; reset replaces system identities and grants")
live <- newLiveConnections
- pure (ServerEnv backend rootName settingsFile config limiter live)
+ privileges <- newPrivileges backend
+ recovered <- writeSecurity (reconcileObjects privileges)
+ case recovered of
+ Left err -> ioError (userError ("object privilege recovery failed: " ++ show err))
+ Right () -> pure ()
+ sudo <- newMVar Nothing
+ pure (ServerEnv backend rootName settingsFile config limiter live sudo)
data ServerHandle = ServerHandle
{ shPort :: Int
@@ -136,18 +151,42 @@ startServer :: ServerEnv -> IO ServerHandle
startServer env = do
sock <- listenSocket (scHost (srvConfig env)) (scPort (srvConfig env))
port <- actualPort sock
+ enableSudo env port `onException` close sock
stopped <- newMVar False
_ <- forkIO (acceptLoop env sock stopped)
- pure (ServerHandle port (stopListening sock stopped))
+ pure (ServerHandle port (stopListening sock stopped `finally` disableSudo env))
-- | 在调用线程里收连接（可执行文件用）；绑好端口先回调一次
runServer :: ServerEnv -> (Int -> IO ()) -> IO ()
-runServer env announce = do
- sock <- listenSocket (scHost (srvConfig env)) (scPort (srvConfig env))
+runServer env announce = bracket (listenSocket (scHost (srvConfig env)) (scPort (srvConfig env))) close $ \sock -> do
port <- actualPort sock
- announce port
- stopped <- newMVar False
- acceptLoop env sock stopped
+ enableSudo env port
+ (do
+ announce port
+ stopped <- newMVar False
+ acceptLoop env sock stopped) `finally` disableSudo env
+
+-- 为显式配置的本机身份映射创建凭据。
+enableSudo :: ServerEnv -> Int -> IO ()
+enableSudo env port
+ | T.null user = pure ()
+ | not (isPlainIdentifier user) = ioError (userError "sudo_auth_user must be a plain identity name")
+ | otherwise = modifyMVar_ (srvSudo env) $ \current -> case current of
+ Just _ -> ioError (userError "sudo authentication is already running")
+ Nothing -> do
+ credential <- createSudoCredential port
+ hPutStrLn stderr ("sudo_auth enabled: local elevated identity -> " ++ T.unpack user)
+ pure (Just (port, user, credential))
+ where
+ user = scSudoUser (srvConfig env)
+
+-- 清理本次服务实例的本机认证凭据。
+disableSudo :: ServerEnv -> IO ()
+disableSudo env = modifyMVar_ (srvSudo env) $ \current -> do
+ case current of
+ Nothing -> pure ()
+ Just (port, _, _) -> removeSudoCredential port
+ pure Nothing
-- | 置停止标记并关掉监听套接字
stopListening :: Socket -> MVar Bool -> IO ()
@@ -209,10 +248,11 @@ reportConnection env conn = do
-- | 一个连接一个会话：一行一条 JSON，读到 EOF 就收工
serveConnection :: ServerEnv -> Socket -> IO ()
serveConnection env conn = do
+ peer <- getPeerName conn
h <- socketToHandle conn ReadWriteMode
hSetBuffering h LineBuffering
hSetNewlineMode h noNewlineTranslation
- entry <- newLiveEntry
+ entry <- newLiveEntry (isLocalPeer peer)
unregister <- registerConnection (srvLive env) entry
session <- newSessionWith (srvBackend env) (srvRootName env) (srvSettingsFile env) (\names -> void (dropConnectionsOf (srvLive env) names))
outcome <- try (loop h session entry `finally` unregister) :: IO (Either IOException ())
@@ -250,11 +290,25 @@ dispatch env session entry request = case request of
| version == protocolVersion -> pure (RespHello protocolVersion, True)
| otherwise -> pure (RespError "bad_request" ("unsupported protocol version: " <> tshow version), True)
ReqLogin user password -> do
+ writeIORef (leChallenge entry) Nothing
response <- login env session user password
case response of
RespLogin who _ -> writeIORef (leWho entry) (Just who)
_ -> pure ()
pure (response, True)
+ ReqSudoChallenge -> do
+ configured <- readMVar (srvSudo env)
+ who <- sessionUser session
+ case configured of
+ Just _ | leLocal entry && who == Nothing -> do
+ nonce <- sudoChallenge
+ now <- getCurrentTime
+ writeIORef (leChallenge entry) (Just (nonce, now))
+ pure (RespSudoChallenge nonce, True)
+ _ -> pure (RespError "forbidden" "local sudo authentication is unavailable", True)
+ ReqSudoLogin user proof -> do
+ response <- sudoLogin env session entry user proof
+ pure (response, True)
ReqQuery sql -> do
who <- sessionUser session
response <- case who of
@@ -268,18 +322,10 @@ dispatch env session entry request = case request of
Right queryResult -> RespResult (trimResult (scMaxRows (srvConfig env)) queryResult)
pure (response, True)
ReqStorage payload -> do
- who <- sessionUser session
- response <- case who of
- Nothing -> pure (RespError "unauthorized" "sign in first")
- Just _ -> do
- admin <- sessionIsAdmin session
- if not admin
- then pure (RespError "forbidden" "administrator required")
- else do
- result <- beStorage (srvBackend env) payload
- pure $ case result of
- Left err -> RespError "storage_error" (T.pack err)
- Right value -> RespStorage value
+ result <- runStorageCoded session payload
+ let response = case result of
+ Left err -> RespError (sessCode err) (sessMessage err)
+ Right value -> RespStorage value
pure (response, True)
ReqCatalog -> do
response <- overSession session (catalog session) RespCatalog
@@ -302,6 +348,45 @@ dispatch env session entry request = case request of
ReqPing -> pure (RespPong, True)
ReqQuit -> pure (RespBye, False)
+-- 消费一次性证明并登录本机映射账号。
+sudoLogin :: ServerEnv -> Session -> LiveEntry -> Text -> Text -> IO ServerResponse
+sudoLogin env session entry user proof = do
+ challenge <- atomicModifyIORef' (leChallenge entry) (\value -> (Nothing, value))
+ configured <- readMVar (srvSudo env)
+ now <- getCurrentTime
+ who <- sessionUser session
+ let key = T.toLower (T.strip user)
+ mapped = maybe "" (\(_, name, _) -> name) configured
+ valid = leLocal entry && who == Nothing && key == mapped
+ && case configured of
+ Just (_, _, credential) -> validSudoChallenge credential now challenge key proof
+ Nothing -> False
+ blocked <- rateLimitBlock (srvLimiter env) key
+ response <- case blocked of
+ Just _ -> pure (RespError "too_many_attempts" "too many failed sudo logins")
+ Nothing | not valid -> do
+ rateLimitRecord (srvLimiter env) key
+ pure (RespError "unauthorized" "sudo authentication refused")
+ Nothing -> do
+ result <- authenticateSudoSessionCoded session key
+ case result of
+ Left err -> do
+ rateLimitRecord (srvLimiter env) key
+ pure (RespError (sessCode err) (sessMessage err))
+ Right () -> do
+ rateLimitClear (srvLimiter env) key
+ writeIORef (leWho entry) (Just key)
+ admin <- sessionIsAdmin session
+ pure (RespLogin key admin)
+ hPutStrLn stderr ("sudo_auth attempt: mapped_user=" ++ T.unpack mapped
+ ++ " local=" ++ show (leLocal entry) ++ " result=" ++ auditResult response)
+ pure response
+ where
+ -- 提取不包含凭据的认证审计结果。
+ auditResult RespLogin{} = "accepted"
+ auditResult (RespError code _) = T.unpack code
+ auditResult _ = "refused"
+
-- | 口令策略在线上只有两个数字：最短长度与至少几类字符
policyResponse :: PasswordPolicy -> ServerResponse
policyResponse (PasswordPolicy minLength classes) = RespPolicy minLength classes
diff --git a/chusql-server/test/Spec.hs b/chusql-server/test/Spec.hs
index 7e9642c..a18bf6a 100644
--- a/chusql-server/test/Spec.hs
+++ b/chusql-server/test/Spec.hs
@@ -5,18 +5,22 @@ module Main (main) where
import ChuSQL.Core.Engine.Storage.IPC (
Account (..),
- Request (ReqAccountReset, ReqAccountsList),
+ Request (ReqAccountCreate, ReqAccountReset, ReqAccountsList, ReqIdentityAlter),
TableInfo (..),
closeConnection,
localStorageLink,
setStorageLink,
)
import ChuSQL.Core.Engine.Syntax.AST (Statement)
+import Data.IORef (newIORef, readIORef, writeIORef)
import ChuSQL.Core.Engine.Syntax.Parser (parseStatement)
import ChuSQL.Core.Model (Database, Histogram (..), Row, Table (..), Value (..), pattern TInt, pattern TStr)
import ChuSQL.Interface.Auth (hashPasswordWith)
import ChuSQL.Interface.Protocol (ClientRequest (..), Grant (..), RoleView (..), ServerResponse (..), decodeRequest, encodeResponse)
import ChuSQL.Interface.RateLimit (newRateLimiter)
+import ChuSQL.Interface.Link (connectClient, closeClient, clientSudoLogin, clientQuery)
+import ChuSQL.Interface.Sudo (SudoCredential, newSudoCredential, sudoProof, verifySudoProof, validSudoChallenge,
+ createSudoCredential, removeSudoCredential, readSudoCredential, sudoPrivileged)
import ChuSQL.Server.Accounts (Principal (..), ensureRootAccount)
import ChuSQL.Server.Backend (Backend (..), StatementResult (..), ipcBackend, memoryBackend)
import ChuSQL.Server.Privileges (
@@ -25,24 +29,30 @@ import ChuSQL.Server.Privileges (
Privileges,
affectedAccounts,
authorize,
+ authorizeConnect,
+ claimObject,
+ prepareObject,
listRoleViews,
newPrivileges,
runPrivilegeCommand,
)
-import ChuSQL.Server.Session (QueryResult (..), Session, SessionError (..), newSession, runStatementCoded)
+import ChuSQL.Server.Session (QueryResult (..), Session, SessionError (..), newSession, runStatementCoded, runStorageCoded, authenticateSessionCoded)
import ChuSQL.Server.TCP (
ServerConfig (..),
- ServerEnv,
+ ServerEnv (..),
ServerHandle (..),
defaultServerConfig,
loadServerConfigAt,
newServerEnv,
startServer,
+ isLocalPeer,
)
import Control.Concurrent (forkIO, threadDelay)
-import Control.Concurrent.MVar (MVar, newEmptyMVar, newMVar, putMVar, takeMVar)
+import Control.Concurrent.MVar (MVar, modifyMVar_, newEmptyMVar, newMVar, putMVar, takeMVar)
+import System.Timeout (timeout)
import Control.Exception (IOException, bracket, finally, try)
import Control.Monad (void)
+import Data.List (sort)
import Data.Aeson (decode)
import qualified Data.Aeson as A
import qualified Data.Aeson.Key as K
@@ -54,9 +64,12 @@ import Data.Maybe (fromMaybe)
import Data.Text (Text)
import qualified Data.Text as T
import qualified Data.Vector as V
-import Data.Time.Clock (getCurrentTime)
+import Data.Time.Clock (addUTCTime, getCurrentTime)
import Network.Socket (
AddrInfo (..),
+ SockAddr (..),
+ tupleToHostAddress,
+ tupleToHostAddress6,
SocketType (Stream),
addrAddress,
addrFamily,
@@ -81,7 +94,6 @@ import System.IO (
hSetNewlineMode,
noNewlineTranslation,
)
-import System.Timeout (timeout)
import Test.Hspec hiding (after, before)
-- TCP 服务器测试：协议编解码、配置读取与真连服务器的端到端用例。
@@ -93,9 +105,119 @@ main = hspec spec
-- | 全部用例
spec :: Spec
spec = do
+ describe "sudo authentication" $ do
+ it "defaults to disabled and rejects unconfigured TCP authentication" $
+ withTcpServer defaultServerConfig $ \_ handle -> withConnection handle $ \client -> do
+ scSudoUser defaultServerConfig `shouldBe` ""
+ challenge <- tcpTalk client "{\"method\":\"sudo_challenge\"}"
+ at "code" challenge `shouldBe` A.String "forbidden"
+ denied <- tcpTalk client "{\"method\":\"sudo_login\",\"user\":\"admin\",\"proof\":\"fake\"}"
+ at "code" denied `shouldBe` A.String "unauthorized"
+ it "loads an explicit normalized local identity mapping" $ do
+ path <- tempSettingsPath "sudo-config"
+ writeFile path (unlines ["[server]", "sudo_auth_user = " ++ show ("Local_User" :: String)])
+ config <- loadServerConfigAt path `finally` removeIfExists path
+ scSudoUser config `shouldBe` "local_user"
+ it "supports the client challenge and login exchange" $
+ withTestSudo $ \_ handle credential -> do
+ connected <- connectClient "127.0.0.1" (shPort handle)
+ case connected of
+ Left message -> expectationFailure (T.unpack message)
+ Right client -> (do
+ clientSudoLogin client credential "local_user" >>= (`shouldBe` Right False)
+ result <- clientQuery client "select 1"
+ result `shouldSatisfy` isRightResult) `finally` closeClient client
+ it "only treats kernel loopback addresses as local" $ do
+ isLocalPeer (SockAddrInet 7777 (tupleToHostAddress (127, 0, 0, 1))) `shouldBe` True
+ isLocalPeer (SockAddrInet 7777 (tupleToHostAddress (192, 168, 1, 2))) `shouldBe` False
+ isLocalPeer (SockAddrInet6 7777 0 (tupleToHostAddress6 (0,0,0,0,0,0,0,1)) 0) `shouldBe` True
+ isLocalPeer (SockAddrInet6 7777 0 (tupleToHostAddress6 (0,0,0,0,0,65535,32512,1)) 0) `shouldBe` True
+ isLocalPeer (SockAddrInet6 7777 0 (tupleToHostAddress6 (0,0,0,0,0,65535,49320,1)) 0) `shouldBe` False
+ it "binds proofs to the instance, challenge, account and expiration" $ do
+ credential <- newSudoCredential
+ other <- newSudoCredential
+ now <- getCurrentTime
+ let proof = sudoProof credential "nonce" "local_user"
+ verifySudoProof credential "nonce" "LOCAL_USER" proof `shouldBe` True
+ verifySudoProof other "nonce" "local_user" proof `shouldBe` False
+ verifySudoProof credential "other" "local_user" proof `shouldBe` False
+ verifySudoProof credential "nonce" "admin" proof `shouldBe` False
+ validSudoChallenge credential now (Just ("nonce", addUTCTime (-61) now)) "local_user" proof `shouldBe` False
+ validSudoChallenge credential now (Just ("nonce", addUTCTime 1 now)) "local_user" proof `shouldBe` False
+ validSudoChallenge credential now Nothing "local_user" proof `shouldBe` False
+ it "requires an OS elevated identity to provision or read credentials" $ do
+ privileged <- sudoPrivileged
+ if privileged then do
+ bracket (createSudoCredential 65534) (const (removeSudoCredential 65534)) $ \credential -> do
+ stored <- readSudoCredential 65534
+ case stored of
+ Left message -> expectationFailure (T.unpack message)
+ Right restored -> sudoProof restored "native" "local_user" `shouldBe` sudoProof credential "native" "local_user"
+ duplicate <- try (createSudoCredential 65534) :: IO (Either IOException SudoCredential)
+ duplicate `shouldSatisfy` isLeftResult
+ else do
+ created <- try (createSudoCredential 65534) :: IO (Either IOException SudoCredential)
+ created `shouldSatisfy` isLeftResult
+ readSudoCredential 65534 >>= (`shouldSatisfy` isLeftResult)
+ it "logs in an ordinary mapped identity without elevating its privileges" $
+ withTestSudo $ \_ handle credential -> withConnection handle $ \client -> do
+ answer <- tcpSudo client credential "local_user"
+ at "status" answer `shouldBe` A.String "ok"
+ at "admin" answer `shouldBe` A.Bool False
+ denied <- tcpQuery client "create database forbidden"
+ at "code" denied `shouldBe` A.String "forbidden"
+ it "rejects a forged proof and consumes its challenge" $
+ withTestSudo $ \_ handle credential -> withConnection handle $ \client -> do
+ nonce <- tcpTalk client "{\"method\":\"sudo_challenge\"}"
+ denied <- tcpTalk client "{\"method\":\"sudo_login\",\"user\":\"local_user\",\"proof\":\"forged\"}"
+ at "code" denied `shouldBe` A.String "unauthorized"
+ replay <- tcpSudoProof client "local_user" (sudoProof credential (asText (at "challenge" nonce)) "local_user")
+ at "code" replay `shouldBe` A.String "unauthorized"
+ it "rejects proof reuse on another connection and account mapping" $
+ withTestSudo $ \_ handle credential -> withConnection handle $ \first -> withConnection handle $ \second -> do
+ nonce <- tcpTalk first "{\"method\":\"sudo_challenge\"}"
+ let proof = sudoProof credential (asText (at "challenge" nonce)) "local_user"
+ replay <- tcpSudoProof second "local_user" proof
+ at "code" replay `shouldBe` A.String "unauthorized"
+ mismatch <- tcpSudo first credential "admin"
+ at "code" mismatch `shouldBe` A.String "unauthorized"
+ it "revokes the attribute and drops existing sudo sessions" $
+ withTestSudo $ \_ handle credential -> withConnection handle $ \admin -> withConnection handle $ \client -> do
+ _ <- tcpLogin admin testRootName testRootPassword
+ _ <- tcpSudo client credential "local_user"
+ changed <- tcpQuery admin "alter user local_user noallow_sudo_auth"
+ at "status" changed `shouldBe` A.String "result"
+ expired <- tcpQuery client "select 1"
+ at "code" expired `shouldBe` A.String "unauthorized"
+ tcpClosed client
+ withConnection handle $ \fresh -> do
+ denied <- tcpSudo fresh credential "local_user"
+ at "code" denied `shouldBe` A.String "unauthorized"
+ it "rejects disabled and NOLOGIN identities" $
+ withTestSudo $ \_ handle credential -> withConnection handle $ \admin -> do
+ _ <- tcpLogin admin testRootName testRootPassword
+ mapM_ (checkSudoDisabled admin handle credential)
+ ["alter user local_user disabled", "alter user local_user enabled nologin"]
+ it "does not inherit sudo authentication from a role" $
+ withTestSudo $ \_ handle credential -> withConnection handle $ \admin -> do
+ _ <- tcpLogin admin testRootName testRootPassword
+ _ <- tcpQuery admin "create role sudo_role"
+ _ <- tcpQuery admin "alter role sudo_role allow_sudo_auth"
+ _ <- tcpQuery admin "grant sudo_role to local_user"
+ _ <- tcpQuery admin "alter user local_user noallow_sudo_auth"
+ withConnection handle $ \client -> do
+ denied <- tcpSudo client credential "local_user"
+ at "code" denied `shouldBe` A.String "unauthorized"
+ it "keeps password login independent of the sudo attribute" $
+ withTestSudo $ \_ handle _ -> withConnection handle $ \client -> do
+ denied <- tcpLogin client "local_user" ""
+ at "code" denied `shouldBe` A.String "unauthorized"
+ accepted <- tcpLogin client "local_user" "Local-Pass123!"
