sqlrooms 0.1.2__tar.gz → 0.1.3__tar.gz

{sqlrooms-0.1.2 → sqlrooms-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sqlrooms
-Version: 0.1.2
+Version: 0.1.3
 Summary: Local-first SQLRooms project launcher for DuckDB worksheets and Mosaic dashboards.
 Project-URL: homepage, https://sqlrooms.com
 Project-URL: repository, https://github.com/sqlrooms/sqlrooms

{sqlrooms-0.1.2 → sqlrooms-0.1.3}/node_modules/sqlrooms-cli-app/README.md

@@ -62,18 +62,15 @@ Before versioning or publishing, test a production build locally:
 pnpm --dir python/sqlrooms build
 
 # Source/workspace check. This should reflect python/sqlrooms/package.json.
-uv run --project python/sqlrooms sqlrooms \
-  --version
+uv run --project python/sqlrooms sqlrooms --version
 
-uv run --project python/sqlrooms sqlrooms \
-  --no-open-browser \
-  /tmp/sqlrooms-smoke.duckdb
+uv run --project python/sqlrooms sqlrooms --no-open-browser --experimental /tmp/sqlrooms-smoke.duckdb
 ```
 
 For the closest local install check, install the freshly built wheel from
 `python/dist` into a `uv tool` environment. Use the exact wheel for the current
 `python/sqlrooms/package.json` version so older files in `python/dist` are not
-selected accidentally:
+selected accidentally. Run these commands from the repository root:
 
 ```bash
 SQLROOMS_VERSION=$(node -p "require('./python/sqlrooms/package.json').version")
@@ -93,8 +90,8 @@ confirm the imported data and workspace state come back.
 2. Version the selected package or packages explicitly:
 
    ```bash
-   pnpm cli:version --target sqlrooms-server --bump patch
-   pnpm cli:version --target sqlrooms --set 0.2.0
+   pnpm cli:version --target sqlrooms --bump patch
+   pnpm cli:version --target sqlrooms-server --set 0.2.0
    pnpm cli:version --target all --bump minor
    ```
 
@@ -102,7 +99,14 @@ confirm the imported data and workspace state come back.
    `sqlrooms-server` is versioned, the workflow also updates the
    `sqlrooms-server>=...` dependency floor in `python/sqlrooms/pyproject.toml`.
 
-3. Run the dry publish workflow for the intended target:
+3. Format the Python CLI packages before running publish checks:
+
+   ```bash
+   uv run --project python/sqlrooms ruff format
+   uv run --project python/sqlrooms ruff check --fix
+   ```
+
+4. Run the dry publish workflow for the intended target:
 
    ```bash
    pnpm cli:publish:dry --target sqlrooms
@@ -111,7 +115,7 @@ confirm the imported data and workspace state come back.
    The dry workflow runs validation and builds the selected package or packages,
    but it does not upload to PyPI.
 
-4. Publish the same target:
+5. Publish the same target:
 
    ```bash
    pnpm cli:publish --target sqlrooms

{sqlrooms-0.1.2 → sqlrooms-0.1.3}/sqlrooms/web/launcher.py

@@ -751,6 +751,33 @@ class SqlroomsHttpServer:
             return None
         return JSONResponse({"error": "unauthorized"}, status_code=401)
 
+    async def _authenticate_duckdb_proxy_websocket(self, client_ws: WebSocket) -> bool:
+        await client_ws.accept()
+
+        query_token = (client_ws.query_params.get("token") or "").strip()
+        if query_token == self.session_token:
+            return True
+
+        try:
+            message = await asyncio.wait_for(client_ws.receive_text(), timeout=5)
+            payload = json.loads(message)
+        except Exception:
+            await client_ws.close(code=1008, reason="unauthorized")
+            return False
+
+        token = payload.get("token") if isinstance(payload, dict) else None
+        if (
+            isinstance(payload, dict)
+            and payload.get("type") == "auth"
+            and token == self.session_token
+        ):
+            await client_ws.send_json({"type": "authAck"})
+            return True
+
+        await client_ws.send_json({"type": "error", "error": "Unauthorized"})
+        await client_ws.close(code=1008, reason="unauthorized")
+        return False
+
     def _build_app(self) -> FastAPI:
         app = FastAPI(title="sqlrooms", version="0.1.0")
         app.add_middleware(
@@ -784,7 +811,9 @@ class SqlroomsHttpServer:
 
