miqro 7.3.3 → 7.3.5

package/build/esm/editor/auth.js

@@ -18,13 +18,15 @@ export default {
             const cookieToken = args.req.cookies[ADMIN_EDITOR_AUTH_COOKIE];
             //console.log("\n\nqueryToken[%s] cookieToken[%s] KEY[%s]\n\n", queryToken, cookieToken, KEY);
             if (queryToken) {
-                if (typeof queryToken === "string" && timingSafeEqual(Buffer.from(queryToken), Buffer.from(KEY))) {
+                const queryBuf = Buffer.from(String(queryToken));
+                const keyBuf = Buffer.from(KEY);
+                if (typeof queryToken === "string" && queryBuf.length === keyBuf.length && timingSafeEqual(queryBuf, keyBuf)) {
                     args.res.setCookie(ADMIN_EDITOR_AUTH_COOKIE, KEY, {
-                        expires: new Date(Date.now() + 1000 * 60 * 60 * 24 * 31 * 12 * 500),
+                        expires: new Date(Date.now() + 1000 * 60 * 60 * 24),
                         httpOnly: true,
-                        //secure: true,
+                        //secure: args.req.secure,
+                        sameSite: "strict",
                         path: "/",
-                        //sameSite: "strict"
                     });
                     args.req.searchParams.delete(ADMIN_EDITOR_AUTH_QUERY);
                     const queryString = args.req.searchParams.toString();

package/build/esm/src/common/esbuild.js

@@ -59,6 +59,7 @@ export async function esBuild(options, logger) {
             else {
                 exec(esBuildCMD, {
                     maxBuffer: 1024 * 1000 * 2000,
+                    timeout: 60000,
                     cwd: dirname(options.entryPoints[0])
                 }, (err, stdout, _stderr) => {
                     if (err) {

package/build/esm/src/common/exit.js

@@ -80,20 +80,38 @@ export function setupExitHandlers(app) {
         }
         process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
     });
-    process.on("SIGTERM", function () {
+    process.on("SIGTERM", async function () {
         app.logger?.info('SIGTERM received');
+        if (app.server) {
+            await Promise.race([
+                app.stop(),
+                new Promise(r => setTimeout(r, 5000))
+            ]);
+        }
         process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
     });
-    process.on('SIGHUP', function () {
+    process.on('SIGHUP', async function () {
         app.logger?.info('SIGHUP received');
+        if (app.server) {
+            await Promise.race([
+                app.stop(),
+                new Promise(r => setTimeout(r, 5000))
+            ]);
+        }
         process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
     });
     /*process.on('SIGKILL', function () {
       server.logger.info('SIGKILL received');
       process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
     });*/
-    process.on('SIGINT', function () {
+    process.on('SIGINT', async function () {
         app.logger?.info('SIGINT received');
+        if (app.server) {
+            await Promise.race([
+                app.stop(),
+                new Promise(r => setTimeout(r, 5000))
+            ]);
+        }
         process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
     });
 }

package/build/esm/src/common/jsx.js

@@ -173,6 +173,29 @@ export const DBConfigSchema = {
     type: "object",
     properties: {
         url: "string?",
+        executor: {
+            type: "object?",
+            properties: {
+                prepare: "function",
+                query: "function",
+                disconnect: "function",
+                connect: "function",
+                transaction: "function",
+                target: "any",
+                transformInput: "function",
+                transformOutput: "function"
+            }
+        },
+        pool: {
+            type: "object?",
+            properties: {
+                min: "number?",
+                max: "number?",
+                idleTimeoutMillis: "number?",
+                connectionTimeoutMillis: "number?",
+                maxLifetimeSeconds: "number?"
+            }
+        },
         disabled: "boolean?",
         storage: "string?",
         dialect: "string?",

package/build/esm/src/services/app.d.ts

@@ -28,6 +28,7 @@ export interface MiqroOptions extends ImportJSXFileOptions {
     https?: boolean;
     httpRedirect?: number;
     noMinify?: boolean;
+    allowedRedirectHosts?: string[];
 }
 export interface InflateOptions {
     inflateDir?: string;

package/build/esm/src/services/app.js

@@ -383,7 +383,12 @@ export class Miqro {
         if (this.options?.httpRedirect) {
             this.httpsRedirectServer = new App();
             this.httpsRedirectServer.use(async (req, res) => {
-                const hostname = req.headers.host.split(":").length > 1 ? req.headers.host.split(":")[0] : req.headers.host;
+                const hostname = req.headers.host?.split(":")[0] ?? "";
+                const allowed = this.options?.allowedRedirectHosts;
+                if (allowed && !allowed.includes(hostname)) {
+                    res.writeHead(400).end("Invalid Host header");
+                    return;
+                }
                 return await res.redirect('https://' + hostname + ":" + this.options.port + req.url);
             });
         }

package/build/esm/src/services/utils/db-manager.js

@@ -15,9 +15,11 @@ export class DBManager {
             this.options?.logger?.debug("setting up db connection [%s]", config.name);
             this.options?.logger?.trace("creating db connection [%s]", config.name);
             const db = new Database({
+                executor: config.executor,
                 dialect: config.dialect ? config.dialect : "node:sqlite",
                 storage: config.storage ? config.storage : "./db.sqlite3",
                 connectionString: config.url,
+                pool: config.pool,
                 logger: this.options?.loggerProvider?.getLogger(`${DB_IDENTIFIER}_${config.name}`)
             });
             this.options?.logger?.trace("connecting db connection [%s]", config.name);

