Please build the React frontend first:
+cd app && npm run build+
Or run in development mode (recommended for development):
+cd app && npm run dev+
The dev server will run on http://localhost:8080 with hot reload.
+ + + """, + status_code=503 + ) + + return FileResponse(index_path) @auth_router.get("/login/google", name="google.login", response_class=RedirectResponse) async def login_google(request: Request) -> RedirectResponse: @@ -507,7 +519,7 @@ async def google_authorized(request: Request) -> RedirectResponse: except Exception as e: logging.error("Google OAuth authentication failed: %s", str(e)) # nosemgrep - raise HTTPException(status_code=400, detail=f"Authentication failed: {str(e)}") from e + raise HTTPException(status_code=400, detail="Authentication failed") from e @auth_router.get("/login/google/callback", response_class=RedirectResponse) @@ -611,7 +623,7 @@ async def github_authorized(request: Request) -> RedirectResponse: except Exception as e: logging.error("GitHub OAuth authentication failed: %s", str(e)) # nosemgrep - raise HTTPException(status_code=400, detail=f"Authentication failed: {str(e)}") from e + raise HTTPException(status_code=400, detail="Authentication failed") from e @auth_router.get("/login/github/callback", response_class=RedirectResponse) @@ -622,17 +634,62 @@ async def github_callback_compat(request: Request) -> RedirectResponse: return RedirectResponse(url=redirect, status_code=status.HTTP_307_TEMPORARY_REDIRECT) -@auth_router.get("/logout", response_class=RedirectResponse) -async def logout(request: Request) -> RedirectResponse: - """Handle user logout and delete session cookies.""" - resp = RedirectResponse(url="/", status_code=status.HTTP_302_FOUND) +@auth_router.get("/auth-status") +async def auth_status(request: Request) -> JSONResponse: + """Check authentication status for the React app. + + Returns: + JSONResponse: Authentication status with user info if authenticated + """ + user_info, is_authenticated = await validate_user(request) + + if is_authenticated and user_info: + return JSONResponse( + content={ + "authenticated": True, + "user": { + "id": str(user_info.get("id")), + "email": user_info.get("email"), + "name": user_info.get("name"), + "picture": user_info.get("picture"), + "provider": user_info.get("provider") + } + } + ) + + # Not authenticated - return 200 with authenticated: false + # This is NOT an error - unauthenticated users can still use the app + return JSONResponse( + content={"authenticated": False}, + status_code=200 + ) + + +@auth_router.get("/logout") +@auth_router.post("/logout") +async def logout(request: Request): + """Handle user logout and delete session cookies. + Supports both GET and POST methods for backward compatibility: + - GET: For direct navigation (bookmarks, links, old clients) + - POST: For programmatic logout from the app + """ + # For GET requests, redirect to home page + if request.method == "GET": + response = RedirectResponse(url="/", status_code=302) + api_token = request.cookies.get("api_token") + if api_token: + response.delete_cookie("api_token") + await delete_user_token(api_token) + return response + + # For POST requests, return JSON + response = JSONResponse(content={"success": True}) api_token = request.cookies.get("api_token") if api_token: - resp.delete_cookie("api_token") + response.delete_cookie("api_token") await delete_user_token(api_token) - - return resp + return response # ---- Hook for app factory ---- def init_auth(app): diff --git a/api/routes/database.py b/api/routes/database.py index 0454161a..293c63ad 100644 --- a/api/routes/database.py +++ b/api/routes/database.py @@ -30,6 +30,7 @@ async def connect_database(request: Request, db_request: DatabaseConnectionReque Accepts a JSON