spindb 0.37.2 → 0.38.0

package/core/credential-generator.ts

@@ -1,93 +0,0 @@
-/**
- * Credential Generator
- *
- * Generates secure random credentials for Docker exports.
- * Uses Node.js crypto module for cryptographically secure random values.
- */
-
-import { randomBytes } from 'crypto'
-
-// Character sets for password generation
-const LOWERCASE = 'abcdefghijklmnopqrstuvwxyz'
-const UPPERCASE = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'
-const DIGITS = '0123456789'
-// Shell-safe symbols only (no # $ & * ? \ ' " ` ! | ; < > etc.)
-const SYMBOLS = '%+-=@^_'
-
-// Default character set (alphanumeric + shell-safe symbols)
-const DEFAULT_CHARSET = LOWERCASE + UPPERCASE + DIGITS + SYMBOLS
-
-// Alphanumeric only (for systems that don't support special chars)
-const ALPHANUMERIC_CHARSET = LOWERCASE + UPPERCASE + DIGITS
-
-export type PasswordOptions = {
-  // Length of the password (default: 16)
-  length?: number
-  // Use alphanumeric only (no special characters)
-  alphanumericOnly?: boolean
-  // Custom character set to use
-  charset?: string
-}
-
-/**
- * Generate a cryptographically secure random password
- * @param options Password generation options
- * @returns Generated password string
- */
-export function generatePassword(options: PasswordOptions = {}): string {
-  const { length = 16, alphanumericOnly = false, charset } = options
-
-  const chars =
-    charset || (alphanumericOnly ? ALPHANUMERIC_CHARSET : DEFAULT_CHARSET)
-
-  // Generate random bytes
-  const bytes = randomBytes(length)
-
-  // Convert to password characters
-  let password = ''
-  for (let i = 0; i < length; i++) {
-    // Use modulo to map byte to character index
-    // This is slightly biased but acceptable for password generation
-    password += chars[bytes[i] % chars.length]
-  }
-
-  return password
-}
-
-/**
- * Generate a random hex string (for API keys, tokens, etc.)
- * @param byteLength Number of random bytes (output will be 2x this length in hex)
- * @returns Hex string
- */
-export function generateHexToken(byteLength: number = 32): string {
-  return randomBytes(byteLength).toString('hex')
-}
-
-/**
- * Generate a random alphanumeric ID (for container names, etc.)
- * @param length Length of the ID
- * @returns Alphanumeric string
- */
-export function generateId(length: number = 8): string {
-  return generatePassword({ length, alphanumericOnly: true }).toLowerCase()
-}
-
-export type Credentials = {
-  username: string
-  password: string
-}
-
-/**
- * Generate standard credentials for a Docker export
- * Uses alphanumeric only to avoid issues with special characters in:
- * - Connection strings (@ is a separator, % needs URL encoding)
- * - Environment variable parsing (= can cause issues)
- * - SQL/shell commands (quotes, backslashes need escaping)
- * @returns Object with username and password
- */
-export function generateCredentials(): Credentials {
-  return {
-    username: 'spindb',
-    password: generatePassword({ length: 20, alphanumericOnly: true }),
-  }
-}

