insforge 1.2.10 → 1.4.8

package/backend/src/utils/sql-parser.ts

@@ -1,7 +1,223 @@
 import splitSqlQuery from '@databases/split-sql-query';
 import sql from '@databases/sql';
+import { parseSync, loadModule } from 'libpg-query';
 import logger from './logger.js';
 
+let initialized = false;
+
+/**
+ * Initialize the SQL parser WASM module.
+ * Must be called and awaited before using analyzeQuery().
+ */
+export async function initSqlParser(): Promise<void> {
+  if (initialized) {
+    return;
+  }
+  await loadModule();
+  initialized = true;
+  logger.info('SQL parser initialized');
+}
+
+export interface DatabaseResourceUpdate {
+  type: 'tables' | 'table' | 'records' | 'index' | 'trigger' | 'policy' | 'function' | 'extension';
+  name?: string;
+}
+
+const STMT_TYPES: Record<string, DatabaseResourceUpdate['type']> = {
+  InsertStmt: 'records',
+  UpdateStmt: 'records',
+  DeleteStmt: 'records',
+  CreateStmt: 'tables',
+  AlterTableStmt: 'table',
+  RenameStmt: 'table',
+  IndexStmt: 'index',
+  CreateTrigStmt: 'trigger',
+  CreatePolicyStmt: 'policy',
+  AlterPolicyStmt: 'policy',
+  CreateFunctionStmt: 'function',
+  CreateExtensionStmt: 'extension',
+};
+
+const DROP_TYPES: Record<string, DatabaseResourceUpdate['type']> = {
+  OBJECT_TABLE: 'tables',
+  OBJECT_INDEX: 'index',
+  OBJECT_TRIGGER: 'trigger',
+  OBJECT_POLICY: 'policy',
+  OBJECT_FUNCTION: 'function',
+  OBJECT_EXTENSION: 'extension',
+};
+
+export function analyzeQuery(query: string): DatabaseResourceUpdate[] {
+  try {
+    const { stmts } = parseSync(query);
+    const changes = stmts
+      .map((s: { stmt: Record<string, unknown> }) => extractChange(s.stmt))
+      .filter((c: DatabaseResourceUpdate | null): c is DatabaseResourceUpdate => c !== null);
+
+    // Deduplicate by type+name
+    const seen = new Set<string>();
+    return changes.filter((c: DatabaseResourceUpdate) => {
+      const key = `${c.type}:${c.name ?? ''}`;
+      if (seen.has(key)) {
+        return false;
+      }
+      seen.add(key);
+      return true;
+    });
+  } catch (e) {
+    logger.warn('SQL parse error:', e);
+    return [];
+  }
+}
+
+function extractChange(stmt: Record<string, unknown>): DatabaseResourceUpdate | null {
+  const [stmtType, data] = Object.entries(stmt)[0] as [string, Record<string, unknown>];
+
+  if (stmtType === 'DropStmt') {
+    const type = DROP_TYPES[data.removeType as string];
+    return type ? { type } : null;
+  }
+
+  const type = STMT_TYPES[stmtType];
+  if (!type) {
+    return null;
+  }
+
+  // Only include name for 'table' (ALTER) and 'records' (DML)
+  if (type === 'table' || type === 'records') {
+    const name = (data.relation as Record<string, unknown>)?.relname as string;
+    return { type, name };
+  }
+
+  return { type };
+}
+
+/**
+ * Extract schema name from a relation/RangeVar node in the AST
+ */
+function getSchemaName(relation: Record<string, unknown> | undefined): string | null {
+  if (!relation) {
+    return null;
+  }
+
+  // Direct schemaname property (for DeleteStmt.relation)
+  if (relation.schemaname) {
+    return relation.schemaname as string;
+  }
+
+  // RangeVar structure (for TruncateStmt.relations)
+  if (relation.RangeVar) {
+    const rangeVar = relation.RangeVar as Record<string, unknown>;
+    if (rangeVar.schemaname) {
+      return rangeVar.schemaname as string;
+    }
+  }
+
+  return null;
+}
+
+/**
+ * Check if a query contains dangerous operations on the auth schema
+ * Returns an error message if blocked, null if allowed
+ */
+export function checkAuthSchemaOperations(query: string): string | null {
+  try {
+    const { stmts } = parseSync(query);
+
+    for (const stmtWrapper of stmts) {
+      const stmt = stmtWrapper.stmt as Record<string, unknown>;
+      const [stmtType, data] = Object.entries(stmt)[0] as [string, Record<string, unknown>];
+
+      // Check DELETE statements
+      if (stmtType === 'DeleteStmt') {
+        const relation = data.relation as Record<string, unknown> | undefined;