payload with a database URL and attempts to connect. Supports both PostgreSQL and MySQL databases. Streams progress steps as a sequence of JSON messages separated by MESSAGE_DELIMITER. + Requires authentication. """ generator = await load_database(db_request.url, request.state.user_id) return StreamingResponse(generator, media_type="application/json") diff --git a/api/routes/graphs.py b/api/routes/graphs.py index a3b14e22..a7403e78 100644 --- a/api/routes/graphs.py +++ b/api/routes/graphs.py @@ -1,5 +1,6 @@ """Graph-related routes for the text2sql API.""" +import logging from fastapi import APIRouter, Request, HTTPException, UploadFile, File from fastapi.responses import JSONResponse, StreamingResponse from pydantic import BaseModel @@ -38,12 +39,13 @@ class GraphData(BaseModel): "", operation_id="list_databases", tags=["mcp_tool"], - responses={401: UNAUTHORIZED_RESPONSE}, + responses={401: UNAUTHORIZED_RESPONSE} ) @token_required async def list_graphs(request: Request): """ - This route is used to list all the graphs (databases names) that are available in the database. + List all available graphs/databases for the authenticated user. + Requires authentication. """ graphs = await list_databases(request.state.user_id, GENERAL_PREFIX) return JSONResponse(content=graphs) @@ -53,17 +55,14 @@ async def list_graphs(request: Request): "/{graph_id}/data", operation_id="database_schema", tags=["mcp_tool"], - responses={401: UNAUTHORIZED_RESPONSE}, + responses={401: UNAUTHORIZED_RESPONSE} ) @token_required async def get_graph_data( request: Request, graph_id: str ): # pylint: disable=too-many-locals,too-many-branches - """Return all nodes and edges for the specified database schema (namespaced to the user). - - This endpoint returns a JSON object with two keys: `nodes` and `edges`. - Nodes contain a minimal set of properties (id, name, labels, props). - Edges contain source and target node names (or internal ids), type and props. + """Return all nodes and edges for the specified database schema. + Requires authentication. args: graph_id (str): The ID of the graph to query (the database name). @@ -73,9 +72,14 @@ async def get_graph_data( schema = await get_schema(request.state.user_id, graph_id) return JSONResponse(content=schema) except GraphNotFoundError as gnfe: - return JSONResponse(content={"error": str(gnfe)}, status_code=404) + logging.warning("Graph not found: %s", str(gnfe)) + return JSONResponse(content={"error": "Database not found"}, status_code=404) except InternalError as ie: - return JSONResponse(content={"error": str(ie)}, status_code=500) + logging.error("Internal error getting schema: %s", str(ie)) + return JSONResponse( + content={"error": "Failed to retrieve database schema"}, + status_code=500 + ) @graphs_router.post("", responses={401: UNAUTHORIZED_RESPONSE}) @@ -125,7 +129,7 @@ async def load_graph( "/{graph_id}", operation_id="query_database", tags=["mcp_tool"], - responses={401: UNAUTHORIZED_RESPONSE}, + responses={401: UNAUTHORIZED_RESPONSE} ) @token_required async def query_graph( @@ -133,6 +137,7 @@ async def query_graph( ): # pylint: disable=too-many-statements """ Query the Database with the given graph_id and chat_data. + Requires authentication. Args: graph_id (str): The ID of the graph to query. @@ -142,7 +147,8 @@ async def query_graph( generator = await query_database(request.state.user_id, graph_id, chat_data) return StreamingResponse(generator, media_type="application/json") except InvalidArgumentError as iae: - return JSONResponse(content={"error": str(iae)}, status_code=400) + logging.warning("Invalid argument in query: %s", str(iae)) + return JSONResponse(content={"error": "Invalid query request"}, status_code=400) @graphs_router.post("/{graph_id}/confirm", responses={401: UNAUTHORIZED_RESPONSE}) @@ -153,7 +159,8 @@ async def confirm_destructive_operation( confirm_data: ConfirmRequest, ): """ - Handle user confirmation for destructive SQL operations + Handle user confirmation for destructive SQL operations. + Requires authentication. """ try: @@ -162,7 +169,8 @@ async def confirm_destructive_operation( ) return StreamingResponse(generator, media_type="application/json") except InvalidArgumentError as iae: - return JSONResponse(content={"error": str(iae)}, status_code=400) + logging.warning("Invalid argument in destructive operation: %s", str(iae)) + return JSONResponse(content={"error": "Invalid confirmation request"}, status_code=400) @graphs_router.post("/{graph_id}/refresh", responses={401: UNAUTHORIZED_RESPONSE}) @@ -172,11 +180,22 @@ async def refresh_graph_schema(request: Request, graph_id: str): Manually refresh the graph schema from the database. This endpoint allows users to manually trigger a schema refresh if they suspect the graph is out of sync with the database. + Streams progress steps as a sequence of JSON messages. """ try: - return await refresh_database_schema(request.state.user_id, graph_id) - except InternalError as ie: - return JSONResponse(content={"error": str(ie)}, status_code=500) + generator = await refresh_database_schema(request.state.user_id, graph_id) + return StreamingResponse(generator, media_type="application/json") + except (InternalError, InvalidArgumentError) as e: + # Log detailed error internally, send generic message to user + if isinstance(e, InternalError): + logging.error("Internal error refreshing schema: %s", str(e)) + error_message = "Failed to refresh database schema" + status_code = 500 + else: + logging.warning("Invalid argument refreshing schema: %s", str(e)) + error_message = "Invalid request to refresh schema" + status_code = 400 + return JSONResponse(content={"error": error_message}, status_code=status_code) @graphs_router.delete("/{graph_id}", responses={401: UNAUTHORIZED_RESPONSE}) @@ -195,8 +214,14 @@ async def delete_graph(request: Request, graph_id: str): return JSONResponse(content=result) except InvalidArgumentError as iae: - return JSONResponse(content={"error": str(iae)}, status_code=400) + logging.warning("Invalid argument in delete: %s", str(iae)) + return JSONResponse(content={"error": "Invalid delete request"}, status_code=400) except GraphNotFoundError as gnfe: - return JSONResponse(content={"error": str(gnfe)}, status_code=404) + logging.warning("Graph not found for deletion: %s", str(gnfe)) + return JSONResponse(content={"error": "Database not found"}, status_code=404) except InternalError as ie: - return JSONResponse(content={"error": str(ie)}, status_code=500) + logging.error("Internal error deleting database: %s", str(ie)) + return JSONResponse( + content={"error": "Failed to delete database"}, + status_code=500 + ) diff --git a/api/sql_utils/__init__.py b/api/sql_utils/__init__.py new file mode 100644 index 00000000..795a5a40 --- /dev/null +++ b/api/sql_utils/__init__.py @@ -0,0 +1,5 @@ +"""Utility modules for QueryWeaver API.""" + +from .sql_sanitizer import SQLIdentifierQuoter, DatabaseSpecificQuoter + +__all__ = ['SQLIdentifierQuoter', 'DatabaseSpecificQuoter'] diff --git a/api/sql_utils/sql_sanitizer.py b/api/sql_utils/sql_sanitizer.py new file mode 100644 index 00000000..6f7d127e --- /dev/null +++ b/api/sql_utils/sql_sanitizer.py @@ -0,0 +1,171 @@ +"""SQL sanitization utilities for handling identifiers with special characters.""" + +import re +from typing import Set, Tuple + + +class SQLIdentifierQuoter: + """ + Utility class for automatically quoting SQL identifiers (table/column names) + that contain special characters like dashes. + """ + + # Characters