mongoku 2.6.0 → 2.7.0-compat

package/src/lib/components/ExplainPanel.svelte

@@ -12,7 +12,9 @@
 
 	// Recursively find index name in the execution plan tree
 	function findIndexInPlan(plan: Record<string, unknown> | undefined): string | null {
-		if (!plan) return null;
+		if (!plan) {
+			return null;
+		}
 
 		// Check if this stage has an index
 		if (plan.indexName) {
@@ -27,21 +29,27 @@
 		// Recursively check inputStage
 		if (plan.inputStage) {
 			const result = findIndexInPlan(plan.inputStage as Record<string, unknown>);
-			if (result) return result;
+			if (result) {
+				return result;
+			}
 		}
 
 		// Check inputStages array (for some aggregation plans)
 		if (Array.isArray(plan.inputStages)) {
 			for (const stage of plan.inputStages) {
 				const result = findIndexInPlan(stage as Record<string, unknown>);
-				if (result) return result;
+				if (result) {
+					return result;
+				}
 			}
 		}
 
 		// Check queryPlan (for some MongoDB versions)
 		if (plan.queryPlan) {
 			const result = findIndexInPlan(plan.queryPlan as Record<string, unknown>);
-			if (result) return result;
+			if (result) {
+				return result;
+			}
 		}
 
 		return null;
@@ -49,22 +57,32 @@
 
 	// Check if plan contains COLLSCAN (no index used)
 	function hasCollScan(plan: Record<string, unknown> | undefined): boolean {
-		if (!plan) return false;
+		if (!plan) {
+			return false;
+		}
 
-		if (plan.stage === "COLLSCAN") return true;
+		if (plan.stage === "COLLSCAN") {
+			return true;
+		}
 
 		if (plan.inputStage) {
-			if (hasCollScan(plan.inputStage as Record<string, unknown>)) return true;
+			if (hasCollScan(plan.inputStage as Record<string, unknown>)) {
+				return true;
+			}
 		}
 
 		if (Array.isArray(plan.inputStages)) {
 			for (const stage of plan.inputStages) {
-				if (hasCollScan(stage as Record<string, unknown>)) return true;
+				if (hasCollScan(stage as Record<string, unknown>)) {
+					return true;
+				}
 			}
 		}
 
 		if (plan.queryPlan) {
-			if (hasCollScan(plan.queryPlan as Record<string, unknown>)) return true;
+			if (hasCollScan(plan.queryPlan as Record<string, unknown>)) {
+				return true;
+			}
 		}
 
 		return false;
@@ -72,7 +90,9 @@
 
 	// Extract key metrics from explain output
 	const metrics = $derived.by(() => {
-		if (!data || typeof data !== "object") return null;
+		if (!data || typeof data !== "object") {
+			return null;
+		}
 
 		const d = data as Record<string, unknown>;
 		const execStats = d.executionStats as Record<string, unknown> | undefined;
@@ -112,7 +132,9 @@
 	// When index used: nReturned / keysExamined
 	// When COLLSCAN (keysExamined = 0): 0% efficiency
 	const efficiency = $derived.by(() => {
-		if (!metrics) return null;
+		if (!metrics) {
+			return null;
+		}
 		const keysExamined = Number(metrics.keysExamined);
 		const returned = Number(metrics.nReturned);
 
@@ -126,7 +148,9 @@
 
 	// For display
 	const efficiencyLabel = $derived.by(() => {
-		if (!metrics) return "";
+		if (!metrics) {
+			return "";
+		}
 		const keysExamined = Number(metrics.keysExamined);
 		const docsExamined = Number(metrics.docsExamined);
 		const returned = Number(metrics.nReturned);
@@ -139,9 +163,13 @@
 
 	// Determine if the query is efficient
 	const isEfficient = $derived.by(() => {
-		if (!metrics) return null;
+		if (!metrics) {
+			return null;
+		}
 		// COLLSCAN is generally inefficient for large collections
-		if (metrics.indexUsed === "COLLSCAN" || metrics.indexUsed === "N/A") return false;
+		if (metrics.indexUsed === "COLLSCAN" || metrics.indexUsed === "N/A") {
+			return false;
+		}
 		// Has an index - that's good
 		return true;
 	});

package/src/lib/components/JsonValue.svelte

@@ -70,7 +70,9 @@
 	}
 
 	async function handleMouseEnter() {
-		if (!hasMappings || !fetchMappedDocument) return;
+		if (!hasMappings || !fetchMappedDocument) {
+			return;
+		}
 
