Support unix sockets and systemd sockets using anyhttp

Bumps [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus) from 1.9.0 to 1.9.1.
- [Release notes](https://github.com/sirupsen/logrus/releases)
- [Changelog](https://github.com/sirupsen/logrus/blob/master/CHANGELOG.md)
- [Commits](https://github.com/sirupsen/logrus/compare/v1.9.0...v1.9.1)

---
updated-dependencies:
- dependency-name: github.com/sirupsen/logrus
  dependency-version: 1.9.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.dockerignore

@@ -0,0 +1,3 @@
+.github
+bin/
+./pgweb

.gitattributes

@@ -0,0 +1 @@
+bindata.go -diff

.github/workflows/checks.yml

@@ -0,0 +1,113 @@
+name: checks
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+  pull_request:
+    types:
+      - opened
+      - synchronize
+    paths-ignore:
+      - '**.md'
+
+
+env:
+  GO_VERSION: "1.25"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  tests:
+    name: tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    strategy:
+      matrix:
+        pg_version: [9.6, 10, 11, 12, 13, 14, 15, 16, 17, 18]
+
+    services:
+      postgres:
+        image: postgres:${{ matrix.pg_version }}
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: booktown
+        ports:
+          - 5432:5432
+        options: >-
+            --health-cmd pg_isready
+            --health-interval 10s
+            --health-timeout 5s
+            --health-retries 5
+    steps:
+      - name: Install latest Postgres client
+        run: |
+          sudo rm -f /etc/apt/sources.list.d/pgdg.list
+          curl --silent https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add
+          echo "deb http://apt.postgresql.org/pub/repos/apt/ `lsb_release -cs`-pgdg main" | sudo tee /etc/apt/sources.list.d/pgdg.list
+          sudo apt-get update && sudo apt-get install -y postgresql-client-18
+
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ env.GO_VERSION }}
+      - run: go mod download
+      - run: make test
+        env:
+          MallocNanoZone: 0 # https://github.com/golang/go/issues/49138
+          PGHOST: localhost
+          PGUSER: postgres
+          PGPASSWORD: postgres
+          PGDATABASE: booktown
+
+  tests-windows:
+    runs-on: windows-latest
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ env.GO_VERSION }}
+      - run: go mod download
+      - run: make test
+
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v8
+        with:
+          version: v2.7.2
+
+  fmt:
+    name: fmt
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ env.GO_VERSION }}
+      - run: go mod download
+      - run: script/check_formatting.sh

.github/workflows/deploy.yml

@@ -0,0 +1,20 @@
+name: demo deploy
+
+on:
+  push:
+    branches:
+      - main
+
+env:
+  FLY_API_TOKEN: ${{ secrets.FLY_TOKEN }}
+
+jobs:
+  deploy:
+    name: Deploy to Fly
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@v3
+      - uses: superfly/flyctl-actions/setup-flyctl@master
+      - run: flyctl deploy --remote-only

.github/workflows/docker.yml

@@ -0,0 +1,37 @@
+name: docker
+
+on:
+  push:
+    branches:
+      - main
+
+env:
+  GO_VERSION: "1.25"
+  CGO_ENABLED: 0
+  IMAGE_REPOSITORY: sosedoff/pgweb
+
+jobs:
+  docker-build:
+    name: docker images
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Configure docker build context
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build docker images
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: false
+          tags: pgweb:latest
+          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          build-args: |
+            "CGO_ENABLED=${{ env.CGO_ENABLED }}"

.github/workflows/release.yml

@@ -0,0 +1,60 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+env:
+  GO_VERSION: "1.25"
+  CGO_ENABLED: 0
+  DOCKER_REPOSITORY: sosedoff/pgweb
+  GHCR_REPOSITORY: sosedoff/pgweb
+
+jobs:
+  docker-release:
+    name: Publish Docker images
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Configure docker build context
+        uses: docker/setup-buildx-action@v2
+
+      - name: Set reference tags
+        id: refs
+        run: |
+          echo ::set-output name=SOURCE_NAME::${GITHUB_REF#refs/*/}
+          echo ::set-output name=SOURCE_BRANCH::${GITHUB_REF#refs/heads/}
+          echo ::set-output name=SOURCE_TAG::${GITHUB_REF#refs/tags/v}
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Login to Github Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GH_TOKEN }}
+
+      - name: Build and push docker images
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ env.DOCKER_REPOSITORY }}:${{ steps.refs.outputs.SOURCE_TAG }}
+            ${{ env.DOCKER_REPOSITORY }}:latest
+            ghcr.io/${{ env.GHCR_REPOSITORY }}:${{ steps.refs.outputs.SOURCE_TAG }}
+            ghcr.io/${{ env.GHCR_REPOSITORY }}:latest
+          platforms: linux/amd64,linux/arm64,linux/arm/v7

.gitignore

@@ -1,4 +1,8 @@
 .DS_Store
+.idea
+.env
+.envrc
 pgweb
 bin
-bindata.go
+tmp/
+cover.out

.golangci.yml

@@ -0,0 +1,7 @@
+version: "2"
+linters:
+  disable:
+    - errcheck
+  settings:
+    staticcheck:
+      checks: ["all", "-ST1000", "-ST1003", "-ST1016", "-ST1020", "-ST1021", "-ST1022", "-ST1005", "-QF1004"]

.travis.yml

@@ -1,5 +0,0 @@
-language: go
-go: 1.3
-
-install: make setup
-script: make dev

CHANGELOG.md

@@ -0,0 +1,495 @@
+## Changelog
+
+Current [release](https://github.com/sosedoff/pgweb/releases) is `0.17.0`.
+
+## 0.17.0 - 2025-11-22
+
+- `NEW` Update Dockerfile to use Golang 1.24 image, GH-821
+- `NEW` Bump go crypto package to 0.44.x, GH-820, GH-823
+- `NEW` Add PostgreSQL 18 support to Github Actions, GH-816
+- `NEW` Connect backend refactor, GH-801
+- `NEW` Add server settings view, GH-768
+- `NEW` Add exec time of empty queries, GH-763
+- `FIX` Minor typos, GH-764, GH-786
+- `FIX` Shorten git revision printed in the --version output, GH-770
+
+## 0.16.2 - 2024-11-02
+
+- `FIX` Build a new Docker image with PostgreSQL 17 support
+- `FIX` Run CI against PostgreSQL 17, GH-758
+- `FIX` Rename master to main branch, GH-750
+
+## 0.16.1 - 2024-09-07
+
+- `FIX` Remove linux/arm/v5 from docker release action, GH-742
+
+## 0.16.0 - 2024-06-04
+
+- `NEW` Allow database stats downloads, GH-738
+- `NEW` Add analyze table action, GH-737
+- `NEW` Bump postgres version used in docker compose to 15, GH-729
+- `NEW` Build on Go 1.22, GH-726
+- `FIX` SSH tunnel cleanup and parse fixup, GH-731
+- `FIX` Drop linux/arm/v5 from docker build, GH-728
+- `FIX` Propagate CGO_ENABLED environment variable to docker build, GH-724
+
+## 0.15.0 - 2024-03-14
+
+- `NEW` Add support for a bookmarks-only mode, GH-716
+- `FIX` Fix missing indexes by quoting schema/table name to ::regclass, GH-711
+- `FIX` Continue on parseJSON error, GH-708
+
+## 0.14.3 - 2024-01-28
+
+- `NEW` Allow retrying a connection on startup, GH-695
+- `NEW` Allow setting readonly mode in bookmarks, GH-707
+- `FIX` Add UPDATE to list of restricted keywords in read-only mode, GH-697
+
+## 0.14.2 - 2023-10-29
+
+- `NEW` Execute tests using PostgreSQL 16, GH-691
+- `FIX` Unclosed database sessions and tunnels, GH-688
+- `FIX` Use pg_table_size for table stats query, GH-685
+- `FIX` Use `HasSuffix` to correctly determine URL prefix, GH-684
+
+## 0.14.1 - 2023-06-17
+
+- `NEW` Add process start time metric, GH-675
+- `NEW` Configure pgweb user for docker container, GH-674
+- `NEW` Updated dockerfile, GH-645
+- `FIX` Fix typo in the healthy metric, GH-657
+- `NEW` Use entrypoint instead of cmd in in dockerfile, GH-654
+
+## 0.14.0 - 2023-02-21
+
+- `FIX` History page query loading fixup, GH-632
+- `NEW` Display cell content via context menu, GH-634
+- `NEW` Handle support/permissions errors in info call, GH-635
+- `NEW` Show error message when API calls fail, GH-636
+- `NEW` Add bookmark options to load username/password from env vars, GH-638
+- `NEW` Add context menu to display database tables stats, GH-639
+- `NEW` Added Local Queries feature, GH-641
+- `FIX` Ensure that objects are sorted by schema and name, GH-648
+- `FIX` Fetch local queries on db connect, GH-650
+
+## 0.13.1 - 2022-12-27
+
+- Fix connect flow when `~/.pgweb/bookmarks` directory is not available, GH-631
+
+## 0.13.0 - 2022-12-25
+
+- Add support for .pgpass file, GH-617
+- Request logging additions (request id, forwarded user), GH-618
+- Establish connections using bookmark ID only, GH-619
+- Display empty schemas on the sidebar, GH-621
+- Configure timeout and retries when testing connection status, GH-623
+- Setup basic prom metrics endpoint, GH-624
+- Add default connect_timeout option to connection string, GH-626
+- Add duration_ms to log entries, GH-628
+- Add query execution stats to api endpoint, GH-629
+
+## 0.12.0 - 2022-12-13
+
+- Deprecate usage of Gox for binary builds, GH-571
+- Add netcat install in dockerfile to provide a way to healthcheck, GH-572
+- Install latest postgres client in docker image, GH-577
+- Add support for `PGWEB_` prefix environment variables, GH-585
+- Fix export URL generation, refactor export code, GH-588
+- Add logrus-based request logger, GH-589
+- Configure logger for connect backend, GH-591
+- Set LDFLAGS for make build/release commands, GH-592
+- Add internal sessions manager, GH-593
+- Include index size on the index list view, GH-595
+- Fix flaky backend connection test, GH-596
+- Add ability to view and copy views/materialized views definitions, GH-594
+- Enable dev assets mode with PGWEB_ASSETS_DEVMODE env var, GH-597
+- Make query input box resizable, GH-599
+- Deprecate Heroku demo deployments and switch to Fly, GH-600
+- Handle returning values in update/delete queries, GH-601
+- Fix panic with invalid time marshaling, GH-602
+- Configure logging level and format, GH-605
+- Use go embed to load queries from static files, GH-607
+- Switch go build target to 1.19, GH-603
+- Add support for user functions, GH-608
+- Implement global query timeout option, GH-609
+- Switch windows tests from Appveyor to Github Actions, GH-611
+- Fix activity endpoint panic when server version is not detected, GH-612
+
+## 0.11.12 - 2022-07-05
+
+- Update base docker image (alpine), update deps, GH-558
+- Refactor docker images building, include ARM, GH-568
+
+## 0.11.11 - 2022-03-29
+
+- Auto-detect the query from the query source based on user selection, GH-547
+- Added binary codec base58 as well as improving the help for --binary-codec flag, GH-548
+- Change binary codec back to none, GH-555
+
+## 0.11.10 - 2022-01-20
+
+- Removes alert on column copy value, GH-536
+- Migrate test suite to Github Action, GH-540
+- Serialize binary bytea cols into hex/base64, GH-537
+- Include build time into version string, GH-541
+- Explain analyze dropdown button, GH-532
+- Switch to go 1.17, GH-543
+- Use HTTP 302 status code for successful backend redirect, GH-544
+- Add connect backend tests, GH-546
+
+## 0.11.9 - 2021-11-08
+
+- Releases are built on Go 1.17
+- Build time correction, GH-521
+- Fix broken assets URL path prefix, GH-525
+- Update docker build image to alpine:3.14, GH-522
+- Upgrade gin dependency to v1.7.4, GH-527
+- Add FreeBSD startup script, GH-520
+
+## 0.11.8 - 2021-07-07
+
+- Releases are built with Go 1.16
+- Add ARM64 v7 build target, GH-497
+- Switch to Go modules for dependency management, GH-509
+- Switch to Go embed for static assets management, GH-510
+- Add Darwin/ARM64 build target (Apple Silicon), GH-513
+
+## 0.11.7 - 2020-10-18
+
+- Releases are built with Go 1.15
+- Show results row context menu on custom query results, GH-457
+- Do not terminate if local authentication failed on start, GH-463
+- Do not show other databases if session is locked, GH-470
+- Strip debug information from binary to reduce size, GH-489
+- Disable autocomplete on database search field, GH-492
+- Improve windows connection error matching during start, GH-493
+
+## 0.11.6 - 2020-02-19
+
+- Add CLI options for SSL key, cert and root certs, GH-452
+- Remove double click action on cell, GH-455
+
+## 0.11.5 - 2019-12-16
+
+- Add basic SQL keyword autocompletion, GH-443
+- SSH Private Key handling update (encrypted keys are supported now), GH-445
+- Include Go version into `pgweb --version` output, GH-447
+- Fix long table name bug in the sidebar, GH-448
+- Add SQL objects (table,views,etc) autocompletion, GH-449
+- Include Go version into info API endpoint, GH-450
+
+## 0.11.4 - 2019-10-05
+
+- Fix SQL export filename, GH-438
+- Update Docker image to alpine:3.10, GH-439
+- Drop unsupported pg_dump options from connection string, GH-441
+- Misc code cleanup and formatting, GH-442
+
+## 0.11.3 - 2019-07-24
+
+- Misc: add script to update homebrew formula version, GH-423
+- Destructive keyword restriction in read-only mode, GH-421
+- Make database object searchable in sidebar, GH-434
+- Update lib/pg to 1.1.1, GH-435
+
+## 0.11.2 - 2019-02-15
+
+- Fix table row estimation query for camelcase schemas, GH-414
+
+## 0.11.1 - 2019-01-28
+
+- Typo fixes
+- Add Base64 javascript encoder/decoder to replace deprecated window.atob call, GH-405
+- Fix startup error when DATABASE_URL is set, GH-406
+- Fix user auto detection when USER env var is not set, GH-408
+- Switch bindata dependency to use maintained fork: github.com/go-bindata/go-bindata, GH-409
+
+## 0.11.0 - 2018-12-24
+
+- Tweak sidebar database object counters styles, GH-400
+- Do not exit with error if local server is not running, GH-399
+- Fix SSH host verification check, GH-398
+- Scope activity list to current database only, GH-397
+- Show current release version and check for updates, GH-396
+- Force switch back to default connection settings view, GH-395
+- Fix row count estimation bug, GH-394
+- Print out failed query SQL and args with --debug flag, GH-393
+
+## 0.10.0 - 2018-11-28
+
+- Fixes relation not found errors when dealing with table names that have uppercase characters, GH-356
+- Dockerfile updates, GH-357
+- Check if pg_dump is available before running database export, GH-358
+- Improvements to CockroachDB integration, GH-365
+- Add EstimatedTableRowsCount to avoid count in large tables, GH-366
+- Automatically set table filter option to 'equals' if its not set, GH-370
+- Dependencies update and switch to dep, GH-375
+- Add column context menu item to get numeric stats, GH-377
+- Fix issues with connection string builder, GH-378
+- Include rows count to numeric stats view on table column, GH-379
+- Make localhost to be a default db host, GH-380
+- Clear out connection settings/bookmark on login screen when running in session/connect mode
+- Add table row context menu with actions, GH-381
+- Allow settings url prefix with URL_PREFIX env var, GH-387
+- Fix JSON marshal panic when dealing with NaN values, GH-388
+- Fix startup behavior when user did not provide a database name, GH-389
+
+## 0.9.12 - 2018-04-23
+
+- Add link to view database connection string format on login page
+- Include constraint name under "constraints" tab, GH-343
+- Misc CI and config changes
+
+## 0.9.11 - 2017-12-07
+
+- Fix ssl mode for the connection url in the bookmarks, GH-320
+- Add support for CORS, GH-321
+- Fix custom query results counter for empty queries, GH-322
+- Reorganize the table context menu, GH-323
+- Disable database connection string text field autocomplete, GH-327
+- Add db prefix to the table export files, GH-329
+- Add database view context menu with export actions, GH-330
+
+## 0.9.10 - 2017-11-03
+
+- Make idle connection timeout configurable, [GH-282]
+- Fix panics when sshinfo is not set on bookmarks, [GH-296]
+- Dot now allow using startup bookmark in multi-session mode, [GH-300]
+- Add ability to copy table name from the sidebar, [GH-301]
+
+## 0.9.9 - 2017-09-28
+
+- Automatically format JSON data exports, GH-255
+- Update Docker image to alpine:3.6, GH-256
+- Print out PostgreSQL server version on start in a single-session mode, GH-264
+- Record last query timestamp for the client connection, GH-265
+- Add context menu for table headers in browse mode (copy name, see unique values), GH-268
+- Add ability to export current database dump, GH-270
+- Automatically open pgweb in browser on start if its already running, GH-272
+- Connect to the database with credentials provided by a third-party backend, GH-266
+- Automatically close idle sessions (no activity in 1 hour), GH-275
+- Allow connecting via SSH with a custom private key and other fixes, GH-277
+- Add options to disable SSH connections, GH-279
+
+## 0.9.8 - 2017-08-04
+
+- Fixed error checking in the API, GH-234
+- Fixed activity tab to support PG 9.x versions, GH-237
+- Remember sort column and order for pagination, GH-240
+- Use `sslmode=disable` for bookmarks without sslmode option, GH-244
+- Javascript fixes for IE9-11, GH-245
+- Require confirmation for the disconnect, GH-246
+- Clean the results table on manual disconnect
+
+## 0.9.7 - 2017-04-04
+
+- Fixed issue with locked session and empty db url, GH-206
+- Fixed path rewrite on DB change, GH-212
+- Upgraded dependencies, GH-217
+- Added ability to specify bookmarks path, GH-218
+- Added counter for the number of rows from a custom SQL query, GH-224
+- Added new behavior for removing table rows view on custom SQL query page, GH-225
+
+## 0.9.6 - 2016-11-18
+
+- Fixed bug in query base64-encoding, GH-186
+- Fixed rows pagination visibility bug, GH-190
+- Fixed issue with query order escaping, GH-191
+- Fixed invalid query selection for explain command, GH-198
+- Fixed issue with empty sidebar, now it shows empty state, GH-202
+- Added new flag --readonly to enable read only transaction mode, GH-193
+- Added ability to kill any running query, GH-194
+- Added session database connection locking, GH-195
+- Added ability to switch between databases, GH-196
+- Added feature to keep last selected tab when switching between tables, GH-197
+- Added new flag --bookmark (-b) to specify server connection from bookmark, GH-201
+
+## 0.9.5 - 2016-10-01
+
+- Only view schema with USAGE privileges, GH-167
+- Fixed broken export to CSV/JSON/XML if hashmark in URL, GH-175
+- Added example service configuration for systemd, GH-177
+- Allow setting auth user and pass using variables
+
+## 0.9.4 - 2016-07-29
+
+- Fixes CSV/JSON/XML export buttons when pgweb is running with url prefix, GH-170
+
+## 0.9.3 - 2016-06-30
+
+- Uses Go 1.6 for development, GH-155
+- Fixes timestamp formatting in CSV export, GH-163
+- Included PostgreSQL 9.6 for integration testing
+- Switches docker image to Alpine to reduce image size
+- Adds support for ARMv5
+
+## 0.9.2 - 2016-03-01
+
+- Fixes bug with unsafe base64 encoded sql queries
+- Fixes issue with session id not being included in multi-session mode
+- Fixes visual issue with long table names in sidebar
+- Fixes visual issue with a scrollbar in table information widget
+- Fixes issue with database connection form being reset by clicking on 'cancel' button
+- Adds ability to close connection
+- Adds display message for number of affected rows for update/delete queries, GH-133
+- Adds web server url prefix as a CLI option, GH-135
+
+## 0.9.1 - 2016-01-25
+
+- Fixes bug with tables context menu
+- Fixes JS bug when query returns no rows
+- Fixes bug with switching between different connection modes
+- Adds AJAX timeout to 5s
+- Adds sidebar reload action on any CREATE/DROP action
+
+## 0.9.0 - 2016-01-19
+
+- Add support for multiple schemas. GH-112
+- Add support for native ssh tunnes. GH-114
+- Add materialized views to list of schema objects
+- Adds a few design tweaks and cleanups
+- Fixes bug with nil result set when fetching rows
+
+## 0.8.0 - 2016-01-11
+
+- Fixes bug with bigint conversions in javascript. Now bigints are encoded as strings. GH-109
+- Adds pagination and simple column filtering to table rows browser. GH-110
+- Adds ability to use pgweb with multiple database sessions. GH-111
+- Adds a few design tweaks and cleanups
+
+## 0.7.0 - 2016-01-05
+
+- Adds sequences to the sidebar panel - GH-100
+- Adds table constrains view - GH-104
+- Adds ability to export table and query rows as JSON/XML - GH-107
+- Updates to UI theme and SQL editor
+
+## 0.6.3 - 2015-08-16
+
+- Adds PostgreSQL password escaping in web ui, GH-96
+- Adds base64 query encoding for CSV export, GH-95
+- Adds automatic saving of last executed query to localStorage
+- Adds request middleware to log incoming form params in debug mode
+
+## 0.6.2 - 2015-07-15
+
+- Adds ability to specify connection strings prefixed by `postgresql://`, [GH-92]
+- Updates configuration for Heroku, [GH-89], [GH-90]
+- Updates postgresql library dependency to latest, [GH-91]
+- Fixes password field to not display plaintext passwords, [GH-87]
+
+## 0.6.1 - 2015-06-18
+
+- This release is repackage-release targeted to fix binary downloads
+
+## 0.6.0 - 2015-05-31
+
+- Adds ability to execute only selected SQL query in run command view, [GH-85]
+- Adds ability to delete/truncate table via context many on sidebar view
+- Adds ability to export table contents to CSV via context menu on sidebar view
+- Changes sidebar color scheme to a lighter and better looking one
+
+## 0.5.3 - 2015-05-06
+
+- Changes default server port from 8080 to 8081 to avoil conflict with RethinkDB
+- Changes styles for table rows and connection settings window
+- Adds highlighting styles for columns with sort order
+- Adds git sha into program version output
+- Add new endpoint /api/info to get build details
+
+## 0.5.2 - 2015-04-13
+
+- Adds a new endpoint /activity that returns active queries
+- Adds tab to view active queries
+- Adds column sorting when browsing table contents
+- Fixes SQL query view when switching to table structure view
+
+## 0.5.1 - 2015-02-23
+
+- Upgrades Gin framework dependency to 0.5.0
+- Fixes server crash if another pgweb server is running
+
+## 0.5.0 - 2015-01-13
+
+- Adds Go 1.4 support
+- Adds connection string printing in debug mode
+- Adds initial bookmarks support
+- Adds /api prefix for all API calls
+- Adds makefile usage task
+- Adds windows CI to verify build process
+- Adds example sql database to codebase
+- Adds timestamped filenames when exporting results to CSV [GH-75]
+- Adds connection checking on each request to prevent api panics
+- Adds timestamps to query history records
+- Adds current database name to the sidebar
+- Adds button to refresh tables list to the sidebar
+- Updates all application dependencies
+- Changes /api/info endpoint to /api/connection
+- Fixes issues with connection string/options parsing
+- Fixes capitalized column names in table view
+- Fixes connection string validation in /api/connect endpoint
+
+## 0.4.1 - 2014-12-01
+
+- Adds pgweb version on start [GH-65]
+- Adds user detection from OS environment
+- Adds simple memory profiles with --debug option
+- Adds the session user and search path in connection info [GH-67]
+- Adds table list reloading after CREATE/DROP TABLE queries [GH-69]
+- Adds font awesome icons for the sidebar
+- Removes query recording for internal queries [GH-67]
+- Fixes default sslmode. Its not longer set to "disable"
+- Fixes cells cropping on table indexes view
+- Fixes connection URL generation using web interface
+- Fixes SQL statements for table row count [GH-67]
+- Fixes /tables JSON response if database does not have any tables
+
+## 0.4.0 - 2014-11-11
+
+- Adds query escaping when exporting results to CSV [GH-38]
+- Adds keyboard shortcut (ctrl+e, command+e on mac) for query explain action
+- Adds HTTP basic authentication with --auth-user and --auth-pass flags
+- Adds -skip-open/-s flag to disable automatic browser launch
+- Adds --bind option to specify server listen hostname/ip
+- Adds ssl mode parameters to url if ssl flag is set and not defined in the url
+- Adds dependency management with Godep
+- Adds Docker support
+- Adds Heroku support
+- Adds ability to connect to databases with no tables
+- Adds precompiled assets into repository to simplify development
+- Adds a connection details view
+- Adds a new interface to specify connection settings or make a new connection
+- Adds page favicon
+- Adds ability to present cell data as text area by double clicking on it
+- Fixes styles for query explain results
+- Fixes sidebar navigation scrolling styles [GH-12]
+- Fixes sidebar table name styles to support long names
+
+## 0.3.1 - 2014-10-28
+
+- Adds proper exit code when printing version via -v/--version flag
+- Adds --version and --debug long flag names
+- Adds double quotes for table name when fetching table contents
+- Adds support for DATABASE_URL environment variable if no --url is set
+- Adds proper usage of jQuery .prop method
+- Adds --pass flag to specify connection password
+- Fixes --ssl flag usage, previous value was hardcoded
+
+## 0.3.0 - 2014-10-26
+
+- Renamed `make deps` to `make setup` and fix issues with bootstrapping
+- Removed hardcoded url for CSV export, it now detects application host:port
+- Improved query history view table styles
+- Moved table information view to the sidebar
+- Added --listen flag to specify web server port, still defaults to 8080
+
+## 0.2.0 - 2014-10-23
+
+- Design tweaks
+- Automatically opens browser on OSX systems
+- Adds query explain functionality
+- Adds export to CSV
+
+## 0.1.0 - 2014-10-14
+
+- Initial release

CONTRIBUTING.md

@@ -0,0 +1,7 @@
+- Fork repository
+- Create a new git branch
+- Make changes
+- Run tests: `make test`
+- Run tests against all supported PostreSQL versions: `make test-all` (optional)
+- If you change frontend code (js/css) make sure to rebuild assets: `make assets`
+- Open a new pull request

Dockerfile

@@ -0,0 +1,48 @@
+# ------------------------------------------------------------------------------
+# Builder Stage
+# ------------------------------------------------------------------------------
+FROM golang:1.25-trixie AS build
+
+# Set default build argument for CGO_ENABLED
+ARG CGO_ENABLED=0
+ENV CGO_ENABLED=${CGO_ENABLED}
+
+WORKDIR /build
+
+RUN git config --global --add safe.directory /build
+COPY go.mod go.sum ./
+RUN go mod download
+COPY Makefile main.go ./
+COPY static/ static/
+COPY pkg/ pkg/
+COPY .git/ .
+RUN make build
+
+# ------------------------------------------------------------------------------
+# Fetch signing key
+# ------------------------------------------------------------------------------
+FROM debian:trixie-slim AS keyring
+ADD https://www.postgresql.org/media/keys/ACCC4CF8.asc keyring.asc
+RUN apt-get update && \
+    apt-get install -qq --no-install-recommends gpg
+RUN gpg -o keyring.pgp --dearmor keyring.asc
+
+# ------------------------------------------------------------------------------
+# Release Stage
+# ------------------------------------------------------------------------------
+FROM debian:trixie-slim
+
+ARG keyring=/usr/share/keyrings/postgresql-archive-keyring.pgp
+COPY --from=keyring /keyring.pgp $keyring
+RUN . /etc/os-release && \
+    echo "deb [signed-by=${keyring}] http://apt.postgresql.org/pub/repos/apt/ ${VERSION_CODENAME}-pgdg main" > /etc/apt/sources.list.d/pgdg.list && \
+    apt-get update && \
+    apt-get install -qq --no-install-recommends ca-certificates openssl netcat-openbsd curl postgresql-client
+
+COPY --from=build /build/pgweb /usr/bin/pgweb
+
+RUN useradd --uid 1000 --no-create-home --shell /bin/false pgweb
+USER pgweb
+
+EXPOSE 8081
+ENTRYPOINT ["/usr/bin/pgweb", "--bind=0.0.0.0", "--listen=8081"]

LICENSE

@@ -1,4 +1,6 @@
-Copyright (c) 2014 Dan Sosedoff <dan.sosedoff@gmail.com>
+The MIT License (MIT)
+
+Copyright (c) 2014-2024 Dan Sosedoff <dan.sosedoff@gmail.com>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in

Makefile

@@ -1,21 +1,73 @@
+PKG = github.com/sosedoff/pgweb
+GIT_COMMIT ?= $(shell git rev-parse --short=8 HEAD)
+BUILD_TIME ?= $(shell date -u +"%Y-%m-%dT%H:%M:%SZ" | tr -d '\n')
+GO_VERSION ?= $(shell go version | awk {'print $$3'})
+
+DOCKER_RELEASE_TAG = "sosedoff/pgweb:$(shell git describe --abbrev=0 --tags | sed 's/v//')"
+DOCKER_LATEST_TAG = "sosedoff/pgweb:latest"
+
+LDFLAGS = -s -w
+LDFLAGS += -X $(PKG)/pkg/command.GitCommit=$(GIT_COMMIT)
+LDFLAGS += -X $(PKG)/pkg/command.BuildTime=$(BUILD_TIME)
+LDFLAGS += -X $(PKG)/pkg/command.GoVersion=$(GO_VERSION)
+
+usage:
+	@echo ""
+	@echo "Task                 : Description"
+	@echo "-----------------    : -------------------"
+	@echo "make dev             : Generate development build"
+	@echo "make build           : Generate production build for current OS"
+	@echo "make release         : Generate binaries for all supported OSes"
+	@echo "make test            : Execute test suite"
+	@echo "make test-all        : Execute test suite on multiple PG versions"
+	@echo "make lint            : Execute code linter"
+	@echo "make clean           : Remove all build files and reset assets"
+	@echo "make docker          : Build docker image"
+	@echo "make docker-release  : Build and tag docker image"
+	@echo "make docker-push     : Push docker images to registry"
+	@echo ""
+
+test:
+	go test -v -race -cover ./pkg/...
+
+test-all:
+	@./script/test_all.sh
+	@./script/test_cockroach.sh
+
+lint:
+	golangci-lint run
+
 dev:
-	rm -f bindata.go
-	go-bindata -debug -ignore=\\.gitignore -ignore=\\.DS_Store -ignore=\\.gitkeep static/...
 	go build
 	@echo "You can now execute ./pgweb"
 
 build:
-	rm -f bindata.go
-	go-bindata -ignore=\\.gitignore -ignore=\\.DS_Store -ignore=\\.gitkeep static/...
-	gox -osarch="darwin/amd64 linux/amd64 linux/386 windows/amd64 windows/386" -output="./bin/pgweb_{{.OS}}_{{.Arch}}"
+	go build -ldflags '${LDFLAGS}'
+	@echo "You can now execute ./pgweb"
 
-setup:
-	go get github.com/mitchellh/gox
-	go get github.com/jteeuwen/go-bindata/...
-	go-bindata -debug -ignore=\\.gitignore -ignore=\\.DS_Store -ignore=\\.gitkeep static/...
-	go get
+install:
+	go install -ldflags '${LDFLAGS}'
+	@echo "You can now execute pgweb"
+
+release: clean
+	@echo "Building binaries..."
+	@LDFLAGS='${LDFLAGS}' ./script/build_all.sh
 
 clean:
-	rm -f ./pgweb
-	rm -f ./bin/*
-	rm -f bindata.go
+	@echo "Removing all artifacts"
+	@rm -rf ./pgweb ./bin/*
+
+docker:
+	docker build --no-cache -t pgweb .
+
+docker-run:
+	docker run --rm -p 8081:8081 -it pgweb
+
+docker-release:
+	docker build --no-cache -t $(DOCKER_RELEASE_TAG) .
+	docker tag $(DOCKER_RELEASE_TAG) $(DOCKER_LATEST_TAG)
+	docker images $(DOCKER_RELEASE_TAG)
+
+docker-push:
+	docker push $(DOCKER_RELEASE_TAG)
+	docker push $(DOCKER_LATEST_TAG)

Procfile

@@ -0,0 +1 @@
+web: pgweb --url=$DATABASE_URL --listen=$PORT --bind=0.0.0.0 --auth-user=$AUTH_USER --auth-pass=$AUTH_PASS

README.md

@@ -1,115 +1,109 @@
 # pgweb
 
-Web-based PostgreSQL database browser written in Go.
+Simple web-based and cross platform PostgreSQL database explorer.
+
+[![Release](https://img.shields.io/github/release/sosedoff/pgweb.svg?label=Release)](https://github.com/sosedoff/pgweb/releases)
+[![Linux Build](https://github.com/sosedoff/pgweb/actions/workflows/checks.yml/badge.svg)](https://github.com/sosedoff/pgweb/actions?query=branch%3Amain)
+[![Go Report Card](https://goreportcard.com/badge/github.com/sosedoff/pgweb)](https://goreportcard.com/report/github.com/sosedoff/pgweb)
+[![GoDoc](https://godoc.org/github.com/sosedoff/pgweb?status.svg)](https://godoc.org/github.com/sosedoff/pgweb)
+[![Docker Pulls](https://img.shields.io/docker/pulls/sosedoff/pgweb.svg)](https://hub.docker.com/r/sosedoff/pgweb/)
 
 ## Overview
 
-This is a web-based browser for PostgreSQL database server. Its written in Go
-and works on Mac OSX, Linux and Windows machines. Main idea behind using Go for the backend
-is to utilize language's ability for cross-compile source code for multiple platforms. 
-This project is an attempt to create a very simple and portable application to work with 
-PostgreSQL databases.
+Pgweb is a web-based database explorer for PostgreSQL, written in Go, and works
+on Mac, Linux and Windows machines. Distributed as a simple binary with zero dependencies.
+Very easy to use and packs just the right amount of features.
 
