backend integration started
This commit is contained in:
251
scripts/db.mjs
Normal file
251
scripts/db.mjs
Normal file
@@ -0,0 +1,251 @@
|
||||
/**
|
||||
* Direct database access, through Hasura.
|
||||
*
|
||||
* A scratchpad for reading and fixing rows that no screen exposes — setting a
|
||||
* password on an account that was spawned without one, flipping a status,
|
||||
* checking what the API is actually reading. It talks to the Hasura instance
|
||||
* the old console proxies to (`api.workolik.com`), using the admin secret from
|
||||
* `daily_merchant_web/.env`, which is gitignored and stays there.
|
||||
*
|
||||
* node scripts/db.mjs tables
|
||||
* node scripts/db.mjs user care@nearle.in
|
||||
* node scripts/db.mjs setpw care@nearle.in <password>
|
||||
* node scripts/db.mjs sql "select userid, authname from app_users limit 5"
|
||||
*
|
||||
* The secret is read from disk or the environment and never printed, never
|
||||
* written anywhere, and never passed on the command line.
|
||||
*
|
||||
* ── Read this before using `setpw` ────────────────────────────────────────
|
||||
* This points at PRODUCTION. Every write here is immediate and unversioned.
|
||||
* `setpw` refuses to run unless the account's password column is already
|
||||
* empty, so it can only ever complete a setup that was never finished — it
|
||||
* cannot overwrite a working login. Lift that guard only deliberately.
|
||||
*
|
||||
* Passwords in `app_users` are stored in clear. That is a property of this
|
||||
* backend, not of this script; anything written here is readable by anyone
|
||||
* with database access.
|
||||
*/
|
||||
|
||||
import { readFileSync, existsSync } from 'node:fs';
|
||||
import { resolve, dirname } from 'node:path';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
|
||||
const HERE = dirname(fileURLToPath(import.meta.url));
|
||||
|
||||
const ENDPOINT = process.env.HASURA_URL ?? 'https://api.workolik.com/v1/graphql';
|
||||
|
||||
/** Where the old console keeps its gitignored secret, relative to this repo. */
|
||||
const ENV_CANDIDATES = [
|
||||
resolve(HERE, '../../../nearle-daily/daily_merchant_web/.env'),
|
||||
resolve(HERE, '../../daily_merchant_web/.env'),
|
||||
'D:/nearle-daily/daily_merchant_web/.env',
|
||||
];
|
||||
|
||||
function readSecret() {
|
||||
if (process.env.HASURA_ADMIN_SECRET) return process.env.HASURA_ADMIN_SECRET;
|
||||
|
||||
for (const path of ENV_CANDIDATES) {
|
||||
if (!existsSync(path)) continue;
|
||||
const line = readFileSync(path, 'utf8')
|
||||
.split(/\r?\n/)
|
||||
.find((row) => row.startsWith('HASURA_ADMIN_SECRET='));
|
||||
if (!line) continue;
|
||||
const value = line.slice('HASURA_ADMIN_SECRET='.length).trim().replace(/^["']|["']$/g, '');
|
||||
if (value) return value;
|
||||
}
|
||||
|
||||
console.error(
|
||||
'No admin secret found.\n' +
|
||||
'Expected HASURA_ADMIN_SECRET in one of:\n' +
|
||||
ENV_CANDIDATES.map((p) => ` ${p}`).join('\n') +
|
||||
'\nor set it in the environment for this command.',
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
const SECRET = readSecret();
|
||||
|
||||
async function gql(query, variables = {}) {
|
||||
let response;
|
||||
try {
|
||||
response = await fetch(ENDPOINT, {
|
||||
method: 'POST',
|
||||
headers: { 'content-type': 'application/json', 'x-hasura-admin-secret': SECRET },
|
||||
body: JSON.stringify({ query, variables }),
|
||||
});
|
||||
} catch (cause) {
|
||||
console.error(`Could not reach ${ENDPOINT} — ${cause.message}`);
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
const payload = await response.json().catch(() => null);
|
||||
if (!payload) {
|
||||
console.error(`Malformed response (HTTP ${response.status})`);
|
||||
process.exit(1);
|
||||
}
|
||||
if (payload.errors) {
|
||||
for (const error of payload.errors) console.error(`✗ ${error.message}`);
|
||||
process.exit(1);
|
||||
}
|
||||
return payload.data;
|
||||
}
|
||||
|
||||
/* ── Commands ─────────────────────────────────────────────────────────────── */
|
||||
|
||||
/** Every table Hasura has tracked. Start here if a query says "field not found". */
|
||||
async function tables() {
|
||||
const data = await gql(`{ __schema { queryType { fields { name } } } }`);
|
||||
const names = data.__schema.queryType.fields
|
||||
.map((field) => field.name)
|
||||
.filter((name) => !name.endsWith('_aggregate') && !name.endsWith('_by_pk'))
|
||||
.sort();
|
||||
console.log(names.join('\n'));
|
||||
console.log(`\n${names.length} tables`);
|
||||
}
|
||||
|
||||
const USER_FIELDS = `userid authname firstname lastname contactno roleid status tenantid locationid configid`;
|
||||
|
||||
async function findUser(email) {
|
||||
const data = await gql(
|
||||
`query ($email: String!) {
|
||||
app_users(where: { authname: { _eq: $email } }) { ${USER_FIELDS} password }
|
||||
}`,
|
||||
{ email },
|
||||
);
|
||||
return data.app_users ?? [];
|
||||
}
|
||||
|
||||
async function user(email) {
|
||||
const rows = await findUser(email);
|
||||
if (rows.length === 0) {
|
||||
console.log(`No account with authname "${email}".`);
|
||||
return;
|
||||
}
|
||||
for (const row of rows) {
|
||||
// The password itself is never printed — only whether one exists, which is
|
||||
// the only thing anyone needs to know from here.