package/build/esm/src/types.d.ts

@@ -1,4 +1,4 @@
-import { Database } from "@miqro/query";
+import { Database, QueryExecutor } from "@miqro/query";
 import { WebSocketServerOptions, SessionHandlerOptions, Logger, WebSocketServer, ReadBuffer, URLEncodedParser, JSONParser, TextParser, CORS, SessionHandler, RouteOptions, Handler, Request, Response, LogLevel, LoggerTransportWriteArgs, CORSOptions, HandlerWithOptions, ErrorHandler, SchemaProperties, APIRoute as BaseAPIRoute } from "@miqro/core";
 import { request } from "@miqro/request";
 import { Parser, ParserInterface } from "@miqro/parser";
@@ -219,9 +219,17 @@ export interface ServerConfig {
 export interface DBConfig {
     dialect?: string;
     storage?: string;
+    executor?: QueryExecutor;
     url?: string;
     disabled?: boolean;
     name: string;
+    pool?: {
+        min?: number;
+        max?: number;
+        idleTimeoutMillis?: number;
+        connectionTimeoutMillis?: number;
+        maxLifetimeSeconds?: number;
+    };
 }
 export interface APIOptions<TBody extends SchemaProperties | string | boolean | undefined = SchemaProperties | string | boolean | undefined, TParams extends SchemaProperties | string | boolean | undefined = SchemaProperties | string | boolean | undefined, TQuery extends SchemaProperties | string | boolean | undefined = SchemaProperties | string | boolean | undefined> extends Partial<RouteOptions<TBody, TParams, TQuery>> {
     basePath?: string;

package/build/lib.cjs

@@ -720,7 +720,7 @@ function ReadBuffer(options) {
           req.removeListener("end", endListener);
           try {
             const concatBuffers = Buffer.concat(buffers);
-            const responseBuffer = req.headers["content-encoding"] === "gzip" ? (0, import_zlib.gunzipSync)(concatBuffers) : concatBuffers;
+            const responseBuffer = req.headers["content-encoding"] === "gzip" ? (0, import_zlib.gunzipSync)(concatBuffers, { maxOutputLength: limit }) : concatBuffers;
             req.logger.trace("ctx.buffer %o", responseBuffer);
             req.buffer = responseBuffer;
             resolve24();
@@ -2897,32 +2897,42 @@ var init_websocket = __esm({
             req.logger.debug("upgrading connection");
             socket.write(createUpgradeHeaders(acceptKey, extraHeaders));
             socket.on("data", async (data) => {
-              const frame = parseFrame(data, this.options.maxFrameSize);
-              if (frame === PING) {
-                try {
-                  socket.write(Buffer.from([138, 0]));
-                } catch (e) {
-                  req.logger.error(e);
-                }
-              } else if (frame !== null) {
-                if (!this.options.onMessage) {
-                  socket.end();
-                  socket.destroy();
+              try {
+                const frame = parseFrame(data, this.options.maxFrameSize);
+                if (frame === PING) {
+                  try {
+                    socket.write(Buffer.from([138, 0]));
+                  } catch (e) {
+                    req.logger.error(e);
+                  }
+                } else if (frame !== null) {
+                  if (!this.options.onMessage) {
+                    socket.end();
+                    socket.destroy();
+                  } else {
+                    try {
+                      await this.options.onMessage(client, frame);
+                    } catch (e) {
+                      req.logger.error(e);
+                    }
+                  }
                 } else {
                   try {
-                    await this.options.onMessage(client, frame);
+                    socket.write(Buffer.from([136, 0]));
                   } catch (e) {
                     req.logger.error(e);
                   }
+                  socket.end();
+                  socket.destroy();
                 }
-              } else {
+              } catch (e) {
                 try {
-                  socket.write(Buffer.from([136, 0]));
-                } catch (e) {
-                  req.logger.error(e);
+                  req.logger?.error(e);
+                  socket.end();
+                  socket.destroy();
+                } catch (e2) {
+                  console.error(e2);
                 }
-                socket.end();
-                socket.destroy();
               }
             });
             socket.on("error", async (error2) => {
@@ -9446,6 +9456,7 @@ async function esBuild2(options, logger) {
       } else {
         (0, import_node_child_process.exec)(esBuildCMD, {
           maxBuffer: 1024 * 1e3 * 2e3,
+          timeout: 6e4,
           cwd: (0, import_node_path5.dirname)(options.entryPoints[0])
         }, (err, stdout, _stderr) => {
           if (err) {
@@ -9603,6 +9614,29 @@ var DBConfigSchema = {
   type: "object",
   properties: {
     url: "string?",
+    executor: {
+      type: "object?",
+      properties: {
+        prepare: "function",
+        query: "function",
+        disconnect: "function",
+        connect: "function",
+        transaction: "function",
+        target: "any",
+        transformInput: "function",
+        transformOutput: "function"
+      }
+    },
+    pool: {
+      type: "object?",
+      properties: {
+        min: "number?",
+        max: "number?",
+        idleTimeoutMillis: "number?",
+        connectionTimeoutMillis: "number?",
+        maxLifetimeSeconds: "number?"
+      }
+    },
     disabled: "boolean?",
     storage: "string?",
     dialect: "string?",
@@ -9883,7 +9917,7 @@ function jsx2HTML(out, runtime) {
 // src/types.ts
 init_lib3();
 
