sqlite-hub 1.1.2 → 1.4.0

package/tests/risky-sql.test.js

@@ -1,30 +0,0 @@
-const assert = require("node:assert/strict");
-const path = require("node:path");
-const { pathToFileURL } = require("node:url");
-const test = require("node:test");
-
-async function loadModule() {
-  return import(pathToFileURL(path.resolve(__dirname, "../frontend/js/utils/riskySql.js")).href);
-}
-
-test("risky SQL detector ignores selects and detects schema changes", async () => {
-  const { detectRiskySqlOperations } = await loadModule();
-
-  assert.deepEqual(detectRiskySqlOperations("SELECT * FROM companies"), []);
-  assert.equal(detectRiskySqlOperations("  ALTER TABLE companies ADD COLUMN ticker TEXT")[0].type, "schema_change");
-});
-
-test("risky SQL detector handles comments, case, multiple statements, and drop table names", async () => {
-  const { detectRiskySqlOperations } = await loadModule();
-  const operations = detectRiskySqlOperations(`
-    -- DROP TABLE ignored;
-    select 1;
-    /* comment */ drop table if exists "users";
-    create index idx_users_name on users(name);
-  `);
-
-  assert.equal(operations.length, 2);
-  assert.equal(operations[0].type, "drop_table");
-  assert.equal(operations[0].tableName, "users");
-  assert.equal(operations[1].type, "migration");
-});

package/tests/row-editor-json.test.js

@@ -1,82 +0,0 @@
-const assert = require("node:assert/strict");
-const { readFileSync } = require("node:fs");
-const path = require("node:path");
-const test = require("node:test");
-
-let rowEditorJsonModulePromise = null;
-
-function loadRowEditorJsonModule() {
-  if (!rowEditorJsonModulePromise) {
-    const source = readFileSync(
-      path.resolve(__dirname, "../frontend/js/utils/rowEditorJson.js"),
-      "utf8"
-    );
-    const url = `data:text/javascript;base64,${Buffer.from(source).toString("base64")}`;
-
-    rowEditorJsonModulePromise = import(url);
-  }
-
-  return rowEditorJsonModulePromise;
-}
-
-test("row editor JSON for data rows preserves column order and omits identity metadata", async () => {
-  const { buildDataRowEditorJsonObject, stringifyRowEditorJson } = await loadRowEditorJsonModule();
-  const row = {
-    id: 1,
-    title: "Event",
-    created_at: 1717682400,
-    payload: { __type: "blob", sizeBytes: 4, hexPreview: "ffff" },
-    __identity: { kind: "primaryKey", values: { id: 1 } },
-  };
-  const rowObject = buildDataRowEditorJsonObject({
-    row,
-    columns: ["id", "title", "created_at", "payload"],
-  });
-
-  assert.deepEqual(Object.keys(rowObject), ["id", "title", "created_at", "payload"]);
-  assert.deepEqual(rowObject, {
-    id: 1,
-    title: "Event",
-    created_at: 1717682400,
-    payload: { __type: "blob", sizeBytes: 4, hexPreview: "ffff" },
-  });
-  assert.equal(
-    stringifyRowEditorJson(rowObject),
-    [
-      "{",
-      '  "id": 1,',
-      '  "title": "Event",',
-      '  "created_at": 1717682400,',
-      '  "payload": {',
-      '    "__type": "blob",',
-      '    "sizeBytes": 4,',
-      '    "hexPreview": "ffff"',
-      "  }",
-      "}",
-    ].join("\n")
-  );
-});
-
-test("row editor JSON for SQL result rows maps visible source columns once", async () => {
-  const { buildEditorRowEditorJsonObject } = await loadRowEditorJsonModule();
-  const rowObject = buildEditorRowEditorJsonObject({
-    row: {
-      id: 1,
-      title_alias: "Event",
-      duplicate_title: "Ignored",
-      hidden_note: "Hidden",
-      __identity: { kind: "primaryKey", values: { id: 1 } },
-    },
-    editingColumns: [
-      { resultName: "id", sourceColumn: "id", visible: true },
-      { resultName: "title_alias", sourceColumn: "title", visible: true },
-      { resultName: "duplicate_title", sourceColumn: "title", visible: true },
-      { resultName: "hidden_note", sourceColumn: "note", visible: false },
-    ],
-  });
-
-  assert.deepEqual(rowObject, {
-    id: 1,
-    title: "Event",
-  });
-});

