Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@auctionfrontier/db-util
Advanced tools
The purpose of this utility is to provide a simplified node interface for upgrading or initilizing the database structure and data. It will process .sql
or .js
files in a specified order, from each root folder in the array order provided to a profile. Semver'd script files will be sorted by the semver before being run. Incremental script files will be sorted by number
# install via npm
npm install @auctionfrontier/db-util
Provide database connection info
const Evolver = require('@auctionfrontier/db-util').Evolver;
const mysqlConfig: {
port: '3306',
host: '127.0.0.1',
user: 'root',
password: 'root',
multipleStatements: true
}
let velocicastDBEvolver = new Evolver(testConfig.mysqlConfig);
Currently this can only be used as a node module in a script. We would like to create an interactive cli in the future.
Initialise velocicast database, ignoring all versions with
"force":true
let velDBinit = [
{
"name":"veloBase",
"force":true,
"database": "velocicast",
"scripts": [
{
"root": "./sql/tables"
},
{
"root": "./sql/procs/"
},
{
"root": "./sql/scripts/"
}
]
},
];
velocicastDBEvolver.run(velDBinit);
Initialise full velocicast database structure
let velDBinit = [{
"name":"velocicast",
"targetVersion": "1.0.0",
"database": "velocicast",
"scripts": [
{
"root": "./sql/tables"
},
{
"force": true,
"root": "./sql/procs/"
},
{
"root": "./sql/scripts/"
}
]
},
{
"name":"velocicast_archive",
"targetVersion": "1.0.0",
"database": "velocicast_archive",
"scripts": [
{
"root": "./sql/tables_archive"
},
]
},
{
"name":"velocicast_staging",
"targetVersion": "1.0.0",
"database": "velocicast_staging",
"scripts": [
{
"root": "./sql/tables_staging"
},
]
}
];
velocicastDBEvolver.run(velDBinit);
upgrade velocicast database tables to version
0.1.0
. this will only run scripts newer than the version stored from the last run.
let velDBupgrade = [
{
"name":"veloBase",
"targetVersion": "0.1.0",
"database": "velocicast",
"scripts": [
{
"root": "./sql/tables"
}
]
},
];
velocicastDBEvolver.run(velDBupgrade);
if you leave out the targetVersion property, it will run all files with a greater semver than the database version.
let velDBupgrade = [
{
"name":"veloBase",
"database": "velocicast",
"scripts": [
{
"root": "./sql/tables"
}
]
},
];
velocicastDBEvolver.run(velDBupgrade);
upgrade velocicast database tables to version
0.1.0
, ignoring the current version of the database by specifying a base vesrion
let velDBupgrade = [
{
"name":"veloBase",
"targetVersion": "0.1.0",
"baseVersion": "0.0.18",
"database": "velocicast",
"scripts": [
{
"root": "./sql/tables"
}
]
},
];
velocicastDBEvolver.run(velDBupgrade);
Currently this can only be used as a node module in a script. We would like to create an interactive cli in the future.
Initialise velocicast database, ignoring all versions with
"force":true
let velDBinit = [
{
"force":true,
"database": "velocicast",
"scripts": [
{
"root": "./sql/tables"
},
{
"root": "./sql/procs/"
},
{
"root": "./sql/scripts/"
}
]
},
];
velocicastDBEvolver.run(velDBinit);
run a specific single file
let velDBprofiles = [{
"force":true,
"database": "velocicast",
"scripts": [
{
"root": "./sql/",
"customGlob":"data-intl-test.sql"
}
]
}
]
velocicastDBEvolver.run(velDBprofiles);
There are a few main concepts important to using the tool
The library was written to support multiple versioning paradigms, including semver like so: v0.1.2.filename.sql
and incremental filenames like so: 1.sql
.
The new semver scheme creates it's own database called afdb
and stores each version and profile run under the log
table. Each profile is versioned independently based on the name
property provided in the config, and each run is inserted as a new row with a timestamp. The version of the profile is determined by the results of the following query:
SELECT semver FROM afdb.log WHERE name = '${profile.name}' ORDER BY UNIX_TIMESTAMP(timestamp) DESC LIMIT 1;
The default semver scheme requires a semver string appended to the beginning of each filename, and will be validated and compared using the semver
npm module.
let getVersionFromFilename = function(fileName){
let semverRegex = /^v(\d+\.\d+\.\d+).*$/;
return semverRegex.exec(fileName)[1];
}
if a version number is not found in the filename, the file will NOT be run unless the force option is passed with the config.
The incremental scheme creates it's own database called afdb
and stores each version and profile run under the log
table. Each profile is versioned independently based on the name
property provided in the config, and each run is inserted as a new row with a timestamp. The version of the profile is determined by the results of the following query:
SELECT version FROM afdb.log WHERE name = '${profile.name}' ORDER BY UNIX_TIMESTAMP(timestamp) DESC LIMIT 1;
To use it, set the versionType property of the profile to the value 'increment'.
profiles are the logical groups of a set of .sql
or .js
scripts that should be run against a specific database, within a specific range of versions. Each profile object takes a set of properties to control which scripts are run. Each profile is run as a self contained set of work, with the scripts array run in the provided order, and the database version written at the end of all operations. The semver scheme stores versions for each profile, while the legacy scheme only supports a single version for the whole database.
profile = {
"name":"velocicast",
"versionType":"semver",
"targetVersion": "1.0.0",
"baseVersion":"0.0.0",
"database": "velocicast",
"scripts": [
{
"customGlob: "/**/@(*.js||*.sql)",
"force": true,
"root": "./sql/procs/"
}
],
"force":true, //this overrides the script force property
"skipVersionUpdate": false,
}
true
will skip all version checking logic, and process all files found in the provided script locations. can be set at the profile level or in an individual script objecttrue
the util won't write the db version at the end of the profile runby default, if a the tool is run in interactive mode, the user will be prompted to confirm they want to run each profile. This behavior can be bypassed with the --skipConfirm
command line argument.
Each script object requires a root
property, which specifies where the lib should look for files. This library uses node-glob to find the files for each profile. the default glob pattern it uses will find any .js
or .sql
files nested in folders under the provided root. It also supports a customGlob
property which will override the default glob pattern.
//Default glob pattern
"/**/@(*.js||*.sql)"
//path passed into glob
let fullGlob = script.root + (script.customGlob || "/**/@(*.js||*.sql)")
let files = glob.sync(fullGlob)
Glob will start it's search from the process cwd. You can override this by passing a cwd
property into the profile object.
the .js
script files you create should export a run
function. The run function is passed a sql connection class that has some helper functions. see the example below:
module.exports = {
run(sqlHelper){
sqlHelper.mysql
.then((mysql)=>{
return mysql.queryAsync();
})
.then(()=>{
return sqlHelper.end();
})
sqlHelper.prepare('');
console.log("I ran some JS!")
return {msg:"success"}
}
}
to run tests: (this requires a mysql database to be running)
npm run test
to generate coverage:
npm run coverage
reports are stored in test-reports
istanbul coverage is stored in coverage
FAQs
utility for migrating between database revisions
We found that @auctionfrontier/db-util demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 13 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.