sqlite-hub 0.17.0 → 1.0.0

package/server/services/sqlite/sqlExecutor.js

@@ -2,6 +2,45 @@ const { ValidationError, mapSqliteError } = require("../../utils/errors");
 const { serializeRows } = require("../../utils/sqliteTypes");
 const { getTableDetail } = require("./introspection");
 
+const DEFAULT_RESULT_ROW_LIMIT = 5000;
+
+function normalizeResultRowLimit(value) {
+  if (value === null || value === false) {
+    return null;
+  }
+
+  const normalized = value === undefined ? DEFAULT_RESULT_ROW_LIMIT : Number(value);
+
+  if (!Number.isInteger(normalized) || normalized < 1) {
+    throw new ValidationError("SQL result row limit must be a positive integer or null.");
+  }
+
+  return normalized;
+}
+
+function readResultRows(prepared, rowLimit) {
+  if (rowLimit === null) {
+    return {
+      rows: prepared.all(),
+      truncated: false,
+    };
+  }
+
+  const rows = [];
+  let truncated = false;
+
+  for (const row of prepared.iterate()) {
+    if (rows.length >= rowLimit) {
+      truncated = true;
+      break;
+    }
+
+    rows.push(row);
+  }
+
+  return { rows, truncated };
+}
+
 function getSerializedMemoryBytes(value) {
   try {
     return Buffer.byteLength(JSON.stringify(value ?? null), "utf8");
@@ -365,6 +404,7 @@ class SqlExecutor {
     const db = this.connectionManager.getActiveDatabase();
     const connection = this.connectionManager.getActiveConnection();
     const statements = splitSqlStatements(sql);
+    const rowLimit = normalizeResultRowLimit(options.maxRows);
 
     if (statements.length === 0) {
       throw new ValidationError("No executable SQL statements were found.");
@@ -386,9 +426,11 @@ class SqlExecutor {
         }
 
         if (prepared.reader) {
-          const rows = prepared.all();
+          const { rows, truncated } = readResultRows(prepared, rowLimit);
           const columnDefinitions = prepared.columns();
-          const serializedRows = serializeRows(rows);
+          const serializedRows = serializeRows(rows, {
+            blobMode: options.blobMode,
+          });
           const editableResult = resolveEditableResult(db, columnDefinitions, serializedRows);
           const columns = columnDefinitions.map((column) => column.name);
           const result = {
@@ -397,6 +439,8 @@ class SqlExecutor {
             keyword,
             kind: "resultSet",
             rowCount: serializedRows.length,
+            truncated,
+            rowLimit,
             columns,
             rows: editableResult?.rows ?? serializedRows,
             editing: editableResult
@@ -463,6 +507,8 @@ class SqlExecutor {
       rows: lastResultSet?.rows ?? [],
       columns: lastResultSet?.columns ?? [],
       editing: lastResultSet?.editing ?? null,
+      truncated: Boolean(lastResultSet?.truncated),
+      rowLimit: lastResultSet ? lastResultSet.rowLimit : null,
       affectedRowCount: totalChanges,
       resultKind: lastResultSet ? "resultSet" : results.at(-1)?.kind ?? "unknown",
     };
@@ -490,6 +536,9 @@ class SqlExecutor {
 }
 
 module.exports = {
+  DEFAULT_RESULT_ROW_LIMIT,
   SqlExecutor,
+  normalizeResultRowLimit,
+  readResultRows,
   splitSqlStatements,
 };

package/server/services/storage/appStateStore.js

@@ -457,6 +457,19 @@ class AppStateStore {
 
       CREATE INDEX IF NOT EXISTS idx_database_documents_database_updated
       ON database_documents(database_key, updated_at DESC, id ASC);
+
+      CREATE TABLE IF NOT EXISTS api_tokens (
+        id TEXT PRIMARY KEY,
+        database_key TEXT NOT NULL,
+        name TEXT NOT NULL,
+        token_hash TEXT NOT NULL UNIQUE,
+        token_prefix TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        last_used_at TEXT
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_api_tokens_database_created
+      ON api_tokens(database_key, created_at DESC, id ASC);
     `);
 
     const recentConnectionColumns = new Set(
@@ -2335,6 +2348,106 @@ class AppStateStore {
     return this.getSettings();
   }
 