-// node_modules/@miqro/query/build/executors/sqlite3/utils.js
+// node_modules/@miqro/query/build/executors/sqlite-native/utils.js
 function sqlite3ExecutorPrepare(args) {
   switch (args._type) {
     case "delete": {
@@ -9891,7 +9925,7 @@ function sqlite3ExecutorPrepare(args) {
       const where = getWhereStatement(q);
       const returing = q._returning.length === 0 ? "*" : q._returning.join(",");
       const whereSQL = where.sql !== "" ? ` WHERE ${where.sql}` : "";
-      const sql = `DELETE FROM "${q._table}"${whereSQL}${getOrderBy(q._orderBy)}${getLimit(q._limitBy, q._offsetBy)} RETURNING ${returing}`;
+      const sql = `DELETE FROM ${renderTable(q._table)}${whereSQL}${getOrderBy(q._orderBy)}${getLimit(q._limitBy, q._offsetBy)} RETURNING ${returing}`;
       return {
         sql,
         values: where.values
@@ -9904,7 +9938,7 @@ function sqlite3ExecutorPrepare(args) {
     }
     case "create-table": {
       const q = args;
-      const sql = `CREATE TABLE${q._ignoreDuplicate ? " IF NOT EXISTS" : ""} "${q._table}"${getCreateTableColumns(q._definition)}`;
+      const sql = `CREATE TABLE${q._ignoreDuplicate ? " IF NOT EXISTS" : ""} ${renderTable(q._table)}${getCreateTableColumns(q._definition)}`;
       return sql;
     }
     case "drop-database": {
@@ -9914,7 +9948,7 @@ function sqlite3ExecutorPrepare(args) {
     }
     case "drop-table": {
       const q = args;
-      const sql = `DROP TABLE${q._ignoreDuplicate ? " IF EXISTS" : ""} "${q._table}"`;
+      const sql = `DROP TABLE${q._ignoreDuplicate ? " IF EXISTS" : ""} ${renderTable(q._table)}`;
       return sql;
     }
     case "alter-table": {
@@ -9933,17 +9967,17 @@ function sqlite3ExecutorPrepare(args) {
               throw new Error("unsupported alter action add without definition");
             }
             alters.push({
-              sql: `ALTER TABLE "${q._table}" ADD COLUMN ${getCreateTableColumn(l._column, l._definition, [])}`
+              sql: `ALTER TABLE ${renderTable(q._table)} ADD COLUMN ${getCreateTableColumn(l._column, l._definition, [])}`
             });
             break;
           case "drop":
             alters.push({
-              sql: `ALTER TABLE "${q._table}" DROP COLUMN "${l._column}"`
+              sql: `ALTER TABLE ${renderTable(q._table)} DROP COLUMN "${l._column}"`
             });
             break;
           case "rename":
             alters.push({
-              sql: `ALTER TABLE "${q._table}" RENAME COLUMN "${l._column}" TO "${l._newName}"`
+              sql: `ALTER TABLE ${renderTable(q._table)} RENAME COLUMN "${l._column}" TO "${l._newName}"`
             });
             break;
           default:
@@ -9956,7 +9990,7 @@ function sqlite3ExecutorPrepare(args) {
       const q = args;
       const rows = getInsertValues(q._columns, q._values);
       const returing = q._returning.length === 0 ? "*" : q._returning.join(",");
-      const sql = `INSERT${q._ignoreDuplicate ? " OR IGNORE" : ""} INTO "${q._table}"${getInsertColumns(q._columns)}${rows.sql} RETURNING ${returing}`;
+      const sql = `INSERT${q._ignoreDuplicate ? " OR IGNORE" : ""} INTO ${renderTable(q._table)}${getInsertColumns(q._columns)}${rows.sql} RETURNING ${returing}`;
       return [{
         sql,
         values: rows.values
@@ -9994,7 +10028,7 @@ function sqlite3ExecutorPrepare(args) {
       const where = getWhereStatement(q);
       const whereSQL = where.sql !== "" ? ` WHERE ${where.sql}` : "";
       const setSQL = ` SET ${q._sets.map((set) => `${renderColumn(set.column)}=?`)}`;
-      const sql = `UPDATE "${q._table}"${setSQL}${whereSQL}${getOrderBy(q._orderBy)}${getLimit(q._limitBy, q._offsetBy)} RETURNING ${returing}`;
+      const sql = `UPDATE ${renderTable(q._table)}${setSQL}${whereSQL}${getOrderBy(q._orderBy)}${getLimit(q._limitBy, q._offsetBy)} RETURNING ${returing}`;
       return [{
         sql,
         values: q._sets.map((set) => set.value).concat(where.values)
@@ -10159,7 +10193,7 @@ function getCreateTableColumns(definition) {
 function getCreateTableColumn(columnName, def, primaryKeyColumns) {
   const primaryKey = primaryKeyColumns.length === 1 && columnName === primaryKeyColumns[0] ? " PRIMARY KEY" : "";
   const notNull = `${def.allowNull == false ? " NOT NULL" : ""}`;
-  const defaultValue = `${def.defaultValue !== void 0 ? ` DEFAULT '${def.defaultValue}'` : ""}`;
+  const defaultValue = def.defaultValue !== void 0 ? ` DEFAULT '${String(def.defaultValue).replace(/'/g, "''")}'` : "";
   const autoIncrement = `${def.autoIncrement !== void 0 && def.autoIncrement === true ? ` AUTOINCREMENT` : ""}`;
   switch (def.type) {
     case "datetime":
@@ -10204,8 +10238,21 @@ function getOrderBy(orderBy, wrapper = '"') {
 function getLimit(limit, offsetBy) {
   return `${limit !== void 0 ? ` LIMIT ${limit}` : ""}${offsetBy ? ` OFFSET ${offsetBy}` : ""}`;
 }
+var IDENT_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function renderColumn(column, wrapper = '"') {
-  return `${column.split(".").map((c) => `${wrapper}${c}${wrapper}`).join(".")}`;
+  const parts = column.split(".");
+  for (const p of parts) {
+    if (!IDENT_RE.test(p)) {
+      throw new Error(`invalid identifier: ${p}`);
+    }
+  }
+  return parts.map((c) => `${wrapper}${c}${wrapper}`).join(".");
+}
+function renderTable(name, wrapper = '"') {
+  if (!IDENT_RE.test(name)) {
+    throw new Error(`invalid table name: ${name}`);
+  }
+  return `${wrapper}${name}${wrapper}`;
 }
 function mergePrepareArgs(to, merge, concatOperator = " AND ") {
   return (merge instanceof Array ? merge : [merge]).reduce((current, value) => {
@@ -10236,7 +10283,9 @@ var DATABASE_CONFIG_SCHEMA = {
       properties: {
         prepare: "function",
         query: "function",
-        disconnect: "function"
+        disconnect: "function",
+        connect: "function",
+        target: "any"
       }
     },
     logger: {
@@ -10247,11 +10296,21 @@ var DATABASE_CONFIG_SCHEMA = {
         error: "function?"
       }
     },
+    pool: {
+      type: "object?",
+      properties: {
+        min: "number?",
+        max: "number?",
+        idleTimeoutMillis: "number?",
+        connectionTimeoutMillis: "number?",
+        maxLifetimeSeconds: "number?"
+      }
+    },
     storage: "string?",
     connectionString: "string?",
     dialect: {
       type: "enum?",
-      enumValues: ["node:sqlite", "sqlite3-cli", "sqlite3", "pg"]
+      enumValues: ["node:sqlite", "pg", "pg-pool"]
     }
   }
 };
@@ -10346,143 +10405,188 @@ function pgTransformOutput(type, value) {
   }
 }
 