         @app.websocket("/ws/duckdb")
         async def duckdb_websocket_proxy(client_ws: WebSocket):
-            await client_ws.accept()
+            if not await self._authenticate_duckdb_proxy_websocket(client_ws):
+                return
+
             try:
                 import websockets
             except ImportError:

sqlrooms-0.1.2/sqlrooms/web/static/assets/index-Dxqv3Ov8.js → sqlrooms-0.1.3/sqlrooms/web/static/assets/index-DSQGFItg.js

@@ -313334,7 +313334,7 @@ Set the 'coep' option to 'require-corp'.`), n?.includes(`/`) || n === `..` || n
         `html-app`,
         `python`,
         `canvas`,
-        `app`
+        `app-builder`
     ], tki = new Set(R9);
     function nki(e) {
         if (!e || typeof e != `object`) return;
@@ -314250,7 +314250,7 @@ export default function App() {
         "html-app": `experimental`,
         python: `experimental`,
         canvas: `experimental`,
-        app: `experimental`
+        "app-builder": `experimental`
     }, Fki = ({ panelInfo: e })=>(0, V.jsx)(`div`, {
             className: `bg-background flex h-full min-h-0 flex-col items-center justify-center p-6 text-center`,
             children: (0, V.jsxs)(`div`, {
@@ -314372,7 +314372,7 @@ export default function App() {
             "html-app": H9(`html-app`, yp(Bki), e),
             python: H9(`python`, yp(Vki), e),
             canvas: H9(`canvas`, r, e),
-            app: H9(`app`, i, e)
+            "app-builder": H9(`app-builder`, i, e)
         });
     }
     var Uki = 2e4, Wki = 250;
@@ -314426,46 +314426,64 @@ export default function App() {
     function nAi(e) {
         return new Promise((t)=>setTimeout(t, e));
     }
-    function rAi(e, t) {
-        return new Promise((n, r)=>{
-            let i = new WebSocket(e), a = !1, o, s = (e)=>{
-                if (!a) {
-                    a = !0, clearTimeout(o), i.onopen = null, i.onerror = null, i.onclose = null;
+    function rAi(e, t, n) {
+        return new Promise((r, i)=>{
+            let a = new WebSocket(e), o = !1, s, c = (e)=>{
+                if (!o) {
+                    o = !0, clearTimeout(s), a.onopen = null, a.onmessage = null, a.onerror = null, a.onclose = null;
                     try {
-                        i.close();
+                        a.close();
                     } catch  {}
-                    e ? r(e) : n();
+                    e ? i(e) : r();
                 }
             };
-            o = setTimeout(()=>{
-                s(Error(`Timed out connecting to DuckDB websocket backend.`));
-            }, t), i.onopen = ()=>s(), i.onerror = ()=>s(Error(`DuckDB websocket connection error.`)), i.onclose = ()=>s(Error(`DuckDB websocket closed before opening.`));
+            s = setTimeout(()=>{
+                c(Error(`Timed out connecting to DuckDB websocket backend.`));
+            }, t), a.onopen = ()=>{
+                if (!n) {
+                    c();
+                    return;
+                }
+                try {
+                    a.send(JSON.stringify({
+                        type: `auth`,
+                        token: n
+                    }));
+                } catch  {
+                    c(Error(`Failed to send DuckDB websocket auth token.`));
+                }
+            }, a.onmessage = (e)=>{
+                if (!(!n || typeof e.data != `string`)) try {
+                    let t = JSON.parse(e.data);
+                    t?.type === `authAck` ? c() : t?.type === `error` && c(Error(t.error || `DuckDB websocket auth failed.`));
+                } catch  {}
+            }, a.onerror = ()=>c(Error(`DuckDB websocket connection error.`)), a.onclose = ()=>c(Error(`DuckDB websocket closed before opening.`));
         });
     }
-    async function iAi(e, t) {
