A non-admin's forced export filter includes co-resident *user* records so
abode/resident data isn't left with dangling references, but the same `users`
allowlist was also governing `apikey` records — leaking co-residents' apikey
metadata (name/permissions/expiry, though not the secret token).
Add a dedicated `apikeys` uid-allowlist to ExportFilter that scopes apikey
records specifically, falling back to `users` when absent (so existing
unfiltered/voluntary-narrowing behaviour and the round-trip are unchanged).
computeForcedExportFilter now sets it to the caller alone (intersected with an
apikey credential's restrict_users), so a non-admin can only ever export their
own keys. Global admins (forced filter null) are unaffected.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add backend-agnostic data export/import over an NDJSON wire format, plus an
inspect utility, exposed via three new CLIs and an HTTP export endpoint.
- ExportImport types + filter helpers (kind/record scoping, hard-intersection
of filters) in src/db/{types/ExportImport,export/filter}.ts
- SqliteInterface implements Exportable + Importable: signal-checked async
generator export (one query per table, per-record yield, trailing error
sentinel on mid-stream failure) and a manually-driven import transaction
that rolls back on any error/abort and never commits partial data
- ApiInterface implements Exportable via its own fetch({signal})
- computeForcedExportFilter enforces non-global-admin scope (resided-in abodes
+ co-resident users, intersected with apikey restrict_*); GET /export
intersects it with the caller's filter and wires an AbortController to the
response socket
- inspectExportStream reports kinds/counts from any stream without a db
- abode-export / abode-import / abode-inspect CLIs (import is sqlite-only)
- Secrets are not exported: imported users default to '#unset' passwords and
apikeys are re-minted a token (ClientApikey view round-trips exactly)
- test/tools/export-import.test.ts: round-trip, filter narrowing, forced-scope,
export/import cancellation, in-process Koa endpoint, inspect
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- PostgresMigrator: run JS migration parts on the transactional client
(WrappedPgTx) instead of the pool, preserving migration atomicity
- pool.ts: guard ROLLBACK so a failing rollback no longer masks the
original error (also applied in the migrator loop)
- pool.ts: share all/get/run between WrappedPool and WrappedPgTx via a
common base class
- sql.ts: document that toPositional precludes JSONB ?/?|/?& operators
- PostgresInterface: implement deleteSession, required by
BackendDbInterface since the logout-invalidation change on master
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Mirrors the node:sqlite sub-backend structure with full migration support.
Uses native pg types (UUID, JSONB, TIMESTAMPTZ) and $1/$2 parameterisation
via internal ? placeholders converted at execution time.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Fills in all 7 previously-unimplemented note methods in SqliteInterface
and ApiInterface, adds cast/query helpers for notes, and fixes the
apirouter (missing updatenote validator, two /user/ → /users/ typos that
were also bypassing auth middleware).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
/auth/logout previously only cleared the client's cookie, leaving the
session token valid in the sessions table — a stolen cookie captured
before logout would still work afterwards. Add BackendDbInterface#deleteSession
(implemented in SqliteInterface) and call it from the logout route using
the session token from the cookie. Caught by the new auth-http.test.ts
integration test, updated to assert the session is actually invalidated.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Add tsconfig.test.json + typecheck:test script so test/ is type-checked;
fixes real type errors it surfaced (hashedPw typing, PartialUser|ClientUser
narrowing for .email).
- Add HTTP-level auth-http.test.ts for the api backend covering
login/session-cookie/logout/clear-sessions/bearer-apikey flows, since
ApiInterface doesn't implement the session/login methods needed to run the
shared session/auth suites directly.
- Make the readonly-db test in shared/users.ts actually construct a readonly
db instance (previously a no-op that never ran) via a new getReadonlyDb
parameter, wired up for both sqlite and api backends.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds 215 tests across three tiers using node:test + node:assert/strict
(no new test framework dependencies):
- test/tools/ — middleware and utility tests (token, hash, authenticate,
jsonBody, convertError, validators)
- test/shared/ — DbInterface/BackendDbInterface contract suites reusable
across backends (users, abodes, residents, apikeys, sessions, auth)
- test/backends/sqlite/ — SQLite-private tests (sql builder, WrappedDb,
migrator) + shared suites via SqliteInterface
- test/backends/api/ — ApiInterface unit tests + shared suites via a
live Koa server backed by SQLite
Also fixes four bugs uncovered by the tests:
- ApiInterface: path params leaked into query string (slice(1) fix)
- ApiInterface: calling res.json() on 204 No Content responses
- SqliteInterface.updateResident: missing comma in SET clause
- WrappedBetterSqlite3Db: readonly:undefined rejected by better-sqlite3
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
codingetandClaude