-// node_modules/@miqro/query/build/executors/sqlite3/lib.js
-var SQLITE_CONFIG_SCHEMA = {
+// node_modules/@miqro/query/build/executors/pg/lib.js
+var PG_DATABASE_CONFIG_SCHEMA = {
   type: "object",
   mode: "remove_extra",
   properties: {
-    storage: "string"
+    connectionString: "string",
+    pool: {
+      type: "object?",
+      properties: {
+        min: "number?",
+        max: "number?",
+        idleTimeoutMillis: "number?",
+        connectionTimeoutMillis: "number?",
+        maxLifetimeSeconds: "number?"
+      }
+    }
   }
 };
-async function sqlite3Executor(config) {
-  const databaseOptions = parser2.parse(config, SQLITE_CONFIG_SCHEMA);
-  if (!databaseOptions) {
-    throw new Error("config not valid");
-  }
-  const sqlite3 = await import("sqlite3");
-  const driver = new sqlite3.default.Database(databaseOptions.storage);
-  return {
-    disconnect: async function sqlite3ExecutorDisconnect() {
-      await driver.close();
-    },
-    prepare: sqlite3ExecutorPrepare,
-    transformInput: sqliteTransformInput,
-    transformOutput: sqliteTransformOutput,
-    query: async function sqlite3Executor2(sql, values) {
-      return new Promise((resolve24, reject) => {
-        const st = driver.prepare(sql, values, function(error2) {
-          if (error2) {
-            reject(error2);
-          } else {
-            st.all(function(error3, rows) {
-              if (error3) {
-                reject(error3);
-              } else {
-                st.finalize((error4) => {
-                  if (error4) {
-                    reject(error4);
-                  } else {
-                    resolve24(rows);
-                  }
-                });
-              }
-            });
-          }
+function postgresExecutorPrepare(args) {
+  switch (args._type) {
+    case "create-table": {
+      const q = args;
+      const sql = `CREATE TABLE${q._ignoreDuplicate ? " IF NOT EXISTS" : ""} ${renderTable(q._table)}${getCreateTableColumns2(q._definition)}`;
+      return sql;
+    }
+    case "insert": {
+      const q = args;
+      const rows = getInsertValues(q._columns, q._values);
+      const returing = q._returning.length === 0 ? "*" : q._returning.join(",");
+      const sql = `INSERT INTO ${renderTable(q._table)}${getInsertColumns(q._columns)}${rows.sql} ${q._ignoreDuplicate ? "ON CONFLICT DO NOTHING " : ""}RETURNING ${returing}`;
+      return {
+        sql,
+        values: rows.values
+      };
+    }
+    case "alter-table": {
+      const q = args;
+      let alters = [];
+      if (q._renameTable) {
+        alters.push({
+          sql: `ALTER TABLE ${renderTable(q._table)} RENAME TO "?"`,
+          values: [q._renameTable]
         });
-      });
+      }
+      for (let l of q._changes) {
+        switch (l._action) {
+          case "add":
+            if (!l._definition) {
+              throw new Error("unsupported alter action add without definition");
+            }
+            alters.push({
+              sql: `ALTER TABLE ${renderTable(q._table)} ADD COLUMN ${getCreateTableColumn2(l._column, l._definition, [])}`
+            });
+            break;
+          case "drop":
+            alters.push({
+              sql: `ALTER TABLE ${renderTable(q._table)} DROP COLUMN "${l._column}"`
+            });
+            break;
+          case "rename":
+            alters.push({
+              sql: `ALTER TABLE ${renderTable(q._table)} RENAME COLUMN "${l._column}" TO "${l._newName}"`
+            });
+            break;
+          default:
+            throw new Error("unsupported alter action");
+        }
+      }
+      return alters;
+    }
+    default:
+      return sqlite3ExecutorPrepare(args);
+  }
+}
+function pgQuery(client) {
+  return async function postgresExecutor2(sql, values) {
+    try {
+      const result = await client.query(tokens2Postgres(sql, values), values);
+      return result.rows;
+    } catch (e) {
+      throw e;
     }
   };
 }
-
-// node_modules/@miqro/query/build/executors/pg/lib.js
-var PG_DATABASE_CONFIG_SCHEMA = {
-  type: "object",
-  mode: "remove_extra",
-  properties: {
-    connectionString: "string"
-  }
-};
-async function postgresExecutor(config) {
+async function postgresExecutor(config, usePool) {
+  const target = new EventTarget();
+  const usingPool = config.pool && usePool === void 0 || usePool === true;
   const databaseOptions = parser2.parse(config, PG_DATABASE_CONFIG_SCHEMA);
   if (!databaseOptions) {
     throw new Error("bad options");
   }
-  const pg = await import("pg");
-  const driver = new pg.default.Client({
-    connectionString: databaseOptions.connectionString
-    // "postgresql://postgres:password@localhost:5432/db"
-  });
-  await driver.connect();
+  const { Pool, Client } = await import("pg");
+  let driver;
+  if (usingPool) {
+    driver = new Pool({
+      connectionString: databaseOptions.connectionString,
+      // "postgresql://postgres:password@localhost:5432/db", 
+      max: databaseOptions.pool?.max,
+      min: databaseOptions.pool?.min,
+      idleTimeoutMillis: databaseOptions.pool?.idleTimeoutMillis,
+      connectionTimeoutMillis: databaseOptions.pool?.connectionTimeoutMillis,
+      maxLifetimeSeconds: databaseOptions.pool?.maxLifetimeSeconds
+    });
+    driver.on("error", (err) => {
+      const errorEvent = new CustomEvent("error", {
+        detail: err
+      });
+      target.dispatchEvent(errorEvent);
+    });