-<img src="screenshots/browse.png" width="345px" />
-<img src="screenshots/query.png" width="345px" />
+[See application screenshots](SCREENS.md)
 
-Features:
+## Features
 
-- Connect to local or remote server
-- Browse tables and table rows
-- Get table details: structure, size, indices, row count
-- Execute SQL query and run analyze on it
-- Export query results to CSV
-- View query history
+- Cross-platform: Mac/Linux/Windows (64bit).
+- Simple installation (distributed as a single binary).
+- Zero dependencies.
+- Works with PostgreSQL 9.1+.
+- Supports native SSH tunnels.
+- Multiple database sessions.
+- Execute and analyze custom SQL queries.
+- Table and query data export to CSV/JSON/XML.
+- Query history.
+- Server bookmarks.
+
+Visit [WIKI](https://github.com/sosedoff/pgweb/wiki) for more details.
+
+## Demo
+
+Visit https://pgweb-demo.fly.dev/ to see Pgweb in action.
 
 ## Installation
 
-Please visit [Github Releases](https://github.com/sosedoff/pgweb/releases) to download a 
-precompiled binary for your operating system.
-
-Currently supported:
-
-- Mac OSX 64bit
-- Linux 32/64bit
-- Windows 32/64bit
-
-Supported PostgreSQL versions:
-
-- 9.1
-- 9.2
-- 9.3
-
-Older versions of PostgreSQL might also work but this project is not tested on 
-8.x branches.
+- [Precompiled binaries](https://github.com/sosedoff/pgweb/releases) for supported operating systems are available.
+- [More installation options](https://github.com/sosedoff/pgweb/wiki/Installation)
 
 ## Usage
 
 Start server:
 
+```
+pgweb
+```
+
+You can also provide connection flags:
+
 ```
 pgweb --host localhost --user myuser --db mydb
 ```
 
-You can also specify a connection URI instead of individual flags:
+Connection URL scheme is also supported:
 
 ```
-pgweb --url postgres://user:password@host:port/database
+pgweb --url postgres://user:password@host:port/database?sslmode=[mode]
+pgweb --url "postgres:///database?host=/absolute/path/to/unix/socket/dir"
 ```
 
-It works great with [Heroku Postgres](https://postgres.heroku.com) if you need 
-to troubleshoot production database or simply run a few queries.
+### Multiple database sessions
 
-Full CLI options:
+To enable multiple database sessions in pgweb, start the server with:
 
 ```
-Usage:
-  pgweb [OPTIONS]
-
-Application Options:
-  -v            Print version
-  -d            Enable debugging mode (false)
-      --url=    Database connection string
-      --host=   Server hostname or IP (localhost)
-      --port=   Server port (5432)
-      --user=   Database user (postgres)
-      --db=     Database name (postgres)
-      --ssl=    SSL option (disable)
-      --listen= HTTP server listen port (8080)
+pgweb --sessions
 ```
 
-## Compile from source
-
-Go 1.3+ is required. You can install Go with `homebrew`:
+Or set environment variable:
 
 ```
-brew install go
+PGWEB_SESSIONS=1 pgweb
 ```
 
-To compile source code run the following command:
+## Testing
+
+Before running tests, make sure you have PostgreSQL server running on `localhost:5432`
+interface. Also, you must have `postgres` user that could create new databases
+in your local environment. Pgweb server should not be running at the same time.
+
+Execute test suite:
 
 ```
-make setup
-make dev
+make test
 ```
 
-This will produce `pgweb` binary in the current directory.
-
-There's also a task to compile binaries for other operating systems:
+If you're using Docker locally, you might also run pgweb test suite against
+all supported PostgreSQL version with a single command:
 
 ```
-make build
+make test-all
 ```
 
-Under the hood it uses [gox](https://github.com/mitchellh/gox). Compiled binaries
-will be stored into `./bin` directory.
+## Contribute
 
-## Contributors
-
-- Dan Sosedoff - https://twitter.com/sosedoff
-- Masha Safina - https://twitter.com/mashasafina
+- Fork this repository
+- Create a new feature branch for a new functionality or bugfix
+- Commit your changes
+- Execute test suite
+- Push your code and open a new pull request
+- Use [issues](https://github.com/sosedoff/pgweb/issues) for any questions
+- Check [wiki](https://github.com/sosedoff/pgweb/wiki) for extra documentation
 
 ## License
 
-The MIT License (MIT)
-
-Copyright (c) 2014 Dan Sosedoff, <dan.sosedoff@gmail.com>
+The MIT License (MIT). See [LICENSE](LICENSE) file for more details.

SCREENS.md

@@ -0,0 +1,10 @@
+# Screenshots
+
+### Connect
+<img src="screenshots/connect.png" />
+
+### Browse table rows
+<img src="screenshots/browse.png" />
+
+### Write SQL queries
+<img src="screenshots/query.png" />

TODO.md

@@ -1,8 +0,0 @@
-## TODO
-
-- [x] More detailed usage / help section
-- [x] Build for linux and windows
-- [x] Add view to see table details (not only structure)
-- [x] Ability to specify pgweb listen port
-- [ ] Ability to switch between databases
-- [ ] Make results table rows sortable

api.go

@@ -1,169 +0,0 @@
-package main
-
-import (
-	"errors"
-	"fmt"
-	"github.com/gin-gonic/gin"
-	"strings"
-)
-
-type Error struct {
-	Message string `json:"error"`
-}
-
-func assetContentType(name string) string {
-	if strings.Contains(name, ".css") {
-		return "text/css"
-	}
-
-	if strings.Contains(name, ".js") {
-		return "application/javascript"
-	}
-
-	return "text/plain"
-}
-
-func API_Home(c *gin.Context) {
-	data, err := Asset("static/index.html")
-
-	if err != nil {
-		c.String(400, err.Error())
-		return
-	}
-
-	c.Data(200, "text/html; charset=utf-8", data)
-}
-
-func API_GetDatabases(c *gin.Context) {
-	names, err := dbClient.Databases()
-
-	if err != nil {
-		c.JSON(400, NewError(err))
-		return
-	}
-
-	c.JSON(200, names)
-}
-
-func API_RunQuery(c *gin.Context) {
-	query := strings.TrimSpace(c.Request.FormValue("query"))
-
-	if query == "" {
-		c.JSON(400, errors.New("Query parameter is missing"))
-		return
-	}
-
-	API_HandleQuery(query, c)
-}
-
-func API_ExplainQuery(c *gin.Context) {
-	query := strings.TrimSpace(c.Request.FormValue("query"))
-
-	if query == "" {
-		c.JSON(400, errors.New("Query parameter is missing"))
-		return
-	}
-
-	API_HandleQuery(fmt.Sprintf("EXPLAIN ANALYZE %s", query), c)
-}
-
-func API_GetTables(c *gin.Context) {
-	names, err := dbClient.Tables()
-
-	if err != nil {
-		c.JSON(400, NewError(err))
-		return
-	}
-
-	c.JSON(200, names)
-}
-
-func API_GetTable(c *gin.Context) {
-	res, err := dbClient.Table(c.Params.ByName("table"))
-
-	if err != nil {
-		c.JSON(400, NewError(err))
-		return
-	}
-
-	c.JSON(200, res)
-}
-
-func API_GetTableInfo(c *gin.Context) {
-	res, err := dbClient.TableInfo(c.Params.ByName("table"))
-
-	if err != nil {
-		c.JSON(400, NewError(err))
-		return
-	}
-
-	c.JSON(200, res.Format()[0])
-}
-
-func API_History(c *gin.Context) {
-	c.JSON(200, dbClient.history)
-}
-
-func API_Info(c *gin.Context) {
-	res, err := dbClient.Info()
-
-	if err != nil {
-		c.JSON(400, NewError(err))
-		return
-	}
-
-	c.JSON(200, res.Format()[0])
-}
-
-func API_TableIndexes(c *gin.Context) {
-	res, err := dbClient.TableIndexes(c.Params.ByName("table"))
-
-	if err != nil {
-		c.JSON(400, NewError(err))
-		return
-	}
-
-	c.JSON(200, res)
-}
-
-func API_HandleQuery(query string, c *gin.Context) {
-	result, err := dbClient.Query(query)
-
-	if err != nil {
-		c.JSON(400, NewError(err))
-		return
-	}
-
-	q := c.Request.URL.Query()
-
-	if len(q["format"]) > 0 {
-		if q["format"][0] == "csv" {
-			c.Data(200, "text/csv", result.CSV())
-			return
-		}
-	}
-
-	c.JSON(200, result)
-}
-
-func API_ServeAsset(c *gin.Context) {
-	file := fmt.Sprintf(
-		"static/%s/%s",
-		c.Params.ByName("type"),
-		c.Params.ByName("name"),
-	)
-
-	data, err := Asset(file)
-
-	if err != nil {
-		c.String(400, err.Error())
-		return
-	}
-
-	if len(data) == 0 {
-		c.String(404, "Asset is empty")
-		return
-	}
-
-	c.Data(200, assetContentType(file), data)
-}

client.go

@@ -1,193 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"encoding/csv"
-	"fmt"
-	"github.com/jmoiron/sqlx"
-	"reflect"
-)
-
-const (
-	PG_INFO          = "SELECT version(), user, current_database(), inet_client_addr(), inet_client_port(), inet_server_addr(), inet_server_port()"
-	PG_DATABASES     = "SELECT datname FROM pg_database WHERE datistemplate = false ORDER BY datname ASC;"
-	PG_TABLES        = "SELECT table_name FROM information_schema.tables WHERE table_schema = 'public' ORDER BY table_schema,table_name;"
-	PG_TABLE_SCHEMA  = "SELECT column_name, data_type, is_nullable, character_maximum_length, character_set_catalog, column_default FROM information_schema.columns where table_name = '%s';"
-	PG_TABLE_INDEXES = "SELECT indexname, indexdef FROM pg_indexes WHERE tablename = '%s';"
-	PG_TABLE_INFO    = "SELECT pg_size_pretty(pg_table_size('%s')) AS data_size, pg_size_pretty(pg_indexes_size('%s')) AS index_size, pg_size_pretty(pg_total_relation_size('%s')) AS total_size, (SELECT COUNT(*) FROM %s) AS rows_count"
-)
-
-type Client struct {
-	db      *sqlx.DB
-	history []string
-}
-
-type Result struct {
-	Columns []string        `json:"columns"`
-	Rows    [][]interface{} `json:"rows"`
-}
-
-func NewError(err error) Error {
-	return Error{err.Error()}
-}
-
-func NewClient() (*Client, error) {
-	db, err := sqlx.Open("postgres", getConnectionString())
-
-	if err != nil {
-		return nil, err
-	}
-
-	return &Client{db: db}, nil
-}
-
-func (client *Client) Test() error {
-	return client.db.Ping()
-}
-
-func (client *Client) recordQuery(query string) {
-	client.history = append(client.history, query)
-}
-
-func (client *Client) Info() (*Result, error) {
-	return client.Query(PG_INFO)
-}
-
-func (client *Client) Databases() ([]string, error) {
-	res, err := client.Query(PG_DATABASES)
-
-	if err != nil {
-		return nil, err
-	}
-
-	var tables []string
-
-	for _, row := range res.Rows {
-		tables = append(tables, row[0].(string))
-	}
-
-	return tables, nil
-}
-
-func (client *Client) Tables() ([]string, error) {
-	res, err := client.Query(PG_TABLES)
-
-	if err != nil {
-		return nil, err
-	}
-
-	var tables []string
-
-	for _, row := range res.Rows {
-		tables = append(tables, row[0].(string))
-	}
-
-	return tables, nil
-}
-
-func (client *Client) Table(table string) (*Result, error) {
-	return client.Query(fmt.Sprintf(PG_TABLE_SCHEMA, table))
-}
-
-func (client *Client) TableInfo(table string) (*Result, error) {
-	return client.Query(fmt.Sprintf(PG_TABLE_INFO, table, table, table, table))
-}
-
-func (client *Client) TableIndexes(table string) (*Result, error) {
-	res, err := client.Query(fmt.Sprintf(PG_TABLE_INDEXES, table))
-
-	if err != nil {
-		return nil, err
-	}
-
-	return res, err
-}
-
-func (client *Client) Query(query string) (*Result, error) {
-	rows, err := client.db.Queryx(query)
-
-	client.recordQuery(query)
-
-	if err != nil {
-		return nil, err
-	}
-
-	defer rows.Close()
-
-	cols, err := rows.Columns()
-
-	if err != nil {
-		return nil, err
-	}
-
-	result := Result{
-		Columns: cols,
-	}
-
-	for rows.Next() {
-		obj, err := rows.SliceScan()
-
-		for i, item := range obj {
-			if item == nil {
-				obj[i] = nil
-			} else {
-				t := reflect.TypeOf(item).Kind().String()
-
-				if t == "slice" {
-					obj[i] = string(item.([]byte))
-				}
-			}
-		}
-
-		if err == nil {
-			result.Rows = append(result.Rows, obj)
-		}
-	}
-
-	return &result, nil
-}
-
-func (res *Result) Format() []map[string]interface{} {
-	var items []map[string]interface{}
-
-	for _, row := range res.Rows {
-		item := make(map[string]interface{})
-
-		for i, c := range res.Columns {
-			item[c] = row[i]
-		}
-
-		items = append(items, item)
-	}
-
-	return items
-}
-
-func (res *Result) CSV() []byte {
-	buff := &bytes.Buffer{}
-	writer := csv.NewWriter(buff)
-
-	writer.Write(res.Columns)
-
-	for _, row := range res.Rows {
-		record := make([]string, len(res.Columns))
-
-		for i, item := range row {
-			if item != nil {
-				record[i] = fmt.Sprintf("%v", item)
-			} else {
-				record[i] = ""
-			}
-		}
-
-		err := writer.Write(record)
-
-		if err != nil {
-			fmt.Println(err)
-			break
-		}
-	}
-
-	writer.Flush()
-	return buff.Bytes()
-}

config/examples/connect_backend_go/README.md

@@ -0,0 +1,17 @@
+# connect-backend-go
+
+Example Golang backend for Pgweb Connect feature
+
+## Usage
+
+Run the backend:
+
+```bash
+go run main.go
+```
+
+Configure pgweb:
+
+```bash
+pgweb --sessions --connect-backend=http://localhost:4567 --connect-token=test
+```

config/examples/connect_backend_go/main.go

@@ -0,0 +1,52 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+)
+
+type BackendRequest struct {
+	Resource string            `json:"resource"`
+	Token    string            `json:"token"`
+	Headers  map[string]string `json:"headers"`
+}
+
+type BackendResponse struct {
+	DatabaseURL string `json:"database_url"`
+}
+
+func main() {
+	resources := map[string]string{
+		"id1": "postgres://localhost:5432/db1?sslmode=disable",
+		"id2": "postgres://localhost:5432/db2?sslmode=disable",
+		"id3": "postgres://localhost:5432/db3?sslmode=disable",
+	}
+
+	http.HandleFunc("/", func(rw http.ResponseWriter, req *http.Request) {
+		backendReq := BackendRequest{}
+
+		if err := json.NewDecoder(req.Body).Decode(&backendReq); err != nil {
+			rw.WriteHeader(400)
+			fmt.Fprintf(rw, "error while parsing request: %v", err)
+			return
+		}
+
+		res, ok := resources[backendReq.Resource]
+		if !ok {
+			rw.WriteHeader(404)
+			return
+		}
+
+		resp := BackendResponse{
+			DatabaseURL: res,
+		}
+
+		json.NewEncoder(rw).Encode(resp)
+	})
+
+	if err := http.ListenAndServe(":4567", nil); err != nil {
+		log.Fatal(err)
+	}
+}

config/examples/connect_backend_ruby/Gemfile

@@ -0,0 +1,6 @@
+source "https://rubygems.org"
+
+gem "sinatra"
+gem "json"
+gem "puma"
+gem "rackup"

config/examples/connect_backend_ruby/Gemfile.lock

@@ -0,0 +1,44 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    base64 (0.3.0)
+    json (2.12.2)
+    logger (1.7.0)
+    mustermann (3.0.3)
+      ruby2_keywords (~> 0.0.1)
+    nio4r (2.7.4)
+    puma (6.6.0)
+      nio4r (~> 2.0)
+    rack (3.1.16)
+    rack-protection (4.1.1)
+      base64 (>= 0.1.0)
+      logger (>= 1.6.0)
+      rack (>= 3.0.0, < 4)
+    rack-session (2.1.1)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0)
+    rackup (2.2.1)
+      rack (>= 3)
+    ruby2_keywords (0.0.5)
+    sinatra (4.1.1)
+      logger (>= 1.6.0)
+      mustermann (~> 3.0)
+      rack (>= 3.0.0, < 4)
+      rack-protection (= 4.1.1)
+      rack-session (>= 2.0.0, < 3)
+      tilt (~> 2.0)
+    tilt (2.6.0)
+
+PLATFORMS
+  arm64-darwin-21
+  arm64-darwin-24
+  x86_64-linux
+
+DEPENDENCIES
+  json
+  puma
+  rackup
+  sinatra
+
+BUNDLED WITH
+   2.3.9

config/examples/connect_backend_ruby/README.md

@@ -0,0 +1,18 @@
+# connect-backend-ruby
+
+Example Ruby backend for Pgweb Connect feature
+
+## Usage
+
+Install and run the backend:
+
+```bash
+bundle install
+ruby main.rb
+```
+
+Configure pgweb:
+
+```bash
+pgweb --sessions --connect-backend=http://localhost:4567 --connect-token=test
+```

config/examples/connect_backend_ruby/config.ru

@@ -0,0 +1,4 @@
+require "bundler/setup"
+require "./main"
+
+run Sinatra::Application

config/examples/connect_backend_ruby/main.rb

@@ -0,0 +1,41 @@
+require "bundler/setup"
+require "sinatra"
+
+# Authentication token
+$token = "test"
+
+# List of all available resources
+$resources = {
+  "id1" => "postgres://localhost:5432/db1?sslmode=disable",
+  "id2" => "postgres://localhost:5432/db2?sslmode=disable",
+  "id3" => "postgres://localhost:5432/db3?sslmode=disable"
+}
+
+helpers do
+  def error(code, message)
+    halt(code, JSON.dump(error: message))
+  end
+end
+
+before do
+  content_type :json
+end
+
+post "/" do
+  req = JSON.load(request.body) || {}
+
+  unless req["resource"]
+    halt 404, "Resource ID required"
+  end
+
+  # Check the resource
+  resource = $resources[req["resource"]]
+  if !resource
+    halt 404, "Invalid resource ID"
+  end
+
+  # Return connection credentials
+  JSON.dump(
+    database_url: resource
+  )
+end

config/pgweb.freebsd_rc

@@ -0,0 +1,50 @@
+#!/bin/sh
+#
+# $FreeBSD: $
+#
+# PROVIDE: pgweb
+# REQUIRE: NETWORKING
+# KEYWORD:
+#
+# Add the following lines to /etc/rc.conf to enable pgweb:
+# pgweb_enable="YES"
+#
+# pgweb_enable (bool):              Set to YES to enable pgweb
+#                                       Default: NO
+# pgweb_bind (str):               HTTP server host
+#                                       Default: localhost
+# pgweb_listen (str):   HTTP server listen port
+#                                       Default: 8081
+# pgweb_user (str):         pgweb daemon user
+#                                       Default: www
+# pgweb_group (str):                pgweb daemon group
+#                                       Default: www
+
+. /etc/rc.subr
+
+name="pgweb"
+rcvar="pgweb_enable"
+load_rc_config $name
+
+: ${pgweb_user:="www"}
+: ${pgweb_group:="www"}
+: ${pgweb_enable:="NO"}
+: ${pgweb_bind:="localhost"}
+: ${pgweb_flags=""}
+: ${pgweb_facility:="daemon"}
+: ${pgweb_priority:="debug"}
+: ${pgweb_listen:="8081"}
+
+procname="/usr/local/bin/${name}"
+pidfile="/var/run/${name}.pid"
+start_precmd="${name}_precmd"
+command=/usr/sbin/daemon
+command_args="-S -l ${pgweb_facility} -s ${pgweb_priority} -T ${name} -t ${name} -p ${pidfile} \
+        ${procname} --bind=${pgweb_bind} --listen=${pgweb_listen} ${pgweb_flags}"
+
+pgweb_precmd()
+{
+        install -o ${pgweb_user} /dev/null ${pidfile}
+}
+
+run_rc_command "$1"

config/pgweb.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=pgweb - Cross-platform client for PostgreSQL databases
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/pgweb --bind=0.0.0.0 --listen=8081
+Restart=on-abort
+
+[Install]
+WantedBy=multi-user.target

config/pgweb_initd.conf

@@ -0,0 +1,67 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:          pgweb
+# Required-Start:    $remote_fs $syslog
+# Required-Stop:     $remote_fs $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Start daemon at boot time
+# Description:       Enable service provided by daemon.
+### END INIT INFO
+
+# Installation instructions (originally written for Debian)
+#
+# Save this script into /etc/init.d/pgweb file, make it executable,
+# and install it into the boot sequence:
+#
+#    chmod 755 /etc/init.d/pgweb
+#    update-rc.d pgweb defaults
+# 
+# This script assumes that pgweb binary is located at /home/pgweb/, and that
+# there's a bookmark 'server' in /home/pgweb/.pgweb/bookmarks/.
+#
+
+NAME="pgweb"
+PIDFILE="/var/run/$NAME.pid"
+
+USER="pgweb"  # Linux system user
+SU="su $USER -s /bin/bash"
+
+TIMEOUT=5  # Time in seconds to wait postgresql to show up
+
+case "$1" in
+  start)
+    if [ -f $PIDFILE ]; then
+        echo "Already running... cat $PIDFILE"
+        exit 0
+    fi
+    
+    # Wait postgresql to show up
+    while ! test -f /var/run/postgresql/*main.pid
+    do
+        sleep 1
+        TIMEOUT=`expr $TIMEOUT - 1`
+        if test $TIMEOUT -eq 0; then
+            exit 1
+        fi
+    done
+    
+    # Ready to start pgweb
+    PID=`$SU -c '/home/pgweb/pgweb -s -b server >/dev/null & echo $!'`  # Note! Logs are lost.
+    if [ -z $PID ]; then
+        exit 1
+    else
+        echo $PID > $PIDFILE
+    fi
+    ;;
+  stop)
+    PID=`cat $PIDFILE`
+    kill $PID && rm $PIDFILE
+    ;;
+  *)
+    echo "Usage: /etc/init.d/$NAME {start|stop}"
+    exit 1
+    ;;
+esac
+
+exit 0

config/pgweb_upstart.conf

@@ -0,0 +1,10 @@
+description "PgWeb as a Service for Ubuntu 14.04 With Upstart"
+
+start on runlevel [2345]
+stop on runlevel [!2345]
+
+respawn
+setuid youruser
+setgid www-data
+
+exec /usr/bin/pgweb --bind=0.0.0.0 --listen=8081

data/bookmark.toml

@@ -0,0 +1,5 @@
+host = "localhost"
+port = 5432
+user = "postgres"
+database = "mydatabase"
+ssl = "disable"

data/bookmark_invalid_ssl.toml

@@ -0,0 +1,5 @@
+host = "localhost"
+port = 5432
+user = "postgres"
+database = "mydatabase"
+ssl = "disabled"

data/bookmark_url.toml

@@ -0,0 +1 @@
+url = "postgres://username:password@host:port/database?sslmode=disable"

data/bookmark_with_ssh.toml

@@ -0,0 +1,12 @@
+host = "localhost"
+port = 5432
+user = "postgres"
+database = "mydatabase"
+ssl = "disable"
+
+[SSH]
+host = "ssh-host"
+user = "ssh-user"
+password = "ssh-password"
+key = "/path/to/key-file"
+keypassword = "key-file-password"

data/invalid.toml

@@ -0,0 +1 @@
+invalid encoding

data/lc_example1.sql

@@ -0,0 +1,2 @@
+-- pgweb: host="localhost"
+select 'foo'

data/lc_example2.sql

@@ -0,0 +1,5 @@
+-- pgweb: host="localhost"
+-- some comment
+-- pgweb: user="foo"
+
+select 'foo'

data/lc_invalid_meta.sql

@@ -0,0 +1,2 @@
+-- pgweb: host="localhost" mode="foo"
+select 'foo'

data/lc_no_meta.sql

@@ -0,0 +1 @@
+select 'foo'

data/passfile

@@ -0,0 +1,2 @@
+localhost:5432:dbname:username:password
+127.0.0.1:5432:*:*:password2

data/roach.sql

@@ -0,0 +1,43 @@
+DROP DATABASE IF EXISTS "roach";
+CREATE DATABASE "roach";
+USE "roach";
+
+CREATE TABLE product_information (
+  product_id           INT PRIMARY KEY NOT NULL,
+  product_name         STRING(50) UNIQUE NOT NULL,
+  product_description  STRING(2000),
+  category_id          STRING(1) NOT NULL CHECK (category_id IN ('A','B','C')),
+  weight_class         INT,
+  warranty_period      INT CONSTRAINT valid_warranty CHECK (warranty_period BETWEEN 0 AND 24),
+  supplier_id          INT,
+  product_status       STRING(20),
+  list_price           DECIMAL(8,2),
+  min_price            DECIMAL(8,2),
+  catalog_url          STRING(50) UNIQUE,
+  date_added           DATE DEFAULT CURRENT_DATE(),
+  misc                 JSONB,     
+  CONSTRAINT price_check CHECK (list_price >= min_price),
+  INDEX date_added_idx (date_added),
+  INDEX supp_id_prod_status_idx (supplier_id, product_status),
+  INVERTED INDEX details (misc)
+);
+
+INSERT INTO product_information VALUES
+  (1, 'Product A', 'Text', 'A', NULL, 1),
+  (2, 'Product B', 'Text', 'B', NULL, 2),
+  (3, 'Product C', 'Text', 'C', NULL, 3);
+
+CREATE TABLE customers (
+  id INT PRIMARY KEY,
+  name STRING
+);
+
+CREATE TABLE orders (
+  id INT PRIMARY KEY,
+  customer_id INT REFERENCES customers(id) ON DELETE CASCADE
+);
+
+INSERT INTO customers VALUES (1, 'Lauren');
+INSERT INTO orders VALUES (1,1);
+DELETE FROM customers WHERE id = 1;
+SELECT * FROM orders;

docker-compose-pg.yml

@@ -0,0 +1,61 @@
+---
+x-base: &base
+  environment: &env
+    POSTGRES_DB: pgweb
+    POSTGRES_PASSWORD: pgweb
+    POSTGRES_USER: pgweb
+  healthcheck:
+    test: pg_isready -U pgweb -h 127.0.0.1
+    interval: 5s
+
+services:
+  postgres18:
+    <<: *base
+    image: postgres:18
+    ports:
+      - 5433:5432
+  postgres17:
+    <<: *base
+    image: postgres:17
+    ports:
+      - 5433:5432
+  postgres16:
+    <<: *base
+    image: postgres:16
+    ports:
+      - 5433:5432
+  postgres15:
+    <<: *base
+    image: postgres:15
+    ports:
+      - 5433:5432
+  postgres14:
+    <<: *base
+    image: postgres:14
+    ports:
+      - 5434:5432
+  postgres13:
+    <<: *base
+    image: postgres:13
+    ports:
+      - 5435:5432
+  postgres12:
+    <<: *base
+    image: postgres:12
+    ports:
+      - 5436:5432
+  postgres11:
+    <<: *base
+    image: postgres:11
+    ports:
+      - 5437:5432
+  postgres10:
+    <<: *base
+    image: postgres:10
+    ports:
+      - 5438:5432
+  postgres9.6:
+    <<: *base
+    image: postgres:9.6
+    ports:
+      - 5439:5432

docker-compose.yml

@@ -0,0 +1,43 @@
+---
+services:
+  postgres:
+    container_name: pgweb-postgres
+    image: postgres:15
+    ports:
+      - 5433:5432
+    volumes:
+      - data:/var/lib/postgresql/data
+    environment:
+      POSTGRES_DB: pgweb
+      POSTGRES_PASSWORD: pgweb
+      POSTGRES_USER: pgweb
+    healthcheck:
+      test: pg_isready -U pgweb -h 127.0.0.1
+      interval: 5s
+    networks:
+      - pgweb
+
+  pgweb:
+    container_name: pgweb
+    image: sosedoff/pgweb:latest
+    build: .
+    environment:
+      PGWEB_DATABASE_URL: postgres://pgweb:pgweb@pgweb-postgres:5432/pgweb?sslmode=disable
+    ports:
+      - 8081:8081
+    networks:
+      - pgweb
+    depends_on:
+      postgres:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "nc", "-vz", "127.0.0.1", "8081"]
+      interval: 5s
+
+volumes:
+  data:
+    name: pgweb_postgres
+
+networks:
+  pgweb:
+    name: pgweb

fly.toml

@@ -0,0 +1,37 @@
+app = "pgweb-demo"
+kill_signal = "SIGINT"
+kill_timeout = 5
+
+[processes]
+  web = "pgweb --sessions --bind=0.0.0.0 --metrics --idle-timeout=30"
+
+[[services]]
+  http_checks = []
+  internal_port = 8081
+  processes = ["web"]
+  protocol = "tcp"
+  script_checks = []
+
+  [services.concurrency]
+    hard_limit = 25
+    soft_limit = 20
+    type = "connections"
+
+  [[services.ports]]
+    force_https = true
+    handlers = ["http"]
+    port = 80
+
+  [[services.ports]]
+    handlers = ["tls", "http"]
+    port = 443
+
+  [[services.tcp_checks]]
+    grace_period = "1s"
+    interval = "15s"
+    restart_limit = 0
+    timeout = "2s"
+
+[metrics]
+  port = 8081
+  path = "/metrics"

go.mod

@@ -0,0 +1,64 @@
+module github.com/sosedoff/pgweb
+
+go 1.25
+
+toolchain go1.25.4
+
+require (
+	github.com/BurntSushi/toml v1.1.0
+	github.com/ScaleFT/sshkeys v0.0.0-20200327173127-6142f742bca5
+	github.com/gin-gonic/gin v1.11.0
+	github.com/jackc/pgpassfile v1.0.0
+	github.com/jessevdk/go-flags v1.5.0
+	github.com/jmoiron/sqlx v1.3.5
+	github.com/lib/pq v1.10.5
+	github.com/mitchellh/go-homedir v1.1.0
+	github.com/mr-tron/base58 v1.2.0
+	github.com/prometheus/client_golang v1.19.1
+	github.com/sirupsen/logrus v1.9.1
+	github.com/stretchr/testify v1.11.1
+	github.com/tuvistavie/securerandom v0.0.0-20140719024926-15512123a948
+	go.balki.me/anyhttp v0.5.0
+	golang.org/x/crypto v0.46.0
+)
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/bytedance/gopkg v0.1.3 // indirect
+	github.com/bytedance/sonic v1.14.2 // indirect
+	github.com/bytedance/sonic/loader v0.4.0 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/cloudwego/base64x v0.1.6 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/dchest/bcrypt_pbkdf v0.0.0-20150205184540-83f37f9c154a // indirect
+	github.com/gabriel-vasile/mimetype v1.4.12 // indirect
+	github.com/gin-contrib/sse v1.1.0 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/go-playground/validator/v10 v10.30.1 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/goccy/go-yaml v1.19.1 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_model v0.5.0 // indirect
+	github.com/prometheus/common v0.48.0 // indirect
+	github.com/prometheus/procfs v0.12.0 // indirect
+	github.com/quic-go/qpack v0.6.0 // indirect
+	github.com/quic-go/quic-go v0.58.0 // indirect
+	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
+	github.com/ugorji/go/codec v1.3.1 // indirect
+	go.uber.org/mock v0.6.0 // indirect
+	golang.org/x/arch v0.23.0 // indirect
+	golang.org/x/net v0.48.0 // indirect
+	golang.org/x/sys v0.39.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)