 		// Clear any pending hide timeout
 		if (hideTooltipTimeout) {
@@ -81,7 +83,9 @@
 		showTooltip = true;
 
 		// If already fetched, don't fetch again
-		if (fetchedDocument || isFetching) return;
+		if (fetchedDocument || isFetching) {
+			return;
+		}
 
 		isFetching = true;
 		fetchError = null;
@@ -126,8 +130,12 @@
 
 	// eslint-disable-next-line @typescript-eslint/no-explicit-any
 	function getValueType(val: any): string {
-		if (val === null) return "null";
-		if (Array.isArray(val)) return "array";
+		if (val === null) {
+			return "null";
+		}
+		if (Array.isArray(val)) {
+			return "array";
+		}
 
 		switch (typeof val) {
 			case "boolean":

package/src/lib/components/PrettyJson.svelte

@@ -36,9 +36,15 @@
 
 	// Helper to get ID value from any type
 	function getIdValue(val: any): string | null {
-		if (val === null || val === undefined) return null;
-		if (typeof val === "string" || typeof val === "number") return String(val);
-		if (val.$type === "ObjectId" && val.$value) return val.$value;
+		if (val === null || val === undefined) {
+			return null;
+		}
+		if (typeof val === "string" || typeof val === "number") {
+			return String(val);
+		}
+		if (val.$type === "ObjectId" && val.$value) {
+			return val.$value;
+		}
 		return null;
 	}
 
@@ -119,7 +125,9 @@
 
 	// Watch for textarea resize and update panel height
 	$effect(() => {
-		if (!textareaRef || !panelRef || !editorVisible) return;
+		if (!textareaRef || !panelRef || !editorVisible) {
+			return;
+		}
 
 		const resizeObserver = new ResizeObserver((entries) => {
 			for (const entry of entries) {

package/src/lib/components/ReplicaSetSelector.svelte

@@ -22,7 +22,9 @@
 
 	// Find the actual primary node by matching the longest common suffix
 	const matchedPrimaryNode = $derived.by(() => {
-		if (!primaryNode || availableNodes.length === 0) return null;
+		if (!primaryNode || availableNodes.length === 0) {
+			return null;
+		}
 		return findBestSuffixMatch(primaryNode, availableNodes);
 	});
 

package/src/lib/components/SearchBox.svelte

@@ -104,7 +104,9 @@
 	$effect(() => {
 		if (showModeDropdown && modeButtonElement) {
 			tick().then(() => {
-				if (!modeButtonElement) return;
+				if (!modeButtonElement) {
+					return;
+				}
 				const rect = modeButtonElement.getBoundingClientRect();
 				dropdownPosition = {
 					left: `${rect.left}px`,
@@ -207,7 +209,9 @@
 	$effect(() => {
 		if (showNewDocsDropdown && newDocsButtonElement) {
 			tick().then(() => {
-				if (!newDocsButtonElement) return;
+				if (!newDocsButtonElement) {
+					return;
+				}
 				const rect = newDocsButtonElement.getBoundingClientRect();
 				newDocsDropdownPosition = {
 					left: `${rect.right - 200}px`,
@@ -219,7 +223,9 @@
 	});
 
 	async function loadStats() {
-		if (!server || !database || !collection || isStatsLoading) return;
+		if (!server || !database || !collection || isStatsLoading) {
+			return;
+		}
 
 		isStatsLoading = true;
 		// Reset all stats to loading state
@@ -252,7 +258,9 @@
 
 	function toggleNewDocsDropdown() {
 		showNewDocsDropdown = !showNewDocsDropdown;
-		if (!showNewDocsDropdown) return;
+		if (!showNewDocsDropdown) {
+			return;
+		}
 
