Lab 5 - DB Intro
Two origins, as the lab requires.
server1/- static client. Plain HTML, CSS and ES modules, no build step.server2/- Node API server. Rawnode:http, no Express and no routing modules.
The only dependency anywhere is mysql2, which the lab allows for database access.
Database
Any MySQL or MariaDB instance works. Create the schema and the two users:
mysql -h <host> -u root -p < server2/sql/setup.sql
Change both passwords in that file before running it.
Two users, on purpose. The read route connects as lab5_reader, which holds nothing
but SELECT. That is what makes DROP, DELETE, UPDATE and CREATE impossible from
the query textarea - the refusal comes from the database itself, not from a check in the
JavaScript. The write route connects as lab5_writer, which holds SELECT, INSERT and
CREATE so it can build the patient table and add rows, and nothing else.
The patient table is created with ENGINE=InnoDB and is rebuilt automatically before
every insert, so dropping it by hand only lasts until the next press of the button.
Running server2
cd server2
npm install
cp .env.example .env # fill in the host, database and both user passwords
npm run dev # or: npm start, when the host injects the variables itself
| Variable | Purpose |
|---|---|
PORT |
port to listen on, defaults to 8080 |
DB_HOST, DB_PORT, DB_NAME |
where the database lives |
DB_SSL |
true for a hosted database that requires TLS |
DB_READER_USER, DB_READER_PASSWORD |
the SELECT-only user |
DB_WRITER_USER, DB_WRITER_PASSWORD |
the INSERT user |
Endpoints
| Method | Path | Does |
|---|---|---|
POST |
/lab5/api/v1/sql |
empty body inserts the four sample patients; a {"query": "INSERT ..."} body inserts that row |
GET |
/lab5/api/v1/sql/<url encoded sql> |
runs the query as the read-only user |
A query typed straight into the address bar, quotes and all:
https://<api-host>/lab5/api/v1/sql/%22select%20*%20from%20patient%22
Running server1
Any static host. Point API_BASE_URL at the top of server1/js/script.js at server 2,
then upload the folder.
cd server1
python3 -m http.server 3000
Server 1 and server 2 must not share an origin.