ffp-sql-sandbox 0.1.0

package/sandbox/execute.js

@@ -0,0 +1,235 @@
+import { stdin } from 'node:process';
+import pg from 'pg';
+import mysql from 'mysql2/promise';
+import { createStreamLimiter } from './stream-limit.js';
+import { sessionSetupStatements } from './session-setup.js';
+import { readPassword } from './secrets.js';
+import { writeEvent, writeRunnerError } from './events.js';
+
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of stdin) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString('utf8');
+}
+
+function envInt(name, fallback) {
+  const raw = process.env[name];
+  if (raw === undefined || raw === '') {
+    return fallback;
+  }
+  const value = Number.parseInt(raw, 10);
+  if (!Number.isInteger(value) || value <= 0) {
+    throw new Error(`${name} must be a positive integer`);
+  }
+  return value;
+}
+
+function dialectFromEnv() {
+  const raw = (process.env.DB_TYPE ?? 'postgres').toLowerCase();
+  if (raw === 'postgres' || raw === 'postgresql') {
+    return 'postgres';
+  }
+  if (raw === 'mysql') {
+    return 'mysql';
+  }
+  throw new Error(`Unsupported DB_TYPE: ${raw}`);
+}
+
+async function runPostgres({ host, port, user, password, database, sql, timeoutMs, limiter }) {
+  const client = new pg.Client({
+    host,
+    port,
+    user,
+    password,
+    database,
+    statement_timeout: timeoutMs,
+    connectionTimeoutMillis: 5_000,
+  });
+  await client.connect();
+  try {
+    for (const statement of sessionSetupStatements('postgres', timeoutMs)) {
+      await client.query(statement);
+    }
+    await streamPg(client, sql, limiter);
+  } finally {
+    try {
+      await client.end();
+    } catch {
+      // ignore
+    }
+  }
+}
+
+function streamPg(client, sql, limiter) {
+  return new Promise((resolve, reject) => {
+    const query = new pg.Query({ text: sql, rowMode: 'array' });
+    let settled = false;
+
+    const finish = () => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      resolve();
+    };
+
+    query.on('fields', (fields) => {
+      writeEvent({ type: 'meta', columns: fields.map((field) => field.name) });
+    });
+
+    query.on('row', (row) => {
+      if (settled) {
+        return;
+      }
+      const decision = limiter.push(row);
+      if (!decision.accept) {
+        writeEvent({
+          type: 'end',
+          truncated: true,
+          reason: decision.reason,
+        });
+        finish();
+        client.connection?.stream?.destroy?.();
+        return;
+      }
+      writeEvent({ type: 'row', values: row });
+    });
+
+    query.on('end', () => {
+      if (settled) {
+        return;
+      }
+      writeEvent({ type: 'end', truncated: false });
+      finish();
+    });
+
+    query.on('error', (err) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      reject(err);
+    });
+
+    client.query(query);
+  });
+}
+
+async function runMysql({ host, port, user, password, database, sql, timeoutMs, limiter }) {
+  const conn = await mysql.createConnection({
+    host,
+    port,
+    user,
+    password,
+    database,
+    connectTimeout: 5_000,
+  });
+  try {
+    for (const statement of sessionSetupStatements('mysql', timeoutMs)) {
+      await conn.query(statement);
+    }
+    await streamMysql(conn, sql, limiter);
+  } finally {
+    try {
+      await conn.end();
+    } catch {
+      conn.destroy();
+    }
+  }
+}
+
+function streamMysql(conn, sql, limiter) {
+  return new Promise((resolve, reject) => {
+    const connection = conn.connection;
+    const query = connection.query({ sql, rowsAsArray: true });
+    let settled = false;
+
+    const finish = () => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      resolve();
+    };
+
+    query.on('fields', (fields) => {
+      const columns = (fields ?? []).map((field) => field.name);
+      writeEvent({ type: 'meta', columns });
+    });
+
+    query.on('result', (row) => {
+      if (settled) {
+        return;
+      }
+      const values = Array.isArray(row) ? row : Object.values(row);
+      const decision = limiter.push(values);
+      if (!decision.accept) {
+        writeEvent({
+          type: 'end',
+          truncated: true,
+          reason: decision.reason,
+        });
+        connection.destroy();
+        finish();
+        return;
+      }
+      writeEvent({ type: 'row', values });
+    });
+
+    query.on('end', () => {
+      if (!settled) {
+        writeEvent({ type: 'end', truncated: false });
+        finish();
+      }
+    });
+
+    query.on('error', (err) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      reject(err);
+    });
+  });
+}
+
+async function main() {
+  const raw = await readStdin();
+  let payload = {};
+  if (raw.trim().length > 0) {
+    payload = JSON.parse(raw);
+  }
+  const sql = payload.sql;
+  if (typeof sql !== 'string' || sql.trim().length === 0) {
+    throw new Error('No SQL provided on stdin');
+  }
+
+  const timeoutMs = envInt('QUERY_TIMEOUT', 10_000);
+  const maxRows = envInt('MAX_ROWS', 1_000);
+  const maxBytes = envInt('MAX_BYTES', 1_000_000);
+  const limiter = createStreamLimiter({ maxRows, maxBytes });
+  const dialect = dialectFromEnv();
+  const connection = {
+    host: process.env.DB_HOST,
+    port: envInt('DB_PORT', dialect === 'mysql' ? 3306 : 5432),
+    user: process.env.DB_USER,
+    password: readPassword(),
+    database: process.env.DB_NAME,
+    sql,
+    timeoutMs,
+    limiter,
+  };
+
+  if (dialect === 'mysql') {
+    await runMysql(connection);
+    return;
+  }
+  await runPostgres(connection);
+}
+
+main().catch((err) => {
+  writeRunnerError(err);
+  process.exit(1);
+});