+  decorateApiTokenRow(row = {}) {
+    return {
+      id: String(row.id ?? ""),
+      databaseKey: String(row.database_key ?? row.databaseKey ?? ""),
+      name: String(row.name ?? ""),
+      tokenPrefix: String(row.token_prefix ?? row.tokenPrefix ?? ""),
+      createdAt: row.created_at ?? row.createdAt ?? null,
+      lastUsedAt: row.last_used_at ?? row.lastUsedAt ?? null,
+    };
+  }
+
+  listApiTokens(databaseKey) {
+    const normalizedDatabaseKey = normalizeDocumentDatabaseKey(databaseKey);
+
+    return this.db
+      .prepare(
+        `
+          SELECT id, database_key, name, token_prefix, created_at, last_used_at
+          FROM api_tokens
+          WHERE database_key = ?
+          ORDER BY created_at DESC, id ASC
+        `
+      )
+      .all(normalizedDatabaseKey)
+      .map((row) => this.decorateApiTokenRow(row));
+  }
+
+  createApiToken({ databaseKey, name, tokenHash, tokenPrefix }) {
+    const normalizedDatabaseKey = normalizeDocumentDatabaseKey(databaseKey);
+    const id = crypto.randomUUID();
+    const createdAt = new Date().toISOString();
+
+    this.db
+      .prepare(
+        `
+          INSERT INTO api_tokens (
+            id,
+            database_key,
+            name,
+            token_hash,
+            token_prefix,
+            created_at
+          )
+          VALUES (?, ?, ?, ?, ?, ?)
+        `
+      )
+      .run(id, normalizedDatabaseKey, name, tokenHash, tokenPrefix, createdAt);
+
+    return this.listApiTokens(normalizedDatabaseKey).find((token) => token.id === id);
+  }
+
+  findApiTokenByHash(tokenHash) {
+    const normalizedTokenHash = String(tokenHash ?? "").trim();
+
+    if (!normalizedTokenHash) {
+      return null;
+    }
+
+    const row = this.db
+      .prepare(
+        `
+          SELECT id, database_key, name, token_prefix, created_at, last_used_at
+          FROM api_tokens
+          WHERE token_hash = ?
+          LIMIT 1
+        `
+      )
+      .get(normalizedTokenHash);
+
+    return row ? this.decorateApiTokenRow(row) : null;
+  }
+
+  touchApiToken(tokenId) {
+    this.db
+      .prepare("UPDATE api_tokens SET last_used_at = ? WHERE id = ?")
+      .run(new Date().toISOString(), String(tokenId ?? "").trim());
+  }
+
+  deleteApiToken(databaseKey, tokenId) {
+    const normalizedDatabaseKey = normalizeDocumentDatabaseKey(databaseKey);
+    const normalizedTokenId = String(tokenId ?? "").trim();
+
+    if (!normalizedTokenId) {
+      throw new ValidationError("Token id is required.");
+    }
+
+    const result = this.db
+      .prepare("DELETE FROM api_tokens WHERE database_key = ? AND id = ?")
+      .run(normalizedDatabaseKey, normalizedTokenId);
+
+    if (result.changes < 1) {
+      throw new NotFoundError("API token was not found.");
+    }
+
+    return {
+      id: normalizedTokenId,
+      deleted: true,
+    };
+  }
+
   decorateDatabaseDocumentRow(row = {}) {
     return {
       id: String(row.id ?? ""),

package/server/utils/errors.js

@@ -29,6 +29,12 @@ class ConflictError extends AppError {
   }
 }
 
+class AuthenticationError extends AppError {
+  constructor(message = "Authentication required.", options = {}) {
+    super(message, 401, { code: "AUTHENTICATION_REQUIRED", ...options });
+  }
+}
+
 class BusyError extends AppError {
   constructor(message, options = {}) {
     super(message, 423, { code: "SQLITE_BUSY", ...options });
@@ -161,6 +167,7 @@ function errorMiddleware(error, req, res, next) {
 
 module.exports = {
   AppError,
+  AuthenticationError,
   BusyError,
   ConflictError,
   DatabaseRequiredError,

package/server/utils/sqliteTypes.js

@@ -37,7 +37,16 @@ function normalizeDeclaredType(type) {
   return { declaredType, affinity: "NUMERIC" };
 }
 
