sqlite-hub 0.16.0 → 0.17.2

package/tests/database-documents.test.js

@@ -0,0 +1,85 @@
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const test = require("node:test");
+
+const { AppStateStore } = require("../server/services/storage/appStateStore");
+const { ensureDatabaseDocuments } = require("../server/routes/documents");
+
+function createStore(t) {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), "sqlite-hub-documents-"));
+  const store = new AppStateStore(path.join(directory, "state.db"));
+
+  t.after(() => {
+    store.db.close();
+    fs.rmSync(directory, { recursive: true, force: true });
+  });
+
+  return store;
+}
+
+test("database documents are scoped to one database and normalize filenames", (t) => {
+  const store = createStore(t);
+  const first = store.createDatabaseDocument("db-one", {
+    filename: "../Daily Notes",
+    content: "# Tasks\n\n- [ ] item1",
+  });
+  const second = store.createDatabaseDocument("db-one", {
+    filename: "Daily Notes.md",
+    content: "second",
+  });
+
+  assert.equal(first.filename, "Daily Notes.md");
+  assert.equal(second.filename, "Daily Notes 2.md");
+  assert.equal(store.listDatabaseDocuments("db-one").length, 2);
+  assert.equal(store.listDatabaseDocuments("db-two").length, 0);
+  assert.throws(() => store.getDatabaseDocument("db-two", first.id), /Document was not found/);
+});
+
+test("database document updates preserve raw markdown content", (t) => {
+  const store = createStore(t);
+  const document = store.createDatabaseDocument("db-one", {
+    filename: "todo",
+    content: "- [ ] item1",
+  });
+  const updated = store.updateDatabaseDocument("db-one", document.id, {
+    filename: "todo-renamed",
+    content: "- [x] item1\n1717682400",
+  });
+
+  assert.equal(updated.filename, "todo-renamed.md");
+  assert.equal(updated.content, "- [x] item1\n1717682400");
+
+  const deleted = store.deleteDatabaseDocument("db-one", document.id);
+  assert.deepEqual(deleted, { id: document.id, deleted: true });
+  assert.equal(store.listDatabaseDocuments("db-one").length, 0);
+});
+
+test("document folder creates one initial document for an empty database namespace", (t) => {
+  const store = createStore(t);
+  const connectionManager = {
+    getActiveConnection: () => ({
+      id: "db-one",
+      label: "trump.sqlite",
+      path: "/tmp/trump.sqlite",
+    }),
+  };
+
+  const firstList = ensureDatabaseDocuments({
+    appStateStore: store,
+    connectionManager,
+    databaseKey: "db-one",
+  });
+  const secondList = ensureDatabaseDocuments({
+    appStateStore: store,
+    connectionManager,
+    databaseKey: "db-one",
+  });
+  const document = store.getDatabaseDocument("db-one", firstList[0].id);
+
+  assert.equal(firstList.length, 1);
+  assert.equal(secondList.length, 1);
+  assert.equal(document.filename, "trump.sqlite.md");
+  assert.equal(document.content, "# trump.sqlite\n");
+});

package/tests/export-blob.test.js

@@ -0,0 +1,46 @@
+const Database = require("better-sqlite3");
+const assert = require("node:assert/strict");
+const test = require("node:test");
+const { ExportService } = require("../server/services/sqlite/exportService");
+const { SqlExecutor } = require("../server/services/sqlite/sqlExecutor");
+
+test("query and table exports include complete BLOB data", () => {
+  const db = new Database(":memory:");
+  const blob = Buffer.from(Array.from({ length: 100 }, (_, index) => index));
+
+  try {
+    db.exec("CREATE TABLE files (id INTEGER PRIMARY KEY, payload BLOB)");
+    db.prepare("INSERT INTO files (payload) VALUES (?)").run(blob);
+
+    const connection = { id: "blob-export-test", label: "Blob export" };
+    const connectionManager = {
+      getActiveConnection: () => connection,
+      getActiveDatabase: () => db,
+    };
+    const appStateStore = {
+      findQueryHistoryItemBySql: () => null,
+      getSettings: () => ({ csvDelimiter: "," }),
+      recordQueryExecution: () => 1,
+    };
+    const sqlExecutor = new SqlExecutor({ connectionManager, appStateStore });
+    const exportService = new ExportService({
+      appStateStore,
+      connectionManager,
+      sqlExecutor,
+    });
+    const expectedBase64 = blob.toString("base64");
+    const queryExport = exportService.exportQuery(
+      "SELECT payload FROM files ORDER BY id",
+      { format: "csv" }
+    );
+    const tableExport = exportService.exportTable("files", { format: "tsv" });
+
+    for (const content of [queryExport.content, tableExport.content]) {
+      assert.equal(content.includes(expectedBase64), true);
+      assert.match(content, /""encoding"":""base64""/);
+      assert.doesNotMatch(content, /base64Preview|hexPreview/);
+    }
+  } finally {
+    db.close();
+  }
+});