+  } else {
+    driver = new Client({
+      connectionString: databaseOptions.connectionString
+      // "postgresql://postgres:password@localhost:5432/db", 
+    });
+    driver.on("error", (err) => {
+      const errorEvent = new CustomEvent("error", {
+        detail: err
+      });
+      target.dispatchEvent(errorEvent);
+    });
+  }
   return {
-    disconnect: async function postgresExecutorDisconnect() {
-      await driver.end();
-    },
-    transformInput: pgTransformInput,
-    transformOutput: pgTransformOutput,
-    prepare: function postgresExecutorPrepare(args) {
-      switch (args._type) {
-        case "create-table": {
-          const q = args;
-          const sql = `CREATE TABLE${q._ignoreDuplicate ? " IF NOT EXISTS" : ""} "${q._table}"${getCreateTableColumns2(q._definition)}`;
-          return sql;
-        }
-        case "insert": {
-          const q = args;
-          const rows = getInsertValues(q._columns, q._values);
-          const returing = q._returning.length === 0 ? "*" : q._returning.join(",");
-          const sql = `INSERT INTO "${q._table}"${getInsertColumns(q._columns)}${rows.sql} ${q._ignoreDuplicate ? "ON CONFLICT DO NOTHING " : ""}RETURNING ${returing}`;
-          return {
-            sql,
-            values: rows.values
-          };
-        }
-        case "alter-table": {
-          const q = args;
-          let alters = [];
-          if (q._renameTable) {
-            alters.push({
-              sql: `ALTER TABLE "${q._table}" RENAME TO "?"`,
-              values: [q._renameTable]
-            });
-          }
-          for (let l of q._changes) {
-            switch (l._action) {
-              case "add":
-                if (!l._definition) {
-                  throw new Error("unsupported alter action add without definition");
-                }
-                alters.push({
-                  sql: `ALTER TABLE "${q._table}" ADD COLUMN ${getCreateTableColumn2(l._column, l._definition, [])}`
-                });
-                break;
-              case "drop":
-                alters.push({
-                  sql: `ALTER TABLE "${q._table}" DROP COLUMN "${l._column}"`
-                });
-                break;
-              case "rename":
-                alters.push({
-                  sql: `ALTER TABLE "${q._table}" RENAME COLUMN "${l._column}" TO "${l._newName}"`
-                });
-                break;
-              default:
-                throw new Error("unsupported alter action");
-            }
+    target,
+    transaction: async (cb) => {
+      const client = usingPool ? await driver.connect() : await (async () => {
+        const newClient = new Client({
+          connectionString: databaseOptions.connectionString
+          // "postgresql://postgres:password@localhost:5432/db", 
+        });
+        newClient.on("error", (err) => {
+          const errorEvent = new CustomEvent("error", {
+            detail: err
+          });
+          target.dispatchEvent(errorEvent);
+        });
+        await newClient.connect();
+        return newClient;
+      })();
+      const newExecutor = {
+        target: new EventTarget(),
+        transaction: async (cb2) => cb2(newExecutor),
+        connect: async () => {
+        },
+        disconnect: async () => {
+          if (usingPool) {
+            await client.release();
+          } else {
+            await client.end();
           }
-          return alters;
-        }
-        default:
-          return sqlite3ExecutorPrepare(args);
-      }
-    },
-    query: async function postgresExecutor2(sql, values) {
+        },
+        transformInput: pgTransformInput,
+        transformOutput: pgTransformOutput,
+        prepare: postgresExecutorPrepare,
+        query: pgQuery(client)
+      };
       try {
-        const result = await driver.query(tokens2Postgres(sql, values), values);
-        return result.rows;
+        await newExecutor.query("BEGIN;");
+        const ret = await cb(newExecutor);
+        await newExecutor.query("COMMIT;");
+        return ret;
       } catch (e) {
+        await newExecutor.query("ROLLBACK;");
         throw e;
+      } finally {
+        newExecutor.disconnect();
       }
-    }
+    },
+    connect: async () => {
+      if (usingPool) {
+        const client = await driver.connect();
+        await client.release();
+      } else {
+        await driver.connect();
+      }
+    },
+    disconnect: async function postgresExecutorDisconnect() {
+      await driver.end();
+    },
+    transformInput: pgTransformInput,
+    transformOutput: pgTransformOutput,
+    prepare: postgresExecutorPrepare,
+    query: pgQuery(driver)
   };
 }
 function getCreateTableColumns2(definition) {
@@ -10498,7 +10602,7 @@ function getCreateTableColumns2(definition) {
 function getCreateTableColumn2(columnName, def, primaryKeyColumns) {
   const primaryKey = primaryKeyColumns.length === 1 && columnName === primaryKeyColumns[0] ? " PRIMARY KEY" : "";
   const notNull = `${def.allowNull == false ? " NOT NULL" : ""}`;
-  const defaultValue = `${def.defaultValue !== void 0 ? ` DEFAULT '${def.defaultValue}'` : ""}`;
+  const defaultValue = def.defaultValue !== void 0 ? ` DEFAULT '${String(def.defaultValue).replace(/'/g, "''")}'` : "";
   if (def.autoIncrement) {
     return `"${columnName}" BIGSERIAL${primaryKey}`;
   }
@@ -10583,10 +10687,12 @@ async function runStatements(db, stmts, logger) {
 