+        const schemaName = getSchemaName(relation);
+        if (schemaName?.toLowerCase() === 'auth') {
+          return 'DELETE operations on auth schema are not allowed. User deletion must be done through dedicated authentication APIs.';
+        }
+      }
+
+      // Check TRUNCATE statements
+      if (stmtType === 'TruncateStmt') {
+        const relations = (data.relations as Array<Record<string, unknown>>) || [];
+        for (const relation of relations) {
+          const schemaName = getSchemaName(relation);
+          if (schemaName?.toLowerCase() === 'auth') {
+            return 'TRUNCATE operations on auth schema are not allowed. This would delete all users and must be done through dedicated authentication APIs.';
+          }
+        }
+      }
+
+      // Check DROP statements
+      if (stmtType === 'DropStmt') {
+        const objects = (data.objects as Array<unknown>) || [];
+        for (const obj of objects) {
+          if (typeof obj === 'object' && obj !== null) {
+            const objRecord = obj as Record<string, unknown>;
+            let schemaName: string | null = null;
+
+            // DROP SCHEMA: direct String object
+            if (objRecord.String) {
+              const stringObj = objRecord.String as Record<string, unknown>;
+              if (stringObj.sval) {
+                schemaName = stringObj.sval as string;
+              }
+            }
+            // DROP TABLE/INDEX/VIEW/etc: List with [schema, name] items
+            else if (objRecord.List) {
+              const list = objRecord.List as Record<string, unknown>;
+              const items = (list.items as Array<Record<string, unknown>>) || [];
+              // First item is typically the schema name
+              if (items.length > 0) {
+                const firstItem = items[0];
+                if (firstItem.String) {
+                  const stringObj = firstItem.String as Record<string, unknown>;
+                  schemaName = stringObj.sval as string;
+                }
+              }
+            }
+            // DROP FUNCTION/PROCEDURE: ObjectWithArgs with objname array
+            else if (objRecord.ObjectWithArgs) {
+              const objectWithArgs = objRecord.ObjectWithArgs as Record<string, unknown>;
+              const objname = (objectWithArgs.objname as Array<Record<string, unknown>>) || [];
+              // First item is typically the schema name
+              if (objname.length > 0) {
+                const firstItem = objname[0];
+                if (firstItem.String) {
+                  const stringObj = firstItem.String as Record<string, unknown>;
+                  schemaName = stringObj.sval as string;
+                }
+              }
+            }
+            // DROP TYPE/DOMAIN: TypeName with names array
+            else if (objRecord.TypeName) {
+              const typeName = objRecord.TypeName as Record<string, unknown>;
+              const names = (typeName.names as Array<Record<string, unknown>>) || [];
+              // First item is typically the schema name
+              if (names.length > 0) {
+                const firstItem = names[0];
+                if (firstItem.String) {
+                  const stringObj = firstItem.String as Record<string, unknown>;
+                  schemaName = stringObj.sval as string;
+                }
+              }
+            }
+
+            if (schemaName?.toLowerCase() === 'auth') {
+              return 'DROP operations on auth schema are not allowed. This would destroy authentication resources and break the system.';
+            }
+          }
+        }
+      }
+    }
+
+    return null; // No dangerous operations found
+  } catch (parseError) {
+    logger.warn('SQL parse error in checkAuthSchemaOperations, letting query through:', parseError);
+    return null;
+  }
+}
+
 /**
  * Parse a SQL string into individual statements, properly handling:
  * - String literals with embedded semicolons

