Commit Graph
70 Commits
Author SHA1 Message Date
t8y2 7c5021fa91 feat(turso): simplify connection form to URL + token 2026-06-13 20:33:32 +08:00
Vergil Lai 799d20a2cf 添加 Manticore Search 支持 (#1145)
* 添加 Manticore Search 支持

* 更新 Manticore Search 文档
2026-06-13 20:23:36 +08:00
haipengno1 6265571182 feat(ssh): add ssh-agent authentication support (#1023)
Thanks for adding ssh-agent support, this is a great addition!
2026-06-11 00:39:30 +08:00
t8y2 d353d4673f feat(redis): add configurable key namespace separator 2026-06-10 17:46:48 +08:00
John Jin 0bd07ccf46 feat: add InfluxDB support (#980) 2026-06-10 14:37:53 +08:00
t8y2 bfec556e9b feat(readonly): add read-only mode for all database connections
- Add read_only field to ConnectionConfig with backward-compatible serde defaults
- SQL classifier with first-keyword + embedded keyword defense layers
- PRAGMA white-listing for safe read-only operations
- Guard all write entry points: SQL, Mongo, Redis, etcd, MCP Bridge
- 16 unit tests covering edge cases (CTE, case insensitivity, string masking)
- 7-language i18n support
- Fast-fail at command/route level before pool creation

Closes #889
2026-06-10 11:58:18 +08:00
runstone a440415e86 feat(readonly): add read-only mode for all database connections
## Background
Add a read-only toggle for database connections that blocks all write
operations (INSERT, UPDATE, DELETE, DROP, etc.) when enabled, allowing
only read queries (SELECT, SHOW, EXPLAIN, etc.). Closes #889.

## Changes

### Data Model
- Added `read_only: bool` field to ConnectionConfig (Rust struct, TS
  interfaces, and ConnectionConfigData deserialization layer)
- Used `#[serde(default, skip_serializing_if = "is_false")]` for
  backward/forward compatibility with existing configs

### Frontend UI
- Added "Read Only" checkbox in connection dialog
- 7-language i18n support (en/es/it/pt-BR/zh-CN/zh-TW)

### SQL Classification (query_execution_sql.rs)
- Added `is_write_sql()` with two-layer defense:
  - Layer 1: First-keyword check (must start with known read keyword)
  - Layer 2: Embedded dangerous keyword detection (catches CTE-wrapped
    writes like `WITH ... AS (DELETE FROM ...)`)
  - `FROM` keyword supported as DuckDB SELECT-less syntax indicator
- Added `check_read_only()` returning descriptive error with connection name
- Added 16 unit tests covering: pure reads/writes, CTE, case insensitivity,
  string literal masking, comment stripping, stored procedure calls, edge cases

### SQL Execution Guards (query.rs / transfer.rs)
- Added `check_read_only_for_connection()` and `_multi()` helper functions
  with lazy name clone (only allocates when read_only is true)
- 6 interception points: `do_execute`, MySQL batch, SQL Server batch,
  DuckDB batch, transaction execution, transfer execution

### Non-SQL Write Guards — Tauri Commands
- Added `ensure_connection_writable()` helper (connection.rs)
- Mongo: 6 write entry points (insert/update/delete, single + batch)
- Redis: 15 write entry points (SET, DEL, HSET, HDEL, LPUSH, LSET, LREM,
  SADD, SREM, ZADD, ZREM, EXPIRE, FLUSHDB, delete_keys, execute_command)
  - execute_command uses RedisCommandSafety classification to allow
    safe read commands through raw command interface
- etcd: 2 write entry points (put, delete)
- sql_file: SQL file execution guarded
- MCP Bridge: 4 write entry points (Insert/Update/Delete/SQL query)

### Non-SQL Write Guards — Web API
- Local `ensure_writable()` helper in each route module
- Redis: 12 write endpoints including classified execute_command
- Mongo: 6 write endpoints
- etcd: 2 write endpoints
- sql_file, table_import, transfer: early rejection

### Test Updates
- Updated ConnectionConfig construction in 7 test files with
  `read_only: false` initialization

## Defense-in-Depth
- Layer 1: Command/Route-level early rejection (saves resources)
- Layer 2: Core SQL classifier (`is_write_sql` — first keyword + embedded scan)
- Layer 3: Core execution-time interception (do_execute/transfer/transaction)
2026-06-10 10:58:52 +08:00
t8y2 d08385e75f feat: add Turso/libSQL database support
Turso is a distributed SQLite database built on libSQL, offering HTTP-based
connectivity with auth token authentication. This change adds full support:

- New DatabaseType::Turso and PoolKind::Turso variants
- TursoClient driver using libSQL HTTP pipeline API (/v2/pipeline)
- Bearer token auth via password or url_params (auth_token=)
- Multi-statement batch pipeline for transactional integrity
- Standalone BEGIN/COMMIT/ROLLBACK treated as no-ops (pipeline is auto-commit)
- Full metadata support: tables, columns, indexes, foreign keys, triggers, DDL
- Frontend: connection form, SQL completion (SQLite syntax), capability sets
- Built-in databases (SQLite/Turso/DuckDB/RQLite/Access) placed first in selector
- Unit tests (15) + integration tests against live libsql-server (12)
- Single connection pool, skips TCP probe

Closes #948
2026-06-10 04:18:05 +08:00
t8y2 6a14b11efc fix(mongodb): skip SQL semantic diagnostics for MongoDB connections
MongoDB shell syntax like db.collection.find({}) was incorrectly
parsed as SQL, causing a "sql parser error" diagnostic in the editor.
Added MongoDB guards in shouldRunSqlSemanticDiagnostics and
refreshSemanticDiagnostics, matching existing Elasticsearch logic.

Also fix a pre-existing TiDB cloud URL param ordering test failure.
2026-06-09 16:20:50 +08:00
Holata Seminole 70dad4e00b fix(mysql): require TLS for TiDB Cloud connections (#911)
Thanks!
2026-06-09 12:06:38 +08:00
t8y2 2a7b26baad fix: add missing idle_timeout_secs in ConnectionConfig constructors and fix clippy warnings 2026-06-09 11:56:39 +08:00
James-LeongandClaude Opus 4.7 171c7cd8d7 fix(ssh): prevent duplicate SSH tunnels from concurrent pool creation (#891)
start_tunnel() and start_chain() had a check-then-act race condition:
multiple concurrent callers could all see an empty cache and each
spawn a new SSH tunnel. The tunnel that lost the insert race was
orphaned, causing queries routed through it to fail.

Use double-check locking with stale entry eviction: hold the lock for
the cache lookup, release it during the slow SSH handshake, then
re-check under the lock before inserting. If another caller already
created the tunnel, abort the duplicate and return the existing port.

Also check handle liveness on cache hits so that callers don't get a
dead port back when the background tunnel task has exited.

Add a matching re-check in the MongoDB connection pool creation path.

Add idle_timeout_secs connection option (default 60s) to preempt
server-side connection idle timeouts that cause "unexpected end of
file" errors on pooled MongoDB connections.

Reject MongoDB queries in the generic SQL execution path before any
pool or session-key creation. Previously, a typo in a MongoDB shell
command would fall through to executeMulti / execute_sql_statement,
which called get_or_create_pool_for_session and leaked a session-scoped
MongoDB Client (and SSH tunnel resources) before eventually returning
"Use MongoDB-specific commands".

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-06-09 10:29:42 +08:00
t8y2 e6062b2b07 feat(etcd): add agent-backed etcd support 2026-06-08 00:58:42 +08:00
t8y2 74e19ec6a3 feat(databend): support agent driver 2026-06-07 16:39:22 +08:00
t8y2 a3e45cd721 feat(iotdb): add Apache IoTDB support 2026-06-07 10:29:05 +08:00
e9ee982843 Preserve ordered SSH and proxy connection layers (#802)
* Preserve ordered SSH and proxy connection layers

Replace separate SSH/proxy connection fields with ordered transport_layers while keeping legacy migration and secret fallback paths intact. The UI now edits SSH tunnel/proxy layers in configured order without a global SSH enable gate.

Constraint: Existing saved SSH tunnels, proxy settings, and secret-store keys must continue to load through migration.
Rejected: Folding proxy fields into SshTunnelConfig | mixes proxy semantics into an SSH-specific structure.
Confidence: high
Scope-risk: moderate
Directive: Keep SSH/proxy structs provider-specific; put cross-layer chaining in transport_layer_tunnel orchestration.
Tested: git diff --check; cargo fmt --check; cargo check --workspace; cargo test -p dbx-core --lib; vue-tsc --noEmit --project apps/desktop/tsconfig.json; tsc -p packages/node-core/tsconfig.json --noEmit; oxlint --vue-plugin apps/desktop/src; tsx --tsconfig apps/desktop/tsconfig.json --test packages/app-tests/*.test.ts; tsx --test packages/node-core/tests/*.test.ts
Not-tested: Live external SSH/proxy/database endpoint integration.

