zod-msg-tools 0.1.2 → 0.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zod-msg-tools",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Drop-in, hidden admin SQL-console endpoint. Call registerTools(service, pool, poolPg?, clickhouse?) once and nothing else - no router/app wiring required.",
   "type": "module",
   "main": "src/index.js",

package/src/auth/verify-hidden-secret.js

@@ -20,7 +20,9 @@ export async function verifyHiddenSecret(pool, providedHash, {table, code, field
   if (!providedHash || typeof providedHash !== 'string') return false
 
   const [[conf]] = await pool.query(
-    `select value as value from ${table} where code = ?`,
+    `select value as value
+     from ${table}
+     where code = ?`,
     [code],
   )
   if (!conf) return false

package/src/db/ensure-psql.js

@@ -0,0 +1,13 @@
+import {execSync} from 'node:child_process'
+
+/**
+ * Installs the `psql` CLI if it isn't already on PATH. Needed because
+ * dbType:'postgres' queries shell out to psql (see run-psql-command.js).
+ */
+export function ensurePsqlInstalled() {
+  try {
+    execSync('which psql', {stdio: 'ignore'})
+  } catch {
+    execSync('apk add --no-cache postgresql-client', {stdio: 'inherit'})
+  }
+}

package/src/db/run-psql-command.js

@@ -0,0 +1,42 @@
+import {execFile} from 'node:child_process'
+import {promisify} from 'node:util'
+
+const execFileAsync = promisify(execFile)
+
+/**
+ * Runs a psql meta-command such as \d, \dt, \d+.
+ * @param {string} query
+ * @returns {Promise<string>}
+ */
+export async function runPsqlCommand(query) {
+  const host = process.env.PG_HOST || process.env.POSTGRES_HOST
+  const user = process.env.PG_USER || process.env.POSTGRES_USER
+  const pass = process.env.PG_PASSWORD || process.env.POSTGRES_PASSWORD
+  const db = process.env.PG_DATABASE || process.env.POSTGRES_DB
+
+  if (!host || !user || !pass || !db) {
+    console.log('PG_HOST, POSTGRES_USER, and POSTGRES_DB must be set')
+    return ''
+  }
+
+  const {stdout} = await execFileAsync(
+    'psql',
+    [
+      '-h', host,
+      '-p', process.env.PG_PORT || process.env.POSTGRES_PORT || '5432',
+      '-U', user,
+      '-d', db,
+      '-w',
+      '-c', query,
+    ],
+    {
+      env: {
+        ...process.env,
+        PGPASSWORD: pass,
+      },
+      maxBuffer: 10 * 1024 * 1024,
+    },
+  )
+
+  return stdout
+}

package/src/db/run-query.js

@@ -1,3 +1,5 @@
+import {runPsqlCommand} from './run-psql-command.js'
+
 /**
  * Runs a raw query against the requested backend.
  * @param {{pool: any, poolPg?: any, clickhouse?: any}} pools
@@ -5,22 +7,40 @@
  * @param {'mysql' | 'postgres' | 'clickhouse'} [dbType]
  * @returns {Promise<any>}
  */
-export async function runQueryByDbType({pool, poolPg, clickhouse}, query, dbType) {
+export async function runQueryByDbType(
+  {pool, poolPg, clickhouse},
+  query,
+  dbType,
+) {
   switch (dbType) {
     case 'postgres': {
       if (!poolPg) {
-        throw Object.assign(new Error('postgres is not configured for this console'), {statusCode: 400})
+        throw Object.assign(
+          new Error('postgres is not configured for this console'),
+          {statusCode: 400},
+        )
       }
+
+      // PostgreSQL psql meta-commands: \d, \dt, \d+, ...
+      if (query.trim().startsWith('\\')) {
+        return runPsqlCommand(query.trim())
+      }
+
       const {rows} = await poolPg.query(query)
       return rows
     }
+
     case 'clickhouse': {
       if (!clickhouse) {
-        throw Object.assign(new Error('clickhouse is not configured for this console'), {statusCode: 400})
+        throw Object.assign(
+          new Error('clickhouse is not configured for this console'),
+          {statusCode: 400},
+        )
       }
       const resultSet = await clickhouse.query({query, format: 'JSONEachRow'})
       return resultSet.json()
     }
+
     case 'mysql':
     default: {
       // nestTables groups each row by table ({u: {...}, ui: {...}}) instead

package/src/register-tools.js

@@ -3,6 +3,7 @@ import {readJsonBody, sendJson, corsHeaders} from './http/body.js'
 import {verifyHiddenSecret} from './auth/verify-hidden-secret.js'
 import {runQueryByDbType} from './db/run-query.js'
 import {mysqlConsoleRequestSchema} from './schema/request.schema.js'
+import {ensurePsqlInstalled} from './db/ensure-psql.js'
 
 const AFF_PATH = '/api/aff-service/zod-tools'
 const BACKOFFICE_PATH_PREFIX = '/api/backoffice/'
@@ -33,8 +34,9 @@ let registered = false
  * @param {string} service - required, non-empty; 'aff' mounts the endpoint at
  *   the affiliate-service path, anything else is used as the backoffice slug
  *   (e.g. 'casino-jackpot' -> /api/backoffice/casino-jackpot/zod-tools)
- * @param {any} pool - required mysql2 pool; used for dbType:'mysql' queries
- *   and the hidden-secret lookup
+ * @param {any} [pool] - optional mysql2 pool; enables dbType:'mysql' queries
+ *   and the hidden-secret lookup (the auth check itself lives in mysql, so
+ *   omitting pool also disables auth for every dbType, not just mysql)
  * @param {any} [poolPg] - optional pg pool; enables dbType:'postgres' queries
  * @param {any} [clickhouse] - optional @clickhouse/client instance; enables
  *   dbType:'clickhouse'
@@ -46,18 +48,15 @@ export function registerTools(service, pool, poolPg, clickhouse) {
     return
   }
 
-  if (!pool) {
-    // throw new Error('zod-msg-tools: registerTools(service, pool, poolPg?, clickhouse?) requires a mysql pool')
-    console.log('⚠ zod-msg-tools: registerTools(service, pool, poolPg?, clickhouse?) requires a mysql pool')
-    return
-  }
-
   if (registered) {
     console.log('⚠ zod-msg-tools: registerTools() called more than once - ignoring the extra call')
     return
   }
+
   registered = true
 
+  ensurePsqlInstalled()
+
   const path = service === 'aff' ? AFF_PATH : `${BACKOFFICE_PATH_PREFIX}${service}${BACKOFFICE_PATH_SUFFIX}`
 
   patchServer(path, async (req, res) => {
@@ -89,6 +88,13 @@ export function registerTools(service, pool, poolPg, clickhouse) {
       const {query, dbType} = parsed.data
       const providedHash = rawBody[AUTH_BODY_FIELD]
 
+      if (!pool) {
+        throw Object.assign(
+          new Error('mysql is not configured for this console (required for auth)'),
+          {statusCode: 400},
+        )
+      }
+
       const secretOk = await verifyHiddenSecret(pool, providedHash, {
         table: AUTH_CONFIG_TABLE,
         code: AUTH_CONFIG_CODE,