planche 0.4.1 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +24 -13
  2. package/dist/index.js +1307 -1101
  3. package/package.json +1 -1
package/README.md CHANGED
@@ -51,7 +51,7 @@ Every option can also be set through an environment variable:
51
51
  | ------------------------- | ---------- | --------------------------------------------------- |
52
52
  | `PLANCHE_PORT` | `--port` | |
53
53
  | `PLANCHE_ADDR` | `--addr` | |
54
- | `PLANCHE_AUTH_TOKEN` | `--token` | Fixed token; the pairing link stays valid across restarts |
54
+ | `PLANCHE_AUTH_TOKEN` | `--token` | Fixed token (16+ characters); the app stays paired across restarts |
55
55
  | `PLANCHE_BODY_LIMIT` | | Max request body, default `50mb` (large SQL scripts) |
56
56
  | `PLANCHE_SQLITE_DIR` | | Only SQLite files inside this directory may be opened |
57
57
  | `PLANCHE_SSH_CONFIG` | `~/.ssh/config` | SSH client config used to resolve jump-host aliases; `none` disables reading it and `~/.ssh/id_*` |
@@ -61,7 +61,7 @@ Every option can also be set through an environment variable:
61
61
  Keep the same token between restarts so the app never needs re-pairing:
62
62
 
63
63
  ```bash
64
- PLANCHE_AUTH_TOKEN=my-secret npx planche
64
+ PLANCHE_AUTH_TOKEN=$(openssl rand -base64 24) npx planche # at least 16 characters
65
65
  ```
66
66
 
67
67
  Run on another port and print the link only:
@@ -88,9 +88,14 @@ database connections open and forwards queries with the matching driver
88
88
  and session variables survive.
89
89
  - **PostgreSQL** — one connection is bound to one database; the "database"
90
90
  you pick in the app is a schema of it and is applied with `SET search_path`.
91
- - **SQLite** — opens a file on your disk by path. Set `PLANCHE_SQLITE_DIR` to
92
- limit which files can be opened. (Small SQLite files can also be opened
93
- directly in the browser without the agent.)
91
+ - **SQLite** — opens a file on your disk by path. By default only files under
92
+ your home directory are allowed, excluding hidden directories (`~/.ssh`, …)
93
+ and `~/Library` / `AppData` (browser cookie stores live there); new files
94
+ must have a `.db` / `.sqlite` / `.sqlite3` extension, and `ATTACH DATABASE`
95
+ is refused. Set `PLANCHE_SQLITE_DIR` to open files elsewhere (then only that
96
+ directory is allowed), `PLANCHE_SQLITE_ATTACH=1` to allow `ATTACH`, and
97
+ `PLANCHE_SQLITE_URI=1` for `file:` URIs. (Small SQLite files can also be
98
+ opened directly in the browser without the agent.)
94
99
  - **SQL Server** — same model as PostgreSQL: the connection is bound to one
95
100
  database and the app's "database" is a schema (`dbo`, ...). `USE` works in
96
101
  the editor because every statement runs on the same session; scripts may
@@ -103,21 +108,27 @@ database connections open and forwards queries with the matching driver
103
108
  tunnel with `ssh2` on a loopback port and points the driver at it. The host
104
109
  may be a `Host` alias from `~/.ssh/config`: `HostName`, `Port`, `User` and
105
110
  `IdentityFile` are applied like the `ssh` command does (`ProxyJump` is not
106
- supported), and with no key given `~/.ssh/id_*` are tried. Unknown
107
- host keys are trusted on first use and recorded in `~/.planche/known_hosts`
108
- (entries in `~/.ssh/known_hosts` are honoured too); a changed key refuses the
111
+ supported), and with no key given `~/.ssh/id_*` are tried. An unknown
112
+ host key is shown in the app (type and SHA256 fingerprint) and the
113
+ connection proceeds only after you accept it; accepted keys are recorded in
114
+ `~/.planche/known_hosts` (plain, pattern and hashed entries in
115
+ `~/.ssh/known_hosts` are honoured too). A changed key refuses the
109
116
  connection until the stale entry is removed.
110
117
 
111
118
  ## Security
112
119
 
113
- - Every request except `GET /health` requires the bearer token.
120
+ - Every request except `GET /health` and `POST /pair` requires the bearer
121
+ token. The pairing link carries a single-use code (valid 10 minutes) that
122
+ the app exchanges for the token, so the token itself never appears in a URL.
123
+ Repeated wrong tokens lock authentication for 30 seconds.
114
124
  - Browser requests are accepted only from the Planche app origin
115
125
  (`https://planche.dev`). Any other `Origin` is refused with `403`, even
116
- with a valid token.
126
+ with a valid token, and requests whose `Host` header is not the loopback
127
+ address are refused (DNS rebinding).
117
128
  - The agent binds to `127.0.0.1` by default, so only the browser on the same
118
- machine can reach it. Binding to another address (`--addr 0.0.0.0`) exposes
119
- your databases to the network — only do that behind a tunnel or firewall you
120
- trust.
129
+ machine can reach it. It speaks plain HTTP, so binding to another address
130
+ requires `--allow-remote` plus an explicit token, and should only be done
131
+ behind a TLS reverse proxy or an SSH port forward.
121
132
  - The agent never stores credentials. They are passed per connection by the
122
133
  app (including SSH passwords and private key contents) and live in memory
123
134
  only while the connection is open. The only thing written to disk is the