-function serializeBlob(buffer) {
+function serializeBlob(buffer, options = {}) {
+  if (options.blobMode === "full") {
+    return {
+      __type: "blob",
+      sizeBytes: buffer.length,
+      encoding: "base64",
+      data: buffer.toString("base64"),
+    };
+  }
+
   return {
     __type: "blob",
     sizeBytes: buffer.length,
@@ -46,26 +55,26 @@ function serializeBlob(buffer) {
   };
 }
 
-function serializeSqliteValue(value) {
+function serializeSqliteValue(value, options = {}) {
   if (Buffer.isBuffer(value)) {
-    return serializeBlob(value);
+    return serializeBlob(value, options);
   }
 
   if (value instanceof Uint8Array) {
-    return serializeBlob(Buffer.from(value));
+    return serializeBlob(Buffer.from(value), options);
   }
 
   return value;
 }
 
-function serializeRow(row) {
+function serializeRow(row, options = {}) {
   return Object.fromEntries(
-    Object.entries(row).map(([key, value]) => [key, serializeSqliteValue(value)])
+    Object.entries(row).map(([key, value]) => [key, serializeSqliteValue(value, options)])
   );
 }
 
-function serializeRows(rows) {
-  return rows.map((row) => serializeRow(row));
+function serializeRows(rows, options = {}) {
+  return rows.map((row) => serializeRow(row, options));
 }
 
 function decodeBlobPayload(payload) {

package/tests/api-token-auth.test.js

@@ -0,0 +1,127 @@
+const assert = require("node:assert/strict");
+const express = require("express");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const test = require("node:test");
+
+const { createExternalApiRouter } = require("../server/routes/externalApi");
+const { ApiTokenService } = require("../server/services/apiTokenService");
+const { AppStateStore } = require("../server/services/storage/appStateStore");
+const { errorMiddleware } = require("../server/utils/errors");
+
+function createConnection(id, label, databasePath) {
+  return {
+    id,
+    label,
+    path: databasePath,
+    lastOpenedAt: new Date().toISOString(),
+    lastModifiedAt: new Date().toISOString(),
+    sizeBytes: 0,
+    readOnly: false,
+    logoPath: null,
+  };
+}
+
+async function startApi(t) {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), "sqlite-hub-api-token-"));
+  const store = new AppStateStore(path.join(directory, "state.db"));
+  const databaseA = createConnection("db-a", "Database A", path.join(directory, "a.db"));
+  const databaseB = createConnection("db-b", "Database B", path.join(directory, "b.db"));
+
+  store.upsertRecentConnection(databaseA);
+  store.upsertRecentConnection(databaseB, { makeActive: false });
+
+  const tokenService = new ApiTokenService({ appStateStore: store });
+  const serviceCalls = [];
+  const databaseService = {
+    listTables(databaseId) {
+      serviceCalls.push(databaseId);
+      return [{ name: "companies" }];
+    },
+  };
+  const app = express();
+
+  app.use(express.json());
+  app.use(