 		// Reload stats if never loaded, or if the query has changed
 		const currentQuery = params.mode === "query" ? params.query : undefined;

package/src/lib/components/Tooltip.svelte

@@ -31,7 +31,7 @@
 	$effect(() => {
 		if (show && tooltipElement && containerElement) {
 			tick().then(() => {
-				if (!containerElement || !tooltipElement) return;
+				if (!containerElement || !tooltipElement) {return;}
 
 				const containerRect = containerElement.getBoundingClientRect();
 				const tooltipRect = tooltipElement.getBoundingClientRect();

package/src/lib/server/HostsManager.ts

@@ -1,3 +1,4 @@
+import { env } from "$env/dynamic/private";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -7,10 +8,8 @@ export interface Host {
 	_id: string;
 }
 
-const DEFAULT_HOSTS = process.env.MONGOKU_DEFAULT_HOST
-	? process.env.MONGOKU_DEFAULT_HOST.split(";")
-	: ["localhost:27017"];
-const DATABASE_FILE = process.env.MONGOKU_DATABASE_FILE || path.join(os.homedir(), ".mongoku.db");
+const DEFAULT_HOSTS = env.MONGOKU_DEFAULT_HOST ? env.MONGOKU_DEFAULT_HOST.split(";") : ["localhost:27017"];
+const DATABASE_FILE = env.MONGOKU_DATABASE_FILE || path.join(os.homedir(), ".mongoku.db");
 
 export class HostsManager {
 	private _hosts: Map<string, string> = new Map(); // path -> _id
@@ -89,20 +88,12 @@ export class HostsManager {
 		return id;
 	}
 
-	async remove(hostPath: string): Promise<void> {
-		// Remove exact matches and regex pattern matches
-		const toRemove = Array.from(this._hosts.keys()).filter((existingPath) => {
-			try {
-				const regex = new RegExp(hostPath);
-				return existingPath === hostPath || regex.test(existingPath);
-			} catch {
-				// If hostPath is not a valid regex, just do exact match
-				return existingPath === hostPath;
+	async removeById(id: string): Promise<void> {
+		for (const [hostPath, hostId] of this._hosts) {
+			if (hostId === id) {
+				this._hosts.delete(hostPath);
+				break;
 			}
-		});
-
-		for (const host of toRemove) {
-			this._hosts.delete(host);
 		}
 		await this._saveToFile();
 	}

package/src/lib/server/logger.ts

@@ -1,3 +1,4 @@
+import { env } from "$env/dynamic/private";
 import { contextStore } from "$lib/server/contextStore";
 import { inspect } from "node:util";
 
@@ -11,10 +12,9 @@ class Logger {
 	private logHeaders: string[];
 
 	constructor() {
-		this.structuredLogging = process.env.MONGOKU_STRUCTURED_LOG === "true";
-		// Parse comma-delimited list of headers to log
-		this.logHeaders = process.env.MONGOKU_LOG_HEADERS
-			? process.env.MONGOKU_LOG_HEADERS.split(",")
+		this.structuredLogging = env.MONGOKU_STRUCTURED_LOG === "true";
+		this.logHeaders = env.MONGOKU_LOG_HEADERS
+			? env.MONGOKU_LOG_HEADERS.split(",")
 					.map((h) => h.trim().toLowerCase())
 					.filter(Boolean)
 			: [];

package/src/lib/server/mongo.ts

@@ -1,3 +1,4 @@
+import { env } from "$env/dynamic/private";
 import { logger } from "$lib/server/logger";
 import type { CollectionJSON, CollectionMappings, Mappings } from "$lib/types";
 import { resolveSrv } from "dns/promises";
@@ -200,17 +201,15 @@ class MongoConnections {
 	private clients: Map<string, MongoClientWithMappings> = new Map(); // _id -> MongoClientWithMappings
 	private clientIds: Map<string, string> = new Map(); // hostname -> _id
 	private hostsManager: HostsManager;
-	private countTimeout = parseInt(process.env.MONGOKU_COUNT_TIMEOUT!, 10) || 30_000;
-	private queryTimeout = process.env.MONGOKU_QUERY_TIMEOUT
-		? parseInt(process.env.MONGOKU_QUERY_TIMEOUT, 10)
-		: undefined;
+	private countTimeout = parseInt(env.MONGOKU_COUNT_TIMEOUT!, 10) || 30_000;
+	private queryTimeout = env.MONGOKU_QUERY_TIMEOUT ? parseInt(env.MONGOKU_QUERY_TIMEOUT, 10) : undefined;
 	private excludedDatabases: Set<string>;
 	private readPreference: ReadPreference | undefined;
 