package/backend/src/utils/utils.ts

@@ -1,114 +1,114 @@
-import crypto from 'crypto';
-import { ColumnType, type AuthConfigSchema } from '@insforge/shared-schemas';
-
-/**
- * Generates a user-friendly error message listing all password requirements
- * @param config - Authentication configuration with password requirements
- * @returns A formatted message listing all enabled password requirements
- */
-export function getPasswordRequirementsMessage(config: AuthConfigSchema): string {
-  const requirements: string[] = [];
-
-  requirements.push(`at least ${config.passwordMinLength} characters long`);
-
-  if (config.requireNumber) {
-    requirements.push('at least one number');
-  }
-
-  if (config.requireLowercase) {
-    requirements.push('at least one lowercase letter');
-  }
-
-  if (config.requireUppercase) {
-    requirements.push('at least one uppercase letter');
-  }
-
-  if (config.requireSpecialChar) {
-    requirements.push('at least one special character');
-  }
-
-  return `Password must contain ${requirements.join(', ')}`;
-}
-
-export const convertSqlTypeToColumnType = (sqlType: string): ColumnType | string => {
-  switch (sqlType.toLowerCase()) {
-    case 'uuid':
-      return ColumnType.UUID;
-    case 'timestamptz':
-    case 'timestamp with time zone':
-      return ColumnType.DATETIME;
-    case 'date':
-      return ColumnType.DATE;
-    case 'integer':
-    case 'bigint':
-    case 'smallint':
-    case 'int':
-    case 'int2':
-    case 'int4':
-    case 'serial':
-    case 'serial2':
-    case 'serial4':
-    case 'serial8':
-    case 'smallserial':
-    case 'bigserial':
-      return ColumnType.INTEGER;
-    case 'double precision':
-    case 'real':
-    case 'numeric':
-    case 'float':
-    case 'float4':
-    case 'float8':
-    case 'decimal':
-      return ColumnType.FLOAT;
-    case 'boolean':
-    case 'bool':
-      return ColumnType.BOOLEAN;
-    case 'json':
-    case 'jsonb':
-    case 'array':
-      return ColumnType.JSON;
-    case 'text':
-    case 'varchar':
-    case 'char':
-    case 'character varying':
-    case 'character':
-      return ColumnType.STRING;
-    default:
-      return sqlType.slice(0, 5);
-  }
-};
-
-/**
- * Generate a UUID v4
- * @returns A UUID v4 string
- */
-export function generateUUID(): string {
-  return crypto.randomUUID();
-}
-
-/**
- * Generate a random numeric string of specified length
- * @param length - The length of the numeric string to generate
- * @returns A random string containing only digits (0-9)
- */
-export function generateNumericCode(length: number): string {
-  // Generate each digit independently
-  let result = '';
-  for (let i = 0; i < length; i++) {
-    result += crypto.randomInt(0, 10).toString();
-  }
-
-  return result;
-}
-
-/**
- * Generate a cryptographically secure random token
- * @param bytes - Number of random bytes to generate (default: 32)
- * @returns Hex-encoded string (length = bytes * 2 characters)
- * @example
- * generateSecureToken(32) // Returns 64-character hex string (256 bits entropy)
- * generateSecureToken(16) // Returns 32-character hex string (128 bits entropy)
- */
-export function generateSecureToken(bytes: number = 32): string {
-  return crypto.randomBytes(bytes).toString('hex');
-}
+import crypto from 'crypto';
+import { ColumnType, type AuthConfigSchema } from '@insforge/shared-schemas';
+
+/**
+ * Generates a user-friendly error message listing all password requirements
+ * @param config - Authentication configuration with password requirements
+ * @returns A formatted message listing all enabled password requirements
+ */
+export function getPasswordRequirementsMessage(config: AuthConfigSchema): string {