package/tests/json-preview.test.js

@@ -0,0 +1,49 @@
+const assert = require("node:assert/strict");
+const { readFileSync } = require("node:fs");
+const path = require("node:path");
+const test = require("node:test");
+
+let jsonPreviewModulePromise = null;
+
+function loadJsonPreviewModule() {
+  if (!jsonPreviewModulePromise) {
+    const source = readFileSync(
+      path.resolve(__dirname, "../frontend/js/utils/jsonPreview.js"),
+      "utf8"
+    );
+    const url = `data:text/javascript;base64,${Buffer.from(source).toString("base64")}`;
+
+    jsonPreviewModulePromise = import(url);
+  }
+
+  return jsonPreviewModulePromise;
+}
+
+test("JSON preview formats objects and arrays with line breaks and indentation", async () => {
+  const { formatJsonPreview } = await loadJsonPreviewModule();
+
+  assert.equal(
+    formatJsonPreview('{"event":"created","metadata":{"source":"api"}}'),
+    [
+      "{",
+      '  "event": "created",',
+      '  "metadata": {',
+      '    "source": "api"',
+      "  }",
+      "}",
+    ].join("\n")
+  );
+  assert.equal(
+    formatJsonPreview([1, { active: true }]),
+    ["[", "  1,", "  {", '    "active": true', "  }", "]"].join("\n")
+  );
+});
+
+test("JSON preview ignores invalid JSON and scalar values", async () => {
+  const { formatJsonPreview } = await loadJsonPreviewModule();
+
+  assert.equal(formatJsonPreview("plain text"), null);
+  assert.equal(formatJsonPreview("{invalid"), null);
+  assert.equal(formatJsonPreview("42"), null);
+  assert.equal(formatJsonPreview(null), null);
+});

package/tests/local-request-security.test.js

@@ -0,0 +1,85 @@
+const assert = require("node:assert/strict");
+const test = require("node:test");
+const {
+  LOOPBACK_HOST,
+  listenOnLoopback,
+  localRequestSecurity,
+} = require("../server/middleware/localRequestSecurity");
+
+function runMiddleware({ method = "GET", protocol = "http", headers = {} } = {}) {
+  const normalizedHeaders = Object.fromEntries(
+    Object.entries(headers).map(([name, value]) => [name.toLowerCase(), value])
+  );
+  const req = {
+    method,
+    protocol,
+    get(name) {
+      return normalizedHeaders[String(name).toLowerCase()];
+    },
+  };
+
+  return new Promise((resolve) => {
+    localRequestSecurity(req, {}, (error) => resolve(error ?? null));
+  });
+}
+
+test("server listener binds explicitly to the IPv4 loopback address", () => {
+  let receivedArguments = null;
+  const listener = {};
+  const app = {
+    listen(...args) {
+      receivedArguments = args;
+      return listener;
+    },
+  };
+
+  assert.equal(listenOnLoopback(app, 4173), listener);
+  assert.deepEqual(receivedArguments, [4173, LOOPBACK_HOST]);
+});
+
+test("local API security accepts same-origin browser and CLI requests", async () => {
+  assert.equal(
+    await runMiddleware({
+      method: "POST",
+      headers: {
+        host: "127.0.0.1:4173",
+        origin: "http://127.0.0.1:4173",
+        "sec-fetch-site": "same-origin",
+      },
+    }),
+    null
+  );
+  assert.equal(
+    await runMiddleware({
+      method: "POST",
+      headers: { host: "localhost:4173" },
+    }),
+    null
+  );
+});
+
+test("local API security rejects foreign hosts and cross-origin mutations", async () => {
+  const foreignHostError = await runMiddleware({
+    headers: { host: "example.test:4173" },
+  });
+  const crossOriginError = await runMiddleware({
+    method: "POST",
+    headers: {
+      host: "127.0.0.1:4173",
+      origin: "https://example.test",
+      "sec-fetch-site": "cross-site",
+    },
+  });
+  const wrongSchemeError = await runMiddleware({
+    method: "PATCH",
+    headers: {
+      host: "localhost:4173",
+      origin: "https://localhost:4173",
+    },
+  });
+
+  for (const error of [foreignHostError, crossOriginError, wrongSchemeError]) {
+    assert.equal(error?.statusCode, 403);
+    assert.equal(error?.code, "LOCAL_REQUEST_REQUIRED");
+  }
+});