 // node_modules/@miqro/query/build/query/create-database.js
 var CreateDatabase = class _CreateDatabase {
+  db;
+  _dbName;
+  _type = "create-database";
   constructor(db, _dbName) {
     this.db = db;
     this._dbName = _dbName;
-    this._type = "create-database";
   }
   async yield(logger) {
     return runStatements(this.db, this.db.getExecutor().prepare(this), logger);
@@ -10602,12 +10708,15 @@ var CreateDatabase = class _CreateDatabase {
 
 // node_modules/@miqro/query/build/query/create-table.js
 var CreateTable = class _CreateTable {
+  db;
+  _table;
+  _definition;
+  _ignoreDuplicate = false;
+  _type = "create-table";
   constructor(db, _table, _definition = {}) {
     this.db = db;
     this._table = _table;
     this._definition = _definition;
-    this._ignoreDuplicate = false;
-    this._type = "create-table";
     this._definition = assertNotUndefined2(parser2.parse(_definition, TableSchemaSchema));
   }
   column(column, definition) {
@@ -10642,11 +10751,13 @@ var CreateTable = class _CreateTable {
 
 // node_modules/@miqro/query/build/query/drop-table.js
 var DropTable = class _DropTable {
+  db;
+  _table;
+  _type = "drop-table";
+  _ignoreDuplicate = false;
   constructor(db, _table) {
     this.db = db;
     this._table = _table;
-    this._type = "drop-table";
-    this._ignoreDuplicate = false;
   }
   prepare() {
     return getStatements(this.db.getExecutor().prepare(this));
@@ -10667,12 +10778,16 @@ var DropTable = class _DropTable {
 
 // node_modules/@miqro/query/build/query/alter-table.js
 var AlterTable = class _AlterTable {
+  db;
+  _table;
+  _inTransaction;
+  _type = "alter-table";
+  _renameTable;
+  _changes = [];
   constructor(db, _table, _inTransaction = false) {
     this.db = db;
     this._table = _table;
     this._inTransaction = _inTransaction;
-    this._type = "alter-table";
-    this._changes = [];
   }
   rename(name) {
     this._renameTable = name;
@@ -10717,14 +10832,17 @@ var AlterTable = class _AlterTable {
 
 // node_modules/@miqro/query/build/query/insert.js
 var Insert = class _Insert {
+  db;
+  _table;
+  _type = "insert";
+  _columns = [];
+  _returning = [];
+  _values = [];
+  _ignoreDuplicate = false;
+  _schema;
   constructor(db, _table, schema) {
     this.db = db;
     this._table = _table;
-    this._type = "insert";
-    this._columns = [];
-    this._returning = [];
-    this._values = [];
-    this._ignoreDuplicate = false;
     this._schema = schema;
   }
   value(value) {
@@ -10776,10 +10894,10 @@ var Insert = class _Insert {
 
 // node_modules/@miqro/query/build/executors/where.js
 var Where = class _Where {
-  constructor() {
-    this._orderBy = [];
-    this._filters = [];
-  }
+  _orderBy = [];
+  _limitBy;
+  _offsetBy;
+  _filters = [];
   clone() {
     const ret = new _Where();
     ret._filters = structuredClone(this._filters);
@@ -10793,10 +10911,16 @@ var Where = class _Where {
     return this;
   }
   limit(limit) {
+    if (typeof limit !== "number" || !Number.isInteger(limit) || limit < 0) {
+      throw new Error("limit must be a non-negative integer");
+    }
     this._limitBy = limit;
     return this;
   }
   offset(offset) {
+    if (typeof offset !== "number" || !Number.isInteger(offset) || offset < 0) {
+      throw new Error("offset must be a non-negative integer");
+    }
     this._offsetBy = offset;
     return this;
   }
@@ -11075,15 +11199,19 @@ async function yieldWithInclude(db, schema, assocMap, include, filters, orderBy,
 
 // node_modules/@miqro/query/build/query/select.js
 var Select = class _Select extends Where {
+  db;
+  _type = "select";
+  _columns = [];
+  _selectFrom = [];
+  _groupBy = [];
+  _joins = [];
+  _orderBy = [];
+  _schema;
+  _assocMap;
+  _include;
   constructor(db, schema, associations) {
     super();
     this.db = db;
-    this._type = "select";
-    this._columns = [];
-    this._selectFrom = [];
-    this._groupBy = [];
-    this._joins = [];
-    this._orderBy = [];
     this._schema = schema;
     if (associations) {
       this._assocMap = new Map(Object.entries(associations));
@@ -11172,13 +11300,14 @@ var Select = class _Select extends Where {
 
 // node_modules/@miqro/query/build/query/count.js
 var Count = class _Count extends Where {
+  db;
+  _type = "count";
+  _selectFrom = [];
+  _groupBy = [];
+  _joins = [];
   constructor(db) {
     super();
     this.db = db;
-    this._type = "count";
-    this._selectFrom = [];
-    this._groupBy = [];
-    this._joins = [];
   }
   clone() {
     const ret = new _Count(this.db);
@@ -11231,13 +11360,16 @@ async function parseCountResult(rows) {
 
 // node_modules/@miqro/query/build/query/update.js
 var Update = class _Update extends Where {
+  db;
+  _table;
+  _type = "update";
+  _sets = [];
+  _returning = [];
+  _schema;
   constructor(db, _table, schema) {
     super();
     this.db = db;
     this._table = _table;
-    this._type = "update";
-    this._sets = [];
-    this._returning = [];
     this._schema = schema;
   }
   prepare() {
@@ -11275,12 +11407,15 @@ var Update = class _Update extends Where {
 
 // node_modules/@miqro/query/build/query/delete.js
 var Delete = class _Delete extends Where {
+  db;
+  _table;
+  _type = "delete";
+  _returning = [];
+  _schema;
   constructor(db, _table, schema) {
     super();
     this.db = db;
     this._table = _table;
-    this._type = "delete";
-    this._returning = [];
     this._schema = schema;
   }
   prepare() {
@@ -11309,11 +11444,13 @@ var Delete = class _Delete extends Where {
 
 // node_modules/@miqro/query/build/query/drop-database.js
 var DropDatabase = class _DropDatabase {
+  db;
+  _dbName;
+  _type = "drop-database";
+  _ignoreDuplicate = false;
   constructor(db, _dbName) {
     this.db = db;
     this._dbName = _dbName;
-    this._type = "drop-database";
-    this._ignoreDuplicate = false;
   }
   prepare() {
     return getStatements(this.db.getExecutor().prepare(this));
@@ -11333,72 +11470,119 @@ var DropDatabase = class _DropDatabase {
 };
 