package/sandbox/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "ffp-sql-sandbox-runner",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "pg": "^8.16.3",
+    "mysql2": "^3.14.5"
+  }
+}

package/sandbox/secrets.d.ts

@@ -0,0 +1,5 @@
+export const DEFAULT_SECRET_PATH: string;
+export function readPassword(
+  secretPath?: string,
+  payload?: { password?: string },
+): string;

package/sandbox/secrets.js

@@ -0,0 +1,16 @@
+import { readFileSync } from 'node:fs';
+
+export const DEFAULT_SECRET_PATH = '/run/secrets/db_password';
+
+/** Official runner reads the tmpfs secret only. No stdin/payload password fallback. */
+export function readPassword(
+  secretPath = DEFAULT_SECRET_PATH,
+  payload,
+) {
+  void payload;
+  try {
+    return readFileSync(secretPath, 'utf8');
+  } catch {
+    throw new Error('Database password missing (expected tmpfs secret file)');
+  }
+}

package/sandbox/session-setup.d.ts

@@ -0,0 +1,4 @@
+export function sessionSetupStatements(
+  type: string,
+  timeoutMs: number,
+): string[];

package/sandbox/session-setup.js

@@ -0,0 +1,20 @@
+export function sessionSetupStatements(type, timeoutMs) {
+  if (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 1_000_000_000) {
+    throw new Error('timeoutMs must be a positive integer');
+  }
+
+  switch (type) {
+    case 'postgres':
+      return [
+        'SET SESSION CHARACTERISTICS AS TRANSACTION READ ONLY',
+        `SET statement_timeout = ${timeoutMs}`,
+      ];
+    case 'mysql':
+      return [
+        'SET SESSION TRANSACTION READ ONLY',
+        `SET SESSION MAX_EXECUTION_TIME = ${timeoutMs}`,
+      ];
+    default:
+      throw new Error(`unsupported dialect: ${type}`);
+  }
+}

package/sandbox/stream-limit.d.ts

@@ -0,0 +1,16 @@
+export function createStreamLimiter(opts: {
+  maxRows: number;
+  maxBytes: number;
+}): {
+  push(values: unknown): {
+    accept: boolean;
+    truncated: boolean;
+    reason?: string;
+  };
+  readonly state: {
+    rows: number;
+    bytes: number;
+    truncated: boolean;
+    reason?: string;
+  };
+};

package/sandbox/stream-limit.js

@@ -0,0 +1,35 @@
+/**
+ * Apply maxRows / maxBytes as rows arrive. Callers must stop producing
+ * remaining rows when accept is false — do not buffer then truncate.
+ */
+export function createStreamLimiter({ maxRows, maxBytes }) {
+  let rows = 0;
+  let bytes = 0;
+  let truncated = false;
+  let reason;
+
+  return {
+    push(values) {
+      if (truncated) {
+        return { accept: false, truncated: true, reason };
+      }
+      const size = Buffer.byteLength(JSON.stringify(values), 'utf8');
+      if (rows + 1 > maxRows) {
+        truncated = true;
+        reason = 'maxRows';
+        return { accept: false, truncated: true, reason };
+      }
+      if (bytes + size > maxBytes) {
+        truncated = true;
+        reason = 'maxBytes';
+        return { accept: false, truncated: true, reason };
+      }
+      rows += 1;
+      bytes += size;
+      return { accept: true, truncated: false };
+    },
+    get state() {
+      return { rows, bytes, truncated, reason };
+    },
+  };
+}