mindoodb 0.0.84 → 0.0.86

package/dist/server/types.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENV_VARS = exports.DEFAULT_SERVER_IROH_CONFIG = void 0;
+/** Written into new `config.json` files. `--update` does not rewrite existing files. */
+exports.DEFAULT_SERVER_IROH_CONFIG = {
+    enabled: false,
+    secretKeyPath: "iroh-secret.key",
+};
+/**
+ * Environment variables used by the server.
+ */
+exports.ENV_VARS = {
+    /** Password to decrypt server identity private keys and per-tenant keybags */
+    SERVER_PASSWORD: "MINDOODB_SERVER_PASSWORD",
+    /**
+     * Path to a file whose contents are the server password (trimmed). If set, used
+     * instead of {@link ENV_VARS.SERVER_PASSWORD}. Prefer in Docker so the secret is
+     * not stored in the container environment block.
+     */
+    SERVER_PASSWORD_FILE: "MINDOODB_SERVER_PASSWORD_FILE",
+    /**
+     * Optional comma-separated allowlist for /system/* (system admin HTTP surface).
+     * If unset or `*`, any client IP may call /system/* (JWT + capabilities still required).
+     * Supports exact IPv4/IPv6 addresses plus IPv4/IPv6 CIDRs.
+     * Example: `127.0.0.1,::1,10.0.0.0/8,2001:db8::/32`
+     */
+    ADMIN_ALLOWED_IPS: "MINDOODB_ADMIN_ALLOWED_IPS",
+    /**
+     * Express `trust proxy` setting: a hop count (`1` behind Cloudflare, `2` when
+     * nginx also fronts the origin), a comma-separated list of trusted
+     * addresses/CIDRs, `loopback`, or `true`. Unset means no proxy is trusted.
+     *
+     * Every rate limiter keys on `req.ip`; behind a proxy without this, all
+     * clients share the proxy's address and therefore one budget.
+     */
+    TRUST_PROXY: "MINDOODB_TRUST_PROXY",
+    /**
+     * When `true`/`1`, peer URLs may use plaintext http and target
+     * loopback/private/link-local hosts. Off by default so the server cannot be
+     * pointed at internal services (SSRF). Enable only for local development.
+     */
+    ALLOW_INSECURE_SYNC_URLS: "MINDOODB_ALLOW_INSECURE_SYNC_URLS",
+    /**
+     * Comma-separated RFC 3161 Time-Stamping Authorities the proxy at
+     * `POST /:tenantId/timestamps/rfc3161` may contact. Each entry is a built-in
+     * id (`aimoda`, `opentsa`, `freetsa`, ...) or a custom `id=url` pair; suffix
+     * `!` marks the provider qualified and `+` marks its root publicly trusted.
+     *
+     * Example: `aimoda,opentsa,belgium=http://tsa.belgium.be/connect!+`
+     *
+     * Unset disables the proxy. Clients name a provider by id only — a URL from a
+     * client would turn the endpoint into an SSRF gadget.
+     */
+    TSA_PROVIDERS: "MINDOODB_TSA_PROVIDERS",
+};
+//# sourceMappingURL=types.js.map

package/dist/server/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":";;;AAoOA,wFAAwF;AAC3E,QAAA,0BAA0B,GAAqB;IAC1D,OAAO,EAAE,KAAK;IACd,aAAa,EAAE,iBAAiB;CACjC,CAAC;AAgBF;;GAEG;AACU,QAAA,QAAQ,GAAG;IACtB,8EAA8E;IAC9E,eAAe,EAAE,0BAA0B;IAC3C;;;;OAIG;IACH,oBAAoB,EAAE,+BAA+B;IACrD;;;;;OAKG;IACH,iBAAiB,EAAE,4BAA4B;IAC/C;;;;;;;OAOG;IACH,WAAW,EAAE,sBAAsB;IACnC;;;;OAIG;IACH,wBAAwB,EAAE,mCAAmC;IAC7D;;;;;;;;;;OAUG;IACH,aAAa,EAAE,wBAAwB;CAC/B,CAAC"}