go.sum

@@ -0,0 +1,151 @@
+github.com/BurntSushi/toml v1.1.0 h1:ksErzDEI1khOiGPgpwuI7x2ebx/uXQNw7xJpn9Eq1+I=
+github.com/BurntSushi/toml v1.1.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+github.com/ScaleFT/sshkeys v0.0.0-20200327173127-6142f742bca5 h1:VauE2GcJNZFun2Och6tIT2zJZK1v6jxALQDA9BIji/E=
+github.com/ScaleFT/sshkeys v0.0.0-20200327173127-6142f742bca5/go.mod h1:gxOHeajFfvGQh/fxlC8oOKBe23xnnJTif00IFFbiT+o=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bytedance/gopkg v0.1.3 h1:TPBSwH8RsouGCBcMBktLt1AymVo2TVsBVCY4b6TnZ/M=
+github.com/bytedance/gopkg v0.1.3/go.mod h1:576VvJ+eJgyCzdjS+c4+77QF3p7ubbtiKARP3TxducM=
+github.com/bytedance/sonic v1.14.2 h1:k1twIoe97C1DtYUo+fZQy865IuHia4PR5RPiuGPPIIE=
+github.com/bytedance/sonic v1.14.2/go.mod h1:T80iDELeHiHKSc0C9tubFygiuXoGzrkjKzX2quAx980=
+github.com/bytedance/sonic/loader v0.4.0 h1:olZ7lEqcxtZygCK9EKYKADnpQoYkRQxaeY2NYzevs+o=
+github.com/bytedance/sonic/loader v0.4.0/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
+github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cloudwego/base64x v0.1.6 h1:t11wG9AECkCDk5fMSoxmufanudBtJ+/HemLstXDLI2M=
+github.com/cloudwego/base64x v0.1.6/go.mod h1:OFcloc187FXDaYHvrNIjxSe8ncn0OOM8gEHfghB2IPU=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dchest/bcrypt_pbkdf v0.0.0-20150205184540-83f37f9c154a h1:saTgr5tMLFnmy/yg3qDTft4rE5DY2uJ/cCxCe3q0XTU=
+github.com/dchest/bcrypt_pbkdf v0.0.0-20150205184540-83f37f9c154a/go.mod h1:Bw9BbhOJVNR+t0jCqx2GC6zv0TGBsShs56Y3gfSCvl0=
+github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw=
+github.com/gabriel-vasile/mimetype v1.4.12/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
+github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
+github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
+github.com/gin-gonic/gin v1.11.0 h1:OW/6PLjyusp2PPXtyxKHU0RbX6I/l28FTdDlae5ueWk=
+github.com/gin-gonic/gin v1.11.0/go.mod h1:+iq/FyxlGzII0KHiBGjuNn4UNENUlKbGlNmc+W50Dls=
+github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
+github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
+github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
+github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
+github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
+github.com/go-playground/validator/v10 v10.30.1 h1:f3zDSN/zOma+w6+1Wswgd9fLkdwy06ntQJp0BBvFG0w=
+github.com/go-playground/validator/v10 v10.30.1/go.mod h1:oSuBIQzuJxL//3MelwSLD5hc2Tu889bF0Idm9Dg26cM=
+github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
+github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
+github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/goccy/go-yaml v1.19.1 h1:3rG3+v8pkhRqoQ/88NYNMHYVGYztCOCIZ7UQhu7H+NE=
+github.com/goccy/go-yaml v1.19.1/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jessevdk/go-flags v1.5.0 h1:1jKYvbxEjfUl0fmqTCOfonvskHHXMjBySTLW4y9LFvc=
+github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4=
+github.com/jmoiron/sqlx v1.3.5 h1:vFFPA71p1o5gAeqtEAwLU4dnX2napprKtHr7PYIcN3g=
+github.com/jmoiron/sqlx v1.3.5/go.mod h1:nRVWtLre0KfCLJvgxzCsLVMogSvQ1zNJtpYr2Ccp0mQ=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
+github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
+github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.10.5 h1:J+gdV2cUmX7ZqL2B0lFcW0m+egaHC2V3lpO8nWxyYiQ=
+github.com/lib/pq v1.10.5/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-sqlite3 v1.14.6 h1:dNPt6NO46WmLVt2DLNpwczCmdV5boIZ6g/tlDrlRUbg=
+github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/mr-tron/base58 v1.2.0 h1:T/HDJBh4ZCPbU39/+c3rRvE0uKBQlU27+QI8LJ4t64o=
+github.com/mr-tron/base58 v1.2.0/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.19.1 h1:wZWJDwK+NameRJuPGDhlnFgx8e8HN3XHQeLaYJFJBOE=
+github.com/prometheus/client_golang v1.19.1/go.mod h1:mP78NwGzrVks5S2H6ab8+ZZGJLZUq1hoULYBAYBw1Ho=
+github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw=
+github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
+github.com/prometheus/common v0.48.0 h1:QO8U2CdOzSn1BBsmXJXduaaW+dY/5QLjfB8svtSzKKE=
+github.com/prometheus/common v0.48.0/go.mod h1:0/KsvlIEfPQCQ5I2iNSAWKPZziNCvRs5EC6ILDTlAPc=
+github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
+github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
+github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
+github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
+github.com/quic-go/quic-go v0.58.0 h1:ggY2pvZaVdB9EyojxL1p+5mptkuHyX5MOSv4dgWF4Ug=
+github.com/quic-go/quic-go v0.58.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
+github.com/sirupsen/logrus v1.9.1 h1:Ou41VVR3nMWWmTiEUnj0OlsgOSCUFgsPAOl6jRIcVtQ=
+github.com/sirupsen/logrus v1.9.1/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/tuvistavie/securerandom v0.0.0-20140719024926-15512123a948 h1:yL0l/u242MzDP6D0B5vGC+wxm5WRY+alQZy+dJk3bFI=
+github.com/tuvistavie/securerandom v0.0.0-20140719024926-15512123a948/go.mod h1:a06d/M1pxWi51qiSrfGMHaEydtuXT06nha8N2aNQuXk=
+github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
+github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
+github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
+github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
+go.balki.me/anyhttp v0.5.0 h1:uys0oRciBpZfwtxXAevScKy6amIQBXyDrcV0EtGF5zo=
+go.balki.me/anyhttp v0.5.0/go.mod h1:JhfekOIjgVODoVqUCficjpIgmB3wwlB7jhN0eN2EZ/s=
+go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
+go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
+golang.org/x/arch v0.23.0 h1:lKF64A2jF6Zd8L0knGltUnegD62JMFBiCPBmQpToHhg=
+golang.org/x/arch v0.23.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
+golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200219091948-cb0a6d8edb6c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
+golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
+golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
+golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

main.go

@@ -1,136 +1,9 @@
 package main
 
 import (
-	"fmt"
-	"github.com/gin-gonic/gin"
-	"github.com/jessevdk/go-flags"
-	_ "github.com/lib/pq"
-	"os"
-	"os/exec"
-	"os/signal"
+	"github.com/sosedoff/pgweb/pkg/cli"
 )
 
-const VERSION = "0.2.0"
-
-var options struct {
-	Version  bool   `short:"v" description:"Print version"`
-	Debug    bool   `short:"d" description:"Enable debugging mode" default:"false"`
-	Url      string `long:"url" description:"Database connection string"`
-	Host     string `long:"host" description:"Server hostname or IP" default:"localhost"`
-	Port     int    `long:"port" description:"Server port" default:"5432"`
-	User     string `long:"user" description:"Database user" default:"postgres"`
-	DbName   string `long:"db" description:"Database name" default:"postgres"`
-	Ssl      string `long:"ssl" description:"SSL option" default:"disable"`
-	HttpPort uint   `long:"listen" description:"HTTP server listen port" default:"8080"`
-}
-
-var dbClient *Client
-
-func exitWithMessage(message string) {
-	fmt.Println("Error:", message)
-	os.Exit(1)
-}
-
-func getConnectionString() string {
-	if options.Url != "" {
-		return options.Url
-	}
-
-	return fmt.Sprintf(
-		"host=%s port=%d user=%s dbname=%s sslmode=disable",
-		options.Host, options.Port,
-		options.User, options.DbName,
-	)
-}
-
-func initClient() {
-	client, err := NewClient()
-	if err != nil {
-		exitWithMessage(err.Error())
-	}
-
-	fmt.Println("Connecting to server...")
-	err = client.Test()
-	if err != nil {
-		exitWithMessage(err.Error())
-	}
-
-	fmt.Println("Checking tables...")
-	tables, err := client.Tables()
-	if err != nil {
-		exitWithMessage(err.Error())
-	}
-
-	if len(tables) == 0 {
-		exitWithMessage("Database does not have any tables")
-	}
-
-	dbClient = client
-}
-
-func initOptions() {
-	_, err := flags.ParseArgs(&options, os.Args)
-
-	if err != nil {
-		os.Exit(1)
-	}
-
-	if options.Version {
-		fmt.Printf("pgweb v%s\n", VERSION)
-		os.Exit(1)
-	}
-}
-
-func startServer() {
-	router := gin.Default()
-
-	router.GET("/", API_Home)
-	router.GET("/databases", API_GetDatabases)
-	router.GET("/info", API_Info)
-	router.GET("/tables", API_GetTables)
-	router.GET("/tables/:table", API_GetTable)
-	router.GET("/tables/:table/info", API_GetTableInfo)
-	router.GET("/tables/:table/indexes", API_TableIndexes)
-	router.GET("/query", API_RunQuery)
-	router.POST("/query", API_RunQuery)
-	router.GET("/explain", API_ExplainQuery)
-	router.POST("/explain", API_ExplainQuery)
-	router.GET("/history", API_History)
-	router.GET("/static/:type/:name", API_ServeAsset)
-
-	fmt.Println("Starting server...")
-	go router.Run(fmt.Sprintf(":%v", options.HttpPort))
-}
-
-func handleSignals() {
-	c := make(chan os.Signal, 1)
-	signal.Notify(c, os.Interrupt, os.Kill)
-	<-c
-}
-
-func openPage() {
-	url := fmt.Sprintf("http://localhost:%v", options.HttpPort)
-	fmt.Println("To view database open", url, "in browser")
-
-	_, err := exec.Command("which", "open").Output()
-	if err != nil {
-		return
-	}
-
-	exec.Command("open", url).Output()
-}
-
 func main() {
-	initOptions()
-	initClient()
-
-	defer dbClient.db.Close()
-
-	if !options.Debug {
-		gin.SetMode("release")
-	}
-
-	startServer()
-	openPage()
-	handleSignals()
+	cli.Run()
 }

pkg/api/api.go

@@ -0,0 +1,734 @@
+package api
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+	"net/http"
+	neturl "net/url"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/tuvistavie/securerandom"
+
+	"github.com/sosedoff/pgweb/pkg/bookmarks"
+	"github.com/sosedoff/pgweb/pkg/client"
+	"github.com/sosedoff/pgweb/pkg/command"
+	"github.com/sosedoff/pgweb/pkg/connect"
+	"github.com/sosedoff/pgweb/pkg/connection"
+	"github.com/sosedoff/pgweb/pkg/metrics"
+	"github.com/sosedoff/pgweb/pkg/queries"
+	"github.com/sosedoff/pgweb/pkg/shared"
+	"github.com/sosedoff/pgweb/static"
+)
+
+var (
+	// DbClient represents the active database connection in a single-session mode
+	DbClient *client.Client
+
+	// DbSessions represents the mapping for client connections
+	DbSessions *SessionManager
+
+	// QueryStore reads the SQL queries stores in the home directory
+	QueryStore *queries.Store
+)
+
+// DB returns a database connection from the client context
+func DB(c *gin.Context) *client.Client {
+	if command.Opts.Sessions {
+		return DbSessions.Get(getSessionId(c.Request))
+	}
+	return DbClient
+}
+
+// setClient sets the database client connection for the sessions
+func setClient(c *gin.Context, newClient *client.Client) error {
+	currentClient := DB(c)
+	if currentClient != nil {
+		currentClient.Close()
+	}
+
+	if !command.Opts.Sessions {
+		DbClient = newClient
+		return nil
+	}
+
+	sid := getSessionId(c.Request)
+	if sid == "" {
+		return errSessionRequired
+	}
+
+	DbSessions.Add(sid, newClient)
+	return nil
+}
+
+// GetHome renders the home page
+func GetHome(prefix string) http.Handler {
+	if prefix != "" {
+		prefix = "/" + prefix
+	}
+	return http.StripPrefix(prefix, static.GetHandler())
+}
+
+func GetAssets(prefix string) http.Handler {
+	if prefix != "" {
+		prefix = "/" + prefix + "static/"
+	} else {
+		prefix = "/static/"
+	}
+	return http.StripPrefix(prefix, static.GetHandler())
+}
+
+// GetSessions renders the number of active sessions
+func GetSessions(c *gin.Context) {
+	// In debug mode endpoint will return a lot of sensitive information
+	// like full database connection string and all query history.
+	if command.Opts.Debug {
+		successResponse(c, DbSessions.Sessions())
+		return
+	}
+	successResponse(c, gin.H{"sessions": DbSessions.Len()})
+}
+
+// ConnectWithBackend creates a new connection based on backend resource
+func ConnectWithBackend(c *gin.Context) {
+	backend := connect.NewBackend(command.Opts.ConnectBackend, command.Opts.ConnectToken)
+	backend.SetLogger(logger)
+
+	if command.Opts.ConnectHeaders != "" {
+		backend.SetPassHeaders(strings.Split(command.Opts.ConnectHeaders, ","))
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*10)
+	defer cancel()
+
+	// Fetch connection credentials
+	cred, err := backend.FetchCredential(ctx, c.Param("resource"), c.Request.Header)
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	// Make the new session
+	sid, err := securerandom.Uuid()
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+	c.Request.Header.Add("x-session-id", sid)
+
+	// Connect to the database
+	cl, err := client.NewFromUrl(cred.DatabaseURL, nil)
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+	cl.External = true
+
+	// Finalize session seetup
+	_, err = cl.Info()
+	if err == nil {
+		err = setClient(c, cl)
+	}
+	if err != nil {
+		cl.Close()
+		badRequest(c, err)
+		return
+	}
+
+	redirectURI := fmt.Sprintf("/%s?session=%s", command.Opts.Prefix, sid)
+	c.Redirect(302, redirectURI)
+}
+
+// Connect creates a new client connection
+func Connect(c *gin.Context) {
+	if command.Opts.LockSession {
+		badRequest(c, errSessionLocked)
+		return
+	}
+
+	var (
+		cl  *client.Client
+		err error
+	)
+
+	if bookmarkID := c.Request.FormValue("bookmark_id"); bookmarkID != "" {
+		cl, err = ConnectWithBookmark(bookmarkID)
+	} else if command.Opts.BookmarksOnly {
+		err = errNotPermitted
+	} else {
+		cl, err = ConnectWithURL(c)
+	}
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	err = cl.Test()
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	info, err := cl.Info()
+	if err == nil {
+		err = setClient(c, cl)
+	}
+	if err != nil {
+		cl.Close()
+		badRequest(c, err)
+		return
+	}
+
+	successResponse(c, info.Format()[0])
+}
+
+func ConnectWithURL(c *gin.Context) (*client.Client, error) {
+	url := c.Request.FormValue("url")
+	if url == "" {
+		return nil, errURLRequired
+	}
+
+	url, err := connection.FormatURL(command.Options{
+		URL:      url,
+		Passfile: command.Opts.Passfile,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var sshInfo *shared.SSHInfo
+	if c.Request.FormValue("ssh") != "" {
+		sshInfo = parseSshInfo(c)
+	}
+
+	return client.NewFromUrl(url, sshInfo)
+}
+
+func ConnectWithBookmark(id string) (*client.Client, error) {
+	manager := bookmarks.NewManager(command.Opts.BookmarksDir)
+
+	bookmark, err := manager.Get(id)
+	if err != nil {
+		return nil, err
+	}
+
+	return client.NewFromBookmark(bookmark)
+}
+
+// SwitchDb perform database switch for the client connection
+func SwitchDb(c *gin.Context) {
+	if command.Opts.LockSession {
+		badRequest(c, errSessionLocked)
+		return
+	}
+
+	name := c.Request.URL.Query().Get("db")
+	if name == "" {
+		name = c.Request.FormValue("db")
+	}
+	if name == "" {
+		badRequest(c, errDatabaseNameRequired)
+		return
+	}
+
+	conn := DB(c)
+	if conn == nil {
+		badRequest(c, errNotConnected)
+		return
+	}
+
+	// Do not allow switching databases for connections from third-party backends
+	if conn.External {
+		badRequest(c, errSessionLocked)
+		return
+	}
+
+	currentURL, err := neturl.Parse(conn.ConnectionString)
+	if err != nil {
+		badRequest(c, errInvalidConnString)
+		return
+	}
+	currentURL.Path = name
+
+	cl, err := client.NewFromUrl(currentURL.String(), nil)
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	err = cl.Test()
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	info, err := cl.Info()
+	if err == nil {
+		err = setClient(c, cl)
+	}
+	if err != nil {
+		cl.Close()
+		badRequest(c, err)
+		return
+	}
+
+	conn.Close()
+
+	successResponse(c, info.Format()[0])
+}
+
+// Disconnect closes the current database connection
+func Disconnect(c *gin.Context) {
+	if command.Opts.LockSession {
+		badRequest(c, errSessionLocked)
+		return
+	}
+
+	if command.Opts.Sessions {
+		result := DbSessions.Remove(getSessionId(c.Request))
+		successResponse(c, gin.H{"success": result})
+		return
+	}
+
+	conn := DB(c)
+	if conn == nil {
+		badRequest(c, errNotConnected)
+		return
+	}
+
+	err := conn.Close()
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	DbClient = nil
+	successResponse(c, gin.H{"success": true})
+}
+
+// RunQuery executes the query
+func RunQuery(c *gin.Context) {
+	query := cleanQuery(c.Request.FormValue("query"))
+
+	if query == "" {
+		badRequest(c, errQueryRequired)
+		return
+	}
+
+	HandleQuery(query, c)
+}
+
+// ExplainQuery renders query explain plan
+func ExplainQuery(c *gin.Context) {
+	query := cleanQuery(c.Request.FormValue("query"))
+
+	if query == "" {
+		badRequest(c, errQueryRequired)
+		return
+	}
+
+	HandleQuery(fmt.Sprintf("EXPLAIN %s", query), c)
+}
+
+// AnalyzeQuery renders query explain plan and analyze profile
+func AnalyzeQuery(c *gin.Context) {
+	query := cleanQuery(c.Request.FormValue("query"))
+
+	if query == "" {
+		badRequest(c, errQueryRequired)
+		return
+	}
+
+	HandleQuery(fmt.Sprintf("EXPLAIN ANALYZE %s", query), c)
+}
+
+// GetDatabases renders a list of all databases on the server
+func GetDatabases(c *gin.Context) {
+	if command.Opts.LockSession {
+		serveResult(c, []string{}, nil)
+		return
+	}
+	conn := DB(c)
+	if conn.External {
+		errorResponse(c, 403, errNotPermitted)
+		return
+	}
+
+	names, err := DB(c).Databases()
+	serveResult(c, names, err)
+}
+
+// GetObjects renders a list of database objects
+func GetObjects(c *gin.Context) {
+	result, err := DB(c).Objects()
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+	successResponse(c, client.ObjectsFromResult(result))
+}
+
+// GetSchemas renders list of available schemas
+func GetSchemas(c *gin.Context) {
+	res, err := DB(c).Schemas()
+	serveResult(c, res, err)
+}
+
+// GetTable renders table information
+func GetTable(c *gin.Context) {
+	var (
+		res *client.Result
+		err error
+	)
+
+	db := DB(c)
+	tableName := c.Params.ByName("table")
+
+	switch c.Request.FormValue("type") {
+	case client.ObjTypeMaterializedView:
+		res, err = db.MaterializedView(tableName)
+	case client.ObjTypeFunction:
+		res, err = db.Function(tableName)
+	default:
+		res, err = db.Table(tableName)
+	}
+
+	serveResult(c, res, err)
+}
+
+// GetTableRows renders table rows
+func GetTableRows(c *gin.Context) {
+	offset, err := parseIntFormValue(c, "offset", 0)
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	limit, err := parseIntFormValue(c, "limit", 100)
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	opts := client.RowsOptions{
+		Limit:      limit,
+		Offset:     offset,
+		SortColumn: c.Request.FormValue("sort_column"),
+		SortOrder:  c.Request.FormValue("sort_order"),
+		Where:      c.Request.FormValue("where"),
+	}
+
+	res, err := DB(c).TableRows(c.Params.ByName("table"), opts)
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	countRes, err := DB(c).TableRowsCount(c.Params.ByName("table"), opts)
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	numFetch := int64(opts.Limit)
+	numOffset := int64(opts.Offset)
+	numRows := countRes.Rows[0][0].(int64)
+	numPages := numRows / numFetch
+
+	if numPages*numFetch < numRows {
+		numPages++
+	}
+
+	res.Pagination = &client.Pagination{
+		Rows:    numRows,
+		Page:    (numOffset / numFetch) + 1,
+		Pages:   numPages,
+		PerPage: numFetch,
+	}
+
+	serveResult(c, res, err)
+}
+
+// GetTableInfo renders a selected table information
+func GetTableInfo(c *gin.Context) {
+	res, err := DB(c).TableInfo(c.Params.ByName("table"))
+	if err == nil {
+		successResponse(c, res.Format()[0])
+	} else {
+		badRequest(c, err)
+	}
+}
+
+// GetHistory renders a list of recent queries
+func GetHistory(c *gin.Context) {
+	successResponse(c, DB(c).History)
+}
+
+// GetConnectionInfo renders information about current connection
+func GetConnectionInfo(c *gin.Context) {
+	conn := DB(c)
+
+	if err := conn.TestWithTimeout(5 * time.Second); err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	res, err := conn.Info()
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	info := res.Format()[0]
+	info["session_lock"] = command.Opts.LockSession
+
+	successResponse(c, info)
+}
+
+// GetServerSettings renders a list of all server settings
+func GetServerSettings(c *gin.Context) {
+	res, err := DB(c).ServerSettings()
+	serveResult(c, res, err)
+}
+
+// GetActivity renders a list of running queries
+func GetActivity(c *gin.Context) {
+	res, err := DB(c).Activity()
+	serveResult(c, res, err)
+}
+
+// GetTableIndexes renders a list of database table indexes
+func GetTableIndexes(c *gin.Context) {
+	res, err := DB(c).TableIndexes(c.Params.ByName("table"))
+	serveResult(c, res, err)
+}
+
+// GetTableConstraints renders a list of database constraints
+func GetTableConstraints(c *gin.Context) {
+	res, err := DB(c).TableConstraints(c.Params.ByName("table"))
+	serveResult(c, res, err)
+}
+
+// GetTablesStats renders data sizes and estimated rows for all tables in the database
+func GetTablesStats(c *gin.Context) {
+	db := DB(c)
+
+	connCtx, err := db.GetConnContext()
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	res, err := db.TablesStats()
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	format := getQueryParam(c, "format")
+	if format == "" {
+		format = "json"
+	}
+
+	// Save as attachment if exporting parameter is set
+	if getQueryParam(c, "export") == "true" {
+		ts := time.Now().Format(time.DateOnly)
+
+		filename := fmt.Sprintf("pgweb-dbstats-%s-%s.%s", connCtx.Database, ts, format)
+		c.Writer.Header().Set("Content-disposition", "attachment;filename="+filename)
+	}
+
+	switch format {
+	case "json":
+		c.JSON(http.StatusOK, res)
+	case "csv":
+		c.Data(http.StatusOK, "text/csv", res.CSV())
+	case "xml":
+		c.XML(200, res)
+	default:
+		badRequest(c, "invalid format")
+	}
+}
+
+// HandleQuery runs the database query
+func HandleQuery(query string, c *gin.Context) {
+	metrics.IncrementQueriesCount()
+
+	rawQuery, err := base64.StdEncoding.DecodeString(desanitize64(query))
+	if err == nil {
+		query = string(rawQuery)
+	}
+
+	result, err := DB(c).Query(query)
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	format := getQueryParam(c, "format")
+	filename := getQueryParam(c, "filename")
+
+	if filename == "" {
+		filename = fmt.Sprintf("pgweb-%v.%v", time.Now().Unix(), format)
+	}
+
+	if format != "" {
+		c.Writer.Header().Set("Content-disposition", "attachment;filename="+filename)
+	}
+
+	switch format {
+	case "csv":
+		c.Data(200, "text/csv", result.CSV())
+	case "json":
+		c.Data(200, "application/json", result.JSON())
+	case "xml":
+		c.XML(200, result)
+	default:
+		c.JSON(200, result)
+	}
+}
+
+// GetBookmarks renders the list of available bookmarks
+func GetBookmarks(c *gin.Context) {
+	manager := bookmarks.NewManager(command.Opts.BookmarksDir)
+	ids, err := manager.ListIDs()
+	serveResult(c, ids, err)
+}
+
+// GetInfo renders the pgweb system information
+func GetInfo(c *gin.Context) {
+	successResponse(c, gin.H{
+		"app": command.Info,
+		"features": gin.H{
+			"session_lock":   command.Opts.LockSession,
+			"query_timeout":  command.Opts.QueryTimeout,
+			"local_queries":  QueryStore != nil,
+			"bookmarks_only": command.Opts.BookmarksOnly,
+		},
+	})
+}
+
+// DataExport performs database table export
+func DataExport(c *gin.Context) {
+	db := DB(c)
+
+	info, err := db.Info()
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	dump := client.Dump{
+		Table: strings.TrimSpace(c.Request.FormValue("table")),
+	}
+
+	// Perform validation of pg_dump command availability and compatibility.
+	// Must be done before the actual command is executed to display errors.
+	if err := dump.Validate(db.ServerVersion()); err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	formattedInfo := info.Format()[0]
+	filename := formattedInfo["current_database"].(string)
+	if dump.Table != "" {
+		filename = filename + "_" + dump.Table
+	}
+
+	filename = sanitizeFilename(filename)
+	filename = fmt.Sprintf("%s_%s", filename, time.Now().Format("20060102_150405"))
+
+	c.Header(
+		"Content-Disposition",
+		fmt.Sprintf(`attachment; filename="%s.sql.gz"`, filename),
+	)
+
+	err = dump.Export(c.Request.Context(), db.ConnectionString, c.Writer)
+	if err != nil {
+		logger.WithError(err).Error("pg_dump command failed")
+		badRequest(c, err)
+	}
+}
+
+// GetFunction renders function information
+func GetFunction(c *gin.Context) {
+	res, err := DB(c).Function(c.Param("id"))
+	serveResult(c, res, err)
+}
+
+func GetLocalQueries(c *gin.Context) {
+	connCtx, err := DB(c).GetConnContext()
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	storeQueries, err := QueryStore.ReadAll()
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	queries := []localQuery{}
+	for _, q := range storeQueries {
+		if !q.IsPermitted(connCtx.Host, connCtx.User, connCtx.Database, connCtx.Mode) {
+			continue
+		}
+
+		queries = append(queries, localQuery{
+			ID:          q.ID,
+			Title:       q.Meta.Title,
+			Description: q.Meta.Description,
+			Query:       cleanQuery(q.Data),
+		})
+	}
+
+	successResponse(c, queries)
+}
+
+func RunLocalQuery(c *gin.Context) {
+	query, err := QueryStore.Read(c.Param("id"))
+	if err != nil {
+		if err == queries.ErrQueryFileNotExist {
+			query = nil
+		} else {
+			badRequest(c, err)
+			return
+		}
+	}
+	if query == nil {
+		errorResponse(c, 404, "query not found")
+		return
+	}
+
+	connCtx, err := DB(c).GetConnContext()
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	if !query.IsPermitted(connCtx.Host, connCtx.User, connCtx.Database, connCtx.Mode) {
+		errorResponse(c, 404, "query not found")
+		return
+	}
+
+	if c.Request.Method == http.MethodGet {
+		successResponse(c, localQuery{
+			ID:          query.ID,
+			Title:       query.Meta.Title,
+			Description: query.Meta.Description,
+			Query:       query.Data,
+		})
+		return
+	}
+
+	statement := cleanQuery(query.Data)
+	if statement == "" {
+		badRequest(c, errQueryRequired)
+		return
+	}
+
+	HandleQuery(statement, c)
+}

pkg/api/api_test.go

@@ -0,0 +1,40 @@
+package api
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_assetContentType(t *testing.T) {
+	samples := map[string]string{
+		"foo.html": "text/html; charset=utf-8",
+		"foo.css":  "text/css; charset=utf-8",
+		"foo.js":   "application/javascript",
+		"foo.icon": "image-x-icon",
+		"foo.png":  "image/png",
+		"foo.jpg":  "image/jpeg",
+		"foo.gif":  "image/gif",
+		"foo.eot":  "application/vnd.ms-fontobject",
+		"foo.svg":  "image/svg+xml",
+		"foo.foo":  "text/plain; charset=utf-8",
+		"foo":      "text/plain; charset=utf-8",
+	}
+
+	alternatives := map[string]string{
+		"foo.js": "text/javascript; charset=utf-8",
+	}
+
+	for name, expected := range samples {
+		if alternatives[name] == "" {
+			assert.Equal(t, expected, assetContentType(name))
+			continue
+		}
+
+		actual := assetContentType(name)
+
+		if actual != expected && actual != alternatives[name] {
+			t.Errorf("expected %v but got %v (alternative value failed)", expected, actual)
+		}
+	}
+}

pkg/api/errors.go

@@ -0,0 +1,16 @@
+package api
+
+import (
+	"errors"
+)
+
+var (
+	errNotConnected         = errors.New("Not connected")
+	errNotPermitted         = errors.New("Not permitted")
+	errInvalidConnString    = errors.New("Invalid connection string")
+	errSessionRequired      = errors.New("Session ID is required")
+	errSessionLocked        = errors.New("Session is locked")
+	errURLRequired          = errors.New("URL parameter is required")
+	errQueryRequired        = errors.New("Query parameter is required")
+	errDatabaseNameRequired = errors.New("Database name is required")
+)

pkg/api/helpers.go

@@ -0,0 +1,190 @@
+package api
+
+import (
+	"fmt"
+	"mime"
+	"net/http"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/sosedoff/pgweb/pkg/shared"
+)
+
+var (
+	// Mime types definitions
+	extraMimeTypes = map[string]string{
+		".icon": "image-x-icon",
+		".ttf":  "application/x-font-ttf",
+		".woff": "application/x-font-woff",
+		".eot":  "application/vnd.ms-fontobject",
+		".svg":  "image/svg+xml",
+		".html": "text/html; charset-utf-8",
+	}
+
+	// Paths that dont require database connection
+	allowedPaths = map[string]bool{
+		"/api/sessions":  true,
+		"/api/info":      true,
+		"/api/connect":   true,
+		"/api/bookmarks": true,
+		"/api/history":   true,
+	}
+
+	// List of characters replaced by javascript code to make queries url-safe.
+	base64subs = map[string]string{
+		"-": "+",
+		"_": "/",
+		".": "=",
+	}
+
+	// Regular expression to remove unwanted characters in filenames
+	regexCleanFilename = regexp.MustCompile(`[^\w]+`)
+)
+
+type Error struct {
+	Message string `json:"error"`
+}
+
+func NewError(err error) Error {
+	return Error{err.Error()}
+}
+
+// Returns a clean query without any comment statements
+func cleanQuery(query string) string {
+	lines := []string{}
+
+	for _, line := range strings.Split(query, "\n") {
+		line = strings.TrimSpace(line)
+		if strings.HasPrefix(line, "--") {
+			continue
+		}
+		lines = append(lines, line)
+	}
+
+	return strings.TrimSpace(strings.Join(lines, "\n"))
+}
+
+func desanitize64(query string) string {
+	// Before feeding the string into decoded, we must "reconstruct" the base64 data.
+	// Javascript replaces a few characters to be url-safe.
+	for olds, news := range base64subs {
+		query = strings.Replace(query, olds, news, -1)
+	}
+
+	return query
+}
+
+func sanitizeFilename(str string) string {
+	str = strings.ReplaceAll(str, ".", "_")
+	return regexCleanFilename.ReplaceAllString(str, "")
+}
+
+func getSessionId(req *http.Request) string {
+	id := req.Header.Get("x-session-id")
+	if id == "" {
+		id = req.URL.Query().Get("_session_id")
+	}
+	return id
+}
+
+func getQueryParam(c *gin.Context, name string) string {
+	result := ""
+	q := c.Request.URL.Query()
+
+	if len(q[name]) > 0 {
+		result = q[name][0]
+	}
+
+	return result
+}
+
+func parseIntFormValue(c *gin.Context, name string, defValue int) (int, error) {
+	val := c.Request.FormValue(name)
+
+	if val == "" {
+		return defValue, nil
+	}
+
+	num, err := strconv.Atoi(val)
+	if err != nil {
+		return defValue, fmt.Errorf("%s must be a number", name)
+	}
+
+	if num < 1 && defValue != 0 {
+		return defValue, fmt.Errorf("%s must be greater than 0", name)
+	}
+
+	return num, nil
+}
+
+func parseSshInfo(c *gin.Context) *shared.SSHInfo {
+	info := shared.SSHInfo{
+		Host:        c.Request.FormValue("ssh_host"),
+		Port:        c.Request.FormValue("ssh_port"),
+		User:        c.Request.FormValue("ssh_user"),
+		Password:    c.Request.FormValue("ssh_password"),
+		Key:         c.Request.FormValue("ssh_key"),
+		KeyPassword: c.Request.FormValue("ssh_key_password"),
+	}
+
+	if info.Port == "" {
+		info.Port = "22"
+	}
+
+	return &info
+}
+
+func assetContentType(name string) string {
+	ext := filepath.Ext(name)
+	result := mime.TypeByExtension(ext)
+
+	if result == "" {
+		result = extraMimeTypes[ext]
+	}
+
+	if result == "" {
+		result = "text/plain; charset=utf-8"
+	}
+
+	return result
+}
+
+// Send a query result to client
+func serveResult(c *gin.Context, result interface{}, err interface{}) {
+	if err != nil {
+		badRequest(c, err)
+		return
+	}
+
+	successResponse(c, result)
+}
+
+// Send successful response back to client
+func successResponse(c *gin.Context, data interface{}) {
+	c.JSON(200, data)
+}
+
+// Send an error response back to client
+func errorResponse(c *gin.Context, status int, err interface{}) {
+	var message interface{}
+
+	switch v := err.(type) {
+	case error:
+		message = v.Error()
+	case string:
+		message = v
+	default:
+		message = v
+	}
+
+	c.AbortWithStatusJSON(status, gin.H{"status": status, "error": message})
+}
+
+// Send a bad request (http 400) back to client
+func badRequest(c *gin.Context, err interface{}) {
+	errorResponse(c, 400, err)
+}