package/tests/markdown-documents.test.js

@@ -0,0 +1,79 @@
+const assert = require("node:assert/strict");
+const path = require("node:path");
+const { pathToFileURL } = require("node:url");
+const test = require("node:test");
+
+let markdownModulePromise = null;
+
+function loadMarkdownModule() {
+  if (!markdownModulePromise) {
+    markdownModulePromise = import(
+      pathToFileURL(path.resolve(__dirname, "../frontend/js/utils/markdownDocuments.js")).href
+    );
+  }
+
+  return markdownModulePromise;
+}
+
+test("markdown preview renders clickable todo checkboxes with source line indexes", async () => {
+  const { renderMarkdownPreview } = await loadMarkdownModule();
+  const html = renderMarkdownPreview(["# Tasks", "- [ ] item1", "- [x] item2", "```", "- [ ] code", "```"].join("\n"));
+
+  assert.match(html, /document-markdown-task-list/);
+  assert.match(html, /data-action="toggle-document-todo"/);
+  assert.match(html, /data-line-index="1"/);
+  assert.match(html, /data-line-index="2"/);
+  assert.doesNotMatch(html, /data-line-index="4"/);
+});
+
+test("markdown todo toggle updates only real task lines", async () => {
+  const { toggleMarkdownTodoLine } = await loadMarkdownModule();
+  const markdown = ["- [ ] item1", "```", "- [ ] code", "```", "- [x] item2"].join("\n");
+
+  assert.equal(toggleMarkdownTodoLine(markdown, 0).split("\n")[0], "- [x] item1");
+  assert.equal(toggleMarkdownTodoLine(markdown, 2), markdown);
+  assert.equal(toggleMarkdownTodoLine(markdown, 4).split("\n")[4], "- [ ] item2");
+});
+
+test("markdown preview fallback renders unordered and ordered lists", async () => {
+  const { renderMarkdownPreview } = await loadMarkdownModule();
+  const previousMarked = globalThis.marked;
+
+  globalThis.marked = undefined;
+
+  try {
+    const html = renderMarkdownPreview(["- alpha", "- beta", "", "1. first", "2. second"].join("\n"));
+
+    assert.match(html, /<ul><li>alpha<\/li><li>beta<\/li><\/ul>/);
+    assert.match(html, /<ol><li>first<\/li><li>second<\/li><\/ol>/);
+  } finally {
+    globalThis.marked = previousMarked;
+  }
+});
+
+test("markdown preview escapes raw html content", async () => {
+  const { renderMarkdownPreview } = await loadMarkdownModule();
+  const html = renderMarkdownPreview('<img src=x onerror="alert(1)">\n- [ ] <script>alert(1)</script>');
+
+  assert.doesNotMatch(html, /<script>/i);
+  assert.doesNotMatch(html, /<img/i);
+  assert.match(html, /&lt;script&gt;/);
+});
+
+test("markdown preview strips executable link targets from rendered markdown", async () => {
+  const { renderMarkdownPreview } = await loadMarkdownModule();
+  const previousMarked = globalThis.marked;
+
+  globalThis.marked = {
+    parse: () => '<p><a href="javascript:alert(1)">unsafe</a></p>',
+  };
+
+  try {
+    const html = renderMarkdownPreview("[unsafe](javascript:alert(1))");
+
+    assert.doesNotMatch(html, /href="javascript:/i);
+    assert.match(html, /href="#"/);
+  } finally {
+    globalThis.marked = previousMarked;
+  }
+});