+ at "status" accepted `shouldBe` A.String "ok"
tcpSpec
tcpServerSpec
privilegeSpec
+ objectPrivilegeSpec
transactionSpec
ipcConcurrencySpec
identitySpec
@@ -118,7 +240,7 @@ identitySpec = describe "unified identities" $ do
switched <- tcpQuery manager "use system"
asText (at "status" switched) `shouldBe` "result"
mapM_ (\sql -> tcpQuery manager sql >>= \reply -> asText (at "code" reply) `shouldBe` "forbidden")
- ["alter user manager superuser", "alter user managed system_catalog_manager", "alter user admin identified by 'Another-Pass123!'", "create database forbidden"]
+ ["alter user manager superuser", "alter user managed system_catalog_manager", "alter user managed allow_sudo_auth", "alter user admin identified by 'Another-Pass123!'", "create database forbidden"]
it "does not inherit catalog management through role membership" $ withTcpServer defaultServerConfig $ \_ handle ->
withConnection handle $ \admin -> withConnection handle $ \worker -> do
_ <- tcpLogin admin "admin" "s3cret"
@@ -139,7 +261,7 @@ identitySpec = describe "unified identities" $ do
other <- tcpQuery h "create role alice"
asText (at "code" other) `shouldBe` "conflict"
shown <- tcpQuery h "show roles"
- map asText (items (at "columns" shown)) `shouldBe` ["id", "name", "can_login", "is_superuser", "enabled", "system_catalog_manager", "created_at"]
+ map asText (items (at "columns" shown)) `shouldBe` ["id", "name", "can_login", "is_superuser", "enabled", "system_catalog_manager", "allow_sudo_auth", "created_at"]
asInt (at "rowCount" shown) `shouldBe` 3
reader <- tcpQuery h "alter role reader login nologin"
asText (at "code" reader) `shouldBe` "bad_request"
@@ -697,7 +819,7 @@ tcpServerSpec = do
-- | 一个普通账号
testAccount :: Account
-testAccount = Account 0 "alice" "" 0 "" Nothing True False True False
+testAccount = Account 0 "alice" "" 0 "" Nothing True False True False False
-- | 权限用例传的当前库名
testDatabase :: Text
@@ -707,7 +829,10 @@ testDatabase = T.pack testDatabaseName
withPrivileges :: (Privileges -> Principal -> IO a) -> IO a
withPrivileges body = do
db <- newMVar testDb
- service <- newPrivileges (memoryBackend testDatabaseName db)
+ let backend = memoryBackend testDatabaseName db
+ _ <- beAccounts backend (ReqAccountCreate "alice" "hash")
+ _ <- beAccounts backend (ReqAccountCreate "bob" "hash")
+ service <- newPrivileges backend
body service (Root testRootName)
-- | 解析一条 SQL，失败就丢掉用例
@@ -747,7 +872,7 @@ privilegeSpec = describe "server privileges" $ do
views <- listRoleViews service
fmap (concatMap (map grantPrivilege) . map roleGrants) views
`shouldBe` Right ["select", "insert", "update", "delete"]
- fmap (concatMap (map grantObject) . map roleGrants) views `shouldBe` Right (replicate 4 "*")
+ fmap (concatMap (map grantObject) . map roleGrants) views `shouldBe` Right (replicate 4 "test.*")
it "revokes a privilege again" $ withPrivileges $ \service root -> do
_ <- runPrivilegeCommand service root testDatabase (CreateRoleCommand "reader")
@@ -919,12 +1044,12 @@ privilegeSpec = describe "server privileges" $ do
_ <- runPrivilegeCommand service root testDatabase (GrantRoleCommand "inner" ["reader"])
_ <- runPrivilegeCommand service root testDatabase (GrantRoleCommand "reader" ["alice"])
directly <- affectedAccounts service (RevokeRoleCommand "inner" ["bob"])
- directly `shouldMatchList` ["bob"]
+ fmap sort directly `shouldBe` Right ["bob"]
granted <- affectedAccounts service (GrantRoleCommand "writer" ["inner"])
- granted `shouldMatchList` ["inner", "reader", "alice"]
+ fmap sort granted `shouldBe` Right (sort ["inner", "reader", "alice"])
dropped <- affectedAccounts service (DropRoleCommand "inner")
- dropped `shouldMatchList` ["inner", "reader", "alice"]
- affectedAccounts service (CreateRoleCommand "other") `shouldReturn` []
+ fmap sort dropped `shouldBe` Right (sort ["inner", "reader", "alice"])
+ affectedAccounts service (CreateRoleCommand "other") `shouldReturn` Right []
it "keeps the role tables on the real storage" $ withIpcStorage $ do
base <- ipcBackend
@@ -944,6 +1069,7 @@ privilegeSpec = describe "server privileges" $ do
it "inherits a role on the real storage" $ withIpcStorage $ do
base <- ipcBackend
+ seedPrivilegeObjects base
service <- newPrivileges base
_ <- runPrivilegeCommand service (Root testRootName) testDatabase (CreateRoleCommand "reader")
_ <- runPrivilegeCommand service (Root testRootName) testDatabase (CreateRoleCommand "writer")
@@ -955,6 +1081,7 @@ privilegeSpec = describe "server privileges" $ do
it "keeps a grant option on the real storage" $ withIpcStorage $ do
base <- ipcBackend
+ seedPrivilegeObjects base
service <- newPrivileges base
_ <- runPrivilegeCommand service (Root testRootName) testDatabase (CreateRoleCommand "reader")
_ <- runPrivilegeCommand service (Root testRootName) testDatabase (CreateRoleCommand "writer")
@@ -968,6 +1095,239 @@ privilegeSpec = describe "server privileges" $ do
fmap (map roleGrants) after `shouldBe` Right [[Grant "reader" "select" "test.users" True], [Grant "writer" "select" "test.users" False]]
-- 真存储夹具：一个用例一份数据目录，跑完关链路删干净
+-- 创建独立的对象授权内存夹具。
+withObjectPrivileges :: (Backend -> Privileges -> Principal -> IO ()) -> IO ()
+withObjectPrivileges body = do
+ db <- newMVar testDb
+ let backend = memoryBackend testDatabaseName db
+ mapM_ (\name -> beAccounts backend (ReqAccountCreate name "hash") >>= either (fail . show) (const (pure ()))) ["alice", "bob", "carol"]
+ service <- newPrivileges backend
+ body backend service (Root testRootName)
+
+-- 验证对象作用域、授权来源和外部入口。
+objectPrivilegeSpec :: Spec
+objectPrivilegeSpec = describe "stable object privileges" $ do
+ it "migrates old table grants once and ignores later legacy writes" $ withObjectPrivileges $ \backend service _ -> do
+ let system = beWithDatabase backend "system"
+ mustRun (beStatement system "CREATE TABLE __system_grants (role VARCHAR(64), privilege VARCHAR(16), object VARCHAR(128))")
+ mustRun (beStatement system "INSERT INTO __system_grants (role, privilege, object) VALUES ('alice', 'select', 'test.users')")
+ authorizeSql service (Ordinary testAccount) "SELECT * FROM users" `shouldReturn` Right ()
+ mustRun (beStatement system "INSERT INTO __system_grants (role, privilege, object) VALUES ('bob', 'select', 'test.users')")
+ authorizeSql service (Ordinary testAccount{accountUser = "bob"}) "SELECT * FROM users" `shouldReturn` Left (PrivilegeError "forbidden" "permission denied: SELECT ON users")
+ it "recovers a durable creator intent after table creation and cancels absent objects" $ withIpcStorage $ do
+ backend <- ipcBackend
+ seedPrivilegeObjects backend
+ service <- newPrivileges backend
+ prepareObject service (Ordinary testAccount) "test" "recovered_owned" `shouldReturn` Right ()
+ mustRun (beStatement (beWithDatabase backend "test") "CREATE TABLE recovered_owned (id INT)")
+ closeConnection
+ dir <- ipcDataDir
+ opened <- localStorageLink (Just (dir ++ ".toml"))
+ link <- either fail pure opened
+ setStorageLink link
+ fresh <- ipcBackend >>= newPrivileges
+ authorizeSql fresh (Ordinary testAccount) "SELECT * FROM recovered_owned" `shouldReturn` Right ()
+ prepareObject fresh (Ordinary testAccount) "test" "never_created" `shouldReturn` Right ()
+ authorizeSql fresh (Ordinary testAccount) "SELECT * FROM recovered_owned" `shouldReturn` Right ()
+ mustRun (beStatement (beWithDatabase backend "test") "CREATE TABLE never_created (id INT)")
+ authorizeSql fresh (Ordinary testAccount) "SELECT * FROM never_created" `shouldReturn` Left (PrivilegeError "forbidden" "permission denied: SELECT ON never_created")
+ it "holds authorization through a concurrent query and orders revocation after it" $ withObjectPrivileges $ \backend service root -> do
+ runPrivilegeCommand service root testDatabase (GrantPrivilegesCommand ["select"] "users" "alice" False) `shouldReturn` Right ()
+ _ <- beAccounts backend (ReqAccountCreate testRootName (testPasswordHash testRootPassword))
+ _ <- beAccounts backend (ReqIdentityAlter testRootName Nothing (Just True) Nothing Nothing Nothing)
+ _ <- beAccounts backend (ReqAccountReset "alice" (testPasswordHash "Alice-Secret-1234"))
+ started <- newEmptyMVar
+ release <- newEmptyMVar
+ finished <- newEmptyMVar
+ revoked <- newEmptyMVar
+ let slow = backend{beWithDatabase = \name -> (beWithDatabase backend name){beStatement = \sql -> do
+ if sql == "SELECT * FROM users" then putMVar started () >> takeMVar release else pure ()
+ beStatement (beWithDatabase backend name) sql}}
+ settings <- tempSettingsPath "permission-race"
+ reader <- newSession slow testRootName settings
+ admin <- newSession backend testRootName settings
+ authenticateSessionCoded reader "alice" "Alice-Secret-1234" `shouldReturn` Right ()
+ authenticateSessionCoded admin testRootName testRootPassword `shouldReturn` Right ()
+ _ <- mustSql reader "USE test"
+ _ <- mustSql admin "USE test"
+ _ <- forkIO (runStatementCoded reader "SELECT * FROM users" >>= putMVar finished)
+ takeMVar started
+ _ <- forkIO (runStatementCoded admin "REVOKE SELECT ON users FROM alice" >>= putMVar revoked)
+ blocked <- timeout 100000 (takeMVar revoked)
+ case blocked of Nothing -> pure (); Just _ -> expectationFailure "revocation raced past an authorized query"
+ putMVar release ()
+ takeMVar finished >>= either (expectationFailure . show) (const (pure ()))
+ takeMVar revoked >>= either (expectationFailure . show) (const (pure ()))
+ result <- runStatementCoded reader "SELECT * FROM users"
+ case result of Left err -> sessCode err `shouldBe` "forbidden"; Right _ -> expectationFailure "revoked privilege remained active"
+ it "requires existing objects and validates database privilege scope" $ withObjectPrivileges $ \_ service root -> do
+ runPrivilegeCommand service root testDatabase (GrantPrivilegesCommand ["select"] "missing" "alice" False)
+ `shouldReturn` Left (PrivilegeError "not_found" "unknown table")
+ runPrivilegeCommand service root testDatabase (GrantPrivilegesCommand ["select"] "database:test" "alice" False)
+ `shouldReturn` Left (PrivilegeError "bad_request" "invalid privilege for object scope")
+ it "applies PUBLIC CONNECT defaults and explicit inherited connections" $ withObjectPrivileges $ \_ service root -> do
+ authorizeConnect service (Ordinary testAccount) "test" `shouldReturn` Right ()
+ runPrivilegeCommand service root "" (RevokePrivilegesCommand ["connect"] "database:test" "public") `shouldReturn` Right ()
+ authorizeConnect service (Ordinary testAccount) "test" `shouldReturn` Left (PrivilegeError "forbidden" "permission denied: CONNECT ON database:test")
+ runPrivilegeCommand service root "" (CreateRoleCommand "connector") `shouldReturn` Right ()
+ runPrivilegeCommand service root "" (GrantPrivilegesCommand ["connect"] "database:test" "connector" False) `shouldReturn` Right ()
+ runPrivilegeCommand service root "" (GrantRoleCommand "connector" ["alice"]) `shouldReturn` Right ()
+ authorizeConnect service (Ordinary testAccount) "test" `shouldReturn` Right ()
+ runPrivilegeCommand service root "" (GrantPrivilegesCommand ["connect"] "database:test" "public" False) `shouldReturn` Right ()
+ it "grants CREATE without granting existing table access" $ withObjectPrivileges $ \_ service root -> do
+ runPrivilegeCommand service root "" (GrantPrivilegesCommand ["create"] "database:test" "alice" False) `shouldReturn` Right ()
+ authorizeSql service (Ordinary testAccount) "CREATE TABLE owned (id INT)" `shouldReturn` Right ()
+ authorizeSql service (Ordinary testAccount) "SELECT * FROM users" `shouldReturn` Left (PrivilegeError "forbidden" "permission denied: SELECT ON users")
+ it "gives table owners management and delegation without giving database management" $ withObjectPrivileges $ \_ service root -> do
+ claimObject service (Ordinary testAccount) testDatabase "users" `shouldReturn` Right ()
+ authorizeSql service (Ordinary testAccount) "DROP TABLE users" `shouldReturn` Right ()
+ authorizeSql service (Ordinary testAccount) "INSERT INTO users (id) VALUES (10)" `shouldReturn` Right ()
+ runPrivilegeCommand service (Ordinary testAccount) testDatabase (GrantPrivilegesCommand ["select"] "users" "bob" False) `shouldReturn` Right ()
+ authorizeSql service (Ordinary testAccount) "DROP DATABASE test" `shouldReturn` Left (PrivilegeError "forbidden" "object owner required")
+ runPrivilegeCommand service root testDatabase (RevokePrivilegesCommand ["select"] "users" "alice") `shouldReturn` Right ()
+ authorizeSql service (Ordinary testAccount) "SELECT * FROM users" `shouldReturn` Right ()
+ it "cascades multihop delegations after the source grant is revoked" $ withObjectPrivileges $ \_ service root -> do
+ runPrivilegeCommand service root testDatabase (GrantPrivilegesCommand ["select"] "users" "alice" True) `shouldReturn` Right ()
+ runPrivilegeCommand service (Ordinary testAccount) testDatabase (GrantPrivilegesCommand ["select"] "users" "bob" True) `shouldReturn` Right ()
+ let bob = Ordinary testAccount{accountUser = "bob"}
+ runPrivilegeCommand service bob testDatabase (GrantPrivilegesCommand ["select"] "users" "carol" False) `shouldReturn` Right ()
+ affectedAccounts service (RevokePrivilegesCommand ["select"] "users" "alice") `shouldReturn` Right ["alice", "bob", "carol"]
+ runPrivilegeCommand service root testDatabase (RevokePrivilegesCommand ["select"] "users" "alice") `shouldReturn` Right ()
+ authorizeSql service (Ordinary testAccount{accountUser = "carol"}) "SELECT * FROM users"
+ `shouldReturn` Left (PrivilegeError "forbidden" "permission denied: SELECT ON users")
+ it "keeps an independent source when another delegation chain is revoked" $ withObjectPrivileges $ \_ service root -> do
+ runPrivilegeCommand service root testDatabase (GrantPrivilegesCommand ["select"] "users" "alice" True) `shouldReturn` Right ()
+ runPrivilegeCommand service (Ordinary testAccount) testDatabase (GrantPrivilegesCommand ["select"] "users" "bob" False) `shouldReturn` Right ()
+ runPrivilegeCommand service root testDatabase (GrantPrivilegesCommand ["select"] "users" "bob" False) `shouldReturn` Right ()
+ runPrivilegeCommand service root testDatabase (RevokePrivilegesCommand ["select"] "users" "alice") `shouldReturn` Right ()
+ authorizeSql service (Ordinary testAccount{accountUser = "bob"}) "SELECT * FROM users" `shouldReturn` Right ()
+ it "removes delegations whose grantor loses an inherited source" $ withObjectPrivileges $ \_ service root -> do
+ runPrivilegeCommand service root testDatabase (CreateRoleCommand "delegator") `shouldReturn` Right ()
+ runPrivilegeCommand service root testDatabase (GrantPrivilegesCommand ["select"] "users" "delegator" True) `shouldReturn` Right ()
+ runPrivilegeCommand service root testDatabase (GrantRoleCommand "delegator" ["alice"]) `shouldReturn` Right ()
+ runPrivilegeCommand service (Ordinary testAccount) testDatabase (GrantPrivilegesCommand ["select"] "users" "bob" False) `shouldReturn` Right ()
+ runPrivilegeCommand service root testDatabase (RevokeRoleCommand "delegator" ["alice"]) `shouldReturn` Right ()
+ authorizeSql service (Ordinary testAccount{accountUser = "bob"}) "SELECT * FROM users" `shouldReturn` Left (PrivilegeError "forbidden" "permission denied: SELECT ON users")
+ it "does not preserve circular delegation after its last independent root is revoked" $ withObjectPrivileges $ \_ service root -> do
+ runPrivilegeCommand service root testDatabase (GrantPrivilegesCommand ["select"] "users" "alice" True) `shouldReturn` Right ()
+ runPrivilegeCommand service (Ordinary testAccount) testDatabase (GrantPrivilegesCommand ["select"] "users" "bob" True) `shouldReturn` Right ()
+ runPrivilegeCommand service (Ordinary testAccount{accountUser = "bob"}) testDatabase (GrantPrivilegesCommand ["select"] "users" "alice" True) `shouldReturn` Right ()
+ runPrivilegeCommand service root testDatabase (RevokePrivilegesCommand ["select"] "users" "alice") `shouldReturn` Right ()
+ authorizeSql service (Ordinary testAccount{accountUser = "bob"}) "SELECT * FROM users" `shouldReturn` Left (PrivilegeError "forbidden" "permission denied: SELECT ON users")
+ it "never transfers a dropped table's grant to a same-name replacement" $ withObjectPrivileges $ \backend service root -> do
+ runPrivilegeCommand service root testDatabase (GrantPrivilegesCommand ["select"] "users" "alice" False) `shouldReturn` Right ()
+ mustRun (beStatement backend "DROP TABLE users")
+ mustRun (beStatement backend "CREATE TABLE users (id INT)")
+ authorizeSql service (Ordinary testAccount) "SELECT * FROM users" `shouldReturn` Left (PrivilegeError "forbidden" "permission denied: SELECT ON users")
+ it "does not let disabled grantors keep downstream grants alive" $ withObjectPrivileges $ \backend service root -> do
+ runPrivilegeCommand service root testDatabase (GrantPrivilegesCommand ["select"] "users" "alice" True) `shouldReturn` Right ()
+ runPrivilegeCommand service (Ordinary testAccount) testDatabase (GrantPrivilegesCommand ["select"] "users" "bob" False) `shouldReturn` Right ()
+ changed <- beAccounts backend (ReqIdentityAlter "alice" Nothing Nothing (Just False) Nothing Nothing)
+ either expectationFailure (const (pure ())) changed
+ authorizeSql service (Ordinary testAccount{accountUser = "bob"}) "SELECT * FROM users" `shouldReturn` Left (PrivilegeError "forbidden" "permission denied: SELECT ON users")
+ it "preserves dormant direct grants and ownership across unrelated ACL writes" $ withObjectPrivileges $ \backend service root -> do
+ runPrivilegeCommand service root testDatabase (GrantPrivilegesCommand ["select"] "users" "alice" False) `shouldReturn` Right ()
+ mustRun (beStatement backend "CREATE TABLE owned (id INT)")
+ claimObject service (Ordinary testAccount) testDatabase "owned" `shouldReturn` Right ()
+ changed <- beAccounts backend (ReqIdentityAlter "alice" Nothing Nothing (Just False) Nothing Nothing)
+ either expectationFailure (const (pure ())) changed
+ runPrivilegeCommand service root testDatabase (GrantPrivilegesCommand ["select"] "users" "bob" False) `shouldReturn` Right ()
+ enabled <- beAccounts backend (ReqIdentityAlter "alice" Nothing Nothing (Just True) Nothing Nothing)
+ either expectationFailure (const (pure ())) enabled
+ authorizeSql service (Ordinary testAccount) "SELECT * FROM users" `shouldReturn` Right ()
+ authorizeSql service (Ordinary testAccount) "DROP TABLE owned" `shouldReturn` Right ()
+ it "keeps same-name tables in separate database scopes and persists the ACL" $ withIpcStorage $ do
+ backend <- ipcBackend
+ seedPrivilegeObjects backend
+ mustRun (beStatement backend "CREATE DATABASE other")
+ mustRun (beStatement (beWithDatabase backend "other") "CREATE TABLE users (id INT)")
+ service <- newPrivileges backend
+ runPrivilegeCommand service (Root testRootName) "test" (GrantPrivilegesCommand ["select"] "users" "alice" False) `shouldReturn` Right ()
+ statement <- parseOrFail "SELECT * FROM users"
+ authorize service (Ordinary testAccount) "other" statement `shouldReturn` Left (PrivilegeError "forbidden" "permission denied: SELECT ON users")
+ closeConnection
+ dir <- ipcDataDir
+ opened <- localStorageLink (Just (dir ++ ".toml"))
+ link <- either fail pure opened
+ setStorageLink link
+ fresh <- ipcBackend >>= newPrivileges
+ authorize fresh (Ordinary testAccount) "test" statement `shouldReturn` Right ()
+ authorize fresh (Ordinary testAccount) "other" statement `shouldReturn` Left (PrivilegeError "forbidden" "permission denied: SELECT ON users")
+ it "checks CONNECT and CREATE through TCP and assigns ownership to the creator" $
+ withTcpServer defaultServerConfig $ \_ handle -> withConnection handle $ \admin -> do
+ _ <- tcpLogin admin "admin" "s3cret"
+ _ <- tcpQuery admin "CREATE USER object_owner IDENTIFIED BY 'Owner-Secret-1234'"
+ tcpQuery admin "REVOKE CONNECT ON DATABASE test FROM PUBLIC" >>= \reply -> at "status" reply `shouldBe` A.String "result"
+ withConnection handle $ \client -> do
+ _ <- tcpLogin client "object_owner" "Owner-Secret-1234"
+ tcpQuery client "USE test" >>= \reply -> at "code" reply `shouldBe` A.String "forbidden"
+ _ <- tcpQuery admin "GRANT CONNECT, CREATE ON DATABASE test TO object_owner"
+ withConnection handle $ \client -> do
+ _ <- tcpLogin client "object_owner" "Owner-Secret-1234"
+ tcpQuery client "USE test" >>= \reply -> at "status" reply `shouldBe` A.String "result"
+ tcpQuery client "CREATE TABLE owned_probe (id INT)" >>= \reply -> at "status" reply `shouldBe` A.String "result"
+ tcpQuery client "INSERT INTO owned_probe (id) VALUES (1)" >>= \reply -> at "status" reply `shouldBe` A.String "result"
+ tcpQuery client "SELECT * FROM users" >>= \reply -> at "code" reply `shouldBe` A.String "forbidden"
+ tcpTalk client "{\"method\":\"storage\",\"request\":{\"method\":\"scan\",\"database\":\"test\",\"table\":\"users\"}}" >>= \reply -> at "code" reply `shouldBe` A.String "forbidden"
+ it "disconnects downstream TCP grantees and protects staged commits after revocation" $
+ withTcpServer defaultServerConfig $ \_ handle -> withConnection handle $ \admin -> do
+ _ <- tcpLogin admin "admin" "s3cret"
+ _ <- tcpQuery admin "USE test"
+ _ <- tcpQuery admin "CREATE USER source_user IDENTIFIED BY 'Source-Secret-1234'"
+ _ <- tcpQuery admin "CREATE USER target_user IDENTIFIED BY 'Target-Secret-1234'"
+ _ <- tcpQuery admin "GRANT SELECT, UPDATE ON users TO source_user WITH GRANT OPTION"
+ withConnection handle $ \source -> do
+ _ <- tcpLogin source "source_user" "Source-Secret-1234"
+ _ <- tcpQuery source "USE test"
+ _ <- tcpQuery source "GRANT SELECT, UPDATE ON users TO target_user"
+ withConnection handle $ \target -> do
+ _ <- tcpLogin target "target_user" "Target-Secret-1234"
+ _ <- tcpQuery target "USE test"
+ _ <- tcpQuery target "BEGIN"
+ _ <- tcpQuery target "UPDATE users SET age = 90 WHERE id = 1"
+ _ <- tcpQuery admin "REVOKE UPDATE ON users FROM source_user"
+ tcpQuery target "COMMIT" >>= \reply -> at "code" reply `shouldBe` A.String "unauthorized"
+ tcpClosed target
+ reply <- tcpQuery admin "SELECT age FROM users WHERE id = 1"
+ map items (items (at "rows" reply)) `shouldBe` [[A.Number 21]]
+ it "rejects a stale local transaction after a granted object is replaced" $ withObjectPrivileges $ \backend service root -> do
+ runPrivilegeCommand service root testDatabase (GrantPrivilegesCommand ["all"] "users" "alice" False) `shouldReturn` Right ()
+ _ <- beAccounts backend (ReqAccountReset "alice" (testPasswordHash "Alice-Secret-1234"))
+ settings <- tempSettingsPath "object-transaction"
+ _ <- beAccounts backend (ReqAccountCreate testRootName (testPasswordHash testRootPassword))
+ _ <- beAccounts backend (ReqIdentityAlter testRootName Nothing (Just True) Nothing Nothing Nothing)
+ session <- newSession backend testRootName settings
+ authenticateSessionCoded session "alice" "Alice-Secret-1234" `shouldReturn` Right ()
+ _ <- mustSql session "USE test"
+ _ <- mustSql session "BEGIN"
+ _ <- mustSql session "UPDATE users SET age = 90 WHERE id = 1"
+ mustRun (beStatement backend "DROP TABLE users")
+ mustRun (beStatement backend "CREATE TABLE users (id INT, name VARCHAR(32), age INT)")
+ result <- runStatementCoded session "COMMIT"
+ case result of Left err -> sessCode err `shouldBe` "forbidden"; Right _ -> expectationFailure "stale transaction committed"
+ it "checks the current administrator identity before executing a raw storage request" $ withObjectPrivileges $ \backend _ _ -> do
+ _ <- beAccounts backend (ReqAccountCreate testRootName (testPasswordHash testRootPassword))
+ _ <- beAccounts backend (ReqIdentityAlter testRootName Nothing (Just True) Nothing Nothing Nothing)
+ _ <- beAccounts backend (ReqAccountCreate "spare_admin" "hash")
+ _ <- beAccounts backend (ReqIdentityAlter "spare_admin" Nothing (Just True) Nothing Nothing Nothing)
+ executed <- newIORef False
+ let guarded = backend{beStorage = \_ -> writeIORef executed True >> pure (Right A.Null)}
+ settings <- tempSettingsPath "raw-storage-identity"
+ session <- newSession guarded testRootName settings
+ authenticateSessionCoded session testRootName testRootPassword `shouldReturn` Right ()
+ changed <- beAccounts backend (ReqIdentityAlter testRootName Nothing (Just False) Nothing Nothing Nothing)
+ either expectationFailure (const (pure ())) changed
+ result <- runStorageCoded session (A.object ["method" A..= ("ping" :: Text)])
+ case result of Left err -> sessCode err `shouldBe` "unauthorized"; Right _ -> expectationFailure "stale administrator executed storage request"
+ readIORef executed `shouldReturn` False
+
+-- 为权限测试创建真实对象和登录身份。
+seedPrivilegeObjects :: Backend -> IO ()
+seedPrivilegeObjects backend = do
+ mustRun (beStatement backend "CREATE DATABASE test")
+ mustRun (beStatement (beWithDatabase backend "test") "CREATE TABLE users (id INT)")
+ result <- beAccounts backend (ReqAccountCreate "alice" "hash")
+ case result of Left err -> expectationFailure err; Right _ -> pure ()
-- | 本次用例的数据目录（用例串行跑，固定名够用）
ipcDataDir :: IO FilePath
@@ -1058,6 +1418,27 @@ intValues rows = [n | row <- rows, Just (VInt n) <- [nth 0 row]]
-- | 显式事务用例
transactionSpec :: Spec
transactionSpec = describe "server transactions" $ do
+ it "preserves concurrent changes in a large untouched table" $ withTwoSessions $ \first second -> do
+ _ <- mustSql first "CREATE TABLE untouched (id INT, value INT)"
+ let values = T.intercalate "," [T.pack ("(" ++ show key ++ ",0)") | key <- [1 .. 5000 :: Int]]
+ _ <- mustSql first ("INSERT INTO untouched (id,value) VALUES " <> values)
+ _ <- mustSql first "BEGIN"
+ _ <- mustSql first "UPDATE users SET age = 77 WHERE id = 1"
+ _ <- mustSql second "UPDATE untouched SET value = 9 WHERE id = 5000"
+ _ <- mustSql first "COMMIT"
+ sessionAge first 1 `shouldReturn` Just 77
+ result <- mustSql first "SELECT value FROM untouched WHERE id = 5000"
+ qrRows result `shouldBe` [[VInt 9]]
+
+ it "preserves staged row order for unsorted integer ids" $ withMemorySession $ \session -> do
+ _ <- mustSql session "CREATE TABLE keys (id INT, value INT)"
+ _ <- mustSql session "INSERT INTO keys (id,value) VALUES (7,0),(-3,0),(4,0)"
+ _ <- mustSql session "BEGIN"
+ _ <- mustSql session "UPDATE keys SET value = 1"
+ _ <- mustSql session "COMMIT"
+ result <- mustSql session "SELECT id FROM keys"
+ qrRows result `shouldBe` [[VInt 7], [VInt (-3)], [VInt 4]]
+
it "filters qualified memory tables and preserves other databases on writes" $ do
let local = Table "users" [("id", TInt)] [[("id", VInt 1)]] Nothing
otherTable = Table "users" [("id", TInt)] [[("id", VInt 2)]] Nothing
@@ -1504,3 +1885,46 @@ ipcConcurrencySpec = describe "server backend on the real storage" $ do
intColumn "id" rows `shouldBe` [1]
intColumn "age" rows `shouldBe` [31]
+
+-- 判断明确错误返回。
+isLeftResult :: Either a b -> Bool
+isLeftResult (Left _) = True
+isLeftResult _ = False
+
+-- 启动带独立本机认证凭据的测试会话。
+withTestSudo :: (ServerEnv -> ServerHandle -> SudoCredential -> IO a) -> IO a
+withTestSudo body = withTcpServer defaultServerConfig $ \env handle -> do
+ credential <- newSudoCredential
+ withConnection handle $ \admin -> do
+ _ <- tcpLogin admin testRootName testRootPassword
+ created <- tcpQuery admin "create user local_user identified by 'Local-Pass123!'"
+ at "status" created `shouldBe` A.String "result"
+ enabled <- tcpQuery admin "alter user local_user allow_sudo_auth"
+ at "status" enabled `shouldBe` A.String "result"
+ modifyMVar_ (srvSudo env) (const (pure (Just (0, "local_user", credential))))
+ body env handle credential `finally` modifyMVar_ (srvSudo env) (const (pure Nothing))
+
+-- 交换本机挑战并提交账号绑定证明。
+tcpSudo :: Handle -> SudoCredential -> Text -> IO A.Value
+tcpSudo client credential user = do
+ challenge <- tcpTalk client "{\"method\":\"sudo_challenge\"}"
+ tcpSudoProof client user (sudoProof credential (asText (at "challenge" challenge)) user)
+
+-- 发送本机认证证明。
+tcpSudoProof :: Handle -> Text -> Text -> IO A.Value
+tcpSudoProof client user proof = tcpTalk client (BL.toStrict (A.encode (A.object
+ ["method" A..= ("sudo_login" :: Text), "user" A..= user, "proof" A..= proof])))
+
+-- 验证身份禁用或取消登录后拒绝本机认证。
+checkSudoDisabled :: Handle -> ServerHandle -> SudoCredential -> Text -> IO ()
+checkSudoDisabled admin handle credential sql = do
+ changed <- tcpQuery admin sql
+ at "status" changed `shouldBe` A.String "result"
+ withConnection handle $ \client -> do
+ denied <- tcpSudo client credential "local_user"
+ at "code" denied `shouldBe` A.String "unauthorized"
+
+-- 判断明确成功返回。
+isRightResult :: Either a b -> Bool
+isRightResult (Right _) = True
+isRightResult _ = False
diff --git a/chusql-web/chusql-web.cabal b/chusql-web/chusql-web.cabal
index 3e5768c..afb0815 100644
--- a/chusql-web/chusql-web.cabal
+++ b/chusql-web/chusql-web.cabal
@@ -20,6 +20,7 @@ library
, aeson
, bytestring
, chusql-core-model
+ , chusql-core-engine
, chusql-interface
, containers
, directory
diff --git a/chusql-web/src/ChuSQL/Web/API.hs b/chusql-web/src/ChuSQL/Web/API.hs
index 96f19fc..2d0e99f 100644
--- a/chusql-web/src/ChuSQL/Web/API.hs
+++ b/chusql-web/src/ChuSQL/Web/API.hs
@@ -21,7 +21,9 @@ module ChuSQL.Web.API (
) where
import ChuSQL.Core.Model (Row, Value (..))
-import ChuSQL.Core.Protocol (Account (..), QueryResult (..), SchemaColumn (..), TableInfo (..))
