {
+    return argon2.verify(hash, plain);
+}

package/dist/src/auth/session.d.ts

@@ -0,0 +1,10 @@
+import { type User } from '../state/db.js';
+import type { Request, Response } from 'express';
+export declare const SESSION_COOKIE_NAME = "atoo_studio_sid";
+export declare const SESSION_MAX_AGE: number;
+export declare function createSession(userId: string, req: Request): string;
+export declare function getSessionUser(sessionId: string): User | null;
+export declare function destroySession(sessionId: string): void;
+export declare function destroyAllUserSessions(userId: string): void;
+export declare function setSessionCookie(res: Response, sessionId: string): void;
+export declare function clearSessionCookie(res: Response): void;

package/dist/src/auth/session.js

@@ -0,0 +1,33 @@
+import { v4 as uuidv4 } from 'uuid';
+import { db } from '../state/db.js';
+export const SESSION_COOKIE_NAME = 'atoo_studio_sid';
+export const SESSION_MAX_AGE = 30 * 24 * 60 * 60 * 1000; // 30 days
+export function createSession(userId, req) {
+    const sessionId = uuidv4();
+    const expiresAt = new Date(Date.now() + SESSION_MAX_AGE).toISOString();
+    const ip = req.ip || req.socket.remoteAddress || '';
+    const ua = req.headers['user-agent'] || '';
+    db.createAuthSession(sessionId, userId, expiresAt, ip, ua);
+    return sessionId;
+}
+export function getSessionUser(sessionId) {
+    return db.getAuthSessionUser(sessionId);
+}
+export function destroySession(sessionId) {
+    db.deleteAuthSession(sessionId);
+}
+export function destroyAllUserSessions(userId) {
+    db.deleteAllUserAuthSessions(userId);
+}
+export function setSessionCookie(res, sessionId) {
+    res.cookie(SESSION_COOKIE_NAME, sessionId, {
+        httpOnly: true,
+        secure: true,
+        sameSite: 'strict',
+        maxAge: SESSION_MAX_AGE,
+        path: '/',
+    });
+}
+export function clearSessionCookie(res) {
+    res.clearCookie(SESSION_COOKIE_NAME, { path: '/' });
+}

package/dist/src/auth/totp.d.ts

@@ -0,0 +1,12 @@
+export declare function generateTotpSecret(username: string): Promise<{
+    secret: string;
+    otpauthUri: string;
+    qrDataUrl: string;
+}>;
+export declare function verifyTotpToken(secret: string, token: string): boolean;
+export declare function saveTotpSecret(userId: string, secret: string): void;
+export declare function getTotpSecret(userId: string): string | null;
+export declare function getUnverifiedTotpSecret(userId: string): string | null;
+export declare function markTotpVerified(userId: string): void;
+export declare function removeTotpSecret(userId: string): void;
+export declare function hasTotpEnabled(userId: string): boolean;

package/dist/src/auth/totp.js

@@ -0,0 +1,61 @@
+import { TOTP, Secret } from 'otpauth';
+import QRCode from 'qrcode';
+import { encrypt, decrypt } from './crypto-key.js';
+import { db } from '../state/db.js';
+const ISSUER = 'Atoo Studio';
+export async function generateTotpSecret(username) {
+    const secret = new Secret({ size: 20 });
+    const totp = new TOTP({
+        issuer: ISSUER,
+        label: username,
+        algorithm: 'SHA1',
+        digits: 6,
+        period: 30,
+        secret,
+    });
+    const otpauthUri = totp.toString();
+    const qrDataUrl = await QRCode.toDataURL(otpauthUri);
+    return {
+        secret: secret.base32,
+        otpauthUri,
+        qrDataUrl,
+    };
+}
+export function verifyTotpToken(secret, token) {
+    const totp = new TOTP({
+        issuer: ISSUER,
+        algorithm: 'SHA1',
+        digits: 6,
+        period: 30,
+        secret: Secret.fromBase32(secret),
+    });
+    // Allow 1 period of drift
+    const delta = totp.validate({ token, window: 1 });
+    return delta !== null;
+}
+export function saveTotpSecret(userId, secret) {
+    const encrypted = encrypt(secret);
+    db.saveTotpSecret(userId, encrypted);
+}
+export function getTotpSecret(userId) {
+    const row = db.getTotpSecret(userId);
+    if (!row || !row.verified)
+        return null;
+    return decrypt(row.secret_encrypted);
+}
+export function getUnverifiedTotpSecret(userId) {
+    const row = db.getTotpSecret(userId);
+    if (!row)
+        return null;
+    return decrypt(row.secret_encrypted);
+}
+export function markTotpVerified(userId) {
+    db.markTotpVerified(userId);
+}
+export function removeTotpSecret(userId) {
+    db.deleteTotpSecret(userId);
+}
+export function hasTotpEnabled(userId) {
+    const row = db.getTotpSecret(userId);
+    return !!row && !!row.verified;
+}