 	constructor() {
 		this.hostsManager = new HostsManager();
 		// Parse MONGOKU_EXCLUDE_DATABASES env var (comma-separated list)
-		const excludeEnv = process.env.MONGOKU_EXCLUDE_DATABASES || "";
+		const excludeEnv = env.MONGOKU_EXCLUDE_DATABASES || "";
 		this.excludedDatabases = new Set(
 			excludeEnv
 				.split(",")
@@ -221,7 +220,7 @@ class MongoConnections {
 		// Parse read preference from env vars
 		// MONGOKU_READ_PREFERENCE: primary, primaryPreferred, secondary, secondaryPreferred, nearest
 		// MONGOKU_READ_PREFERENCE_TAGS: JSON array of tag sets, e.g. [{"nodeType":"ANALYTICS"},{}]
-		const readPrefMode = process.env.MONGOKU_READ_PREFERENCE as
+		const readPrefMode = env.MONGOKU_READ_PREFERENCE as
 			| "primary"
 			| "primaryPreferred"
 			| "secondary"
@@ -231,9 +230,9 @@ class MongoConnections {
 
 		if (readPrefMode) {
 			let tags: Array<Record<string, string>> | undefined;
-			if (process.env.MONGOKU_READ_PREFERENCE_TAGS) {
+			if (env.MONGOKU_READ_PREFERENCE_TAGS) {
 				try {
-					tags = JSON.parse(process.env.MONGOKU_READ_PREFERENCE_TAGS);
+					tags = JSON.parse(env.MONGOKU_READ_PREFERENCE_TAGS);
 				} catch (err) {
 					logger.error("Failed to parse MONGOKU_READ_PREFERENCE_TAGS:", err);
 				}
@@ -321,14 +320,20 @@ class MongoConnections {
 	}
 
 	async removeServer(name: string) {
-		await this.hostsManager.remove(name);
+		const clientKey = this.clientIds.has(name) ? name : `${name}:27017`;
+		const clientId = this.clientIds.get(clientKey);
+		if (!clientId) {
+			throw new Error(`Server not found: ${name}`);
+		}
+
+		await this.hostsManager.removeById(clientId);
 
 		this.clients
-			.get(name)
+			.get(clientId)
 			?.close()
 			.catch((err) => logger.error(`Error closing client ${name}:`, err));
-		this.clients.delete(name);
-		this.clientIds.delete(name);
+		this.clients.delete(clientId);
+		this.clientIds.delete(clientKey);
 	}
 