+import ChuSQL.Core.Engine.Syntax.AST (Statement (BeginTransaction, CommitTransaction, RollbackTransaction))
+import ChuSQL.Core.Engine.Syntax.Parser (parseStatement)
+import ChuSQL.Core.Protocol (Account (..), QueryResult (..), SchemaColumn (..), TableInfo (..), valueToJSON)
import ChuSQL.Interface.AccountTable (accountColumns, accountTableName, isAccountTable, passwordColumn, systemTableInfo)
import ChuSQL.Interface.Actions (
ColumnSpec (..),
@@ -108,16 +110,19 @@ import ChuSQL.Web.UISettings (
writeUISettings,
)
import Control.Concurrent.MVar (MVar, modifyMVar, newMVar, withMVar)
+import Control.Concurrent (forkIO, threadDelay)
import Control.Exception (IOException, try)
+import Control.Monad (forever, when)
import Data.Aeson (FromJSON (..), eitherDecode, object, withObject, (.:), (.=))
import qualified Data.Aeson as A
import qualified Data.Aeson.Key as K
import qualified Data.Aeson.KeyMap as KM
import qualified Data.ByteString as BS
import qualified Data.ByteString.Lazy as BL
-import Data.IORef (IORef, newIORef, readIORef, writeIORef)
+import Data.IORef (IORef, atomicModifyIORef', newIORef, readIORef, writeIORef)
import Data.List (nub, sortBy)
import qualified Data.Map.Strict as Map
+import qualified Data.Set as Set
import Data.Maybe (catMaybes, fromMaybe)
import Data.Scientific (fromFloatDigits)
import Data.Text (Text)
@@ -176,6 +181,7 @@ data AppEnv = AppEnv
, aeUISettingsFile :: FilePath
, aeEffective :: Map.Map Text Text
, aeLog :: Text -> IO ()
+ , aeReaperStarted :: IORef Bool
}
-- | 一条网页会话：TCP 连接、登录状态与账号名
@@ -184,6 +190,12 @@ data WebSession = WebSession
, wsSession :: Session
, wsUser :: Text
, wsAdmin :: Bool
+ , wsEditor :: Session
+ , wsEditorClient :: Client
+ , wsEdit :: IORef (Maybe (Text, Text))
+ , wsEditReceipt :: IORef (Maybe (Text, A.Value, A.Value))
+ , wsEditEnded :: IORef (Set.Set Text)
+ , wsConsole :: IORef (Maybe (Text, Text))
}
-- | 会话 Cookie 名
@@ -201,6 +213,7 @@ newAppEnvAt :: FilePath -> Text -> Int -> RateLimiter -> FilePath -> IO AppEnv
newAppEnvAt settingsFile host port limiter staticDir = do
sessions <- newPayloadStore getCurrentTime defaultSessionPolicy
liveRef <- newIORef defaultLive
+ reaperStarted <- newIORef False
uiSettingsFile <- resolveUISettingsFileSafe
pure
AppEnv
@@ -215,6 +228,7 @@ newAppEnvAt settingsFile host port limiter staticDir = do
, aeUISettingsFile = uiSettingsFile
, aeEffective = Map.empty
, aeLog = const (pure ())
+ , aeReaperStarted = reaperStarted
}
-- | 系统库：账号表住在这里，只有管理员能进
@@ -256,6 +270,12 @@ liveBodyLimit env = lvBodyLimit <$> readLive env
-- | 组装 WAI 应用：路由外套四层中间件
webApp :: AppEnv -> IO Application
webApp env = do
+ started <- atomicModifyIORef' (aeReaperStarted env) (\old -> (True, old))
+ when (not started) $ do
+ _ <- forkIO $ forever $ do
+ threadDelay 60000000
+ sweepWebSessions env
+ pure ()
inner <- scottyApp (routes env)
locks <- newMVar Map.empty
pure (securityHeaders (sameOriginOnly (bodyLimitDynamic (liveBodyLimit env) (serializeSessions locks inner))))
@@ -318,6 +338,10 @@ routes env = do
post "/api/roles/:name/members" (withDatabase env addRoleMemberH)
delete "/api/roles/:name/members/:user" (withDatabase env removeRoleMemberH)
post "/api/query" (withDatabase env queryH)
+ post "/api/query/rollback" (rollbackConsoleH env)
+ post "/api/edit/begin" (beginEditH env)
+ post "/api/edit/commit" (commitEditH env)
+ post "/api/edit/rollback" (rollbackEditH env)
notFound (notFoundH env)
-- | 先认会话，再按请求头切本会话的库
@@ -331,7 +355,18 @@ withDatabase env action = do
if chosen == systemDatabase && not (wsAdmin ws)
then reply403 "the system database is only available to the administrator"
else do
- ready <- liftIO (if T.null chosen then pure (Right ()) else switchDatabase (wsSession ws) chosen)
+ editing <- header "X-ChuSQL-Edit"
+ req <- request
+ let snapshotRead = editing /= Nothing && requestMethod req == "GET" && take 2 (pathInfo req) == ["api", "tables"]
+ console <- liftIO (readIORef (wsConsole ws))
+ caller <- consoleOwner
+ case console of
+ Just (owner, database) | not snapshotRead &&
+ (pathInfo req /= ["api", "query"] || caller /= owner || (not (T.null chosen) && chosen /= database)) ->
+ apiError "conflict" "another SQL console owns this connection transaction; commit or rollback there first"
+ _ -> pure ()
+ current <- liftIO (sessionDatabase (wsSession ws))
+ ready <- liftIO (if T.null chosen || chosen == current || snapshotRead then pure (Right ()) else switchDatabase (wsSession ws) chosen)
case ready of
Left message -> serverError message
Right () -> action env
@@ -347,11 +382,31 @@ requireDatabaseName ws = do
-- | 取本请求的会话，没有令牌就 401
requireSession :: AppEnv -> ActionM WebSession
requireSession env = do
+ liftIO (sweepWebSessions env)
token <- requestSessionToken >>= maybe (apiError "unauthorized" "sign in first") pure
found <- liftIO (lookupPayload (aeSessions env) token)
case found of
Nothing -> apiError "unauthorized" "sign in first"
- Just (_, ws) -> pure ws
+ Just (_, ws) -> do
+ editHeader <- fmap TL.toStrict <$> header "X-ChuSQL-Edit"
+ req <- request
+ case editHeader of
+ Just editId | requestMethod req == "GET" && take 2 (pathInfo req) == ["api", "tables"] -> do
+ active <- liftIO (readIORef (wsEdit ws))
+ database <- maybe "" (T.toLower . TL.toStrict) <$> header "X-ChuSQL-Database"
+ case active of
+ Just (owner, name) | owner == editId && name == database ->
+ pure ws {wsSession = wsEditor ws, wsClient = wsEditorClient ws}
+ _ -> apiError "conflict" "the editing snapshot is no longer available; rollback and reload"
+ _ -> pure ws
+
+-- | 关闭网页会话的两个服务端连接。
+closeWebSession :: WebSession -> IO ()
+closeWebSession ws = endEdit ws >> writeIORef (wsConsole ws) Nothing >> closeClient (wsEditorClient ws) >> closeClient (wsClient ws)
+
+-- | 清理过期会话与未提交快照。
+sweepWebSessions :: AppEnv -> IO ()
+sweepWebSessions env = sweepPayloads (aeSessions env) >>= mapM_ closeWebSession
-- | 管理员专属操作
requireAdminSession :: AppEnv -> ActionM WebSession
@@ -388,7 +443,7 @@ createDatabaseH env = do
-- | 删除数据库；系统库 system 一律拒绝。
dropDatabaseH :: AppEnv -> ActionM ()
dropDatabaseH env = do
- ws <- requireAdminSession env
+ ws <- requireSession env
name <- pathParam "name"
if reservedDatabase name
then reply400 "bad_request" "the system database cannot be dropped"
@@ -443,8 +498,7 @@ healthH = json (object ["status" .= ("ok" :: Text)])
-- | 探活：回进程与存储状态，顺带清理过期会话
statusH :: AppEnv -> ActionM ()
statusH env = do
- expired <- liftIO (sweepPayloads (aeSessions env))
- liftIO (mapM_ (closeClient . wsClient) expired)
+ liftIO (sweepWebSessions env)
opened <- liftIO (connectClient (aeServerHost env) (aeServerPort env))
case opened of
Left message -> json (object ["status" .= ("ok" :: Text), "storage" .= ("down" :: Text), "detail" .= message])
@@ -504,7 +558,21 @@ openSession env user password = do
else serverError message
Right () -> do
admin <- liftIO (sessionIsAdmin session)
- token <- liftIO (createPayloadSession (aeSessions env) user (WebSession client session user admin))
+ openedEditor <- liftIO (connectClient (aeServerHost env) (aeServerPort env))
+ editorClient <- case openedEditor of
+ Left message -> liftIO (closeClient client) >> serverError message
+ Right connected -> pure connected
+ editor <- liftIO (newSession editorClient)
+ editorSigned <- liftIO (authenticateSession editor user password)
+ case editorSigned of
+ Left message -> liftIO (closeClient editorClient >> closeClient client) >> serverError message
+ Right () -> pure ()
+ edit <- liftIO (newIORef Nothing)
+ receipt <- liftIO (newIORef Nothing)
+ ended <- liftIO (newIORef Set.empty)
+ console <- liftIO (newIORef Nothing)
+ liftIO (sweepWebSessions env)
+ token <- liftIO (createPayloadSession (aeSessions env) user (WebSession client session user admin editor editorClient edit receipt ended console))
liftIO (rateLimitClear (aeLimiter env) user)
setHeader "Set-Cookie" (TL.fromStrict (sessionCookie env token (Just (lvSessionMax live))))
liftIO (aeLog env ("sign-in ok user=" <> user))
@@ -513,6 +581,7 @@ openSession env user password = do
-- | 退出：收掉会话与连接，清除 Cookie
logoutH :: AppEnv -> ActionM ()
logoutH env = do
+ liftIO (sweepWebSessions env)
token <- requestSessionToken
case token of
Nothing -> pure ()
@@ -520,7 +589,7 @@ logoutH env = do
gone <- liftIO (dropPayload (aeSessions env) t)
case gone of
Nothing -> pure ()
- Just ws -> liftIO (closeClient (wsClient ws))
+ Just ws -> liftIO (closeWebSession ws)
setHeader "Set-Cookie" (TL.fromStrict (sessionCookie env "" (Just 0)))
status status204
@@ -1036,7 +1105,6 @@ createTableH :: AppEnv -> ActionM ()
createTableH env = do
ws <- requireSession env
_ <- requireDatabaseName ws
- adminOnly ws
withJsonObject env $ \o -> case decodeCreateTable o of
Left err -> reply400 "bad_request" err
Right spec -> case createTableSql spec of
@@ -1048,7 +1116,6 @@ dropTableH :: AppEnv -> ActionM ()
dropTableH env = do
ws <- requireSession env
_ <- requireDatabaseName ws
- adminOnly ws
name <- pathParam "t"
account <- accountRoute ws name
if account
@@ -1117,7 +1184,6 @@ createIndexH :: AppEnv -> ActionM ()
createIndexH env = do
ws <- requireSession env
_ <- requireDatabaseName ws
- adminOnly ws
name <- pathParam "t"
account <- accountRoute ws name
if account
@@ -1137,7 +1203,6 @@ dropIndexH :: AppEnv -> ActionM ()
dropIndexH env = do
ws <- requireSession env
_ <- requireDatabaseName ws
- adminOnly ws
name <- pathParam "t"
column <- pathParam "col"
account <- accountRoute ws name
@@ -1156,7 +1221,6 @@ dropColumnH :: AppEnv -> ActionM ()
dropColumnH env = do
ws <- requireSession env
_ <- requireDatabaseName ws
- adminOnly ws
name <- pathParam "t"
column <- pathParam "col"
account <- accountRoute ws name
@@ -1233,7 +1297,7 @@ dropRoleH env = do
-- | 给角色加权限
grantRoleH :: AppEnv -> ActionM ()
grantRoleH env = do
- ws <- requireAdminSession env
+ ws <- requireSession env
role <- pathParam "name"
withJsonObject env $ \o -> case grantFields o of
Left err -> reply400 "bad_request" err
@@ -1243,7 +1307,7 @@ grantRoleH env = do
-- | 收角色的权限
revokeRoleH :: AppEnv -> ActionM ()
revokeRoleH env = do
- ws <- requireAdminSession env
+ ws <- requireSession env
role <- pathParam "name"
withJsonObject env $ \o -> case grantFields o of
Left err -> reply400 "bad_request" err
@@ -1418,7 +1482,219 @@ columnTypeText cols name = case [c | c <- cols, scName c == T.unpack name] of
(c : _) -> T.pack (scType c)
[] -> ""
--- | 查询接口：校验请求体后执行 SQL
+-- | 校验编辑事务的页面与数据库标识。
+editIdentity :: A.Object -> Either Text (Text, Text)
+editIdentity o = do
+ owner <- textField "id" o
+ database <- textField "database" o
+ if T.null owner || T.length owner > 128 || not (isPlainIdentifier database)
+ then Left "invalid edit identity or database"
+ else Right (owner, T.toLower database)
+
+-- | 开始或确认同一页面的编辑快照。
+beginEditH :: AppEnv -> ActionM ()
+beginEditH env = do
+ ws <- requireSession env
+ withJsonObject env $ \o -> case editIdentity o of
+ Left message -> reply400 "bad_request" message
+ Right identity@(owner, database) -> do
+ when (database == systemDatabase) (apiError "bad_request" "system identities cannot be edited in a data transaction")
+ active <- liftIO (readIORef (wsEdit ws))
+ ended <- liftIO (readIORef (wsEditEnded ws))
+ case active of
+ Just existing | existing == identity -> json (object ["state" .= ("active" :: Text), "id" .= owner])
+ Just _ -> apiError "conflict" "another page owns the editing transaction"
+ Nothing | Set.member owner ended -> apiError "conflict" "this editing transaction has already ended"
+ Nothing -> do
+ switched <- liftIO (switchDatabase (wsEditor ws) database)
+ either serverError pure switched
+ begun <- liftIO (runStatement (wsEditor ws) "BEGIN")
+ either serverError (const (pure ())) begun
+ saved <- liftIO (runStatement (wsEditor ws) "SAVEPOINT web_edit_base")
+ case saved of
+ Left message -> do
+ liftIO (closeClient (wsEditorClient ws))
+ serverError message
+ Right _ -> do
+ liftIO (writeIORef (wsEdit ws) (Just identity))
+ json (object ["state" .= ("active" :: Text), "id" .= owner])
+
+-- | 确认当前页面仍持有编辑事务。
+requireEdit :: WebSession -> (Text, Text) -> ActionM ()
+requireEdit ws identity = do
+ active <- liftIO (readIORef (wsEdit ws))
+ when (active /= Just identity) (apiError "conflict" "editing transaction is stale; rollback and reload")
+
+-- | 结束事务并禁止旧页面标识重新使用。
+endEdit :: WebSession -> IO ()
+endEdit ws = do
+ active <- readIORef (wsEdit ws)
+ case active of
+ Nothing -> pure ()
+ Just (owner, _) -> atomicModifyIORef' (wsEditEnded ws) (\ended -> (Set.insert owner ended, ()))
+ writeIORef (wsEdit ws) Nothing
+
+-- | 按表结构生成一条编辑语句。
+editStatement :: [TableInfo] -> A.Value -> Either Text Text
+editStatement infos (A.Object o) = do
+ name <- textField "table" o
+ operation <- textField "op" o
+ when (isAccountTable name) (Left "system identities cannot be edited in a data transaction")
+ info <- maybe (Left ("table not found: " <> name)) Right (findTable name infos)
+ sql <- case operation of
+ "insert" -> do
+ row <- valuesField o >>= readRowValues False (tiColumns info)
+ either (Left . T.pack) Right (insertRowSql name row)
+ "update" -> do
+ key <- editRowKey o
+ values <- case KM.lookup "set" o of
+ Just (A.Object assigns) -> Right assigns
+ _ -> Left "update requires a set object"
+ row <- readRowValues False (tiColumns info) values
+ either (Left . T.pack) Right (updateRowSql name key row)
+ "delete" -> do
+ key <- editRowKey o
+ either (Left . T.pack) Right (deleteRowSql name key)
+ _ -> Left "unknown edit operation"
+ pure (T.pack sql)
+editStatement _ _ = Left "each change must be an object"
+
+-- | 读取行编辑的整数主键。
+editRowKey :: A.Object -> Either Text Int
+editRowKey o = case KM.lookup "pk" o of
+ Just (A.String rawKey) -> maybe (Left "invalid row id") Right (readMaybe (T.unpack rawKey))
+ Just rawKey -> case A.fromJSON rawKey of
+ A.Success key -> Right key
+ A.Error _ -> Left "invalid row id"
+ Nothing -> Left "missing row id"
+
+-- | 顺序执行编辑集并定位首个错误。
+runEditStatements :: Session -> Int -> [Text] -> IO (Either (Int, Text) ())
+runEditStatements _ _ [] = pure (Right ())
+runEditStatements session index (sql : rest) = do
+ result <- runStatement session sql
+ case result of
+ Left message -> pure (Left (index, message))
+ Right _ -> runEditStatements session (index + 1) rest
+
+-- | 返回明确的事务失败状态。
+editFailure :: Text -> Text -> Maybe Int -> Bool -> ActionM ()
+editFailure stateName message index reload = do
+ let code = errorCodeOf message
+ status (if code == "unauthorized" then status401 else if reload || code == "serialization_failure" then status409 else statusOf code)
+ json (object ["ok" .= False, "applied" .= (0 :: Int), "state" .= stateName,
+ "reloadRequired" .= reload, "error" .= code, "message" .= message,
+ "errors" .= [object ["index" .= index, "message" .= message]]])
+
+-- | 回退提交失败的暂存语句并保留快照。
+resetEditAfterFailure :: WebSession -> Maybe Int -> Text -> ActionM ()
+resetEditAfterFailure ws index message = do
+ reset <- liftIO (runStatement (wsEditor ws) "ROLLBACK TO SAVEPOINT web_edit_base")
+ case reset of
+ Right _ -> editFailure "active" message index False
+ Left resetError -> do
+ liftIO (endEdit ws >> closeClient (wsEditorClient ws))
+ editFailure "lost" (message <> "; rollback failed: " <> resetError) index True
+
+-- | 原子提交跨表编辑集并缓存成功回执。
+commitEditH :: AppEnv -> ActionM ()
+commitEditH env = do
+ ws <- requireSession env
+ withJsonObject env $ \o -> case (editIdentity o, KM.lookup "changes" o) of
+ (Right identity@(owner, _), Just (A.Array entries)) -> do
+ receipt <- liftIO (readIORef (wsEditReceipt ws))
+ case receipt of
+ Just (old, submitted, result) | old == owner && submitted == A.Object o -> json result
+ Just (old, _, _) | old == owner -> apiError "conflict" "transaction already committed with a different edit set"
+ _ -> do
+ requireEdit ws identity
+ found <- liftIO (catalog (wsEditor ws))
+ infos <- case found of
+ Left message -> do
+ when (errorCodeOf message == "unauthorized") (liftIO (endEdit ws >> closeWebSession ws))
+ serverError message
+ Right tables -> pure tables
+ case mapM (editStatement infos) (V.toList entries) of
+ Left message -> editFailure "active" ("bad_request: " <> message) Nothing False
+ Right statements -> do
+ reset <- liftIO (runStatement (wsEditor ws) "ROLLBACK TO SAVEPOINT web_edit_base")
+ case reset of
+ Left message -> do
+ liftIO (endEdit ws >> closeClient (wsEditorClient ws))
+ editFailure "lost" message Nothing True
+ finish
+ Right _ -> pure ()
+ staged <- liftIO (runEditStatements (wsEditor ws) 0 statements)
+ case staged of
+ Left (index, message) -> resetEditAfterFailure ws (Just index) message
+ Right () -> do
+ committed <- liftIO (runStatement (wsEditor ws) "COMMIT")
+ case committed of
+ Right _ -> do
+ let result = object ["ok" .= True, "applied" .= V.length entries, "state" .= ("committed" :: Text)]
+ liftIO (endEdit ws >> writeIORef (wsEditReceipt ws) (Just (owner, A.Object o, result)))
+ json result
+ Left message | errorCodeOf message == "serialization_failure" -> do
+ rolledBack <- liftIO (runStatement (wsEditor ws) "ROLLBACK")
+ liftIO (endEdit ws)
+ case rolledBack of
+ Right _ -> editFailure "rolled_back" message Nothing True
+ Left err -> do
+ liftIO (closeClient (wsEditorClient ws))
+ editFailure "lost" (message <> "; rollback failed: " <> err) Nothing True
+ Left message | errorCodeOf message `elem` ["query_error", "bad_request", "forbidden"] -> resetEditAfterFailure ws Nothing message
+ Left message -> do
+ liftIO (endEdit ws >> closeClient (wsEditorClient ws))
+ editFailure "lost" (message <> "; commit outcome requires reload") Nothing True
+ _ -> reply400 "bad_request" "expected edit identity and a changes array"
+
+-- | 撤销页面持有的编辑事务。
+rollbackEditH :: AppEnv -> ActionM ()
+rollbackEditH env = do
+ ws <- requireSession env
+ withJsonObject env $ \o -> case editIdentity o of
+ Left message -> reply400 "bad_request" message
+ Right identity -> do
+ active <- liftIO (readIORef (wsEdit ws))
+ case active of
+ Nothing -> do
+ receipt <- liftIO (readIORef (wsEditReceipt ws))
+ let stateName = case receipt of
+ Just (owner, _, _) | owner == fst identity -> "committed" :: Text
+ _ -> "rolled_back"
+ json (object ["state" .= stateName])
+ Just _ -> do
+ requireEdit ws identity
+ result <- liftIO (runStatement (wsEditor ws) "ROLLBACK")
+ liftIO (endEdit ws)
+ case result of
+ Left message -> liftIO (closeClient (wsEditorClient ws)) >> serverError message
+ Right _ -> json (object ["state" .= ("rolled_back" :: Text)])
+
+-- | 读取 SQL 控制台的请求所有者。
+consoleOwner :: ActionM Text
+consoleOwner = do
+ owner <- maybe "legacy" TL.toStrict <$> header "X-ChuSQL-Console"
+ if T.null owner || T.length owner > 128 then apiError "bad_request" "invalid console identity" else pure owner
+
+-- | 回滚关闭页面或标签的控制台事务。
+rollbackConsoleH :: AppEnv -> ActionM ()
+rollbackConsoleH env = do
+ ws <- requireSession env
+ withJsonObject env $ \o -> case textField "console" o of
+ Left message -> reply400 "bad_request" message
+ Right owner -> do
+ active <- liftIO (readIORef (wsConsole ws))
+ case active of
+ Nothing -> status status204
+ Just (existing, _) | existing /= owner -> apiError "conflict" "another console owns this transaction"
+ Just _ -> do
