mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-25 00:01:55 +00:00
Guilhem Lemouel
86 lines
3.5 KiB
TypeScript
86 lines
3.5 KiB
TypeScript
/**
|
|
* `postgres://user:password@host:5432/dbname?sslmode=require` in both directions.
|
|
*
|
|
* Shared by the resource form and the data table wizard: both turn a pasted
|
|
* connection string into a `postgresql` resource value, and the two drifting
|
|
* apart would mean the same string produced two different resources.
|
|
*
|
|
* The wizard offers the same connection as a string or as fields and lets the
|
|
* user switch, so parse and compose have to be inverses: whatever one produces,
|
|
* the other must read back unchanged.
|
|
*
|
|
* libpq is the arbiter of what a connection string means, so this follows it rather than
|
|
* RFC 3986 where they differ: credentials are split at the *first* `@` -- an unencoded one
|
|
* lands in the host for libpq too -- and percent escapes in them are decoded, so `p%40ss`
|
|
* authenticates as `p@ss`.
|
|
*/
|
|
|
|
/**
|
|
* The host alternation is what admits IPv6: a literal address is full of colons, so a URI
|
|
* has to bracket it (`@[2001:db8::1]:5432/`) and the brackets are what tell the port apart
|
|
* from the address. Brackets are stripped on the way in and added back on the way out, so
|
|
* what is stored is the bare address a Postgres client wants.
|
|
*/
|
|
const CONNECTION_STRING =
|
|
/postgres(?:ql)?:\/\/(?<user>[^:@]+)(?::(?<password>[^@]+))?@(?<host>\[[^\]]+\]|[^:\/?]+)(?::(?<port>\d+))?\/(?<dbname>[^\?]+)?(?:\?.*sslmode=(?<sslmode>[^&]+))?/
|
|
|
|
/**
|
|
* A database someone types into Windmill is almost never localhost, so callers ask for TLS
|
|
* where libpq would settle for `prefer`. A string that names its own `sslmode` keeps it.
|
|
*/
|
|
export const DEFAULT_SSLMODE = 'require'
|
|
|
|
export type PostgresConnectionParts = {
|
|
user: string
|
|
password?: string
|
|
host: string
|
|
port?: number
|
|
dbname?: string
|
|
sslmode?: string
|
|
}
|
|
|
|
/** A lone `%` is not an escape, and a password is free to contain one. */
|
|
function decode(value: string): string {
|
|
try {
|
|
return decodeURIComponent(value)
|
|
} catch {
|
|
return value
|
|
}
|
|
}
|
|
|
|
/** Undefined when the string is not a postgres URI. */
|
|
export function parsePostgresConnectionString(
|
|
connectionString: string
|
|
): PostgresConnectionParts | undefined {
|
|
const match = connectionString.match(CONNECTION_STRING)
|
|
if (!match?.groups) return undefined
|
|
const { user, password, host, port, dbname, sslmode } = match.groups
|
|
return {
|
|
user: decode(user),
|
|
password: password ? decode(password) : undefined,
|
|
host: host.startsWith('[') ? host.slice(1, -1) : host,
|
|
port: port ? Number(port) : undefined,
|
|
dbname: dbname ? decode(dbname) : undefined,
|
|
sslmode: sslmode || undefined
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Every part that was set is emitted, `sslmode` included. Leaving `prefer` out because it is
|
|
* libpq's own default would be shorter, but it does not survive the trip: a caller that
|
|
* reparses this string gets `undefined` back and substitutes its own default, which is how an
|
|
* explicit `prefer` silently became `require`. Whatever this produces, `parse` must read back.
|
|
*/
|
|
export function composePostgresConnectionString(parts: PostgresConnectionParts): string {
|
|
const credentials = parts.password
|
|
? `${encodeURIComponent(parts.user)}:${encodeURIComponent(parts.password)}`
|
|
: encodeURIComponent(parts.user)
|
|
const port = parts.port ? `:${parts.port}` : ''
|
|
const query = parts.sslmode ? `?sslmode=${parts.sslmode}` : ''
|
|
const dbname = parts.dbname ? encodeURIComponent(parts.dbname) : ''
|
|
// A bare IPv6 address would put its own colons where the port separator goes.
|
|
const host =
|
|
parts.host.includes(':') && !parts.host.startsWith('[') ? `[${parts.host}]` : parts.host
|
|
return `postgres://${credentials}@${host}${port}/${dbname}${query}`
|
|
}
|