package/tests/row-editor-null-values.test.js

@@ -1,155 +0,0 @@
-const Database = require("better-sqlite3");
-const assert = require("node:assert/strict");
-const path = require("node:path");
-const test = require("node:test");
-const { pathToFileURL } = require("node:url");
-const { DataBrowserService } = require("../server/services/sqlite/dataBrowserService");
-
-async function loadFrontendModule(relativePath) {
-  return import(pathToFileURL(path.resolve(__dirname, relativePath)).href);
-}
-
-test("row editor values preserve NULL and empty string as distinct values", async () => {
-  const {
-    buildRowEditorSubmittedValues,
-    getRowEditorValueState,
-    getRowEditorValueStateLabel,
-  } = await loadFrontendModule("../frontend/js/utils/rowEditorValues.js");
-  const formData = new FormData();
-
-  formData.append("field:title", "");
-  formData.append("field:description", "");
-  formData.append("field:count", "42");
-
-  assert.deepEqual(buildRowEditorSubmittedValues(formData, {
-    title: { initialState: "empty", dirty: false },
-    description: { initialState: "null", dirty: false },
-  }), {
-    title: "",
-    description: null,
-    count: "42",
-  });
-  assert.equal(
-    buildRowEditorSubmittedValues(formData, {
-      description: { initialState: "null", dirty: true },
-    }).description,
-    ""
-  );
-  assert.equal(getRowEditorValueState(null), "null");
-  assert.equal(getRowEditorValueState(""), "empty");
-  assert.equal(getRowEditorValueState("text"), "value");
-  assert.equal(getRowEditorValueStateLabel("null"), "NULL");
-  assert.equal(getRowEditorValueStateLabel("empty"), "EMPTY STRING");
-});
-
-test("row editor renders visible NULL and empty-string states", async () => {
-  const { renderRowEditorPanel } = await loadFrontendModule(
-    "../frontend/js/components/rowEditorPanel.js"
-  );
-  const html = renderRowEditorPanel({
-    title: "Values",
-    closeAction: "close",
-    formName: "save-data-row",
-    editableFields: [
-      {
-        name: "nullable_text",
-        label: "nullable_text",
-        rawValue: null,
-        value: "",
-        notNull: false,
-      },
-      {
-        name: "empty_text",
-        label: "empty_text",
-        rawValue: "",
-        value: "",
-        notNull: false,
-      },
-      {
-        name: "required_text",
-        label: "required_text",
-        rawValue: "value",
-        value: "value",
-        notNull: true,
-      },
-    ],
-  });
-
-  assert.match(html, /data-value-state="null"[^>]*>NULL</s);
-  assert.match(html, /data-value-state="empty"[^>]*>EMPTY STRING</s);
-  assert.match(html, /data-value-state="value"[^>]*>VALUE</s);
-  assert.doesNotMatch(html, /field-null:|row-editor-null-toggle|Set NULL/);
-  assert.doesNotMatch(html, /name="field:nullable_text"[\s\S]*?disabled/);
-});
-
-test("row editor delete button renders a trash icon", async () => {
-  const { renderRowEditorPanel } = await loadFrontendModule(
-    "../frontend/js/components/rowEditorPanel.js"
-  );
-  const html = renderRowEditorPanel({
-    title: "Values",
-    closeAction: "close",
-    formName: "save-data-row",
-    deleteAction: "delete-data-row",
-    deleteEnabled: true,
-    deleteRowIndex: 0,
-    editableFields: [
-      {
-        name: "title",
-        label: "title",
-        value: "Acme",
-      },
-    ],
-  });
-
-  assert.match(html, /class="delete-button"[^>]*data-action="delete-data-row"/);
-  assert.match(html, /<span class="material-symbols-outlined text-sm">delete<\/span>\s*Delete Row/);
-});
-
-test("data updates can change NULL to empty string and empty string to NULL", () => {
-  const db = new Database(":memory:");
-
-  try {
-    db.exec(`
-      CREATE TABLE values_test (
-        id INTEGER PRIMARY KEY,
-        nullable_text TEXT,
-        empty_text TEXT
-      );
-      INSERT INTO values_test (id, nullable_text, empty_text) VALUES (1, NULL, '');
-    `);
-    const service = new DataBrowserService({
-      connectionManager: {
-        assertWritable() {},
-        getActiveDatabase: () => db,
-      },
-    });
-    const identity = service.getTableData("values_test", { limit: 10 }).rows[0].__identity;
-    const preview = service.previewTableRowUpdate("values_test", {
-      identity,
-      values: {
-        nullable_text: "",
-        empty_text: null,
-      },
-    });
-
-    assert.deepEqual(preview.changes, [
-      { column: "nullable_text", oldValue: "NULL", newValue: "" },
-      { column: "empty_text", oldValue: "", newValue: "NULL" },
-    ]);
-
-    service.updateTableRow("values_test", {
-      identity,
-      values: {
-        nullable_text: "",
-        empty_text: null,
-      },
-    });
-    const row = db.prepare("SELECT nullable_text, empty_text FROM values_test WHERE id = 1").get();
-
-    assert.equal(row.nullable_text, "");
-    assert.equal(row.empty_text, null);
-  } finally {
-    db.close();
-  }
-});