+ result <- liftIO (runStatement (wsSession ws) "ROLLBACK")
+ case result of
+ Left message -> serverError message
+ Right _ -> liftIO (writeIORef (wsConsole ws) Nothing) >> status status204
+
+-- | 查询接口：校验请求体后执行 SQL。
queryH :: AppEnv -> ActionM ()
queryH env = do
ws <- requireSession env
@@ -1447,6 +1723,15 @@ executeSql ws live sql = do
case result of
Left message -> serverError message
Right res -> do
+ owner <- consoleOwner
+ case parseStatement (T.unpack sql) of
+ Right BeginTransaction -> do
+ database <- liftIO (sessionDatabase (wsSession ws))
+ liftIO (writeIORef (wsConsole ws) (Just (owner, database)))
+ Right CommitTransaction -> liftIO (writeIORef (wsConsole ws) Nothing)
+ Right RollbackTransaction -> liftIO (writeIORef (wsConsole ws) Nothing)
+ _ -> pure ()
+ transaction <- liftIO (readIORef (wsConsole ws))
let shown = take (lvMaxRows live) (qrRows res)
json
( object
@@ -1455,6 +1740,7 @@ executeSql ws live sql = do
, "rowCount" .= qrRowCount res
, "truncated" .= (qrTruncated res || qrRowCount res > lvMaxRows live)
, "database" .= qrDatabase res
+ , "transaction" .= (transaction /= Nothing)
]
)
@@ -1516,6 +1802,7 @@ valueJson (VInt n) = A.Number (fromIntegral n)
valueJson (VFloat d) = A.Number (fromFloatDigits d)
valueJson (VStr s) = A.String (T.pack s)
valueJson (VBool b) = A.Bool b
+valueJson value@VRuntime{} = valueToJSON value
-- | 一张表的线上信息：列、行数、索引与统计
tableInfoJson :: TableInfo -> A.Value
diff --git a/chusql-web/static/api.js b/chusql-web/static/api.js
index 2a801c5..1fdb9d4 100644
--- a/chusql-web/static/api.js
+++ b/chusql-web/static/api.js
@@ -2,6 +2,9 @@
// 请求都带 X-ChuSQL-Database 头；401 时广播登录事件。
export const AUTH_EVENT = 'chusql-auth-required';
+let editing = null;
+let consoleTransaction = null;
+const pageOwner = [...crypto.getRandomValues(new Uint8Array(16))].map((byte) => byte.toString(16).padStart(2, '0')).join('');
// 是否是普通对象。
function isObject(value) {
@@ -12,6 +15,9 @@ function isObject(value) {
async function request(url, init, database) {
const headers = new Headers(init && init.headers ? init.headers : undefined);
if (database) headers.set('X-ChuSQL-Database', database);
+ if (editing && editing.database === database && url.startsWith('/api/tables') && (!init || init.method === 'GET')) {
+ headers.set('X-ChuSQL-Edit', editing.id);
+ }
let response;
try {
response = await fetch(url, { credentials: 'same-origin', ...(init ?? {}), headers });
@@ -31,7 +37,10 @@ async function request(url, init, database) {
const message = isObject(body) && typeof body.message === 'string'
? body.message
: `请求失败（HTTP ${response.status}）。`;
- throw new Error(message);
+ const error = new Error(message);
+ error.result = body;
+ error.code = body?.error;
+ throw error;
}
return body;
}
@@ -215,33 +224,68 @@ export async function deleteRow(database, table, id) {
await request(`/api/tables/${encodeURIComponent(table)}/rows/${encodeURIComponent(id)}`, jsonInit('DELETE'), database);
}
-// 逐条提交，遇到第一条失败就停，返回已经成功了几条。
-export async function commitChanges(database, changes) {
- let applied = 0;
- for (const [index, change] of changes.entries()) {
- try {
- if (change.op === 'insert') await insertRow(database, change.table, change.values);
- else if (change.op === 'delete') await deleteRow(database, change.table, change.pk);
- else await updateRow(database, change.table, change.pk, change.set);
- applied += 1;
- } catch (error) {
- return { ok: false, applied, errors: [{ index, message: error instanceof Error ? error.message : String(error) }] };
- }
+// 为页面开启固定数据库的编辑快照。
+export async function beginEdit(id, database) {
+ await request('/api/edit/begin', jsonInit('POST', { id, database }));
+ editing = { id, database };
+}
+
+// 在服务端事务中原子提交编辑集。
+export async function commitChanges(id, database, changes) {
+ try {
+ const result = await request('/api/edit/commit', jsonInit('POST', { id, database, changes }));
+ if (!isObject(result) || result.ok !== true || result.state !== 'committed') throw new Error('服务器未返回可确认的提交结果。');
+ editing = null;
+ return result;
+ } catch (error) {
+ if (isObject(error.result) && typeof error.result.state === 'string') return error.result;
+ return { ok: false, applied: 0, state: error.result ? 'lost' : 'unknown',
+ reloadRequired: Boolean(error.result), message: error.message };
+ }
+}
+
+// 回滚编辑快照并清除本地事务标识。
+export async function rollbackEdit(id, database) {
+ const result = await request('/api/edit/rollback', jsonInit('POST', { id, database }));
+ editing = null;
+ return result;
+}
+
+// 忘记已失效的登录会话编辑标识。
+export function forgetEdit() {
+ editing = null;
+ consoleTransaction = null;
+}
+
+// 标签关闭时回滚它持有的控制台事务。
+export async function rollbackConsole(tabId) {
+ if (!consoleTransaction || consoleTransaction.console !== `${pageOwner}:${tabId ?? 'default'}`) return;
+ await request('/api/query/rollback', jsonInit('POST', { console: consoleTransaction.console }));
+ consoleTransaction = null;
+}
+
+// 页面离开时请求清理控制台事务。
+export function closeConsoleOnPagehide() {
+ if (consoleTransaction) {
+ navigator.sendBeacon('/api/query/rollback', new Blob([JSON.stringify({ console: consoleTransaction.console })], { type: 'application/json' }));
}
- return { ok: true, applied };
}
// ---------------------------------------------------------------- 查询
// 执行 SQL 并规整结果。
-export async function query(sql, database) {
+export async function query(sql, database, tabId) {
const started = performance.now();
try {
- const body = await request('/api/query', jsonInit('POST', { sql }), database);
+ const console = `${pageOwner}:${tabId ?? 'default'}`;
+ const init = jsonInit('POST', { sql });
+ init.headers['X-ChuSQL-Console'] = console;
+ const body = await request('/api/query', init, database);
if (!isObject(body) || !Array.isArray(body.columns) || !Array.isArray(body.rows)) {
throw new Error('服务器返回的查询结果无法识别。');
}
const durationMs = performance.now() - started;
+ consoleTransaction = body.transaction === true ? { console, database } : null;
return {
type: body.columns.length ? 'rows' : 'affected',
columns: body.columns,
@@ -249,6 +293,7 @@ export async function query(sql, database) {
affected: typeof body.rowCount === 'number' ? body.rowCount : 0,
truncated: body.truncated === true,
database: typeof body.database === 'string' ? body.database : undefined,
+ transactionActive: body.transaction === true,
durationMs,
};
} catch (error) {
diff --git a/chusql-web/static/app.js b/chusql-web/static/app.js
index c123bb8..1661910 100644
--- a/chusql-web/static/app.js
+++ b/chusql-web/static/app.js
@@ -46,6 +46,12 @@ const state = {
tabs: [],
activeId: undefined,
changes: createEmptyChangeSet(),
+ edit: null,
+ editStarting: null,
+ editAttempt: null,
+ editBusy: false,
+ editNeedsReload: false,
+ editUncertain: null,
insertSeq: 0,
messages: [],
tabSeq: 0,
@@ -301,8 +307,8 @@ function renderSidebar() {
变更
-
-
+
+
`;
}
@@ -364,7 +370,9 @@ function renderTableTab(el, tab) {
}
const columns = data.columns;
const keyColumn = columns.find((column) => column.name === 'id');
- const editable = Boolean(keyColumn);
+ const editable = Boolean(keyColumn) && tab.table !== accountsTable && Boolean(state.edit)
+ && data.editId === state.edit.id && !data.loading
+ && !state.editBusy && !state.editNeedsReload && !state.editUncertain;
const filters = data.filters ?? {};
const count = changeCount(state.changes);
@@ -413,8 +421,8 @@ function renderTableTab(el, tab) {
-
-
+
+
@@ -438,7 +446,7 @@ function renderTableTab(el, tab) {
${data.rows.length || stagedInserts.length ? '' : '这张表没有数据。
'}
${data.loading ? '加载中…
' : ''}
- ${editable ? '' : '这张表没有 id 列，只能浏览。
'}
+ ${editable ? '' : '当前表或事务状态仅允许浏览；系统身份请通过 SQL 管理。
'}
`;
}
@@ -650,8 +658,8 @@ function renderBottom() {
-
-
+
+
${state.bottomTab === 'changes' ? changeList : messages}
`;
@@ -694,19 +702,36 @@ async function loadWorkspace() {
// 切换当前数据库。
async function switchDatabase(name) {
+ if (state.editBusy || state.editStarting) return;
if (name === state.database) return;
if (changeCount(state.changes) > 0) {
log('warn', '请先提交或撤销当前库的修改，再切换数据库。');
renderSidebar();
return;
}
+ const previousEdit = state.edit ?? state.editAttempt;
+ state.editBusy = true;
+ afterChange();
+ try {
+ if (previousEdit) await api.rollbackEdit(previousEdit.id, previousEdit.database);
+ } catch (error) {
+ state.editBusy = false;
+ fail(error);
+ afterChange();
+ return;
+ }
+ state.edit = null;
+ state.editAttempt = null;
const result = await api.query(`USE ${name}`, state.database);
+ state.editBusy = false;
if (result.type === 'error') {
fail(new Error(result.message));
renderSidebar();
return;
}
state.database = result.database ?? name;
+ state.tabs = state.tabs.filter((entry) => entry.kind !== 'table');
+ state.activeId = state.tabs[0]?.id;
log('info', `已切换到数据库 ${state.database}`);
await loadWorkspace();
renderEditor();
@@ -732,10 +757,12 @@ async function openTable(database, name) {
// 加载表标签的一页数据。
async function loadTableData(tab) {
+ if (state.editBusy || state.editNeedsReload || state.editUncertain) return;
const data = tab.data;
data.loading = true;
renderEditor();
try {
+ if (tab.table !== accountsTable) await ensureEdit(tab.database);
const meta = await api.getTable(tab.database, tab.table);
const filters = Object.entries(data.filters ?? {})
.filter(([, expression]) => String(expression).trim().length > 0)
@@ -756,6 +783,7 @@ async function loadTableData(tab) {
data.offset = offset;
data.pageSize = pageSize;
data.error = null;
+ data.editId = state.edit?.id;
// 服务端做等值过滤，界面上的 like / 比较表达式再在本地收敛一次
data.rows = filters.length
? page.rows.filter((row) => filters.every((filter) => matchesFilter(row[filter.column], filter.expression)))
@@ -770,6 +798,28 @@ async function loadTableData(tab) {
}
}
+// 在首个数据表加载时固定编辑快照。
+async function ensureEdit(database) {
+ if (database !== state.database) throw new Error('请切换到表所属数据库后重新打开。');
+ if (state.edit) {
+ if (state.edit.database !== database) throw new Error('请先撤销当前数据库的编辑事务。');
+ return;
+ }
+ if (!state.editStarting) {
+ const edit = state.editAttempt ?? { id: [...crypto.getRandomValues(new Uint8Array(16))].map((byte) => byte.toString(16).padStart(2, '0')).join(''), database };
+ if (edit.database !== database) throw new Error('请先撤销之前的编辑快照，再切换数据库。');
+ state.editAttempt = edit;
+ const session = state.session;
+ state.editStarting = api.beginEdit(edit.id, database).then(() => {
+ if (state.session !== session) throw new Error('登录会话已更换，请重新加载。');
+ state.edit = edit;
+ state.editAttempt = null;
+ })
+ .finally(() => { state.editStarting = null; });
+ }
+ await state.editStarting;
+}
+
// 重新加载所有表标签。
async function reloadOpenTables() {
for (const tab of state.tabs) {
@@ -790,6 +840,7 @@ function unstageRow(table, pk) {
// 暂存单元格修改。
function stageUpdate(table, database, pk, column, oldValue, newValue) {
+ if (!canEdit(database)) return;
if (oldValue === newValue) state.changes.updates.delete(changeKey(table, pk, column));
else state.changes.updates.set(changeKey(table, pk, column), { table, database, pk, column, oldValue, newValue });
afterChange();
@@ -797,6 +848,7 @@ function stageUpdate(table, database, pk, column, oldValue, newValue) {
// 暂存新增行。
function stageInsert(table, database, values) {
+ if (!canEdit(database)) return;
state.insertSeq += 1;
const tempId = `new-${state.insertSeq}`;
state.changes.inserts.set(insertKey(table, tempId), { table, database, tempId, values });
@@ -805,6 +857,7 @@ function stageInsert(table, database, values) {
// 暂存删除行。
function stageDelete(table, database, pk, row) {
+ if (!canEdit(database)) return;
unstageRow(table, pk);
state.changes.deletes.set(deleteKey(table, pk), { table, database, pk, row });
afterChange();
@@ -819,6 +872,7 @@ function afterChange() {
// 撤下一条暂存变更。
function removeStaged(key) {
+ if (!canEdit(state.database)) return;
if (state.changes.updates.has(key)) state.changes.updates.delete(key);
else if (state.changes.inserts.has(key)) state.changes.inserts.delete(key);
else if (state.changes.deletes.has(key)) state.changes.deletes.delete(key);
@@ -826,48 +880,70 @@ function removeStaged(key) {
}
// 撤销全部暂存变更。
-function rollbackAll() {
- state.changes = createEmptyChangeSet();
- for (const tab of state.tabs) if (tab.selected) tab.selected.clear();
- log('info', '已撤销全部待提交变更。');
+async function rollbackAll() {
+ if (state.editBusy || state.editStarting) return;
+ state.editBusy = true;
afterChange();
+ try {
+ const edit = state.edit ?? state.editAttempt;
+ const result = edit ? await api.rollbackEdit(edit.id, edit.database) : null;
+ state.edit = null;
+ state.editAttempt = null;
+ state.editNeedsReload = false;
+ state.editUncertain = null;
+ state.changes = createEmptyChangeSet();
+ for (const tab of state.tabs) if (tab.selected) tab.selected.clear();
+ log('info', result?.state === 'committed' ? '先前提交已成功，现重新加载数据。' : '已回滚编辑事务，重新加载数据。');
+ state.editBusy = false;
+ await loadWorkspace();
+ await reloadOpenTables();
+ } catch (error) {
+ state.editNeedsReload = true;
+ fail(error);
+ } finally {
+ state.editBusy = false;
+ afterChange();
+ }
+}
+
+// 检查编辑事务与页面操作状态。
+function canEdit(database) {
+ return Boolean(state.edit) && state.edit.database === database && !state.editBusy
+ && !state.editNeedsReload && !state.editUncertain;
}
// 提交全部暂存变更。
async function commitAll() {
- const payload = toCommitPayload(state.changes);
+ if (state.editBusy || state.editStarting) return;
+ if (state.editNeedsReload || !state.edit) {
+ fail(new Error('编辑快照已失效，请撤销并重新加载后编辑。'));
+ return;
+ }
+ const payload = state.editUncertain ?? toCommitPayload(state.changes);
if (!payload.length) {
log('info', '没有待提交的变更。');
return;
}
- const database = state.database;
- const result = await api.commitChanges(database, payload);
+ state.editBusy = true;
+ afterChange();
+ const edit = state.edit;
+ const result = await api.commitChanges(edit.id, edit.database, payload);
+ if (state.edit !== edit) { state.editBusy = false; return; }
if (result.ok) {
+ state.edit = null;
+ state.editUncertain = null;
state.changes = createEmptyChangeSet();
for (const tab of state.tabs) if (tab.selected) tab.selected.clear();
log('info', `已提交 ${result.applied} 条变更。`);
setStatus(`已提交 ${result.applied} 条变更`);
} else {
- const failed = result.errors?.[0];
- // 成功的部分不再保留，失败的那条留在面板上等修正
- state.changes = createEmptyChangeSet();
- payload.slice(result.applied).forEach((change) => {
- if (change.op === 'insert') {
- state.insertSeq += 1;
- const tempId = `new-${state.insertSeq}`;
- state.changes.inserts.set(insertKey(change.table, tempId), { table: change.table, database, tempId, values: change.values });
- } else if (change.op === 'delete') {
- state.changes.deletes.set(deleteKey(change.table, change.pk), { table: change.table, database, pk: change.pk, row: {} });
- } else {
- for (const [column, value] of Object.entries(change.set)) {
- state.changes.updates.set(changeKey(change.table, change.pk, column), {
- table: change.table, database, pk: change.pk, column, oldValue: undefined, newValue: value,
- });
- }
- }
- });
- log('error', `提交在第 ${(failed?.index ?? 0) + 1} 条失败：${failed?.message ?? '未知错误'}（已成功 ${result.applied} 条）`);
+ state.editNeedsReload = result.reloadRequired === true;
+ state.editUncertain = result.state === 'unknown' ? payload : null;
+ log('error', `${result.message ?? '提交失败'}（事务状态：${result.state}）。${state.editNeedsReload
+ ? result.state === 'lost' ? '连接已失效，请重新登录，确认数据后重新编辑。' : '请撤销并重新加载，禁止覆盖其他会话修改。' : state.editUncertain
+ ? '结果尚未确认，编辑已冻结；再次提交仅查询同一提交结果。' : '全部修改已回退，编辑内容保留，可修正后重试。'}`);
}
+ state.editBusy = false;
await loadWorkspace();
await reloadOpenTables();
afterChange();
@@ -877,10 +953,31 @@ async function commitAll() {
// 运行 SQL 并展示结果。
async function runSql(tab) {
+ if (state.editBusy || state.editStarting || state.editUncertain || state.editNeedsReload) return;
+ if (changeCount(state.changes)) {
+ log('warn', '请先提交或撤销表格修改，再运行 SQL。');
+ return;
+ }
const sql = String(tab.sql ?? '').trim();
if (!sql) return;
+ state.editBusy = true;
+ afterChange();
+ const previousEdit = state.edit ?? state.editAttempt;
+ if (previousEdit) {
+ try {
+ await api.rollbackEdit(previousEdit.id, previousEdit.database);
+ state.edit = null;
+ state.editAttempt = null;
+ } catch (error) {
+ state.editBusy = false;
+ fail(error);
+ afterChange();
+ return;
+ }
+ }
setStatus('执行中…');
- const result = await api.query(sql, tab.database);
+ const result = await api.query(sql, tab.database, tab.id);
+ state.editBusy = false;
tab.result = result;
if (result.type === 'error') {
log('error', result.message ?? '执行失败');
@@ -888,6 +985,7 @@ async function runSql(tab) {
} else {
if (result.database && result.database !== state.database) {
state.database = result.database;
+ state.tabs = state.tabs.filter((entry) => entry.kind !== 'table');
tab.database = result.database;
await loadWorkspace();
}
@@ -897,8 +995,10 @@ async function runSql(tab) {
} else {
log('info', `语句影响 ${result.affected ?? 0} 行`);
setStatus(`影响 ${result.affected ?? 0} 行`);
- await loadWorkspace();
- await reloadOpenTables();
+ if (!result.transactionActive) {
+ await loadWorkspace();
+ await reloadOpenTables();
+ }
}
}
renderEditor();
@@ -912,15 +1012,22 @@ function activateTab(id) {
const tab = activeTab();
if (tab?.kind === 'sql') tab.database = state.database;
if (tab?.kind === 'settings' && !state.serverSettings) void loadServerSettings();
+ if (tab?.kind === 'table' && !state.edit && tab.table !== accountsTable) void loadTableData(tab);
renderTabs();
}
// 关闭指定标签。
function closeTabById(id) {
+ if (state.tabs.find((tab) => tab.id === id)?.kind === 'sql') {
+ void api.rollbackConsole(id).catch(fail);
+ }
const closed = closeTab(state.tabs, id, state.activeId);
state.tabs = closed.tabs;
state.activeId = closed.activeId;
renderTabs();
+ if (!state.tabs.some((tab) => tab.kind === 'table') && !changeCount(state.changes) && (state.edit || state.editAttempt)) {
+ void rollbackAll();
+ }
}
// 新开一个查询标签。
@@ -1066,6 +1173,10 @@ function deleteSelected(tab) {
// 就地编辑单元格：提交或放弃。
function beginCellEdit(cell, options) {
+ if (/^runtime\(\[1,\[[567],/.test(String(options.type))) {
+ setStatus('复合值请通过 SQL 控制台修改');
+ return;
+ }
if (cell.querySelector('input')) return;
const input = document.createElement('input');
input.className = 'cell-input';
@@ -1292,6 +1403,7 @@ function onClick(event) {
const target = event.target.closest('[data-action]');
if (!target) return;
const action = target.dataset.action;
+ if (state.editBusy || state.editStarting) return;
const tab = activeTab();
// 没有选库时，需要当前库的动作先拦下来（服务端也会拒，这里给人话）
@@ -1305,13 +1417,19 @@ function onClick(event) {
void (async () => {
try {
await api.logout();
- } catch {
- // 退出失败也要回到登录页
+ } catch (error) {
+ fail(error);
+ return;
}
state.session = null;
state.tabs = [];
state.activeId = undefined;
state.changes = createEmptyChangeSet();
+ state.edit = null;
+ state.editAttempt = null;
+ state.editNeedsReload = false;
+ state.editUncertain = null;
+ api.forgetEdit();
renderLogin('已退出登录。', 'info');
})();
return;
@@ -1450,7 +1568,7 @@ function onClick(event) {
void commitAll();
return;
case 'rollback':
- rollbackAll();
+ void rollbackAll();
return;
case 'copy-sql': {
const text = changesSql(state.changes).join('\n');