+    "/api/v1",
+    createExternalApiRouter({ databaseService, tokenService })
+  );
+  app.use(errorMiddleware);
+
+  const server = await new Promise((resolve) => {
+    const listener = app.listen(0, "127.0.0.1", () => resolve(listener));
+  });
+
+  t.after(async () => {
+    await new Promise((resolve, reject) => {
+      server.close((error) => (error ? reject(error) : resolve()));
+    });
+    store.db.close();
+    fs.rmSync(directory, { recursive: true, force: true });
+  });
+
+  return {
+    baseUrl: `http://127.0.0.1:${server.address().port}/api/v1`,
+    databaseA,
+    databaseB,
+    serviceCalls,
+    store,
+    tokenService,
+  };
+}
+
+test("tokens are hashed, deletable, and isolated per database", async (t) => {
+  const fixture = await startApi(t);
+  const created = fixture.tokenService.createToken(fixture.databaseA.id, "Automation");
+
+  assert.match(created.token, /^shub_[A-Za-z0-9_-]+$/);
+  assert.equal(fixture.tokenService.listTokens(fixture.databaseA.id)[0].token, undefined);
+
+  const stored = fixture.store.db
+    .prepare("SELECT token_hash, token_prefix FROM api_tokens WHERE id = ?")
+    .get(created.id);
+
+  assert.notEqual(stored.token_hash, created.token);
+  assert.equal(stored.token_prefix, created.tokenPrefix);
+  assert.equal(fixture.tokenService.authenticate(fixture.databaseA.id, created.token).id, created.id);
+  assert.throws(
+    () => fixture.tokenService.authenticate(fixture.databaseB.id, created.token),
+    /invalid for this database/
+  );
+
+  const validResponse = await fetch(
+    `${fixture.baseUrl}/databases/${fixture.databaseA.id}/tables`,
+    { headers: { Authorization: `Bearer ${created.token}` } }
+  );
+  const validPayload = await validResponse.json();
+
+  assert.equal(validResponse.status, 200);
+  assert.deepEqual(validPayload.data.items, [{ name: "companies" }]);
+  assert.deepEqual(fixture.serviceCalls, [fixture.databaseA.id]);
+
+  const invalidResponse = await fetch(
+    `${fixture.baseUrl}/databases/${fixture.databaseA.id}/tables`,
+    { headers: { Authorization: "Bearer invalid" } }
+  );
+  assert.equal(invalidResponse.status, 401);
+
+  const missingResponse = await fetch(
+    `${fixture.baseUrl}/databases/${fixture.databaseA.id}/tables`
+  );
+  assert.equal(missingResponse.status, 401);
+
+  const wrongDatabaseResponse = await fetch(
+    `${fixture.baseUrl}/databases/${fixture.databaseB.id}/tables`,
+    { headers: { Authorization: `Bearer ${created.token}` } }
+  );
+  assert.equal(wrongDatabaseResponse.status, 401);
+  assert.deepEqual(fixture.serviceCalls, [fixture.databaseA.id]);
+
+  fixture.tokenService.deleteToken(fixture.databaseA.id, created.id);
+  assert.equal(fixture.tokenService.listTokens(fixture.databaseA.id).length, 0);
+  assert.throws(
+    () => fixture.tokenService.authenticate(fixture.databaseA.id, created.token),
+    /invalid for this database/
+  );
+});