package/dist/src/auth/webauthn.d.ts

@@ -0,0 +1,6 @@
+import { type User } from '../state/db.js';
+export declare function getRegistrationOptions(user: User, rpID: string): Promise<import("@simplewebauthn/server").PublicKeyCredentialCreationOptionsJSON>;
+export declare function verifyAndSaveRegistration(user: User, rpID: string, origin: string, response: any, deviceName?: string): Promise<boolean>;
+export declare function getAuthOptions(userId: string, rpID: string): Promise<import("@simplewebauthn/server").PublicKeyCredentialRequestOptionsJSON>;
+export declare function verifyAuth(userId: string, rpID: string, origin: string, response: any): Promise<boolean>;
+export declare function getUsersWithPasskeys(): string[];

package/dist/src/auth/webauthn.js

@@ -0,0 +1,117 @@
+import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse, } from '@simplewebauthn/server';
+import { v4 as uuidv4 } from 'uuid';
+import { db } from '../state/db.js';
+const RP_NAME = 'Atoo Studio';
+// In-memory challenge store (short-lived, keyed by usedId)
+const challenges = new Map();
+function storeChallenge(userId, challenge) {
+    challenges.set(userId, { challenge, expires: Date.now() + 5 * 60 * 1000 });
+}
+function getChallenge(userId) {
+    const entry = challenges.get(userId);
+    if (!entry || entry.expires < Date.now()) {
+        challenges.delete(userId);
+        return null;
+    }
+    challenges.delete(userId);
+    return entry.challenge;
+}
+export async function getRegistrationOptions(user, rpID) {
+    const existingPasskeys = db.listPasskeys(user.id);
+    const options = await generateRegistrationOptions({
+        rpName: RP_NAME,
+        rpID,
+        userName: user.username,
+        userDisplayName: user.display_name,
+        attestationType: 'none',
+        excludeCredentials: existingPasskeys.map((pk) => ({
+            id: pk.credential_id,
+            transports: pk.transports ? JSON.parse(pk.transports) : undefined,
+        })),
+        authenticatorSelection: {
+            residentKey: 'preferred',
+            userVerification: 'preferred',
+        },
+    });
+    storeChallenge(user.id, options.challenge);
+    return options;
+}
+export async function verifyAndSaveRegistration(user, rpID, origin, response, deviceName) {
+    const expectedChallenge = getChallenge(user.id);
+    if (!expectedChallenge)
+        return false;
+    let verification;
+    try {
+        verification = await verifyRegistrationResponse({
+            response,
+            expectedChallenge,
+            expectedOrigin: origin,
+            expectedRPID: rpID,
+        });
+    }
+    catch {
+        return false;
+    }
+    if (!verification.verified || !verification.registrationInfo)
+        return false;
+    const { credential } = verification.registrationInfo;
+    db.createPasskey({
+        id: uuidv4(),
+        user_id: user.id,
+        credential_id: credential.id,
+        public_key: Buffer.from(credential.publicKey).toString('base64'),
+        counter: credential.counter,
+        transports: response.response?.transports ? JSON.stringify(response.response.transports) : null,
+        device_name: deviceName || null,
+    });
+    return true;
+}
+export async function getAuthOptions(userId, rpID) {
+    const passkeys = db.listPasskeys(userId);
+    const options = await generateAuthenticationOptions({
+        rpID,
+        allowCredentials: passkeys.map((pk) => ({
+            id: pk.credential_id,
+            transports: pk.transports ? JSON.parse(pk.transports) : undefined,
+        })),
+        userVerification: 'preferred',
+    });
+    storeChallenge(userId, options.challenge);
+    return options;
+}
+export async function verifyAuth(userId, rpID, origin, response) {
+    const expectedChallenge = getChallenge(userId);
+    if (!expectedChallenge)
+        return false;
+    // Find the credential being used
+    const credentialId = response.id;
+    const passkey = db.findPasskeyByCredentialId(credentialId);
+    if (!passkey || passkey.user_id !== userId)
+        return false;
+    let verification;
+    try {
+        verification = await verifyAuthenticationResponse({
+            response,
+            expectedChallenge,
+            expectedOrigin: origin,
+            expectedRPID: rpID,
+            credential: {
+                id: passkey.credential_id,
+                publicKey: Buffer.from(passkey.public_key, 'base64'),
+                counter: passkey.counter,
+                transports: passkey.transports ? JSON.parse(passkey.transports) : undefined,
+            },
+        });
+    }
+    catch {
+        return false;
+    }
+    if (!verification.verified)
+        return false;
+    // Update counter
+    db.updatePasskeyCounter(passkey.id, verification.authenticationInfo.newCounter);
+    return true;
+}
+export function getUsersWithPasskeys() {
+    return db.getUserIdsWithPasskeys();
+}