 // node_modules/@miqro/query/build/executors/sqlite-native/lib.js
-var SQLITE_CONFIG_SCHEMA2 = {
+var SQLITE_CONFIG_SCHEMA = {
   type: "object",
   mode: "remove_extra",
   properties: {
     storage: "string"
   }
 };
+function nativeSqliteQuery(driver) {
+  return async function sqlite3Executor(sql, values) {
+    return new Promise((resolve24, reject) => {
+      try {
+        if (values) {
+          for (let i = 0; i < values.length; i++) {
+            switch (typeof values[i]) {
+              case "object":
+                if (values[i] instanceof Date) {
+                  values[i] = values[i].toString();
+                }
+                break;
+              case "boolean":
+                values[i] = values[i] ? 1 : 0;
+                break;
+            }
+          }
+        }
+        const stmt = driver.prepare(sql);
+        stmt.setReadBigInts(true);
+        const ret = values && values.length > 0 ? stmt.all(...values) : stmt.all();
+        resolve24(ret.map((row) => {
+          const out = {};
+          for (const key of Object.keys(row)) {
+            const v = row[key];
+            out[key] = typeof v === "bigint" && v >= Number.MIN_SAFE_INTEGER && v <= Number.MAX_SAFE_INTEGER ? Number(v) : typeof v === "number" ? Number(v) : v;
+          }
+          return out;
+        }));
+      } catch (e) {
+        reject(e);
+      }
+    });
+  };
+}
 async function nativeSqlite(config) {
-  const databaseOptions = parser2.parse(config, SQLITE_CONFIG_SCHEMA2);
+  const databaseOptions = parser2.parse(config, SQLITE_CONFIG_SCHEMA);
+  const target = new EventTarget();
   if (!databaseOptions) {
     throw new Error("config not valid");
   }
   const sqliteModule = await import("node:sqlite");
   const driver = new sqliteModule.DatabaseSync(databaseOptions.storage);
   return {
+    target,
+    transaction: async (cb) => {
+      const client = new sqliteModule.DatabaseSync(databaseOptions.storage);
+      const newExecutor = {
+        target: new EventTarget(),
+        transaction: async (cb2) => cb2(newExecutor),
+        connect: async () => {
+        },
+        disconnect: async () => {
+          if (client.isOpen)
+            return client.close();
+        },
+        prepare: sqlite3ExecutorPrepare,
+        transformInput: sqliteTransformInput,
+        transformOutput: sqliteTransformOutput,
+        query: nativeSqliteQuery(client)
+      };
+      let begin = false;
+      try {
+        await newExecutor.query("BEGIN;");
+        begin = true;
+        const ret = await cb(newExecutor);
+        await newExecutor.query("COMMIT;");
+        return ret;
+      } catch (e) {
+        if (begin) {
+          await newExecutor.query("ROLLBACK;");
+        }
+        throw e;
+      } finally {
+        newExecutor.disconnect();
+      }
+    },
+    connect: async () => {
+    },
     // we just use the sqlite3Executor prepare function
     prepare: sqlite3ExecutorPrepare,
     transformInput: sqliteTransformInput,
     transformOutput: sqliteTransformOutput,
     disconnect: async function sqlite3ExecutorDisconnect() {
-      return driver.close();
+      if (driver.isOpen)
+        return driver.close();
     },
-    query: async function sqlite3Executor2(sql, values) {
-      return new Promise((resolve24, reject) => {
-        try {
-          if (values) {
-            for (let i = 0; i < values.length; i++) {
-              switch (typeof values[i]) {
-                case "object":
-                  if (values[i] instanceof Date) {
-                    values[i] = values[i].toString();
-                  }
-                  break;
-                case "boolean":
-                  values[i] = values[i] ? 1 : 0;
-                  break;
-              }
-            }
-          }
-          const stmt = driver.prepare(sql);
-          stmt.setReadBigInts(true);
-          const ret = values && values.length > 0 ? stmt.all(...values) : stmt.all();
-          resolve24(ret.map((row) => {
-            const out = {};
-            for (const key of Object.keys(row)) {
-              const v = row[key];
-              out[key] = typeof v === "bigint" && v >= Number.MIN_SAFE_INTEGER && v <= Number.MAX_SAFE_INTEGER ? Number(v) : typeof v === "number" ? Number(v) : v;
-            }
-            return out;
-          }));
-        } catch (e) {
-          reject(e);
-        }
-      });
-    }
+    query: nativeSqliteQuery(driver)
   };
 }
 