pkg/api/helpers_test.go

@@ -0,0 +1,88 @@
+package api
+
+import (
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_desanitize64(t *testing.T) {
+	examples := map[string]string{
+		"test":        "test",
+		"test+test+":  "test-test-",
+		"test/test/":  "test_test_",
+		"test=test==": "test.test..",
+	}
+
+	for expected, example := range examples {
+		assert.Equal(t, expected, desanitize64(example))
+	}
+}
+
+func Test_cleanQuery(t *testing.T) {
+	assert.Equal(t, "a\nb\nc", cleanQuery("a\nb\nc"))
+	assert.Equal(t, "", cleanQuery("--something"))
+	assert.Equal(t, "test", cleanQuery("--test\ntest\n   -- test\n"))
+}
+
+func Test_sanitizeFilename(t *testing.T) {
+	examples := map[string]string{
+		"foo":              "foo",
+		"fooBar":           "fooBar",
+		"foo.bar":          "foo_bar",
+		`"foo"."bar"`:      "foo_bar",
+		"!@#$foo.&&*(&bar": "foo_bar",
+	}
+
+	for given, expected := range examples {
+		t.Run(given, func(t *testing.T) {
+			assert.Equal(t, expected, sanitizeFilename(given))
+		})
+	}
+}
+
+func Test_getSessionId(t *testing.T) {
+	req := &http.Request{Header: http.Header{}}
+	req.Header.Add("x-session-id", "token")
+	assert.Equal(t, "token", getSessionId(req))
+
+	req = &http.Request{}
+	req.URL, _ = url.Parse("http://foobar/?_session_id=token")
+	assert.Equal(t, "token", getSessionId(req))
+}
+
+func Test_serveResult(t *testing.T) {
+	server := gin.Default()
+	server.GET("/good", func(c *gin.Context) {
+		serveResult(c, gin.H{"foo": "bar"}, nil)
+	})
+	server.GET("/bad", func(c *gin.Context) {
+		serveResult(c, nil, errors.New("message"))
+	})
+	server.GET("/nodata", func(c *gin.Context) {
+		serveResult(c, nil, nil)
+	})
+
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", "/good", nil)
+	server.ServeHTTP(w, req)
+	assert.Equal(t, 200, w.Code)
+	assert.Equal(t, `{"foo":"bar"}`, w.Body.String())
+
+	w = httptest.NewRecorder()
+	req, _ = http.NewRequest("GET", "/bad", nil)
+	server.ServeHTTP(w, req)
+	assert.Equal(t, 400, w.Code)
+	assert.Equal(t, `{"error":"message","status":400}`, w.Body.String())
+
+	w = httptest.NewRecorder()
+	req, _ = http.NewRequest("GET", "/nodata", nil)
+	server.ServeHTTP(w, req)
+	assert.Equal(t, 200, w.Code)
+	assert.Equal(t, `null`, w.Body.String())
+}

pkg/api/logger.go

@@ -0,0 +1,115 @@
+package api
+
+import (
+	"net/http"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/sirupsen/logrus"
+
+	"github.com/sosedoff/pgweb/pkg/command"
+)
+
+var (
+	logger *logrus.Logger
+
+	reConnectToken = regexp.MustCompile("/connect/(.*)")
+)
+
+func init() {
+	if logger == nil {
+		logger = logrus.New()
+	}
+}
+
+// TODO: Move this into server struct when it's ready
+func SetLogger(l *logrus.Logger) {
+	logger = l
+}
+
+func RequestLogger(logger *logrus.Logger) gin.HandlerFunc {
+	debug := logger.Level > logrus.InfoLevel
+	logForwardedUser := command.Opts.LogForwardedUser
+
+	return func(c *gin.Context) {
+		start := time.Now()
+		path := c.Request.URL.Path
+
+		// Process request
+		c.Next()
+
+		if !debug {
+			// Skip static assets logging
+			if strings.Contains(path, "/static/") {
+				return
+			}
+
+			path = sanitizeLogPath(path)
+		}
+
+		status := c.Writer.Status()
+		end := time.Now()
+		latency := end.Sub(start)
+
+		fields := logrus.Fields{
+			"status":      status,
+			"method":      c.Request.Method,
+			"remote_addr": c.ClientIP(),
+			"duration":    latency.String(),
+			"duration_ms": latency.Milliseconds(),
+			"path":        path,
+		}
+
+		if reqID := getRequestID(c); reqID != "" {
+			fields["id"] = reqID
+		}
+
+		if logForwardedUser {
+			if forwardedUser := c.GetHeader("X-Forwarded-User"); forwardedUser != "" {
+				fields["forwarded_user"] = forwardedUser
+			}
+			if forwardedEmail := c.GetHeader("X-Forwarded-Email"); forwardedEmail != "" {
+				fields["forwarded_email"] = forwardedEmail
+			}
+		}
+
+		if err := c.Errors.Last(); err != nil {
+			fields["error"] = err.Error()
+		}
+
+		// Additional fields for debugging
+		if debug {
+			fields["raw_query"] = c.Request.URL.RawQuery
+
+			if c.Request.Method != http.MethodGet {
+				fields["raw_form"] = c.Request.Form
+			}
+		}
+
+		entry := logger.WithFields(fields)
+		msg := "http_request"
+
+		switch {
+		case status >= http.StatusBadRequest && status < http.StatusInternalServerError:
+			entry.Warn(msg)
+		case status >= http.StatusInternalServerError:
+			entry.Error(msg)
+		default:
+			entry.Info(msg)
+		}
+	}
+}
+
+func sanitizeLogPath(str string) string {
+	return reConnectToken.ReplaceAllString(str, "/connect/REDACTED")
+}
+
+func getRequestID(c *gin.Context) string {
+	id := c.GetHeader("x-request-id")
+	if id == "" {
+		id = c.GetHeader("x-amzn-trace-id")
+	}
+	return id
+}

pkg/api/logger_test.go

@@ -0,0 +1,31 @@
+package api
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_getRequestID(t *testing.T) {
+	examples := []struct {
+		headers map[string]string
+		result  string
+	}{
+		{map[string]string{}, ""},
+		{map[string]string{"X-Request-ID": "foo"}, "foo"},
+		{map[string]string{"x-request-id": "foo"}, "foo"},
+		{map[string]string{"x-request-id": "foo"}, "foo"},
+		{map[string]string{"x-request-id": "foo", "x-amzn-trace-id": "amz"}, "foo"},
+	}
+
+	for _, ex := range examples {
+		req := &http.Request{Header: http.Header{}}
+		for k, v := range ex.headers {
+			req.Header.Set(k, v)
+		}
+
+		assert.Equal(t, ex.result, getRequestID(&gin.Context{Request: req}))
+	}
+}

pkg/api/middleware.go

@@ -0,0 +1,69 @@
+package api
+
+import (
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/sosedoff/pgweb/pkg/command"
+)
+
+// Middleware to check database connection status before running queries
+func dbCheckMiddleware() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		path := strings.Replace(c.Request.URL.Path, command.Opts.Prefix, "", -1)
+
+		// Allow whitelisted paths
+		if allowedPaths[path] {
+			c.Next()
+			return
+		}
+
+		// Check if session exists in single-session mode
+		if !command.Opts.Sessions {
+			if DbClient == nil {
+				badRequest(c, errNotConnected)
+				return
+			}
+
+			c.Next()
+			return
+		}
+
+		// Determine session ID from the client request
+		sid := getSessionId(c.Request)
+		if sid == "" {
+			badRequest(c, errSessionRequired)
+			return
+		}
+
+		// Determine the database connection handle for the session
+		conn := DbSessions.Get(sid)
+		if conn == nil {
+			badRequest(c, errNotConnected)
+			return
+		}
+
+		c.Next()
+	}
+}
+
+// Middleware to inject CORS headers
+func corsMiddleware() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.Header("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
+		c.Header("Access-Control-Expose-Headers", "*")
+		c.Header("Access-Control-Allow-Origin", command.Opts.CorsOrigin)
+	}
+}
+
+func requireLocalQueries() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if QueryStore == nil {
+			badRequest(c, "local queries are disabled")
+			return
+		}
+
+		c.Next()
+	}
+}

pkg/api/routes.go

@@ -0,0 +1,68 @@
+package api
+
+import (
+	"github.com/gin-gonic/gin"
+
+	"github.com/sosedoff/pgweb/pkg/command"
+	"github.com/sosedoff/pgweb/pkg/metrics"
+)
+
+func SetupMiddlewares(group *gin.RouterGroup) {
+	if command.Opts.Cors {
+		group.Use(corsMiddleware())
+	}
+
+	group.Use(dbCheckMiddleware())
+}
+
+func SetupRoutes(router *gin.Engine) {
+	root := router.Group(command.Opts.Prefix)
+
+	root.GET("/", gin.WrapH(GetHome(command.Opts.Prefix)))
+	root.GET("/static/*path", gin.WrapH(GetAssets(command.Opts.Prefix)))
+	root.GET("/connect/:resource", ConnectWithBackend)
+
+	api := root.Group("/api")
+	SetupMiddlewares(api)
+
+	if command.Opts.Sessions {
+		api.GET("/sessions", GetSessions)
+	}
+
+	api.GET("/info", GetInfo)
+	api.POST("/connect", Connect)
+	api.POST("/disconnect", Disconnect)
+	api.POST("/switchdb", SwitchDb)
+	api.GET("/databases", GetDatabases)
+	api.GET("/connection", GetConnectionInfo)
+	api.GET("/server_settings", GetServerSettings)
+	api.GET("/activity", GetActivity)
+	api.GET("/schemas", GetSchemas)
+	api.GET("/objects", GetObjects)
+	api.GET("/tables/:table", GetTable)
+	api.GET("/tables/:table/rows", GetTableRows)
+	api.GET("/tables/:table/info", GetTableInfo)
+	api.GET("/tables/:table/indexes", GetTableIndexes)
+	api.GET("/tables/:table/constraints", GetTableConstraints)
+	api.GET("/tables_stats", GetTablesStats)
+	api.GET("/functions/:id", GetFunction)
+	api.GET("/query", RunQuery)
+	api.POST("/query", RunQuery)
+	api.GET("/explain", ExplainQuery)
+	api.POST("/explain", ExplainQuery)
+	api.GET("/analyze", AnalyzeQuery)
+	api.POST("/analyze", AnalyzeQuery)
+	api.GET("/history", GetHistory)
+	api.GET("/bookmarks", GetBookmarks)
+	api.GET("/export", DataExport)
+	api.GET("/local_queries", requireLocalQueries(), GetLocalQueries)
+	api.GET("/local_queries/:id", requireLocalQueries(), RunLocalQuery)
+	api.POST("/local_queries/:id", requireLocalQueries(), RunLocalQuery)
+}
+
+func SetupMetrics(engine *gin.Engine) {
+	if command.Opts.MetricsEnabled && command.Opts.MetricsAddr == "" {
+		// NOTE: We're not supporting the MetricsPath CLI option here to avoid the route conflicts.
+		engine.GET("/metrics", gin.WrapH(metrics.NewHandler()))
+	}
+}

pkg/api/session_manager.go

@@ -0,0 +1,136 @@
+package api
+
+import (
+	"sync"
+	"time"
+
+	"github.com/sirupsen/logrus"
+
+	"github.com/sosedoff/pgweb/pkg/client"
+	"github.com/sosedoff/pgweb/pkg/metrics"
+)
+
+type SessionManager struct {
+	logger      *logrus.Logger
+	sessions    map[string]*client.Client
+	mu          sync.Mutex
+	idleTimeout time.Duration
+}
+
+func NewSessionManager(logger *logrus.Logger) *SessionManager {
+	return &SessionManager{
+		logger:   logger,
+		sessions: map[string]*client.Client{},
+		mu:       sync.Mutex{},
+	}
+}
+
+func (m *SessionManager) SetIdleTimeout(timeout time.Duration) {
+	m.idleTimeout = timeout
+}
+
+func (m *SessionManager) IDs() []string {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	ids := []string{}
+	for k := range m.sessions {
+		ids = append(ids, k)
+	}
+
+	return ids
+}
+
+func (m *SessionManager) Sessions() map[string]*client.Client {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	sessions := make(map[string]*client.Client, len(m.sessions))
+	for k, v := range m.sessions {
+		sessions[k] = v
+	}
+
+	return sessions
+}
+
+func (m *SessionManager) Get(id string) *client.Client {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	return m.sessions[id]
+}
+
+func (m *SessionManager) Add(id string, conn *client.Client) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	m.sessions[id] = conn
+	metrics.SetSessionsCount(len(m.sessions))
+}
+
+func (m *SessionManager) Remove(id string) bool {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	conn, ok := m.sessions[id]
+	if ok {
+		conn.Close()
+		delete(m.sessions, id)
+	}
+
+	metrics.SetSessionsCount(len(m.sessions))
+	return ok
+}
+
+func (m *SessionManager) Len() int {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	return len(m.sessions)
+}
+
+func (m *SessionManager) Cleanup() int {
+	if m.idleTimeout == 0 {
+		return 0
+	}
+
+	removed := 0
+
+	m.logger.Debug("starting idle sessions cleanup")
+	defer func() {
+		m.logger.Debug("removed idle sessions:", removed)
+	}()
+
+	for _, id := range m.staleSessions() {
+		m.logger.WithField("id", id).Debug("closing stale session")
+		if m.Remove(id) {
+			removed++
+		}
+	}
+
+	return removed
+}
+
+func (m *SessionManager) RunPeriodicCleanup() {
+	m.logger.WithField("timeout", m.idleTimeout).Info("session manager cleanup enabled")
+
+	for range time.Tick(time.Minute) {
+		m.Cleanup()
+	}
+}
+
+func (m *SessionManager) staleSessions() []string {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	now := time.Now()
+	ids := []string{}
+
+	for id, conn := range m.sessions {
+		if now.Sub(conn.LastQueryTime()) > m.idleTimeout {
+			ids = append(ids, id)
+		}
+	}
+
+	return ids
+}

pkg/api/session_manager_test.go

@@ -0,0 +1,80 @@
+package api
+
+import (
+	"sort"
+	"testing"
+	"time"
+
+	"github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/sosedoff/pgweb/pkg/client"
+)
+
+func TestSessionManager(t *testing.T) {
+	t.Run("return ids", func(t *testing.T) {
+		manager := NewSessionManager(nil)
+		assert.Equal(t, []string{}, manager.IDs())
+
+		manager.sessions["foo"] = &client.Client{}
+		manager.sessions["bar"] = &client.Client{}
+
+		ids := manager.IDs()
+		sort.Strings(ids)
+		assert.Equal(t, []string{"bar", "foo"}, ids)
+	})
+
+	t.Run("get session", func(t *testing.T) {
+		manager := NewSessionManager(nil)
+		assert.Nil(t, manager.Get("foo"))
+
+		manager.sessions["foo"] = &client.Client{}
+		assert.NotNil(t, manager.Get("foo"))
+	})
+
+	t.Run("set session", func(t *testing.T) {
+		manager := NewSessionManager(nil)
+		assert.Nil(t, manager.Get("foo"))
+
+		manager.Add("foo", &client.Client{})
+		assert.NotNil(t, manager.Get("foo"))
+	})
+
+	t.Run("remove session", func(t *testing.T) {
+		manager := NewSessionManager(nil)
+		assert.Nil(t, manager.Get("foo"))
+
+		manager.Add("foo", &client.Client{})
+		assert.NotNil(t, manager.Get("foo"))
+		assert.True(t, manager.Remove("foo"))
+		assert.False(t, manager.Remove("foo"))
+		assert.Nil(t, manager.Get("foo"))
+	})
+
+	t.Run("return len", func(t *testing.T) {
+		manager := NewSessionManager(nil)
+		manager.sessions["foo"] = &client.Client{}
+		manager.sessions["bar"] = &client.Client{}
+
+		assert.Equal(t, 2, manager.Len())
+	})
+
+	t.Run("clean up stale sessions", func(t *testing.T) {
+		manager := NewSessionManager(logrus.New())
+		conn := &client.Client{}
+		manager.Add("foo", conn)
+
+		assert.Equal(t, 1, manager.Len())
+		assert.Equal(t, 0, manager.Cleanup())
+		assert.Equal(t, 1, manager.Len())
+
+		res, err := conn.Query("select 1")
+		assert.Nil(t, res)
+		assert.Nil(t, err)
+
+		manager.SetIdleTimeout(time.Minute)
+		assert.Equal(t, 1, manager.Cleanup())
+		assert.Equal(t, 0, manager.Len())
+		assert.True(t, conn.IsClosed())
+	})
+}

pkg/api/types.go

@@ -0,0 +1,8 @@
+package api
+
+type localQuery struct {
+	ID          string `json:"id"`
+	Title       string `json:"title,omitempty"`
+	Description string `json:"description,omitempty"`
+	Query       string `json:"query"`
+}

pkg/bookmarks/bookmarks.go

@@ -0,0 +1,53 @@
+package bookmarks
+
+import (
+	"os"
+
+	"github.com/sosedoff/pgweb/pkg/command"
+	"github.com/sosedoff/pgweb/pkg/shared"
+)
+
+// Bookmark contains information about bookmarked database connection
+type Bookmark struct {
+	ID          string          // ID generated from the filename
+	URL         string          // Postgres connection URL
+	Host        string          // Server hostname
+	Port        int             // Server port
+	User        string          // Database user
+	UserVar     string          // Database user environment variable
+	Password    string          // User password
+	PasswordVar string          // User password environment variable
+	Database    string          // Database name
+	SSLMode     string          // Connection SSL mode
+	SSH         *shared.SSHInfo // SSH tunnel config
+	ReadOnly    bool            // Enable read-only transaction mode
+}
+
+// SSHInfoIsEmpty returns true if ssh configuration is not provided
+func (b Bookmark) SSHInfoIsEmpty() bool {
+	return b.SSH == nil || b.SSH.User == "" && b.SSH.Host == "" && b.SSH.Port == ""
+}
+
+// ConvertToOptions returns an options struct from connection details
+func (b Bookmark) ConvertToOptions() command.Options {
+	user := b.User
+	if b.User == "" {
+		user = os.Getenv(b.UserVar)
+	}
+
+	pass := b.Password
+	if b.Password == "" {
+		pass = os.Getenv(b.PasswordVar)
+	}
+
+	return command.Options{
+		URL:      b.URL,
+		Host:     b.Host,
+		Port:     b.Port,
+		User:     user,
+		Pass:     pass,
+		DbName:   b.Database,
+		SSLMode:  b.SSLMode,
+		ReadOnly: b.ReadOnly,
+	}
+}

pkg/bookmarks/bookmarks_test.go

@@ -0,0 +1,122 @@
+package bookmarks
+
+import (
+	"testing"
+
+	"github.com/sosedoff/pgweb/pkg/command"
+	"github.com/sosedoff/pgweb/pkg/shared"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestBookmarkSSHInfoIsEmpty(t *testing.T) {
+	t.Run("empty", func(t *testing.T) {
+		info := &shared.SSHInfo{
+			Host: "",
+			Port: "",
+			User: "",
+		}
+
+		b := Bookmark{SSH: nil}
+		assert.True(t, b.SSHInfoIsEmpty())
+
+		b = Bookmark{SSH: info}
+		assert.True(t, b.SSHInfoIsEmpty())
+	})
+
+	t.Run("populated", func(t *testing.T) {
+		info := &shared.SSHInfo{
+			Host: "localhost",
+			Port: "8080",
+			User: "postgres",
+		}
+
+		b := Bookmark{SSH: info}
+		assert.False(t, b.SSHInfoIsEmpty())
+	})
+}
+
+func TestBookmarkWithVarsConvertToOptions(t *testing.T) {
+	t.Run("literals set", func(t *testing.T) {
+		b := Bookmark{
+			User:        "user",
+			UserVar:     "",
+			Password:    "password",
+			PasswordVar: "",
+		}
+
+		expOpt := command.Options{
+			User: "user",
+			Pass: "password",
+		}
+
+		opt := b.ConvertToOptions()
+		assert.Equal(t, expOpt, opt)
+	})
+
+	t.Run("all set", func(t *testing.T) {
+		b := Bookmark{
+			User:        "user",
+			UserVar:     "DB_USER",
+			Password:    "password",
+			PasswordVar: "DB_PASSWORD",
+		}
+
+		expOpt := command.Options{
+			User: "user",
+			Pass: "password",
+		}
+
+		t.Setenv("DB_USER", "user123")
+		t.Setenv("DB_PASSWORD", "password123")
+
+		opt := b.ConvertToOptions()
+		assert.Equal(t, expOpt, opt)
+	})
+
+	t.Run("env vars set", func(t *testing.T) {
+		b := Bookmark{
+			User:        "",
+			UserVar:     "DB_USER",
+			Password:    "",
+			PasswordVar: "DB_PASSWORD",
+		}
+
+		expOpt := command.Options{
+			User: "user123",
+			Pass: "password123",
+		}
+
+		t.Setenv("DB_USER", "user123")
+		t.Setenv("DB_PASSWORD", "password123")
+
+		opt := b.ConvertToOptions()
+		assert.Equal(t, expOpt, opt)
+	})
+}
+
+func TestBookmarkConvertToOptions(t *testing.T) {
+	b := Bookmark{
+		URL:      "postgres://username:password@host:port/database?sslmode=disable",
+		Host:     "localhost",
+		Port:     5432,
+		User:     "postgres",
+		Password: "password",
+		Database: "mydatabase",
+		SSLMode:  "disable",
+		ReadOnly: true,
+	}
+
+	expOpt := command.Options{
+		URL:      "postgres://username:password@host:port/database?sslmode=disable",
+		Host:     "localhost",
+		Port:     5432,
+		User:     "postgres",
+		Pass:     "password",
+		DbName:   "mydatabase",
+		SSLMode:  "disable",
+		ReadOnly: true,
+	}
+
+	opt := b.ConvertToOptions()
+	assert.Equal(t, expOpt, opt)
+}

pkg/bookmarks/manager.go

@@ -0,0 +1,152 @@
+package bookmarks
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/BurntSushi/toml"
+)
+
+type Manager struct {
+	dir string
+}
+
+func NewManager(dir string) Manager {
+	return Manager{
+		dir: dir,
+	}
+}
+
+func (m Manager) Get(id string) (*Bookmark, error) {
+	bookmarks, err := m.list()
+	if err != nil {
+		return nil, err
+	}
+
+	for _, b := range bookmarks {
+		if b.ID == id {
+			return &b, nil
+		}
+	}
+
+	return nil, fmt.Errorf("bookmark %v not found", id)
+}
+
+func (m Manager) List() ([]Bookmark, error) {
+	return m.list()
+}
+
+func (m Manager) ListIDs() ([]string, error) {
+	bookmarks, err := m.list()
+	if err != nil {
+		return nil, err
+	}
+
+	ids := make([]string, len(bookmarks))
+	for i, bookmark := range bookmarks {
+		ids[i] = bookmark.ID
+	}
+
+	return ids, nil
+}
+
+func (m Manager) list() ([]Bookmark, error) {
+	result := []Bookmark{}
+
+	if m.dir == "" {
+		return result, nil
+	}
+
+	info, err := os.Stat(m.dir)
+	if err != nil {
+		// Do not fail if base dir does not exists: it's not created by default
+		if errors.Is(err, os.ErrNotExist) {
+			fmt.Fprintf(os.Stderr, "[WARN] bookmarks dir %s does not exist\n", m.dir)
+			return result, nil
+		}
+		return nil, err
+	}
+	if !info.IsDir() {
+		return nil, fmt.Errorf("path %s is not a directory", m.dir)
+	}
+
+	dirEntries, err := os.ReadDir(m.dir)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, entry := range dirEntries {
+		name := entry.Name()
+		if filepath.Ext(name) != ".toml" {
+			continue
+		}
+
+		bookmark, err := readBookmark(filepath.Join(m.dir, name))
+		if err != nil {
+			// Do not fail if one of the bookmarks is invalid
+			fmt.Fprintf(os.Stderr, "[WARN] bookmark file %s is invalid: %s\n", name, err)
+			continue
+		}
+
+		result = append(result, bookmark)
+	}
+
+	return result, nil
+}
+
+func readBookmark(path string) (Bookmark, error) {
+	bookmark := Bookmark{
+		ID: fileBasename(path),
+	}
+
+	_, err := os.Stat(path)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			err = fmt.Errorf("bookmark file %s does not exist", path)
+		}
+		return bookmark, err
+	}
+
+	buff, err := os.ReadFile(path)
+	if err != nil {
+		return bookmark, err
+	}
+
+	_, err = toml.Decode(string(buff), &bookmark)
+
+	if bookmark.Port == 0 {
+		bookmark.Port = 5432
+	}
+
+	// List of all supported postgres modes
+	modes := []string{"disable", "allow", "prefer", "require", "verify-ca", "verify-full"}
+	valid := false
+
+	for _, mode := range modes {
+		if bookmark.SSLMode == mode {
+			valid = true
+			break
+		}
+	}
+
+	// Fall back to a default mode if mode is not set or invalid
+	// Typical typo: ssl mode set to "disabled"
+	if bookmark.SSLMode == "" || !valid {
+		bookmark.SSLMode = "disable"
+	}
+
+	// Set default SSH port if it's not provided by user
+	if bookmark.SSH != nil && bookmark.SSH.Port == "" {
+		bookmark.SSH.Port = "22"
+	}
+
+	return bookmark, err
+}
+
+func fileBasename(path string) string {
+	filename := filepath.Base(path)
+	return strings.Replace(filename, filepath.Ext(path), "", 1)
+}

pkg/bookmarks/manager_test.go

@@ -0,0 +1,116 @@
+package bookmarks
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestManagerList(t *testing.T) {
+	examples := []struct {
+		dir string
+		num int
+		err string
+	}{
+		{"../../data", 4, ""},
+		{"../../data/bookmark.toml", 0, "is not a directory"},
+		{"../../data2", 0, ""},
+		{"", 0, ""},
+	}
+
+	for _, ex := range examples {
+		t.Run(ex.dir, func(t *testing.T) {
+			bookmarks, err := NewManager(ex.dir).List()
+			if ex.err != "" {
+				assert.Contains(t, err.Error(), ex.err)
+			}
+			assert.Len(t, bookmarks, ex.num)
+		})
+	}
+}
+
+func TestManagerListIDs(t *testing.T) {
+	ids, err := NewManager("../../data").ListIDs()
+	assert.NoError(t, err)
+	assert.Equal(t, []string{
+		"bookmark",
+		"bookmark_invalid_ssl",
+		"bookmark_url",
+		"bookmark_with_ssh",
+	}, ids)
+}
+
+func TestManagerGet(t *testing.T) {
+	manager := NewManager("../../data")
+
+	b, err := manager.Get("bookmark")
+	assert.NoError(t, err)
+	assert.Equal(t, "bookmark", b.ID)
+
+	b, err = manager.Get("foo")
+	assert.Equal(t, "bookmark foo not found", err.Error())
+	assert.Nil(t, b)
+}
+
+func Test_fileBasename(t *testing.T) {
+	assert.Equal(t, "filename", fileBasename("filename.toml"))
+	assert.Equal(t, "filename", fileBasename("path/filename.toml"))
+	assert.Equal(t, "filename", fileBasename("~/long/path/filename.toml"))
+	assert.Equal(t, "filename", fileBasename("filename"))
+}
+
+func Test_readBookmark(t *testing.T) {
+	t.Run("good", func(t *testing.T) {
+		b, err := readBookmark("../../data/bookmark.toml")
+		assert.NoError(t, err)
+		assert.Equal(t, "bookmark", b.ID)
+		assert.Equal(t, "localhost", b.Host)
+		assert.Equal(t, 5432, b.Port)
+		assert.Equal(t, "postgres", b.User)
+		assert.Equal(t, "mydatabase", b.Database)
+		assert.Equal(t, "disable", b.SSLMode)
+		assert.Equal(t, "", b.Password)
+		assert.Equal(t, "", b.URL)
+	})
+
+	t.Run("with url", func(t *testing.T) {
+		b, err := readBookmark("../../data/bookmark_url.toml")
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://username:password@host:port/database?sslmode=disable", b.URL)
+		assert.Equal(t, "", b.Host)
+		assert.Equal(t, 5432, b.Port)
+		assert.Equal(t, "", b.User)
+		assert.Equal(t, "", b.Database)
+		assert.Equal(t, "disable", b.SSLMode)
+		assert.Equal(t, "", b.Password)
+	})
+
+	t.Run("with ssh options", func(t *testing.T) {
+		b, err := readBookmark("../../data/bookmark_with_ssh.toml")
+		assert.NoError(t, err)
+		assert.NotNil(t, b.SSH)
+
+		sshc := b.SSH
+		assert.Equal(t, "ssh-host", sshc.Host)
+		assert.Equal(t, "ssh-user", sshc.User)
+		assert.Equal(t, "ssh-password", sshc.Password)
+		assert.Equal(t, "/path/to/key-file", sshc.Key)
+		assert.Equal(t, "key-file-password", sshc.KeyPassword)
+	})
+
+	t.Run("invalid ssl", func(t *testing.T) {
+		b, err := readBookmark("../../data/bookmark_invalid_ssl.toml")
+		assert.NoError(t, err)
+		assert.Equal(t, "disable", b.SSLMode)
+	})
+
+	t.Run("invalid file", func(t *testing.T) {
+		_, err := readBookmark("foobar")
+		assert.Equal(t, "bookmark file foobar does not exist", err.Error())
+	})
+
+	t.Run("invalid syntax", func(t *testing.T) {
+		_, err := readBookmark("../../data/invalid.toml")
+		assert.Equal(t, "toml: line 1: expected '.' or '=', but got 'e' instead", err.Error())
+	})
+}

