insforge 0.3.3 → 1.3.0

package/backend/src/{core/database/advance.ts → services/database/database-advance.service.ts}

@@ -1,29 +1,39 @@
-import { DatabaseManager } from '@/core/database/manager.js';
-import { AppError } from '@/api/middleware/error.js';
+import { DatabaseManager } from '@/infra/database/database.manager.js';
+import { AppError } from '@/api/middlewares/error.js';
 import {
   type RawSQLResponse,
   type ExportDatabaseResponse,
   type ExportDatabaseJsonData,
   type ImportDatabaseResponse,
   type BulkUpsertResponse,
-  type DatabaseMetadataSchema,
 } from '@insforge/shared-schemas';
 import logger from '@/utils/logger.js';
-import { ERROR_CODES } from '@/types/error-constants';
+import { ERROR_CODES } from '@/types/error-constants.js';
 import { parseSQLStatements } from '@/utils/sql-parser.js';
 import { validateTableName } from '@/utils/validations.js';
 import format from 'pg-format';
 import { parse } from 'csv-parse/sync';
+import { DatabaseError, type PoolClient } from 'pg';
 
 export class DatabaseAdvanceService {
+  private static instance: DatabaseAdvanceService;
   private dbManager = DatabaseManager.getInstance();
 
+  private constructor() {}
+
+  public static getInstance(): DatabaseAdvanceService {
+    if (!DatabaseAdvanceService.instance) {
+      DatabaseAdvanceService.instance = new DatabaseAdvanceService();
+    }
+    return DatabaseAdvanceService.instance;
+  }
+
   /**
    * Get table data using simple SELECT query
    * More reliable than streaming for moderate datasets
    */
   private async getTableData(
-    client: any, // eslint-disable-line @typescript-eslint/no-explicit-any
+    client: PoolClient,
     table: string,
     rowLimit: number | undefined
   ): Promise<{ rows: Record<string, unknown>[]; totalRows: number; wasTruncated: boolean }> {
@@ -53,8 +63,25 @@ export class DatabaseAdvanceService {
     return { rows, totalRows, wasTruncated };
   }
 
-  private sanitizeQuery(query: string): string {
-    // Basic SQL injection prevention - check for dangerous patterns
+  /**
+   * Sanitize query with strict or relaxed mode
+   *
+   * BOTH MODES block:
+   * - DROP DATABASE, CREATE DATABASE, ALTER DATABASE
+   * - pg_catalog and information_schema access
+   *
+   * STRICT MODE blocks:
+   * - ALL operations on system tables (tables starting with _)
+   * - DROP or RENAME operations on users table
+   *
+   * RELAXED MODE allows:
+   * - SELECT and INSERT into system tables and users table
+   * RELAXED MODE blocks:
+   * - UPDATE/DELETE/DROP/CREATE/ALTER system tables
+   * - UPDATE/DELETE/DROP/RENAME users table
+   */
+  sanitizeQuery(query: string, mode: 'strict' | 'relaxed' = 'strict'): string {
+    // Both modes: Block database-level operations
     const dangerousPatterns = [
       /DROP\s+DATABASE/i,
       /CREATE\s+DATABASE/i,
@@ -69,18 +96,6 @@ export class DatabaseAdvanceService {
       }
     }
 
-    // Check for system table operations (tables starting with underscore)
-    // This pattern checks each statement in multi-statement queries, including schema-qualified names
-    const systemTablePattern =
-      /(?:^|\n|;)\s*(?:CREATE|ALTER|DROP|INSERT\s+INTO|UPDATE|DELETE\s+FROM|TRUNCATE)\s+(?:TABLE\s+)?(?:IF\s+(?:NOT\s+)?EXISTS\s+)?(?:\w+\.)?["']?_\w+/im;
-    if (systemTablePattern.test(query)) {
-      throw new AppError(
-        'Cannot modify or create system tables (tables starting with underscore)',
-        403,
-        ERROR_CODES.FORBIDDEN
-      );
-    }
-
     // Check for RENAME TO system table
     const renameToSystemTablePattern = /RENAME\s+TO\s+(?:\w+\.)?["']?_\w+/im;
     if (renameToSystemTablePattern.test(query)) {
@@ -98,20 +113,45 @@ export class DatabaseAdvanceService {
       throw new AppError('Cannot drop or rename the users table', 403, ERROR_CODES.FORBIDDEN);
     }
 
