influx-local-cli 0.1.0

package/src/config.js

@@ -0,0 +1,349 @@
+'use strict';
+
+const fs = require('fs/promises');
+const path = require('path');
+const os = require('os');
+const crypto = require('crypto');
+const {
+  FLAVORS,
+  flavorOf,
+  miseTomlFor,
+  CRED_FIELDS,
+} = require('./versions');
+
+// Overridable for tests: INFLUX_LOCAL_HOME points at an alternate base dir,
+// INFLUX_LOCAL_MISE points at an alternate mise executable (or stub).
+const BASE_DIR = process.env.INFLUX_LOCAL_HOME
+  ? path.resolve(process.env.INFLUX_LOCAL_HOME)
+  : path.join(os.homedir(), '.influx-local');
+
+function miseBin() {
+  return process.env.INFLUX_LOCAL_MISE || 'mise';
+}
+
+function getInstanceDir(name) {
+  return path.join(BASE_DIR, 'instances', name);
+}
+
+function getConfigPath(name) {
+  return path.join(getInstanceDir(name), 'config.json');
+}
+
+function getCredsPath(name) {
+  return path.join(getInstanceDir(name), 'creds.env');
+}
+
+// Each instance carries its own mise config: it pins the exact InfluxDB version
+// and teaches mise where to fetch that version's tarball from.
+function getMiseTomlPath(name) {
+  return path.join(getInstanceDir(name), '.mise.toml');
+}
+
+// InfluxDB 2.x's CLI writes a client config (host/token/org shortcuts) on
+// `influx setup`. Keep it inside the instance dir so the user's
+// ~/.influxdbv2/configs is never touched.
+function getCliConfigsPath(name) {
+  return path.join(getInstanceDir(name), 'influx-cli-configs');
+}
+
+function getPidPath(name, serverBin = 'influxd') {
+  return path.join(getInstanceDir(name), `${serverBin}.pid`);
+}
+
+function getLogPath(name, serverBin = 'influxd') {
+  return path.join(getInstanceDir(name), `${serverBin}.log`);
+}
+
+function getBootPidPath(name, serverBin = 'influxd') {
+  return path.join(getInstanceDir(name), `${serverBin}-bootstrap.pid`);
+}
+
+function getBootLogPath(name, serverBin = 'influxd') {
+  return path.join(getInstanceDir(name), `${serverBin}-bootstrap.log`);
+}
+
+// Config keys the user can persist / edit.
+const SETTABLE_KEYS = [
+  'version',
+  'port',
+  'host',
+  'database',
+  'measurement',
+  'org',
+  'adminUser',
+  'appUser',
+  'publicHost',
+];
+
+// The default is the newest 1.x: that line maps 1:1 onto the
+// pg-local-cli/mongo-local-cli model (admin user + database-scoped app user +
+// a shell). Pick another version in the wizard for 2.x/3.x.
+const DEFAULT_VERSION = FLAVORS.v1.defaultVersion;
+
+const DEFAULT_CONFIG = {
+  version: DEFAULT_VERSION,
+  host: '127.0.0.1',
+  database: null, // falls back to the instance name
+  measurement: 'items',
+  org: null, // falls back to the instance name (2.x only)
+  adminUser: 'admin',
+  appUser: 'app',
+  publicHost: '',
+};
+
+// Instance names become directory names under ~/.influx-local. Restrict them to
+// a safe charset so a crafted name cannot traverse out of the data dir.
+const NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const NAME_MAX_LENGTH = 64;
+
+function assertValidInstanceName(name) {
+  if (
+    typeof name !== 'string' ||
+    name.length === 0 ||
+    name.length > NAME_MAX_LENGTH ||
+    !NAME_PATTERN.test(name)
+  ) {
+    throw new Error(
+      `Invalid instance name "${name}". Use 1-${NAME_MAX_LENGTH} characters: letters, digits, dots, dashes or underscores; must start with a letter or digit.`,
+    );
+  }
+  return name;
+}
+
+async function ensureBaseDir() {
+  await fs.mkdir(BASE_DIR, { recursive: true });
+  await fs.mkdir(path.join(BASE_DIR, 'instances'), { recursive: true });
+}
+
+async function loadConfig(name = 'default') {
+  assertValidInstanceName(name);
+  await ensureBaseDir();
+  const instanceDir = getInstanceDir(name);
+
+  let loaded = {};
+  try {
+    loaded = JSON.parse(await fs.readFile(getConfigPath(name), 'utf8'));
+  } catch (err) {
+    // Config doesn't exist yet: defaults are used below and persisted on save.