package/tests/native-file-dialog.test.js

@@ -0,0 +1,78 @@
+const assert = require("node:assert/strict");
+const test = require("node:test");
+const {
+  NativeFileDialogService,
+  buildDialogAttempts,
+  normalizeSelectedDatabasePath,
+} = require("../server/services/nativeFileDialogService");
+
+test("native database dialog normalizes paths and adds a default extension", () => {
+  assert.equal(normalizeSelectedDatabasePath("/tmp/customer-data"), "/tmp/customer-data.sqlite");
+  assert.equal(normalizeSelectedDatabasePath("/tmp/customer-data.db\n"), "/tmp/customer-data.db");
+  assert.equal(normalizeSelectedDatabasePath(""), null);
+});
+
+test("native database dialog builds platform-specific save commands", () => {
+  const macAttempt = buildDialogAttempts({ platform: "darwin", homeDirectory: "/Users/test" })[0];
+  const windowsAttempt = buildDialogAttempts({ platform: "win32", homeDirectory: "C:\\Users\\test" })[0];
+  const linuxAttempts = buildDialogAttempts({ platform: "linux", homeDirectory: "/home/test" });
+
+  assert.equal(macAttempt.command, "osascript");
+  assert.match(macAttempt.args.join(" "), /choose file name/);
+  assert.equal(windowsAttempt.command, "powershell.exe");
+  assert.match(windowsAttempt.args.at(-1), /SaveFileDialog/);
+  assert.deepEqual(linuxAttempts.map((attempt) => attempt.command), ["zenity", "kdialog"]);
+});
+
+test("native database dialog returns null when the user cancels", async () => {
+  const service = new NativeFileDialogService({
+    platform: "darwin",
+    homeDirectory: "/Users/test",
+    executeFile: async () => {
+      const error = new Error("User canceled.");
+      error.code = 1;
+      throw error;
+    },
+  });
+
+  assert.equal(await service.chooseCreateDatabasePath(), null);
+});
+
+test("native database dialog does not hide macOS script failures as cancellations", async () => {
+  const service = new NativeFileDialogService({
+    platform: "darwin",
+    homeDirectory: "/Users/test",
+    executeFile: async () => {
+      const error = new Error("AppleScript syntax error");
+      error.code = 1;
+      throw error;
+    },
+  });
+
+  await assert.rejects(service.chooseCreateDatabasePath(), (error) => {
+    assert.equal(error.code, "NATIVE_FILE_DIALOG_FAILED");
+    return true;
+  });
+});
+
+test("native database dialog falls back from zenity to kdialog", async () => {
+  const commands = [];
+  const service = new NativeFileDialogService({
+    platform: "linux",
+    homeDirectory: "/home/test",
+    executeFile: async (command) => {
+      commands.push(command);
+
+      if (command === "zenity") {
+        const error = new Error("not found");
+        error.code = "ENOENT";
+        throw error;
+      }
+
+      return { stdout: "/home/test/catalog.sqlite3\n" };
+    },
+  });
+
+  assert.equal(await service.chooseCreateDatabasePath(), "/home/test/catalog.sqlite3");
+  assert.deepEqual(commands, ["zenity", "kdialog"]);
+});

package/tests/query-results-truncation.test.js

@@ -0,0 +1,20 @@
+const assert = require("node:assert/strict");
+const path = require("node:path");
+const test = require("node:test");
+const { pathToFileURL } = require("node:url");
+
+test("query results render an explicit truncation notice", async () => {
+  const moduleUrl = pathToFileURL(
+    path.resolve(__dirname, "../frontend/js/components/queryResults.js")
+  ).href;
+  const { renderQueryResultsPane } = await import(moduleUrl);
+  const html = renderQueryResultsPane({
+    columns: ["id"],
+    rows: [{ id: 1 }, { id: 2 }],
+    truncated: true,
+    rowLimit: 2,
+  });
+
+  assert.match(html, /Showing the first 2 rows/);
+  assert.match(html, /export it to process the complete result set/);
+});

