scdb-api 1.0.2

package/index.js

@@ -0,0 +1,593 @@
+import express from 'express';
+import session from 'express-session';
+import path from 'path';
+import fs from 'fs';
+import { fileURLToPath } from 'url';
+import { openDatabase, authenticateUser, authenticateApiKey, canRunSql, auditLog, listTables, tableColumns, hashPassword, verifyPassword, generateApiKey, hashApiKey } from 'scdb-core';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+/**
+ * Create the Secure DB Express app (API + web panel static). Does not call listen().
+ * @param {{
+ *   databasePath?: string;
+ *   sessionSecret?: string;
+ *   staticDir?: string;
+ *   docsDir?: string | null;
+ * }} options - Override env/defaults. staticDir = web panel assets; docsDir = dir with USER_GUIDE.md, ADMIN_GUIDE.md (optional).
+ * @returns {express.Express}
+ */
+export function createApp(options = {}) {
+  const databasePath = options.databasePath ?? process.env.DATABASE_PATH ?? './data/secure-db.sqlite';
+  const sessionSecret = options.sessionSecret ?? process.env.SESSION_SECRET ?? 'change-me';
+  const staticDir = options.staticDir ?? path.join(__dirname, '../web-panel/public');
+  const docsDir = options.docsDir !== undefined ? options.docsDir : null;
+
+  const app = express();
+  app.use(express.json({ limit: '1mb' }));
+  app.set('trust proxy', 1);
+  app.use(
+    session({
+      secret: sessionSecret,
+      resave: false,
+      saveUninitialized: false,
+      cookie: { httpOnly: true, secure: process.env.NODE_ENV === 'production', maxAge: 24 * 60 * 60 * 1000 },
+    })
+  );
+
+  let db = null;
+  async function ensureDb() {
+    if (!db) db = await openDatabase(databasePath);
+    return db;
+  }
+
+  function getAuth(req) {
+    const authHeader = req.headers.authorization;
+    if (authHeader?.startsWith('Bearer ')) {
+      return { type: 'api_key', key: authHeader.slice(7) };
+    }
+    if (req.session?.userId != null) {
+      return { type: 'session', userId: req.session.userId, username: req.session.username, role: req.session.role };
+    }
+    return null;
+  }
+
+  async function authMiddleware(req, res, next) {
+    const d = await ensureDb();
+    const auth = getAuth(req);
+    if (!auth) {
+      return res.status(401).json({ error: 'Unauthorized' });
+    }
+    if (auth.type === 'api_key') {
+      const keyAuth = authenticateApiKey(d, auth.key, PORT);
+      if (!keyAuth) {
+        return res.status(401).json({ error: 'Invalid API key' });
+      }
+      req.auth = {
+        principalType: 'api_key',
+        principalId: keyAuth.id,
+        role: keyAuth.role,
+        name: keyAuth.name,
+      };
+      return next();
+    }
+    req.auth = {
+      principalType: 'user',
+      principalId: req.session.userId,
+      role: req.session.role,
+      name: req.session.username,
+    };
+    next();
+  }
+
+  function normalizeParams(bodyParams) {
+    if (Array.isArray(bodyParams)) return bodyParams;
+    if (bodyParams && typeof bodyParams === 'object' && !Array.isArray(bodyParams)) {
+      return Object.keys(bodyParams)
+        .sort()
+        .map((k) => bodyParams[k]);
+    }
+    return [];
+  }
+
+  app.post('/login', express.json(), async (req, res) => {
+    const d = await ensureDb();
+    const { username, password } = req.body || {};
+    if (!username || !password) {
+      return res.status(400).json({ error: 'Username and password required' });
+    }
+    const user = await authenticateUser(d, username, password);
+    if (!user) {
+      return res.status(401).json({ error: 'Invalid credentials' });
+    }
+    req.session.userId = user.id;
+    req.session.username = user.username;
+    req.session.role = user.role;
+    res.json({ username: user.username, role: user.role });
+  });
+
+  app.post('/logout', (req, res) => {
+    req.session.destroy(() => {
+      res.json({ ok: true });
+    });
+  });
+  app.get('/is-setup', async (req, res) => {
+    const d = await ensureDb();
+    const existing = d.query('SELECT 1 FROM users WHERE role = ? LIMIT 1', ['admin']);
+    res.json({ isSetup: existing.length > 0 });
+  });
+  app.post('/setup', async (req, res) => {
+    const d = await ensureDb();
+    const existing = d.query('SELECT 1 FROM users WHERE role = ? LIMIT 1', ['admin']);
+    if (existing.length > 0) {
+      return res.status(400).json({ error: 'Setup already completed' });