+  }
+
+  const version = loaded.version || DEFAULT_CONFIG.version;
+  const f = flavorOf(version); // throws with a clear message for bogus versions
+  const database = loaded.database || name;
+  return {
+    name,
+    version: String(version),
+    flavor: f.id,
+    flavorLabel: f.label,
+    auth: f.auth,
+    capabilities: f.capabilities,
+    serverBin: f.serverBin,
+    cliBin: f.cliBin,
+    port: loaded.port || f.defaultPort,
+    host: loaded.host || DEFAULT_CONFIG.host,
+    database,
+    measurement: loaded.measurement || DEFAULT_CONFIG.measurement,
+    org: loaded.org || DEFAULT_CONFIG.org || name,
+    adminUser: loaded.adminUser || DEFAULT_CONFIG.adminUser,
+    appUser: loaded.appUser || DEFAULT_CONFIG.appUser,
+    publicHost: loaded.publicHost || DEFAULT_CONFIG.publicHost,
+    instanceDir,
+    dataDir: loaded.dataDir || path.join(instanceDir, 'data'),
+    credsPath: getCredsPath(name),
+    miseTomlPath: getMiseTomlPath(name),
+    cliConfigsPath: getCliConfigsPath(name),
+    pidPath: getPidPath(name, f.serverBin),
+    logPath: getLogPath(name, f.serverBin),
+    bootPidPath: getBootPidPath(name, f.serverBin),
+    bootLogPath: getBootLogPath(name, f.serverBin),
+  };
+}
+
+async function saveConfig(name, config) {
+  assertValidInstanceName(name);
+  await ensureBaseDir();
+  const instanceDir = getInstanceDir(name);
+  await fs.mkdir(instanceDir, { recursive: true });
+
+  const toPersist = {};
+  for (const key of SETTABLE_KEYS) {
+    if (config[key] !== undefined && config[key] !== null && config[key] !== '') {
+      toPersist[key] = config[key];
+    }
+  }
+  await fs.writeFile(getConfigPath(name), JSON.stringify(toPersist, null, 2) + '\n', 'utf8');
+}
+
+// (Re)generate the instance's .mise.toml from its pinned version.
+async function saveMiseToml(name, version) {
+  const instanceDir = getInstanceDir(name);
+  await fs.mkdir(instanceDir, { recursive: true });
+  await fs.writeFile(getMiseTomlPath(name), miseTomlFor(version), 'utf8');
+}
+
+async function configExists(name) {
+  try {
+    await fs.stat(getConfigPath(name));
+    return true;
+  } catch (err) {
+    return false;
+  }
+}
+
+async function listInstances() {
+  await ensureBaseDir();
+  const instancesDir = path.join(BASE_DIR, 'instances');
+  let entries = [];
+  try {
+    entries = await fs.readdir(instancesDir, { withFileTypes: true });
+  } catch (err) {
+    return [];
+  }
+  const names = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    try {
+      await fs.stat(path.join(instancesDir, entry.name, 'config.json'));
+      names.push(entry.name);
+    } catch (err) {
+      // Not an instance directory.
+    }
+  }
+  return names.sort();
+}
+
+async function deleteInstanceDir(name) {
+  assertValidInstanceName(name);
+  const instanceDir = getInstanceDir(name);
+  const instancesBase = path.join(BASE_DIR, 'instances');
+  // Safety: the resolved instance dir must live directly under the instances
+  // base so a crafted name cannot make us delete ~/.influx-local itself.
+  if (path.dirname(instanceDir) !== instancesBase) {
+    throw new Error(`Refusing to delete unexpected path: ${instanceDir}`);
+  }
+  await fs.rm(instanceDir, { recursive: true, force: true });
+}
+
+// --- Secrets (per-instance creds.env, mode 0600) ----------------------------
+
+// Parse "KEY=VALUE" lines (comments and blank lines allowed, '#' starts a
+// comment). Values keep everything after the first '=' (tokens may contain it).