package/tests/row-editor-null-values.test.js

@@ -0,0 +1,131 @@
+const Database = require("better-sqlite3");
+const assert = require("node:assert/strict");
+const path = require("node:path");
+const test = require("node:test");
+const { pathToFileURL } = require("node:url");
+const { DataBrowserService } = require("../server/services/sqlite/dataBrowserService");
+
+async function loadFrontendModule(relativePath) {
+  return import(pathToFileURL(path.resolve(__dirname, relativePath)).href);
+}
+
+test("row editor values preserve NULL and empty string as distinct values", async () => {
+  const {
+    buildRowEditorSubmittedValues,
+    getRowEditorValueState,
+    getRowEditorValueStateLabel,
+  } = await loadFrontendModule("../frontend/js/utils/rowEditorValues.js");
+  const formData = new FormData();
+
+  formData.append("field:title", "");
+  formData.append("field:description", "");
+  formData.append("field:count", "42");
+
+  assert.deepEqual(buildRowEditorSubmittedValues(formData, {
+    title: { initialState: "empty", dirty: false },
+    description: { initialState: "null", dirty: false },
+  }), {
+    title: "",
+    description: null,
+    count: "42",
+  });
+  assert.equal(
+    buildRowEditorSubmittedValues(formData, {
+      description: { initialState: "null", dirty: true },
+    }).description,
+    ""
+  );
+  assert.equal(getRowEditorValueState(null), "null");
+  assert.equal(getRowEditorValueState(""), "empty");
+  assert.equal(getRowEditorValueState("text"), "value");
+  assert.equal(getRowEditorValueStateLabel("null"), "NULL");
+  assert.equal(getRowEditorValueStateLabel("empty"), "EMPTY STRING");
+});
+
+test("row editor renders visible NULL and empty-string states", async () => {
+  const { renderRowEditorPanel } = await loadFrontendModule(
+    "../frontend/js/components/rowEditorPanel.js"
+  );
+  const html = renderRowEditorPanel({
+    title: "Values",
+    closeAction: "close",
+    formName: "save-data-row",
+    editableFields: [
+      {
+        name: "nullable_text",
+        label: "nullable_text",
+        rawValue: null,
+        value: "",
+        notNull: false,
+      },
+      {
+        name: "empty_text",
+        label: "empty_text",
+        rawValue: "",
+        value: "",
+        notNull: false,
+      },
+      {
+        name: "required_text",
+        label: "required_text",
+        rawValue: "value",
+        value: "value",
+        notNull: true,
+      },
+    ],
+  });
+
+  assert.match(html, /data-value-state="null"[^>]*>NULL</s);
+  assert.match(html, /data-value-state="empty"[^>]*>EMPTY STRING</s);
+  assert.match(html, /data-value-state="value"[^>]*>VALUE</s);
+  assert.doesNotMatch(html, /field-null:|row-editor-null-toggle|Set NULL/);
+  assert.doesNotMatch(html, /name="field:nullable_text"[\s\S]*?disabled/);
+});
+
+test("data updates can change NULL to empty string and empty string to NULL", () => {
+  const db = new Database(":memory:");
+
+  try {
+    db.exec(`
+      CREATE TABLE values_test (
+        id INTEGER PRIMARY KEY,
+        nullable_text TEXT,
+        empty_text TEXT
+      );
+      INSERT INTO values_test (id, nullable_text, empty_text) VALUES (1, NULL, '');
+    `);
+    const service = new DataBrowserService({
+      connectionManager: {
+        assertWritable() {},
+        getActiveDatabase: () => db,
+      },
+    });
+    const identity = service.getTableData("values_test", { limit: 10 }).rows[0].__identity;
+    const preview = service.previewTableRowUpdate("values_test", {
+      identity,
+      values: {
+        nullable_text: "",
+        empty_text: null,
+      },
+    });
+
+    assert.deepEqual(preview.changes, [
+      { column: "nullable_text", oldValue: "NULL", newValue: "" },
+      { column: "empty_text", oldValue: "", newValue: "NULL" },
+    ]);
+
+    service.updateTableRow("values_test", {
+      identity,
+      values: {
+        nullable_text: "",
+        empty_text: null,
+      },
+    });
+    const row = db.prepare("SELECT nullable_text, empty_text FROM values_test WHERE id = 1").get();
+
+    assert.equal(row.nullable_text, "");
+    assert.equal(row.empty_text, null);
+  } finally {
+    db.close();
+  }
+});