that require quoting in identifiers + SPECIAL_CHARS = {'-', ' ', '.', '@', '#', '$', '%', '^', '&', '*', '(', + ')', '+', '=', '[', ']', '{', '}', '|', '\\', ':', + ';', '"', "'", '<', '>', ',', '?', '/'} + # SQL keywords that should not be quoted + SQL_KEYWORDS = { + 'SELECT', 'FROM', 'WHERE', 'JOIN', 'LEFT', 'RIGHT', 'INNER', 'OUTER', 'ON', + 'AS', 'AND', 'OR', 'NOT', 'IN', 'BETWEEN', 'LIKE', 'IS', 'NULL', 'ORDER', + 'BY', 'GROUP', 'HAVING', 'LIMIT', 'OFFSET', 'INSERT', 'UPDATE', 'DELETE', + 'CREATE', 'DROP', 'ALTER', 'TABLE', 'INTO', 'VALUES', 'SET', 'COUNT', + 'SUM', 'AVG', 'MAX', 'MIN', 'DISTINCT', 'ALL', 'UNION', 'INTERSECT', + 'EXCEPT', 'CASE', 'WHEN', 'THEN', 'ELSE', 'END', 'CAST', 'ASC', 'DESC' + } + + @classmethod + def needs_quoting(cls, identifier: str) -> bool: + """ + Check if an identifier needs quoting based on special characters. + + Args: + identifier: The table or column name to check + + Returns: + True if the identifier needs quoting, False otherwise + """ + # Already quoted + if (identifier.startswith('"') and identifier.endswith('"')) or \ + (identifier.startswith('`') and identifier.endswith('`')): + return False + + # Check if it's a SQL keyword + if identifier.upper() in cls.SQL_KEYWORDS: + return False + + # Check for special characters + return any(char in cls.SPECIAL_CHARS for char in identifier) + + @staticmethod + def quote_identifier(identifier: str, quote_char: str = '"') -> str: + """ + Quote an identifier if not already quoted. + + Args: + identifier: The identifier to quote + quote_char: The quote character to use (default: " for PostgreSQL/standard SQL) + + Returns: + Quoted identifier + """ + identifier = identifier.strip() + + # Don't double-quote + if (identifier.startswith('"') and identifier.endswith('"')) or \ + (identifier.startswith('`') and identifier.endswith('`')): + return identifier + + return f'{quote_char}{identifier}{quote_char}' + + @classmethod + def extract_table_names_from_query(cls, sql_query: str) -> Set[str]: + """ + Extract potential table names from a SQL query. + Looks for identifiers after FROM, JOIN, UPDATE, INSERT INTO, etc. + + Args: + sql_query: The SQL query to parse + + Returns: + Set of potential table names + """ + table_names = set() + + # Pattern to match table names after FROM, JOIN, UPDATE, INSERT INTO, etc. + # This is a heuristic approach - not perfect but handles common cases + patterns = [ + r'\bFROM\s+([a-zA-Z0-9_\-]+)', + r'\bJOIN\s+([a-zA-Z0-9_\-]+)', + r'\bUPDATE\s+([a-zA-Z0-9_\-]+)', + r'\bINSERT\s+INTO\s+([a-zA-Z0-9_\-]+)', + r'\bTABLE\s+([a-zA-Z0-9_\-]+)', + ] + + for pattern in patterns: + matches = re.finditer(pattern, sql_query, re.IGNORECASE) + for match in matches: + table_name = match.group(1).strip() + # Skip if it's already quoted or an alias + if not ((table_name.startswith('"') and table_name.endswith('"')) or + (table_name.startswith('`') and table_name.endswith('`'))): + table_names.add(table_name) + + return table_names + + @classmethod + def auto_quote_identifiers( + cls, + sql_query: str, + known_tables: Set[str], + quote_char: str = '"' + ) -> Tuple[str, bool]: + """ + Automatically quote table names with special characters in a SQL query. + + Args: + sql_query: The SQL query to process + known_tables: Set of known table names from the database schema + quote_char: Quote character to use (default: " for PostgreSQL, use ` for MySQL) + + Returns: + Tuple of (modified_query, was_modified) + """ + modified = False + result_query = sql_query + + # Extract potential table names from query + query_tables = cls.extract_table_names_from_query(sql_query) + + # For each table that needs quoting + for table in query_tables: + # Check if this table exists in known schema and needs quoting + if table in known_tables and cls.needs_quoting(table): + # Quote the table name + quoted = cls.quote_identifier(table, quote_char) + + # Replace unquoted occurrences with quoted version + # Use word boundaries to avoid partial replacements + # Handle cases: FROM table, JOIN table, table.column, etc. + patterns_to_replace = [ + (rf'\b{re.escape(table)}\b(?!