package/dist/server/validation.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Input validation utilities for the MindooDB Example Server.
+ *
+ * Prevents path traversal, injection, and resource exhaustion attacks
+ * by enforcing strict rules on all user-supplied identifiers and arrays.
+ */
+/**
+ * Validates an identifier (dbId, serverName, etc.).
+ * Must be 1-64 chars, ASCII letters/digits/dots/hyphens, start with alphanumeric.
+ * Rejects path separators, "..", leading dots, and special characters.
+ */
+export declare function validateIdentifier(value: unknown, fieldName: string): string;
+/**
+ * Validates a username (more permissive than identifier -- allows "CN=xxx/O=yyy" format).
+ * Max 256 chars, printable ASCII, no path separators or null bytes.
+ */
+export declare function validateUsername(value: unknown): string;
+/**
+ * Validates that an array does not exceed a maximum number of elements.
+ */
+export declare function validateArraySize(value: unknown, maxSize: number, fieldName: string): void;
+/**
+ * Validates that a string does not exceed a maximum length.
+ */
+export declare function validateStringLength(value: unknown, maxLength: number, fieldName: string): void;
+/**
+ * Validates tenant ID syntax without checking reserved route names.
+ */
+export declare function validateTenantIdFormat(value: unknown): string;
+/**
+ * Validates a tenant ID: must pass tenant ID syntax rules and must not be reserved.
+ */
+export declare function validateTenantId(value: unknown): string;
+export declare class ValidationError extends Error {
+    constructor(message: string);
+}
+export declare const MAX_HAVE_IDS = 100000;
+export declare const MAX_ENTRY_IDS = 100000;
+export declare const MAX_PUT_ENTRIES = 10000;
+export declare const MAX_PEM_KEY_LENGTH = 8192;
+export declare const MAX_SIGNATURE_LENGTH = 4096;
+export declare const MAX_CHALLENGE_LENGTH = 4096;
+//# sourceMappingURL=validation.d.ts.map

package/dist/server/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/server/validation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAM5E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAcvD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAU1F;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAU/F;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAS7D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQvD;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAGD,eAAO,MAAM,YAAY,SAAU,CAAC;AACpC,eAAO,MAAM,aAAa,SAAU,CAAC;AACrC,eAAO,MAAM,eAAe,QAAS,CAAC;AACtC,eAAO,MAAM,kBAAkB,OAAQ,CAAC;AACxC,eAAO,MAAM,oBAAoB,OAAQ,CAAC;AAC1C,eAAO,MAAM,oBAAoB,OAAQ,CAAC"}

package/dist/server/validation.js

@@ -0,0 +1,104 @@
+"use strict";
+/**
+ * Input validation utilities for the MindooDB Example Server.
+ *
+ * Prevents path traversal, injection, and resource exhaustion attacks
+ * by enforcing strict rules on all user-supplied identifiers and arrays.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_CHALLENGE_LENGTH = exports.MAX_SIGNATURE_LENGTH = exports.MAX_PEM_KEY_LENGTH = exports.MAX_PUT_ENTRIES = exports.MAX_ENTRY_IDS = exports.MAX_HAVE_IDS = exports.ValidationError = void 0;
+exports.validateIdentifier = validateIdentifier;
+exports.validateUsername = validateUsername;
+exports.validateArraySize = validateArraySize;
+exports.validateStringLength = validateStringLength;
+exports.validateTenantIdFormat = validateTenantIdFormat;
+exports.validateTenantId = validateTenantId;
+const databaseIdValidation_1 = require("../core/databaseIdValidation");
+const tenantIdValidation_1 = require("../core/tenantIdValidation");
+/**
+ * Validates an identifier (dbId, serverName, etc.).
+ * Must be 1-64 chars, ASCII letters/digits/dots/hyphens, start with alphanumeric.
+ * Rejects path separators, "..", leading dots, and special characters.
+ */
+function validateIdentifier(value, fieldName) {
+    const error = (0, databaseIdValidation_1.getDatabaseIdValidationError)(value, fieldName);
+    if (error) {
+        throw new ValidationError(error);
+    }
+    return value;
+}
+/**
+ * Validates a username (more permissive than identifier -- allows "CN=xxx/O=yyy" format).
+ * Max 256 chars, printable ASCII, no path separators or null bytes.
+ */
+function validateUsername(value) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new ValidationError("username is required and must be a non-empty string");
+    }
+    if (value.length > 256) {
+        throw new ValidationError("username must be at most 256 characters");
+    }
+    if (/[\x00-\x1f\x7f]/.test(value)) {
+        throw new ValidationError("username must not contain control characters");
+    }
+    return value;
+}
+/**
+ * Validates that an array does not exceed a maximum number of elements.
+ */
+function validateArraySize(value, maxSize, fieldName) {
+    if (!Array.isArray(value)) {
+        return;
+    }
+    if (value.length > maxSize) {
+        throw new ValidationError(`${fieldName} must contain at most ${maxSize} elements (received ${value.length})`);
+    }
+}
+/**
+ * Validates that a string does not exceed a maximum length.
+ */
+function validateStringLength(value, maxLength, fieldName) {
+    if (typeof value !== "string") {
+        return;
+    }
+    if (value.length > maxLength) {
+        throw new ValidationError(`${fieldName} must be at most ${maxLength} characters`);
+    }
+}
+/**
+ * Validates tenant ID syntax without checking reserved route names.
+ */
+function validateTenantIdFormat(value) {
+    const error = (0, tenantIdValidation_1.getTenantIdValidationError)(value, "tenantId", {
+        allowReserved: true,
+    });
+    if (error) {
+        throw new ValidationError(error);
+    }
+    return value;
+}
+/**
+ * Validates a tenant ID: must pass tenant ID syntax rules and must not be reserved.
+ */
+function validateTenantId(value) {
+    const id = validateTenantIdFormat(value);
+    if (tenantIdValidation_1.RESERVED_TENANT_NAMES.has(id)) {
+        throw new ValidationError(`tenantId "${id}" is reserved and cannot be used`);
+    }
+    return id;
+}
+class ValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ValidationError";
+    }
+}
+exports.ValidationError = ValidationError;
+// Limits
+exports.MAX_HAVE_IDS = 100000;
+exports.MAX_ENTRY_IDS = 100000;
+exports.MAX_PUT_ENTRIES = 10000;
+exports.MAX_PEM_KEY_LENGTH = 8192;
+exports.MAX_SIGNATURE_LENGTH = 4096;
+exports.MAX_CHALLENGE_LENGTH = 4096;
+//# sourceMappingURL=validation.js.map