package/dist/src/config.d.ts

@@ -0,0 +1,10 @@
+export declare const PROJECT_ROOT: string;
+export declare const PROXY_PORT = 8081;
+export declare const WEB_PORT = 3010;
+export declare const CERTS_DIR: string;
+export declare const CA_CERT_PATH: string;
+export declare const CA_KEY_PATH: string;
+export declare const WEB_CERT_PATH: string;
+export declare const WEB_KEY_PATH: string;
+export declare const CDP_PORT_START = 9300;
+export declare const CDP_PORT_END = 9399;

package/dist/src/config.js

@@ -0,0 +1,16 @@
+import path from 'path';
+import { fileURLToPath } from 'url';
+// Resolve the project root — works for both tsx (src/config.ts) and compiled (dist/src/config.js)
+const __config_dirname = path.dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = __config_dirname.includes('/dist/src')
+    ? path.resolve(__config_dirname, '../..') // dist/src/ → project root
+    : path.resolve(__config_dirname, '..'); // src/ → project root
+export const PROXY_PORT = 8081;
+export const WEB_PORT = 3010;
+export const CERTS_DIR = path.join(PROJECT_ROOT, 'certs') + '/';
+export const CA_CERT_PATH = `${CERTS_DIR}ca.pem`;
+export const CA_KEY_PATH = `${CERTS_DIR}ca-key.pem`;
+export const WEB_CERT_PATH = `${CERTS_DIR}web-cert.pem`;
+export const WEB_KEY_PATH = `${CERTS_DIR}web-key.pem`;
+export const CDP_PORT_START = 9300;
+export const CDP_PORT_END = 9399;

package/dist/src/database/connection-manager.d.ts

@@ -0,0 +1,25 @@
+import type { ConnectionParams, DbType, QueryResult, SchemaInfo, TableInfo } from './types.js';
+declare class ConnectionManager {
+    private connections;
+    private cleanupInterval;
+    constructor();
+    connect(dbType: DbType, params: ConnectionParams, name?: string, readonly?: boolean): Promise<string>;
+    disconnect(connectionId: string): Promise<void>;
+    query(connectionId: string, sql: string, limit?: number, timeoutMs?: number): Promise<QueryResult>;
+    getTables(connectionId: string): Promise<TableInfo[]>;
+    describeTable(connectionId: string, table: string): Promise<SchemaInfo>;
+    getDatabases(connectionId: string): Promise<string[]>;
+    getActiveConnections(): Array<{
+        id: string;
+        name: string;
+        db_type: DbType;
+        connected: boolean;
+        readonly: boolean;
+    }>;
+    private getDefaultPort;
+    private getConn;
+    private cleanupIdle;
+    shutdown(): Promise<void>;
+}
+export declare const connectionManager: ConnectionManager;
+export {};