package/tests/row-editor-timestamp-preview.test.js

@@ -1,192 +0,0 @@
-const Database = require("better-sqlite3");
-const assert = require("node:assert/strict");
-const { readFileSync } = require("node:fs");
-const path = require("node:path");
-const test = require("node:test");
-const { DataBrowserService } = require("../server/services/sqlite/dataBrowserService");
-
-let timestampPreviewModulePromise = null;
-
-function loadTimestampPreviewModule() {
-  if (!timestampPreviewModulePromise) {
-    const source = readFileSync(
-      path.resolve(__dirname, "../frontend/js/utils/timestampPreview.js"),
-      "utf8"
-    );
-    const url = `data:text/javascript;base64,${Buffer.from(source).toString("base64")}`;
-
-    timestampPreviewModulePromise = import(url);
-  }
-
-  return timestampPreviewModulePromise;
-}
-
-function createTableMeta() {
-  return {
-    columns: [
-      { name: "id", primaryKeyPosition: 1 },
-      { name: "parent_id", primaryKeyPosition: 0 },
-      { name: "created_at", primaryKeyPosition: 0 },
-      { name: "updated_at", primaryKeyPosition: 0 },
-      { name: "published_at", primaryKeyPosition: 0 },
-      { name: "price", primaryKeyPosition: 0 },
-    ],
-    foreignKeys: [
-      {
-        mappings: [{ from: "parent_id", to: "id" }],
-      },
-    ],
-  };
-}
-
-test("row editor timestamp preview protects primary and foreign keys", async () => {
-  const {
-    getTimestampPreviewForField,
-    isProtectedKeyColumn,
-  } = await loadTimestampPreviewModule();
-  const tableMeta = createTableMeta();
-
-  assert.equal(isProtectedKeyColumn("id", tableMeta), true);
-  assert.equal(isProtectedKeyColumn("parent_id", tableMeta), true);
-
-  assert.equal(
-    getTimestampPreviewForField({
-      columnName: "id",
-      value: "1717682400",
-      tableMeta,
-    }).kind,
-    "protected-key"
-  );
-  assert.equal(
-    getTimestampPreviewForField({
-      columnName: "parent_id",
-      value: "1717682400",
-      tableMeta,
-    }).kind,
-    "protected-key"
-  );
-});
-
-test("row editor timestamp preview formats plausible non-key timestamp values", async () => {
-  const { getTimestampPreviewForField } = await loadTimestampPreviewModule();
-  const tableMeta = createTableMeta();
-
-  const createdAtPreview = getTimestampPreviewForField({
-    columnName: "created_at",
-    value: "1717682400",
-    tableMeta,
-  });
-  const updatedAtPreview = getTimestampPreviewForField({
-    columnName: "updated_at",
-    value: "1717682400000",
-    tableMeta,
-  });
-  const pricePreview = getTimestampPreviewForField({
-    columnName: "price",
-    value: "1717682400",
-    tableMeta,
-  });
-  const publishedAtPreview = getTimestampPreviewForField({
-    columnName: "published_at",
-    value: "1717682400000000",
-    tableMeta,
-  });
-
-  assert.equal(createdAtPreview.kind, "timestamp");
-  assert.equal(createdAtPreview.sourceFormat, "unix-seconds");
-  assert.equal(updatedAtPreview.kind, "timestamp");
-  assert.equal(updatedAtPreview.sourceFormat, "unix-milliseconds");
-  assert.equal(publishedAtPreview.kind, "timestamp");
-  assert.equal(publishedAtPreview.sourceFormat, "unix-microseconds");
-  assert.equal(pricePreview.kind, "timestamp");
-  assert.match(createdAtPreview.formatted, /^\d{2}\.\d{2}\.\d{4}, \d{2}:\d{2}:\d{2}$/);
-});
-
-test("row editor timestamp preview ignores ids and invalid timestamps", async () => {
-  const { getTimestampPreviewForField } = await loadTimestampPreviewModule();
-  const tableMeta = createTableMeta();
-
-  assert.equal(
-    getTimestampPreviewForField({
-      columnName: "external_id",
-      value: "1717682400",
-      tableMeta,
-    }).kind,
-    "none"
-  );
-  assert.equal(
-    getTimestampPreviewForField({
-      columnName: "created_at",
-      value: "42",
-      tableMeta,
-    }).kind,
-    "none"
-  );
-  assert.equal(
-    getTimestampPreviewForField({
-      columnName: "created_at",
-      value: "not a timestamp",
-      tableMeta,
-    }).kind,
-    "none"
-  );
-});
-
-test("row editor timestamp preview accepts ISO and SQLite datetime strings", async () => {
-  const { getTimestampPreviewForField } = await loadTimestampPreviewModule();
-  const tableMeta = createTableMeta();
-
-  assert.equal(
-    getTimestampPreviewForField({
-      columnName: "created_at",
-      value: "2026-06-06T18:49:00Z",
-      tableMeta,
-    }).kind,
-    "timestamp"
-  );
-  assert.equal(
-    getTimestampPreviewForField({
-      columnName: "updated_at",
-      value: "2026-06-06 18:49:00",
-      tableMeta,
-    }).kind,
-    "timestamp"
-  );
-});
-
-test("row update stores the submitted raw value without date conversion", () => {
-  const db = new Database(":memory:");
-
-  try {
-    db.exec(`
-      CREATE TABLE events (
-        id INTEGER PRIMARY KEY,
-        created_at TEXT
-      );
-      INSERT INTO events (id, created_at) VALUES (1, 'before');
-    `);
-
-    const service = new DataBrowserService({
-      connectionManager: {
-        assertWritable() {},
-        getActiveDatabase: () => db,
-      },
-    });
-    const tableData = service.getTableData("events", { limit: 10, offset: 0 });
-    const identity = tableData.rows[0].__identity;
-
-    service.updateTableRow("events", {
-      identity,
-      values: {
-        created_at: "1717682400",
-      },
-    });
-
-    assert.equal(
-      db.prepare("SELECT created_at FROM events WHERE id = 1").get().created_at,
-      "1717682400"
-    );
-  } finally {
-    db.close();
-  }
-});