pkg/cli/cli.go

@@ -0,0 +1,343 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"os/signal"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/jessevdk/go-flags"
+	"github.com/sirupsen/logrus"
+
+	"github.com/sosedoff/pgweb/pkg/api"
+	"github.com/sosedoff/pgweb/pkg/bookmarks"
+	"github.com/sosedoff/pgweb/pkg/client"
+	"github.com/sosedoff/pgweb/pkg/command"
+	"github.com/sosedoff/pgweb/pkg/connection"
+	"github.com/sosedoff/pgweb/pkg/metrics"
+	"github.com/sosedoff/pgweb/pkg/queries"
+	"github.com/sosedoff/pgweb/pkg/util"
+	"go.balki.me/anyhttp"
+)
+
+var (
+	logger  *logrus.Logger
+	options command.Options
+
+	readonlyWarning = `
+--------------------------------------------------------------------------------
+SECURITY WARNING: You are running Pgweb in read-only mode.
+This mode is designed for environments where users could potentially delete or change data.
+For proper read-only access please follow PostgreSQL role management documentation.
+--------------------------------------------------------------------------------`
+)
+
+func init() {
+	logger = logrus.New()
+}
+
+func exitWithMessage(message string) {
+	fmt.Println("Error:", message)
+	os.Exit(1)
+}
+
+func initClientUsingBookmark(baseDir, bookmarkName string) (*client.Client, error) {
+	manager := bookmarks.NewManager(baseDir)
+	bookmark, err := manager.Get(bookmarkName)
+	if err != nil {
+		return nil, err
+	}
+
+	return client.NewFromBookmark(bookmark)
+}
+
+func initClient() {
+	if connection.IsBlank(command.Opts) && options.Bookmark == "" {
+		return
+	}
+
+	var cl *client.Client
+	var err error
+
+	if options.Bookmark != "" {
+		cl, err = initClientUsingBookmark(options.BookmarksDir, options.Bookmark)
+	} else {
+		cl, err = client.New()
+	}
+	if err != nil {
+		exitWithMessage(err.Error())
+	}
+
+	if command.Opts.Debug {
+		fmt.Println("Opening database connection using string:", cl.ConnectionString)
+	}
+
+	retryCount := command.Opts.RetryCount
+	retryDelay := time.Second * time.Duration(command.Opts.RetryDelay)
+
+	fmt.Println("Connecting to server...")
+	abort, err := testClient(cl, int(retryCount), retryDelay)
+	if err != nil {
+		if abort {
+			exitWithMessage(err.Error())
+		} else {
+			return
+		}
+	}
+
+	if !command.Opts.Sessions {
+		fmt.Printf("Connected to %s\n", cl.ServerVersionInfo())
+	}
+
+	fmt.Println("Checking database objects...")
+	_, err = cl.Objects()
+	if err != nil {
+		exitWithMessage(err.Error())
+	}
+
+	api.DbClient = cl
+}
+
+func initOptions() {
+	opts, err := command.ParseOptions(os.Args)
+	if err != nil {
+		switch errVal := err.(type) {
+		case *flags.Error:
+			if errVal.Type == flags.ErrHelp {
+				fmt.Println("Available environment variables:")
+				fmt.Println(command.AvailableEnvVars())
+			}
+			// no need to print error, flags package already does that
+		default:
+			fmt.Println(err.Error())
+		}
+		os.Exit(1)
+	}
+	command.Opts = opts
+	options = opts
+
+	if options.Version {
+		printVersion()
+		os.Exit(0)
+	}
+
+	if err := configureLogger(opts); err != nil {
+		exitWithMessage(err.Error())
+		return
+	}
+
+	if options.ReadOnly {
+		fmt.Println(readonlyWarning)
+	}
+
+	if options.BinaryCodec != "" {
+		if err := client.SetBinaryCodec(options.BinaryCodec); err != nil {
+			exitWithMessage(err.Error())
+		}
+	}
+
+	configureLocalQueryStore()
+	printVersion()
+}
+
+func configureLocalQueryStore() {
+	if options.Sessions || options.QueriesDir == "" {
+		return
+	}
+
+	stat, err := os.Stat(options.QueriesDir)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			logger.Debugf("local queries directory %q does not exist, disabling feature", options.QueriesDir)
+		} else {
+			logger.Debugf("local queries feature disabled due to error: %v", err)
+		}
+		return
+	}
+
+	if !stat.IsDir() {
+		logger.Debugf("local queries path %q is not a directory", options.QueriesDir)
+		return
+	}
+
+	api.QueryStore = queries.NewStore(options.QueriesDir)
+}
+
+func configureLogger(opts command.Options) error {
+	if options.Debug {
+		logger.SetLevel(logrus.DebugLevel)
+	} else {
+		lvl, err := logrus.ParseLevel(opts.LogLevel)
+		if err != nil {
+			return err
+		}
+		logger.SetLevel(lvl)
+	}
+
+	switch options.LogFormat {
+	case "text":
+		logger.SetFormatter(&logrus.TextFormatter{})
+	case "json":
+		logger.SetFormatter(&logrus.JSONFormatter{})
+	default:
+		return fmt.Errorf("invalid logger format: %v", options.LogFormat)
+	}
+
+	return nil
+}
+
+func printVersion() {
+	fmt.Println(command.VersionString())
+}
+
+func startServer() *anyhttp.ServerCtx {
+	router := gin.New()
+	router.Use(api.RequestLogger(logger))
+	router.Use(gin.Recovery())
+
+	// Enable HTTP basic authentication only if both user and password are set
+	if options.AuthUser != "" && options.AuthPass != "" {
+		auth := map[string]string{options.AuthUser: options.AuthPass}
+		router.Use(gin.BasicAuth(auth))
+	}
+
+	api.SetLogger(logger)
+	api.SetupRoutes(router)
+	api.SetupMetrics(router)
+
+	fmt.Println("Starting server...")
+	address := fmt.Sprintf("%v:%v", options.HTTPHost, options.HTTPPort)
+	if options.HTTPAddr != "" {
+		address = options.HTTPAddr
+	}
+
+	metrics.SetHealthy(true)
+
+	ctx, err := anyhttp.Serve(address, router.Handler())
+	if err != nil {
+		fmt.Println("Can't start server:", err)
+		if strings.Contains(err.Error(), "address already in use") {
+			openPage()
+		}
+		os.Exit(1)
+	}
+	return ctx
+}
+
+func startMetricsServer() {
+	serverAddr := fmt.Sprintf("%v:%v", command.Opts.HTTPHost, command.Opts.HTTPPort)
+	if options.MetricsAddr == serverAddr {
+		return
+	}
+
+	err := metrics.StartServer(logger, options.MetricsPath, options.MetricsAddr)
+	if err != nil {
+		logger.WithError(err).Fatal("unable to start prometheus metrics server")
+	}
+}
+
+func openPage() {
+	url := fmt.Sprintf("http://%v:%v/%s", options.HTTPHost, options.HTTPPort, options.Prefix)
+	fmt.Println("To view database open", url, "in browser")
+
+	if options.SkipOpen {
+		return
+	}
+
+	_, err := exec.Command("which", "open").Output()
+	if err != nil {
+		return
+	}
+
+	_, err = exec.Command("open", url).Output()
+	if err != nil {
+		fmt.Println("Unable to auto-open pgweb URL:", err)
+	}
+}
+
+// testClient attempts to establish a database connection until it succeeds or
+// give up after certain number of retries. Retries only available when database
+// name or a connection string is provided.
+func testClient(cl *client.Client, retryCount int, retryDelay time.Duration) (abort bool, err error) {
+	usingDefaultDB := command.Opts.DbName == "" && command.Opts.URL == ""
+
+	for {
+		err = cl.Test()
+		if err == nil {
+			return false, nil
+		}
+
+		// Continue normal start up if can't connect locally without database details.
+		if usingDefaultDB {
+			if errors.Is(err, client.ErrConnectionRefused) ||
+				errors.Is(err, client.ErrAuthFailed) ||
+				errors.Is(err, client.ErrDatabaseNotExist) {
+				return false, err
+			}
+		}
+
+		// Only retry if can't establish connection to the server.
+		if errors.Is(err, client.ErrConnectionRefused) && retryCount > 0 {
+			fmt.Printf("Connection error: %v, retrying in %v (%d remaining)\n", err, retryDelay, retryCount)
+			retryCount--
+			<-time.After(retryDelay)
+			continue
+		}
+
+		return true, err
+	}
+}
+
+func Run() {
+	initOptions()
+	initClient()
+
+	if api.DbClient != nil {
+		defer api.DbClient.Close()
+	}
+
+	if !options.Debug {
+		gin.SetMode("release")
+	}
+
+	// Print memory usage every 30 seconds with debug flag
+	if options.Debug {
+		util.StartProfiler()
+	}
+
+	// Start session cleanup worker
+	if options.Sessions {
+		api.DbSessions = api.NewSessionManager(logger)
+
+		if !command.Opts.DisableConnectionIdleTimeout {
+			api.DbSessions.SetIdleTimeout(time.Minute * time.Duration(command.Opts.ConnectionIdleTimeout))
+			go api.DbSessions.RunPeriodicCleanup()
+		}
+	}
+
+	// Start a separate metrics http server. If metrics addr is not provided, we
+	// add the metrics endpoint in the existing application server (see api.go).
+	if options.MetricsEnabled && options.MetricsAddr != "" {
+		go startMetricsServer()
+	}
+
+	serverCtx := startServer()
+
+	openPage()
+
+	c := make(chan os.Signal, 1)
+	signal.Notify(c, os.Interrupt, syscall.SIGTERM)
+	select {
+	case doneErr := <-serverCtx.Done:
+		logger.Infoln("idle server. shutting down error: ", doneErr)
+	case <-c:
+		logger.Infoln("received signal. shutting down")
+		serverCtx.Shutdown(context.TODO())
+	}
+}

pkg/client/client.go

@@ -0,0 +1,680 @@
+package client
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	neturl "net/url"
+	"reflect"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/jmoiron/sqlx"
+	_ "github.com/lib/pq"
+
+	"github.com/sosedoff/pgweb/pkg/bookmarks"
+	"github.com/sosedoff/pgweb/pkg/command"
+	"github.com/sosedoff/pgweb/pkg/connection"
+	"github.com/sosedoff/pgweb/pkg/history"
+	"github.com/sosedoff/pgweb/pkg/shared"
+	"github.com/sosedoff/pgweb/pkg/statements"
+)
+
+var (
+	regexErrAuthFailed        = regexp.MustCompile(`(authentication failed|role "(.*)" does not exist)`)
+	regexErrConnectionRefused = regexp.MustCompile(`(connection|actively) refused`)
+	regexErrDatabaseNotExist  = regexp.MustCompile(`database "(.*)" does not exist`)
+)
+
+var (
+	ErrAuthFailed        = errors.New("authentication failed")
+	ErrConnectionRefused = errors.New("connection refused")
+	ErrDatabaseNotExist  = errors.New("database does not exist")
+)
+
+type Client struct {
+	db               *sqlx.DB
+	tunnel           *Tunnel
+	serverVersion    string
+	serverType       string
+	lastQueryTime    time.Time
+	queryTimeout     time.Duration
+	readonly         bool
+	closed           bool
+	External         bool             `json:"external"`
+	History          []history.Record `json:"history"`
+	ConnectionString string           `json:"connection_string"`
+}
+
+func getSchemaAndTable(str string) (string, string) {
+	chunks := strings.Split(str, ".")
+	if len(chunks) == 1 {
+		return "public", chunks[0]
+	}
+	return chunks[0], chunks[1]
+}
+
+func New() (*Client, error) {
+	str, err := connection.BuildStringFromOptions(command.Opts)
+
+	if command.Opts.Debug && str != "" {
+		fmt.Println("Creating a new client for:", str)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	db, err := sqlx.Open("postgres", str)
+	if err != nil {
+		return nil, err
+	}
+
+	client := Client{
+		db:               db,
+		ConnectionString: str,
+		History:          history.New(),
+	}
+
+	client.init()
+	return &client, nil
+}
+
+func NewFromUrl(url string, sshInfo *shared.SSHInfo) (*Client, error) {
+	var (
+		tunnel *Tunnel
+		err    error
+	)
+
+	if sshInfo != nil {
+		if command.Opts.DisableSSH {
+			return nil, fmt.Errorf("ssh connections are disabled")
+		}
+		if command.Opts.Debug {
+			fmt.Println("Opening SSH tunnel for:", sshInfo)
+		}
+
+		tunnel, err = NewTunnel(sshInfo, url)
+		if err != nil {
+			tunnel.Close()
+			return nil, err
+		}
+
+		err = tunnel.Configure()
+		if err != nil {
+			tunnel.Close()
+			return nil, err
+		}
+
+		go tunnel.Start()
+
+		uri, err := neturl.Parse(url)
+		if err != nil {
+			tunnel.Close()
+			return nil, err
+		}
+
+		// Override remote postgres port with local proxy port
+		url = strings.Replace(url, uri.Host, fmt.Sprintf("127.0.0.1:%v", tunnel.Port), 1)
+	}
+
+	if command.Opts.Debug {
+		fmt.Println("Creating a new client for:", url)
+	}
+
+	uri, err := neturl.Parse(url)
+	if err == nil && uri.Path == "" {
+		return nil, fmt.Errorf("Database name is not provided")
+	}
+
+	db, err := sqlx.Open("postgres", url)
+	if err != nil {
+		return nil, err
+	}
+
+	client := Client{
+		db:               db,
+		tunnel:           tunnel,
+		serverType:       postgresType,
+		ConnectionString: url,
+		History:          history.New(),
+	}
+
+	client.init()
+	return &client, nil
+}
+
+func NewFromBookmark(bookmark *bookmarks.Bookmark) (*Client, error) {
+	var (
+		connStr string
+		err     error
+	)
+
+	options := bookmark.ConvertToOptions()
+	if options.URL != "" {
+		connStr = options.URL
+	} else {
+		connStr, err = connection.BuildStringFromOptions(options)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	var sshInfo *shared.SSHInfo
+	if !bookmark.SSHInfoIsEmpty() {
+		sshInfo = bookmark.SSH
+	}
+
+	client, err := NewFromUrl(connStr, sshInfo)
+	if err != nil {
+		return nil, err
+	}
+
+	if bookmark.ReadOnly {
+		client.readonly = true
+	}
+
+	return client, nil
+}
+
+func (client *Client) init() {
+	if command.Opts.QueryTimeout > 0 {
+		client.queryTimeout = time.Second * time.Duration(command.Opts.QueryTimeout)
+	}
+
+	client.setServerVersion()
+}
+
+func (client *Client) setServerVersion() {
+	res, err := client.query("SELECT version()")
+	if err != nil || len(res.Rows) < 1 {
+		return
+	}
+
+	version := res.Rows[0][0].(string)
+	match, serverType, serverVersion := detectServerTypeAndVersion(version)
+	if match {
+		client.serverType = serverType
+		client.serverVersion = serverVersion
+	}
+}
+
+func (client *Client) Test() error {
+	// NOTE: This is a different timeout defined in CLI OpenTimeout
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	err := client.db.PingContext(ctx)
+	if err == nil {
+		return nil
+	}
+
+	errMsg := err.Error()
+
+	if regexErrConnectionRefused.MatchString(errMsg) {
+		return ErrConnectionRefused
+	}
+	if regexErrAuthFailed.MatchString(errMsg) {
+		return ErrAuthFailed
+	}
+	if regexErrDatabaseNotExist.MatchString(errMsg) {
+		return ErrDatabaseNotExist
+	}
+
+	return err
+}
+
+func (client *Client) TestWithTimeout(timeout time.Duration) (result error) {
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+
+	// Check connection status right away without waiting for the ticker to kick in.
+	// We're expecting to get "connection refused" here for the most part.
+	if err := client.db.PingContext(ctx); err == nil {
+		return nil
+	}
+
+	ticker := time.NewTicker(250 * time.Millisecond)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			result = client.db.PingContext(ctx)
+			if result == nil {
+				return
+			}
+		case <-ctx.Done():
+			return
+		}
+	}
+}
+
+func (client *Client) Info() (*Result, error) {
+	result, err := client.query(statements.Info)
+	if err != nil {
+		msg := err.Error()
+		if strings.Contains(msg, "inet_") && (strings.Contains(msg, "not supported") || strings.Contains(msg, "permission denied")) {
+			// Fetch client information without inet_ function calls
+			result, err = client.query(statements.InfoSimple)
+		}
+	}
+	return result, err
+}
+
+func (client *Client) Databases() ([]string, error) {
+	return client.fetchRows(statements.Databases)
+}
+
+func (client *Client) Schemas() ([]string, error) {
+	return client.fetchRows(statements.Schemas)
+}
+
+func (client *Client) Objects() (*Result, error) {
+	return client.query(statements.Objects)
+}
+
+func (client *Client) Table(table string) (*Result, error) {
+	schema, table := getSchemaAndTable(table)
+	return client.query(statements.TableSchema, schema, table)
+}
+
+func (client *Client) MaterializedView(name string) (*Result, error) {
+	return client.query(statements.MaterializedView, name)
+}
+
+func (client *Client) Function(id string) (*Result, error) {
+	return client.query(statements.Function, id)
+}
+
+func (client *Client) TableRows(table string, opts RowsOptions) (*Result, error) {
+	schema, table := getSchemaAndTable(table)
+	sql := fmt.Sprintf(`SELECT * FROM "%s"."%s"`, schema, table)
+
+	if opts.Where != "" {
+		sql += fmt.Sprintf(" WHERE %s", opts.Where)
+	}
+
+	if opts.SortColumn != "" {
+		if opts.SortOrder == "" {
+			opts.SortOrder = "ASC"
+		}
+
+		sql += fmt.Sprintf(` ORDER BY "%s" %s`, opts.SortColumn, opts.SortOrder)
+	}
+
+	if opts.Limit > 0 {
+		sql += fmt.Sprintf(" LIMIT %d", opts.Limit)
+	}
+
+	if opts.Offset > 0 {
+		sql += fmt.Sprintf(" OFFSET %d", opts.Offset)
+	}
+
+	return client.query(sql)
+}
+
+func (client *Client) EstimatedTableRowsCount(table string, opts RowsOptions) (*Result, error) {
+	schema, table := getSchemaAndTable(table)
+	result, err := client.query(statements.EstimatedTableRowCount, schema, table)
+	if err != nil {
+		return nil, err
+	}
+	// float64 to int64 conversion
+	estimatedRowsCount := result.Rows[0][0].(float64)
+	result.Rows[0] = Row{int64(estimatedRowsCount)}
+
+	return result, nil
+}
+
+func (client *Client) TableRowsCount(table string, opts RowsOptions) (*Result, error) {
+	// Return postgres estimated rows count on empty filter
+	if opts.Where == "" && client.serverType == postgresType {
+		res, err := client.EstimatedTableRowsCount(table, opts)
+		if err != nil {
+			return nil, err
+		}
+		n := res.Rows[0][0].(int64)
+		if n >= 100000 {
+			return res, nil
+		}
+	}
+
+	schema, tableName := getSchemaAndTable(table)
+	sql := fmt.Sprintf(`SELECT COUNT(1) FROM "%s"."%s"`, schema, tableName)
+
+	if opts.Where != "" {
+		sql += fmt.Sprintf(" WHERE %s", opts.Where)
+	}
+
+	return client.query(sql)
+}
+
+func (client *Client) TableInfo(table string) (*Result, error) {
+	if client.serverType == cockroachType {
+		return client.query(statements.TableInfoCockroach)
+	}
+	schema, table := getSchemaAndTable(table)
+	return client.query(statements.TableInfo, fmt.Sprintf(`"%s"."%s"`, schema, table))
+}
+
+func (client *Client) TableIndexes(table string) (*Result, error) {
+	schema, table := getSchemaAndTable(table)
+	res, err := client.query(statements.TableIndexes, schema, table)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return res, err
+}
+
+func (client *Client) TableConstraints(table string) (*Result, error) {
+	schema, table := getSchemaAndTable(table)
+	res, err := client.query(statements.TableConstraints, schema, table)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return res, err
+}
+
+func (client *Client) TablesStats() (*Result, error) {
+	return client.query(statements.TablesStats)
+}
+
+func (client *Client) ServerSettings() (*Result, error) {
+	return client.query(statements.Settings)
+}
+
+// Returns all active queriers on the server
+func (client *Client) Activity() (*Result, error) {
+	if client.serverType == cockroachType {
+		return client.query("SHOW QUERIES")
+	}
+
+	version := getMajorMinorVersionString(client.serverVersion)
+	query := statements.Activity[version]
+	if query == "" {
+		query = statements.Activity["default"]
+	}
+
+	return client.query(query)
+}
+
+func (client *Client) Query(query string) (*Result, error) {
+	res, err := client.query(query)
+
+	// Save history records only if query did not fail
+	if err == nil && !client.hasHistoryRecord(query) {
+		client.History = append(client.History, history.NewRecord(query))
+	}
+
+	return res, err
+}
+
+func (client *Client) SetReadOnlyMode() error {
+	var value string
+	if err := client.db.Get(&value, "SHOW default_transaction_read_only;"); err != nil {
+		return err
+	}
+
+	if value == "off" {
+		_, err := client.db.Exec("SET default_transaction_read_only=on;")
+		return err
+	}
+
+	return nil
+}
+
+func (client *Client) ServerVersionInfo() string {
+	return fmt.Sprintf("%s %s", client.serverType, client.serverVersion)
+}
+
+func (client *Client) ServerVersion() string {
+	return client.serverVersion
+}
+
+func (client *Client) context() (context.Context, context.CancelFunc) {
+	if client.queryTimeout > 0 {
+		return context.WithTimeout(context.Background(), client.queryTimeout)
+	}
+	return context.Background(), func() {}
+}
+
+func (client *Client) exec(query string, args ...interface{}) (*Result, error) {
+	ctx, cancel := client.context()
+	defer cancel()
+
+	queryStart := time.Now()
+	res, err := client.db.ExecContext(ctx, query, args...)
+	queryFinish := time.Now()
+	if err != nil {
+		return nil, err
+	}
+
+	affected, err := res.RowsAffected()
+	if err != nil {
+		return nil, err
+	}
+
+	result := Result{
+		Columns: []string{"Rows Affected"},
+		Rows: []Row{
+			{affected},
+		},
+		Stats: &ResultStats{
+			ColumnsCount:    1,
+			RowsCount:       1,
+			QueryStartTime:  queryStart.UTC(),
+			QueryFinishTime: queryFinish.UTC(),
+			QueryDuration:   queryFinish.Sub(queryStart).Milliseconds(),
+		},
+	}
+
+	return &result, nil
+}
+
+func (client *Client) query(query string, args ...interface{}) (*Result, error) {
+	if client.db == nil {
+		return nil, nil
+	}
+
+	// Update the last usage time
+	defer func() {
+		client.lastQueryTime = time.Now().UTC()
+	}()
+
+	// We're going to force-set transaction mode on every query.
+	// This is needed so that default mode could not be changed by user.
+	if command.Opts.ReadOnly || client.readonly {
+		if err := client.SetReadOnlyMode(); err != nil {
+			return nil, err
+		}
+		if containsRestrictedKeywords(query) {
+			return nil, errors.New("query contains keywords not allowed in read-only mode")
+		}
+	}
+
+	action := strings.ToLower(strings.Split(query, " ")[0])
+	hasReturnValues := strings.Contains(strings.ToLower(query), " returning ")
+
+	if (action == "update" || action == "delete") && !hasReturnValues {
+		return client.exec(query, args...)
+	}
+
+	ctx, cancel := client.context()
+	defer cancel()
+
+	queryStart := time.Now()
+	rows, err := client.db.QueryxContext(ctx, query, args...)
+	queryFinish := time.Now()
+	if err != nil {
+		if command.Opts.Debug {
+			log.Println("Failed query:", query, "\nArgs:", args)
+		}
+		return nil, err
+	}
+	defer rows.Close()
+
+	cols, err := rows.Columns()
+	if err != nil {
+		return nil, err
+	}
+
+	// Make sure to never return null columns
+	if cols == nil {
+		cols = []string{}
+	}
+
+	result := Result{
+		Columns: cols,
+		Rows:    []Row{},
+	}
+
+	for rows.Next() {
+		obj, err := rows.SliceScan()
+
+		for i, item := range obj {
+			if item == nil {
+				obj[i] = nil
+			} else {
+				t := reflect.TypeOf(item).Kind().String()
+
+				if t == "slice" {
+					obj[i] = string(item.([]byte))
+				}
+			}
+		}
+
+		if err == nil {
+			result.Rows = append(result.Rows, obj)
+		}
+	}
+
+	result.Stats = &ResultStats{
+		ColumnsCount:    len(cols),
+		RowsCount:       len(result.Rows),
+		QueryStartTime:  queryStart.UTC(),
+		QueryFinishTime: queryFinish.UTC(),
+		QueryDuration:   queryFinish.Sub(queryStart).Milliseconds(),
+	}
+
+	result.PostProcess()
+
+	return &result, nil
+}
+
+// Close database connection
+func (client *Client) Close() error {
+	if client.closed {
+		return nil
+	}
+	defer func() {
+		client.closed = true
+		client.tunnel = nil
+	}()
+
+	if client.tunnel != nil {
+		client.tunnel.Close()
+	}
+
+	if client.db != nil {
+		return client.db.Close()
+	}
+
+	return nil
+}
+
+func (c *Client) IsClosed() bool {
+	return c.closed
+}
+
+func (c *Client) LastQueryTime() time.Time {
+	return c.lastQueryTime
+}
+
+func (client *Client) IsIdle() bool {
+	mins := int(time.Since(client.lastQueryTime).Minutes())
+
+	if command.Opts.ConnectionIdleTimeout > 0 {
+		return mins >= command.Opts.ConnectionIdleTimeout
+	}
+
+	return false
+}
+
+// Fetch all rows as strings for a single column
+func (client *Client) fetchRows(q string) ([]string, error) {
+	res, err := client.query(q)
+
+	if err != nil {
+		return nil, err
+	}
+
+	// Init empty slice so json.Marshal will encode it to "[]" instead of "null"
+	results := make([]string, 0)
+
+	for _, row := range res.Rows {
+		results = append(results, row[0].(string))
+	}
+
+	return results, nil
+}
+
+func (client *Client) hasHistoryRecord(query string) bool {
+	result := false
+
+	for _, record := range client.History {
+		if record.Query == query {
+			result = true
+			break
+		}
+	}
+
+	return result
+}
+
+type ConnContext struct {
+	Host     string
+	User     string
+	Database string
+	Mode     string
+}
+
+func (c ConnContext) String() string {
+	return fmt.Sprintf(
+		"host=%q user=%q database=%q mode=%q",
+		c.Host, c.User, c.Database, c.Mode,
+	)
+}
+
+// ConnContext returns information about current database connection
+func (client *Client) GetConnContext() (*ConnContext, error) {
+	url, err := neturl.Parse(client.ConnectionString)
+	if err != nil {
+		return nil, err
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*10)
+	defer cancel()
+
+	connCtx := ConnContext{
+		Host: url.Hostname(),
+		Mode: "default",
+	}
+
+	if command.Opts.ReadOnly {
+		connCtx.Mode = "readonly"
+	}
+
+	row := client.db.QueryRowContext(ctx, "SELECT current_user, current_database()")
+	if err := row.Scan(&connCtx.User, &connCtx.Database); err != nil {
+		return nil, err
+	}
+
+	return &connCtx, nil
+}