+    }
+    const { username, password } = req.body || {};
+    if (!username || !password || username.length < 2) {
+      return res.status(400).json({ error: 'Username (min 2 chars) and password required' });
+    }
+    const hash = await hashPassword(password);
+    d.execute('INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)', [username, hash, 'admin']);
+    d.save();
+    res.status(201).json({ message: 'Admin user created' });
+  });
+
+  app.get('/me', authMiddleware, (req, res) => {
+    res.json({ principalType: req.auth.principalType, role: req.auth.role, name: req.auth.name });
+  });
+
+  app.get('/health', async (req, res) => {
+    try {
+      await ensureDb();
+      res.json({ ok: true });
+    } catch (e) {
+      res.status(500).json({ ok: false, error: String(e.message) });
+    }
+  });
+
+  app.post('/query', authMiddleware, async (req, res) => {
+    const d = await ensureDb();
+    const { sql, params: bodyParams } = req.body || {};
+    const params = normalizeParams(bodyParams);
+    if (typeof sql !== 'string' || !sql.trim()) {
+      return res.status(400).json({ error: 'Missing or invalid sql' });
+    }
+    const trimmed = sql.trim().toUpperCase();
+    if (!canRunSql(req.auth.role, sql)) {
+      auditLog(d, {
+        principalType: req.auth.principalType,
+        principalId: req.auth.principalId,
+        role: req.auth.role,
+        action: 'query_denied',
+        queryPreview: sql.slice(0, 200),
+        success: false,
+      });
+      d.save();
+      return res.status(403).json({ error: 'Not allowed to run this query (read-only role)' });
+    }
+    if (/^(INSERT|UPDATE|DELETE|CREATE|DROP|ALTER|REPLACE)\s/.test(trimmed)) {
+      return res.status(400).json({ error: 'Use POST /execute for write queries' });
+    }
+    try {
+      const rows = d.query(sql, params);
+      auditLog(d, {
+        principalType: req.auth.principalType,
+        principalId: req.auth.principalId,
+        role: req.auth.role,
+        action: 'query',
+        queryPreview: sql.slice(0, 200),
+        success: true,
+      });
+      d.save();
+      res.json({ rows });
+    } catch (err) {
+      auditLog(d, {
+        principalType: req.auth.principalType,
+        principalId: req.auth.principalId,
+        role: req.auth.role,
+        action: 'query',
+        queryPreview: sql.slice(0, 200),
+        success: false,
+      });
+      d.save();
+      res.status(400).json({ error: err.message, code: 'SQL_ERROR' });
+    }
+  });
+
+  app.post('/execute', authMiddleware, async (req, res) => {
+    const d = await ensureDb();
+    const { sql, params: bodyParams } = req.body || {};
+    const params = normalizeParams(bodyParams);
+    if (typeof sql !== 'string' || !sql.trim()) {
+      return res.status(400).json({ error: 'Missing or invalid sql' });
+    }
+    if (!canRunSql(req.auth.role, sql)) {
+      auditLog(d, {
+        principalType: req.auth.principalType,
+        principalId: req.auth.principalId,
+        role: req.auth.role,
+        action: 'execute_denied',
+        queryPreview: sql.slice(0, 200),
+        success: false,
+      });
+      d.save();
+      return res.status(403).json({ error: 'Not allowed to run this query' });
+    }
+    try {
+      const result = d.execute(sql, params);
+      auditLog(d, {
+        principalType: req.auth.principalType,
+        principalId: req.auth.principalId,
+        role: req.auth.role,
+        action: 'execute',
+        queryPreview: sql.slice(0, 200),
+        success: true,
+      });
+      d.save();
+      res.json(result);
+    } catch (err) {
+      auditLog(d, {
+        principalType: req.auth.principalType,
+        principalId: req.auth.principalId,
+        role: req.auth.role,
+        action: 'execute',
+        queryPreview: sql.slice(0, 200),
+        success: false,
+      });
+      d.save();
+      res.status(400).json({ error: err.message, code: 'SQL_ERROR' });
+    }
+  });
+
+  app.get('/tables', authMiddleware, async (req, res) => {
+    const d = await ensureDb();
+    try {
+      const tables = listTables(d);
+      res.json({ tables: tables.map((t) => t.name) });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.get('/tables/:name', authMiddleware, async (req, res) => {
+    const d = await ensureDb();