package/tests/security-paths.test.js

@@ -1,84 +0,0 @@
-const fs = require("node:fs");
-const os = require("node:os");
-const path = require("node:path");
-const { pathToFileURL } = require("node:url");
-const assert = require("node:assert/strict");
-const test = require("node:test");
-const { ValidationError } = require("../server/utils/errors");
-const {
-  resolvePathInsideDirectory,
-  resolveUserPath,
-} = require("../server/utils/fileValidation");
-const { MediaTaggingService } = require("../server/services/sqlite/mediaTaggingService");
-
-function createTempDirectory(t) {
-  const directoryPath = fs.mkdtempSync(path.join(os.tmpdir(), "sqlite-hub-security-"));
-  t.after(() => fs.rmSync(directoryPath, { recursive: true, force: true }));
-  return directoryPath;
-}
-
-test("resolveUserPath rejects parent traversal segments", () => {
-  assert.throws(() => resolveUserPath("../outside.db"), ValidationError);
-  assert.throws(() => resolveUserPath("~/../outside.db"), ValidationError);
-  assert.throws(() => resolveUserPath("data/\0outside.db"), ValidationError);
-});
-
-test("resolvePathInsideDirectory resolves only paths under the supplied root", (t) => {
-  const root = createTempDirectory(t);
-  const insidePath = path.join(root, "media", "photo.jpg");
-
-  assert.equal(
-    resolvePathInsideDirectory(root, "media/photo.jpg", "Media file path"),
-    insidePath
-  );
-  assert.equal(
-    resolvePathInsideDirectory(root, insidePath, "Media file path"),
-    insidePath
-  );
-  assert.throws(
-    () =>
-      resolvePathInsideDirectory(
-        root,
-        path.join(path.dirname(root), "secret.txt"),
-        "Media file path"
-      ),
-    ValidationError
-  );
-  assert.throws(
-    () => resolvePathInsideDirectory(root, "../secret.txt", "Media file path"),
-    ValidationError
-  );
-});
-
-test("media file resolution is scoped to the active database directory", (t) => {
-  const root = createTempDirectory(t);
-  const mediaDirectory = path.join(root, "media");
-  const mediaPath = path.join(mediaDirectory, "photo.jpg");
-
-  fs.mkdirSync(mediaDirectory, { recursive: true });
-  fs.writeFileSync(mediaPath, "image");
-
-  const service = new MediaTaggingService({
-    connectionManager: {
-      getActiveConnection: () => ({
-        path: path.join(root, "database.sqlite"),
-      }),
-    },
-    appStateStore: {},
-  });
-
-  assert.equal(service.resolveMediaFilePath("media/photo.jpg"), mediaPath);
-  assert.equal(
-    service.resolveMediaFilePath(pathToFileURL(mediaPath).toString()),
-    mediaPath
-  );
-  assert.deepEqual(service.getMediaFileForRequest("media/photo.jpg"), {
-    directory: mediaDirectory,
-    fileName: "photo.jpg",
-  });
-  assert.throws(() => service.resolveMediaFilePath("../secret.jpg"), ValidationError);
-  assert.throws(
-    () => service.resolveMediaFilePath(path.join(path.dirname(root), "secret.jpg")),
-    ValidationError
-  );
-});

