chore(release): prepare public source release

2026-07-18 15:41:59 +08:00
commit e365e5df4d
508 changed files with 163373 additions and 0 deletions
@@ -0,0 +1,138 @@
+use common::CliError;
+use url::Url;
+
+use crate::model::{ConnectionSource, Engine};
+
+pub(crate) fn source_from_parts(
+    engine: Option<Engine>,
+    raw_url: String,
+) -> Result<ConnectionSource, CliError> {
+    let source_redacted = redact_source(&raw_url);
+    let engine = engine.or_else(|| infer_engine(&raw_url)).ok_or_else(|| {
+        CliError::usage(format!(
+            "--engine is required for ambiguous SQL source '{source_redacted}'"
+        ))
+    })?;
+    Ok(ConnectionSource {
+        engine,
+        raw_url,
+        source_redacted,
+    })
+}
+
+pub(crate) fn infer_engine(raw_url: &str) -> Option<Engine> {
+    Url::parse(raw_url)
+        .ok()
+        .and_then(|url| Engine::parse(url.scheme()))
+}
+
+pub(crate) fn redact_source(raw: &str) -> String {
+    if let Ok(mut url) = Url::parse(raw) {
+        if url.password().is_some() {
+            let _ = url.set_password(Some("***"));
+        }
+        if url
+            .query_pairs()
+            .any(|(key, _)| is_sensitive_connection_key(&key))
+        {
+            let pairs = url
+                .query_pairs()
+                .map(|(key, value)| {
+                    let rendered = if is_sensitive_connection_key(&key) {
+                        "***".into()
+                    } else {
+                        value
+                    };
+                    (key.into_owned(), rendered.into_owned())
+                })
+                .collect::<Vec<_>>();
+            url.query_pairs_mut().clear().extend_pairs(pairs);
+        }
+        return url.to_string();
+    }
+    redact_key_value_passwords(raw)
+}
+
+fn redact_key_value_passwords(raw: &str) -> String {
+    let mut changed = false;
+    let parts = raw
+        .split(';')
+        .map(|part| {
+            let Some((key, value)) = part.split_once('=') else {
+                return part.to_string();
+            };
+            let key_trimmed = key.trim();
+            if is_sensitive_connection_key(key_trimmed) {
+                changed = true;
+                format!("{key}=***")
+            } else {
+                format!("{key}={value}")
+            }
+        })
+        .collect::<Vec<_>>();
+    if changed {
+        parts.join(";")
+    } else {
+        raw.to_string()
+    }
+}
+
+fn is_sensitive_connection_key(key: &str) -> bool {
+    let normalized = key
+        .chars()
+        .filter(|character| !matches!(character, '_' | '-' | ' '))
+        .flat_map(char::to_lowercase)
+        .collect::<String>();
+    matches!(
+        normalized.as_str(),
+        "password"
+            | "pwd"
+            | "token"
+            | "accesstoken"
+            | "apikey"
+            | "secret"
+            | "clientsecret"
+            | "credential"
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn redacts_url_and_ado_passwords() {
+        assert_eq!(
+            redact_source("postgres://user:secret@example.test/db"),
+            "postgres://user:***@example.test/db"
+        );
+        assert_eq!(
+            redact_source("server=tcp:host,1433;User ID=sa;Password=secret;Database=db"),
+            "server=tcp:host,1433;User ID=sa;Password=***;Database=db"
+        );
+    }
+
+    #[test]
+    fn redacts_url_query_and_key_value_secrets() {
+        assert_eq!(
+            redact_source(
+                "postgres://example.test/db?password=secret&access_token=abc&sslmode=require"
+            ),
+            "postgres://example.test/db?password=***&access_token=***&sslmode=require"
+        );
+        assert_eq!(
+            redact_source("server=tcp:host,1433;User ID=sa;Access Token=abc;ApiKey=key"),
+            "server=tcp:host,1433;User ID=sa;Access Token=***;ApiKey=***"
+        );
+    }
+
+    #[test]
+    fn infers_engines_from_url_schemes_only() {
+        assert_eq!(
+            infer_engine("postgres://localhost/db"),
+            Some(Engine::Postgres)
+        );
+        assert_eq!(infer_engine("duckdb://local/path"), Some(Engine::DuckDb));
+        assert_eq!(infer_engine(r".\local.db"), None);
+    }
+}