package/core/credential-manager.ts

@@ -1,259 +0,0 @@
-/**
- * Credential Manager
- *
- * Manages saved database credentials on disk.
- * Credentials are stored as .env files in the container's credentials/ directory.
- */
-
-import { existsSync } from 'fs'
-import { readFile, writeFile, readdir, mkdir, chmod } from 'fs/promises'
-import { join } from 'path'
-import { paths } from '../config/paths'
-import { Engine, type UserCredentials } from '../types'
-import { isValidUsername } from './error-handler'
-
-/**
- * Get the credentials directory for a container.
- */
-function getCredentialsDir(containerName: string, engine: Engine): string {
-  const containerPath = paths.getContainerPath(containerName, { engine })
-  return join(containerPath, 'credentials')
-}
-
-/**
- * Get the credential file path for a specific username.
- * Validates the username to prevent path traversal (same rules as assertValidUsername).
- */
-function getCredentialFilePath(
-  containerName: string,
-  engine: Engine,
-  username: string,
-): string {
-  if (!isValidUsername(username)) {
-    throw new Error(
-      `Invalid username for credential file: "${username}". Must match ^[a-zA-Z][a-zA-Z0-9_]{0,62}$`,
-    )
-  }
-  return join(getCredentialsDir(containerName, engine), `.env.${username}`)
-}
-
-/**
- * Format credentials as .env file content.
- */
-function encodeEnvValue(value: string): string {
-  if (/[\n\r=\\]/.test(value)) {
-    return JSON.stringify(value)
-  }
-  return value
-}
-
-function decodeEnvValue(raw: string): string {
-  if (raw.startsWith('"') && raw.endsWith('"')) {
-    try {
-      return JSON.parse(raw) as string
-    } catch {
-      return raw
-    }
-  }
-  return raw
-}
-
-function formatCredentials(credentials: UserCredentials): string {
-  const lines: string[] = []
-
-  if (credentials.apiKey) {
-    lines.push(`API_KEY_NAME=${encodeEnvValue(credentials.username)}`)
-    lines.push(`API_KEY=${encodeEnvValue(credentials.apiKey)}`)
-    lines.push(`API_URL=${encodeEnvValue(credentials.connectionString)}`)
-  } else {
-    lines.push(`DB_USER=${encodeEnvValue(credentials.username)}`)
-    lines.push(`DB_PASSWORD=${encodeEnvValue(credentials.password)}`)
-    // Extract host and port from the connection string.
-    // Use URL parsing when possible; fall back to a regex targeting host:port.
-    let extractedHost: string | undefined
-    let extractedPort: string | undefined
-    try {
-      const url = new URL(credentials.connectionString)
-      if (url.hostname) {
-        extractedHost = url.hostname
-      }
-      if (url.port) {
-        extractedPort = url.port
-      }
-    } catch {
-      // Not a valid URL (e.g. custom scheme). Use regex targeting host:port segment.
-      const hostPortMatch = credentials.connectionString.match(
-        /@(\[[^\]]+\]|[^:/?#]+):(\d+)(?:\/|$)/,
-      )
-      if (hostPortMatch) {
-        extractedHost = hostPortMatch[1].replace(/^\[|\]$/g, '')
-        extractedPort = hostPortMatch[2]
-      }
-    }
-    lines.push(`DB_HOST=${extractedHost || '127.0.0.1'}`)
-    if (extractedPort) {
-      lines.push(`DB_PORT=${extractedPort}`)
-    }
-    if (credentials.database) {
-      lines.push(`DB_NAME=${encodeEnvValue(credentials.database)}`)
-    }
-    lines.push(`DB_URL=${encodeEnvValue(credentials.connectionString)}`)
-  }
-
-  return lines.join('\n') + '\n'
-}
-
-/**
- * Parse a .env credential file back into UserCredentials.
- */
-function parseCredentialFile(
-  content: string,
-  containerName: string,
-  engine: Engine,
-): UserCredentials {
-  const vars: Record<string, string> = {}
-  for (const line of content.split('\n')) {
-    const trimmed = line.trim()
-    if (!trimmed || trimmed.startsWith('#')) continue
-    const eqIdx = trimmed.indexOf('=')
-    if (eqIdx === -1) continue
-    const key = trimmed.slice(0, eqIdx).trim()
-    const rawValue = trimmed.slice(eqIdx + 1).trim()
-    vars[key] = decodeEnvValue(rawValue)
-  }
-
-  // API key credentials: password is intentionally empty (auth uses API key, not password)
-  if (vars.API_KEY) {
-    if (!vars.API_KEY_NAME || !vars.API_URL) {
-      throw new Error(
-        `Corrupt credential file for container "${containerName}": missing API_KEY_NAME or API_URL`,
-      )
-    }
-    return {
-      username: vars.API_KEY_NAME,
-      password: '', // API-based auth does not use a password
-      connectionString: vars.API_URL,
-      engine,
-      container: containerName,
-      apiKey: vars.API_KEY,
-    }
-  }
-
-  // Empty string DB_PASSWORD is intentionally allowed (some DBs permit passwordless connections)
-  if (!vars.DB_USER || vars.DB_PASSWORD === undefined || !vars.DB_URL) {
-    throw new Error(
-      `Corrupt credential file for container "${containerName}": missing DB_USER, DB_PASSWORD, or DB_URL`,
-    )
-  }
-
-  return {
-    username: vars.DB_USER,
-    password: vars.DB_PASSWORD,
-    connectionString: vars.DB_URL,
-    engine,
-    container: containerName,
-    database: vars.DB_NAME,
-  }
-}
-
-/**
- * Save credentials to disk as a .env file.
- * Creates the credentials/ directory if it doesn't exist.
- * @returns The path to the saved credential file.
- */
-export async function saveCredentials(
-  containerName: string,
-  engine: Engine,
-  credentials: UserCredentials,
-): Promise<string> {
-  const credDir = getCredentialsDir(containerName, engine)
-  if (!existsSync(credDir)) {
-    await mkdir(credDir, { recursive: true, mode: 0o700 })
-  }
-
-  const filePath = getCredentialFilePath(
-    containerName,
-    engine,
-    credentials.username,
-  )
-  await writeFile(filePath, formatCredentials(credentials), {
-    encoding: 'utf-8',
-    mode: 0o600,
-  })
-
-  // POSIX file permissions are no-ops on Windows
-  if (process.platform !== 'win32') {
-    await chmod(credDir, 0o700)
-    await chmod(filePath, 0o600)
-  }
-  return filePath
-}
-
-/**
- * Load credentials for a specific username from disk.
- * Returns null if the credential file doesn't exist.
- */
-export async function loadCredentials(
-  containerName: string,
-  engine: Engine,
-  username: string,
-): Promise<UserCredentials | null> {
-  const filePath = getCredentialFilePath(containerName, engine, username)
-  try {
-    const content = await readFile(filePath, 'utf-8')
-    return parseCredentialFile(content, containerName, engine)
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
-      return null
-    }
-    throw error
-  }
-}
-
-/**
- * List all saved credential usernames for a container.
- * Returns an empty array if no credentials directory exists.
- */
-export async function listCredentials(
-  containerName: string,
-  engine: Engine,
-): Promise<string[]> {
-  const credDir = getCredentialsDir(containerName, engine)
-  if (!existsSync(credDir)) {
-    return []
-  }
-
-  const files = await readdir(credDir)
-  return files
-    .filter((f) => f.startsWith('.env.'))
-    .map((f) => f.slice(5)) // Remove '.env.' prefix
-    .sort()
-}
-
-/**
- * Check if credentials exist for a specific username.
- */
-export function credentialsExist(
-  containerName: string,
-  engine: Engine,
-  username: string,
-): boolean {
-  return existsSync(getCredentialFilePath(containerName, engine, username))
-}
-
-/**
- * Get the default username for a given engine.
- * API key engines use 'search_key' or 'api_key', all others use 'spindb'.
- */
-export function getDefaultUsername(engine: Engine): string {
-  switch (engine) {
-    case Engine.Meilisearch:
-      return 'search_key'
-    case Engine.Qdrant:
-      return 'api_key'
-    case Engine.Weaviate:
-      return 'api_key'
-    default:
-      return 'spindb'
-  }
-}