package/tests/cli-service-delegation.test.js

@@ -0,0 +1,43 @@
+const assert = require("node:assert/strict");
+const test = require("node:test");
+
+const { main } = require("../bin/sqlite-hub");
+
+test("CLI delegates database operations to the shared command service", async () => {
+  const calls = [];
+  const connection = {
+    id: "db-one",
+    label: "Database One",
+  };
+  const databaseService = {
+    getDatabase(reference) {
+      calls.push(["getDatabase", reference]);
+      return connection;
+    },
+    listDatabases() {
+      calls.push(["listDatabases"]);
+      return [connection];
+    },
+    listTables(reference) {
+      calls.push(["listTables", reference]);
+      return [{ name: "companies" }];
+    },
+  };
+  const output = [];
+  const originalLog = console.log;
+
+  console.log = (...values) => output.push(values.join(" "));
+
+  try {
+    await main(["--database:Database One", "--tables"], { databaseService });
+  } finally {
+    console.log = originalLog;
+  }
+
+  assert.deepEqual(calls, [
+    ["listDatabases"],
+    ["getDatabase", "Database One"],
+    ["listTables", "db-one"],
+  ]);
+  assert.match(output.join("\n"), /companies/);
+});

package/tests/connections-file-dialog-route.test.js

@@ -0,0 +1,89 @@
+const assert = require("node:assert/strict");
+const express = require("express");
+const test = require("node:test");
+const { createConnectionsRouter } = require("../server/routes/connections");
+const { errorMiddleware } = require("../server/utils/errors");
+
+test("connections route returns the path selected by the native dialog", async () => {
+  const app = express();
+  app.use(express.json());
+  app.use(
+    "/api/connections",
+    createConnectionsRouter({
+      connectionManager: {},
+      importService: {},
+      backupService: {},
+      nativeFileDialogService: {
+        chooseCreateDatabasePath: async () => "/tmp/new-database.sqlite",
+        chooseOpenDatabasePath: async () => "/tmp/existing-database.db",
+      },
+    })
+  );
+  app.use(errorMiddleware);
+
+  const server = await new Promise((resolve) => {
+    const listener = app.listen(0, "127.0.0.1", () => resolve(listener));
+  });
+
+  try {
+    const address = server.address();
+    const response = await fetch(
+      `http://127.0.0.1:${address.port}/api/connections/choose-create-path`,
+      { method: "POST" }
+    );
+    const payload = await response.json();
+
+    assert.equal(response.status, 200);
+    assert.equal(payload.success, true);
+    assert.deepEqual(payload.data, {
+      cancelled: false,
+      path: "/tmp/new-database.sqlite",
+    });
+  } finally {
+    await new Promise((resolve, reject) => {
+      server.close((error) => (error ? reject(error) : resolve()));
+    });
+  }
+});
+
+test("connections route returns the existing database selected by the native dialog", async () => {
+  const app = express();
+  app.use(express.json());
+  app.use(
+    "/api/connections",
+    createConnectionsRouter({
+      connectionManager: {},
+      importService: {},
+      backupService: {},
+      nativeFileDialogService: {
+        chooseCreateDatabasePath: async () => null,
+        chooseOpenDatabasePath: async () => "/tmp/existing-database.db",
+      },
+    })
+  );
+  app.use(errorMiddleware);
+
+  const server = await new Promise((resolve) => {
+    const listener = app.listen(0, "127.0.0.1", () => resolve(listener));
+  });
+
+  try {
+    const address = server.address();
+    const response = await fetch(
+      `http://127.0.0.1:${address.port}/api/connections/choose-open-path`,
+      { method: "POST" }
+    );
+    const payload = await response.json();
+
+    assert.equal(response.status, 200);
+    assert.equal(payload.success, true);
+    assert.deepEqual(payload.data, {
+      cancelled: false,
+      path: "/tmp/existing-database.db",
+    });
+  } finally {
+    await new Promise((resolve, reject) => {
+      server.close((error) => (error ? reject(error) : resolve()));
+    });
+  }
+});

package/tests/copy-column-modal.test.js

@@ -81,3 +81,51 @@ test("modal footer close buttons are not right-aligned", () => {
     /'<div class="[^']*justify-end[^']*pt-2[^']*>'[\s\S]{0,500}?data-action="close-modal"/
   );
 });
+
+test("create database modal offers a native path picker and manual fallback", async () => {
+  const { renderCreateDatabaseForm } = await loadModalModule();
+  const html = renderCreateDatabaseForm({
+    kind: "create-connection",
+    error: null,
+    submitting: false,
+  });
+
+  assert.match(html, /data-action="choose-create-database-path"/);
+  assert.match(html, /data-create-database-path/);
+  assert.match(html, /name="path"/);
+  assert.match(html, /enter an absolute path manually/);
+});
+
+test("open database modal offers a native file picker and manual fallback", async () => {
+  const { renderOpenConnectionForm } = await loadModalModule();
+  const html = renderOpenConnectionForm({
+    kind: "open-connection",
+    error: null,
+    submitting: false,
+  });
+
+  assert.match(html, /data-action="choose-open-database-path"/);
+  assert.match(html, /data-open-database-path/);
+  assert.match(html, /name="path"/);
+  assert.match(html, /enter an absolute path manually/);
+});
+
+test("API token deletion uses the shared confirmation modal", async () => {
+  const { renderDeleteApiTokenForm } = await loadModalModule();
+  const html = renderDeleteApiTokenForm({
+    kind: "delete-api-token",
+    tokenId: "token-one",
+    tokenName: "Automation",
+    tokenPrefix: "shub_example",
+    databaseLabel: "Database One",
+    error: null,
+    submitting: false,
+  });
+
+  assert.match(html, /Delete API token/);
+  assert.match(html, /Automation/);
+  assert.match(html, /Database One/);
+  assert.match(html, /shub_example\.\.\./);
+  assert.match(html, /data-form="delete-api-token-confirm"/);
+  assert.match(html, /Delete Token/);
+});