 	async reconnectClient(id: string) {

package/src/lib/server/oauth.ts

@@ -0,0 +1,276 @@
+import { base } from "$app/paths";
+import { env } from "$env/dynamic/private";
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+
+export interface OAuthConfig {
+	clientId: string;
+	issuerUrl: string;
+	authorizationUrl: string;
+	tokenUrl: string;
+	scopes: string;
+	sessionSecret: string;
+	sessionDuration: number;
+	allowedSubs?: Set<string>;
+}
+
+export interface SessionPayload {
+	sub?: string;
+	name?: string;
+	email?: string;
+	exp: number;
+}
+
+interface OpenIDConfiguration {
+	authorization_endpoint: string;
+	token_endpoint: string;
+}
+
+interface TokenResponse {
+	access_token: string;
+	token_type: string;
+	expires_in?: number;
+	id_token?: string;
+	scope?: string;
+}
+
+const DEFAULT_SESSION_DURATION = 86400;
+export const OAUTH_CIMD_CLIENT_ID = "__CIMD__";
+
+let cachedConfig: OAuthConfig | null | undefined;
+
+function parseSessionDuration(rawDuration: string | undefined): number {
+	if (!rawDuration) {
+		return DEFAULT_SESSION_DURATION;
+	}
+
+	const parsed = Number(rawDuration);
+	if (!Number.isInteger(parsed) || parsed <= 0) {
+		return DEFAULT_SESSION_DURATION;
+	}
+
+	return parsed;
+}
+
+async function fetchOpenIDConfiguration(issuerUrl: string): Promise<OpenIDConfiguration> {
+	const wellKnown = issuerUrl.replace(/\/+$/, "") + "/.well-known/openid-configuration";
+	const response = await fetch(wellKnown);
+
+	if (!response.ok) {
+		throw new Error(`Failed to fetch OpenID configuration from ${wellKnown} (${response.status})`);
+	}
+
+	const config = await response.json();
+
+	if (!config.authorization_endpoint || !config.token_endpoint) {
+		throw new Error(`OpenID configuration at ${wellKnown} is missing required endpoints`);
+	}
+
+	return config;
+}
+
+/**
+ * Returns OAuth config from env vars, or null if not configured.
+ * Fetches the OpenID discovery document on first call and caches the result.
+ * Throws if partially configured (some required vars missing).
+ */
+export async function getOAuthConfig(): Promise<OAuthConfig | null> {
+	if (cachedConfig !== undefined) {
+		return cachedConfig;
+	}
+
+	const clientId = env.MONGOKU_OAUTH_CLIENT_ID;
+	if (!clientId) {
+		cachedConfig = null;
+		return null;
+	}
+
+	const issuerUrl = env.MONGOKU_OAUTH_ISSUER_URL;
+	const sessionSecret = env.MONGOKU_OAUTH_SESSION_SECRET;
+
+	if (!issuerUrl || !sessionSecret) {
+		throw new Error(
+			"OAuth is partially configured. When MONGOKU_OAUTH_CLIENT_ID is set, " +
+				"MONGOKU_OAUTH_ISSUER_URL and MONGOKU_OAUTH_SESSION_SECRET are also required.",
+		);
+	}
+
+	const oidc = await fetchOpenIDConfiguration(issuerUrl);
+
+	const allowedSubsRaw = env.MONGOKU_OAUTH_ALLOWED_SUBS;
+	const allowedSubs = allowedSubsRaw
+		? new Set(
+				allowedSubsRaw
+					.split(",")
+					.map((s) => s.trim())
+					.filter(Boolean),
+			)
+		: undefined;
+
+	cachedConfig = {
+		clientId,
+		issuerUrl,
+		authorizationUrl: oidc.authorization_endpoint,
+		tokenUrl: oidc.token_endpoint,
+		scopes: env.MONGOKU_OAUTH_SCOPES ?? "openid profile email",
+		sessionSecret,
+		sessionDuration: parseSessionDuration(env.MONGOKU_OAUTH_SESSION_DURATION),
+		allowedSubs,
+	};
+
+	return cachedConfig;
+}
+
+function resolveOAuthClientId(config: OAuthConfig, origin: string): string {
+	if (config.clientId !== OAUTH_CIMD_CLIENT_ID) {
+		return config.clientId;
+	}
+
+	return new URL(`${base}/.well-known/cimd.json`, origin).toString();
+}
+
+function base64url(buffer: Buffer): string {
+	return buffer.toString("base64url");
+}
+
+export function generateCodeVerifier(): string {
+	return base64url(randomBytes(64));
+}
+
+export function generateCodeChallenge(verifier: string): string {
+	return base64url(createHash("sha256").update(verifier).digest());
+}
+
+export function generateState(): string {
+	return base64url(randomBytes(32));
+}
+
+export function buildAuthorizationUrl(
+	config: OAuthConfig,
+	origin: string,
+	callbackUrl: string,
+	codeChallenge: string,
+	state: string,
+): string {
+	const url = new URL(config.authorizationUrl);
+	url.searchParams.set("client_id", resolveOAuthClientId(config, origin));