@@ -1493,10 +1611,12 @@ function onClick(event) {
if (!meta || !row) return;
const staged = state.changes.updates.get(changeKey(tab.table, pk, column));
const oldValue = staged ? staged.oldValue : row[column.name];
+ const editId = state.edit?.id;
beginCellEdit(target, {
type: meta.type,
currentValue: staged ? staged.newValue : row[column.name],
commit: (value) => {
+ if (state.edit?.id !== editId) return;
if (value === undefined) renderEditor();
else stageUpdate(tab.table, tab.database, pk, column, oldValue, value);
},
@@ -1513,6 +1633,7 @@ function onClick(event) {
type: meta ? meta.type : 'str',
currentValue: insert.values[column],
commit: (value) => {
+ if (!canEdit(tab.database)) return;
if (value === undefined) renderEditor();
else {
insert.values[column] = value;
@@ -1617,9 +1738,33 @@ window.addEventListener(AUTH_EVENT, () => {
state.session = null;
state.tabs = [];
state.activeId = undefined;
+ state.changes = createEmptyChangeSet();
+ state.edit = null;
+ state.editAttempt = null;
+ state.editStarting = null;
+ state.editUncertain = null;
+ state.editNeedsReload = false;
+ api.forgetEdit();
renderLogin('会话已过期，请重新登录。', 'warn');
});
+// 离开页面时请求回滚仍持有的编辑快照。
+window.addEventListener('pagehide', () => {
+ api.closeConsoleOnPagehide();
+ const edit = state.edit ?? state.editAttempt;
+ if (edit && !state.editBusy) {
+ navigator.sendBeacon('/api/edit/rollback', new Blob([JSON.stringify(edit)], { type: 'application/json' }));
+ }
+});
+
+// 未提交或结果未知时提示页面关闭。
+window.addEventListener('beforeunload', (event) => {
+ if (changeCount(state.changes) || state.editBusy) {
+ event.preventDefault();
+ event.returnValue = '';
+ }
+});
+
root.addEventListener('click', onClick);
root.addEventListener('change', onChange);
root.addEventListener('submit', onSubmit);
diff --git a/chusql-web/static/core.js b/chusql-web/static/core.js
index 30d3320..2765f07 100644
--- a/chusql-web/static/core.js
+++ b/chusql-web/static/core.js
@@ -23,6 +23,8 @@ export const accountsTable = '__system_users';
// 值转 SQL 字面量（字符串加引号转义）。
export function sqlLiteral(value) {
if (value === null || value === undefined) return 'NULL';
+ const runtime = runtimeEnvelope(value);
+ if (runtime) return runtimeValueText(runtime[1], runtime[2], true);
if (typeof value === 'number' || typeof value === 'boolean') return String(value);
return `'${String(value).replaceAll("'", "''")}'`;
}
@@ -235,6 +237,11 @@ export function isBooleanType(type) {
// 类型的显示名。
export function typeLabel(type) {
+ if (String(type).startsWith('runtime(') && String(type).endsWith(')')) {
+ const envelope = JSON.parse(String(type).slice(8, -1));
+ if (!Array.isArray(envelope) || envelope.length !== 2 || envelope[0] !== 1) throw new Error('Unsupported runtime type encoding');
+ return runtimeTypeText(envelope[1]);
+ }
const kind = columnKind(type);
const label = typeLabels[kind];
const args = String(type).includes('(') ? String(type).slice(String(type).indexOf('(')) : '';
@@ -247,6 +254,8 @@ export function typeLabel(type) {
// 单元格显示文本（空值用占位文本）。
export function cellText(value, nullText) {
if (value === null || value === undefined) return nullText;
+ const runtime = runtimeEnvelope(value);
+ if (runtime) return runtimeValueText(runtime[1], runtime[2], false);
if (typeof value === 'boolean') return value ? 'true' : 'false';
return String(value);
}
@@ -254,9 +263,60 @@ export function cellText(value, nullText) {
// 编辑框里回填的文本（null 给空串）。
export function editText(value) {
if (value === null || value === undefined) return '';
+ const runtime = runtimeEnvelope(value);
+ if (runtime && runtime[1][0] <= 4) return String(runtime[2]);
+ if (runtime) return runtimeValueText(runtime[1], runtime[2], false);
return String(value);
}
+// 读取版本化运行时值封装。
+function runtimeEnvelope(value) {
+ if (!value || typeof value !== 'object' || !Object.hasOwn(value, '__chusql_runtime_v1')) return null;
+ const envelope = value.__chusql_runtime_v1;
+ if (!Array.isArray(envelope) || envelope.length !== 3 || envelope[0] !== 1) throw new Error('Unsupported runtime value encoding');
+ return envelope;
+}
+
+// 渲染运行时类型的 SQL 语法。
+function runtimeTypeText(type) {
+ if (!Array.isArray(type) || type.length !== 2 || !Array.isArray(type[1])) throw new Error('Invalid runtime type identity');
+ const [id, args] = type;
+ if (!Number.isInteger(id)) throw new Error('Invalid runtime constructor identity');
+ if (id >= 1 && id <= 4 && args.length === 0) return ['Int', 'Double', 'Bool', 'String'][id - 1];
+ if (id === 5 && args.length === 1) return `[${runtimeTypeText(args[0])}]`;
+ if (id === 6 && args.length === 1) return `Maybe ${runtimeTypeText(args[0])}`;
+ if (id === 7) return `(${args.map(runtimeTypeText).join(', ')})`;
+ throw new Error('Unknown runtime type identity');
+}
+
+// 渲染复合值或对应的 SQL 构造器。
+function runtimeValueText(type, value, sql) {
+ runtimeTypeText(type);
+ const [id, args] = type;
+ if (id === 1 || id === 2) {
+ if (typeof value !== 'number' || !Number.isFinite(value)) throw new Error('Invalid runtime numeric value');
+ if (id === 1 && !Number.isInteger(value)) throw new Error('Invalid runtime integer value');
+ const text = String(value);
+ return sql && id === 2 && !/[.eE]/.test(text) ? `${text}.0` : text;
+ }
+ if (id === 3 && typeof value === 'boolean') return sql ? (value ? 'TRUE' : 'FALSE') : String(value);
+ if (id === 4 && typeof value === 'string') return sql ? sqlLiteral(value) : JSON.stringify(value);
+ if (!Array.isArray(value)) throw new Error('Invalid runtime compound value');
+ if (id === 5) {
+ const items = value.map((item) => runtimeValueText(args[0], item, sql)).join(', ');
+ return sql ? `LIST<${runtimeTypeText(args[0])}>(${items})` : `[${items}]`;
+ }
+ if (id === 6 && value.length <= 1) {
+ const item = value.length ? runtimeValueText(args[0], value[0], sql) : '';
+ return sql ? `MAYBE<${runtimeTypeText(args[0])}>(${item})` : (value.length ? `Just (${item})` : 'Nothing');
+ }
+ if (id === 7 && value.length === args.length) {
+ const items = value.map((item, index) => runtimeValueText(args[index], item, sql)).join(', ');
+ return sql ? `TUPLE<${args.map(runtimeTypeText).join(', ')}>(${items})` : `(${items})`;
+ }
+ throw new Error('Runtime value type mismatch');
+}
+
// 编辑框文本转提交值（空串当 null）。
export function parseEdited(raw, type) {
const text = String(raw ?? '').trim();
diff --git a/chusql-web/test/Gates.hs b/chusql-web/test/Gates.hs
index b1a9912..81b2c18 100644
--- a/chusql-web/test/Gates.hs
+++ b/chusql-web/test/Gates.hs
@@ -179,7 +179,8 @@ gateSpec = do
-- 静态目录与管理员名都不再写进配置：前者写死 static，后者由 --user 给（默认 root）；
-- 监听地址是活的配置项（[server] listen_host / [web] listen_host），模板里可以留空靠内置默认
template `shouldSatisfy` (not . T.isInfixOf "static_dir =")
- template `shouldSatisfy` (not . T.isInfixOf "user =")
+ template `shouldSatisfy` (not . any ((== "user") . T.strip . fst . T.breakOn "=") . T.lines)
+ template `shouldSatisfy` T.isInfixOf ("sudo_auth_user = " <> T.pack (show ("" :: String)))
-- 管道传输退休后，两侧都不该再算套接字路径、也不该再认管名。
it "neither side computes a socket path or a pipe name any more" $ do
haskellIpc <- readUtf8 (".." "chusql-core" "engine" "src" "ChuSQL" "Core" "Engine" "Storage" "IPC.hs")
diff --git a/chusql-web/test/Spec.hs b/chusql-web/test/Spec.hs
index e7cdb3e..e7da4c2 100644
--- a/chusql-web/test/Spec.hs
+++ b/chusql-web/test/Spec.hs
@@ -3,8 +3,12 @@
module Main (main) where
import ChuSQL.Interface.Link (closeClient, connectClient)
+import ChuSQL.Interface.Auth (SessionPolicy (..), defaultSessionPolicy, lookupPayload, setPayloadPolicy)
import ChuSQL.Interface.RateLimit (newRateLimiter)
import ChuSQL.Interface.Session (authenticateSession, newSession, runStatement)
+import qualified ChuSQL.Interface.Actions as Actions
+import qualified ChuSQL.Core.Model as Model
+import ChuSQL.Core.Runtime
import ChuSQL.Interface.Settings (
applySettings,
defaultOf,
@@ -17,6 +21,7 @@ import ChuSQL.Interface.Settings (
)
import ChuSQL.Web.API (
AppEnv (..),
+ WebSession (..),
Live (..),
defaultLive,
isIdentifier,
@@ -27,8 +32,9 @@ import ChuSQL.Web.API (
)
import ChuSQL.Web.Static (contentTypeOf, safeRelative)
import ChuSQL.Web.UISettings (validateUISettings)
-import Control.Concurrent (forkIO)
-import Control.Exception (IOException, bracket, try)
+import Control.Concurrent (forkFinally, forkIO)
+import Control.Concurrent.MVar (newEmptyMVar, putMVar, takeMVar)
+import Control.Exception (IOException, bracket, throwIO, try)
import Control.Monad (when)
import Data.Aeson (encode, object, (.=))
import qualified Data.Aeson as A
@@ -39,6 +45,7 @@ import qualified Data.ByteString.Char8 as BSC
import qualified Data.ByteString.Lazy as BL
import Data.Char (isDigit)
import Data.List (isInfixOf)
+import Data.IORef (readIORef)
import qualified Data.Map.Strict as Map
import Data.Maybe (fromMaybe)
import Data.Text (Text)
@@ -511,6 +518,17 @@ stopServer world = do
-- | 纯函数用例
unitSpec :: Spec
unitSpec = describe "pure helpers" $ do
+ it "rejects malformed runtime values before producing write SQL" $ do
+ case resolveType builtinTypes (listType intType) of
+ Left err -> expectationFailure err
+ Right descriptor ->
+ Actions.insertRowSql "t" [("xs", Model.VRuntime (descriptorId descriptor) (RList [RString "wrong"]))]
+ `shouldSatisfy` either (const True) (const False)
+ it "escapes nested runtime string literals" $ do
+ case resolveType builtinTypes (listType stringType) of
+ Left err -> expectationFailure err
+ Right descriptor -> Actions.sqlLiteral (Model.VRuntime (descriptorId descriptor) (RList [RString "a'b"]))
+ `shouldBe` Right "LIST('a''b')"
it "parses the session cookie out of a Cookie header" $ do
parseCookieHeader sessionCookieName "a=1; chusql_session=abc123; b=2" `shouldBe` Just "abc123"
parseCookieHeader sessionCookieName "other=1" `shouldBe` Nothing
@@ -835,17 +853,54 @@ accountSpec env = describe "the account table (system database, admin only)" $ d
roleSpec :: AppEnv -> Spec
roleSpec env = describe "roles and grants" $ do
withApp (webApp env) $ do
+ it "uses database scopes and owner permissions through REST and rejects private data" $ do
+ admin <- adminHeaders
+ ensureDatabase admin testDatabaseName
+ ensureAccount admin "acl_web_owner" "Owner-Secret-1234"
+ ensureAccount admin "acl_web_reader" "Reader-Secret-1234"
+ ensureTable admin "acl_private" (encode (object ["name" .= ("acl_private" :: Text), "columns" .= [column "id" "int"]]))
+ permission <- postAs admin "/api/roles/acl_web_owner/grants" (encode (object ["object" .= ("database:" <> testDatabaseName), "privileges" .= (["connect", "create"] :: [Text])]))
+ expectStatusWith "database object grant" permission 200
+ owner <- ordinaryHeaders "acl_web_owner" "Owner-Secret-1234"
+ created <- postAs (withDb testDatabaseName owner) "/api/tables" (encode (object ["name" .= ("acl_owned" :: Text), "columns" .= [column "id" "int"]]))
+ expectStatusWith "owner creates table" created 200
+ denied <- testSql owner "SELECT * FROM acl_private"
+ expectStatusWith "private table denied" denied 403
+ grantDenied <- postAs (withDb testDatabaseName owner) "/api/roles/acl_web_reader/grants" (encode (object ["object" .= (testDatabaseName <> ".acl_private"), "privileges" .= (["select"] :: [Text])]))
+ expectStatusWith "missing grant option" grantDenied 403
+ delegated <- postAs (withDb testDatabaseName owner) "/api/roles/acl_web_reader/grants" (encode (object ["object" .= (testDatabaseName <> ".acl_owned"), "privileges" .= (["select"] :: [Text])]))
+ expectStatusWith "owner delegates via REST" delegated 200
+ reader <- ordinaryHeaders "acl_web_reader" "Reader-Secret-1234"
+ visible <- testSql reader "SELECT * FROM acl_owned"
+ expectStatusWith "delegated query" visible 200
+ revoked <- testSql admin "REVOKE SELECT ON acl_owned FROM acl_web_reader"
+ expectStatusWith "root revokes owner delegation" revoked 200
+ invalidated <- testSql reader "SELECT * FROM acl_owned"
+ expectStatusWith "revoked Web session" invalidated 401
+ it "filters database visibility after PUBLIC CONNECT is revoked" $ do
+ admin <- adminHeaders
+ ensureDatabase admin "acl_closed"
+ ensureAccount admin "acl_web_guest" "Guest-Secret-1234"
+ closed <- postAs admin "/api/query" (encode (object ["sql" .= ("REVOKE CONNECT ON DATABASE acl_closed FROM PUBLIC" :: Text)]))
+ expectStatusWith "close default connection" closed 200
+ guest <- ordinaryHeaders "acl_web_guest" "Guest-Secret-1234"
+ listed <- getAs guest "/api/databases"
+ expectStatusWith "filtered database list" listed 200
+ check (("acl_closed" `elem` map asText (items (jsonBody listed))) `shouldBe` False)
+ refused <- getAs (withDb "acl_closed" guest) "/api/tables"
+ expectStatusWith "CONNECT denied through Web" refused 403
it "creates a role, grants a privilege, adds a member and drops it" $ do
hs <- adminHeaders
ensureDatabase hs testDatabaseName
ensureAccount hs "bob" "bob-Secret-123456"
+ ensureTable (withDb testDatabaseName hs) "grant_probe" (encode (object ["name" .= ("grant_probe" :: Text), "columns" .= [column "id" "int"]]))
created <- postAs hs "/api/roles" (encode (object ["name" .= ("analyst" :: Text)]))
expectStatusWith "create role" created 200
granted <-
postAs
hs
"/api/roles/analyst/grants"
- (encode (object ["object" .= testDatabaseName, "privileges" .= (["select"] :: [Text])]))
+ (encode (object ["object" .= (testDatabaseName <> ".grant_probe"), "privileges" .= (["select"] :: [Text])]))
expectStatusWith "grant privilege" granted 200
member <- postAs hs "/api/roles/analyst/members" (encode (object ["user" .= ("bob" :: Text)]))
expectStatusWith "add member" member 200
@@ -865,13 +920,14 @@ roleSpec env = describe "roles and grants" $ do
it "carries the grant option through the API" $ do
hs <- adminHeaders
ensureDatabase hs testDatabaseName
+ ensureTable (withDb testDatabaseName hs) "grant_option_probe" (encode (object ["name" .= ("grant_option_probe" :: Text), "columns" .= [column "id" "int"]]))
created <- postAs hs "/api/roles" (encode (object ["name" .= ("passer" :: Text)]))
expectStatusWith "create passer" created 200
granted <-
postAs
(withDb testDatabaseName hs)
"/api/roles/passer/grants"
- (encode (object ["object" .= testDatabaseName, "privileges" .= (["select"] :: [Text]), "grantOption" .= True]))
+ (encode (object ["object" .= (testDatabaseName <> ".grant_option_probe"), "privileges" .= (["select"] :: [Text]), "grantOption" .= True]))
expectStatusWith "grant with option" granted 200
listed <- getAs hs "/api/roles"
expectStatusWith "list roles" listed 200
@@ -890,6 +946,16 @@ roleSpec env = describe "roles and grants" $ do
querySpec :: AppEnv -> Spec
querySpec env = describe "the SQL console" $ do
withApp (webApp env) $ do
+ it "returns typed compound values through HTTP and TCP" $ do
+ hs <- adminHeaders
+ ensureDatabase hs testDatabaseName
+ result <- testSql hs "SELECT LIST(1, 2), length('abc')"
+ expectStatusWith "typed SQL values" result 200
+ let value = maybe A.Null id (nth 0 (firstRow result))
+ envelope = at "__chusql_runtime_v1" value
+ check (arrayLen envelope `shouldBe` 3)
+ check (asInt (maybe A.Null id (nth 0 (items envelope))) `shouldBe` 1)
+ check (asInt (maybe A.Null id (nth 1 (firstRow result))) `shouldBe` 3)
it "runs DDL and DML and returns positional rows" $ do
hs <- adminHeaders
ensureDatabase hs testDatabaseName
@@ -916,9 +982,230 @@ querySpec env = describe "the SQL console" $ do
ensureDatabase hs testDatabaseName
res <- postAs (withDb testDatabaseName hs) "/api/query" (encode (object ["sql" .= ("SELEC nonsense" :: Text)]))
expectStatusWith "syntax error" res 400
+ it "redacts credentials from malformed SQL responses" $ do
+ hs <- adminHeaders
+ ensureDatabase hs testDatabaseName
+ let secret = "Web-Secret-DoNotEcho123!" :: Text
+ res <- postAs (withDb testDatabaseName hs) "/api/query" (encode (object ["sql" .= ("CREATE USER broken IDENTIFIED BY '" <> secret <> "' trailing")]))
+ expectStatusWith "credential syntax error" res 400
+ check (BSC.isInfixOf "Web-Secret-DoNotEcho123!" (BL.toStrict (WT.simpleBody res)) `shouldBe` False)
+ check (BSC.isInfixOf "redacted" (BL.toStrict (WT.simpleBody res)) `shouldBe` True)
-- IDE 设置 -------------------------------------------------------------------
+-- | 发出编辑事务控制请求。
+editRequest :: [Header] -> BS.ByteString -> Text -> [A.Value] -> TestSession WT.SResponse
+editRequest hs path owner changes = postAs hs path (encode (object
+ ["id" .= owner, "database" .= testDatabaseName, "changes" .= changes]))
+
+-- | 在测试库执行一条 SQL。
+testSql :: [Header] -> Text -> TestSession WT.SResponse
+testSql hs sql = postAs (withDb testDatabaseName hs) "/api/query" (encode (object ["sql" .= sql]))
+
+-- | 生成整数行插入编辑。
+editInsert :: Text -> Int -> A.Value
+editInsert table key = object ["op" .= ("insert" :: Text), "table" .= table,
+ "values" .= object ["id" .= key, "value" .= key]]
+
+-- | 验证编辑原子性、隔离与失效清理。
+editSpec :: AppEnv -> Spec
+editSpec env = describe "web editing transactions" $ withApp (webApp env) $ do
+ it "commits across tables atomically and deduplicates successful retries" $ do
+ hs <- adminHeaders
+ ensureDatabase hs testDatabaseName
+ madeA <- testSql hs "CREATE TABLE edit_atomic_a (id int PRIMARY KEY, value int)"
+ expectStatusWith "create first table" madeA 200
+ madeB <- testSql hs "CREATE TABLE edit_atomic_b (id int PRIMARY KEY, value int)"
+ expectStatusWith "create second table" madeB 200
+ begun <- editRequest hs "/api/edit/begin" "atomic" []
+ expectStatusWith "begin" begun 200
+ let changes = [editInsert "edit_atomic_a" 1, editInsert "edit_atomic_b" 2]
+ committed <- editRequest hs "/api/edit/commit" "atomic" changes
+ expectStatusWith "commit" committed 200
+ check (at "applied" (jsonBody committed) `shouldBe` A.Number 2)
+ duplicate <- editRequest hs "/api/edit/commit" "atomic" changes
+ expectStatusWith "duplicate commit" duplicate 200
+ check (jsonBody duplicate `shouldBe` jsonBody committed)
+ changed <- editRequest hs "/api/edit/commit" "atomic" [editInsert "edit_atomic_a" 9]
+ expectStatusWith "changed duplicate" changed 409
+ rowsA <- testSql hs "SELECT * FROM edit_atomic_a"
+ rowsB <- testSql hs "SELECT * FROM edit_atomic_b"
+ check (asInt (at "rowCount" (jsonBody rowsA)) `shouldBe` 1)
+ check (asInt (at "rowCount" (jsonBody rowsB)) `shouldBe` 1)
+ it "rolls back a mid-batch constraint error to the savepoint and permits correction" $ do
+ hs <- adminHeaders
+ ensureDatabase hs testDatabaseName
+ made <- testSql hs "CREATE TABLE edit_constraints (id int PRIMARY KEY, value int)"
+ expectStatusWith "create table" made 200
+ begun <- editRequest hs "/api/edit/begin" "constraints" []
+ expectStatusWith "begin" begun 200
+ failed <- editRequest hs "/api/edit/commit" "constraints" [editInsert "edit_constraints" 1, editInsert "edit_constraints" 1]
+ expectStatusWith "constraint failure" failed 400
+ check (at "state" (jsonBody failed) `shouldBe` A.String "active")
+ check (at "applied" (jsonBody failed) `shouldBe` A.Number 0)
+ visible <- testSql hs "SELECT * FROM edit_constraints"
+ check (asInt (at "rowCount" (jsonBody visible)) `shouldBe` 0)
+ snapshot <- getAs (("X-ChuSQL-Edit", "constraints") : withDb testDatabaseName hs) "/api/tables/edit_constraints/rows"
+ expectStatusWith "snapshot after failure" snapshot 200