+async function readCreds(name, flavorId) {
+  const credsPath = getCredsPath(name);
+  let data = '';
+  try {
+    data = await fs.readFile(credsPath, 'utf8');
+  } catch (err) {
+    return null;
+  }
+  const creds = {};
+  for (const line of data.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const eq = trimmed.indexOf('=');
+    if (eq <= 0) continue;
+    creds[trimmed.slice(0, eq).trim()] = trimmed.slice(eq + 1);
+  }
+  const required = CRED_FIELDS[flavorId] || [];
+  for (const key of required) {
+    if (!creds[key]) return null;
+  }
+  return creds;
+}
+
+function credsHeader(flavorId, cfg) {
+  if (flavorId === 'v1') {
+    return [
+      '# InfluxDB 1.x: ADMIN_USER has ALL PRIVILEGES, APP_USER has ALL on the database.',
+    ];
+  }
+  if (flavorId === 'v2') {
+    return [
+      '# InfluxDB 2.x: ADMIN_TOKEN is an all-access (operator) token, APP_TOKEN is scoped',
+      `# read/write on bucket "${cfg ? cfg.database : 'BUCKET'}"; ADMIN_PW is the operator login password.`,
+    ];
+  }
+  return [
+    '# InfluxDB 3 Core: a single admin token (3 Core has no per-database tokens).',
+  ];
+}
+
+// Atomically write creds.env with restrictive permissions: a random 0600 temp
+// file is created, written, then renamed over the target.
+async function writeCreds(name, flavorId, creds, cfg) {
+  const credsPath = getCredsPath(name);
+  const instanceDir = getInstanceDir(name);
+  await fs.mkdir(instanceDir, { recursive: true });
+  const tmp = path.join(instanceDir, `.creds.env.${crypto.randomBytes(6).toString('hex')}.tmp`);
+
+  const order = CRED_FIELDS[flavorId] || Object.keys(creds);
+  const lines = [...credsHeader(flavorId, cfg)];
+  for (const key of order) {
+    if (creds[key] !== undefined && creds[key] !== '') lines.push(`${key}=${creds[key]}`);
+  }
+  for (const key of Object.keys(creds)) {
+    if (!order.includes(key) && creds[key] !== undefined && creds[key] !== '') {
+      lines.push(`${key}=${creds[key]}`);
+    }
+  }
+  const body = `${lines.join('\n')}\n`;
+
+  try {
+    const handle = await fs.open(tmp, 'wx', 0o600);
+    try {
+      await handle.writeFile(body, 'utf8');
+    } finally {
+      await handle.close();
+    }
+    await fs.rename(tmp, credsPath);
+    await fs.chmod(credsPath, 0o600);
+  } catch (err) {
+    await fs.rm(tmp, { force: true }).catch(() => {});
+    throw err;
+  }
+}
+
+// 20 random characters from [A-Za-z0-9] (same shape pg-local-cli/mongo-local-cli
+// generate with `openssl rand -base64 18 | tr -dc 'A-Za-z0-9' | head -c 20`).
+function randomPassword() {
+  const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+  let out = '';
+  for (let i = 0; i < 20; i++) {
+    out += alphabet[crypto.randomInt(0, alphabet.length)];
+  }
+  return out;
+}
+
+// 64 hex chars — the shape InfluxDB itself uses for API tokens.
+function randomToken() {
+  return crypto.randomBytes(32).toString('hex');
+}
+
+module.exports = {
+  BASE_DIR,
+  miseBin,
+  getInstanceDir,
+  getConfigPath,
+  getCredsPath,
+  getMiseTomlPath,
+  getCliConfigsPath,
+  getPidPath,
+  getLogPath,
+  getBootPidPath,
+  getBootLogPath,
+  SETTABLE_KEYS,
+  DEFAULT_CONFIG,
+  DEFAULT_VERSION,
+  assertValidInstanceName,
+  ensureBaseDir,
+  loadConfig,
+  saveConfig,
+  saveMiseToml,
+  configExists,
+  listInstances,
+  deleteInstanceDir,
+  readCreds,
+  writeCreds,
+  randomPassword,
+  randomToken,
+};