+    if (mode === 'strict') {
+      // Check for system table operations (tables starting with underscore)
+      // This pattern checks each statement in multi-statement queries, including schema-qualified names
+      const systemTablePattern =
+        /(?:^|\n|;)\s*(?:CREATE|ALTER|DROP|INSERT\s+INTO|UPDATE|DELETE\s+FROM|TRUNCATE)\s+(?:TABLE\s+)?(?:IF\s+(?:NOT\s+)?EXISTS\s+)?(?:\w+\.)?["']?_\w+/im;
+      if (systemTablePattern.test(query)) {
+        throw new AppError(
+          'Cannot modify or create system tables (tables starting with underscore)',
+          403,
+          ERROR_CODES.FORBIDDEN
+        );
+      }
+    } else {
+      // Relaxed mode: Allow only SELECT and INSERT into system tables and users table
+      // Block UPDATE, DELETE, DROP, CREATE, ALTER, TRUNCATE
+      const systemTableDestructivePattern =
+        /(?:^|\n|;)\s*(?:CREATE|ALTER|DROP|TRUNCATE|UPDATE|DELETE\s+FROM)\s+(?:TABLE\s+)?(?:IF\s+(?:NOT\s+)?EXISTS\s+)?(?:\w+\.)?["']?_\w+/im;
+      if (systemTableDestructivePattern.test(query)) {
+        throw new AppError(
+          'Cannot UPDATE/DELETE/DROP/CREATE/ALTER system tables (tables starting with underscore)',
+          403,
+          ERROR_CODES.FORBIDDEN
+        );
+      }
+    }
+
     return query;
   }
 
-  async executeRawSQL(input_query: string, params: unknown[] = []): Promise<RawSQLResponse> {
-    const query = this.sanitizeQuery(input_query);
+  async executeRawSQL(query: string, params: unknown[] = []): Promise<RawSQLResponse> {
     const pool = this.dbManager.getPool();
     const client = await pool.connect();
 
     try {
-      // Execute query with timeout
-      const result = (await Promise.race([
-        client.query(query, params),
-        new Promise((_, reject) => setTimeout(() => reject(new Error('Query timeout')), 30000)),
-      ])) as { rows: unknown[]; rowCount: number; fields?: { name: string; dataTypeID: number }[] };
+      // Set statement timeout at session level (30 seconds)
+      await client.query('SET statement_timeout = 30000');
+
+      // Execute query - database will enforce the timeout
+      const result = await client.query(query, params);
 
       // Refresh schema cache if it was a DDL operation
       if (/CREATE|ALTER|DROP/i.test(query)) {
@@ -129,13 +169,21 @@ export class DatabaseAdvanceService {
       };
 
       return response;
+    } catch (error) {
+      // Handle timeout errors specifically for better error messages
+      if (error instanceof DatabaseError && error.code === '57014') {
+        throw new Error('Query timeout: The query took longer than 30 seconds to execute');
+      }
+      // Re-throw other errors as-is
+      throw error;
     } finally {
+      // Reset timeout to default before releasing client back to pool
+      await client.query('SET statement_timeout = 0');
       client.release();
     }
   }
 
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  private async exportTableSchemaBySQL(client: any, table: string): Promise<string> {
+  private async exportTableSchemaBySQL(client: PoolClient, table: string): Promise<string> {
     let sqlExport = '';
     // Always export table schema with defaults
     const schemaResult = await client.query(
@@ -157,7 +205,7 @@ export class DatabaseAdvanceService {
       [table]
     );
 
-    if (schemaResult.rows.length > 0) {
+    if (schemaResult.rows.length) {
       sqlExport += `-- Table: ${table}\n`;
       sqlExport += schemaResult.rows[0].create_statement + '\n\n';
     }
@@ -177,7 +225,7 @@ export class DatabaseAdvanceService {
       [table]
     );
 
-    if (indexesResult.rows.length > 0) {
+    if (indexesResult.rows.length) {
       sqlExport += `-- Indexes for table: ${table}\n`;
       for (const indexRow of indexesResult.rows) {
         sqlExport += indexRow.indexdef + ';\n';
@@ -222,7 +270,7 @@ export class DatabaseAdvanceService {
       [table]
     );
 