package/dist/server/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/server/validation.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAaH,gDAMC;AAMD,4CAcC;AAKD,8CAUC;AAKD,oDAUC;AAKD,wDASC;AAKD,4CAQC;AA9FD,uEAA4E;AAC5E,mEAGoC;AAEpC;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,KAAc,EAAE,SAAiB;IAClE,MAAM,KAAK,GAAG,IAAA,mDAA4B,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC7D,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAe,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CAAC,qDAAqD,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,eAAe,CAAC,yCAAyC,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CAAC,8CAA8C,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,KAAc,EAAE,OAAe,EAAE,SAAiB;IAClF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,yBAAyB,OAAO,uBAAuB,KAAK,CAAC,MAAM,GAAG,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAAC,KAAc,EAAE,SAAiB,EAAE,SAAiB;IACvF,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,oBAAoB,SAAS,aAAa,CACvD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,sBAAsB,CAAC,KAAc;IACnD,MAAM,KAAK,GAAG,IAAA,+CAA0B,EAAC,KAAK,EAAE,UAAU,EAAE;QAC1D,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;IACH,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,KAAe,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,MAAM,EAAE,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,0CAAqB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CACvB,aAAa,EAAE,kCAAkC,CAClD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AALD,0CAKC;AAED,SAAS;AACI,QAAA,YAAY,GAAG,MAAO,CAAC;AACvB,QAAA,aAAa,GAAG,MAAO,CAAC;AACxB,QAAA,eAAe,GAAG,KAAM,CAAC;AACzB,QAAA,kBAAkB,GAAG,IAAK,CAAC;AAC3B,QAAA,oBAAoB,GAAG,IAAK,CAAC;AAC7B,QAAA,oBAAoB,GAAG,IAAK,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mindoodb",
-  "version": "0.0.84",
+  "version": "0.0.86",
   "engines": {
     "node": ">=22.13.0"
   },
@@ -39,6 +39,14 @@
       "default": "./dist/browser/index.mjs"
     },
     "./node": "./dist/node/index.js",
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "default": "./dist/server/index.js"
+    },
+    "./cloudflare": {
+      "types": "./dist/cloudflare/index.d.ts",
+      "default": "./dist/cloudflare/index.js"
+    },
     "./reactnative": "./dist/reactnative/index.js",
     "./sqlite": {
       "types": "./dist/sqlite/index.d.ts",