+ check (asInt (at "total" (jsonBody snapshot)) `shouldBe` 0)
+ corrected <- editRequest hs "/api/edit/commit" "constraints" [editInsert "edit_constraints" 2]
+ expectStatusWith "corrected replay" corrected 200
+ visibleAgain <- testSql hs "SELECT id FROM edit_constraints"
+ check (firstRow visibleAgain `shouldBe` [A.Number 2])
+ it "preserves the initial snapshot and rejects a conflicting external update" $ do
+ hs <- adminHeaders
+ ensureDatabase hs testDatabaseName
+ made <- testSql hs "CREATE TABLE edit_conflicts (id int PRIMARY KEY, value int)"
+ expectStatusWith "create table" made 200
+ seeded <- testSql hs "INSERT INTO edit_conflicts (id, value) VALUES (1, 10)"
+ expectStatusWith "seed row" seeded 200
+ begun <- editRequest hs "/api/edit/begin" "conflicts" []
+ expectStatusWith "begin" begun 200
+ observer <- adminHeaders
+ updated <- testSql observer "UPDATE edit_conflicts SET value = 20 WHERE id = 1"
+ expectStatusWith "concurrent update" updated 200
+ snapshot <- getAs (("X-ChuSQL-Edit", "conflicts") : withDb testDatabaseName hs) "/api/tables/edit_conflicts/rows"
+ check (firstRow snapshot `shouldBe` [A.Number 1, A.Number 10])
+ let change = object ["op" .= ("update" :: Text), "table" .= ("edit_conflicts" :: Text),
+ "pk" .= (1 :: Int), "set" .= object ["value" .= (30 :: Int)]]
+ failed <- editRequest hs "/api/edit/commit" "conflicts" [change]
+ expectStatusWith "serialization conflict" failed 409
+ check (at "reloadRequired" (jsonBody failed) `shouldBe` A.Bool True)
+ live <- testSql observer "SELECT value FROM edit_conflicts"
+ check (firstRow live `shouldBe` [A.Number 20])
+ retried <- editRequest hs "/api/edit/commit" "conflicts" [change]
+ expectStatusWith "stale retry" retried 409
+ reopened <- editRequest hs "/api/edit/begin" "conflicts" []
+ expectStatusWith "stale begin" reopened 409
+ it "binds editing to one page and database and makes rollback idempotent" $ do
+ hs <- adminHeaders
+ ensureDatabase hs testDatabaseName
+ begun <- editRequest hs "/api/edit/begin" "owner" []
+ expectStatusWith "begin" begun 200
+ repeated <- editRequest hs "/api/edit/begin" "owner" []
+ expectStatusWith "repeated begin" repeated 200
+ otherPage <- editRequest hs "/api/edit/begin" "intruder" []
+ expectStatusWith "another page" otherPage 409
+ otherDatabase <- postAs hs "/api/edit/commit" (encode (object
+ ["id" .= ("owner" :: Text), "database" .= ("system" :: Text), "changes" .= ([] :: [A.Value])]))
+ expectStatusWith "another database" otherDatabase 409
+ forged <- getAs (("X-ChuSQL-Edit", "intruder") : withDb testDatabaseName hs) "/api/tables"
+ expectStatusWith "another page snapshot" forged 409
+ rolled <- editRequest hs "/api/edit/rollback" "owner" []
+ expectStatusWith "rollback" rolled 200
+ duplicate <- editRequest hs "/api/edit/rollback" "owner" []
+ expectStatusWith "repeated rollback" duplicate 200
+ stale <- editRequest hs "/api/edit/begin" "owner" []
+ expectStatusWith "ended identity" stale 409
+ it "keeps SQL-console transactions separate from grid editing" $ do
+ hs <- adminHeaders
+ ensureDatabase hs testDatabaseName
+ made <- testSql hs "CREATE TABLE edit_console (id int PRIMARY KEY, value int)"
+ expectStatusWith "create table" made 200
+ consoleBegin <- testSql hs "BEGIN"
+ expectStatusWith "console begin" consoleBegin 200
+ consoleWrite <- testSql hs "INSERT INTO edit_console (id, value) VALUES (1, 1)"
+ expectStatusWith "console write" consoleWrite 200
+ begun <- editRequest hs "/api/edit/begin" "console" []
+ expectStatusWith "editor begin" begun 200
+ committed <- editRequest hs "/api/edit/commit" "console" [editInsert "edit_console" 2]
+ expectStatusWith "editor commit" committed 200
+ consoleRollback <- testSql hs "ROLLBACK"
+ expectStatusWith "console rollback" consoleRollback 200
+ live <- testSql hs "SELECT id FROM edit_console"
+ check (firstRow live `shouldBe` [A.Number 2])
+ it "drops the editing connection on logout and rejects the old transaction after login" $ do
+ hs <- adminHeaders
+ ensureDatabase hs testDatabaseName
+ begun <- editRequest hs "/api/edit/begin" "logout" []
+ expectStatusWith "begin" begun 200
+ gone <- postAs hs "/api/logout" "{}"
+ expectStatusWith "logout" gone 204
+ rejected <- editRequest hs "/api/edit/commit" "logout" []
+ expectStatusWith "old cookie" rejected 401
+ newHs <- adminHeaders
+ stale <- editRequest newHs "/api/edit/commit" "logout" []
+ expectStatusWith "old transaction on new connection" stale 409
+ it "rejects system identity transactions" $ do
+ hs <- adminHeaders
+ res <- postAs hs "/api/edit/begin" (encode (object ["id" .= ("identities" :: Text), "database" .= ("system" :: Text)]))
+ expectStatusWith "identity transaction" res 400
+ it "invalidates editing when the account loses its permission" $ do
+ hs <- adminHeaders
+ ensureDatabase hs testDatabaseName
+ made <- testSql hs "CREATE TABLE edit_permissions (id int PRIMARY KEY, value int)"
+ expectStatusWith "create table" made 200
+ ensureAccount hs "edit_user" "Editor-Secret-1234"
+ granted <- testSql hs "GRANT SELECT, INSERT ON edit_permissions TO edit_user"
+ expectStatusWith "grant editing" granted 200
+ editor <- ordinaryHeaders "edit_user" "Editor-Secret-1234"
+ begun <- editRequest editor "/api/edit/begin" "permissions" []
+ expectStatusWith "begin" begun 200
+ revoked <- testSql hs "REVOKE INSERT ON edit_permissions FROM edit_user"
+ expectStatusWith "revoke insert" revoked 200
+ rejected <- editRequest editor "/api/edit/commit" "permissions" [editInsert "edit_permissions" 1]
+ expectStatusWith "invalidated editor" rejected 401
+ live <- testSql hs "SELECT * FROM edit_permissions"
+ check (asInt (at "rowCount" (jsonBody live)) `shouldBe` 0)
+ it "restricts an SQL transaction to its owning console and blocks unrelated REST writes" $ do
+ hs <- adminHeaders
+ ensureDatabase hs testDatabaseName
+ let owner = ("X-ChuSQL-Console", "page:console-a") : hs
+ intruder = ("X-ChuSQL-Console", "page:console-b") : hs
+ begun <- testSql owner "/* owner */ BEGIN"
+ expectStatusWith "console begin" begun 200
+ rejected <- testSql intruder "ROLLBACK"
+ expectStatusWith "other console rollback" rejected 409
+ rest <- postAs (withDb testDatabaseName hs) "/api/tables" (encode (object
+ ["name" .= ("edit_rest_intruder" :: Text), "columns" .= [column "id" "int"]]))
+ expectStatusWith "REST write inside console transaction" rest 409
+ closed <- postAs hs "/api/query/rollback" (encode (object ["console" .= ("page:console-a" :: Text)]))
+ expectStatusWith "close owning console" closed 204
+ next <- testSql intruder "SELECT 1"
+ expectStatusWith "other console after rollback" next 200
+ it "cleans the editing snapshot when its web session expires" $ do
+ hs <- adminHeaders
+ ensureDatabase hs testDatabaseName
+ begun <- editRequest hs "/api/edit/begin" "expires" []
+ expectStatusWith "begin" begun 200
+ let token = fromMaybe "" (lookup "Cookie" hs >>= parseCookieHeader sessionCookieName . TE.decodeUtf8)
+ stored <- liftIO (lookupPayload (aeSessions env) token)
+ app <- getState
+ res <- liftIO $ bracket
+ (setPayloadPolicy (aeSessions env) (SessionPolicy (-1) 86400))
+ (const (setPayloadPolicy (aeSessions env) defaultSessionPolicy))
+ (const (editFromApp app hs "expires" []))
+ expectStatusWith "expired commit" res 401
+ case stored of
+ Nothing -> check (expectationFailure "missing live web session")
+ Just (_, ws) -> check (readIORef (wsEdit ws) >>= (`shouldBe` Nothing))
+ it "serializes duplicate HTTP commits and applies the edit set once" $ do
+ hs <- adminHeaders
+ ensureDatabase hs testDatabaseName
+ made <- testSql hs "CREATE TABLE edit_double_click (id int PRIMARY KEY, value int)"
+ expectStatusWith "create table" made 200
+ begun <- editRequest hs "/api/edit/begin" "double-click" []
+ expectStatusWith "begin" begun 200
+ app <- getState
+ results <- liftIO $ do
+ first <- newEmptyMVar
+ second <- newEmptyMVar
+ _ <- forkFinally (editFromApp app hs "double-click" [editInsert "edit_double_click" 1]) (putMVar first)
+ _ <- forkFinally (editFromApp app hs "double-click" [editInsert "edit_double_click" 1]) (putMVar second)
+ mapM (either throwIO pure) =<< sequence [takeMVar first, takeMVar second]
+ mapM_ (\res -> expectStatusWith "duplicate concurrent commit" res 200) results
+ live <- testSql hs "SELECT * FROM edit_double_click"
+ check (asInt (at "rowCount" (jsonBody live)) `shouldBe` 1)
+
+-- | 从独立请求上下文提交编辑事务。
+editFromApp :: Wai.Application -> [Header] -> Text -> [A.Value] -> IO WT.SResponse
+editFromApp app hs owner changes = WT.runSession send app
+ where
+ -- | 构造带 Cookie 的原子提交请求。
+ send = WT.srequest (WT.SRequest
+ (WT.setPath WT.defaultRequest {Wai.requestMethod = methodPost, Wai.requestHeaders = jsonHeaders hs} "/api/edit/commit")
+ (encode (object ["id" .= owner, "database" .= testDatabaseName, "changes" .= changes])))
+
-- | IDE 设置用例
uiSettingsSpec :: AppEnv -> Spec
uiSettingsSpec env = describe "IDE settings" $ do
@@ -1000,7 +1287,25 @@ main = do
limitedEnv <- liveEnv limitedWorld staticDir 1
hspec (spec staticDir env limitedEnv)
--- | 汇总挂载全部用例组
+-- | 执行前端事务状态回归。
+frontendSpec :: Spec
+frontendSpec = describe "browser transaction state" $ do
+ it "passes the Node runtime value suite" $ do
+ node <- findExecutable "node"
+ case node of
+ Nothing -> expectationFailure "Node.js is required for runtime value tests"
+ Just executable -> do
+ (exitCode, output, errors) <- readProcessWithExitCode executable ["test/runtime-values.mjs"] ""
+ when (exitCode /= ExitSuccess) (expectationFailure (output ++ errors))
+ it "passes the Node frontend transaction suite" $ do
+ node <- findExecutable "node"
+ case node of
+ Nothing -> expectationFailure "Node.js is required for frontend transaction tests"
+ Just executable -> do
+ (exitCode, output, errors) <- readProcessWithExitCode executable ["--test", "--test-reporter=tap", "test/transactions.mjs"] ""
+ when (exitCode /= ExitSuccess) (expectationFailure (output ++ errors))
+
+-- | 汇总挂载全部用例组。
spec :: FilePath -> AppEnv -> AppEnv -> Spec
spec staticDir env limitedEnv = do
unitSpec
@@ -1013,6 +1318,8 @@ spec staticDir env limitedEnv = do
accountSpec env
roleSpec env
querySpec env
+ editSpec env
+ frontendSpec
uiSettingsSpec env
e2eSpec env
rateLimitSpec limitedEnv
diff --git a/chusql-web/test/runtime-values.mjs b/chusql-web/test/runtime-values.mjs
new file mode 100644
index 0000000..a83996f
--- /dev/null
+++ b/chusql-web/test/runtime-values.mjs
@@ -0,0 +1,20 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+
+// 检查前端复合值显示、SQL 生成和编码错误。
+
+const source = await readFile(new URL('../static/core.js', import.meta.url), 'utf8');
+const { cellText, sqlLiteral, typeLabel, editText } = await import(`data:text/javascript;base64,${Buffer.from(source).toString('base64')}`);
+const typeInt = [1, []];
+const typeString = [4, []];
+const nested = { __chusql_runtime_v1: [1, [5, [[6, [typeInt]]]], [[], [42]]] };
+assert.equal(cellText(nested, 'NULL'), '[Nothing, Just (42)]');
+assert.equal(sqlLiteral(nested), 'LIST(MAYBE(), MAYBE(42))');
+assert.equal(sqlLiteral({ __chusql_runtime_v1: [1, [7, [typeInt, typeString]], [1, "a'b"]] }), "TUPLE(1, 'a''b')");
+assert.equal(sqlLiteral({ __chusql_runtime_v1: [1, [5, [[2, []]]], [1]] }), 'LIST(1.0)');
+assert.throws(() => cellText({ __chusql_runtime_v1: [2, typeInt, 1] }, 'NULL'), /encoding/);
+assert.throws(() => sqlLiteral({ __chusql_runtime_v1: [1, [7, [typeInt]], [1, 2]] }), /mismatch/);
+assert.equal(typeLabel('runtime([1,[5,[[1,[]]]]])'), '[Int]');
+assert.equal(editText({ __chusql_runtime_v1: [1, typeString, 'abc'] }), 'abc');
+assert.throws(() => sqlLiteral({ __chusql_runtime_v1: [1, typeInt, 1.5] }), /integer/);
+console.log('runtime values: 9 assertions passed');
diff --git a/chusql-web/test/transactions.mjs b/chusql-web/test/transactions.mjs
new file mode 100644
index 0000000..9431ff2
--- /dev/null
+++ b/chusql-web/test/transactions.mjs
@@ -0,0 +1,175 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { beforeEach, test } from 'node:test';
+import * as api from '../static/api.js';
+import { createEmptyChangeSet } from '../static/core.js';
+
+// 验证页面编辑状态、原子请求、断线重试与关闭清理。
+
+const listeners = new Map();
+globalThis.window = { addEventListener: (name, callback) => listeners.set(name, callback), dispatchEvent: () => {} };
+globalThis.document = { getElementById: (id) => id === 'root' ? { addEventListener() {} } : null };
+let source = await readFile(new URL('../static/app.js', import.meta.url), 'utf8');
+source = source.replaceAll("'./api.js'", JSON.stringify(new URL('../static/api.js', import.meta.url).href))
+ .replaceAll("'./core.js'", JSON.stringify(new URL('../static/core.js', import.meta.url).href))
+ .replace('void boot();', 'export { state, commitAll, rollbackAll, stageUpdate, removeStaged, ensureEdit, runSql };');
+const app = await import(`data:text/javascript;base64,${Buffer.from(source).toString('base64')}`);
+let calls;
+let commitResponse;
+
+// 生成 JSON HTTP 响应。
+function response(body, status = 200) {
+ return new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
+}
+
+// 重置页面与模拟服务端。
+beforeEach(() => {
+ calls = [];
+ commitResponse = () => response({ ok: true, applied: 1, state: 'committed' });
+ api.forgetEdit();
+ Object.assign(app.state, { database: 'test', databases: ['test'], tabs: [], activeId: undefined,
+ view: 'workbench', session: { user: 'admin' }, edit: { id: 'page', database: 'test' },
+ editBusy: false, editStarting: null, editAttempt: null, editNeedsReload: false, editUncertain: null,
+ changes: createEmptyChangeSet(), messages: [] });
+ globalThis.fetch = async (url, init) => {
+ calls.push({ url, init, body: init.body ? JSON.parse(init.body) : undefined });
+ if (url === '/api/edit/commit') return commitResponse();
+ if (url === '/api/databases') return response(['test']);
+ if (url === '/api/tables') return response([]);
+ return response({ state: 'active' });
+ };
+});
+
+// 检查整批修改只发送一次提交请求。
+test('all table edits use one atomic request and clear only after success', async () => {
+ app.stageUpdate('first', 'test', 1, 'value', 10, 20);
+ app.stageUpdate('second', 'test', 2, 'value', 20, 30);
+ await app.commitAll();
+ const committed = calls.filter((call) => call.url === '/api/edit/commit');
+ assert.equal(committed.length, 1);
+ assert.equal(committed[0].body.changes.length, 2);
+ assert.equal(app.state.changes.updates.size, 0);
+ assert.equal(app.state.edit, null);
+ assert.equal(calls.some((call) => call.init.method === 'PATCH'), false);
+});
+
+// 检查失败保留可修正的完整编辑集。
+test('constraint failure retains all edits and permits local undo before replay', async () => {
+ app.stageUpdate('first', 'test', 1, 'value', 10, 20);
+ app.stageUpdate('second', 'test', 2, 'value', 20, 30);
+ commitResponse = () => response({ ok: false, applied: 0, state: 'active', message: 'constraint', reloadRequired: false }, 400);
+ await app.commitAll();
+ assert.equal(app.state.changes.updates.size, 2);
+ assert.equal(app.state.editNeedsReload, false);
+ app.removeStaged([...app.state.changes.updates.keys()][0]);
+ assert.equal(app.state.changes.updates.size, 1);
+ assert.equal(calls.some((call) => call.init.method === 'PATCH'), false);
+});
+
+// 检查冲突禁止再次提交直到回滚。
+test('serialization conflict freezes edits and requires rollback and reload', async () => {
+ app.stageUpdate('first', 'test', 1, 'value', 10, 20);
+ commitResponse = () => response({ ok: false, state: 'rolled_back', reloadRequired: true, message: 'conflict' }, 409);
+ await app.commitAll();
+ await app.commitAll();
+ assert.equal(calls.filter((call) => call.url === '/api/edit/commit').length, 1);
+ assert.equal(app.state.changes.updates.size, 1);
+ app.stageUpdate('first', 'test', 1, 'value', 10, 40);
+ assert.equal([...app.state.changes.updates.values()][0].newValue, 20);
+ await app.rollbackAll();
+ assert.equal(app.state.changes.updates.size, 0);
+ assert.equal(app.state.editNeedsReload, false);
+ assert.equal(calls.some((call) => call.url === '/api/edit/rollback'), true);
+});
+
+// 检查断线后冻结载荷并使用同一提交标识。
+test('an uncertain response retries the same payload without allowing edits', async () => {
+ app.stageUpdate('first', 'test', 1, 'value', 10, 20);
+ commitResponse = () => { throw new Error('connection lost'); };
+ await app.commitAll();
+ assert.ok(app.state.editUncertain);
+ app.stageUpdate('first', 'test', 1, 'value', 10, 99);
+ commitResponse = () => response({ ok: true, applied: 1, state: 'committed' });
+ await app.commitAll();
+ const committed = calls.filter((call) => call.url === '/api/edit/commit');
+ assert.deepEqual(committed[0].body, committed[1].body);
+ assert.equal(app.state.editUncertain, null);
+});
+
+// 检查并发点击只有一个正在提交的请求。
+test('duplicate clicks cannot submit concurrently', async () => {
+ app.stageUpdate('first', 'test', 1, 'value', 10, 20);
+ await Promise.all([app.commitAll(), app.commitAll()]);
+ assert.equal(calls.filter((call) => call.url === '/api/edit/commit').length, 1);
+});
+
+// 检查快照读取带页面标识且普通 SQL 无标识。
+test('snapshot headers are attached only to table reads', async () => {
+ await api.beginEdit('page', 'test');
+ await api.listTables('test');
+ globalThis.fetch = async (url, init) => {
+ calls.push({ url, init });
+ return response({ columns: [], rows: [], rowCount: 0 });
+ };
+ await api.query('SELECT 1', 'test');
+ assert.equal(calls.find((call) => call.url === '/api/tables').init.headers.get('X-ChuSQL-Edit'), 'page');
+ assert.equal(calls.find((call) => call.url === '/api/query').init.headers.has('X-ChuSQL-Edit'), false);
+});
+
+// 检查页面离开时发送回滚请求。
+test('page close sends a rollback beacon for its own transaction', async () => {
+ let beacon;
+ Object.defineProperty(globalThis, 'navigator', { configurable: true, value: { sendBeacon: (url, body) => { beacon = { url, body }; } } });
+ listeners.get('pagehide')();
+ assert.equal(beacon.url, '/api/edit/rollback');
+ assert.deepEqual(JSON.parse(await beacon.body.text()), { id: 'page', database: 'test' });
+});
+
+// 检查 BEGIN 回包断线后仍使用同一标识。
+test('a lost BEGIN response keeps its identity for an idempotent retry', async () => {
+ app.state.edit = null;
+ globalThis.fetch = async (url, init) => {
+ calls.push({ url, init, body: JSON.parse(init.body) });
+ if (calls.length === 1) throw new Error('begin response lost');
+ return response({ state: 'active' });
+ };
+ await assert.rejects(app.ensureEdit('test'));
+ assert.ok(app.state.editAttempt);
+ await app.ensureEdit('test');
+ assert.deepEqual(calls[0].body, calls[1].body);
+ assert.equal(app.state.edit.id, calls[0].body.id);
+});
+
+// 检查每个 SQL 标签使用独立所有者标识。
+test('console transaction cleanup only applies to its owning tab', async () => {
+ globalThis.fetch = async (url, init) => {
+ calls.push({ url, init, body: JSON.parse(init.body) });
+ return response({ columns: [], rows: [], rowCount: 0, transaction: true });
+ };
+ await api.query('BEGIN', 'test', 'first');
+ const owner = calls[0].init.headers.get('X-ChuSQL-Console');
+ assert.ok(owner.endsWith(':first'));
+ await api.rollbackConsole('second');
+ assert.equal(calls.length, 1);
+ await api.rollbackConsole('first');
+ assert.equal(calls[1].url, '/api/query/rollback');
+ assert.equal(calls[1].body.console, owner);