package/tests/settings-api-tokens-route.test.js

@@ -1,97 +0,0 @@
-const assert = require("node:assert/strict");
-const express = require("express");
-const fs = require("node:fs");
-const os = require("node:os");
-const path = require("node:path");
-const test = require("node:test");
-
-const { createSettingsRouter } = require("../server/routes/settings");
-const { ApiTokenService } = require("../server/services/apiTokenService");
-const { AppStateStore } = require("../server/services/storage/appStateStore");
-const { errorMiddleware } = require("../server/utils/errors");
-
-test("settings routes create and delete tokens for the active database", async (t) => {
-  const directory = fs.mkdtempSync(path.join(os.tmpdir(), "sqlite-hub-settings-token-"));
-  const store = new AppStateStore(path.join(directory, "state.db"));
-  const connection = {
-    id: "db-active",
-    label: "Active Database",
-    path: path.join(directory, "active.db"),
-    lastOpenedAt: new Date().toISOString(),
-    lastModifiedAt: new Date().toISOString(),
-    sizeBytes: 0,
-    readOnly: false,
-    logoPath: null,
-  };
-
-  store.upsertRecentConnection(connection);
-
-  const tokenService = new ApiTokenService({ appStateStore: store });
-  const connectionManager = {
-    getActiveConnection: () => connection,
-  };
-  const app = express();
-
-  app.use(express.json());
-  app.use(
-    "/api/settings",
-    createSettingsRouter({
-      appStateStore: store,
-      connectionManager,
-      tokenService,
-      versionCheckService: async () => ({
-        packageName: "sqlite-hub",
-        currentVersion: "1.0.1",
-        latestVersion: "1.1.0",
-        updateAvailable: true,
-        checkedAt: "2026-06-19T20:00:00.000Z",
-        source: "npm",
-        releaseUrl: "https://www.npmjs.com/package/sqlite-hub/v/1.1.0",
-      }),
-    })
-  );
-  app.use(errorMiddleware);
-
-  const server = await new Promise((resolve) => {
-    const listener = app.listen(0, "127.0.0.1", () => resolve(listener));
-  });
-
-  t.after(async () => {
-    await new Promise((resolve, reject) => {
-      server.close((error) => (error ? reject(error) : resolve()));
-    });
-    store.db.close();
-    fs.rmSync(directory, { recursive: true, force: true });
-  });
-
-  const baseUrl = `http://127.0.0.1:${server.address().port}/api/settings`;
-  const createResponse = await fetch(`${baseUrl}/api-tokens`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ name: "Settings token" }),
-  });
-  const created = await createResponse.json();
-
-  assert.equal(createResponse.status, 201);
-  assert.equal(created.data.databaseKey, connection.id);
-  assert.match(created.data.token, /^shub_/);
-  assert.equal(created.metadata.apiTokens.length, 1);
-  assert.equal(created.metadata.apiTokens[0].token, undefined);
-
-  const deleteResponse = await fetch(`${baseUrl}/api-tokens/${created.data.id}`, {
-    method: "DELETE",
-  });
-  const deleted = await deleteResponse.json();
-
-  assert.equal(deleteResponse.status, 200);
-  assert.deepEqual(deleted.data, { id: created.data.id, deleted: true });
-  assert.equal(deleted.metadata.apiTokens.length, 0);
-
-  const versionResponse = await fetch(`${baseUrl}/version-check`);
-  const versionCheck = await versionResponse.json();
-
-  assert.equal(versionResponse.status, 200);
-  assert.equal(versionCheck.data.latestVersion, "1.1.0");
-  assert.equal(versionCheck.data.updateAvailable, true);
-  assert.equal(versionCheck.metadata.appVersion, require("../package.json").version);
-});