+  const requirements: string[] = [];
+
+  requirements.push(`at least ${config.passwordMinLength} characters long`);
+
+  if (config.requireNumber) {
+    requirements.push('at least one number');
+  }
+
+  if (config.requireLowercase) {
+    requirements.push('at least one lowercase letter');
+  }
+
+  if (config.requireUppercase) {
+    requirements.push('at least one uppercase letter');
+  }
+
+  if (config.requireSpecialChar) {
+    requirements.push('at least one special character');
+  }
+
+  return `Password must contain ${requirements.join(', ')}`;
+}
+
+export const convertSqlTypeToColumnType = (sqlType: string): ColumnType | string => {
+  switch (sqlType.toLowerCase()) {
+    case 'uuid':
+      return ColumnType.UUID;
+    case 'timestamptz':
+    case 'timestamp with time zone':
+      return ColumnType.DATETIME;
+    case 'date':
+      return ColumnType.DATE;
+    case 'integer':
+    case 'bigint':
+    case 'smallint':
+    case 'int':
+    case 'int2':
+    case 'int4':
+    case 'serial':
+    case 'serial2':
+    case 'serial4':
+    case 'serial8':
+    case 'smallserial':
+    case 'bigserial':
+      return ColumnType.INTEGER;
+    case 'double precision':
+    case 'real':
+    case 'numeric':
+    case 'float':
+    case 'float4':
+    case 'float8':
+    case 'decimal':
+      return ColumnType.FLOAT;
+    case 'boolean':
+    case 'bool':
+      return ColumnType.BOOLEAN;
+    case 'json':
+    case 'jsonb':
+    case 'array':
+      return ColumnType.JSON;
+    case 'text':
+    case 'varchar':
+    case 'char':
+    case 'character varying':
+    case 'character':
+      return ColumnType.STRING;
+    default:
+      return sqlType.slice(0, 8);
+  }
+};
+
+/**
+ * Generate a UUID v4
+ * @returns A UUID v4 string
+ */
+export function generateUUID(): string {
+  return crypto.randomUUID();
+}
+
+/**
+ * Generate a random numeric string of specified length
+ * @param length - The length of the numeric string to generate
+ * @returns A random string containing only digits (0-9)
+ */
+export function generateNumericCode(length: number): string {
+  // Generate each digit independently
+  let result = '';
+  for (let i = 0; i < length; i++) {
+    result += crypto.randomInt(0, 10).toString();
+  }
+
+  return result;
+}
+
+/**
+ * Generate a cryptographically secure random token
+ * @param bytes - Number of random bytes to generate (default: 32)
+ * @returns Hex-encoded string (length = bytes * 2 characters)
+ * @example
+ * generateSecureToken(32) // Returns 64-character hex string (256 bits entropy)
+ * generateSecureToken(16) // Returns 32-character hex string (128 bits entropy)
+ */
+export function generateSecureToken(bytes: number = 32): string {
+  return crypto.randomBytes(bytes).toString('hex');
+}

package/backend/src/utils/validations.ts

@@ -100,17 +100,17 @@ export function isValidIdentifier(identifier: string): boolean {
  */
 export function validateTableName(tableName: string): boolean {
   validateIdentifier(tableName, 'table');
+  return true;
+}
 
-  // Prevent access to all other system tables (starting with _)
-  if (tableName.startsWith('_')) {
-    throw new AppError(
-      'Access to system tables is not allowed',
-      403,
-      ERROR_CODES.FORBIDDEN,
-      'System tables (starting with _) cannot be accessed directly'
-    );
-  }
-
+/**
+ * Validates PostgreSQL function name for RPC calls
+ * @param functionName - The function name to validate
+ * @returns true if valid
+ * @throws AppError if invalid
+ */
+export function validateFunctionName(functionName: string): boolean {
+  validateIdentifier(functionName, 'function');
   return true;
 }