+    try {
+      const columns = tableColumns(d, req.params.name);
+      res.json({ columns });
+    } catch (err) {
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  app.get('/audit', authMiddleware, async (req, res) => {
+    if (req.auth.role !== 'admin') {
+      return res.status(403).json({ error: 'Admin only' });
+    }
+    const d = await ensureDb();
+    const limit = Math.min(Number(req.query.limit) || 100, 500);
+    const rows = d.query(
+      'SELECT id, principal_type, principal_id, role, action, query_preview, success, created_at FROM audit_log ORDER BY id DESC LIMIT ?',
+      [limit]
+    );
+    res.json({ rows });
+  });
+
+  app.get('/api-keys', authMiddleware, async (req, res) => {
+    if (req.auth.principalType !== 'user') {
+      return res.status(400).json({ error: 'API keys list is only available for logged-in users' });
+    }
+    const d = await ensureDb();
+    let rows;
+    if (req.auth.role === 'admin') {
+      rows = d.query('SELECT id, name, role, created_at, owner_user_id FROM api_keys ORDER BY id', []);
+    } else {
+      rows = d.query(
+        'SELECT id, name, role, created_at, owner_user_id FROM api_keys WHERE owner_user_id = ? ORDER BY id',
+        [req.auth.principalId]
+      );
+    }
+    res.json({ keys: rows });
+  });
+
+  app.post('/api-keys', authMiddleware, async (req, res) => {
+    if (req.auth.principalType !== 'user') {
+      return res.status(400).json({ error: 'Create API key is only available for logged-in users' });
+    }
+    const d = await ensureDb();
+    const { name, role } = req.body || {};
+    const r = role || 'readwrite';
+    if (!['admin', 'readwrite', 'readonly'].includes(r)) {
+      return res.status(400).json({ error: 'Invalid role' });
+    }
+    if (req.auth.role !== 'admin' && r === 'admin') {
+      return res.status(403).json({ error: 'Only admins can create admin-role API keys' });
+    }
+    const plainKey = generateApiKey(process.env.PORT);
+    const keyHash = hashApiKey(plainKey);
+    const ownerId = req.auth.principalId;
+    d.execute(
+      'INSERT INTO api_keys (key_hash, name, role, owner_user_id) VALUES (?, ?, ?, ?)',
+      [keyHash, name || null, r, ownerId]
+    );
+    d.save();
+    res.status(201).json({ key: plainKey, name: name || null, role: r });
+  });
+
+  app.delete('/api-keys/:id', authMiddleware, async (req, res) => {
+    if (req.auth.principalType !== 'user') {
+      return res.status(400).json({ error: 'Delete API key is only available for logged-in users' });
+    }
+    const id = Number(req.params.id);
+    if (!Number.isInteger(id) || id <= 0) {
+      return res.status(400).json({ error: 'Invalid key id' });
+    }
+    const d = await ensureDb();
+    const rows = d.query('SELECT id, owner_user_id FROM api_keys WHERE id = ?', [id]);
+    if (rows.length === 0) {
+      return res.status(404).json({ error: 'API key not found' });
+    }
+    const key = rows[0];
+    const isAdmin = req.auth.role === 'admin';
+    const isOwner = key.owner_user_id != null && Number(key.owner_user_id) === req.auth.principalId;
+    if (!isAdmin && !isOwner) {
+      return res.status(403).json({ error: 'You can only delete your own API keys' });
+    }
+    d.execute('DELETE FROM api_keys WHERE id = ?', [id]);
+    d.save();
+    res.json({ ok: true });
+  });
+
+  // Admin-only user management
+  app.get('/users', authMiddleware, async (req, res) => {
+    if (req.auth.role !== 'admin') {
+      return res.status(403).json({ error: 'Admin only' });
+    }
+    const d = await ensureDb();
+    try {
+      const rows = d.query('SELECT id, username, role, created_at FROM users ORDER BY id', []);
+      res.json({ users: rows });
+    } catch (err) {
+      if (String(err.message || err).includes('no such column')) {
+        const rows = d.query('SELECT id, username, role FROM users ORDER BY id', []);
+        res.json({ users: rows });
+      } else {
+        res.status(500).json({ error: 'Failed to list users' });
+      }
+    }
+  });
+
+  app.post('/users', authMiddleware, async (req, res) => {
+    if (req.auth.role !== 'admin') {
+      return res.status(403).json({ error: 'Admin only' });
+    }
+    const d = await ensureDb();
+    const { username, password, role } = req.body || {};
+    const r = role || 'readwrite';
