lab 05

labs/05/README.md

@@ -0,0 +1,69 @@
+# Lab 5 - DB Intro
+
+Two origins, as the lab requires.
+
+- `server1/` - static client. Plain HTML, CSS and ES modules, no build step.
+- `server2/` - Node API server. Raw `node:http`, no Express and no routing modules.
+
+The only dependency anywhere is `mysql2`, which the lab allows for database access.
+
+## Database
+
+Any MySQL or MariaDB instance works. Create the schema and the two users:
+
+```sh
+mysql -h <host> -u root -p < server2/sql/setup.sql
+```
+
+Change both passwords in that file before running it.
+
+**Two users, on purpose.** The read route connects as `lab5_reader`, which holds nothing
+but `SELECT`. That is what makes `DROP`, `DELETE`, `UPDATE` and `CREATE` impossible from
+the query textarea - the refusal comes from the database itself, not from a check in the
+JavaScript. The write route connects as `lab5_writer`, which holds `SELECT`, `INSERT` and
+`CREATE` so it can build the `patient` table and add rows, and nothing else.
+
+The `patient` table is created with `ENGINE=InnoDB` and is rebuilt automatically before
+every insert, so dropping it by hand only lasts until the next press of the button.
+
+## Running server2
+
+```sh
+cd server2
+npm install
+cp .env.example .env    # fill in the host, database and both user passwords
+npm run dev             # or: npm start, when the host injects the variables itself
+```
+
+| Variable | Purpose |
+| --- | --- |
+| `PORT` | port to listen on, defaults to 8080 |
+| `DB_HOST`, `DB_PORT`, `DB_NAME` | where the database lives |
+| `DB_SSL` | `true` for a hosted database that requires TLS |
+| `DB_READER_USER`, `DB_READER_PASSWORD` | the SELECT-only user |
+| `DB_WRITER_USER`, `DB_WRITER_PASSWORD` | the INSERT user |
+
+### Endpoints
+
+| Method | Path | Does |
+| --- | --- | --- |
+| `POST` | `/lab5/api/v1/sql` | empty body inserts the four sample patients; a `{"query": "INSERT ..."}` body inserts that row |
+| `GET` | `/lab5/api/v1/sql/<url encoded sql>` | runs the query as the read-only user |
+
+A query typed straight into the address bar, quotes and all:
+
+```
+https://<api-host>/lab5/api/v1/sql/%22select%20*%20from%20patient%22
+```
+
+## Running server1
+
+Any static host. Point `API_BASE_URL` at the top of `server1/js/script.js` at server 2,
+then upload the folder.
+
+```sh
+cd server1
+python3 -m http.server 3000
+```
+
+Server 1 and server 2 must not share an origin.