* Keep ordered transport changes CI-format clean

Constraint: CI pnpm check failed only on oxfmt formatting for two desktop TypeScript files
Confidence: high
Scope-risk: narrow
Directive: Keep generated/editor config changes out of this PR fix commit
Tested: PATH="/Volumes/data/code/rust/dbx/node_modules/.bin:/Users/hekx/.codex/tmp/arg0/codex-arg0nuL34n:/Users/hekx/.cargo/bin:/Users/hekx/.local/bin:/opt/homebrew/opt/llvm/bin:/opt/homebrew/opt/libpq/bin:/Volumes/data/Users/hekx/.opencode/bin:/Users/hekx/.bun/bin:/Volumes/data/sdks/flutter/bin:/Volumes/data/Users/hekx/.cargo/bin:/Users/hekx/.local/bin:/opt/homebrew/opt/llvm/bin:/opt/homebrew/opt/libpq/bin:/Volumes/data/Users/hekx/.opencode/bin:/Users/hekx/.bun/bin:/Volumes/data/Users/hekx/Library/pnpm:/Volumes/data/sdks/flutter/bin:/Volumes/data/Users/hekx/.cargo/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/pkg/env/global/bin:/opt/X11/bin:/Library/Apple/usr/bin:/Applications/Wireshark.app/Contents/MacOS:/usr/local/go/bin:/opt/homebrew/bin:/opt/podman/bin:/Applications/Ghostty.app/Contents/MacOS" rtk node scripts/run-check.mjs
Not-tested: GitHub Actions rerun not observed locally

* Keep Rust checks warning-clean

Constraint: cargo clippy --workspace --all-targets --all-features -- -D warnings failed across core, web, and tauri crates
Rejected: Broad workspace-level clippy suppression | kept allows local to long-argument command/API boundaries
Confidence: high
Scope-risk: moderate
Directive: Preserve src-tauri/tauri.conf.json as an unrelated local change outside this commit
Tested: rtk cargo clippy --workspace --all-targets --all-features -- -D warnings
Not-tested: Full GitHub Actions rerun not observed locally

* Reuse existing proxy tunnels on retry

Proxy tunnel startup now mirrors SSH tunnel behavior by returning the existing local port for an active connection id instead of replacing the managed handle. A second map check aborts a just-spawned duplicate handle if a concurrent retry won the race before insertion, preventing orphaned listeners while keeping the change narrow.

Constraint: Reviewer requested proxy tunnel behavior align with SSH local-port reuse

Rejected: Always overwrite and abort the previous handle | less consistent with SSH behavior and churns listeners during retries

Confidence: high

Scope-risk: narrow

Tested: cargo fmt --check --all

Tested: cargo test -p dbx-core db::proxy_tunnel::tests::start_tunnel_reuses_existing_local_port

Tested: cargo clippy -p dbx-core --all-targets -- -D warnings

---------

Co-authored-by: hekx <hekx@momandeMac-mini.local>
Co-authored-by: caisin <caisin@caisins-Mac-mini.local>
2026-06-06 23:22:29 +08:00
Xudong Guo 9b15843e1a feat: add KWDB support 2026-06-05 16:55:38 +08:00
t8y2 0887b96236 feat: add rqlite database support 2026-06-05 01:02:07 +08:00
t8y2 01c8072d97 fix: support MongoDB Atlas SRV connections in form mode
Add an "SRV (MongoDB Atlas)" toggle in the MongoDB connection form.
When enabled, the backend uses mongodb+srv:// scheme and omits the
port, matching the behavior of pasting a mongodb+srv:// URL directly.
2026-06-04 16:01:31 +08:00
t8y2 ccaa50e36b fix(query): honor connection timeout during exports 2026-06-02 19:38:21 +08:00
t8y2 46c05b811f feat(connection): support multi-hop ssh tunnels 2026-06-01 14:48:33 +08:00
t8y2 a9e7f3946d fix(redis): support insecure tls connections 2026-05-30 16:00:13 +08:00
t8y2 6481af3ed8 fix(oracle): preserve jdbc descriptors 2026-05-30 13:06:52 +08:00
t8y2 81e50cadb5 feat: add XuguDB agent support 2026-05-30 09:12:34 +08:00
t8y2 f88367a872 feat: add OpenGauss support and enhance MySQL URL parameter handling 2026-05-30 00:31:29 +08:00
t8y2 c71804d144 feat: add InterSystems IRIS database support
Add IRIS as a new agent-driven database type with:
- iris:// connection URL scheme (default port 1972, user _SYSTEM)
- JDBC driver via agent (com.intersystems.jdbc.IRISDriver)
- Oracle-compatible DDL dialect and schema-aware SQL dialect
- Capability sets: schema-aware, tree schema, diagram, search, table structure

Closes #368
2026-05-29 19:15:11 +08:00
t8y2 b07273249b chore: cargo fmt with rustc 1.96 to fix CI format check 2026-05-29 18:15:15 +08:00
t8y2 58f2942520 feat: generalize URL params field to all database types and support oceanbase-oracle URL params
Remove the hardcoded 12-type whitelist for the URL params form field so all
database types (including agent-driven ones like oceanbase-oracle) can set
custom URL parameters. Also append url_params to oceanbase-oracle connection
URLs in the Rust backend (matching the existing Postgres/Redshift pattern).
2026-05-29 17:56:03 +08:00
t8y2 ef4baba57a feat: support double-clicking .db/.sqlite/.duckdb files to open in IDE
Add OS file association for database files (.db, .sqlite, .sqlite3, .duckdb)
so double-clicking them in Finder/Explorer automatically creates a connection.
If the same file path is already connected, prompts the user to switch instead.

