feat: prepare ARR for controlled public deployment

arr_mcp/database.py

@@ -0,0 +1,67 @@
+"""Controlled local PostgreSQL connector for the standalone MCP process."""
+
+from __future__ import annotations
+
+import os
+import stat
+from pathlib import Path
+from typing import Any, Callable, Dict
+
+
+_REQUIRED = (
+    "ARR_DB_HOST",
+    "ARR_DB_PORT",
+    "ARR_DB_USER",
+    "ARR_DB_PASSWORD",
+    "ARR_DB_NAME",
+)
+
+
+def _read_private_database_config(path: Path) -> Dict[str, object]:
+    candidate = path.expanduser()
+    if candidate.is_symlink():
+        raise ValueError("controlled database configuration is invalid")
+    resolved = candidate.resolve(strict=True)
+    metadata = resolved.stat()
+    if (
+        not stat.S_ISREG(metadata.st_mode)
+        or metadata.st_uid != os.getuid()
+        or stat.S_IMODE(metadata.st_mode) != 0o600
+    ):
+        raise ValueError("controlled database configuration is invalid")
+    values: Dict[str, str] = {}
+    for raw in resolved.read_text(encoding="utf-8").splitlines():
+        line = raw.strip()
+        if not line or line.startswith("#") or "=" not in line:
+            continue
+        key, value = line.split("=", 1)
+        key = key.strip()
+        if key in values:
+            raise ValueError("controlled database configuration is invalid")
+        values[key] = value.strip().strip('"').strip("'")
+    if any(not values.get(key) for key in _REQUIRED):
+        raise ValueError("controlled database configuration is incomplete")
+    try:
+        port = int(values["ARR_DB_PORT"])
+    except ValueError:
+        raise ValueError("controlled database configuration is invalid") from None
+    if not 1 <= port <= 65535:
+        raise ValueError("controlled database configuration is invalid")
+    return {
+        "host": values["ARR_DB_HOST"],
+        "port": port,
+        "user": values["ARR_DB_USER"],
+        "password": values["ARR_DB_PASSWORD"],
+        "dbname": values["ARR_DB_NAME"],
+    }
+
+
+def controlled_connect(path: Path) -> Callable[[str], Any]:
+    import psycopg  # type: ignore[import-not-found]
+
+    parameters = _read_private_database_config(path)
+
+    def connect(_dsn: str) -> Any:
+        return psycopg.connect(**parameters, autocommit=False)
+
+    return connect