package/tests/settings-metadata.test.js

@@ -0,0 +1,16 @@
+const assert = require("node:assert/strict");
+const test = require("node:test");
+
+const { version } = require("../package.json");
+const { readSettingsMetadata, readSqliteVersion } = require("../server/routes/settings");
+
+test("settings metadata exposes app and SQLite versions", () => {
+  const metadata = readSettingsMetadata();
+
+  assert.equal(metadata.appVersion, version);
+  assert.match(metadata.sqliteVersion, /^\d+\.\d+\.\d+$/);
+});
+
+test("SQLite runtime version is readable", () => {
+  assert.match(readSqliteVersion(), /^\d+\.\d+\.\d+$/);
+});

package/tests/settings-view.test.js

@@ -0,0 +1,32 @@
+const assert = require("node:assert/strict");
+const path = require("node:path");
+const { pathToFileURL } = require("node:url");
+const test = require("node:test");
+
+let settingsViewModulePromise = null;
+
+function loadSettingsViewModule() {
+  if (!settingsViewModulePromise) {
+    settingsViewModulePromise = import(
+      pathToFileURL(path.resolve(__dirname, "../frontend/js/views/settings.js")).href
+    );
+  }
+
+  return settingsViewModulePromise;
+}
+
+test("settings view shows SQLite runtime version and custom port command", async () => {
+  const { renderSettingsView } = await loadSettingsViewModule();
+  const rendered = renderSettingsView({
+    settings: {
+      loading: false,
+      error: null,
+      appVersion: "1.2.3",
+      sqliteVersion: "3.53.1",
+    },
+  });
+
+  assert.match(rendered.main, /SQLite_Runtime/);
+  assert.match(rendered.main, /3\.53\.1/);
+  assert.match(rendered.main, /sqlite-hub --port:PORT/);
+});

package/tests/sql-identifier-safety.test.js

@@ -114,7 +114,8 @@ test("data browser mutations preserve quoted dynamic identifiers", () => {
         "UPDATE",
         quoteIdentifier(tableName),
         "SET",
-        quoteIdentifier(valueColumn) + " = ?",
+        quoteIdentifier(valueColumn) + " = ?,",
+        quoteIdentifier(noteColumn) + " = ?",
         "WHERE",
         "rowid IS ?",
       ].join(" ")
@@ -125,6 +126,11 @@ test("data browser mutations preserve quoted dynamic identifiers", () => {
         oldValue: "before",
         newValue: "after",
       },
+      {
+        column: noteColumn,
+        oldValue: "NULL",
+        newValue: "",
+      },
     ]);
 
     const updated = service.updateTableRow(tableName, {
@@ -136,7 +142,7 @@ test("data browser mutations preserve quoted dynamic identifiers", () => {
     });
 
     assert.equal(updated.row[valueColumn], "after");
-    assert.equal(updated.row[noteColumn], null);
+    assert.equal(updated.row[noteColumn], "");
     const persistedRow = db.prepare(
       [
         "SELECT",
@@ -148,7 +154,7 @@ test("data browser mutations preserve quoted dynamic identifiers", () => {
     ).get();
 
     assert.equal(persistedRow[valueColumn], "after");
-    assert.equal(persistedRow[noteColumn], null);
+    assert.equal(persistedRow[noteColumn], "");
 
     const deleted = service.deleteTableRow(tableName, {
       identity: updated.row.__identity,