+});
+
+// 检查 SQL 回滚等待期间不能继续编辑旧快照。
+test('edits are locked while SQL releases the previous snapshot', async () => {
+ let release;
+ globalThis.fetch = async (url, init) => {
+ calls.push({ url, init });
+ if (url === '/api/edit/rollback') return new Promise((resolve) => { release = () => resolve(response({ state: 'rolled_back' })); });
+ return response({ columns: ['value'], rows: [[1]], rowCount: 1 });
+ };
+ const job = app.runSql({ id: 'query', database: 'test', sql: 'SELECT 1' });
+ assert.equal(app.state.editBusy, true);
+ app.stageUpdate('first', 'test', 1, 'value', 10, 20);
+ assert.equal(app.state.changes.updates.size, 0);
+ release();
+ await job;
+ assert.equal(app.state.editBusy, false);
+ assert.equal(app.state.edit, null);
+});
diff --git a/docs/architecture.md b/docs/architecture.md
index eccc7e5..8619efa 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -40,6 +40,8 @@ Web / CLI / 其他客户端
- 每条 TCP 连接拥有独立会话，当前数据库和事务互不影响。
- 读请求可并行，写请求由存储层协调。
- Web 与 CLI 共享服务端的权限和执行规则，不直接读写数据目录。
+- Web 登录会话分别持有普通 API / SQL 连接与表格编辑连接，编辑事务按页面标识固定数据库。表格读取携带编辑标识时使用该事务快照；普通查询不进入编辑事务。
+- 同一 Web Cookie 的请求串行执行。编辑提交以固定保存点重放本地编辑集，失败整体回退；成功回执按提交标识去重。SQL 控制台事务另按页面与标签标识限制连接访问。
## SQL 查询处理
@@ -97,15 +99,136 @@ Web / CLI / 其他客户端
| 机制 | 行为 |
| --- | --- |
| 角色继承 | 沿成员关系取得权限并集；拒绝自继承与环 |
-| 表级授权 | 支持 SELECT、INSERT、UPDATE、DELETE 和 ALL |
+| 对象授权 | 数据库 CONNECT / CREATE，表 SELECT / INSERT / UPDATE / DELETE；ALL 按作用域展开 |
| 转授权 | WITH GRANT OPTION 允许将持有的权限授予其他身份 |
-| 撤销 | 管理员撤销权限及对应转授权能力；当前不级联撤销已转授权限 |
-| 对象名称 | 授权前补全为库.表，检查与持久化使用同一名称 |
+| 撤销 | 授予者撤销自身来源；所有者或最高权限身份管理对象授权，级联清理无合法来源的下游 |
+| 稳定对象 | catalog 分配数据库及表编号，授权与所有者绑定对象和身份编号，删除后不复用 |
+| 所有者 | 建表者获得表所有权；启用角色可继承所有权，数据库所有权不隐含他人表的数据权限 |
+
+对象权限目录 __system_object_acl 对普通语句和存储请求隐藏。权限快照按字符分块，在系统库写锁内比较版本并通过同一 WAL 组替换；服务启动恢复建表前持久化的创建者声明，旧名称授权只迁移一次到现存稳定对象。
类型目录说明见 [types.md](types.md)，身份字段与权限边界见 [users-and-roles.md](users-and-roles.md)。
## 权限变更与会话失效
-账号、属性和授权变化会标记受影响的在线连接。角色变化先展开成员关系，确定涉及的登录身份。
+账号、属性和授权变化会标记受影响的在线连接。角色变化先展开成员及转授权来源关系，确定涉及的登录身份。共享读写门允许查询并行，并将授权及对象结构变更与查询排序；事务提交再次验证权限和稳定对象编号。
TCP 连接在下一次请求时返回 unauthorized 并关闭；空闲连接不被强行中断。权限逐条查询，避免继续使用旧授权。Web 会话还通过账号版本校验，口令或身份变更使旧凭据失效。
+
+## 查询引擎扩展设计（尚未实现）
+
+按 bound IR → 子查询物化 / 递归 CTE 推进；DOMAIN 约束见[类型文档](types.md#domain-约束设计尚未实现)。以下设计尚未实施，当前能力见前文；实施状态以 project-plan.txt 为准。
+
+### bound IR
+
+#### 列与作用域绑定
+
+保留语法 AST 用于解析和诊断；语义检查产出独立 `BoundStatement`，规划、优化及执行逐步只接收它。列引用绑定为作用域编号、来源编号、列编号和类型，保留原始位置用于诊断；相关列明确标记所属外层作用域，不再通过字符串补限定名辨认身份。
+
+#### 表达式类型与错误语义
+
+表达式节点携带结果类型、nullable、已解析运算符/函数标识和显式转换。没有证据证明安全时 `may_error` 为 true；优化不得删除或提前求值可能报错的表达式。未定型 NULL 只参与推导，最后绑定到上下文类型；不允许流入存储 schema。DOMAIN 身份保留在类型节点中，比较可以用底层语义，赋值需经过领域校验。
+
+#### schema 与对象版本
+
+绑定仅使用 schema，不能扫描数据或打开索引。catalog 解析对象后提供 schema 与版本；执行前再次验证稳定对象编号和 schema 版本。统计独立附着，不纳入绑定身份。内存存储使用与磁盘相同的绑定规则。
+
+#### 实施与验收
+
+迁移顺序为查询表达式 → RelOp 输入 → 写语句和约束；过渡适配器单向转换且仅位于边界，不维护两套优化规则。验收用现有查询全集并补同名遮蔽、相关列、别名、NULL/DOMAIN 和错误时序回归；既有可观察顺序保持。
+
+### 通用子查询物化
+
+#### 惰性执行与缓存身份
+
+引入查询内 `LazyMaterialize` 算子：首次实际需要时执行，保留结果行序与重复；非相关查询每语句一次，相关查询按 bound IR 外层列绑定值缓存。缓存键沿用规范值相等、NULL 与领域底层语义，并绑定子计划和执行视图；不能跨语句、会话或权限版本复用。
+
+#### 求值语义
+
+首版只物化已证明确定且无副作用的子计划；可能报错的表达式保持现有首次使用和短路路径，无法证明错误时序相同的改写禁用。空输入不触发子查询，标量多行仍在实际消费时报错。ANY/ALL、IN、EXISTS 各自保留三值及空集规则，不能用集合去重替代结果。
+
+#### 预算与回退
+
+预算同时限制单缓存、查询总缓存和相关键数量；超过预算时在执行该次子计划前选择不缓存的原路径，不能重跑已执行一半的计划。磁盘溢写作为后续阶段，需明确临时目录、类型编码、权限及取消清理。EXPLAIN 展示物化范围与估算，运行统计不泄露缓存行值。
+
+#### 验收条件
+
+验收比较启用/禁用的结果多重集、行序、首次错误、空输入、NULL、重复外层绑定、多次 CTE 引用、预算及取消；不确定函数不可复用。
+
+### 递归 CTE
+
+#### 首版语法范围
+
+保留现有非递归 WITH 行为；新增 WITH RECURSIVE 走绑定作用域，不在解析期无限展开。首版仅单一自引用、锚点 UNION ALL 递归项；自引用只能出现在递归项 FROM，锚点不可引用自身。互递归、多个自引用、递归项聚合/排序/LIMIT、外连接及非单调子查询明确拒绝。UNION 去重递归留后续设计，不能冒用 UNION ALL。
+
+#### 类型绑定与迭代
+
+锚点和递归项输出列数相同；显式列名唯一，先由锚点确定类型，再校验递归项可赋值转换，不按运行数据扩宽。无法给锚点 NULL 定型时要求显式类型。执行用 worktable，递归项仅读取上一轮 delta，按轮次和每轮既有行序追加输出，保留 UNION ALL 重复。
+
+#### 资源预算与终止
+
+拟定默认深度 1000、累计行数 100000、内存 64 MiB，并受服务端上限限制；达到任一预算返回 resource_limit，不返回截断结果。深度定义为递归项执行轮数；delta 为空正常终止。外层 LIMIT 首版不作为终止证明，先完整执行递归再消费，避免隐藏循环/错误。取消释放所有 worktable。
+
+#### 验收条件
+
+验收覆盖零轮、多轮、重复路径、循环超限、NULL/类型冲突、空锚点、名称遮蔽、非法自引用和查询取消。EXPLAIN 明确递归与预算。
+
+## 存储与事务扩展设计（尚未实现）
+
+先引入稳定行编号和 MVCC，再实施跨页 compact 与并行写。前置条件是新页格式、版本化 WAL、离线升级工具及恢复验收。
+
+新格式必须标版本，旧二进制拒绝打开。旧数据在保留备份的停服副本上升级、校验后发布，不混用新旧写入路径。每阶段先运行改动模块的规定测试入口，全量门禁由所有者运行；性能数据不能代替语义、恢复或权限验收。
+
+### 行版本 MVCC
+
+#### 身份与可见性
+
+引入库内单调 row_id，独立于用户 `id`、主键及物理槽号；删除不复用。每版本包含 row_id、版本编号、创建/结束提交序号与前版本定位，未提交版本只在事务私有工作集内。读视图固定 snapshot_csn，选取创建序号不大于快照且结束序号大于快照的版本，再合并自身修改。提交序号与 WAL LSN 分离，映射随提交记录持久化。
+
+每连接仍只允许一个事务，保持快照隔离和保存点语义；不声称可串行化，写偏斜仍可能发生。写集记录读取的基线版本，提交验证该版本仍为最新；同 row_id 更新/删除冲突返回 serialization_failure。唯一键冲突在当前已提交状态和本次写集联合检查，不能仅用开始快照验证。无业务 id 的表也按 row_id 提交，不再整表替换。
+
+索引键定位 row_id，索引查询再按快照检查版本；更新键保留旧键候选直到所有活跃快照不再需要，不能只索引最新值。扫描先保持旧格式导入的行序，更新不改 row_id 的扫描位置，新插入按持久化序号排序；不得借 MVCC 无意改变现有无 ORDER BY 输出。
+
+#### 提交、恢复与回收
+
+首版仍串行提交：验证 → 分配 CSN → WAL 记录版本变化及提交 → fsync → 应用 → 统一发布可见 CSN。读者仅获取已完整应用的可见序号；持久化提交后应用失败继续采用 recovery_required 封闭请求，不能把已提交组当作失败撤销。不引入未提交脏页，因此首版保持 redo-only；若将来允许提前刷未提交页，必须另行设计 undo/状态恢复。
+
+保存点记录私有写集边界与不可变根，回退不撤销其他事务版本。活跃快照登记器包括流式扫描和物化消费者；最老快照决定旧版本回收界线。回收同时处理 heap 和索引，读定位有 pin，取消/断线可靠注销。长事务受现有寿命及新增保留空间预算限制，不能为了回收静默推进其快照。
+
+升级在停服副本中为旧行分配 row_id、初始版本和顺序，重建索引，验证行数/值/约束后切换；不得把重复业务 id 合并。新 WAL 与页格式显式版本化，截断仍遵循已刷盘检查点，不顺带改成页 LSN 检查点。
+
+#### 验收条件
+
+验收包含重复/缺失业务 id、旧快照与键更新、删除重插、保存点、唯一并发冲突、写偏斜边界、长读回收、断线及提交每个持久化边界的崩溃恢复；复测 BEGIN/COMMIT 的传输和比较成本。
+
+### 跨页 compact
+
+#### 定位与影子页
+
+使用 row_id 到版本位置的存储内部定位映射，索引不保存可失效的页/槽定位。首版在表维护独占锁下进行，等待该表读 pin 释放；其他表仍可运行。以快照回收界线保留所有可能可见版本，按既有逻辑扫描顺序打包到影子页和定位映射，随后 WAL 记录并原子切换文件代次。
+
+#### 恢复与旧版本保护
+
+旧代次直到无读引用且新代次检查点完成才删除；提交前崩溃丢弃影子文件，提交后重放切换。映射缺失、重复 row_id/版本和校验失败明确报错，不返回缺行扫描。隐藏列一并按当前 schema 改写，旧快照需要的结构不得提前删除。跨页整理不改变对象编号、行编号、值或输出顺序。
+
+#### 验收条件
+
+验收验证前后全量扫描和索引点/范围查一致、快照旧版本、隐藏列、页损坏、空间不足、取消与文件切换崩溃；记录回收页数及 IO，不能只比较耗时。
+
+### 并行写
+
+#### 实施顺序与锁范围
+
+先允许事务私有写集准备并行，继续保留短串行 WAL/CSN 发布；第二阶段按稳定表编号与 row_id 排序取得写锁、唯一键锁。DDL/维护使用库结构锁，跨表事务必须一次取得完整锁集，禁止边执行边任意升级。权限读门在执行和最终复查期间保持现有语义；目录及 ACL 修改仍单独排序。
+
+#### 唯一键锁与取消
+
+唯一键锁使用与值相等一致的规范编码，缺主键也使用 row_id 锁。等待有取消与超时，超时返回明确错误且保持/回退事务遵循现有错误分类；固定锁序避免内部锁环，不承诺支持任意用户锁或死锁自动重试。
+
+#### 提交发布顺序
+
+允许不同表/行的验证和页面准备并行，但同一页短 latch、catalog 高水位、索引节点和 WAL 写入仍保护。发布 CSN 必须按提交顺序形成连续已应用前缀，后提交不能跨过未完成组而对读者可见。group commit 为后续性能阶段，不能改变每组原子性和持久化失败语义。
+
+#### 验收条件
+
+验收覆盖同表不同行、同一行、唯一键冲突、跨表相反顺序、DDL/compact/撤权竞争、超时取消和 WAL 故障；用确定同步点断言并发结果，再单独测吞吐与等待时间。
diff --git a/docs/badges/README.md b/docs/badges/README.md
deleted file mode 100644
index e580d8f..0000000
--- a/docs/badges/README.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# README 徽章
-
-所有徽章都是本地 SVG，采用统一的深色标签、彩色值区和圆角样式。
-
-执行 `pwsh -File scripts/update-code-lines.ps1` 可重新生成全部徽章。代码行数包含代码、测试、注释和空行，排除 Git 忽略的构建工件；行数与提交编号是生成时的本地快照。
-
-发布徽章链接 GitHub 版本列表。构建、测试和门禁徽章提供实时状态页面入口，本地图片显示 `view status` 或 `manual status`，不保存或宣称实时通过状态。门禁由所有者手动触发。
diff --git a/docs/badges/build.svg b/docs/badges/build.svg
deleted file mode 100644
index 2a6dfa9..0000000
--- a/docs/badges/build.svg
+++ /dev/null
@@ -1,6 +0,0 @@
-
diff --git a/docs/badges/commit.svg b/docs/badges/commit.svg
deleted file mode 100644
index 7948aa8..0000000
--- a/docs/badges/commit.svg
+++ /dev/null
@@ -1,6 +0,0 @@
-
diff --git a/docs/badges/gate.svg b/docs/badges/gate.svg
deleted file mode 100644
index d8a7811..0000000
--- a/docs/badges/gate.svg
+++ /dev/null
@@ -1,6 +0,0 @@
-
diff --git a/docs/badges/languages.svg b/docs/badges/languages.svg
deleted file mode 100644
index aecd033..0000000
--- a/docs/badges/languages.svg
+++ /dev/null
@@ -1,6 +0,0 @@
-
diff --git a/docs/badges/lines.svg b/docs/badges/lines.svg
deleted file mode 100644
index 58a277c..0000000
--- a/docs/badges/lines.svg
+++ /dev/null
@@ -1,6 +0,0 @@
-
diff --git a/docs/badges/release.svg b/docs/badges/release.svg
deleted file mode 100644
index ebd73ec..0000000
--- a/docs/badges/release.svg
+++ /dev/null
@@ -1,6 +0,0 @@
-
diff --git a/docs/badges/tests.svg b/docs/badges/tests.svg
deleted file mode 100644
index db721e1..0000000
--- a/docs/badges/tests.svg
+++ /dev/null
@@ -1,6 +0,0 @@
-
diff --git a/docs/commands.md b/docs/commands.md
index 2564df3..3711031 100644
--- a/docs/commands.md
+++ b/docs/commands.md
@@ -45,6 +45,7 @@ csql [options]
| `-f, --format FORMAT` | 输出格式：`table`、`json` 或 `csv` |
| `-e, --execute SQL` | 执行一条 SQL 后退出 |
| `--history FILE` | 指定历史记录文件 |
+| `--sudo` | 使用本机 root / 提升管理员身份认证；需配置映射并启用身份属性，见 [用户与角色](users-and-roles.md#本机-sudo-认证) |
| `--config FILE` | 指定配置文件 |
| `-h, --help` | 显示帮助 |
@@ -99,6 +100,18 @@ chusql-web [options]
静态资源目录固定为 `static`。其余请求大小、会话、登录限制、分页等参数通常通过 `settings.toml` 配置即可。
+### 表格编辑与事务
+
+首次打开业务数据表时建立编辑快照。同一页面内、同一数据库的跨表修改统一暂存；“提交全部”在服务端事务中执行，全部成功才持久化。逐项撤销只移除本地编辑项，下次提交从原快照重放剩余编辑；“撤销全部”执行 ROLLBACK 并重新加载表和统计。
+
+途中发生约束错误时，整批语句退回编辑保存点，完整编辑内容仍可修正。写写冲突不会覆盖其他会话，必须撤销并重新加载后重新编辑。提交响应断线时冻结编辑集；再次点击提交使用同一标识确认或重试同一批修改，已成功的提交不会重复执行。
+
+编辑事务绑定登录会话、页面和数据库；待提交修改存在时，先提交或撤销才能换库或运行 SQL。关闭最后一个表标签且没有待提交修改时释放快照。关闭页面会请求回滚，退出登录会关闭连接并丢弃快照；若页面断线、回滚请求未送达，后台每分钟按配置的会话空闲与最长寿命清理连接。重新登录不能继续旧事务。
+
+SQL 控制台使用另一条服务端连接；SQL 的 BEGIN / COMMIT / ROLLBACK 绑定发起它的页面与查询标签。事务尚未结束时，其他控制台和普通 REST 写操作不能占用该连接；关闭所属查询标签或页面时请求回滚。系统身份修改不支持数据事务，账号表只读，使用 SQL 用户与角色命令管理。
+
+Web 模块测试入口为 `stack test chusql-web --fast`，其中同时运行 `node --test test/transactions.mjs`；测试环境需要 Node.js。
+
## chusql-server
基本用法：
diff --git a/docs/config.md b/docs/config.md
index 28e6337..62756dc 100644
--- a/docs/config.md
+++ b/docs/config.md
@@ -53,6 +53,8 @@ ChuSQL 使用统一配置文件 `settings.toml`。默认位置：
| `max_message` | `1048576` | 单条请求最大大小（字节） |
| `max_rows` | `1000` | 单次查询最大返回行数 |
+本机 sudo 认证额外使用 `[server] sudo_auth_user`，默认空字符串，表示关闭。设置为一个已启用 `ALLOW_SUDO_AUTH` 的数据库身份后，必须以 Unix root 或 Windows 提升后的管理员运行 `chusql-server`。这是明确的本机身份映射，与启动参数 `--user` 和最高权限属性分别设置。配置变更后重启服务生效，Web 设置页面不提供此项。操作步骤见 [用户与角色](users-and-roles.md#本机-sudo-认证)。
+
修改 Server 相关配置后需要重启 `chusql-server`。
## 账号与安全
diff --git a/docs/install.md b/docs/install.md
index d9092ca..5b4ad61 100644
--- a/docs/install.md
+++ b/docs/install.md
@@ -33,6 +33,17 @@ ChuSQL 支持三种安装方式：
完成系统目录初始化后，安装程序默认会启动 `chusql-server`；如不希望自动启动，可使用 `--no-start`（Windows 为 `-NoStart`）。
+Linux 默认注册 `chusql-server.service` 为当前操作系统用户的 systemd 服务，并启用 linger 和开机启动，无需登录即可运行，异常退出后自动重启。需要可用的 systemd 用户会话；若启用 linger 时权限不足，按安装提示执行 `sudo loginctl enable-linger "$(id -un)"` 后重试。数据库管理员 `--user` 与运行服务的操作系统用户是两个独立身份。
+
+`--no-start` 仅跳过本次启动，仍启用开机启动。非 systemd 环境可使用 `--no-service` 跳过服务注册，此时保留原有后台启动方式。
+
+```sh
+systemctl --user status chusql-server.service
+systemctl --user restart chusql-server.service
+systemctl --user stop chusql-server.service
+journalctl --user -u chusql-server.service
+```
+
## 包内安装
解压发行包后，在包根目录执行：
@@ -56,6 +67,7 @@ Windows：
| `--data-dir DIR` | `-DataDir` | 指定数据目录 |
| `--user NAME` | `-RootUser` | 指定管理员账号名 |
| `--no-start` | `-NoStart` | 安装后不自动启动服务 |
+| `--no-service` | — | 跳过 Linux 服务注册和开机启动 |
| `--version TAG` | `-Version` | 指定发行版本 |
| `--list-versions` | `-ListVersions` | 列出可安装版本 |
| `--from-source` | — | 从源码构建并安装 |
@@ -108,3 +120,9 @@ Windows：
```
如需保留数据，可使用 `--keep-data`（Windows 为 `-KeepData`）；如需保留配置，可使用 `--keep-config`（Windows 为 `-KeepConfig`）。
+
+Linux 卸载时会停止服务、取消开机启动并移除服务文件。用户的 linger 设置保留，其他用户服务仍可使用它。
+
+## 发布真实性与后续签名方案
+
+当前 SHA256 校验用于检测产物损坏，发布签名尚未实现。密钥管理、可信根、轮换、在线与离线验证的设计见[发布签名与验证](release-signing.md)；设计中的验证器和签名安装流程目前不可用。
diff --git a/docs/normalization.md b/docs/normalization.md
new file mode 100644
index 0000000..7afb07d
--- /dev/null
+++ b/docs/normalization.md
@@ -0,0 +1,143 @@
+# 数据库范式分析与迁移
+
+引擎模块 `ChuSQL.Core.Engine.Normalization` 提供只读范式分析。输入只有 schema 与用户声明，不读取样本数据，不访问或修改存储。
+
+## 接口与示例
+
+```haskell
+analyzeNormalization
+ :: [(String, Column)]
+ -> Declaration
+ -> Either String Analysis
+```
+
+调用示例：
+
+```haskell
+analyzeNormalization [("student", TInt), ("course", TInt), ("name", TStr)]
+ (Declaration
+ { declaredKeys = [["student", "course"]]
+ , dependencies = [Dependency ["student"] ["name"]]
+ , dependenciesComplete = True
+ , atomicAttributes = Just True
+ })
+```
+
+这个声明违反 2NF、3NF、BCNF：非主属性 `name` 依赖复合候选键的真子集 `student`。
+
+报告的 `witnesses` 给出相关字段，`condition` 给出范式条件。建议分为 `(student, name)` 与 `(course, student)`，无损连接并保持声明依赖。
+
+## 声明与输入校验
+
+`declaredKeys` 中每个键作为决定全部字段的依赖加入公理推导；检查器验证其最小性，并枚举所有最小超键。空键允许表达只有一行的关系约束。
+
+字段名称使用 schema 中的确切名称，不自行处理 SQL 标识符解析。以下输入返回明确错误：
+
+- 未知字段或重复字段。
+- 空依赖右部。
+- 非最小候选键。
+- 空 schema。
+
+## 公理推导与范式条件
+
+属性闭包以输入属性实现自反性，逐轮加入已满足左部的依赖右部，得到阿姆斯特朗增广和传递规则蕴含的闭包。检查器枚举字段子集及其闭包，检查完整的依赖投影。
+
+| 范式 | 检查条件 |
+| --- | --- |
+| 1NF | 根据用户声明判断领域值原子性。 |
+| 2NF | 检查所有候选键的部分依赖。 |
+| 3NF | 检查非超键左部与非主属性右部。 |
+| BCNF | 检查非超键左部。 |
+
+理论定义可参考[数据库课程讲义](https://documents.uow.edu.au/~jrg/235/slides/03databasenormalization/03databasenormalization.html)。
+
+## 信息完整性与判定
+
+### 领域值原子性
+
+`atomicAttributes` 是用户关于领域值原子性的声明：
+
+| 声明值 | 1NF 判定 |
+| --- | --- |
+| `Just True` | 满足。 |
+| `Just False` | 违反。 |
+| `Nothing` | 信息不足。 |
+
+schema 类型不证明业务意义上的原子性。不满足 1NF 时更高范式也判违反；原子性未知时更高范式信息不足。
+
+### 依赖完整性
+
+只有 `dependenciesComplete = True` 才对更高范式给出满足或违反结论。这表示用户承诺给出了完整业务依赖的一个覆盖，而非必须列出所有推导依赖。完整的空依赖集有效。
+
+未承诺完整时，更高范式返回 `Insufficient`，不输出违反证据或分解建议。此时 `candidateKeys` 仅是相对已知声明求得的键，不能视为完整业务候选键清单。
+
+分析始终以声明为条件，不能证明数据库实际数据满足声明。
+
+## 分解建议
+
+分解建议仅针对第一条 BCNF 违反依赖 `X -> Y`，输出两个子关系：
+
+- `X ∪ Y`
+- `R − (Y − X)`
+
+该二元分解由依赖保证无损；依赖保持通过两个子关系的完整依赖投影之并是否蕴含原依赖集判定。
+
+建议只是一轮分解，子关系可能仍需继续分析，不承诺一次达到 BCNF。依赖不保持时需跨关系检查原约束。
+
+## 第一阶段限制
+
+- 最多接受 12 列，超过返回错误，避免指数枚举无界增长。
+- 仅提供 Haskell 只读 API。
+- CLI / Web 入口和自动迁移尚未实现。
+
+## 后续入口设计（尚未实现）
+
+以下 TCP、CLI 和 Web 接口尚未实现，拟议命令与端点目前不可用。实施状态以 project-plan.txt 为准。
+
+### 协议与鉴权
+
+在 `ChuSQL.Interface.Protocol` 增加专用客户端请求 `normalization_analyze`，由 server 调用 engine API；不经最高权限专用的原始 `ReqStorage` 入口。请求包含 `api_version=1`、数据库与表标识、声明，以及可选的预期对象编号和 schema 指纹。server 在现有权限读门内以 catalog 解析现存对象，检查 CONNECT 与 SELECT；系统对象拒绝访问。事务内取该连接的 schema 快照，返回视图来源和对象编号，不能混入其他连接的快照。
+
+声明字段固定为 `declared_keys`、`dependencies`（`lhs` / `rhs`）、`dependencies_complete`、`atomic_attributes`。完整性缺省 false，原子性缺省 null；不把 PRIMARY KEY、UNIQUE 或样本自动当作完整业务依赖。前端可以展示实际 schema 约束供用户选择，确认后才成为声明。候选键的 nullable 与 SQL UNIQUE 语义单独提示，不自动证明经典关系模型的键。
+
+响应包含对象编号、schema 指纹、规范化声明、候选键、四项 findings 和一次分解建议。稳定标签使用 `1nf/2nf/3nf/bcnf`、`satisfied/violated/insufficient`；条件说明与机器字段分开。所有结论标明“以声明为条件”，无损连接标签不代表现有 SQL 数据或袋语义已经验证。
+
+字段名称必须与返回 schema 的确切列名一致；对象名称使用现有标识符规则，数据库限定名必须与请求数据库一致。指纹只覆盖列名、类型和约束等语义结构，排除行数与直方图；定义确定性编码并同时绑定稳定对象编号，避免同名重建复用报告。
+
+拒绝未知协议版本、未知字段、重复字段、空右部、非最小声明键、空 schema 和超过 12 列。拟定请求上限 64 KiB、依赖条数 256、键声明 256；预算超限返回明确错误，不截断后给出完整报告。分析在有界工作队列运行，取消或超时释放权限读门与会话资源；输出也受传输预算约束，超限返回错误。实施时用最坏 12 列声明确定默认时间预算。
+
+### CLI 与 Web
+
+CLI 拟议元命令为 `\normalize TABLE --declaration FILE --format text|json`，通过当前登录连接和工作库请求。声明文件为 UTF-8 JSON，错误写 stderr；成功分析退出码 0，即使结论违反或信息不足；协议、权限、输入与运行错误退出非零。批处理增加独立 `--normalize` 模式，与 `--execute` 互斥，不把元命令发给 SQL 解析器。
+
+Web 拟议 `POST /api/normalization/analyze`，复用登录、CSRF 和 Cookie 串行规则。入口位于表结构页：展示 schema、编辑声明、提交分析、显示证据和分解字段列表。完整性与原子性不预先勾选；没有自动执行分解按钮。编辑页分析必须携带既有页面事务标识，不能自动开启另一事务。对象或 schema 改变返回冲突并要求重新分析。
+
+### 入口验收
+
+验收覆盖 engine 报告的协议往返、CLI 文本/JSON 同值、Web 与 TCP 越权、跨库同名、删表重建、事务快照、超限及取消。沿用现有 14 项算法回归，不复制算法到客户端。
+
+## 数据迁移设计（尚未实现）
+
+先实现只读入口，再在 [DOMAIN 约束](types.md#domain-约束设计尚未实现)、依赖目录和原子结构发布具备后实施迁移。
+
+### 规划条件
+
+迁移首版限定单业务表、二元分解、显式目标名，保留原表，不自动改名或删除。请求必须引用报告对象编号、schema 指纹及声明摘要；报告本身不是执行授权。要求来源 SELECT、数据库 CREATE；切换旧表需要来源所有权。每个目标取得新编号和执行者所有权，原 ACL 不自动复制。
+
+经典 FD 与无损分解适用于关系集合，当前 SQL 保留重复行且有 NULL。首版只接受所有参与字段 NOT NULL、全行无重复且声明确实成立的数据；否则明确拒绝，不能通过 DISTINCT 悄悄丢行。候选键也必须验证唯一和非空，包括空键最多一行。FD 验证按引擎规范值相等规则分组，禁止使用文本序列化代替值比较。
+
+目标数据为各字段投影的集合。验证每条声明 FD、全部候选键、目标约束及两目标连接与来源的完整多重集相等；无损性理论证明和实际重建检查均须通过。若投影依赖不能保持所有原依赖，首版拒绝迁移；后续有跨表约束执行器后再开放，不只弹提示继续。
+
+### 结构依赖与发布
+
+规划器枚举索引、默认值、CHECK、DOMAIN 引用、外键及其他已登记依赖，逐项生成保留或拒绝理由。单目标可表达的约束绑定后迁移；跨目标 CHECK、无法保存的索引/唯一约束及任何无法枚举的受支持依赖阻止发布。不得根据 SQL 文本替换列名。客户端保存的任意 SQL 无法枚举，保留来源表可避免静默改坏；首版不提供透明替换。
+
+执行流程为 prepare → validate → publish：prepare 创建不对业务 catalog 可见的暂存对象；validate 固定来源视图并生成目标、验证重建；publish 在短结构锁内复查身份、权限、对象编号、schema 与数据版本，原子登记全部目标。来源变化返回 serialization_failure，不自动重试。暂存对象需要空间预算、作业编号和取消清理。
+
+现有事务禁止 DDL，不能拼接 CREATE/INSERT 伪装成原子迁移。实施前必须加入包含 catalog、页文件、索引和所有权声明的迁移 WAL 发布组；提交前暂存文件可清理，提交后故障进入 recovery_required 并重放到完整目标组。对象编号可以跳号但不得复用。恢复仅依据作业状态与 WAL 清理暂存对象，不能按名称猜测。
+
+后续替换来源需独立设计：稳定对象引用、授权重绑定、完整依赖图与原子交换。保留原对象及其编号直到该方案验收；当前阶段不提供多轮自动 BCNF 化。
+
+### 迁移验收
+
+验收包含重复/NULL/不成立 FD 的拒绝、依赖不保持、跨目标约束、并发修改、撤权、名称占用、取消、空间不足，以及每个 WAL/文件发布边界的崩溃恢复；失败不得留下部分可见目标。
diff --git a/docs/performance.md b/docs/performance.md
index b2d1f44..4515459 100644
--- a/docs/performance.md
+++ b/docs/performance.md
@@ -103,6 +103,8 @@ stack exec -- benchmark4csql 10000 50000
## 性能瓶颈分析
+本节描述首次基准时的实现；事务差分优化后的结果见文末复测。
+
### 1. 事务提交的整库差分是首要排查点
本次 200 条事务 INSERT 比 200 次独立持久化 INSERT 慢约 60 倍。事务阶段开始时，数据库已有 10,000 用户、50,000 订单及 5,000 宽行，事务只修改 writes 表。事务内一次 400 行 UPDATE 仅耗时 0.5 ms，说明不能将整个事务阶段的 67.55 秒简单归因于 SQL 更新计算或 fsync。
@@ -132,3 +134,23 @@ stack exec -- benchmark4csql 10000 50000
## 使用范围
这是单机回环、主要为热缓存、管理员身份的单次基准，不是生产容量承诺。未覆盖远程网络、鉴权角色开销、崩溃恢复耗时、并发写冲突或大型宽表。七次读采样和单次写测量不足以建立统计置信区间，后续优化应使用相同参数、多次独立运行和分阶段 profile 比较。
+
+## 2026-10-05 事务差分优化复测
+
+使用相同机器、优化构建及 10,000 用户、50,000 订单规模运行完整基准，所有场景及结果校验通过（`BENCHMARK_OK`）。日志为 `logs/repair-txn-performance.log`。
+
+COMMIT 跳过未修改表，以 IntMap / IntSet 查询整数键差分，冲突检查与操作生成共享差分；保持原行顺序及重复 id 的首行查找语义。
+
+| 指标 | 耗时（ms） |
+| --- | ---: |
+| 200 次独立持久化 INSERT | 1,134.7 |
+| 事务 200 条 INSERT 总计 | 687.355 |
+| BEGIN | 269.806 |
+| 事务内 200 条 INSERT | 41.129 |
+| COMMIT | 376.345 |
+
+事务总耗时从首次的 67,549.539 ms 降至 687.355 ms，约快 98 倍，吞吐从 2.96 升至 290.97 行/秒；本次事务写入约比逐条持久化快 1.65 倍。两次独立运行未建立统计置信区间，倍数仅描述这两次测量。
+
+BEGIN 与 COMMIT 仍获取整库快照，合计约占事务总耗时的 94%；COMMIT 计时也包含差分、冲突检查和持久化，不能全部归因于快照。整库快照传输、修改表比较及刷盘仍需进一步分阶段测量。
+
+20 个不同绑定的相关 EXISTS 平均 2,135.218 ms（首次 2,061.770 ms），该瓶颈仍存在，本轮没有改变子查询执行方式。
diff --git a/docs/release-signing.md b/docs/release-signing.md
new file mode 100644
index 0000000..c669820
--- /dev/null
+++ b/docs/release-signing.md
@@ -0,0 +1,31 @@
+# 发布签名与验证设计
+
+本文定义尚未实现的发行安全方案。当前操作见[安装文档](install.md)，实施状态以 project-plan.txt 为准。先实现离线验证，再接入在线安装；该工作可独立于查询和存储扩展推进。
+
+## 选择与信任入口
+
+采用标准 TUF root/targets/snapshot/timestamp 元数据和 Ed25519 签名，使用经过维护的实现与标准测试向量，不自行定义签名 JSON 规范。Ed25519 算法依据 [RFC 8032](https://datatracker.ietf.org/doc/rfc8032/)，角色、轮换、版本及过期验证依据 [TUF 规范](https://theupdateframework.github.io/specification/v1.0.36/)。SHA256 保留为产物散列，签名覆盖其可信元数据来源。
+
+可信初始 root 随独立取得的安装器/验证器发布，记录版本与公钥；不能从同一个未认证下载响应接受任意公钥。首次下载安装器仍依赖用户可信取得该安装器这一入口，不能宣称脚本内公钥解决首次下载脚本被替换。升级客户端保存可信元数据的版本与过期状态，拒绝回退、混配和过期；状态缺失不等同于已完成反回退验证。
+
+targets 绑定确切文件名、长度、SHA256、平台/架构、版本、提交号、组件清单与最低数据格式要求。snapshot 固定元数据版本/散列，timestamp 指向 snapshot。禁止通配匹配产物、跨平台替代和同版本静默覆盖；签名通过后才允许解包或执行 bootstrap。
+
+## 密钥与发布操作
+
+root 使用离线 2-of-3 阈值密钥，分开保管及加密备份；CI 不持有 root 私钥。targets 发布密钥限定于受保护发布环境，仅受信任标签与人工发布流程可调用；PR 构建、普通日志、构建缓存和发行包均不能读取私钥。snapshot/timestamp 使用独立在线密钥，权限和有效期按角色设置；拟定 targets/snapshot 30 天、timestamp 7 天、root 1 年，并通过到期监控续签。
+
+轮换 root 按连续版本发布，同时满足旧 root 与新 root 阈值；离线备份定期做恢复演练。在线密钥泄露时停止发布，用 root 撤销并更换受影响角色密钥，重新生成元数据；所有 root 信任丢失时需要经独立可信渠道重新引导，不能靠损坏的 root 自证恢复。
+
+发布顺序为构建与模块/所有者门禁 → 装配确切产物 → 计算散列 → 签 targets/snapshot → 上传产物和版本化元数据 → 最后发布 timestamp。任何产物字节变化均需重新签署。签名不证明构建内容正确，平台真机验收仍单列。
+
+## 安装与兼容性
+
+新增小型跨平台验证器，打包随安装器提供；验证器不可作为首个未验证的临时下载再立即执行。在线安装先验证元数据链、版本、有效期与目标平台，再下载并验长度/散列，之后才解包。签名缺失、密钥未知、元数据过期、系统时间无法可信校验等均明确失败，不降级成仅 SHA256。
+
+本地离线安装使用随包 root 链、targets 和 snapshot 验证真实性与完整性；缺少在线 timestamp 时明确说明不能证明最新版本。离线模式必须显式选择且不联网；已有可信版本仍禁止回退，元数据过期仍失败，需要重新取得有效离线元数据。历史无签名包不纳入新安装器的可信安装路径。
+