 // node_modules/@miqro/query/build/db.js
-var Database = class {
+var Database = class _Database extends EventTarget {
+  config;
+  status = "disconnected";
+  executor = null;
+  _errorListener;
   constructor(config) {
+    super();
     this.config = config;
-    this.status = "disconnected";
-    this.executor = null;
     parser2.parse(config, DATABASE_CONFIG_SCHEMA, "no_extra");
     this.executor = null;
+    this._errorListener = (event) => {
+      this.config.logger?.error(event.detail);
+      this.dispatchEvent(event);
+    };
   }
   async connect() {
     if (this.status !== "disconnected") {
@@ -11410,6 +11594,8 @@ var Database = class {
     this.status = "connecting";
     try {
       this.executor = await getExecutor(this.config);
+      this.executor.target.addEventListener("error", this._errorListener);
+      await this.executor.connect();
       this.status = "connected";
     } catch (e) {
       this.status = "error";
@@ -11423,6 +11609,9 @@ var Database = class {
     this.status = "disconnecting";
     try {
       await this.getExecutor().disconnect();
+      if (this.executor) {
+        this.executor.target.removeEventListener("error", this._errorListener);
+      }
       this.executor = null;
       this.status = "disconnected";
     } catch (e) {
@@ -11448,15 +11637,15 @@ var Database = class {
     }
   }
   async transaction(transactionCB, logger) {
-    try {
-      await this.query("BEGIN", void 0, logger);
-      const ret = await transactionCB(this, logger);
-      await this.query("COMMIT", void 0, logger);
-      return ret;
-    } catch (e) {
-      await this.query("ROLLBACK", void 0, logger);
-      throw e;
-    }
+    const ret = await this.executor?.transaction(async (transactionExecutor) => {
+      const newDB = new _Database({
+        executor: transactionExecutor
+      });
+      await newDB.connect();
+      const ret2 = await transactionCB(newDB, logger);
+      return ret2;
+    });
+    return ret;
   }
   createDatabase(dbName) {
     return new CreateDatabase(this, dbName);
@@ -11494,12 +11683,12 @@ var Database = class {
 };
 async function getExecutor(config) {
   switch (config.dialect) {
+    case "pg-pool":
+      return await postgresExecutor(config, true);
     case "node:sqlite":
       return await nativeSqlite(config);
     case "pg":
       return await postgresExecutor(config);
-    case "sqlite3":
-      return await sqlite3Executor(config);
     default:
       if (config.executor) {
         const e = config.executor;
@@ -12304,9 +12493,11 @@ var DBManager = class {
       this.options?.logger?.debug("setting up db connection [%s]", config.name);
       this.options?.logger?.trace("creating db connection [%s]", config.name);
       const db = new Database({
+        executor: config.executor,
         dialect: config.dialect ? config.dialect : "node:sqlite",
         storage: config.storage ? config.storage : "./db.sqlite3",
         connectionString: config.url,
+        pool: config.pool,
         logger: this.options?.loggerProvider?.getLogger(`${DB_IDENTIFIER}_${config.name}`)
       });
       this.options?.logger?.trace("connecting db connection [%s]", config.name);
@@ -14133,13 +14324,15 @@ var auth_default = {
       const queryToken = args.req.query[ADMIN_EDITOR_AUTH_QUERY];
       const cookieToken = args.req.cookies[ADMIN_EDITOR_AUTH_COOKIE];
       if (queryToken) {
-        if (typeof queryToken === "string" && (0, import_node_crypto5.timingSafeEqual)(Buffer.from(queryToken), Buffer.from(KEY))) {
+        const queryBuf = Buffer.from(String(queryToken));
+        const keyBuf = Buffer.from(KEY);
+        if (typeof queryToken === "string" && queryBuf.length === keyBuf.length && (0, import_node_crypto5.timingSafeEqual)(queryBuf, keyBuf)) {
           args.res.setCookie(ADMIN_EDITOR_AUTH_COOKIE, KEY, {
-            expires: new Date(Date.now() + 1e3 * 60 * 60 * 24 * 31 * 12 * 500),
+            expires: new Date(Date.now() + 1e3 * 60 * 60 * 24),
             httpOnly: true,
-            //secure: true,
+            //secure: args.req.secure,
+            sameSite: "strict",
             path: "/"
-            //sameSite: "strict"
           });
           args.req.searchParams.delete(ADMIN_EDITOR_AUTH_QUERY);
           const queryString = args.req.searchParams.toString();
@@ -14407,16 +14600,34 @@ function setupExitHandlers(app) {
     }
     process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
   });
-  process.on("SIGTERM", function() {
+  process.on("SIGTERM", async function() {
     app.logger?.info("SIGTERM received");
+    if (app.server) {
+      await Promise.race([
+        app.stop(),
+        new Promise((r) => setTimeout(r, 5e3))
+      ]);
+    }
     process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
   });
-  process.on("SIGHUP", function() {
+  process.on("SIGHUP", async function() {
     app.logger?.info("SIGHUP received");
+    if (app.server) {
+      await Promise.race([
+        app.stop(),
+        new Promise((r) => setTimeout(r, 5e3))
+      ]);
+    }
     process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
   });
-  process.on("SIGINT", function() {
+  process.on("SIGINT", async function() {
     app.logger?.info("SIGINT received");
+    if (app.server) {
+      await Promise.race([
+        app.stop(),
+        new Promise((r) => setTimeout(r, 5e3))
+      ]);
+    }
     process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
   });
 }
@@ -17706,7 +17917,12 @@ var Miqro = class _Miqro {
     if (this.options?.httpRedirect) {
       this.httpsRedirectServer = new App();
       this.httpsRedirectServer.use(async (req, res) => {
-        const hostname = req.headers.host.split(":").length > 1 ? req.headers.host.split(":")[0] : req.headers.host;
+        const hostname = req.headers.host?.split(":")[0] ?? "";
+        const allowed2 = this.options?.allowedRedirectHosts;
+        if (allowed2 && !allowed2.includes(hostname)) {
+          res.writeHead(400).end("Invalid Host header");
+          return;
+        }
         return await res.redirect("https://" + hostname + ":" + this.options.port + req.url);
       });
     }

package/editor/auth.ts

@@ -28,14 +28,15 @@ export default {
       //console.log("\n\nqueryToken[%s] cookieToken[%s] KEY[%s]\n\n", queryToken, cookieToken, KEY);
 
       if (queryToken) {
-        if (typeof queryToken === "string" && timingSafeEqual(Buffer.from(queryToken), Buffer.from(KEY))) {
+        const queryBuf = Buffer.from(String(queryToken));
+        const keyBuf = Buffer.from(KEY);
+        if (typeof queryToken === "string" && queryBuf.length === keyBuf.length && timingSafeEqual(queryBuf, keyBuf)) {
           args.res.setCookie(ADMIN_EDITOR_AUTH_COOKIE, KEY, {
-            expires: new Date(Date.now() + 1000 * 60 * 60 * 24 * 31 * 12 * 500),
+            expires: new Date(Date.now() + 1000 * 60 * 60 * 24),
             httpOnly: true,
-
-            //secure: true,
+            //secure: args.req.secure,
+            sameSite: "strict",
             path: "/",
-            //sameSite: "strict"
           });
           args.req.searchParams.delete(ADMIN_EDITOR_AUTH_QUERY);
           const queryString = args.req.searchParams.toString();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "miqro",
-  "version": "7.3.3",
+  "version": "7.3.5",
   "description": "",
   "type": "module",
   "main": "build/esm/src/lib.js",
@@ -41,12 +41,12 @@
   },
   "dependencies": {
     "postject": "1.0.0-alpha.6",
-    "@miqro/core": "^5.1.1",
+    "@miqro/core": "^5.1.2",
     "@miqro/jsx": "^1.0.2",
     "@miqro/jsx-dom": "^1.0.6",
     "@miqro/jsx-node": "^1.0.9",
     "@miqro/parser": "^2.0.6",
-    "@miqro/query": "^0.0.8",
+    "@miqro/query": "^0.1.0",
     "@miqro/runner": "^2.0.3",
     "@miqro/test": "^0.2.10",
     "@miqro/test-http": "^0.1.4",