82 行
2.7 KiB
JavaScript
82 行
2.7 KiB
JavaScript
require("dotenv/config");
|
|
|
|
const { Client } = require("pg");
|
|
|
|
const LOCAL_DATABASE_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
|
|
|
|
class DevSeedSafetyError extends Error {
|
|
constructor(code, message) {
|
|
super(message);
|
|
this.name = "DevSeedSafetyError";
|
|
this.code = code;
|
|
}
|
|
}
|
|
|
|
function refuse(code, message) {
|
|
throw new DevSeedSafetyError(code, message);
|
|
}
|
|
|
|
function validateDevSeedSafety(env = process.env) {
|
|
if (String(env.NODE_ENV || "").trim().toLowerCase() === "production") {
|
|
refuse("production_forbidden", "seed:dev is permanently disabled in production");
|
|
}
|
|
if (String(env.SEED_DEV_ALLOW || "").trim() !== "1") {
|
|
refuse("explicit_allow_required", "seed:dev requires the explicit local allow switch");
|
|
}
|
|
|
|
let databaseUrl;
|
|
try {
|
|
databaseUrl = new URL(String(env.DATABASE_URL || ""));
|
|
} catch {
|
|
refuse("database_url_invalid", "seed:dev requires a valid local PostgreSQL target");
|
|
}
|
|
if (!["postgres:", "postgresql:"].includes(databaseUrl.protocol)) {
|
|
refuse("database_protocol_invalid", "seed:dev requires a local PostgreSQL target");
|
|
}
|
|
|
|
let effectiveTarget;
|
|
try {
|
|
const client = new Client({ connectionString: databaseUrl.toString() });
|
|
effectiveTarget = {
|
|
host: String(client.host || "").toLowerCase(),
|
|
databaseName: String(client.database || "").trim(),
|
|
};
|
|
} catch {
|
|
refuse("database_url_invalid", "seed:dev requires a valid local PostgreSQL target");
|
|
}
|
|
if (!LOCAL_DATABASE_HOSTS.has(effectiveTarget.host)) {
|
|
refuse("database_host_not_local", "seed:dev only accepts a loopback database target");
|
|
}
|
|
|
|
const databaseName = decodeURIComponent(databaseUrl.pathname.replace(/^\/+/, "")).trim();
|
|
if (!databaseName || databaseName.includes("/") || effectiveTarget.databaseName !== databaseName) {
|
|
refuse("database_name_invalid", "seed:dev requires one explicit database name");
|
|
}
|
|
const confirmation = String(env.SEED_DEV_DATABASE_CONFIRM || "").trim();
|
|
if (!confirmation || confirmation !== databaseName) {
|
|
refuse("database_confirmation_mismatch", "seed:dev database confirmation does not match the target");
|
|
}
|
|
|
|
return {
|
|
databaseName,
|
|
resetPasswords: String(env.SEED_DEV_RESET_PASSWORDS || "").trim() === "1",
|
|
};
|
|
}
|
|
|
|
if (require.main === module) {
|
|
try {
|
|
const result = validateDevSeedSafety();
|
|
const passwordMode = result.resetPasswords ? "one_time_reset" : "preserve_existing";
|
|
console.log(`[seed-dev] safety check passed; passwordMode=${passwordMode}`);
|
|
} catch (error) {
|
|
const code = error instanceof DevSeedSafetyError ? error.code : "unexpected_error";
|
|
console.error(`[seed-dev][REFUSED] ${code}`);
|
|
process.exit(1);
|
|
}
|
|
}
|
|
|
|
module.exports = {
|
|
DevSeedSafetyError,
|
|
validateDevSeedSafety,
|
|
};
|