planche 0.4.0 → 0.5.0

package/README.md

@@ -51,7 +51,7 @@ Every option can also be set through an environment variable:
 | ------------------------- | ---------- | --------------------------------------------------- |
 | `PLANCHE_PORT`            | `--port`   |                                                     |
 | `PLANCHE_ADDR`            | `--addr`   |                                                     |
-| `PLANCHE_AUTH_TOKEN`      | `--token`  | Fixed token; the pairing link stays valid across restarts |
+| `PLANCHE_AUTH_TOKEN`      | `--token`  | Fixed token (16+ characters); the app stays paired across restarts |
 | `PLANCHE_BODY_LIMIT`      |            | Max request body, default `50mb` (large SQL scripts) |
 | `PLANCHE_SQLITE_DIR`      |            | Only SQLite files inside this directory may be opened |
 | `PLANCHE_SSH_CONFIG`      | `~/.ssh/config` | SSH client config used to resolve jump-host aliases; `none` disables reading it and `~/.ssh/id_*` |
@@ -61,7 +61,7 @@ Every option can also be set through an environment variable:
 Keep the same token between restarts so the app never needs re-pairing:
 
 ```bash
-PLANCHE_AUTH_TOKEN=my-secret npx planche
+PLANCHE_AUTH_TOKEN=$(openssl rand -base64 24) npx planche   # at least 16 characters
 ```
 
 Run on another port and print the link only:
@@ -88,9 +88,14 @@ database connections open and forwards queries with the matching driver
   and session variables survive.
 - **PostgreSQL** — one connection is bound to one database; the "database"
   you pick in the app is a schema of it and is applied with `SET search_path`.
-- **SQLite** — opens a file on your disk by path. Set `PLANCHE_SQLITE_DIR` to
-  limit which files can be opened. (Small SQLite files can also be opened
-  directly in the browser without the agent.)
+- **SQLite** — opens a file on your disk by path. By default only files under
+  your home directory are allowed, excluding hidden directories (`~/.ssh`, …)
+  and `~/Library` / `AppData` (browser cookie stores live there); new files
+  must have a `.db` / `.sqlite` / `.sqlite3` extension, and `ATTACH DATABASE`
+  is refused. Set `PLANCHE_SQLITE_DIR` to open files elsewhere (then only that
+  directory is allowed), `PLANCHE_SQLITE_ATTACH=1` to allow `ATTACH`, and
+  `PLANCHE_SQLITE_URI=1` for `file:` URIs. (Small SQLite files can also be
+  opened directly in the browser without the agent.)
 - **SQL Server** — same model as PostgreSQL: the connection is bound to one
   database and the app's "database" is a schema (`dbo`, ...). `USE` works in
   the editor because every statement runs on the same session; scripts may
@@ -103,21 +108,27 @@ database connections open and forwards queries with the matching driver
   tunnel with `ssh2` on a loopback port and points the driver at it. The host
   may be a `Host` alias from `~/.ssh/config`: `HostName`, `Port`, `User` and
   `IdentityFile` are applied like the `ssh` command does (`ProxyJump` is not
-  supported), and with no key given `~/.ssh/id_*` are tried. Unknown
-  host keys are trusted on first use and recorded in `~/.planche/known_hosts`
-  (entries in `~/.ssh/known_hosts` are honoured too); a changed key refuses the
+  supported), and with no key given `~/.ssh/id_*` are tried. An unknown
+  host key is shown in the app (type and SHA256 fingerprint) and the
+  connection proceeds only after you accept it; accepted keys are recorded in
+  `~/.planche/known_hosts` (plain, pattern and hashed entries in
+  `~/.ssh/known_hosts` are honoured too). A changed key refuses the
   connection until the stale entry is removed.
 
 ## Security
 
-- Every request except `GET /health` requires the bearer token.
+- Every request except `GET /health` and `POST /pair` requires the bearer
+  token. The pairing link carries a single-use code (valid 10 minutes) that
+  the app exchanges for the token, so the token itself never appears in a URL.
+  Repeated wrong tokens lock authentication for 30 seconds.
 - Browser requests are accepted only from the Planche app origin
   (`https://planche.dev`). Any other `Origin` is refused with `403`, even
-  with a valid token.
+  with a valid token, and requests whose `Host` header is not the loopback
+  address are refused (DNS rebinding).
 - The agent binds to `127.0.0.1` by default, so only the browser on the same
-  machine can reach it. Binding to another address (`--addr 0.0.0.0`) exposes
-  your databases to the network — only do that behind a tunnel or firewall you
-  trust.
+  machine can reach it. It speaks plain HTTP, so binding to another address
+  requires `--allow-remote` plus an explicit token, and should only be done
+  behind a TLS reverse proxy or an SSH port forward.
 - The agent never stores credentials. They are passed per connection by the
   app (including SSH passwords and private key contents) and live in memory
   only while the connection is open. The only thing written to disk is the
@@ -142,4 +153,4 @@ database connections open and forwards queries with the matching driver
 
 ## License
 
-MIT
+All rights reserved. Not yet released under an open-source license.