-    if (foreignKeysResult.rows.length > 0) {
+    if (foreignKeysResult.rows.length) {
       sqlExport += `-- Foreign key constraints for table: ${table}\n`;
       for (const fkRow of foreignKeysResult.rows) {
         sqlExport += fkRow.fk_statement + '\n';
@@ -241,7 +289,7 @@ export class DatabaseAdvanceService {
       [table]
     );
     const rlsEnabled =
-      rlsResult.rows.length > 0 &&
+      !!rlsResult.rows.length &&
       (rlsResult.rows[0].relrowsecurity === true || rlsResult.rows[0].relrowsecurity === 1);
     if (rlsEnabled) {
       sqlExport += `-- RLS enabled for table: ${table}\n`;
@@ -273,7 +321,7 @@ export class DatabaseAdvanceService {
       [table]
     );
 
-    if (policiesResult.rows.length > 0) {
+    if (policiesResult.rows.length) {
       sqlExport += `-- RLS policies for table: ${table}\n`;
       for (const policyRow of policiesResult.rows) {
         sqlExport += policyRow.policy_statement + '\n';
@@ -316,7 +364,7 @@ export class DatabaseAdvanceService {
       [table]
     );
 
-    if (triggersResult.rows.length > 0) {
+    if (triggersResult.rows.length) {
       sqlExport += `-- Triggers for table: ${table}\n`;
       for (const triggerRow of triggersResult.rows) {
         sqlExport += triggerRow.trigger_statement + '\n';
@@ -341,7 +389,7 @@ export class DatabaseAdvanceService {
     try {
       // Get tables to export
       let tablesToExport: string[];
-      if (tables && tables.length > 0) {
+      if (tables && tables.length) {
         tablesToExport = tables;
       } else {
         const tablesResult = await client.query(`
@@ -375,7 +423,7 @@ export class DatabaseAdvanceService {
 
             const { rows, wasTruncated } = await this.getTableData(client, table, rowLimit);
 
-            if (rows.length > 0) {
+            if (rows.length) {
               tableDataSql += `-- Data for table: ${table}\n`;
 
               for (const row of rows) {
@@ -433,7 +481,7 @@ export class DatabaseAdvanceService {
             ORDER BY p.proname
           `);
 
-          if (functionsResult.rows.length > 0) {
+          if (functionsResult.rows.length) {
             sqlExport += `-- Functions and Procedures\n`;
             for (const funcRow of functionsResult.rows) {
               sqlExport += `-- Function: ${funcRow.function_name}\n`;
@@ -459,7 +507,7 @@ export class DatabaseAdvanceService {
             ORDER BY sequence_name
           `);
 
-          if (sequencesResult.rows.length > 0) {
+          if (sequencesResult.rows.length) {
             sqlExport += `-- Sequences\n`;
             for (const seqRow of sequencesResult.rows) {
               sqlExport += seqRow.sequence_statement + '\n';
@@ -480,7 +528,7 @@ export class DatabaseAdvanceService {
             ORDER BY table_name
           `);
 
-          if (viewsResult.rows.length > 0) {
+          if (viewsResult.rows.length) {
             sqlExport += `-- Views\n`;
             for (const viewRow of viewsResult.rows) {
               sqlExport += `-- View: ${viewRow.view_name}\n`;
@@ -493,7 +541,7 @@ export class DatabaseAdvanceService {
           format: 'sql',
           data: sqlExport,
           timestamp,
-          ...(truncatedTables.length > 0 && {
+          ...(truncatedTables.length && {
             truncatedTables,
             rowLimit,
           }),
@@ -585,7 +633,7 @@ export class DatabaseAdvanceService {
           );
 
           const rlsEnabled =
-            rlsResult.rows.length > 0 &&
+            !!rlsResult.rows.length &&
             (rlsResult.rows[0].relrowsecurity === true || rlsResult.rows[0].relrowsecurity === 1);
 
           // Get policies
@@ -624,7 +672,7 @@ export class DatabaseAdvanceService {
           );
 
           // Get data if requested - using streaming to avoid memory issues
-          const rows: unknown[] = [];
+          const rows: Record<string, unknown>[] = [];
           let truncated = false;
           let totalRowCount: number | undefined;
 
@@ -711,7 +759,7 @@ export class DatabaseAdvanceService {
           format: 'json',
           data: jsonData,
           timestamp,
-          ...(truncatedTables.length > 0 && {
+          ...(truncatedTables.length && {
             truncatedTables,
             rowLimit,
           }),
@@ -856,6 +904,7 @@ export class DatabaseAdvanceService {
         records = parse(fileBuffer, {
           columns: true,
           skip_empty_lines: true,
+          bom: true,
         });
       } else if (fileExtension === '.json') {
         const jsonContent = fileBuffer.toString('utf-8');
@@ -879,7 +928,7 @@ export class DatabaseAdvanceService {
       );
     }
 