pkg/client/client_test.go

@@ -0,0 +1,791 @@
+package client
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"runtime"
+	"sort"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/sosedoff/pgweb/pkg/command"
+)
+
+var (
+	testClient     *Client
+	testCommands   map[string]string
+	serverHost     string
+	serverPort     string
+	serverUser     string
+	serverPassword string
+	serverDatabase string
+)
+
+func mapKeys(data map[string]*Objects) []string {
+	result := []string{}
+	for k := range data {
+		result = append(result, k)
+	}
+	return result
+}
+
+func objectNames(data []Object) []string {
+	names := make([]string, len(data))
+	for i, obj := range data {
+		names[i] = obj.Name
+	}
+
+	sort.Strings(names)
+	return names
+}
+
+// assertMatches is a helper method to check if src slice contains any elements of expected slice
+func assertMatches(t *testing.T, expected, src []string) {
+	assert.NotEqual(t, 0, len(expected))
+	assert.NotEqual(t, 0, len(src))
+
+	for _, val := range expected {
+		assert.Contains(t, src, val)
+	}
+}
+
+func pgVersion() (int, int) {
+	var major, minor int
+	if _, err := fmt.Sscanf(os.Getenv("PGVERSION"), "%d.%d", &major, &minor); err != nil {
+		log.Println("[warn] unable to read value of PGVERSION env var")
+	}
+	return major, minor
+}
+
+func getVar(name, def string) string {
+	val := os.Getenv(name)
+	if val == "" {
+		return def
+	}
+	return val
+}
+
+func initVars() {
+	// We need to load default options to make sure all stuff works
+	if err := command.SetDefaultOptions(); err != nil {
+		log.Fatal(err)
+	}
+
+	serverHost = getVar("PGHOST", "localhost")
+	serverPort = getVar("PGPORT", "5432")
+	serverUser = getVar("PGUSER", "postgres")
+	serverPassword = getVar("PGPASSWORD", "postgres")
+	serverDatabase = getVar("PGDATABASE", "booktown")
+}
+
+func setupCommands() {
+	testCommands = map[string]string{
+		"createdb": "createdb",
+		"psql":     "psql",
+		"dropdb":   "dropdb",
+	}
+
+	if onWindows() {
+		for k, v := range testCommands {
+			testCommands[k] = v + ".exe"
+		}
+	}
+}
+
+func onWindows() bool {
+	return runtime.GOOS == "windows"
+}
+
+func setup() {
+	// No pretty JSON for tests
+	command.Opts.DisablePrettyJSON = true
+
+	out, err := exec.Command(
+		testCommands["createdb"],
+		"-U", serverUser,
+		"-h", serverHost,
+		"-p", serverPort,
+		serverDatabase,
+	).CombinedOutput()
+
+	if err != nil {
+		fmt.Println("Database creation failed:", string(out))
+		fmt.Println("Error:", err)
+		os.Exit(1)
+	}
+
+	out, err = exec.Command(
+		testCommands["psql"],
+		"-U", serverUser,
+		"-h", serverHost,
+		"-p", serverPort,
+		"-f", "../../data/booktown.sql",
+		serverDatabase,
+	).CombinedOutput()
+
+	if err != nil {
+		fmt.Println("Database import failed:", string(out))
+		fmt.Println("Error:", err)
+		os.Exit(1)
+	}
+}
+
+func setupClient() {
+	url := fmt.Sprintf("postgres://%s@%s:%s/%s?sslmode=disable", serverUser, serverHost, serverPort, serverDatabase)
+	testClient, _ = NewFromUrl(url, nil)
+}
+
+func teardownClient() {
+	if testClient != nil {
+		testClient.Close()
+	}
+}
+
+func teardown(t *testing.T, allowFail bool) {
+	output, err := exec.Command(
+		testCommands["dropdb"],
+		"-U", serverUser,
+		"-h", serverHost,
+		"-p", serverPort,
+		serverDatabase,
+	).CombinedOutput()
+
+	if err != nil && strings.Contains(err.Error(), "does not exist") {
+		t.Log("Teardown error:", err)
+		t.Logf("%s\n", output)
+
+		if !allowFail {
+			assert.NoError(t, err)
+		}
+	}
+}
+
+func testNewClientFromURL(t *testing.T) {
+	t.Run("postgres prefix", func(t *testing.T) {
+		url := fmt.Sprintf("postgres://%s@%s:%s/%s?sslmode=disable", serverUser, serverHost, serverPort, serverDatabase)
+		client, err := NewFromUrl(url, nil)
+
+		assert.Equal(t, nil, err)
+		assert.Equal(t, url, client.ConnectionString)
+		assert.NoError(t, client.Close())
+	})
+
+	t.Run("postgresql prefix", func(t *testing.T) {
+		url := fmt.Sprintf("postgresql://%s@%s:%s/%s?sslmode=disable", serverUser, serverHost, serverPort, serverDatabase)
+		client, err := NewFromUrl(url, nil)
+
+		assert.Equal(t, nil, err)
+		assert.Equal(t, url, client.ConnectionString)
+		assert.NoError(t, client.Close())
+	})
+}
+
+func testClientIdleTime(t *testing.T) {
+	examples := map[time.Time]bool{
+		time.Now():                         false, // Current time
+		time.Now().Add(time.Minute * -30):  false, // 30 minutes ago
+		time.Now().Add(time.Minute * -240): true,  // 240 minutes ago
+		time.Now().Add(time.Minute * 30):   false, // 30 minutes in future
+		time.Now().Add(time.Minute * 128):  false, // 128 minutes in future
+	}
+
+	for ts, expected := range examples {
+		testClient.lastQueryTime = ts
+		assert.Equal(t, expected, testClient.IsIdle())
+	}
+}
+
+func testTest(t *testing.T) {
+	examples := []struct {
+		name  string
+		input string
+		err   error
+	}{
+		{
+			name:  "success",
+			input: fmt.Sprintf("postgres://%s@%s:%s/%s?sslmode=disable", serverUser, serverHost, serverPort, serverDatabase),
+			err:   nil,
+		},
+		{
+			name:  "connection refused",
+			input: "postgresql://localhost:5433/dbname",
+			err:   ErrConnectionRefused,
+		},
+		{
+			name:  "invalid user",
+			input: fmt.Sprintf("postgres://%s:%s@%s:%s/%s?sslmode=disable", "foo", serverPassword, serverHost, serverPort, serverDatabase),
+			err:   ErrAuthFailed,
+		},
+		{
+			name:  "invalid password",
+			input: fmt.Sprintf("postgres://%s:%s@%s:%s/%s?sslmode=disable", serverUser, "foo", serverHost, serverPort, serverDatabase),
+			err:   ErrAuthFailed,
+		},
+		{
+			name:  "invalid database",
+			input: fmt.Sprintf("postgres://%s@%s:%s/%s?sslmode=disable", serverUser, serverHost, serverPort, "foo"),
+			err:   ErrDatabaseNotExist,
+		},
+	}
+
+	for _, ex := range examples {
+		t.Run(ex.name, func(t *testing.T) {
+			conn, err := NewFromUrl(ex.input, nil)
+			require.NoError(t, err)
+
+			require.Equal(t, ex.err, conn.Test())
+		})
+	}
+}
+
+func testInfo(t *testing.T) {
+	t.Run("normal", func(t *testing.T) {
+		expected := []string{
+			"session_user",
+			"current_user",
+			"current_database",
+			"current_schemas",
+			"inet_client_addr",
+			"inet_client_port",
+			"inet_server_addr",
+			"inet_server_port",
+			"version",
+		}
+
+		res, err := testClient.Info()
+		assert.NoError(t, err)
+		assert.Equal(t, expected, res.Columns)
+	})
+
+	t.Run("with restrictions", func(t *testing.T) {
+		expected := []string{
+			"session_user",
+			"current_user",
+			"current_database",
+			"current_schemas",
+			"version",
+		}
+
+		// Prepare a new user and database
+		testClient.db.MustExec("DROP DATABASE IF EXISTS testdb")
+		testClient.db.Exec("DROP OWNED BY IF EXISTS testuser") //nolint:all
+		testClient.db.MustExec("DROP ROLE IF EXISTS testuser")
+		testClient.db.MustExec("CREATE ROLE testuser WITH PASSWORD 'secret' LOGIN NOSUPERUSER NOINHERIT")
+		testClient.db.MustExec("CREATE DATABASE testdb OWNER testuser")
+
+		// Disable access to inet_ calls for new user
+		url := fmt.Sprintf("postgres://%s:@%s:%s/testdb?sslmode=disable", serverUser, serverHost, serverPort)
+		client, err := NewFromUrl(url, nil)
+		assert.NoError(t, err)
+		client.db.MustExec("REVOKE EXECUTE ON FUNCTION inet_client_addr() FROM PUBLIC")
+		assert.NoError(t, client.Close())
+
+		// Connect using new user
+		url = fmt.Sprintf("postgres://testuser:secret@%s:%s/testdb?sslmode=disable", serverHost, serverPort)
+		client, err = NewFromUrl(url, nil)
+		assert.NoError(t, err)
+		defer client.Close()
+
+		res, err := client.Info()
+		assert.NoError(t, err)
+		assert.Equal(t, expected, res.Columns)
+	})
+}
+
+func testActivity(t *testing.T) {
+	expected := []string{"datid", "pid", "query", "query_start", "state", "client_addr"}
+
+	res, err := testClient.Activity()
+	assert.NoError(t, err)
+	assertMatches(t, expected, res.Columns)
+}
+
+func testDatabases(t *testing.T) {
+	res, err := testClient.Databases()
+	assert.NoError(t, err)
+	assertMatches(t, []string{"booktown", "postgres"}, res)
+}
+
+func testSchemas(t *testing.T) {
+	res, err := testClient.Schemas()
+	assert.NoError(t, err)
+	assert.Equal(t, []string{"public"}, res)
+}
+
+func testObjects(t *testing.T) {
+	res, err := testClient.Objects()
+	objects := ObjectsFromResult(res)
+
+	tables := []string{
+		"alternate_stock",
+		"authors",
+		"book_backup",
+		"book_queue",
+		"books",
+		"customers",
+		"daily_inventory",
+		"distinguished_authors",
+		"dummies",
+		"editions",
+		"employees",
+		"favorite_authors",
+		"favorite_books",
+		"money_example",
+		"my_list",
+		"numeric_values",
+		"publishers",
+		"schedules",
+		"shipments",
+		"states",
+		"stock",
+		"stock_backup",
+		"subjects",
+		"text_sorting",
+	}
+
+	functions := []string{
+		"add_shipment",
+		"add_two_loop",
+		"books_by_subject",
+		"compound_word",
+		"count_by_two",
+		"double_price",
+		"extract_all_titles",
+		"extract_all_titles2",
+		"extract_title",
+		"first",
+		"get_author",
+		"get_author",
+		"get_customer_id",
+		"get_customer_name",
+		"html_linebreaks",
+		"in_stock",
+		"isbn_to_title",
+		"mixed",
+		"raise_test",
+		"ship_item",
+		"stock_amount",
+		"test",
+		"title",
+		"triple_price",
+	}
+
+	assert.NoError(t, err)
+	assert.Equal(t, []string{"oid", "schema", "name", "type", "owner", "comment"}, res.Columns)
+	assert.Equal(t, []string{"public"}, mapKeys(objects))
+	assert.Equal(t, tables, objectNames(objects["public"].Tables))
+	assertMatches(t, functions, objectNames(objects["public"].Functions))
+	assert.Equal(t, []string{"recent_shipments", "stock_view"}, objectNames(objects["public"].Views))
+	assert.Equal(t, []string{"author_ids", "book_ids", "shipments_ship_id_seq", "subject_ids"}, objectNames(objects["public"].Sequences))
+
+	major, minor := pgVersion()
+	if minor == 0 || minor >= 3 {
+		assert.Equal(t, []string{"m_stock_view"}, objectNames(objects["public"].MaterializedViews))
+	} else {
+		t.Logf("Skipping materialized view on %d.%d\n", major, minor)
+	}
+}
+
+func testTable(t *testing.T) {
+	columns := []string{
+		"column_name",
+		"data_type",
+		"is_nullable",
+		"character_maximum_length",
+		"character_set_catalog",
+		"column_default",
+		"comment",
+	}
+
+	res, err := testClient.Table("books")
+	assert.NoError(t, err)
+	assert.Equal(t, columns, res.Columns)
+	assert.Equal(t, 4, len(res.Rows))
+}
+
+func testTableRows(t *testing.T) {
+	res, err := testClient.TableRows("books", RowsOptions{})
+	assert.NoError(t, err)
+	assert.Equal(t, 4, len(res.Columns))
+	assert.Equal(t, 15, len(res.Rows))
+}
+
+func testTableInfo(t *testing.T) {
+	res, err := testClient.TableInfo("books")
+	assert.NoError(t, err)
+	assert.Equal(t, 4, len(res.Columns))
+	assert.Equal(t, 1, len(res.Rows))
+}
+
+func testEstimatedTableRowsCount(t *testing.T) {
+	res, err := testClient.EstimatedTableRowsCount("books", RowsOptions{})
+	assert.NoError(t, err)
+	assert.Equal(t, []string{"reltuples"}, res.Columns)
+	assert.Equal(t, []Row{{int64(15)}}, res.Rows)
+}
+
+func testTableRowsCount(t *testing.T) {
+	res, err := testClient.TableRowsCount("books", RowsOptions{})
+	assert.NoError(t, err)
+	assert.Equal(t, []string{"count"}, res.Columns)
+	assert.Equal(t, []Row{{int64(15)}}, res.Rows)
+}
+
+func testTableRowsCountWithLargeTable(t *testing.T) {
+	testClient.db.MustExec(`CREATE TABLE large_table AS SELECT s FROM generate_series(1,1000000) s;`)
+	testClient.db.MustExec(`VACUUM large_table;`)
+
+	res, err := testClient.TableRowsCount("large_table", RowsOptions{})
+	assert.Equal(t, nil, err)
+	assert.Equal(t, []string{"reltuples"}, res.Columns)
+	assert.Equal(t, []Row{{int64(1000000)}}, res.Rows)
+}
+
+func testTableIndexes(t *testing.T) {
+	res, err := testClient.TableIndexes("books")
+	assert.NoError(t, err)
+	assert.Equal(t, []string{"index_name", "index_size", "index_definition"}, res.Columns)
+	assert.Equal(t, 2, len(res.Rows))
+}
+
+func testTableConstraints(t *testing.T) {
+	res, err := testClient.TableConstraints("editions")
+	assert.NoError(t, err)
+	assert.Equal(t, []string{"name", "definition"}, res.Columns)
+	assert.Equal(t, Row{"pkey", "PRIMARY KEY (isbn)"}, res.Rows[0])
+	assert.Equal(t, Row{"integrity", "CHECK (book_id IS NOT NULL AND edition IS NOT NULL)"}, res.Rows[1])
+}
+
+func testTableNameWithCamelCase(t *testing.T) {
+	testClient.db.MustExec(`CREATE TABLE "exampleTable" (id int, name varchar);`)
+	testClient.db.MustExec(`INSERT INTO "exampleTable" (id, name) VALUES (1, 'foo'), (2, 'bar');`)
+
+	_, err := testClient.Table("exampleTable")
+	assert.NoError(t, err)
+
+	_, err = testClient.TableInfo("exampleTable")
+	assert.NoError(t, err)
+
+	_, err = testClient.TableConstraints("exampleTable")
+	assert.NoError(t, err)
+
+	_, err = testClient.TableIndexes("exampleTable")
+	assert.NoError(t, err)
+
+	_, err = testClient.TableRowsCount("exampleTable", RowsOptions{})
+	assert.NoError(t, err)
+
+	_, err = testClient.EstimatedTableRowsCount("exampleTable", RowsOptions{})
+	assert.NoError(t, err)
+}
+
+func testQuery(t *testing.T) {
+	t.Run("basic query", func(t *testing.T) {
+		res, err := testClient.Query("SELECT * FROM books")
+		assert.NoError(t, err)
+		assert.Equal(t, 4, len(res.Columns))
+		assert.Equal(t, 15, len(res.Rows))
+	})
+
+	t.Run("error", func(t *testing.T) {
+		res, err := testClient.Query("SELCT * FROM books")
+		assert.NotNil(t, err)
+		assert.Equal(t, "pq: syntax error at or near \"SELCT\"", err.Error())
+		assert.Nil(t, res)
+	})
+
+	t.Run("invalid table", func(t *testing.T) {
+		res, err := testClient.Query("SELECT * FROM books2")
+		assert.NotNil(t, err)
+		assert.Equal(t, "pq: relation \"books2\" does not exist", err.Error())
+		assert.Nil(t, res)
+	})
+
+	t.Run("timeout", func(t *testing.T) {
+		testClient.queryTimeout = time.Millisecond * 100
+		defer func() {
+			testClient.queryTimeout = 0
+		}()
+
+		res, err := testClient.query("SELECT pg_sleep(1);")
+		assert.Equal(t, "pq: canceling statement due to user request", err.Error())
+		assert.Nil(t, res)
+	})
+}
+
+func testUpdateQuery(t *testing.T) {
+	t.Run("updating data", func(t *testing.T) {
+		// Add new row
+		testClient.db.MustExec("INSERT INTO books (id, title) VALUES (8888, 'Test Book'), (8889, 'Test Book 2')")
+
+		// Update without return values
+		res, err := testClient.Query("UPDATE books SET title = 'Foo' WHERE id >= 8888 AND id <= 8889")
+		assert.NoError(t, err)
+		assert.Equal(t, "Rows Affected", res.Columns[0])
+		assert.Equal(t, int64(2), res.Rows[0][0])
+
+		// Update with return values
+		res, err = testClient.Query("UPDATE books SET title = 'Foo2' WHERE id >= 8888 AND id <= 8889 RETURNING id, title")
+		assert.NoError(t, err)
+		assert.Equal(t, []string{"id", "title"}, res.Columns)
+		assert.Equal(t, Row{int64(8888), "Foo2"}, res.Rows[0])
+		assert.Equal(t, Row{int64(8889), "Foo2"}, res.Rows[1])
+	})
+
+	t.Run("deleting data", func(t *testing.T) {
+		// Add new row
+		testClient.db.MustExec("INSERT INTO books (id, title) VALUES (9999, 'Test Book')")
+
+		// Delete the existing row
+		res, err := testClient.Query("DELETE FROM books WHERE id = 9999")
+		assert.NoError(t, err)
+		assert.Equal(t, "Rows Affected", res.Columns[0])
+		assert.Equal(t, int64(1), res.Rows[0][0])
+
+		// Deleting already deleted row
+		res, err = testClient.Query("DELETE FROM books WHERE id = 9999")
+		assert.NoError(t, err)
+		assert.Equal(t, int64(0), res.Rows[0][0])
+
+		// Delete with returning value
+		testClient.db.MustExec("INSERT INTO books (id, title) VALUES (9999, 'Test Book')")
+
+		res, err = testClient.Query("DELETE FROM books WHERE id = 9999 RETURNING id")
+		assert.NoError(t, err)
+		assert.Equal(t, int64(9999), res.Rows[0][0])
+	})
+}
+
+func testTableRowsOrderEscape(t *testing.T) {
+	rows, err := testClient.TableRows("dummies", RowsOptions{SortColumn: "isDummy"})
+	assert.NoError(t, err)
+	assert.Equal(t, 2, len(rows.Rows))
+
+	rows, err = testClient.TableRows("dummies", RowsOptions{SortColumn: "isdummy"})
+	assert.NotNil(t, err)
+	assert.Equal(t, `pq: column "isdummy" does not exist`, err.Error())
+	assert.Nil(t, rows)
+}
+
+func testFunctions(t *testing.T) {
+	funcName := "get_customer_name"
+	funcID := ""
+
+	res, err := testClient.Objects()
+	assert.NoError(t, err)
+
+	for _, row := range res.Rows {
+		if row[2] == funcName {
+			funcID = row[0].(string)
+			break
+		}
+	}
+
+	res, err = testClient.Function("12345")
+	assert.NoError(t, err)
+	assertMatches(t, []string{"oid", "proname", "functiondef"}, res.Columns)
+	assert.Equal(t, 0, len(res.Rows))
+
+	res, err = testClient.Function(funcID)
+	assert.NoError(t, err)
+	assertMatches(t, []string{"oid", "proname", "functiondef"}, res.Columns)
+	assert.Equal(t, 1, len(res.Rows))
+	assert.Equal(t, funcName, res.Rows[0][1])
+	assert.Contains(t, res.Rows[0][len(res.Columns)-1], "SELECT INTO customer_fname, customer_lname")
+}
+
+func testResult(t *testing.T) {
+	t.Run("json", func(t *testing.T) {
+		result, err := testClient.Query("SELECT * FROM books LIMIT 1")
+		assert.NoError(t, err)
+		assert.Equal(t, `[{"author_id":4156,"id":7808,"subject_id":9,"title":"The Shining"}]`, string(result.JSON()))
+
+		result, err = testClient.Query("SELECT 'NaN'::float AS value;")
+		assert.NoError(t, err)
+		assert.Equal(t, `[{"value":null}]`, string(result.JSON()))
+	})
+
+	t.Run("csv", func(t *testing.T) {
+		expected := "id,title,author_id,subject_id\n156,The Tell-Tale Heart,115,9\n"
+
+		res, err := testClient.Query("SELECT * FROM books ORDER BY id ASC LIMIT 1")
+		assert.NoError(t, err)
+		assert.Equal(t, expected, string(res.CSV()))
+	})
+}
+
+func testHistory(t *testing.T) {
+	t.Run("success", func(t *testing.T) {
+		_, err := testClient.Query("SELECT * FROM books WHERE id = 12345")
+		query := testClient.History[len(testClient.History)-1].Query
+		assert.NoError(t, err)
+		assert.Equal(t, "SELECT * FROM books WHERE id = 12345", query)
+	})
+
+	t.Run("failed query", func(t *testing.T) {
+		_, err := testClient.Query("SELECT * FROM books123")
+		query := testClient.History[len(testClient.History)-1].Query
+		assert.NotNil(t, err)
+		assert.NotEqual(t, "SELECT * FROM books123", query)
+	})
+
+	t.Run("unique queries", func(t *testing.T) {
+		url := fmt.Sprintf("postgres://%s@%s:%s/%s?sslmode=disable", serverUser, serverHost, serverPort, serverDatabase)
+
+		client, _ := NewFromUrl(url, nil)
+		defer client.Close()
+
+		for i := 0; i < 3; i++ {
+			_, err := client.Query("SELECT * FROM books WHERE id = 1")
+			assert.NoError(t, err)
+		}
+
+		assert.Equal(t, 1, len(client.History))
+		assert.Equal(t, "SELECT * FROM books WHERE id = 1", client.History[0].Query)
+	})
+}
+
+func testReadOnlyMode(t *testing.T) {
+	command.Opts.ReadOnly = true
+	defer func() {
+		command.Opts.ReadOnly = false
+	}()
+
+	url := fmt.Sprintf("postgres://%s@%s:%s/%s?sslmode=disable", serverUser, serverHost, serverPort, serverDatabase)
+	client, _ := NewFromUrl(url, nil)
+	defer client.Close()
+
+	err := client.SetReadOnlyMode()
+	assert.NoError(t, err)
+
+	_, err = client.Query("\nCREATE TABLE foobar(id integer);\n")
+	assert.NotNil(t, err)
+	assert.Error(t, err, "query contains keywords not allowed in read-only mode")
+
+	// Turn off guard
+	_, err = client.db.Exec("SET default_transaction_read_only=off;")
+	assert.NoError(t, err)
+
+	_, err = client.Query("\nCREATE TABLE foobar(id integer);\n")
+	assert.NotNil(t, err)
+	assert.Contains(t, err.Error(), "query contains keywords not allowed in read-only mode")
+
+	_, err = client.Query("-- CREATE TABLE foobar(id integer);\nSELECT 'foo';")
+	assert.NoError(t, err)
+
+	_, err = client.Query("/* CREATE TABLE foobar(id integer); */ SELECT 'foo';")
+	assert.NoError(t, err)
+
+	t.Run("with local readonly flag", func(t *testing.T) {
+		command.Opts.ReadOnly = false
+		client.readonly = true
+
+		_, err := client.Query("INSERT INTO foobar(id) VALUES(1)")
+		assert.Error(t, err, "query contains keywords not allowed in read-only mode")
+	})
+}
+
+func testTablesStats(t *testing.T) {
+	columns := []string{
+		"schema_name",
+		"table_name",
+		"total_size",
+		"data_size",
+		"index_size",
+		"estimated_rows_count",
+		"estimated_rows",
+		"index_to_data_ratio",
+		"indexes_count",
+		"columns_count",
+	}
+
+	result, err := testClient.TablesStats()
+	assert.NoError(t, err)
+	assert.Equal(t, columns, result.Columns)
+}
+
+func testConnContext(t *testing.T) {
+	result, err := testClient.GetConnContext()
+	assert.NoError(t, err)
+	assert.Equal(t, "localhost", result.Host)
+	assert.Equal(t, "postgres", result.User)
+	assert.Equal(t, "booktown", result.Database)
+	assert.Equal(t, "default", result.Mode)
+}
+
+func testServerSettings(t *testing.T) {
+	expectedColumns := []string{
+		"name",
+		"setting",
+		"unit",
+		"category",
+		"short_desc",
+		"extra_desc",
+		"context",
+		"vartype",
+		"source",
+		"min_val",
+		"max_val",
+		"enumvals",
+		"boot_val",
+		"reset_val",
+		"sourcefile",
+		"sourceline",
+		"pending_restart",
+	}
+
+	result, err := testClient.ServerSettings()
+	assert.NoError(t, err)
+	assert.Equal(t, expectedColumns, result.Columns)
+}
+
+func TestAll(t *testing.T) {
+	if onWindows() {
+		t.Log("Unit testing on Windows platform is not supported.")
+		return
+	}
+
+	initVars()
+	setupCommands()
+	teardown(t, false)
+	setup()
+	setupClient()
+
+	testNewClientFromURL(t)
+	testClientIdleTime(t)
+	testTest(t)
+	testInfo(t)
+	testActivity(t)
+	testDatabases(t)
+	testSchemas(t)
+	testObjects(t)
+	testTable(t)
+	testTableRows(t)
+	testTableInfo(t)
+	testEstimatedTableRowsCount(t)
+	testTableRowsCount(t)
+	testTableRowsCountWithLargeTable(t)
+	testTableIndexes(t)
+	testTableConstraints(t)
+	testTableNameWithCamelCase(t)
+	testQuery(t)
+	testUpdateQuery(t)
+	testTableRowsOrderEscape(t)
+	testFunctions(t)
+	testResult(t)
+	testHistory(t)
+	testReadOnlyMode(t)
+	testDumpExport(t)
+	testTablesStats(t)
+	testConnContext(t)
+	testServerSettings(t)
+
+	teardownClient()
+	teardown(t, true)
+}

pkg/client/codec.go

@@ -0,0 +1,45 @@
+package client
+
+import (
+	"encoding/base64"
+	"encoding/hex"
+	"fmt"
+
+	"github.com/mr-tron/base58"
+)
+
+const (
+	CodecNone   = "none"
+	CodecHex    = "hex"
+	CodecBase58 = "base58"
+	CodecBase64 = "base64"
+)
+
+var (
+	// BinaryCodec sets the serialization format of binary data
+	BinaryCodec = CodecBase64
+)
+
+func SetBinaryCodec(codec string) error {
+	switch codec {
+	case CodecNone, CodecHex, CodecBase58, CodecBase64:
+		BinaryCodec = codec
+	default:
+		return fmt.Errorf("invalid binary codec: %v", codec)
+	}
+
+	return nil
+}
+
+func encodeBinaryData(data []byte, codec string) string {
+	switch codec {
+	case CodecHex:
+		return hex.EncodeToString(data)
+	case CodecBase58:
+		return base58.Encode(data)
+	case CodecBase64:
+		return base64.StdEncoding.EncodeToString(data)
+	default:
+		return string(data)
+	}
+}

pkg/client/codec_test.go

@@ -0,0 +1,51 @@
+package client
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSetBinaryCodec(t *testing.T) {
+	examples := []struct {
+		input string
+		err   error
+	}{
+		{input: CodecNone, err: nil},
+		{input: CodecBase58, err: nil},
+		{input: CodecBase64, err: nil},
+		{input: CodecHex, err: nil},
+		{input: "foobar", err: errors.New("invalid binary codec: foobar")},
+	}
+
+	for _, ex := range examples {
+		t.Run(ex.input, func(t *testing.T) {
+			val := BinaryCodec
+			defer func() {
+				BinaryCodec = val
+			}()
+
+			assert.Equal(t, ex.err, SetBinaryCodec(ex.input))
+		})
+	}
+}
+
+func Test_encodeBinaryData(t *testing.T) {
+	examples := []struct {
+		input    string
+		expected string
+		encoding string
+	}{
+		{input: "hello world", expected: "hello world", encoding: CodecNone},
+		{input: "hello world", expected: "StV1DL6CwTryKyV", encoding: CodecBase58},
+		{input: "hello world", expected: "aGVsbG8gd29ybGQ=", encoding: CodecBase64},
+		{input: "hello world", expected: "68656c6c6f20776f726c64", encoding: CodecHex},
+	}
+
+	for _, ex := range examples {
+		t.Run(ex.input, func(t *testing.T) {
+			assert.Equal(t, ex.expected, encodeBinaryData([]byte(ex.input), ex.encoding))
+		})
+	}
+}

pkg/client/dump.go

@@ -0,0 +1,93 @@
+package client
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net/url"
+	"os/exec"
+	"strings"
+)
+
+var (
+	unsupportedDumpOptions = []string{
+		"search_path",
+	}
+)
+
+// Dump represents a database dump
+type Dump struct {
+	Table string
+}
+
+// Validate checks availability and version of pg_dump CLI
+func (d *Dump) Validate(serverVersion string) error {
+	out := bytes.NewBuffer(nil)
+
+	cmd := exec.Command("pg_dump", "--version")
+	cmd.Stdout = out
+	cmd.Stderr = out
+
+	if err := cmd.Run(); err != nil {
+		return fmt.Errorf("pg_dump command failed: %s", out.Bytes())
+	}
+
+	detected, dumpVersion := detectDumpVersion(out.String())
+	if detected && serverVersion != "" {
+		satisfied := checkVersionRequirement(dumpVersion, serverVersion)
+		if !satisfied {
+			return fmt.Errorf("pg_dump version %v not compatible with server version %v", dumpVersion, serverVersion)
+		}
+	}
+
+	return nil
+}
+
+// Export streams the database dump to the specified writer
+func (d *Dump) Export(ctx context.Context, connstr string, writer io.Writer) error {
+	if str, err := removeUnsupportedOptions(connstr); err != nil {
+		return err
+	} else {
+		connstr = str
+	}
+
+	opts := []string{
+		"--no-owner",      // skip restoration of object ownership in plain-text format
+		"--clean",         // clean (drop) database objects before recreating
+		"--compress", "6", // compression level for compressed formats
+	}
+
+	if d.Table != "" {
+		opts = append(opts, []string{"--table", d.Table}...)
+	}
+
+	opts = append(opts, connstr)
+	errOutput := bytes.NewBuffer(nil)
+
+	cmd := exec.CommandContext(ctx, "pg_dump", opts...)
+	cmd.Stdout = writer
+	cmd.Stderr = errOutput
+
+	if err := cmd.Run(); err != nil {
+		return fmt.Errorf("error: %s. output: %s", err.Error(), errOutput.Bytes())
+	}
+	return nil
+}
+
+// removeUnsupportedOptions removes any options unsupported for making a db dump
+func removeUnsupportedOptions(input string) (string, error) {
+	uri, err := url.Parse(input)
+	if err != nil {
+		return "", err
+	}
+
+	q := uri.Query()
+	for _, opt := range unsupportedDumpOptions {
+		q.Del(opt)
+		q.Del(strings.ToUpper(opt))
+	}
+	uri.RawQuery = q.Encode()
+
+	return uri.String(), nil
+}

pkg/client/dump_test.go

@@ -0,0 +1,55 @@
+package client
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func testDumpExport(t *testing.T) {
+	url := fmt.Sprintf("postgres://%s@%s:%s/%s?sslmode=disable", serverUser, serverHost, serverPort, serverDatabase)
+
+	savePath := "/tmp/dump.sql.gz"
+	os.Remove(savePath)
+
+	saveFile, err := os.Create(savePath)
+	if err != nil {
+		t.Fatal(err.Error())
+	}
+
+	defer func() {
+		saveFile.Close()
+		os.Remove(savePath)
+	}()
+
+	dump := Dump{}
+
+	// Test for pg_dump presence
+	assert.NoError(t, dump.Validate("10.0"))
+	assert.NoError(t, dump.Validate(""))
+	assert.Contains(t, dump.Validate("20").Error(), "not compatible with server version 20")
+
+	// Test full db dump
+	err = dump.Export(context.Background(), url, saveFile)
+	assert.NoError(t, err)
+
+	// Test nonexistent database
+	invalidURL := fmt.Sprintf("postgres://%s@%s:%s/%s?sslmode=disable", serverUser, serverHost, serverPort, "foobar")
+	err = dump.Export(context.Background(), invalidURL, saveFile)
+	assert.Contains(t, err.Error(), `database "foobar" does not exist`)
+
+	// Test dump of non existent db
+	dump = Dump{Table: "foobar"}
+	err = dump.Export(context.Background(), url, saveFile)
+	assert.NotNil(t, err)
+	assert.Contains(t, err.Error(), "no matching tables were found")
+
+	// Should drop "search_path" param from URI
+	dump = Dump{}
+	searchPathURL := fmt.Sprintf("postgres://%s@%s:%s/%s?sslmode=disable&search_path=private", serverUser, serverHost, serverPort, serverDatabase)
+	err = dump.Export(context.Background(), searchPathURL, saveFile)
+	assert.NoError(t, err)
+}

pkg/client/result.go

@@ -0,0 +1,212 @@
+package client
+
+import (
+	"bytes"
+	"encoding/csv"
+	"encoding/json"
+	"fmt"
+	"log"
+	"math"
+	"strconv"
+	"time"
+
+	"github.com/sosedoff/pgweb/pkg/command"
+)
+
+const (
+	ObjTypeTable            = "table"
+	ObjTypeView             = "view"
+	ObjTypeMaterializedView = "materialized_view"
+	ObjTypeSequence         = "sequence"
+	ObjTypeFunction         = "function"
+)
+
+type (
+	// Row represents a single row of data
+	Row []interface{}
+
+	// RowsOptions contains a list of parameters for table browsing requests
+	RowsOptions struct {
+		Where      string // Custom filter
+		Offset     int    // Number of rows to skip
+		Limit      int    // Number of rows to fetch
+		SortColumn string // Column to sort by
+		SortOrder  string // Sort direction (ASC, DESC)
+	}
+
+	Pagination struct {
+		Rows    int64 `json:"rows_count"`
+		Page    int64 `json:"page"`
+		Pages   int64 `json:"pages_count"`
+		PerPage int64 `json:"per_page"`
+	}
+
+	Result struct {
+		Pagination *Pagination  `json:"pagination,omitempty"`
+		Columns    []string     `json:"columns"`
+		Rows       []Row        `json:"rows"`
+		Stats      *ResultStats `json:"stats,omitempty"`
+	}
+
+	ResultStats struct {
+		ColumnsCount    int       `json:"columns_count"`
+		RowsCount       int       `json:"rows_count"`
+		RowsAffected    int64     `json:"rows_affected"`
+		QueryStartTime  time.Time `json:"query_start_time"`
+		QueryFinishTime time.Time `json:"query_finish_time"`
+		QueryDuration   int64     `json:"query_duration_ms"`
+	}
+
+	Object struct {
+		OID  string `json:"oid"`
+		Name string `json:"name"`
+	}
+
+	Objects struct {
+		Tables            []Object `json:"table"`
+		Views             []Object `json:"view"`
+		MaterializedViews []Object `json:"materialized_view"`
+		Functions         []Object `json:"function"`
+		Sequences         []Object `json:"sequence"`
+	}
+)
+
+// Due to big int number limitations in javascript, numbers should be encoded
+// as strings so they could be properly loaded on the frontend.
+func (res *Result) PostProcess() {
+	for i, row := range res.Rows {
+		for j, col := range row {
+			if col == nil {
+				continue
+			}
+
+			switch val := col.(type) {
+			case int64:
+				if val < -9007199254740991 || val > 9007199254740991 {
+					res.Rows[i][j] = strconv.FormatInt(col.(int64), 10)
+				}
+			case float64:
+				// json.Marshal panics when dealing with NaN/Inf values
+				// issue: https://github.com/golang/go/issues/25721
+				if math.IsNaN(val) {
+					res.Rows[i][j] = nil
+					break
+				}
+
+				if val < -999999999999999 || val > 999999999999999 {
+					res.Rows[i][j] = strconv.FormatFloat(val, 'e', -1, 64)
+				}
+			case string:
+				if hasBinary(val, 8) && BinaryCodec != CodecNone {
+					res.Rows[i][j] = encodeBinaryData([]byte(val), BinaryCodec)
+				}
+			case time.Time:
+				// RFC 3339 is clear that years are 4 digits exactly.
+				// See golang.org/issue/4556#c15 for more discussion.
+				if val.Year() < 0 || val.Year() >= 10000 {
+					res.Rows[i][j] = "ERR: INVALID_DATE"
+				} else {
+					res.Rows[i][j] = val
+				}
+			}
+		}
+	}
+}
+
+func (res *Result) Format() []map[string]interface{} {
+	items := make([]map[string]interface{}, len(res.Rows))
+
+	for rowIdx, row := range res.Rows {
+		item := make(map[string]interface{})
+		for i, c := range res.Columns {
+			item[c] = row[i]
+		}
+
+		items[rowIdx] = item
+	}
+
+	return items
+}
+
+func (res *Result) CSV() []byte {
+	buff := &bytes.Buffer{}
+	writer := csv.NewWriter(buff)
+
+	if err := writer.Write(res.Columns); err != nil {
+		log.Printf("result csv write error: %v\n", err)
+	}
+
+	for _, row := range res.Rows {
+		record := make([]string, len(res.Columns))
+
+		for i, item := range row {
+			switch v := item.(type) {
+			case time.Time:
+				record[i] = v.Format("2006-01-02 15:04:05")
+			case nil:
+				record[i] = ""
+			default:
+				record[i] = fmt.Sprintf("%v", item)
+			}
+		}
+
+		err := writer.Write(record)
+		if err != nil {
+			fmt.Println(err)
+			break
+		}
+	}
+
+	writer.Flush()
+	return buff.Bytes()
+}
+
+func (res *Result) JSON() []byte {
+	var data []byte
+
+	if command.Opts.DisablePrettyJSON {
+		data, _ = json.Marshal(res.Format())
+	} else {
+		data, _ = json.MarshalIndent(res.Format(), "", " ")
+	}
+
+	return data
+}
+
+func ObjectsFromResult(res *Result) map[string]*Objects {
+	objects := map[string]*Objects{}
+
+	for _, row := range res.Rows {
+		oid := row[0].(string)
+		schema := row[1].(string)
+		name := row[2].(string)
+		objectType := row[3].(string)
+
+		if objects[schema] == nil {
+			objects[schema] = &Objects{
+				Tables:            []Object{},
+				Views:             []Object{},
+				MaterializedViews: []Object{},
+				Functions:         []Object{},
+				Sequences:         []Object{},
+			}
+		}
+
+		obj := Object{OID: oid, Name: name}
+
+		switch objectType {
+		case ObjTypeTable:
+			objects[schema].Tables = append(objects[schema].Tables, obj)
+		case ObjTypeView:
+			objects[schema].Views = append(objects[schema].Views, obj)
+		case ObjTypeMaterializedView:
+			objects[schema].MaterializedViews = append(objects[schema].MaterializedViews, obj)
+		case ObjTypeFunction:
+			objects[schema].Functions = append(objects[schema].Functions, obj)
+		case ObjTypeSequence:
+			objects[schema].Sequences = append(objects[schema].Sequences, obj)
+		}
+	}
+
+	return objects
+}

pkg/client/result_test.go

@@ -0,0 +1,139 @@
+package client
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/sosedoff/pgweb/pkg/command"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPostProcess(t *testing.T) {
+	t.Run("large numbers", func(t *testing.T) {
+		result := Result{
+			Columns: []string{"value"},
+			Rows: []Row{
+				{int(1234)},
+				{int64(9223372036854775807)},
+				{int64(-9223372036854775808)},
+				{float64(9223372036854775808.9223372036854775808)},
+				{float64(999999999999999.9)},
+			},
+		}
+
+		result.PostProcess()
+
+		assert.Equal(t, 1234, result.Rows[0][0])
+		assert.Equal(t, "9223372036854775807", result.Rows[1][0])
+		assert.Equal(t, "-9223372036854775808", result.Rows[2][0])
+		assert.Equal(t, "9.223372036854776e+18", result.Rows[3][0])
+		assert.Equal(t, "9.999999999999999e+14", result.Rows[4][0])
+	})
+
+	t.Run("binary encoding", func(t *testing.T) {
+		result := Result{
+			Columns: []string{"data"},
+			Rows: []Row{
+				{"text value"},
+				{"text with symbols !@#$%"},
+				{string([]byte{10, 11, 12, 13})},
+			},
+		}
+
+		result.PostProcess()
+
+		assert.Equal(t, "text value", result.Rows[0][0])
+		assert.Equal(t, "text with symbols !@#$%", result.Rows[1][0])
+		assert.Equal(t, "CgsMDQ==", result.Rows[2][0])
+	})
+}
+
+func TestCSV(t *testing.T) {
+	result := Result{
+		Columns: []string{"id", "name", "email", "extra"},
+		Rows: []Row{
+			{1, "John", "john@example.com", "data"},
+			{2, "Bob", "bob@example.com", nil},
+		},
+	}
+
+	expected := strings.Join([]string{
+		"id,name,email,extra",
+		"1,John,john@example.com,data",
+		"2,Bob,bob@example.com,",
+	}, "\n") + "\n"
+
+	assert.Equal(t, expected, string(result.CSV()))
+}
+
+func TestJSON(t *testing.T) {
+	result := Result{
+		Columns: []string{"id", "name", "email"},
+		Rows: []Row{
+			{1, "John", "john@example.com"},
+			{2, "Bob", "bob@example.com"},
+		},
+	}
+
+	obj := []struct {
+		Id    int
+		Name  string
+		Email string
+	}{}
+
+	expected := []struct {
+		Id    int
+		Name  string
+		Email string
+	}{
+		{1, "John", "john@example.com"},
+		{2, "Bob", "bob@example.com"},
+	}
+
+	assert.NoError(t, json.Unmarshal(result.JSON(), &obj))
+	assert.Equal(t, 2, len(obj))
+	assert.Equal(t, expected, obj)
+
+	t.Run("invalid time", func(t *testing.T) {
+		loc, err := time.LoadLocation("UTC")
+		if err != nil {
+			panic(err)
+		}
+
+		command.Opts.DisablePrettyJSON = true
+		defer func() {
+			command.Opts.DisablePrettyJSON = false
+		}()
+
+		result := Result{
+			Columns: []string{"value"},
+			Rows: []Row{
+				{time.Unix(1640995200, 0).In(loc)},
+				{time.Unix(222539616000, 0).In(loc)},
+				{time.Unix(254096611200, 0).In(loc)},
+			},
+		}
+
+		result.PostProcess()
+		assert.Equal(t, `[{"value":"2022-01-01T00:00:00Z"},{"value":"9022-01-01T00:00:00Z"},{"value":"ERR: INVALID_DATE"}]`, string(result.JSON()))
+	})
+}
+
+func TestResultFormat(t *testing.T) {
+	result := Result{
+		Columns: []string{"col1", "col2", "col3", "col4"},
+		Rows: []Row{
+			{"1", "2", "3", nil},
+			{"4", "5", "6", nil},
+		},
+	}
+
+	expected := []map[string]interface{}{
+		{"col1": "1", "col2": "2", "col3": "3", "col4": nil},
+		{"col1": "4", "col2": "5", "col3": "6", "col4": nil},
+	}
+
+	assert.Equal(t, expected, result.Format())
+}