+    if (!username || typeof username !== 'string' || username.trim().length < 2) {
+      return res.status(400).json({ error: 'Username (min 2 chars) is required' });
+    }
+    if (!password || typeof password !== 'string' || password.length < 6) {
+      return res.status(400).json({ error: 'Password (min 6 chars) is required' });
+    }
+    if (!['admin', 'readwrite', 'readonly'].includes(r)) {
+      return res.status(400).json({ error: 'Invalid role' });
+    }
+    const existing = d.query('SELECT id FROM users WHERE username = ?', [username.trim()]);
+    if (existing.length > 0) {
+      return res.status(409).json({ error: 'Username already exists' });
+    }
+    const hash = await hashPassword(password);
+    const result = d.execute('INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)', [
+      username.trim(),
+      hash,
+      r,
+    ]);
+    auditLog(d, {
+      principalType: req.auth.principalType,
+      principalId: req.auth.principalId,
+      role: req.auth.role,
+      action: 'user_create',
+      queryPreview: `user:${username.trim()}, role:${r}`,
+      success: true,
+    });
+    d.save();
+    res.status(201).json({ id: result.lastInsertRowid, username: username.trim(), role: r });
+  });
+
+  app.patch('/users/:id', authMiddleware, async (req, res) => {
+    if (req.auth.role !== 'admin') {
+      return res.status(403).json({ error: 'Admin only' });
+    }
+    const id = Number(req.params.id);
+    if (!Number.isInteger(id) || id <= 0) {
+      return res.status(400).json({ error: 'Invalid user id' });
+    }
+    const { role, password } = req.body || {};
+    if (role == null && password == null) {
+      return res.status(400).json({ error: 'Nothing to update' });
+    }
+    const d = await ensureDb();
+    const rows = d.query('SELECT id, username, role FROM users WHERE id = ?', [id]);
+    if (rows.length === 0) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+    const user = rows[0];
+
+    let newRole = user.role;
+    if (role != null) {
+      if (!['admin', 'readwrite', 'readonly'].includes(role)) {
+        return res.status(400).json({ error: 'Invalid role' });
+      }
+      if (user.role === 'admin' && role !== 'admin') {
+        const admins = d.query("SELECT COUNT(*) AS c FROM users WHERE role = 'admin'", []);
+        const count = Number(admins[0]?.c ?? admins[0]?.C ?? 0);
+        if (count <= 1) {
+          return res.status(400).json({ error: 'Cannot change role of last admin' });
+        }
+      }
+      newRole = role;
+    }
+
+    let passwordHash = null;
+    if (password != null) {
+      if (typeof password !== 'string' || password.length < 6) {
+        return res.status(400).json({ error: 'Password (min 6 chars) is required' });
+      }
+      passwordHash = await hashPassword(password);
+    }
+
+    if (passwordHash != null && newRole !== user.role) {
+      d.execute('UPDATE users SET password_hash = ?, role = ? WHERE id = ?', [passwordHash, newRole, id]);
+    } else if (passwordHash != null) {
+      d.execute('UPDATE users SET password_hash = ? WHERE id = ?', [passwordHash, id]);
+    } else if (newRole !== user.role) {
+      d.execute('UPDATE users SET role = ? WHERE id = ?', [newRole, id]);
+    }
+
+    auditLog(d, {
+      principalType: req.auth.principalType,
+      principalId: req.auth.principalId,
+      role: req.auth.role,
+      action: 'user_update',
+      queryPreview: `userId:${id}, role:${newRole}, password_changed:${password != null}`,
+      success: true,
+    });
+    d.save();
+    res.json({ id, username: user.username, role: newRole });
+  });
+
+  app.delete('/users/:id', authMiddleware, async (req, res) => {
+    if (req.auth.role !== 'admin') {
+      return res.status(403).json({ error: 'Admin only' });
+    }
+    const id = Number(req.params.id);
+    if (!Number.isInteger(id) || id <= 0) {
+      return res.status(400).json({ error: 'Invalid user id' });
+    }
+    const d = await ensureDb();
+    const rows = d.query('SELECT id, username, role FROM users WHERE id = ?', [id]);
+    if (rows.length === 0) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+    const user = rows[0];
+    if (user.role === 'admin') {
+      const admins = d.query("SELECT COUNT(*) AS c FROM users WHERE role = 'admin'", []);
+      const count = Number(admins[0]?.c ?? admins[0]?.C ?? 0);
+      if (count <= 1) {