-        let n = Date.now() + t, r;
-        for(; Date.now() < n;){
-            let t = n - Date.now();
+    async function iAi(e, t, n) {
+        let r = Date.now() + t, i;
+        for(; Date.now() < r;){
+            let t = r - Date.now();
             try {
-                await rAi(e, Math.min(Zki, t));
+                await rAi(e, Math.min(Zki, t), n);
                 return;
             } catch (e) {
-                if (r = e, eAi(await Yki())) throw e;
+                if (i = e, eAi(await Yki())) throw e;
             }
-            let i = n - Date.now();
-            i > 0 && await nAi(Math.min(Qki, i));
+            let a = r - Date.now();
+            a > 0 && await nAi(Math.min(Qki, a));
         }
-        throw r ?? Error(`Timed out connecting to DuckDB websocket backend.`);
+        throw i ?? Error(`Timed out connecting to DuckDB websocket backend.`);
     }
-    function aAi(e, { runtimeConfig: t, wsUrl: n }) {
-        let r = e.initialize.bind(e);
+    function aAi(e, { runtimeConfig: t, wsUrl: n, authToken: r }) {
+        let i = e.initialize.bind(e);
         e.initialize = async ()=>{
             if (eAi(t.startupStatus)) throw tAi({
                 wsUrl: n,
                 startupStatus: t.startupStatus
             });
             try {
-                await iAi(n, Xki);
+                await iAi(n, Xki, r);
             } catch (e) {
                 throw tAi({
                     wsUrl: n,
@@ -314474,7 +314492,7 @@ export default function App() {
                 });
             }
             try {
-                await r();
+                await i();
             } catch (e) {
                 throw tAi({
                     wsUrl: n,
@@ -315881,8 +315899,8 @@ Use this for map, geospatial, spatial, longitude/latitude, geometry, H3, route,
             command: ()=>W9(`canvas`, `Canvas`)
         },
         {
-            artifactType: `app`,
-            command: ()=>W9(`app`, `App`)
+            artifactType: `app-builder`,
+            command: ()=>W9(`app-builder`, `App Builder`)
         },
         {
             artifactType: `dashboard`,
@@ -317046,6 +317064,7 @@ Experimental SQLRooms tools are available in this session. Use them for app, map
         if (q9.syncEnabled) return m$r({
             url: q9.crdtWsUrl || q9.wsUrl || `ws://localhost:4000`,
             roomId: q9.crdtRoomId || `sqlrooms-cli:${q9.metaNamespace || `__sqlrooms`}:${q9.dbPath || `memory`}`,
+            token: q9.wsAuthToken,
             sendSnapshotOnConnect: !1
         });
     }
@@ -317062,6 +317081,7 @@ Experimental SQLRooms tools are available in this session. Use them for app, map
     }
     var KMi = q9.wsUrl || `ws://localhost:4000`, qMi = KMi, Z9 = ZEe({
         wsUrl: KMi,
+        authToken: q9.wsAuthToken,
         initializationQuery: [
             `INSTALL spatial`,
             `LOAD spatial`,
@@ -317071,7 +317091,8 @@ Experimental SQLRooms tools are available in this session. Use them for app, map
     }), JMi = Z9;
     aAi(Z9, {
         runtimeConfig: q9,
-        wsUrl: KMi
+        wsUrl: KMi,
+        authToken: q9.wsAuthToken
     });
     var YMi = Z9.loadFile.bind(Z9);
     Z9.loadFile = async (e, t, n)=>{

{sqlrooms-0.1.2 → sqlrooms-0.1.3}/sqlrooms/web/static/index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>SQLRooms CLI App</title>
-    <script type="module" crossorigin src="/assets/index-Dxqv3Ov8.js"></script>
+    <script type="module" crossorigin src="/assets/index-DSQGFItg.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/chunk-jRWAZmH_.js">
     <link rel="modulepreload" crossorigin href="/assets/CommandSlice-DPSuuiIV.js">
     <link rel="modulepreload" crossorigin href="/assets/react-dom-liMHu8hH.js">