pkg/client/tunnel.go

@@ -0,0 +1,219 @@
+package client
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/ScaleFT/sshkeys"
+	"golang.org/x/crypto/ssh"
+
+	"github.com/sosedoff/pgweb/pkg/connection"
+	"github.com/sosedoff/pgweb/pkg/shared"
+)
+
+const (
+	portStart = 29168
+	portLimit = 500
+)
+
+// Tunnel represents the connection between local and remote server
+type Tunnel struct {
+	TargetHost string
+	TargetPort string
+	Port       int
+	SSHInfo    *shared.SSHInfo
+	Config     *ssh.ClientConfig
+	Client     *ssh.Client
+	Listener   *net.TCPListener
+}
+
+func defaultKeyPath() string {
+	return filepath.Join(os.Getenv("HOME"), ".ssh/id_rsa")
+}
+
+func expandKeyPath(path string) string {
+	home := os.Getenv("HOME")
+	if home == "" {
+		return path
+	}
+	return strings.Replace(path, "~", home, 1)
+}
+
+func fileExists(path string) bool {
+	_, err := os.Stat(path)
+	return err == nil
+}
+
+func parsePrivateKey(keyPath string, keyPass string) (ssh.Signer, error) {
+	buff, err := os.ReadFile(keyPath)
+	if err != nil {
+		return nil, err
+	}
+
+	signer, err := ssh.ParsePrivateKey(buff)
+	if _, ok := err.(*ssh.PassphraseMissingError); ok {
+		if keyPass == "" {
+			return nil, errors.New("ssh key password is not provided")
+		}
+		return sshkeys.ParseEncryptedPrivateKey(buff, []byte(keyPass))
+	}
+
+	return signer, err
+}
+
+func makeConfig(info *shared.SSHInfo) (*ssh.ClientConfig, error) {
+	methods := []ssh.AuthMethod{}
+
+	// Try to use user-provided key, fallback to system default key
+	keyPath := info.Key
+	if keyPath == "" {
+		keyPath = defaultKeyPath()
+	} else {
+		keyPath = expandKeyPath(keyPath)
+	}
+
+	if !fileExists(keyPath) {
+		return nil, fmt.Errorf("ssh public key not found at path %q", keyPath)
+	}
+
+	// Append public key authentication method
+	key, err := parsePrivateKey(keyPath, info.KeyPassword)
+	if err != nil {
+		return nil, err
+	}
+	methods = append(methods, ssh.PublicKeys(key))
+
+	// Append password authentication method
+	if info.Password != "" {
+		methods = append(methods, ssh.Password(info.Password))
+	}
+
+	cfg := &ssh.ClientConfig{
+		User:    info.User,
+		Auth:    methods,
+		Timeout: time.Second * 10,
+		HostKeyCallback: func(hostname string, remote net.Addr, key ssh.PublicKey) error {
+			return nil
+		},
+	}
+
+	return cfg, nil
+}
+
+func (tunnel *Tunnel) sshEndpoint() string {
+	return fmt.Sprintf("%s:%v", tunnel.SSHInfo.Host, tunnel.SSHInfo.Port)
+}
+
+func (tunnel *Tunnel) targetEndpoint() string {
+	return fmt.Sprintf("%v:%v", tunnel.TargetHost, tunnel.TargetPort)
+}
+
+func (tunnel *Tunnel) copy(wg *sync.WaitGroup, writer, reader net.Conn) {
+	defer wg.Done()
+	if _, err := io.Copy(writer, reader); err != nil {
+		log.Println("Tunnel copy error:", err)
+	}
+}
+
+func (tunnel *Tunnel) handleConnection(local net.Conn) {
+	remote, err := tunnel.Client.Dial("tcp", tunnel.targetEndpoint())
+	if err != nil {
+		return
+	}
+
+	wg := &sync.WaitGroup{}
+	wg.Add(2)
+
+	go tunnel.copy(wg, local, remote)
+	go tunnel.copy(wg, remote, local)
+
+	wg.Wait()
+	local.Close()
+}
+
+// Close closes the tunnel connection
+func (tunnel *Tunnel) Close() {
+	if tunnel.Client != nil {
+		tunnel.Client.Close()
+	}
+
+	if tunnel.Listener != nil {
+		tunnel.Listener.Close()
+	}
+}
+
+// Configure establishes the tunnel between localhost and remote machine
+func (tunnel *Tunnel) Configure() error {
+	config, err := makeConfig(tunnel.SSHInfo)
+	if err != nil {
+		return err
+	}
+	tunnel.Config = config
+
+	client, err := ssh.Dial("tcp", tunnel.sshEndpoint(), config)
+	if err != nil {
+		return err
+	}
+	tunnel.Client = client
+
+	listener, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%v", tunnel.Port))
+	if err != nil {
+		return err
+	}
+	tunnel.Listener = listener.(*net.TCPListener)
+
+	return nil
+}
+
+// Start starts the connection handler loop
+func (tunnel *Tunnel) Start() {
+	defer tunnel.Close()
+
+	for {
+		conn, err := tunnel.Listener.Accept()
+		if err != nil {
+			return
+		}
+
+		go tunnel.handleConnection(conn)
+	}
+}
+
+// NewTunnel instantiates a new tunnel struct from given ssh info
+func NewTunnel(sshInfo *shared.SSHInfo, dbUrl string) (*Tunnel, error) {
+	uri, err := url.Parse(dbUrl)
+	if err != nil {
+		return nil, err
+	}
+
+	listenPort, err := connection.FindAvailablePort(portStart, portLimit)
+	if err != nil {
+		return nil, err
+	}
+
+	chunks := strings.Split(uri.Host, ":")
+	host := chunks[0]
+	port := "5432"
+
+	if len(chunks) == 2 {
+		port = chunks[1]
+	}
+
+	tunnel := &Tunnel{
+		Port:       listenPort,
+		SSHInfo:    sshInfo,
+		TargetHost: host,
+		TargetPort: port,
+	}
+
+	return tunnel, nil
+}

pkg/client/util.go

@@ -0,0 +1,101 @@
+package client
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+var (
+	// List of keywords that are not allowed in read-only mode
+	reRestrictedKeywords = regexp.MustCompile(`(?mi)\s?(CREATE|INSERT|UPDATE|DROP|DELETE|TRUNCATE|GRANT|OPEN|IMPORT|COPY)\s`)
+
+	// Comment regular expressions
+	reSlashComment = regexp.MustCompile(`(?m)/\*.+\*/`)
+	reDashComment  = regexp.MustCompile(`(?m)--.+`)
+
+	// Postgres version signature
+	postgresSignature     = regexp.MustCompile(`(?i)postgresql ([\d\.]+)\s?`)
+	postgresDumpSignature = regexp.MustCompile(`\s([\d\.]+)\s?`)
+	postgresType          = "PostgreSQL"
+
+	// Cockroach version signature
+	cockroachSignature = regexp.MustCompile(`(?i)cockroachdb ccl v([\d\.]+)\s?`)
+	cockroachType      = "CockroachDB"
+)
+
+// Get major and minor version components
+// Example: 10.2.3.1 -> 10.2
+func getMajorMinorVersion(str string) (major int, minor int) {
+	chunks := strings.Split(str, ".")
+	fmt.Sscanf(chunks[0], "%d", &major) //nolint
+	if len(chunks) > 1 {
+		fmt.Sscanf(chunks[1], "%d", &minor) //nolint
+	}
+	return
+}
+
+// Get short version from the string
+// Example: 10.2.3.1 -> 10.2
+func getMajorMinorVersionString(str string) string {
+	major, minor := getMajorMinorVersion(str)
+	return fmt.Sprintf("%d.%d", major, minor)
+}
+
+func detectServerTypeAndVersion(version string) (bool, string, string) {
+	version = strings.TrimSpace(version)
+
+	// Detect postgresql
+	matches := postgresSignature.FindAllStringSubmatch(version, 1)
+	if len(matches) > 0 {
+		return true, postgresType, matches[0][1]
+	}
+
+	// Detect cockroachdb
+	matches = cockroachSignature.FindAllStringSubmatch(version, 1)
+	if len(matches) > 0 {
+		return true, cockroachType, matches[0][1]
+	}
+
+	return false, "", ""
+}
+
+// detectDumpVersion parses out version from `pg_dump -V` command.
+func detectDumpVersion(version string) (bool, string) {
+	matches := postgresDumpSignature.FindAllStringSubmatch(version, 1)
+	if len(matches) > 0 {
+		return true, matches[0][1]
+	}
+	return false, ""
+}
+
+func checkVersionRequirement(client, server string) bool {
+	clientMajor, clientMinor := getMajorMinorVersion(client)
+	serverMajor, serverMinor := getMajorMinorVersion(server)
+
+	if serverMajor < 10 {
+		return clientMajor >= serverMajor && clientMinor >= serverMinor
+	}
+
+	return clientMajor >= serverMajor
+}
+
+// containsRestrictedKeywords returns true if given keyword is not allowed in read-only mode
+func containsRestrictedKeywords(str string) bool {
+	str = reSlashComment.ReplaceAllString(str, "")
+	str = reDashComment.ReplaceAllString(str, "")
+
+	return reRestrictedKeywords.MatchString(str)
+}
+
+func hasBinary(data string, checkLen int) bool {
+	for idx, chr := range data {
+		if int(chr) < 32 || int(chr) > 126 {
+			return true
+		}
+		if idx >= checkLen {
+			break
+		}
+	}
+	return false
+}

pkg/client/util_test.go

@@ -0,0 +1,116 @@
+package client
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestDetectServerType(t *testing.T) {
+	examples := []struct {
+		input      string
+		match      bool
+		serverType string
+		version    string
+	}{
+		{input: "",
+			match:      false,
+			serverType: "",
+			version:    "",
+		},
+		{
+			input:      " postgresql 15 ",
+			match:      true,
+			serverType: postgresType,
+			version:    "15",
+		},
+		{
+			input:      "PostgreSQL 14.5 (Homebrew) on aarch64-apple-darwin21.6.0",
+			match:      true,
+			serverType: postgresType,
+			version:    "14.5",
+		},
+		{
+			input:      "PostgreSQL 11.16, compiled by Visual C++ build 1800, 64-bit",
+			match:      true,
+			serverType: postgresType,
+			version:    "11.16",
+		},
+	}
+
+	for _, ex := range examples {
+		t.Run("input:"+ex.input, func(t *testing.T) {
+			match, stype, version := detectServerTypeAndVersion(ex.input)
+
+			assert.Equal(t, ex.match, match)
+			assert.Equal(t, ex.serverType, stype)
+			assert.Equal(t, ex.version, version)
+		})
+	}
+}
+
+func TestDetectDumpVersion(t *testing.T) {
+	examples := []struct {
+		input   string
+		match   bool
+		version string
+	}{
+		{"", false, ""},
+		{"pg_dump (PostgreSQL) 9.6", true, "9.6"},
+		{"pg_dump 10", true, "10"},
+		{"pg_dump (PostgreSQL) 14.5 (Homebrew)", true, "14.5"},
+	}
+
+	for _, ex := range examples {
+		t.Run("input:"+ex.input, func(t *testing.T) {
+			match, version := detectDumpVersion(ex.input)
+
+			assert.Equal(t, ex.match, match)
+			assert.Equal(t, ex.version, version)
+		})
+	}
+}
+
+func TestGetMajorMinorVersion(t *testing.T) {
+	examples := []struct {
+		input string
+		major int
+		minor int
+	}{
+		{"", 0, 0},
+		{"   ", 0, 0},
+		{"0", 0, 0},
+		{"9.6", 9, 6},
+		{"9.6.1.1", 9, 6},
+		{"10", 10, 0},
+		{"10.1 ", 10, 1},
+	}
+
+	for _, ex := range examples {
+		t.Run(ex.input, func(t *testing.T) {
+			major, minor := getMajorMinorVersion(ex.input)
+			assert.Equal(t, ex.major, major)
+			assert.Equal(t, ex.minor, minor)
+		})
+	}
+}
+
+func TestCheckVersionRequirement(t *testing.T) {
+	examples := []struct {
+		client string
+		server string
+		result bool
+	}{
+		{"", "", true},
+		{"0", "0", true},
+		{"9.6", "9.7", false},
+		{"9.6.10", "9.6.25", true},
+		{"10.0", "10.1", true},
+		{"10.5", "10.1", true},
+		{"14.5", "15.1", false},
+	}
+
+	for _, ex := range examples {
+		assert.Equal(t, ex.result, checkVersionRequirement(ex.client, ex.server))
+	}
+}

pkg/command/options.go

@@ -0,0 +1,246 @@
+package command
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"os/user"
+	"path/filepath"
+	"strings"
+
+	"github.com/jackc/pgpassfile"
+	"github.com/jessevdk/go-flags"
+	"github.com/mitchellh/go-homedir"
+	"github.com/sirupsen/logrus"
+)
+
+const (
+	// Prefix to use for all pgweb env vars, ie PGWEB_HOST, PGWEB_PORT, etc
+	envVarPrefix = "PGWEB_"
+)
+
+type Options struct {
+	Version                      bool   `short:"v" long:"version" description:"Print version"`
+	Debug                        bool   `short:"d" long:"debug" description:"Enable debugging mode"`
+	LogLevel                     string `long:"log-level" description:"Logging level" default:"info"`
+	LogFormat                    string `long:"log-format" description:"Logging output format" default:"text"`
+	LogForwardedUser             bool   `long:"log-forwarded-user" description:"Log user information available in X-Forwarded-User/Email headers"`
+	URL                          string `long:"url" description:"Database connection string"`
+	Host                         string `long:"host" description:"Server hostname or IP" default:"localhost"`
+	Port                         int    `long:"port" description:"Server port" default:"5432"`
+	User                         string `long:"user" description:"Database user"`
+	Pass                         string `long:"pass" description:"Password for user"`
+	Passfile                     string `long:"passfile" description:"Local passwords file location"`
+	DbName                       string `long:"db" description:"Database name"`
+	SSLMode                      string `long:"ssl" description:"SSL mode"`
+	SSLRootCert                  string `long:"ssl-rootcert" description:"SSL certificate authority file"`
+	SSLCert                      string `long:"ssl-cert" description:"SSL client certificate file"`
+	SSLKey                       string `long:"ssl-key" description:"SSL client certificate key file"`
+	OpenTimeout                  int    `long:"open-timeout" description:"Maximum wait time for connection, in seconds" default:"30"`
+	RetryDelay                   uint   `long:"open-retry-delay" description:"Number of seconds to wait before retrying the connection" default:"3"`
+	RetryCount                   uint   `long:"open-retry" description:"Number of times to retry establishing connection" default:"0"`
+	HTTPAddr                     string `long:"address" description:"anyhttp address. See https://pkg.go.dev/go.balki.me/anyhttp#readme-address-syntax" default:""`
+	HTTPHost                     string `long:"bind" description:"HTTP server host" default:"localhost"`
+	HTTPPort                     uint   `long:"listen" description:"HTTP server listen port" default:"8081"`
+	AuthUser                     string `long:"auth-user" description:"HTTP basic auth user"`
+	AuthPass                     string `long:"auth-pass" description:"HTTP basic auth password"`
+	SkipOpen                     bool   `short:"s" long:"skip-open" description:"Skip browser open on start"`
+	Sessions                     bool   `long:"sessions" description:"Enable multiple database sessions"`
+	Prefix                       string `long:"prefix" description:"Add a url prefix"`
+	ReadOnly                     bool   `long:"readonly" description:"Run database connection in readonly mode"`
+	LockSession                  bool   `long:"lock-session" description:"Lock session to a single database connection"`
+	Bookmark                     string `short:"b" long:"bookmark" description:"Bookmark to use for connection. Bookmark files are stored under $HOME/.pgweb/bookmarks/*.toml" default:""`
+	BookmarksDir                 string `long:"bookmarks-dir" description:"Overrides default directory for bookmark files to search" default:""`
+	BookmarksOnly                bool   `long:"bookmarks-only" description:"Allow only connections from bookmarks"`
+	QueriesDir                   string `long:"queries-dir" description:"Overrides default directory for local queries"`
+	DisablePrettyJSON            bool   `long:"no-pretty-json" description:"Disable JSON formatting feature for result export"`
+	DisableSSH                   bool   `long:"no-ssh" description:"Disable database connections via SSH"`
+	ConnectBackend               string `long:"connect-backend" description:"Enable database authentication through a third party backend"`
+	ConnectToken                 string `long:"connect-token" description:"Authentication token for the third-party connect backend"`
+	ConnectHeaders               string `long:"connect-headers" description:"List of headers to pass to the connect backend"`
+	DisableConnectionIdleTimeout bool   `long:"no-idle-timeout" description:"Disable connection idle timeout"`
+	ConnectionIdleTimeout        int    `long:"idle-timeout" description:"Set connection idle timeout in minutes" default:"180"`
+	QueryTimeout                 uint   `long:"query-timeout" description:"Set global query execution timeout in seconds" default:"300"`
+	Cors                         bool   `long:"cors" description:"Enable Cross-Origin Resource Sharing (CORS)"`
+	CorsOrigin                   string `long:"cors-origin" description:"Allowed CORS origins" default:"*"`
+	BinaryCodec                  string `long:"binary-codec" description:"Codec for binary data serialization, one of 'none', 'hex', 'base58', 'base64'" default:"none"`
+	MetricsEnabled               bool   `long:"metrics" description:"Enable Prometheus metrics endpoint"`
+	MetricsPath                  string `long:"metrics-path" description:"Path prefix for Prometheus metrics endpoint" default:"/metrics"`
+	MetricsAddr                  string `long:"metrics-addr" description:"Listen host and port for Prometheus metrics server"`
+}
+
+var Opts Options
+
+// ParseOptions returns a new options struct from the input arguments
+func ParseOptions(args []string) (Options, error) {
+	var opts = Options{}
+
+	_, err := flags.ParseArgs(&opts, args)
+	if err != nil {
+		return opts, err
+	}
+
+	_, err = logrus.ParseLevel(opts.LogLevel)
+	if err != nil {
+		return opts, err
+	}
+
+	if opts.URL == "" {
+		opts.URL = getPrefixedEnvVar("DATABASE_URL")
+	}
+
+	if opts.Prefix == "" {
+		opts.Prefix = getPrefixedEnvVar("URL_PREFIX")
+	}
+
+	if opts.Passfile == "" {
+		passfile := os.Getenv("PGPASSFILE")
+		if passfile == "" {
+			passfile = filepath.Join(os.Getenv("HOME"), ".pgpass")
+		}
+
+		_, err := os.Stat(passfile)
+		if err == nil {
+			_, err = pgpassfile.ReadPassfile(passfile)
+			if err == nil {
+				opts.Passfile = passfile
+			} else {
+				fmt.Printf("[WARN] Pgpass file unreadable: %s\n", err)
+			}
+		}
+	}
+
+	// Handle edge case where pgweb is started with a default host `localhost` and no user.
+	// When user is not set the `lib/pq` connection will fail and cause pgweb's termination.
+	if (opts.Host == "localhost" || opts.Host == "127.0.0.1") && opts.User == "" {
+		if username := getCurrentUser(); username != "" {
+			opts.User = username
+		} else {
+			opts.Host = ""
+		}
+	}
+
+	if getPrefixedEnvVar("BOOKMARKS_ONLY") != "" {
+		opts.BookmarksOnly = true
+	}
+
+	if getPrefixedEnvVar("SESSIONS") != "" {
+		opts.Sessions = true
+	}
+
+	if getPrefixedEnvVar("LOCK_SESSION") != "" {
+		opts.LockSession = true
+		opts.Sessions = false
+	}
+
+	if opts.Sessions || opts.ConnectBackend != "" {
+		opts.Bookmark = ""
+		opts.URL = ""
+		opts.Host = ""
+		opts.User = ""
+		opts.Pass = ""
+		opts.DbName = ""
+		opts.SSLMode = ""
+	}
+
+	if opts.Prefix != "" && !strings.HasSuffix(opts.Prefix, "/") {
+		opts.Prefix = opts.Prefix + "/"
+	}
+
+	if opts.AuthUser == "" {
+		opts.AuthUser = getPrefixedEnvVar("AUTH_USER")
+	}
+
+	if opts.AuthPass == "" {
+		opts.AuthPass = getPrefixedEnvVar("AUTH_PASS")
+	}
+
+	if opts.ConnectBackend != "" {
+		if !opts.Sessions {
+			return opts, errors.New("--sessions flag must be set")
+		}
+		if opts.ConnectToken == "" {
+			return opts, errors.New("--connect-token flag must be set")
+		}
+	} else {
+		if opts.ConnectToken != "" || opts.ConnectHeaders != "" {
+			return opts, errors.New("--connect-backend flag must be set")
+		}
+	}
+
+	if opts.BookmarksOnly {
+		if opts.URL != "" {
+			return opts, errors.New("--url not supported in bookmarks-only mode")
+		}
+		if opts.Host != "" && opts.Host != "localhost" {
+			return opts, errors.New("--host not supported in bookmarks-only mode")
+		}
+		if opts.ConnectBackend != "" {
+			return opts, errors.New("--connect-backend not supported in bookmarks-only mode")
+		}
+	}
+
+	homePath, err := homedir.Dir()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "[WARN] can't detect home dir: %v", err)
+		homePath = os.Getenv("HOME")
+	}
+
+	if homePath != "" {
+		if opts.BookmarksDir == "" {
+			opts.BookmarksDir = filepath.Join(homePath, ".pgweb/bookmarks")
+		}
+
+		if opts.QueriesDir == "" {
+			opts.QueriesDir = filepath.Join(homePath, ".pgweb/queries")
+		}
+	}
+
+	return opts, nil
+}
+
+// SetDefaultOptions parses and assigns the options
+func SetDefaultOptions() error {
+	opts, err := ParseOptions([]string{})
+	if err != nil {
+		return err
+	}
+	Opts = opts
+	return nil
+}
+
+// getCurrentUser returns a current user name
+func getCurrentUser() string {
+	u, _ := user.Current()
+	if u != nil {
+		return u.Username
+	}
+	return os.Getenv("USER")
+}
+
+// getPrefixedEnvVar returns env var with prefix, or falls back to unprefixed one
+func getPrefixedEnvVar(name string) string {
+	val := os.Getenv(envVarPrefix + name)
+	if val == "" {
+		val = os.Getenv(name)
+		if val != "" {
+			fmt.Printf("[DEPRECATION] Usage of %s env var is deprecated, please use PGWEB_%s variable instead\n", name, name)
+		}
+	}
+	return val
+}
+
+// AvailableEnvVars returns list of supported env vars.
+//
+// TODO: These should probably be embedded into flag parsing logic so we dont have
+// to maintain the list manually.
+func AvailableEnvVars() string {
+	return strings.Join([]string{
+		"  " + envVarPrefix + "DATABASE_URL  Database connection string",
+		"  " + envVarPrefix + "URL_PREFIX    HTTP server path prefix",
+		"  " + envVarPrefix + "SESSIONS      Enable multiple database sessions",
+		"  " + envVarPrefix + "LOCK_SESSION  Lock session to a single database connection",
+		"  " + envVarPrefix + "AUTH_USER     HTTP basic auth username",
+		"  " + envVarPrefix + "AUTH_PASS     HTTP basic auth password",
+	}, "\n")
+}

pkg/command/options_test.go

@@ -0,0 +1,97 @@
+package command
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/mitchellh/go-homedir"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestParseOptions(t *testing.T) {
+	var hdir string
+	if d, err := homedir.Dir(); err == nil {
+		hdir = d
+	}
+
+	t.Run("defaults", func(t *testing.T) {
+		opts, err := ParseOptions([]string{})
+		assert.NoError(t, err)
+		assert.Equal(t, false, opts.Sessions)
+		assert.Equal(t, "", opts.Prefix)
+		assert.Equal(t, "", opts.ConnectToken)
+		assert.Equal(t, "", opts.ConnectHeaders)
+		assert.Equal(t, false, opts.DisableSSH)
+		assert.Equal(t, false, opts.DisablePrettyJSON)
+		assert.Equal(t, false, opts.DisableConnectionIdleTimeout)
+		assert.Equal(t, 180, opts.ConnectionIdleTimeout)
+		assert.Equal(t, false, opts.Cors)
+		assert.Equal(t, "*", opts.CorsOrigin)
+		assert.Equal(t, "", opts.Passfile)
+		assert.Equal(t, filepath.Join(hdir, ".pgweb/bookmarks"), opts.BookmarksDir)
+	})
+
+	t.Run("sessions", func(t *testing.T) {
+		opts, err := ParseOptions([]string{"--sessions", "1"})
+		assert.NoError(t, err)
+		assert.Equal(t, true, opts.Sessions)
+	})
+
+	t.Run("url prefix", func(t *testing.T) {
+		opts, err := ParseOptions([]string{"--prefix", "pgweb"})
+		assert.NoError(t, err)
+		assert.Equal(t, "pgweb/", opts.Prefix)
+
+		opts, err = ParseOptions([]string{"--prefix", "pgweb/"})
+		assert.NoError(t, err)
+		assert.Equal(t, "pgweb/", opts.Prefix)
+	})
+
+	t.Run("connect backend", func(t *testing.T) {
+		_, err := ParseOptions([]string{"--connect-backend", "test"})
+		assert.EqualError(t, err, "--sessions flag must be set")
+
+		_, err = ParseOptions([]string{"--connect-backend", "test", "--sessions"})
+		assert.EqualError(t, err, "--connect-token flag must be set")
+
+		_, err = ParseOptions([]string{"--connect-backend", "test", "--sessions", "--connect-token", "token"})
+		assert.NoError(t, err)
+	})
+
+	t.Run("passfile", func(t *testing.T) {
+		defer os.Unsetenv("PGPASSFILE")
+
+		// File does not exist
+		os.Setenv("PGPASSFILE", "/tmp/foo")
+		opts, err := ParseOptions([]string{})
+		assert.NoError(t, err)
+		assert.Equal(t, "", opts.Passfile)
+
+		// File exists and valid
+		os.Setenv("PGPASSFILE", "../../data/passfile")
+		opts, err = ParseOptions([]string{})
+		assert.NoError(t, err)
+		assert.Equal(t, "../../data/passfile", opts.Passfile)
+
+		// Set via flag
+		os.Unsetenv("PGPASSFILE")
+		opts, err = ParseOptions([]string{"--passfile", "../../data/passfile"})
+		assert.NoError(t, err)
+		assert.Equal(t, "../../data/passfile", opts.Passfile)
+	})
+
+	t.Run("bookmarks only mode", func(t *testing.T) {
+		_, err := ParseOptions([]string{"--bookmarks-only"})
+		assert.NoError(t, err)
+
+		_, err = ParseOptions([]string{"--bookmarks-only", "--url", "test"})
+		assert.EqualError(t, err, "--url not supported in bookmarks-only mode")
+
+		_, err = ParseOptions([]string{"--bookmarks-only", "--host", "test", "--port", "5432"})
+		assert.EqualError(t, err, "--host not supported in bookmarks-only mode")
+
+		_, err = ParseOptions([]string{"--bookmarks-only", "--connect-backend", "test", "--sessions", "--connect-token", "token", "--url", "127.0.0.2"})
+		assert.EqualError(t, err, "--connect-backend not supported in bookmarks-only mode")
+	})
+}

pkg/command/version.go

@@ -0,0 +1,64 @@
+package command
+
+import (
+	"fmt"
+	"runtime"
+	"strings"
+)
+
+const (
+	// Version is the current Pgweb application version
+	Version = "0.17.0"
+)
+
+var (
+	// GitCommit contains the Git commit SHA for the binary
+	GitCommit string
+
+	// BuildTime contains the binary build time
+	BuildTime string
+
+	// BuildArch contains the OS architecture of the binary
+	BuildArch string = fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH)
+
+	// GoVersion contains the build time Go version
+	GoVersion string
+
+	// Info contains all version information
+	Info VersionInfo
+)
+
+type VersionInfo struct {
+	Version   string `json:"version"`
+	GitCommit string `json:"git_sha"`
+	BuildTime string `json:"build_time"`
+	BuildArch string `json:"build_arch"`
+	GoVersion string `json:"go_version"`
+}
+
+func init() {
+	Info.Version = Version
+	Info.GitCommit = GitCommit
+	Info.BuildTime = BuildTime
+	Info.BuildArch = BuildArch
+	Info.GoVersion = GoVersion
+}
+
+func VersionString() string {
+	chunks := []string{fmt.Sprintf("Pgweb v%s", Version)}
+
+	if GitCommit != "" {
+		chunks = append(chunks, fmt.Sprintf("(git: %s)", GitCommit))
+	}
+	if GoVersion != "" {
+		chunks = append(chunks, fmt.Sprintf("(go: %s)", GoVersion))
+	}
+	if BuildTime != "" {
+		chunks = append(chunks, fmt.Sprintf("(build time: %s)", BuildTime))
+	}
+	if BuildArch != "" {
+		chunks = append(chunks, fmt.Sprintf("(arch: %s)", BuildArch))
+	}
+
+	return strings.Join(chunks, " ")
+}

pkg/connect/backend.go

@@ -0,0 +1,92 @@
+package connect
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/sirupsen/logrus"
+)
+
+type Backend struct {
+	Endpoint    string
+	Token       string
+	PassHeaders []string
+
+	logger *logrus.Logger
+}
+
+func NewBackend(endpoint string, token string) Backend {
+	return Backend{
+		Endpoint: endpoint,
+		Token:    token,
+		logger:   logrus.StandardLogger(),
+	}
+}
+
+func (be *Backend) SetLogger(logger *logrus.Logger) {
+	be.logger = logger
+}
+
+func (be *Backend) SetPassHeaders(headers []string) {
+	be.PassHeaders = headers
+}
+
+func (be *Backend) FetchCredential(ctx context.Context, resource string, headers http.Header) (*Credential, error) {
+	be.logger.WithField("resource", resource).Debug("fetching database credential")
+
+	request := Request{
+		Resource: resource,
+		Token:    be.Token,
+		Headers:  map[string]string{},
+	}
+
+	// Pass allow-listed client headers to the backend request
+	for _, name := range be.PassHeaders {
+		request.Headers[strings.ToLower(name)] = headers.Get(name)
+	}
+
+	body, err := json.Marshal(request)
+	if err != nil {
+		be.logger.WithField("resource", resource).Error("backend request serialization error:", err)
+		return nil, err
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, be.Endpoint, bytes.NewReader(body))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("content-type", "application/json")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		be.logger.WithField("resource", resource).Error("backend credential fetch failed:", err)
+		return nil, errBackendConnectError
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != 200 {
+		err = fmt.Errorf("backend credential fetch received HTTP status code %v", resp.StatusCode)
+
+		be.logger.
+			WithField("resource", request.Resource).
+			WithField("status", resp.StatusCode).
+			Error(err)
+
+		return nil, err
+	}
+
+	cred := &Credential{}
+	if err := json.NewDecoder(resp.Body).Decode(cred); err != nil {
+		return nil, err
+	}
+
+	if cred.DatabaseURL == "" {
+		return nil, errConnStringRequired
+	}
+
+	return cred, nil
+}