+系统原生代码签名分别设计接入 Windows Authenticode 和 macOS Developer ID/notarization；TUF 不能替代操作系统签名，第一阶段也不声称消除 SmartScreen/Gatekeeper 提示。Linux $ORIGIN、在线下载与 macOS 发行继续按现有实机待办验收。
+
+## 验收条件
+
+验收覆盖合法包、字节篡改、错误平台、截断、签名替换、重复键/非法元数据、未知密钥、过期、回退、元数据混配、连续 root 轮换/阈值不足、撤销、断网离线、下载中断与私钥日志检查；三平台从干净安装目录验证拒绝路径不会执行包内程序。
diff --git a/docs/runtime-types.md b/docs/runtime-types.md
new file mode 100644
index 0000000..e6642b0
--- /dev/null
+++ b/docs/runtime-types.md
@@ -0,0 +1,65 @@
+# 运行时类型与函数基础
+
+阶段 A 提供固定身份的内建类型、函数注册表、schema 驱动的绑定和类型化查询入口。
+完整 capability、运算符注册、转换、用户 ADT 与 Extension 留在后续阶段。
+
+## SQL 使用
+
+```sql
+CREATE TABLE typed_values (
+ id Int,
+ name String,
+ numbers [Int],
+ label Maybe String,
+ pair (Int, String)
+);
+
+INSERT INTO typed_values (id, name, numbers, label, pair)
+VALUES (1, 'abc', LIST(1, 2), MAYBE(), TUPLE(3, 'x'));
+
+SELECT length(name), numbers, label, pair FROM typed_values;
+
+UPDATE typed_values SET numbers = LIST(9), label = MAYBE('ready') WHERE id = 1;
+
+SELECT LIST(MAYBE(), MAYBE(42));
+SELECT not(TRUE), length('你好');
+```
+
+类型语法支持 `Int`、`Double`、`Bool`、`String`、`[a]` / `List a`、`Maybe a` 和 `(a, b, ...)`。
+构造器中的类型参数是完整逻辑类型；空列表和 Nothing 也有确定类型。
+`MAYBE()` 表示 Nothing，`MAYBE(value)` 表示 Just；不能用 SQL NULL 代替复合值内部的 Nothing。
+SQL 可空列仍接受 NULL，和 Maybe 的 Nothing 保持区别。
+构造器按完整类型校验，不隐式转换 List 的元素类型。
+
+内建签名为 `length :: String -> Int` 和 `not :: Bool -> Bool`，名称不区分大小写。
+SQL 参数为 NULL 时结果为 NULL；具体非空参数仍校验类型。
+尚无运行时 Eq / Ord / Hash 字典，复合类型的比较、排序、分组、极值和索引不会自动取得能力。
+Web 显示复合值及 SQL 构造器预览，复合字段通过 SQL 控制台修改。
+
+## 身份与编码
+
+`ChuSQL.Core.Runtime` 是共享模型中的权威定义；Engine 模块导出同一组身份。
+内建构造器编号固定为 Int=1、Double=2、Bool=3、String=4、List=5、Maybe=6、Tuple=7。
+TypeId 包含已校验的完整构造器应用，比较和恢复不依赖注册顺序或随机哈希。
+FunctionId 固定为 length=1、not=2；内建元数据可直接重建注册表。
+
+逻辑 TypeExpr 与 PhysicalType 分开；List、Maybe、Tuple 使用递归 sequence、optional、product 表示。
+schema 保存版本化的 TypeId，协议值保存版本、类型身份和 payload；包括 String 在内的运行时值共用编码。
+Rust 的通用行、目录和 WAL 路径保存该表示，读取时由共享模型验证版本、类型、元素和字段个数。
+未知版本、身份溢出、类型不符、非有限浮点数及损坏 payload 明确返回错误。
+内建类型不可删除，复合类型的依赖完整包含在 TypeExpr 中。
+旧标量 schema 和协议继续读取；包含运行时类型的数据不能交给不支持该编码的旧客户端。
+
+## 绑定与执行
+
+`Runtime.Binding` 提供独立的 TypedExpression 和 TypedPlan，绑定只接受 catalog schema。
+表达式和计划构造器隐藏，调用者必须经过 Binder；执行使用已解析的 TypeId / FunctionId，并校验存储行。
+该 API 覆盖单行、表扫描、投影和过滤，可构造嵌套复合值及函数调用。
+
+SQL SELECT 通过 `Runtime.Query.bindQuery` 生成不可直接构造的 BoundQuery，再由 `executeQueryM` 执行。
+绑定计划保存输出 schema 与类型身份；现有 RelOp 作为关系执行和优化的兼容桥，输出按位置校验，保留重复别名。
+类型化函数和构造器节点也进入 INSERT、UPDATE、CHECK、聚合参数和子查询。
+日期、时间戳、Blob 等阶段 A 外的类型保留明确的 CompatibilityType。
+旧 ColumnType 和运算符实现尚未整体移除；统一 capability、cast 和 rewrite 将在后续阶段收拢。
+
+测试覆盖稳定编码、kind / 参数校验、共享协议、SQL 调用和复合列、实际存储重载、HTTP/TCP 与客户端显示。
diff --git a/docs/syntax.md b/docs/syntax.md
index 3000399..de41a47 100644
--- a/docs/syntax.md
+++ b/docs/syntax.md
@@ -136,13 +136,21 @@ REVOKE reviewer FROM alice;
DROP ROLE analyst;
```
-当前表级权限包括：`SELECT`、`INSERT`、`UPDATE`、`DELETE` 和 `ALL`。
+表级权限包括 `SELECT`、`INSERT`、`UPDATE`、`DELETE`；数据库权限包括 `CONNECT`、`CREATE`。`ALL` 按对象类型展开。未限定的表名及 `*` 使用当前数据库，`库名.表名` 和 `库名.*` 可指定其他数据库；系统对象不能通过业务 GRANT 授权。
+
+```sql
+REVOKE CONNECT ON DATABASE sales FROM PUBLIC;
+GRANT CONNECT, CREATE ON DATABASE sales TO analyst;
+GRANT SELECT ON TABLE sales.orders TO reviewer WITH GRANT OPTION;
+GRANT SELECT ON sales.* TO analyst;
+REVOKE SELECT ON sales.orders FROM reviewer;
+```
角色可以互相继承：`GRANT analyst TO reviewer` 让 `reviewer` 成为 `analyst` 的成员并取得其授权；继承会沿成员关系传递，成环的授权被拒绝（报 `conflict`），自继承同样拒绝。用户也可以直接接受表级授权或作为其他角色的成员。
-管理员拥有完整权限；数据库、表、索引等结构管理操作仅允许管理员执行。
+最高权限身份拥有完整权限。数据库默认向 PUBLIC 开放 CONNECT，不默认授予 CREATE 或数据权限。具有数据库 CREATE 的身份可建表，并成为新表所有者；表所有者可管理表、字段及索引，并授予该表权限。数据库所有者可删除自己的数据库，创建数据库与管理 DOMAIN 仍要求最高权限。
-`GRANT ... WITH GRANT OPTION` 让拿到的授权可以再转授：普通身份只有手里那条授权带 grant option 时才能执行 `GRANT`，报错是 `grant option required: <权限> ON <表>`；`REVOKE` 仍然只允许管理员，收回授权会连它的 grant option 一起收掉，且不会级联收回别人转授出去的授权。转授权随角色继承一起传递。
+`GRANT ... WITH GRANT OPTION` 允许再转授；所有者也可授予自身对象的权限。普通授予者可撤销自己的授予，所有者及最高权限身份可撤销对象上的其他授予。撤销时收回相应 grant option，并级联清理失去合法来源的下游授权；仍有独立来源的授权保留。转授权能力随启用的角色继承，循环转授不能独立维持权限。REVOKE 不移除所有者的隐含权限。
系统目录访问还受目录管理属性控制，具体能力见 [用户与角色](users-and-roles.md)。
@@ -152,4 +160,6 @@ DROP ROLE analyst;
```sql
ALTER USER alice SYSTEM_CATALOG_MANAGER;
ALTER USER alice NOSYSTEM_CATALOG_MANAGER;
+ALTER USER alice ALLOW_SUDO_AUTH;
+ALTER USER alice NOALLOW_SUDO_AUTH;
```
diff --git a/docs/types.md b/docs/types.md
index a41725a..d930d7d 100644
--- a/docs/types.md
+++ b/docs/types.md
@@ -46,3 +46,23 @@ DOMAIN 按数据库保存，保留名称并复用基础类型的校验与运算
该目录是受保护的系统元数据，普通 SQL 不直接展示或修改它。类型执行语义由引擎实现，不能通过手工增加目录行获得新的基础类型。安装登记不会创建任何预定义 DOMAIN；DOMAIN 定义另存于各工作库的 catalog。
首次安装完成管理员初始化后登记类型。重复引导保留一致的记录并补齐缺失项；同名定义冲突会报错，停止安装启动流程，不覆盖现有定义。
+
+## DOMAIN 约束设计（尚未实现）
+
+以下约束与 ALTER 能力是后续设计，当前 DOMAIN 仍只提供类型命名。实施依赖 [bound IR](architecture.md#bound-ir)，先固化类型、列身份与表达式求值规则。
+
+### 约束与默认值语义
+
+定义扩展为基础类型引用、可选 DEFAULT、NOT NULL、命名 CHECK 及定义版本。CHECK 只接受绑定的单值 `VALUE` 表达式和确定性内置函数，禁止子查询、表引用和自定义副作用函数；CHECK 的 false 拒绝，unknown 允许，NOT NULL 独立拒绝 NULL。嵌套领域从底层向外校验，约束取交集；显式列默认优先，否则使用最近外层有定义的领域默认，只在省略列值时使用，不替换显式 NULL。
+
+### 引擎与存储校验
+
+server/engine 负责绑定；Rust 存储根据版本化约束 IR 在全部写入口再次验证，包含批写、原始请求和迁移。两层必须共享运算符标识、类型及 NULL 规则并用相同测试向量验证；不能让 Rust 重新解析 SQL 或只依赖客户端验证。解析诊断不得吞错。
+
+### 结构变更与持久化
+
+首版仅支持 CREATE 带约束与 ALTER 添加经全量验证的约束、修改默认；不支持 NOT VALID 或 CASCADE。ALTER 在稳定 schema/数据视图中校验所有直接和间接使用列，短锁发布前复查版本；失败不改变定义。类型定义、依赖版本和受影响 schema 同一 WAL 组提交。现有 DOMAIN 空目录表升级为明确版本元数据，旧编码读入并转换，拒绝无法解析的定义。
+
+### 验收条件
+
+验收覆盖嵌套默认优先级、三值 CHECK、NULL、批写全回退、领域改变并发写、循环/间接依赖、内存事务提交与 WAL 重放。新约束加入既有事务后，提交必须按最新定义重新验证或报 schema 冲突。
diff --git a/docs/users-and-roles.md b/docs/users-and-roles.md
index 4bd9978..e347254 100644
--- a/docs/users-and-roles.md
+++ b/docs/users-and-roles.md
@@ -10,6 +10,7 @@ ChuSQL 的用户和角色共用一套身份目录及名称空间。用户是允
| --- | --- | --- |
| `can_login` | `true` | 可以使用账号及口令登录 |
| `is_superuser` | `true` | 具有系统管理及数据访问的最高权限 |
+| `allow_sudo_auth` | `false` | 允许经本机提升身份验证后免数据库口令登录；不赋予权限 |
| `system_catalog_manager` | `false` | 独立目录管理属性；SUPERUSER 本身已具有有效目录管理能力 |
| `enabled` | `true` | 身份处于启用状态 |
@@ -29,9 +30,9 @@ ChuSQL 的用户和角色共用一套身份目录及名称空间。用户是允
身份创建与修改语法见 [SQL 语法](syntax.md#账号与权限)。
-`ALTER USER` 与 `ALTER ROLE` 的属性、口令修改语法通用。可使用 `LOGIN / NOLOGIN`、`SUPERUSER / NOSUPERUSER`、`ENABLED / DISABLED`、`SYSTEM_CATALOG_MANAGER / NOSYSTEM_CATALOG_MANAGER`；同一条语句不能重复指定同一属性。
+`ALTER USER` 与 `ALTER ROLE` 的属性、口令修改语法通用。可使用 `LOGIN / NOLOGIN`、`SUPERUSER / NOSUPERUSER`、`ENABLED / DISABLED`、`SYSTEM_CATALOG_MANAGER / NOSYSTEM_CATALOG_MANAGER`、`ALLOW_SUDO_AUTH / NOALLOW_SUDO_AUTH`；同一条语句不能重复指定同一属性。
-SUPERUSER 可设置目录管理属性。该属性默认为 false，不经成员关系继承；只有自身启用且允许登录的身份能使用它。目录管理者可以进入 system 库、查看身份目录、创建普通身份、修改普通身份属性与口令及删除普通用户身份。它不能管理 SUPERUSER 或其他目录管理者，不能授予这两个特权属性，不能执行 `DROP ROLE`，也不会因此获得创建业务数据库、直接修改系统表或读取业务数据的权限。受限身份变更在存储写锁内再次检查目标权限。
+SUPERUSER 可设置目录管理属性。该属性默认为 false，不经成员关系继承；只有自身启用且允许登录的身份能使用它。目录管理者可以进入 system 库、查看身份目录、创建普通身份、修改普通身份属性与口令及删除普通用户身份。它不能管理 SUPERUSER、其他目录管理者或启用 sudo 认证的身份，不能授予这三个特权属性，不能执行 `DROP ROLE`，也不会因此获得创建业务数据库、直接修改系统表或读取业务数据的权限。受限身份变更在存储写锁内再次检查目标权限。
## 全部身份及凭据字段
@@ -44,6 +45,7 @@ SUPERUSER 可设置目录管理属性。该属性默认为 false，不经成员
| `can_login` | 是否允许直接登录；仅允许登录仍不足以保证登录成功，还需启用及正确口令 | `LOGIN / NOLOGIN` |
| `is_superuser` | 是否具有最高权限；不通过角色成员关系继承 | `SUPERUSER / NOSUPERUSER` |
| `system_catalog_manager` | 是否具有受限的系统目录管理能力；不继承、不替代数据访问授权 | `SYSTEM_CATALOG_MANAGER / NOSYSTEM_CATALOG_MANAGER`，仅 SUPERUSER 可设置 |
+| `allow_sudo_auth` | 是否接受受信任本机提升身份认证；默认 false，不继承，不改变业务权限 | `ALLOW_SUDO_AUTH / NOALLOW_SUDO_AUTH`，仅 SUPERUSER 可设置 |
| `enabled` | 是否启用身份；禁用后不能登录，也不再贡献角色继承权限 | `ENABLED / DISABLED` |
| `identity_version` | 身份目录格式与旧数据迁移标记；旧记录可为 0，当前统一身份格式为 1 | 系统维护；不是会话版本 |
| `registered_at` | 身份创建时间；旧记录缺失时由迁移补齐 | 系统记录 |
@@ -55,7 +57,68 @@ SUPERUSER 可设置目录管理属性。该属性默认为 false，不经成员
| `id` | 对应身份目录中的编号 |
| `password_hash` | 口令哈希，不是明文口令；通过口令修改命令更新 |
-内部账号协议可将身份字段和 `password_hash` 合并为账号对象，但哈希不属于公开的角色展示内容。`SHOW ROLES` 展示全部身份的编号、名称、登录能力、最高权限、启用状态、目录管理属性和创建时间，不返回口令哈希，也不展示全部内部字段。系统表由身份管理接口维护，不应直接修改。
+内部账号协议可将身份字段和 `password_hash` 合并为账号对象，但哈希不属于公开的角色展示内容。`SHOW ROLES` 展示全部身份的编号、名称、登录能力、最高权限、启用状态、目录管理属性、sudo 认证开关和创建时间，不返回口令哈希，也不展示全部内部字段。系统表由身份管理接口维护，不应直接修改。
+
+## 本机 sudo 认证
+
+此入口适用于 Linux、macOS 和 Windows，默认关闭。Unix 有效 UID 0（通常通过 sudo 获得）映射到 `[server] sudo_auth_user`；Windows 提升令牌中的 Administrators 成员映射到同一配置身份。不会使用客户端上报的操作系统用户名、`SUDO_USER`、数据库用户名或角色属性作为操作系统身份凭据。
+
+先用数据库 SUPERUSER 配置目标身份，例如：
+
+```sql
+ALTER USER local_operator ALLOW_SUDO_AUTH;
+```
+
+目标身份仍需 `LOGIN` 与 `ENABLED`；按需要另行授予业务权限。即使它是普通身份，sudo 登录也只获得该身份已有的权限。`SUPERUSER` 和 `SYSTEM_CATALOG_MANAGER` 不会隐含允许 sudo 登录。
+
+在服务端与 CLI 使用的配置中显式设置映射：
+
+```toml
+[server]
+sudo_auth_user = "local_operator"
+```
+
+停止原服务后，以 Unix root 或 Windows 提升后的管理员重启 `chusql-server`，使用受管理员保护的配置文件、数据目录和程序路径。以相同提升身份运行 CLI；Unix 示例：
+
+```sh
+sudo csql --config /absolute/path/settings.toml --sudo -e "SELECT 1"
+```
+
+Windows 在提升的终端中运行 `csql --config C:\absolute\path\settings.toml --sudo -e "SELECT 1"`。`--sudo` 不读取数据库口令，省略 `--user` 时使用配置映射。显式指定其他账号也不能绕过服务端映射。普通 TCP/CLI 口令登录与 Web 登录保持原有口令认证；远程连接无法请求此入口，CLI 也校验实际连接对端为回环地址。
+
+服务启动时产生独立随机凭据。Unix 放在 `/var/run/chusql-sudo-<实际端口>/credential`，目录 root 所有且为 0700，文件为 0600；Windows 放在系统目录的 `config\ChuSQL-Sudo-<实际端口>\credential`，使用不继承的 Administrators / SYSTEM 专属 DACL。读取入口检查当前进程提升身份；Unix 还验证文件所有权、权限和类型，拒绝链接，Windows 拒绝重解析路径。凭据不会传输到网络，CLI 使用 HMAC-SHA256 回应绑定连接、账号和服务实例的一次性随机挑战；挑战 60 秒后过期，每次认证尝试都会消费挑战，失败按账号限流。
+
+服务端在 stderr 记录启用映射和认证结果，不记录凭据或证明。成功登录更新身份目录的 `last_login_at`。`ALTER USER local_operator NOALLOW_SUDO_AUTH`、`DISABLED`、`NOLOGIN`、修改口令或删除身份都会使既有连接在下一次请求时失效。映射配置清空并重启服务后，本机入口关闭。
+
+正常停止服务时清理凭据。异常退出可能留下端口专属目录；再次启用会明确报错，不读取或覆盖旧凭据。确认对应服务已停止后，由提升身份清理该目录再启动；不要把凭据复制到普通账号可访问的目录。
+
+## 对象授权
+
+业务授权绑定数据库编号与表编号，身份与所有者绑定身份编号。删除后重建同名数据库、表或身份会获得新编号，旧授权不会随名称恢复。对象存在性以 catalog 为准；不同数据库的同名表互不共享授权。
+
+| 对象范围 | 权限 | 默认与所有者能力 |
+| --- | --- | --- |
+| DATABASE 库名 | CONNECT、CREATE | PUBLIC 默认 CONNECT；CREATE 允许建表；数据库所有者可管理该数据库 |
+| TABLE 库名.表名 | SELECT、INSERT、UPDATE、DELETE | 默认无数据权限；表所有者拥有四项数据权限、结构管理及转授权能力 |
+| 库名.* | 四项表级数据权限 | 覆盖该数据库内现有及未来的表；不包含数据库 CREATE |
+
+`ALL` 按对象范围展开。未限定表名与 `*` 绑定当前数据库。数据库所有权不自动赋予其他身份所建表的数据权限；启用的所有者角色可以通过成员关系贡献所有权，最高权限属性仍不继承。创建数据库及管理 DOMAIN 仍要求 SUPERUSER；所有权不能通过 REVOKE 移除，当前没有所有权转移命令。
+
+```sql
+REVOKE CONNECT ON DATABASE sales FROM PUBLIC;
+GRANT CONNECT, CREATE ON DATABASE sales TO analyst;
+GRANT SELECT ON TABLE sales.orders TO reader WITH GRANT OPTION;
+GRANT SELECT ON sales.* TO analyst;
+REVOKE SELECT ON sales.orders FROM reader;
+```
+
+PUBLIC 是所有身份共享的虚拟角色，不能新建同名用户或角色。已有同名旧身份仍按真实身份编号解析，删除该身份后才使用虚拟 PUBLIC。撤销 PUBLIC CONNECT 会关闭数据库的默认连接权限，其他显式 CONNECT 或数据库所有权仍有效；重新授予会恢复默认连接权限。
+
+每次授予记录授予者。普通身份须持有有效 grant option 或对象所有权，可撤销自己的授予；所有者和 SUPERUSER 可撤销对象上的其他来源。撤销、删除身份或成员变更会清理失去合法来源的转授权链；其他独立来源保留，循环转授不能维持失去根来源的权限。禁用身份暂停权限贡献，保留所有权及管理员直接授权；失去启用授予者的下游转授权会被清理。
+
+旧名称授权在首次启动时一次性绑定现存对象和身份编号。旧记录不含授予者，迁移为管理来源；旧全局 `*` 仅转换成当时现存表的明确授权，不扩展到未来对象。已经不存在的对象和身份记录被清理。迁移后不再读取旧名称授权作为鉴权依据。
+
+权限快照位于受保护系统目录，经 WAL 原子保存；普通存储请求不能访问该目录。SQL、TCP 和 Web 使用同一服务端检查；TCP 原始存储入口仅允许 SUPERUSER。查询与授权变更通过共享读写锁排序，建表前持久化创建者声明供重启恢复所有权。事务提交重新检查权限和稳定对象编号，权限撤销或对象替换后不能提交旧事务。
## 属性、授权与会话的关系
diff --git a/resources/settings.toml.linux b/resources/settings.toml.linux
index 9e6c37a..a80446c 100644
--- a/resources/settings.toml.linux
+++ b/resources/settings.toml.linux
@@ -35,6 +35,9 @@ port = 7777
max_message = 1048576
# Maximum number of rows returned by a query through the database server.
max_rows = 1000
+# Local elevated OS identity mapping; empty disables sudo authentication.
+# Requires ALLOW_SUDO_AUTH on the identity and an elevated server process.
+sudo_auth_user = ""
[log]
# Diagnostic verbosity: off, error, warn, info or debug.
diff --git a/resources/settings.toml.windows b/resources/settings.toml.windows
index 958b7bf..c809fab 100644
--- a/resources/settings.toml.windows
+++ b/resources/settings.toml.windows
@@ -35,6 +35,9 @@ port = 7777
max_message = 1048576
# Maximum number of rows returned by a query through the database server.
max_rows = 1000
+# Local elevated OS identity mapping; empty disables sudo authentication.
+# Requires ALLOW_SUDO_AUTH on the identity and an elevated server process.
+sudo_auth_user = ""
[log]
# Diagnostic verbosity: off, error, warn, info or debug.
diff --git a/scripts/install.sh b/scripts/install.sh
index 2fe5823..fcaf898 100644
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -2,7 +2,7 @@
set -eu
# ChuSQL 安装脚本（Linux/macOS）：装 cli/web、写全局配置、
-# 改 PATH、跑 csql-bootstrap 建系统目录、最后拉起服务。
+# 改 PATH、初始化系统目录，Linux 注册开机启动服务。
default_repo='TheBadRoger/ChuSQL'
@@ -42,6 +42,7 @@ usage: ./install.sh [--component web|cli|both] [options]
there is no terminal to ask on; shows up in the shell
history, so CHUSQL_ADMIN_PASSWORD is safer)
--no-start do not start the server after installing
+ --no-service skip Linux systemd registration and boot autostart
where the files come from:
(default) a package next to this script, else the newest GitHub release
@@ -71,6 +72,7 @@ root_user='root'
keep_package='no'
password_arg=''
no_start='no'
+no_service='no'
repo="$default_repo"
version='latest'
url_arg=''
@@ -90,6 +92,7 @@ while [ $# -gt 0 ]; do
--keep-package) keep_package='yes'; shift ;;
--password) password_arg="${2:-}"; shift 2 ;;
--no-start) no_start='yes'; shift ;;
+ --no-service) no_service='yes'; shift ;;
--url) url_arg="${2:-}"; shift 2 ;;
--repo) repo="${2:-}"; shift 2 ;;
--version) version="${2:-}"; shift 2 ;;
@@ -617,8 +620,23 @@ echo " root user $root_user (password asked above, kept out of settings.toml)"
# ---- 释放文件 ----
# 包是合在一起的（web 和 cli 都在），这里按这次的选择逐个释放：没选的组件不落地
+service_file="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user/chusql-server.service"
+use_service='no'
+if [ "$(uname -s)" = 'Linux' ] && [ "$no_service" = 'no' ]; then
+ command -v systemctl >/dev/null 2>&1 || fail 'systemd is required; use --no-service to opt out'
+ command -v loginctl >/dev/null 2>&1 || fail 'loginctl is required for boot autostart'
+ systemctl --user show-environment >/dev/null || fail 'cannot connect to user systemd; run in a login session or use --no-service'
+ loginctl enable-linger "$(id -un)" || fail 'cannot enable boot autostart; run sudo loginctl enable-linger for this OS user and retry'
+ use_service='yes'
+ if [ -f "$service_file" ]; then
+ systemctl --user stop chusql-server.service || fail 'cannot stop the existing service'
+ fi
+fi
step 'Installing files'
mkdir -p "$install_dir/bin" "$log_dir" "$data_dir"
+install_dir=$(CDPATH= cd -- "$install_dir" && pwd)
+data_dir=$(CDPATH= cd -- "$data_dir" && pwd)
+log_dir=$(CDPATH= cd -- "$log_dir" && pwd)
cp "$pack/bin/chusql-server" "$install_dir/bin/"
cp "$pack/bin/csql-bootstrap" "$install_dir/bin/"
for lib in "$pack/bin/"libchusql_core_storage.*; do
@@ -646,6 +664,8 @@ step 'Writing settings.toml'
config_dir="${XDG_CONFIG_HOME:-$HOME/.config}/ChuSQL"
config_file="$config_dir/settings.toml"
mkdir -p "$config_dir"
+config_dir=$(CDPATH= cd -- "$config_dir" && pwd)
+config_file="$config_dir/settings.toml"
sed -e "s|@DATA_DIR@|$(printf '%s' "$data_dir" | sed 's/[\&|]/\\&/g')|g" \
-e "s|@LOG_DIR@|$(printf '%s' "$log_dir" | sed 's/[\&|]/\\&/g')|g" \
"$pack/resources/settings.toml.linux" > "$config_file"
@@ -714,7 +734,46 @@ fi
# ---- 拉起服务 ----
server_bin="$install_dir/bin/chusql-server"
server_pid=''
-if [ "$no_start" = 'yes' ]; then
+if [ "$use_service" = 'yes' ]; then
+ step 'Registering the systemd service and boot autostart'
+ for service_arg in "$install_dir" "$server_bin" "$config_file" "$root_user"; do
+ case "$service_arg" in
+ *"
+"*) fail 'service arguments must not contain newlines' ;;
+ esac
+ done
+ mkdir -p "$(dirname "$service_file")"
+ # 转义 systemd 双引号参数与变量符号。
+ unit_quote() {
+ printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g; s/%/%%/g'
+ }
+ cat > "$service_file" <"$vtmp/log" 2>&1; then
sed -n '1,120p' "$vtmp/log" >&2
rm -rf "$vtmp"
diff --git a/scripts/uninstall.sh b/scripts/uninstall.sh
index a5c5402..1a8fbfa 100644
--- a/scripts/uninstall.sh
+++ b/scripts/uninstall.sh
@@ -94,6 +94,13 @@ if [ "$assume_yes" = 'no' ]; then
fi
step 'Stopping the service'
+service_file="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user/chusql-server.service"
+if [ "$(uname -s)" = 'Linux' ] && [ -f "$service_file" ]; then
+ command -v systemctl >/dev/null 2>&1 || fail 'systemctl is required to remove the service'
+ systemctl --user disable --now chusql-server.service || fail 'cannot stop and disable chusql-server.service'
+ rm -f "$service_file"
+ systemctl --user daemon-reload || fail 'cannot reload systemd units'
+fi
stop_by_path "$install_dir/bin/chusql-server"
stop_by_path "$install_dir/bin/chusql-web"
diff --git a/scripts/update-code-lines.ps1 b/scripts/update-code-lines.ps1
deleted file mode 100644
index bc91f72..0000000
--- a/scripts/update-code-lines.ps1
+++ /dev/null
@@ -1,55 +0,0 @@
-param([string]$Root = (Split-Path -Parent $PSScriptRoot))
-
-$ErrorActionPreference = 'Stop'
-
-# 统计物理行数并生成 README 统一风格的本地 SVG 徽章。
-
-# 生成带文字和色块的本地徽章。
-function Write-Badge([string]$Directory, [string]$Name, [string]$Label, [string]$Value, [string]$Color, [string]$Description) {
- $leftWidth = [int]($Label.Length * 7 + 24)
- $rightWidth = [int]($Value.Length * 7 + 24)
- $width = $leftWidth + $rightWidth
- $leftCenter = $leftWidth / 2
- $rightCenter = $leftWidth + $rightWidth / 2
- $safeLabel = [Security.SecurityElement]::Escape($Label)
- $safeValue = [Security.SecurityElement]::Escape($Value)
- $safeDescription = [Security.SecurityElement]::Escape($Description)
- $svg = @"
-
-"@
- Set-Content -LiteralPath (Join-Path $Directory "$Name.svg") -Value $svg -Encoding utf8
-}
-
-Push-Location -LiteralPath $Root
-try {
- $paths = @(& git ls-files --cached --others --exclude-standard)
- if ($LASTEXITCODE -ne 0) { throw 'git ls-files failed' }
- $lines = 0
- $files = 0
- foreach ($path in ($paths | Sort-Object -Unique)) {
- if ($path -notmatch '\.(hs|rs|js|css|html|ps1|sh)$') { continue }
- if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { continue }
- $lines += @(Get-Content -LiteralPath $path).Count
- $files++
- }
- $label = $lines.ToString('N0', [Globalization.CultureInfo]::InvariantCulture)
- $badgeDir = Join-Path $Root 'docs/badges'
- [IO.Directory]::CreateDirectory($badgeDir) | Out-Null
- $revision = & git rev-parse --short HEAD
- if ($LASTEXITCODE -ne 0) { throw 'git rev-parse failed' }
- Write-Badge $badgeDir 'lines' 'source lines' $label '#0369a1' 'Physical source lines; includes tests, comments and blank lines.'
- Write-Badge $badgeDir 'release' 'release' 'browse' '#6d28d9' 'Open GitHub releases to view published versions.'
- Write-Badge $badgeDir 'commit' 'commit' $revision '#475569' 'Local HEAD snapshot when the badges were generated; open commit history for latest updates.'
- Write-Badge $badgeDir 'languages' 'languages' 'Haskell + Rust' '#6d28d9' 'ChuSQL implementation languages: Haskell and Rust.'
- Write-Badge $badgeDir 'build' 'build' 'view status' '#0369a1' 'Open the build workflow for live status; this local badge is a navigation link.'
- Write-Badge $badgeDir 'tests' 'tests' 'view status' '#0369a1' 'Open the test workflow for live status; this local badge is a navigation link.'
- Write-Badge $badgeDir 'gate' 'gate' 'manual status' '#b45309' 'Open the owner-triggered gate workflow for status; this local badge is a navigation link.'
- Write-Output "source_lines=$lines source_files=$files"
-} finally {
- Pop-Location
-}
+ 
+ 
+ 
+ 
+