\s*\.)', quoted), + (rf'\b{re.escape(table)}\.', f'{quoted}.'), + ] + + for pattern, replacement in patterns_to_replace: + new_query = re.sub(pattern, replacement, result_query, flags=re.IGNORECASE) + if new_query != result_query: + modified = True + result_query = new_query + + return result_query, modified + + +class DatabaseSpecificQuoter: # pylint: disable=too-few-public-methods + """Factory class to get the appropriate quote character for different databases.""" + + @staticmethod + def get_quote_char(db_type: str) -> str: + """ + Get the appropriate quote character for a database type. + + Args: + db_type: Database type ('postgresql', 'mysql', etc.) + + Returns: + Quote character to use + """ + if db_type.lower() in ['mysql', 'mariadb']: + return '`' + # PostgreSQL, SQLite, SQL Server (standard SQL) use double quotes + return '"' diff --git a/app/components.json b/app/components.json new file mode 100644 index 00000000..62e10116 --- /dev/null +++ b/app/components.json @@ -0,0 +1,20 @@ +{ + "$schema": "https://ui.shadcn.com/schema.json", + "style": "default", + "rsc": false, + "tsx": true, + "tailwind": { + "config": "tailwind.config.ts", + "css": "src/index.css", + "baseColor": "slate", + "cssVariables": true, + "prefix": "" + }, + "aliases": { + "components": "@/components", + "utils": "@/lib/utils", + "ui": "@/components/ui", + "lib": "@/lib", + "hooks": "@/hooks" + } +} diff --git a/app/eslint.config.cjs b/app/eslint.config.cjs index b054baed..bb46a38b 100644 --- a/app/eslint.config.cjs +++ b/app/eslint.config.cjs @@ -20,7 +20,10 @@ module.exports = [ { rules: { // Base JS recommended rules - 'no-unused-vars': 'warn', + 'no-unused-vars': ['warn', { + 'argsIgnorePattern': '^_', + 'varsIgnorePattern': '^_' + }], // TypeScript rules '@typescript-eslint/no-explicit-any': 'off', }, diff --git a/app/hooks/use-mobile.ts b/app/hooks/use-mobile.ts new file mode 100644 index 00000000..80e2b99b --- /dev/null +++ b/app/hooks/use-mobile.ts @@ -0,0 +1,18 @@ +import { useEffect, useState } from 'react'; + +// Returns true if the viewport is less than the given breakpoint (default: 768px) +export function useIsMobile(breakpoint = 768): boolean { + const [isMobile, setIsMobile] = useState(() => + typeof window !== 'undefined' ? window.matchMedia(`(max-width: ${breakpoint - 1}px)`).matches : false + ); + + useEffect(() => { + const media = window.matchMedia(`(max-width: ${breakpoint - 1}px)`); + const listener = () => setIsMobile(media.matches); + media.addEventListener('change', listener); + setIsMobile(media.matches); + return () => media.removeEventListener('change', listener); + }, [breakpoint]); + + return isMobile; +} diff --git a/app/index.html b/app/index.html new file mode 100644 index 00000000..bd2ee032 --- /dev/null +++ b/app/index.html @@ -0,0 +1,25 @@ + + + + + + ++ Powered by FalkorDB +
++ This operation will perform a {operationType} query: +
+ {confirmationData?.sqlQuery && ( +
+ {confirmationData.sqlQuery}
+
+ + {isHighRisk ? ( + <> + ⚠️ WARNING: This operation may be irreversible and will permanently modify your database. + + ) : ( + <>This operation will make changes to your database. Please review carefully before confirming. + )} +
+{content}
+
+ {content}
+
+ {analysisInfo.explanation}
+{analysisInfo.missing}
+{analysisInfo.ambiguities}
+| + {column} + | + ))} +
|---|
| + {String(value)} + | + ))} +
{progress}% complete
+