package/dist/src/database/connection-manager.js

@@ -0,0 +1,211 @@
+import { v4 as uuidv4 } from 'uuid';
+// Tier 1 drivers — always available (deps already in package.json)
+import { PostgreSQLDriver } from './drivers/postgresql.js';
+import { SQLiteDriver } from './drivers/sqlite.js';
+import { MySQLDriver } from './drivers/mysql.js';
+import { RedisDriver } from './drivers/redis.js';
+import { MongoDBDriver } from './drivers/mongodb.js';
+import { sshManager } from '../services/ssh-manager.js';
+// Tier 2+3 drivers — loaded lazily so missing npm packages don't crash the server
+async function loadDriver(name) {
+    try {
+        switch (name) {
+            case 'elasticsearch': return (await import('./drivers/elasticsearch.js')).ElasticsearchDriver;
+            case 'clickhouse': return (await import('./drivers/clickhouse.js')).ClickHouseDriver;
+            case 'neo4j': return (await import('./drivers/neo4j.js')).Neo4jDriver;
+            case 'influxdb': return (await import('./drivers/influxdb.js')).InfluxDBDriver;
+            case 'cassandra': return (await import('./drivers/cassandra.js')).CassandraDriver;
+            case 'memcached': return (await import('./drivers/memcached.js')).MemcachedDriver;
+            default: throw new Error(`Unknown driver: ${name}`);
+        }
+    }
+    catch (err) {
+        if (err.code === 'ERR_MODULE_NOT_FOUND' || err.code === 'MODULE_NOT_FOUND') {
+            throw new Error(`Driver for ${name} is not installed. Run: npm install ${getPackageName(name)}`);
+        }
+        throw err;
+    }
+}
+function getPackageName(driver) {
+    const map = {
+        elasticsearch: '@elastic/elasticsearch',
+        clickhouse: '@clickhouse/client', neo4j: 'neo4j-driver',
+        influxdb: '@influxdata/influxdb-client', cassandra: 'cassandra-driver',
+        memcached: 'memjs',
+    };
+    return map[driver] || driver;
+}
+const IDLE_TIMEOUT_MS = 30 * 60 * 1000; // 30 minutes
+/** Statements that modify data — blocked in readonly mode. */
+const WRITE_PATTERN = /^\s*(INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|TRUNCATE|REPLACE|MERGE|GRANT|REVOKE)\b/i;
+async function createDriver(dbType) {
+    // Tier 1 — always available
+    switch (dbType) {
+        case 'postgresql':
+        case 'cockroachdb':
+            return new PostgreSQLDriver();
+        case 'sqlite':
+            return new SQLiteDriver();
+        case 'mysql':
+        case 'mariadb':
+            return new MySQLDriver();
+        case 'redis':
+            return new RedisDriver();
+        case 'mongodb':
+            return new MongoDBDriver();
+    }
+    // Tier 2+3 — lazy loaded
+    const driverMap = {
+        elasticsearch: 'elasticsearch', opensearch: 'elasticsearch',
+        clickhouse: 'clickhouse', neo4j: 'neo4j', influxdb: 'influxdb',
+        cassandra: 'cassandra', scylladb: 'cassandra', memcached: 'memcached',
+    };
+    const driverName = driverMap[dbType];
+    if (!driverName)
+        throw new Error(`Unsupported database type: ${dbType}`);
+    const DriverClass = await loadDriver(driverName);
+    return new DriverClass();
+}
+class ConnectionManager {
+    connections = new Map();
+    cleanupInterval;
+    constructor() {
+        this.cleanupInterval = setInterval(() => this.cleanupIdle(), 60_000);
+    }
+    async connect(dbType, params, name, readonly = false) {
+        const driver = await createDriver(dbType);
+        // SSH tunnel: if ssh_connection_id is specified, create a local port forward
+        let effectiveParams = { ...params };
+        if (params.ssh_connection_id) {
+            if (!sshManager.isConnected(params.ssh_connection_id)) {
+                throw new Error('SSH connection is not active. Connect to the SSH host first.');
+            }
+            const remotePort = params.ssh_remote_port || params.port || this.getDefaultPort(dbType);
+            const localPort = await sshManager.getOrCreateForwardTunnel(params.ssh_connection_id, remotePort);
+            // Override host/port to go through the tunnel
+            effectiveParams = { ...params, host: '127.0.0.1', port: localPort };
+            // Clear connection_string since we're routing through tunnel
+            delete effectiveParams.connection_string;
+        }
+        // For SQLite, enforce readonly at the driver level
+        if (readonly && dbType === 'sqlite') {
+            effectiveParams = { ...effectiveParams, _readonly: true };
+        }
+        await driver.connect(effectiveParams);
+        // For PostgreSQL/CockroachDB, set default transaction read-only
