backupdrill 2.0.0 → 2.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/restore-engine.js +5 -2
- package/package.json +1 -1
package/dist/restore-engine.js
CHANGED
|
@@ -11,7 +11,7 @@
|
|
|
11
11
|
import { spawn } from "node:child_process";
|
|
12
12
|
import { Client } from "pg";
|
|
13
13
|
import { resolvePgRestoreBin } from "./pgbin.js";
|
|
14
|
-
import { pgConnectOptions } from "./supabase-ca.js";
|
|
14
|
+
import { pgConnectOptions, dumpUrlFor } from "./supabase-ca.js";
|
|
15
15
|
/** 主机名规范化:剥掉合法的 DNS 根点(db.x.supabase.co. ≡ db.x.supabase.co)。
|
|
16
16
|
* 身份比较不规范化 = 一个尾点就能绕过同源阻断(supabase-ca 对同类早有钉子)。 */
|
|
17
17
|
export function normalizeHost(hostname) {
|
|
@@ -254,7 +254,10 @@ export function assertNoHostOverride(connString) {
|
|
|
254
254
|
}
|
|
255
255
|
export async function restoreDatabaseArtifact(opts) {
|
|
256
256
|
const bin = resolvePgRestoreBin();
|
|
257
|
-
|
|
257
|
+
// TLS 全链路 verify-full(创始人承诺项):pg_restore 与 pg_dump 同一改写——
|
|
258
|
+
// Supabase 主机强制 verify-full + 打包根 CA(libpq 的 require 不验证书,
|
|
259
|
+
// 中间人可拿到连接与数据);沙箱/外部主机原样透传。先改写 SSL 再拆密码。
|
|
260
|
+
const { url, env } = credentialSafeDbArgs(dumpUrlFor(opts.connString));
|
|
258
261
|
const common = ["--no-owner", "--no-privileges", "--dbname", url, opts.dumpPath];
|
|
259
262
|
const first = await spawnPgRestore(bin, ["--section=pre-data", "--section=data", ...common], env);
|
|
260
263
|
const preData = finalizePass(first.code, first.stderr, classifyBlocks(first.stderr, SCHEMA_EXISTS_ERROR));
|
package/package.json
CHANGED