package/core/dblab-utils.ts

@@ -1,113 +0,0 @@
-import { Engine, type ContainerConfig } from '../types'
-
-/** Pinned dblab version — single source of truth for download URL */
-export const DBLAB_VERSION = '0.34.2'
-
-/** Engines that support dblab (PostgreSQL, MySQL, or SQLite wire protocol) */
-export const DBLAB_ENGINES = new Set([
-  Engine.PostgreSQL,
-  Engine.MySQL,
-  Engine.MariaDB,
-  Engine.CockroachDB,
-  Engine.SQLite,
-  Engine.QuestDB,
-])
-
-/**
- * Get the platform suffix for the dblab download URL.
- * Returns e.g. 'darwin_arm64', 'linux_amd64', 'windows_amd64'
- */
-export function getDblabPlatformSuffix(): string {
-  const platform = process.platform
-  const arch = process.arch
-
-  if (platform === 'darwin' && arch === 'arm64') return 'darwin_arm64'
-  if (platform === 'darwin' && arch === 'x64') return 'darwin_amd64'
-  if (platform === 'linux' && arch === 'arm64') return 'linux_arm64'
-  if (platform === 'linux' && arch === 'x64') return 'linux_amd64'
-  if (platform === 'win32' && arch === 'x64') return 'windows_amd64'
-
-  throw new Error(`Unsupported platform: ${platform} ${arch}`)
-}
-
-/**
- * Build the CLI args array for launching dblab against a container.
- * Uses flag-based approach to avoid MySQL tcp() URL wrapper issues.
- */
-export function getDblabArgs(
-  config: ContainerConfig,
-  database: string,
-): string[] {
-  switch (config.engine) {
-    case Engine.PostgreSQL:
-      return [
-        '--host',
-        '127.0.0.1',
-        '--port',
-        String(config.port),
-        '--user',
-        'postgres',
-        '--db',
-        database,
-        '--driver',
-        'postgres',
-        '--ssl',
-        'disable',
-      ]
-
-    case Engine.MySQL:
-    case Engine.MariaDB:
-      return [
-        '--host',
-        '127.0.0.1',
-        '--port',
-        String(config.port),
-        '--user',
-        'root',
-        '--db',
-        database,
-        '--driver',
-        'mysql',
-      ]
-
-    case Engine.CockroachDB:
-      return [
-        '--host',
-        '127.0.0.1',
-        '--port',
-        String(config.port),
-        '--user',
-        'root',
-        '--db',
-        database,
-        '--driver',
-        'postgres',
-        '--ssl',
-        'disable',
-      ]
-
-    case Engine.QuestDB:
-      return [
-        '--host',
-        '127.0.0.1',
-        '--port',
-        String(config.port),
-        '--user',
-        'admin',
-        '--pass',
-        'quest',
-        '--db',
-        database || 'qdb',
-        '--driver',
-        'postgres',
-        '--ssl',
-        'disable',
-      ]
-
-    case Engine.SQLite:
-      return ['--db', config.database, '--driver', 'sqlite3']
-
-    default:
-      throw new Error(`dblab is not supported for engine: ${config.engine}`)
-  }
-}