-    if (!records || records.length === 0) {
+    if (!records || !records.length) {
       throw new AppError('No records found in file', 400, ERROR_CODES.INVALID_INPUT);
     }
 
@@ -901,12 +950,11 @@ export class DatabaseAdvanceService {
     records: Record<string, unknown>[],
     upsertKey?: string
   ): Promise<{ rowCount: number; rows?: unknown[] }> {
-    if (!records || records.length === 0) {
+    if (!records || !records.length) {
       throw new AppError('No records to insert', 400, ERROR_CODES.INVALID_INPUT);
     }
 
     const pool = this.dbManager.getPool();
-    const client = await pool.connect();
 
     try {
       // Get column names from first record
@@ -937,7 +985,7 @@ export class DatabaseAdvanceService {
         // Build upsert query with pg-format
         const updateColumns = columns.filter((c) => c !== upsertKey);
 
-        if (updateColumns.length > 0) {
+        if (updateColumns.length) {
           // Build UPDATE SET clause
           const updateClause = updateColumns
             .map((col) => format('%I = EXCLUDED.%I', col, col))
@@ -967,10 +1015,10 @@ export class DatabaseAdvanceService {
       }
 
       // Execute query
-      const result = await client.query(query);
+      const result = await pool.query(query);
 
       // Refresh schema cache if needed
-      await client.query(`NOTIFY pgrst, 'reload schema';`);
+      await pool.query(`NOTIFY pgrst, 'reload schema';`);
 
       return {
         rowCount: result.rowCount || 0,
@@ -987,88 +1035,6 @@ export class DatabaseAdvanceService {
 
       const message = error instanceof Error ? error.message : 'Bulk insert failed';
       throw new AppError(message, 400, ERROR_CODES.INVALID_INPUT);
-    } finally {
-      client.release();
-    }
-  }
-
-  /**
-   * Get database metadata
-   */
-  async getMetadata(): Promise<DatabaseMetadataSchema> {
-    // Get all tables excluding system tables (those starting with _)
-    const allTables = await this.dbManager.getUserTables();
-    const dbMetadata = await this.exportDatabase(allTables, 'json', false, false, false, false);
-
-    const databaseSize = await this.getDatabaseSizeInGB();
-
-    // Get record counts for each table
-    const tablesSchemas = (dbMetadata.data as ExportDatabaseJsonData).tables;
-    const db = this.dbManager.getDb();
-
-    for (const tableName of allTables) {
-      let recordCount = 0;
-      try {
-        // there is a race condition here, if the table is immeditely deleted, so added an extra check to see if the table exists
-        const tableExists = (await db
-          .prepare(
-            `
-          SELECT EXISTS (
-            SELECT 1 FROM pg_class
-            WHERE relname = ?
-            AND relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = 'public')
-            AND relkind = 'r'
-          ) as exists
-        `
-          )
-          .get(tableName)) as { exists: boolean } | null;
-
-        if (tableExists?.exists) {
-          const countResult = (await db
-            .prepare(`SELECT COUNT(*) as count FROM "${tableName}"`)
-            .get()) as { count: number } | null;
-          recordCount = countResult?.count || 0;
-        }
-      } catch (error) {
-        // Handle any unexpected errors
-        logger.warn('Could not get record count for table', {
-          table: tableName,
-          error: error instanceof Error ? error.message : String(error),
-        });
-        recordCount = 0;
-      }
-
-      // Only add recordCount if the table exists in tablesSchemas
-      if (tablesSchemas[tableName]) {
-        tablesSchemas[tableName].recordCount = recordCount;
-      }
-    }
-
-    return {
-      tables: tablesSchemas,
-      totalSize: databaseSize,
-    };
-  }
-
-  async getDatabaseSizeInGB(): Promise<number> {
-    try {
-      const db = this.dbManager.getDb();
-      // Query PostgreSQL for database size
-      const result = (await db
-        .prepare(
-          `
-        SELECT pg_database_size(current_database()) as size
-      `
-        )
-        .get()) as { size: number } | null;
-
-      // PostgreSQL returns size in bytes, convert to GB
-      return (result?.size || 0) / (1024 * 1024 * 1024);
-    } catch (error) {
-      logger.error('Error getting database size', {
-        error: error instanceof Error ? error.message : String(error),
-      });
-      return 0;
     }
   }
 }