Also fix 42 pre-existing clippy warnings in dbx-core (needless_borrow,
too_many_arguments, derivable_impls, manual_div_ceil, type_complexity, etc.).

Closes #527
2026-05-29 17:25:52 +08:00
t8y2 fa39fb9f92 fix(rust): update tests for connection timeout changes 2026-05-28 20:25:09 +08:00
t8y2 2fbdffebf5 style(rust): format core modules 2026-05-28 19:23:49 +08:00
t8y2 486d9bb3a6 fix(connection): move query timeout into per-connection settings 2026-05-28 18:18:45 +08:00
田振洲 c03b57c179 feat: add per-connection configurable connect timeout
Add a `connect_timeout_secs` field to ConnectionConfig that allows users
to configure the database connection timeout per connection (1-300s,
default 5s). Previously all connections used a hardcoded 5-second timeout.

- Add connect_timeout_secs field with serde default and clamp logic
- Add parse_connect_timeout_with_fallback to honor URL params over config
- Pass user-configured timeout to all drivers (MySQL, Postgres, Redis,
  MongoDB, ClickHouse, SQL Server, Elasticsearch) and TCP probe
- Add UI input in connection dialog SSH tab
- Add i18n keys for en/zh-CN/es
2026-05-28 14:24:54 +08:00
t8y2 797c0d8d21 Add Redis cluster support and improve key loading 2026-05-28 00:08:59 +08:00
t8y2 d6047e26c1 fix: support postgres schema url params 2026-05-27 09:12:47 +08:00
t8y2 660ed3002f fix: tolerate mysql-style params in postgres urls 2026-05-26 21:48:37 +08:00
t8y2 32273b4d6e feat: support Redis Sentinel connections 2026-05-26 19:44:23 +08:00
t8y2 f9b58993b4 fix: add TLS connection settings 2026-05-26 17:32:05 +08:00
t8y2 c6fc78588e fix: normalize postgres timezone url parameter 2026-05-26 12:38:37 +08:00
t8y2 fe2ecd60d2 feat: add ClickHouse TLS connection support 2026-05-25 21:07:22 +08:00
yavon007 13424588b9 Support DBX connection deep links (#359)
* fix(mysql): avoid metadata collation conflicts

Split MySQL column and primary key metadata lookups so MariaDB and OceanBase do not join information_schema tables with incompatible collations.

* feat(grid): add invert column visibility action

* feat(grid): improve cell detail editing

* feat(grid): add keyboard cell navigation

* feat(grid): add column name copy in header tooltip

* feat(grid): improve transpose navigation

* feat(connection): support dbx connection deep links

* docs: document connection deep links

* fix(connection): harden deep link boolean handling
2026-05-20 16:10:14 +08:00
t8y2 bd727c32d0 fix(sqlserver): use BEGIN TRANSACTION instead of BEGIN for explicit transactions
SQL Server interprets bare "BEGIN" as a BEGIN...END block, not a
transaction start, causing syntax error when editing table data.
2026-05-20 11:08:44 +08:00
t8y2 b16393f68c feat(database): add agent database profiles 2026-05-18 22:38:04 +08:00
t8y2 008656806e feat(oracle): support service name and SID connections 2026-05-18 21:04:37 +08:00
t8y2 fb9582fd2c feat(drivers): add YashanDB built-in support 2026-05-18 14:33:18 +08:00
t8y2 e1930550e2 feat(grid): support DuckDB database files 2026-05-18 13:18:02 +08:00
t8y2 1bcfd02de1 feat: add Microsoft Access database support
Add Access as a new database type with agent-based connectivity,
UCanAccess JDBC URL parsing, backtick identifier quoting, file-path
connection dialog, and PNG icons for Access/GoldenDB/Vastbase.
2026-05-17 09:57:04 +08:00
t8y2 e9621ef06a Add TDengine support and editable grid handling 2026-05-16 11:33:42 +08:00
t8y2 08de206644 feat(sidebar): add visible database filters 2026-05-15 17:36:51 +08:00
t8y2 2973bb1cd5 feat: add Highgo (瀚高) database support
Add full support for Highgo database, a PostgreSQL-compatible Chinese
domestic database. Includes database type definition, connection dialog,
agent driver mapping, and database icon.
2026-05-15 14:35:19 +08:00