+        return res.status(400).json({ error: 'Cannot delete last admin' });
+      }
+    }
+    d.execute('DELETE FROM users WHERE id = ?', [id]);
+    auditLog(d, {
+      principalType: req.auth.principalType,
+      principalId: req.auth.principalId,
+      role: req.auth.role,
+      action: 'user_delete',
+      queryPreview: `userId:${id}`,
+      success: true,
+    });
+    d.save();
+    res.json({ ok: true });
+  });
+
+  // Profile + docs endpoints
+  app.get('/profile', authMiddleware, async (req, res) => {
+    if (req.auth.principalType !== 'user') {
+      return res.status(400).json({ error: 'Profile is only available for logged-in users' });
+    }
+    const d = await ensureDb();
+    const rows = d.query('SELECT id, username, role, created_at FROM users WHERE id = ?', [req.auth.principalId]);
+    if (rows.length === 0) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+    const user = rows[0];
+    res.json({ id: user.id, username: user.username, role: user.role, created_at: user.created_at });
+  });
+
+  app.post('/profile/password', authMiddleware, async (req, res) => {
+    if (req.auth.principalType !== 'user') {
+      return res.status(400).json({ error: 'Password change is only available for logged-in users' });
+    }
+    const { oldPassword, newPassword } = req.body || {};
+    if (!oldPassword || !newPassword) {
+      return res.status(400).json({ error: 'oldPassword and newPassword are required' });
+    }
+    if (typeof newPassword !== 'string' || newPassword.length < 6) {
+      return res.status(400).json({ error: 'New password must be at least 6 characters' });
+    }
+    const d = await ensureDb();
+    const rows = d.query('SELECT id, username, role, password_hash FROM users WHERE id = ?', [req.auth.principalId]);
+    if (rows.length === 0) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+    const user = rows[0];
+    const ok = await verifyPassword(oldPassword, user.password_hash);
+    if (!ok) {
+      auditLog(d, {
+        principalType: 'user',
+        principalId: req.auth.principalId,
+        role: user.role,
+        action: 'profile_password_change',
+        success: false,
+      });
+      d.save();
+      return res.status(400).json({ error: 'Old password is incorrect' });
+    }
+    const hash = await hashPassword(newPassword);
+    d.execute('UPDATE users SET password_hash = ? WHERE id = ?', [hash, user.id]);
+    auditLog(d, {
+      principalType: 'user',
+      principalId: req.auth.principalId,
+      role: user.role,
+      action: 'profile_password_change',
+      success: true,
+    });
+    d.save();
+    res.json({ ok: true });
+  });
+
+  function readDocFile(name) {
+    const baseDir = docsDir ?? path.join(__dirname, '../../docs');
+    const docPath = path.join(baseDir, name);
+    try {
+      return fs.readFileSync(docPath, 'utf8');
+    } catch (err) {
+      return null;
+    }
+  }
+
+  app.get('/docs/user', authMiddleware, (req, res) => {
+    const content = readDocFile('USER_GUIDE.md');
+    if (!content) {
+      return res.status(404).json({ error: 'Documentation not available' });
+    }
+    res.type('text/plain').send(content);
+  });
+
+  app.get('/docs/admin', authMiddleware, (req, res) => {
+    if (req.auth.role !== 'admin') {
+      return res.status(403).json({ error: 'Admin only' });
+    }
+    const content = readDocFile('ADMIN_GUIDE.md');
+    if (!content) {
+      return res.status(404).json({ error: 'Documentation not available' });
+    }
+    res.type('text/plain').send(content);
+  });
+
+  app.use(express.static(staticDir));
+
+  return app;
+}
+
+// Run as standalone server when this file is executed directly
+const isMain =
+  process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url));
+if (isMain) {
+  const app = createApp({});
+  const PORT = Number(process.env.PORT) || 4406;
+  const HOST = process.env.HOST || '0.0.0.0';
+  app.listen(PORT, HOST, () => {
+    console.log(`API + Panel listening on http://${HOST}:${PORT}`);
+  });
+}

package/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "scdb-api",
+  "version": "1.0.2",
+  "main": "index.js",
+  "type": "module",
+  "scripts": {
+    "start": "node index.js"
+  },
+  "dependencies": {
+    "express": "^4.21.0",
+    "express-session": "^1.18.0",
+    "scdb-core": "1.0.0"
+  }
+}