+        if (readonly && (dbType === 'postgresql' || dbType === 'cockroachdb')) {
+            try {
+                await driver.query('SET default_transaction_read_only = ON');
+            }
+            catch { }
+        }
+        // For MySQL/MariaDB, set read-only session variable
+        if (readonly && (dbType === 'mysql' || dbType === 'mariadb')) {
+            try {
+                await driver.query('SET SESSION TRANSACTION READ ONLY');
+            }
+            catch { }
+        }
+        const id = uuidv4();
+        this.connections.set(id, {
+            id,
+            db_type: dbType,
+            driver,
+            params,
+            name: name || `${dbType}@${params.host || params.filename || 'localhost'}`,
+            readonly,
+            created_at: Date.now(),
+            last_used: Date.now(),
+        });
+        return id;
+    }
+    async disconnect(connectionId) {
+        const conn = this.connections.get(connectionId);
+        if (!conn)
+            throw new Error('Connection not found');
+        await conn.driver.disconnect();
+        this.connections.delete(connectionId);
+    }
+    async query(connectionId, sql, limit = 100, timeoutMs) {
+        const conn = this.getConn(connectionId);
+        conn.last_used = Date.now();
+        // Enforce readonly at the application level as an extra safeguard
+        if (conn.readonly && WRITE_PATTERN.test(sql)) {
+            throw new Error('Connection is read-only. Write operations are not allowed.');
+        }
+        // Apply timeout if specified
+        if (timeoutMs && timeoutMs > 0) {
+            return Promise.race([
+                conn.driver.query(sql, limit),
+                new Promise((_, reject) => setTimeout(() => reject(new Error(`Query timed out after ${timeoutMs}ms`)), timeoutMs)),
+            ]);
+        }
+        return conn.driver.query(sql, limit);
+    }
+    async getTables(connectionId) {
+        const conn = this.getConn(connectionId);
+        conn.last_used = Date.now();
+        return conn.driver.getTables();
+    }
+    async describeTable(connectionId, table) {
+        const conn = this.getConn(connectionId);
+        conn.last_used = Date.now();
+        return conn.driver.describeTable(table);
+    }
+    async getDatabases(connectionId) {
+        const conn = this.getConn(connectionId);
+        conn.last_used = Date.now();
+        if (conn.driver.getDatabases)
+            return conn.driver.getDatabases();
+        return [];
+    }
+    getActiveConnections() {
+        return [...this.connections.values()].map(c => ({
+            id: c.id,
+            name: c.name,
+            db_type: c.db_type,
+            connected: c.driver.isConnected(),
+            readonly: c.readonly,
+        }));
+    }
+    getDefaultPort(dbType) {
+        const ports = {
+            postgresql: 5432, cockroachdb: 26257, mysql: 3306, mariadb: 3306,
+            redis: 6379, mongodb: 27017, elasticsearch: 9200, opensearch: 9200,
+            clickhouse: 8123, neo4j: 7687, influxdb: 8086, cassandra: 9042,
+            scylladb: 9042, memcached: 11211,
+        };
+        return ports[dbType] || 5432;
+    }
+    getConn(id) {
+        const conn = this.connections.get(id);
+        if (!conn)
+            throw new Error('Connection not found');
+        if (!conn.driver.isConnected())
+            throw new Error('Connection is closed');
+        return conn;
+    }
+    async cleanupIdle() {
+        const now = Date.now();
+        for (const [id, conn] of this.connections) {
+            if (now - conn.last_used > IDLE_TIMEOUT_MS) {
+                try {
+                    await conn.driver.disconnect();
+                }
+                catch { }
+                this.connections.delete(id);
+            }
+        }
+    }
+    async shutdown() {
+        clearInterval(this.cleanupInterval);
+        for (const conn of this.connections.values()) {
+            try {
+                await conn.driver.disconnect();
+            }
+            catch { }
+        }
+        this.connections.clear();
+    }
+}
+export const connectionManager = new ConnectionManager();

package/dist/src/database/discovery/container.d.ts

@@ -0,0 +1,6 @@
+import type { DiscoveredDatabase } from '../types.js';
+export declare function discoverContainerDatabases(): Promise<DiscoveredDatabase[]>;
+/**
+ * Parse docker-compose.yml for database services (without running containers).
+ */
+export declare function parseComposeFile(projectDir: string): DiscoveredDatabase[];