+	url.searchParams.set("response_type", "code");
+	url.searchParams.set("redirect_uri", callbackUrl);
+	url.searchParams.set("scope", config.scopes);
+	url.searchParams.set("state", state);
+	url.searchParams.set("code_challenge", codeChallenge);
+	url.searchParams.set("code_challenge_method", "S256");
+	return url.toString();
+}
+
+export async function exchangeCode(
+	config: OAuthConfig,
+	origin: string,
+	code: string,
+	codeVerifier: string,
+	callbackUrl: string,
+): Promise<TokenResponse> {
+	const body = new URLSearchParams({
+		grant_type: "authorization_code",
+		code,
+		redirect_uri: callbackUrl,
+		client_id: resolveOAuthClientId(config, origin),
+		code_verifier: codeVerifier,
+	});
+
+	const response = await fetch(config.tokenUrl, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: body.toString(),
+	});
+
+	if (!response.ok) {
+		const text = await response.text();
+		throw new Error(`Token exchange failed (${response.status}): ${text}`);
+	}
+
+	return response.json();
+}
+
+/**
+ * Extract user info from an OIDC id_token (JWT) without cryptographic verification.
+ * This is safe because the token was obtained directly from the token endpoint over HTTPS.
+ */
+export function extractUserFromIdToken(idToken: string): { sub?: string; name?: string; email?: string } {
+	try {
+		const parts = idToken.split(".");
+		if (parts.length !== 3) {
+			return {};
+		}
+		const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
+		return {
+			sub: payload.sub,
+			name: payload.name || payload.preferred_username,
+			email: payload.email,
+		};
+	} catch {
+		return {};
+	}
+}
+
+export function createSessionCookie(
+	config: OAuthConfig,
+	user: { sub?: string; name?: string; email?: string },
+): string {
+	const sessionDuration =
+		Number.isInteger(config.sessionDuration) && config.sessionDuration > 0
+			? config.sessionDuration
+			: DEFAULT_SESSION_DURATION;
+
+	const payload: SessionPayload = {
+		...user,
+		exp: Math.floor(Date.now() / 1000) + sessionDuration,
+	};
+	const payloadStr = Buffer.from(JSON.stringify(payload)).toString("base64url");
+	const signature = createHmac("sha256", config.sessionSecret).update(payloadStr).digest("base64url");
+	return `${payloadStr}.${signature}`;
+}
+
+export function verifySession(config: OAuthConfig, cookie: string): SessionPayload | null {
+	const dotIndex = cookie.lastIndexOf(".");
+	if (dotIndex === -1) {
+		return null;
+	}
+
+	const payloadStr = cookie.slice(0, dotIndex);
+	const signature = cookie.slice(dotIndex + 1);
+
+	const expectedSignature = createHmac("sha256", config.sessionSecret).update(payloadStr).digest("base64url");
+
+	const a = Buffer.from(signature);
+	const b = Buffer.from(expectedSignature);
+	if (a.length !== b.length || !timingSafeEqual(a, b)) {
+		return null;
+	}
+
+	try {
+		const payload: SessionPayload = JSON.parse(Buffer.from(payloadStr, "base64url").toString());
+		if (!Number.isFinite(payload.exp)) {
+			return null;
+		}
+		if (payload.exp < Math.floor(Date.now() / 1000)) {
+			return null;
+		}
+		return payload;
+	} catch {
+		return null;
+	}
+}
+
+export function getCallbackUrl(origin: string): string {
+	return `${origin}${base}/auth/callback`;
+}
+
+export function cookieOptions(url: URL, maxAge?: number) {
+	return {
+		httpOnly: true,
+		secure: url.protocol === "https:",
+		sameSite: "lax" as const,
+		path: base || "/",
+		...(maxAge !== undefined && { maxAge }),
+	};
+}

package/src/lib/utils/filters.ts

@@ -1,9 +1,19 @@
 export function formatBytes(bytes: number): string {
-	if (bytes === 0) return "0 B";
-	if (bytes < 1000) return bytes + " B";
-	if (bytes < 1000000) return (bytes / 1000).toFixed(2) + " kB";
-	if (bytes < 1000000000) return (bytes / 1000000).toFixed(2) + " MB";
-	if (bytes < 1000000000000) return (bytes / 1000000000).toFixed(2) + " GB";
+	if (bytes === 0) {
+		return "0 B";
+	}
+	if (bytes < 1000) {
+		return bytes + " B";
+	}
+	if (bytes < 1000000) {
+		return (bytes / 1000).toFixed(2) + " kB";
+	}
+	if (bytes < 1000000000) {
+		return (bytes / 1000000).toFixed(2) + " MB";
+	}
+	if (bytes < 1000000000000) {
+		return (bytes / 1000000000).toFixed(2) + " GB";
+	}
 	return (bytes / 1000000000000).toFixed(2) + " TB";
 }