|
||||
const { password, ...rest } = row;
|
||||
console.log({ ...rest, haspassword: String(password ?? '').trim() !== '' });
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Completes a password setup that was never finished.
|
||||
*
|
||||
* Refuses if a password is already set. An account that can sign in must not
|
||||
* be changeable from a scratchpad — that is a support action with a person
|
||||
* behind it, not a one-liner.
|
||||
*/
|
||||
async function setpw(email, password) {
|
||||
if (!password || password.length < 6) {
|
||||
console.error('Password must be at least 6 characters (the backend enforces this too).');
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
const rows = await findUser(email);
|
||||
if (rows.length === 0) {
|
||||
console.error(`No account with authname "${email}".`);
|
||||
process.exit(1);
|
||||
}
|
||||
if (rows.length > 1) {
|
||||
console.error(
|
||||
`${rows.length} accounts share that email (configid ${rows.map((r) => r.configid).join(', ')}).\n` +
|
||||
'Refusing to guess. Use `sql` with an explicit userid.',
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
const row = rows[0];
|
||||
if (String(row.password ?? '').trim() !== '') {
|
||||
console.error(
|
||||
`userid ${row.userid} already has a password. This command only completes an unfinished setup.\n` +
|
||||
'To reset a working login, do it deliberately with `sql`.',
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
if (row.roleid === 7 || row.roleid === 8) {
|
||||
console.error(
|
||||
`userid ${row.userid} is a till account (roleid ${row.roleid}). Those sign in at the terminal with a PIN, not here.`,
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
const data = await gql(
|
||||
`mutation ($userid: Int!, $password: String!) {
|
||||
update_app_users(where: { userid: { _eq: $userid } }, _set: { password: $password }) {
|
||||
affected_rows
|
||||
}
|
||||
}`,
|
||||
{ userid: row.userid, password },
|
||||
);
|
||||
|
||||
const affected = data.update_app_users?.affected_rows ?? 0;
|
||||
if (affected !== 1) {
|
||||
console.error(`Expected to update 1 row, updated ${affected}. Nothing assumed — check manually.`);
|
||||
process.exit(1);
|
||||
}
|
||||
console.log(
|
||||
`✓ Password set on userid ${row.userid} (${email}), roleid ${row.roleid}, tenantid ${row.tenantid}.`,
|
||||
);
|
||||
console.log(' Sign in at the console with it now.');
|
||||
}
|
||||
|
||||
/**
|
||||
* Arbitrary read-only SQL, via Hasura's `run_sql`.
|
||||
*
|
||||
* Reads only. A statement that writes is refused here — writes go through a
|
||||
* named command above, where they can carry their own guard.
|
||||
*/
|
||||
async function sql(statement) {
|
||||
if (/^\s*(insert|update|delete|drop|alter|truncate|create)\b/i.test(statement)) {
|
||||
console.error('This command runs reads only. Add a named command for a write.');
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
const endpoint = ENDPOINT.replace(/\/v1\/graphql$/, '/v2/query');
|
||||
const response = await fetch(endpoint, {
|
||||
method: 'POST',
|
||||
headers: { 'content-type': 'application/json', 'x-hasura-admin-secret': SECRET },
|
||||
body: JSON.stringify({
|
||||
type: 'run_sql',
|
||||
args: { source: 'default', sql: statement, read_only: true },
|
||||
}),
|
||||
});
|
||||
|
||||
const payload = await response.json().catch(() => null);
|
||||
if (!response.ok || !payload) {
|
||||
console.error(payload?.error ?? `HTTP ${response.status}`);
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
const rows = payload.result ?? [];
|
||||
for (const row of rows) console.log(row.join('\t'));
|
||||
console.log(`\n${Math.max(0, rows.length - 1)} rows`);
|
||||
}
|
||||
|
||||
/* ── Dispatch ─────────────────────────────────────────────────────────────── */
|
||||
|
||||
const [command, ...rest] = process.argv.slice(2);
|
||||
|
||||
const COMMANDS = {
|
||||
tables: () => tables(),
|
||||
user: () => user(rest[0]),
|
||||
setpw: () => setpw(rest[0], rest[1]),
|
||||
sql: () => sql(rest.join(' ')),
|
||||
};
|
||||
|
||||
if (!command || !COMMANDS[command]) {
|
||||
console.log(
|
||||
[
|
||||
'node scripts/db.mjs <command>',
|
||||
'',
|
||||
' tables every table Hasura has tracked',
|
||||
' user <email> show an account (never prints the password)',
|
||||
' setpw <email> <password> set a password on an account that has none',
|
||||
' sql "<select ...>" read-only SQL',
|
||||
].join('\n'),
|
||||
);
|
||||
process.exit(command ? 1 : 0);
|
||||
}
|
||||
|
||||
await COMMANDS[command]();
|
||||
Reference in New Issue
Block a user