pkg/connect/backend_test.go

@@ -0,0 +1,173 @@
+package connect
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestBackendFetchCredential(t *testing.T) {
+	examples := []struct {
+		name         string
+		backend      Backend
+		resourceName string
+		cred         *Credential
+		headers      http.Header
+		ctx          func() (context.Context, context.CancelFunc)
+		err          error
+	}{
+		{
+			name:    "Bad auth token",
+			backend: Backend{Endpoint: "http://localhost:5555/unauthorized"},
+			err:     errors.New("backend credential fetch received HTTP status code 401"),
+		},
+		{
+			name:    "Backend timeout",
+			backend: Backend{Endpoint: "http://localhost:5555/timeout"},
+			ctx: func() (context.Context, context.CancelFunc) {
+				return context.WithTimeout(context.Background(), time.Millisecond*100)
+			},
+			err: errors.New("unable to connect to the auth backend"),
+		},
+		{
+			name:    "Empty response",
+			backend: Backend{Endpoint: "http://localhost:5555/empty-response"},
+			err:     errors.New("connection string is required"),
+		},
+		{
+			name:    "Missing header",
+			backend: Backend{Endpoint: "http://localhost:5555/pass-header"},
+			err:     errors.New("backend credential fetch received HTTP status code 400"),
+		},
+		{
+			name: "Require header",
+			backend: Backend{
+				Endpoint:    "http://localhost:5555/pass-header",
+				PassHeaders: []string{"x-foo"},
+			},
+			headers: http.Header{
+				"X-Foo": []string{"bar"},
+			},
+			cred: &Credential{DatabaseURL: "postgres://hostname/bar"},
+		},
+		{
+			name:    "Success",
+			backend: Backend{Endpoint: "http://localhost:5555/success"},
+			cred:    &Credential{DatabaseURL: "postgres://hostname/dbname"},
+		},
+	}
+
+	srvCtx, srvCancel := context.WithTimeout(context.Background(), time.Minute)
+	defer srvCancel()
+
+	startTestBackend(srvCtx, "localhost:5555")
+
+	for _, ex := range examples {
+		ex.backend.logger = logrus.StandardLogger()
+
+		t.Run(ex.name, func(t *testing.T) {
+			ctx, cancel := context.WithCancel(context.Background())
+			if ex.ctx != nil {
+				ctx, cancel = ex.ctx()
+			}
+			defer cancel()
+
+			cred, err := ex.backend.FetchCredential(ctx, ex.resourceName, ex.headers)
+			assert.Equal(t, ex.err, err)
+			assert.Equal(t, ex.cred, cred)
+		})
+	}
+}
+
+func startTestBackend(ctx context.Context, listenAddr string) {
+	router := gin.New()
+
+	router.Use(func(c *gin.Context) {
+		if c.GetHeader("content-type") != "application/json" {
+			c.AbortWithStatus(http.StatusBadRequest)
+		}
+	})
+
+	router.POST("/unauthorized", func(c *gin.Context) {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Unauthorized"})
+	})
+
+	router.POST("/timeout", func(c *gin.Context) {
+		time.Sleep(time.Second)
+		c.JSON(http.StatusOK, gin.H{})
+	})
+
+	router.POST("/empty-response", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{})
+	})
+
+	router.POST("/pass-header", func(c *gin.Context) {
+		req := Request{}
+		if err := c.BindJSON(&req); err != nil {
+			panic(err)
+		}
+
+		header := req.Headers["x-foo"]
+		if header == "" {
+			c.AbortWithStatus(http.StatusBadRequest)
+			return
+		}
+
+		c.JSON(http.StatusOK, gin.H{
+			"database_url": "postgres://hostname/" + header,
+		})
+	})
+
+	router.POST("/success", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{
+			"database_url": "postgres://hostname/dbname",
+		})
+	})
+
+	server := &http.Server{Addr: listenAddr, Handler: router}
+	mustStartServer(server)
+
+	go func() {
+		<-ctx.Done()
+		if err := server.Shutdown(context.Background()); err != nil && err != http.ErrServerClosed {
+			panic(err)
+		}
+	}()
+}
+
+func mustStartServer(server *http.Server) {
+	go func() {
+		err := server.ListenAndServe()
+		if err != nil && err != http.ErrServerClosed {
+			panic(err)
+		}
+	}()
+
+	if err := waitForServer(server.Addr, 5); err != nil {
+		panic(err)
+	}
+}
+
+func waitForServer(addr string, n int) error {
+	var lastErr error
+
+	for i := 0; i < n; i++ {
+		conn, err := net.Dial("tcp", addr)
+		if err == nil {
+			conn.Close()
+			return nil
+		}
+
+		lastErr = err
+		time.Sleep(time.Millisecond * 100)
+	}
+
+	return lastErr
+}

pkg/connect/types.go

@@ -0,0 +1,20 @@
+package connect
+
+import "errors"
+
+var (
+	errBackendConnectError = errors.New("unable to connect to the auth backend")
+	errConnStringRequired  = errors.New("connection string is required")
+)
+
+// Request holds the resource request details
+type Request struct {
+	Resource string            `json:"resource"`
+	Token    string            `json:"token"`
+	Headers  map[string]string `json:"headers,omitempty"`
+}
+
+// Credential holds the database connection string
+type Credential struct {
+	DatabaseURL string `json:"database_url"`
+}

pkg/connection/connection_string.go

@@ -0,0 +1,197 @@
+package connection
+
+import (
+	"errors"
+	"fmt"
+	neturl "net/url"
+	"os"
+	"os/user"
+	"strconv"
+	"strings"
+
+	"github.com/jackc/pgpassfile"
+
+	"github.com/sosedoff/pgweb/pkg/command"
+)
+
+// Common errors
+var (
+	errCantDetectUser   = errors.New("Could not detect default username")
+	errInvalidURLFormat = errors.New("Invalid URL. Valid format: postgres://user:password@host:port/db?sslmode=mode")
+)
+
+// currentUser returns a current user name
+func currentUser() (string, error) {
+	u, err := user.Current()
+	if err == nil {
+		return u.Username, nil
+	}
+
+	name := os.Getenv("USER")
+	if name != "" {
+		return name, nil
+	}
+
+	return "", errCantDetectUser
+}
+
+// Check if connection url has a correct postgres prefix
+func hasValidPrefix(str string) bool {
+	return strings.HasPrefix(str, "postgres://") || strings.HasPrefix(str, "postgresql://")
+}
+
+// Extract all query vals and return as a map
+func valsFromQuery(vals neturl.Values) map[string]string {
+	result := map[string]string{}
+	for k, v := range vals {
+		result[strings.ToLower(k)] = v[0]
+	}
+	return result
+}
+
+// FormatURL reformats the existing connection string
+func FormatURL(opts command.Options) (string, error) {
+	url := opts.URL
+
+	// Validate connection string prefix
+	if !hasValidPrefix(url) {
+		return "", errInvalidURLFormat
+	}
+
+	// Validate the URL
+	uri, err := neturl.Parse(url)
+	if err != nil {
+		return "", errInvalidURLFormat
+	}
+
+	// Get query params
+	params := valsFromQuery(uri.Query())
+
+	// Determine if we need to specify sslmode if it's missing
+	if params["sslmode"] == "" {
+		if opts.SSLMode == "" {
+			// Only modify sslmode for local connections
+			if strings.Contains(uri.Host, "localhost") || strings.Contains(uri.Host, "127.0.0.1") {
+				params["sslmode"] = "disable"
+			}
+		} else {
+			params["sslmode"] = opts.SSLMode
+		}
+	}
+
+	// When password is not provided, look it up from a .pgpass file
+	if uri.User != nil {
+		pass, _ := uri.User.Password()
+		if pass == "" && opts.Passfile != "" {
+			pass = lookupPassword(opts, uri)
+			if pass != "" {
+				uri.User = neturl.UserPassword(uri.User.Username(), pass)
+			}
+		}
+	}
+
+	// Configure default connect timeout
+	if opts.OpenTimeout > 0 {
+		params["connect_timeout"] = strconv.Itoa(opts.OpenTimeout)
+	}
+
+	// Rebuild query params
+	query := neturl.Values{}
+	for k, v := range params {
+		query.Add(k, v)
+	}
+	uri.RawQuery = query.Encode()
+
+	return uri.String(), nil
+}
+
+// IsBlank returns true if command options do not contain connection details
+func IsBlank(opts command.Options) bool {
+	return opts.Host == "" && opts.User == "" && opts.DbName == "" && opts.URL == ""
+}
+
+// BuildStringFromOptions returns a new connection string built from options
+func BuildStringFromOptions(opts command.Options) (string, error) {
+	query := neturl.Values{}
+
+	// If connection string is provided we just use that
+	if opts.URL != "" {
+		return FormatURL(opts)
+	}
+
+	// Try to detect user from current OS user
+	if opts.User == "" {
+		u, err := currentUser()
+		if err == nil {
+			opts.User = u
+		}
+	}
+
+	if opts.SSLMode != "" {
+		query.Add("sslmode", opts.SSLMode)
+	} else {
+		if opts.Host == "localhost" || opts.Host == "127.0.0.1" {
+			query.Add("sslmode", "disable")
+		}
+	}
+	if opts.SSLCert != "" {
+		query.Add("sslcert", opts.SSLCert)
+	}
+	if opts.SSLKey != "" {
+		query.Add("sslkey", opts.SSLKey)
+	}
+	if opts.SSLRootCert != "" {
+		query.Add("sslrootcert", opts.SSLRootCert)
+	}
+
+	// Grab password from .pgpass file if it's available
+	if opts.Pass == "" && opts.Passfile != "" {
+		opts.Pass = lookupPassword(opts, nil)
+	}
+
+	// Configure default connect timeout
+	if opts.OpenTimeout > 0 {
+		query.Add("connect_timeout", strconv.Itoa(opts.OpenTimeout))
+	}
+
+	url := neturl.URL{
+		Scheme:   "postgres",
+		Host:     fmt.Sprintf("%v:%v", opts.Host, opts.Port),
+		User:     neturl.UserPassword(opts.User, opts.Pass),
+		Path:     fmt.Sprintf("/%s", opts.DbName),
+		RawQuery: query.Encode(),
+	}
+
+	return url.String(), nil
+}
+
+func lookupPassword(opts command.Options, url *neturl.URL) string {
+	if opts.Passfile == "" {
+		return ""
+	}
+
+	passfile, err := pgpassfile.ReadPassfile(opts.Passfile)
+	if err != nil {
+		fmt.Println("[WARN] .pgpassfile", opts.Passfile, "is not readable")
+		return ""
+	}
+
+	if url != nil {
+		var dbName string
+		fmt.Sscanf(url.Path, "/%s", &dbName) //nolint
+
+		return passfile.FindPassword(
+			url.Hostname(),
+			url.Port(),
+			dbName,
+			url.User.Username(),
+		)
+	}
+
+	return passfile.FindPassword(
+		opts.Host,
+		fmt.Sprintf("%d", opts.Port),
+		opts.DbName,
+		opts.User,
+	)
+}

pkg/connection/connection_string_test.go

@@ -0,0 +1,284 @@
+package connection
+
+import (
+	"fmt"
+	"net/url"
+	"os/user"
+	"testing"
+
+	"github.com/sosedoff/pgweb/pkg/command"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestBuildStringFromOptions(t *testing.T) {
+	t.Run("valid url", func(t *testing.T) {
+		url := "postgres://myhost/database"
+		str, err := BuildStringFromOptions(command.Options{URL: url})
+
+		assert.NoError(t, err)
+		assert.Equal(t, url, str)
+	})
+
+	t.Run("with sslmode param", func(t *testing.T) {
+		str, err := BuildStringFromOptions(command.Options{
+			URL:     "postgres://myhost/database",
+			SSLMode: "disable",
+		})
+
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://myhost/database?sslmode=disable", str)
+	})
+
+	t.Run("sets sslmode param if not set", func(t *testing.T) {
+		str, err := BuildStringFromOptions(command.Options{
+			URL: "postgres://localhost/database",
+		})
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://localhost/database?sslmode=disable", str)
+
+		str, err = BuildStringFromOptions(command.Options{
+			URL: "postgres://127.0.0.1/database",
+		})
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://127.0.0.1/database?sslmode=disable", str)
+	})
+
+	t.Run("sslmode as an option", func(t *testing.T) {
+		str, err := BuildStringFromOptions(command.Options{
+			URL:     "postgres://localhost/database",
+			SSLMode: "require",
+		})
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://localhost/database?sslmode=require", str)
+
+		str, err = BuildStringFromOptions(command.Options{
+			URL:     "postgres://127.0.0.1/database",
+			SSLMode: "require",
+		})
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://127.0.0.1/database?sslmode=require", str)
+	})
+
+	t.Run("localhost and sslmode flag", func(t *testing.T) {
+		str, err := BuildStringFromOptions(command.Options{
+			URL: "postgres://localhost/database?sslmode=require",
+		})
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://localhost/database?sslmode=require", str)
+
+		str, err = BuildStringFromOptions(command.Options{
+			URL: "postgres://127.0.0.1/database?sslmode=require",
+		})
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://127.0.0.1/database?sslmode=require", str)
+	})
+
+	t.Run("extended options", func(t *testing.T) {
+		str, err := BuildStringFromOptions(command.Options{
+			URL: "postgres://localhost/database?sslmode=require&sslcert=cert&sslkey=key&sslrootcert=ca",
+		})
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://localhost/database?sslcert=cert&sslkey=key&sslmode=require&sslrootcert=ca", str)
+	})
+
+	t.Run("from flags", func(t *testing.T) {
+		str, err := BuildStringFromOptions(command.Options{
+			Host:   "host",
+			Port:   5432,
+			User:   "user",
+			Pass:   "password",
+			DbName: "db",
+		})
+
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://user:password@host:5432/db", str)
+	})
+
+	t.Run("localhost", func(t *testing.T) {
+		opts := command.Options{
+			Host:   "localhost",
+			Port:   5432,
+			User:   "user",
+			Pass:   "password",
+			DbName: "db",
+		}
+
+		str, err := BuildStringFromOptions(opts)
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://user:password@localhost:5432/db?sslmode=disable", str)
+
+		opts.Host = "127.0.0.1"
+		str, err = BuildStringFromOptions(opts)
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://user:password@127.0.0.1:5432/db?sslmode=disable", str)
+	})
+
+	t.Run("localhost and ssl", func(t *testing.T) {
+		opts := command.Options{
+			Host:        "localhost",
+			Port:        5432,
+			User:        "user",
+			Pass:        "password",
+			DbName:      "db",
+			SSLMode:     "require",
+			SSLKey:      "keyPath",
+			SSLCert:     "certPath",
+			SSLRootCert: "caPath",
+		}
+
+		str, err := BuildStringFromOptions(opts)
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://user:password@localhost:5432/db?sslcert=certPath&sslkey=keyPath&sslmode=require&sslrootcert=caPath", str)
+	})
+
+	t.Run("no user", func(t *testing.T) {
+		opts := command.Options{Host: "host", Port: 5432, DbName: "db"}
+		u, _ := user.Current()
+		str, err := BuildStringFromOptions(opts)
+		userAndPass := url.UserPassword(u.Username, "").String()
+
+		assert.NoError(t, err)
+		assert.Equal(t, fmt.Sprintf("postgres://%s@host:5432/db", userAndPass), str)
+	})
+
+	t.Run("port", func(t *testing.T) {
+		opts := command.Options{Host: "host", User: "user", Port: 5000, DbName: "db"}
+		str, err := BuildStringFromOptions(opts)
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://user:@host:5000/db", str)
+	})
+
+	t.Run("with pgpass", func(t *testing.T) {
+		opts := command.Options{
+			Host:     "localhost",
+			Port:     5432,
+			User:     "username",
+			DbName:   "dbname",
+			Passfile: "../../data/passfile",
+		}
+
+		str, err := BuildStringFromOptions(opts)
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://username:password@localhost:5432/dbname?sslmode=disable", str)
+
+		opts.User = "foobar"
+		str, err = BuildStringFromOptions(opts)
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://foobar:@localhost:5432/dbname?sslmode=disable", str)
+
+		opts.Host = "127.0.0.1"
+		opts.DbName = "foobar2"
+		str, err = BuildStringFromOptions(opts)
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://foobar:password2@127.0.0.1:5432/foobar2?sslmode=disable", str)
+	})
+
+	t.Run("with connection timeout", func(t *testing.T) {
+		opts := command.Options{
+			URL:         "postgres://user:pass@localhost:5432/dbname",
+			OpenTimeout: 30,
+		}
+		str, err := BuildStringFromOptions(opts)
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://user:pass@localhost:5432/dbname?connect_timeout=30&sslmode=disable", str)
+
+		opts = command.Options{
+			Host:        "localhost",
+			Port:        5432,
+			User:        "username",
+			DbName:      "dbname",
+			OpenTimeout: 30,
+		}
+
+		str, err = BuildStringFromOptions(opts)
+		assert.NoError(t, err)
+		assert.Equal(t, "postgres://username:@localhost:5432/dbname?connect_timeout=30&sslmode=disable", str)
+	})
+
+	t.Run("invalid url", func(t *testing.T) {
+		opts := command.Options{}
+		examples := []string{
+			"postgre://foobar",
+			"tcp://blah",
+			"foobar",
+		}
+
+		for _, val := range examples {
+			opts.URL = val
+			str, err := BuildStringFromOptions(opts)
+
+			assert.Equal(t, "", str)
+			assert.Error(t, err)
+			assert.Equal(t, "Invalid URL. Valid format: postgres://user:password@host:port/db?sslmode=mode", err.Error())
+		}
+	})
+}
+
+func TestFormatURL(t *testing.T) {
+	examples := []struct {
+		name   string
+		input  command.Options
+		result string
+		err    string
+	}{
+		{
+			name:  "empty opts",
+			input: command.Options{},
+		},
+		{
+			name:  "invalid url",
+			input: command.Options{URL: "barurl"},
+			err:   "Invalid URL",
+		},
+		{
+			name: "good",
+			input: command.Options{
+				URL: "postgres://user:pass@localhost:5432/dbname",
+			},
+			result: "postgres://user:pass@localhost:5432/dbname?sslmode=disable",
+		},
+		{
+			name: "password lookup, password set",
+			input: command.Options{
+				URL:      "postgres://username:@localhost:5432/dbname",
+				Passfile: "../../data/passfile",
+			},
+			result: "postgres://username:password@localhost:5432/dbname?sslmode=disable",
+		},
+		{
+			name: "password lookup, password not set",
+			input: command.Options{
+				URL:      "postgres://username@localhost:5432/dbname",
+				Passfile: "../../data/passfile",
+			},
+			result: "postgres://username:password@localhost:5432/dbname?sslmode=disable",
+		},
+		{
+			name: "with timeout setting",
+			input: command.Options{
+				URL:         "postgres://username@localhost:5432/dbname",
+				OpenTimeout: 30,
+			},
+			result: "postgres://username@localhost:5432/dbname?connect_timeout=30&sslmode=disable",
+		},
+	}
+
+	for _, ex := range examples {
+		t.Run(ex.name, func(t *testing.T) {
+			str, err := FormatURL(ex.input)
+
+			if ex.err != "" {
+				assert.Error(t, err)
+				assert.Contains(t, err.Error(), ex.err)
+			}
+			assert.Equal(t, ex.result, str)
+		})
+	}
+}
+
+func TestIsBlank(t *testing.T) {
+	assert.Equal(t, true, IsBlank(command.Options{}))
+	assert.Equal(t, false, IsBlank(command.Options{Host: "host", User: "user"}))
+	assert.Equal(t, false, IsBlank(command.Options{Host: "host", User: "user", DbName: "db"}))
+	assert.Equal(t, false, IsBlank(command.Options{URL: "url"}))
+}

pkg/connection/port.go

@@ -0,0 +1,29 @@
+package connection
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"strings"
+)
+
+// IsPortAvailable returns true if there's no listeners on a given port
+func IsPortAvailable(port int) bool {
+	conn, err := net.Dial("tcp", fmt.Sprintf("127.0.0.1:%v", port))
+	if err != nil {
+		return strings.Index(err.Error(), "connection refused") > 0
+	}
+
+	conn.Close()
+	return false
+}
+
+// FindAvailablePort returns the first available TCP port in the range
+func FindAvailablePort(start int, limit int) (int, error) {
+	for i := start; i <= (start + limit); i++ {
+		if IsPortAvailable(i) {
+			return i, nil
+		}
+	}
+	return -1, errors.New("No available port")
+}

pkg/connection/port_test.go

@@ -0,0 +1,75 @@
+package connection
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsPortAvailable(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("FIXME")
+	}
+
+	assert.Equal(t, true, IsPortAvailable(30000))
+
+	serv, err := net.Listen("tcp", "127.0.0.1:30000")
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "Unable to start test tcp listener:", err)
+		t.Fail()
+		return
+	}
+	defer serv.Close()
+
+	go func() {
+		for {
+			conn, err := serv.Accept()
+			if err == nil {
+				conn.Close()
+			}
+			serv.Close()
+		}
+	}()
+
+	assert.Equal(t, false, IsPortAvailable(30000))
+	assert.Equal(t, true, IsPortAvailable(30001))
+}
+
+func TestFindAvailablePort(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("FIXME")
+	}
+
+	port, err := FindAvailablePort(30000, 1)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, 30000, port)
+
+	serv, err := net.Listen("tcp", "127.0.0.1:30000")
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "Unable to start test tcp listener:", err)
+		t.Fail()
+		return
+	}
+	defer serv.Close()
+
+	go func() {
+		for {
+			conn, err := serv.Accept()
+			if err == nil {
+				conn.Close()
+			}
+		}
+	}()
+
+	port, err = FindAvailablePort(30000, 0)
+	assert.EqualError(t, err, "No available port")
+	assert.Equal(t, -1, port)
+
+	port, err = FindAvailablePort(30000, 1)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, 30001, port)
+}

pkg/history/history.go

@@ -0,0 +1,21 @@
+package history
+
+import (
+	"time"
+)
+
+type Record struct {
+	Query     string `json:"query"`
+	Timestamp string `json:"timestamp"`
+}
+
+func New() []Record {
+	return make([]Record, 0)
+}
+
+func NewRecord(query string) Record {
+	return Record{
+		Query:     query,
+		Timestamp: time.Now().String(),
+	}
+}

pkg/metrics/handler.go

@@ -0,0 +1,26 @@
+package metrics
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+)
+
+type Handler struct {
+	startTime   time.Time
+	promHandler http.Handler
+}
+
+func (h Handler) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+	uptimeGauge.Set(time.Since(h.startTime).Seconds())
+
+	h.promHandler.ServeHTTP(rw, req)
+}
+
+func NewHandler() http.Handler {
+	return Handler{
+		startTime:   time.Now(),
+		promHandler: promhttp.Handler(),
+	}
+}

pkg/metrics/metrics.go

@@ -0,0 +1,55 @@
+package metrics
+
+import (
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
+)
+
+var (
+	sessionsGauge = promauto.NewGauge(prometheus.GaugeOpts{
+		Name: "pgweb_sessions_count",
+		Help: "Total number of database sessions",
+	})
+
+	queriesCounter = promauto.NewCounter(prometheus.CounterOpts{
+		Name: "pgweb_queries_count",
+		Help: "Total number of custom queries executed",
+	})
+
+	healthyGauge = promauto.NewGauge(prometheus.GaugeOpts{
+		Name: "pgweb_healthy",
+		Help: "Server health status",
+	})
+
+	startTimeGauge = promauto.NewGauge(prometheus.GaugeOpts{
+		Name: "pgweb_process_start_time",
+		Help: "Server start time, seconds since unix epoch",
+	})
+
+	uptimeGauge = promauto.NewGauge(prometheus.GaugeOpts{
+		Name: "pgweb_uptime",
+		Help: "Server application uptime in seconds",
+	})
+)
+
+func init() {
+	startTimeGauge.Set(float64(time.Now().Unix()))
+}
+
+func IncrementQueriesCount() {
+	queriesCounter.Inc()
+}
+
+func SetSessionsCount(val int) {
+	sessionsGauge.Set(float64(val))
+}
+
+func SetHealthy(val bool) {
+	healthy := 0.0
+	if val {
+		healthy = 1.0
+	}
+	healthyGauge.Set(float64(healthy))
+}

pkg/metrics/server.go

@@ -0,0 +1,14 @@
+package metrics
+
+import (
+	"net/http"
+
+	"github.com/sirupsen/logrus"
+)
+
+func StartServer(logger *logrus.Logger, path string, addr string) error {
+	logger.WithField("addr", addr).WithField("path", path).Info("starting prometheus metrics server")
+
+	http.Handle(path, NewHandler())
+	return http.ListenAndServe(addr, nil)
+}

pkg/queries/field.go

@@ -0,0 +1,43 @@
+package queries
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+type field struct {
+	value string
+	re    *regexp.Regexp
+}
+
+func (f field) String() string {
+	return f.value
+}
+
+func (f field) matches(input string) bool {
+	if f.re != nil {
+		return f.re.MatchString(input)
+	}
+	return f.value == input
+}
+
+func newField(value string) (field, error) {
+	f := field{value: value}
+
+	if value == "*" { // match everything
+		f.re = reMatchAll
+	} else if reExpression.MatchString(value) { // match by given expression
+		// Make writing expressions easier for values like "foo_*"
+		if strings.Count(value, "*") == 1 {
+			value = strings.Replace(value, "*", "(.+)", 1)
+		}
+		re, err := regexp.Compile(fmt.Sprintf("^%s$", value))
+		if err != nil {
+			return f, err
+		}
+		f.re = re
+	}
+
+	return f, nil
+}

pkg/queries/field_test.go

@@ -0,0 +1,41 @@
+package queries
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_field(t *testing.T) {
+	field, err := newField("val")
+	assert.NoError(t, err)
+	assert.Equal(t, "val", field.value)
+	assert.Equal(t, true, field.matches("val"))
+	assert.Equal(t, false, field.matches("value"))
+
+	field, err = newField("*")
+	assert.NoError(t, err)
+	assert.Equal(t, "*", field.value)
+	assert.NotNil(t, field.re)
+	assert.Equal(t, true, field.matches("val"))
+	assert.Equal(t, true, field.matches("value"))
+
+	field, err = newField("(.+")
+	assert.EqualError(t, err, "error parsing regexp: missing closing ): `^(.+$`")
+	assert.NotNil(t, field)
+
+	field, err = newField("foo_*")
+	assert.NoError(t, err)
+	assert.Equal(t, "foo_*", field.value)
+	assert.NotNil(t, field.re)
+	assert.Equal(t, false, field.matches("foo"))
+	assert.Equal(t, true, field.matches("foo_bar"))
+	assert.Equal(t, true, field.matches("foo_bar_widget"))
+
+}
+
+func Test_fieldString(t *testing.T) {
+	field, err := newField("val")
+	assert.NoError(t, err)
+	assert.Equal(t, "val", field.String())
+}

pkg/queries/metadata.go

@@ -0,0 +1,148 @@
+package queries
+
+import (
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+)
+
+var (
+	reMetaPrefix  = regexp.MustCompile(`(?m)^\s*--\s*pgweb:\s*(.+)`)
+	reMetaContent = regexp.MustCompile(`([\w]+)\s*=\s*"([^"]+)"`)
+	reMatchAll    = regexp.MustCompile(`^(.+)$`)
+	reExpression  = regexp.MustCompile(`[\[\]\(\)\+\*]+`)
+
+	allowedKeys  = []string{"title", "description", "host", "user", "database", "mode", "timeout"}
+	allowedModes = map[string]bool{"readonly": true, "*": true}
+)
+
+type Metadata struct {
+	Title       string
+	Description string
+	Host        field
+	User        field
+	Database    field
+	Mode        field
+	Timeout     *time.Duration
+}
+
+func parseMetadata(input string) (*Metadata, error) {
+	fields, err := parseFields(input)
+	if err != nil {
+		return nil, err
+	}
+	if fields == nil {
+		return nil, nil
+	}
+
+	// Host must be set to limit queries availability
+	if fields["host"] == "" {
+		return nil, fmt.Errorf("host field must be set")
+	}
+
+	// Allow matching for any user, database and mode by default
+	if fields["user"] == "" {
+		fields["user"] = "*"
+	}
+	if fields["database"] == "" {
+		fields["database"] = "*"
+	}
+	if fields["mode"] == "" {
+		fields["mode"] = "*"
+	}
+
+	hostField, err := newField(fields["host"])
+	if err != nil {
+		return nil, fmt.Errorf(`error initializing "host" field: %w`, err)
+	}
+
+	userField, err := newField(fields["user"])
+	if err != nil {
+		return nil, fmt.Errorf(`error initializing "user" field: %w`, err)
+	}
+
+	dbField, err := newField(fields["database"])
+	if err != nil {
+		return nil, fmt.Errorf(`error initializing "database" field: %w`, err)
+	}
+
+	if !allowedModes[fields["mode"]] {
+		return nil, fmt.Errorf(`invalid "mode" field value: %q`, fields["mode"])
+	}
+	modeField, err := newField(fields["mode"])
+	if err != nil {
+		return nil, fmt.Errorf(`error initializing "mode" field: %w`, err)
+	}
+
+	var timeout *time.Duration
+	if fields["timeout"] != "" {
+		timeoutSec, err := strconv.Atoi(fields["timeout"])
+		if err != nil {
+			return nil, fmt.Errorf(`error initializing "timeout" field: %w`, err)
+		}
+		timeoutVal := time.Duration(timeoutSec) * time.Second
+		timeout = &timeoutVal
+	}
+
+	return &Metadata{
+		Title:       fields["title"],
+		Description: fields["description"],
+		Host:        hostField,
+		User:        userField,
+		Database:    dbField,
+		Mode:        modeField,
+		Timeout:     timeout,
+	}, nil
+}
+
+func parseFields(input string) (map[string]string, error) {
+	result := map[string]string{}
+	seenKeys := map[string]bool{}
+
+	allowed := map[string]bool{}
+	for _, key := range allowedKeys {
+		allowed[key] = true
+	}
+
+	matches := reMetaPrefix.FindAllStringSubmatch(input, -1)
+	if len(matches) == 0 {
+		return nil, nil
+	}
+
+	for _, match := range matches {
+		content := reMetaContent.FindAllStringSubmatch(match[1], -1)
+		if len(content) == 0 {
+			continue
+		}
+
+		for _, field := range content {
+			key := field[1]
+			value := field[2]
+
+			if !allowed[key] {
+				return result, fmt.Errorf("unknown key: %q", key)
+			}
+			if seenKeys[key] {
+				return result, fmt.Errorf("duplicate key: %q", key)
+			}
+
+			seenKeys[key] = true
+			result[key] = value
+		}
+	}
+
+	return result, nil
+}
+
+func sanitizeMetadata(input string) string {
+	lines := []string{}
+	for _, line := range strings.Split(input, "\n") {
+		line = reMetaPrefix.ReplaceAllString(line, "")
+		if len(line) > 0 {
+			lines = append(lines, line)
+		}
+	}
+	return strings.Join(lines, "\n")
+}

pkg/queries/metadata_test.go

@@ -0,0 +1,146 @@
+package queries
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_parseFields(t *testing.T) {
+	examples := []struct {
+		input string
+		err   error
+		vals  map[string]string
+	}{
+		{input: "", err: nil, vals: nil},
+		{input: "foobar", err: nil, vals: nil},
+		{input: "-- no pgweb meta", err: nil, vals: nil},
+		{
+			input: `--pgweb: foo=bar`,
+			err:   nil,
+			vals:  map[string]string{},
+		},
+		{
+			input: `--pgweb: host="localhost"`,
+			err:   nil,
+			vals:  map[string]string{"host": "localhost"},
+		},
+		{
+			input: `--pgweb: host="*" user="admin" database  ="mydb"; mode = "readonly"`,
+			err:   nil,
+			vals: map[string]string{
+				"host":     "*",
+				"database": "mydb",
+				"user":     "admin",
+				"mode":     "readonly",
+			},
+		},
+	}
+
+	for _, ex := range examples {
+		t.Run(ex.input, func(t *testing.T) {
+			fields, err := parseFields(ex.input)
+			assert.Equal(t, ex.err, err)
+			assert.Equal(t, ex.vals, fields)
+		})
+	}
+}
+
+func Test_parseMetadata(t *testing.T) {
+	examples := []struct {
+		input string
+		err   string
+		check func(meta *Metadata) bool
+	}{
+		{
+			input: `--pgweb: `,
+			err:   `host field must be set`,
+		},
+		{
+			input: `--pgweb: hello="world"`,
+			err:   `unknown key: "hello"`,
+		},
+		{
+			input: `--pgweb: host="localhost" user="anyuser" database="anydb" mode="foo"`,
+			err:   `invalid "mode" field value: "foo"`,
+		},
+		{
+			input: "--pgweb2:",
+			check: func(m *Metadata) bool {
+				return m == nil
+			},
+		},
+		{
+			input: `--pgweb: host="localhost"`,
+			check: func(m *Metadata) bool {
+				return m.Host.value == "localhost" &&
+					m.User.value == "*" &&
+					m.Database.value == "*" &&
+					m.Mode.value == "*" &&
+					m.Timeout == nil
+			},
+		},
+		{
+			input: `--pgweb: host="localhost" user="anyuser" database="anydb" mode="*"`,
+			check: func(m *Metadata) bool {
+				return m.Host.value == "localhost" &&
+					m.Host.re == nil &&
+					m.User.value == "anyuser" &&
+					m.Database.value == "anydb" &&
+					m.Mode.value == "*" &&
+					m.Timeout == nil
+			},
+		},
+		{
+			input: `--pgweb: host="localhost" timeout="foo"`,
+			err:   `error initializing "timeout" field: strconv.Atoi: parsing "foo": invalid syntax`,
+		},
+		{
+			input: `-- pgweb: host="local(host|dev)"`,
+			check: func(m *Metadata) bool {
+				return m.Host.value == "local(host|dev)" && m.Host.re != nil &&
+					m.Host.matches("localhost") && m.Host.matches("localdev") &&
+					!m.Host.matches("localfoo") && !m.Host.matches("superlocaldev")
+			},
+		},
+	}
+
+	for _, ex := range examples {
+		t.Run(ex.input, func(t *testing.T) {
+			meta, err := parseMetadata(ex.input)
+			if ex.err != "" {
+				assert.Contains(t, err.Error(), ex.err)
+			}
+			if ex.check != nil {
+				assert.Equal(t, true, ex.check(meta))
+			}
+		})
+	}
+}
+
+func Test_sanitizeMetadata(t *testing.T) {
+	examples := []struct {
+		input  string
+		output string
+	}{
+		{input: "", output: ""},
+		{input: "foo", output: "foo"},
+		{
+			input: `
+-- pgweb: metadata
+query1
+-- pgweb: more metadata
+
+query2
+
+`,
+			output: "query1\nquery2",
+		},
+	}
+
+	for _, ex := range examples {
+		t.Run(ex.input, func(t *testing.T) {
+			assert.Equal(t, ex.output, sanitizeMetadata(ex.input))
+		})
+	}
+}

pkg/queries/query.go

@@ -0,0 +1,23 @@
+package queries
+
+type Query struct {
+	ID   string
+	Path string
+	Meta *Metadata
+	Data string
+}
+
+// IsPermitted returns true if a query is allowed to execute for a given db context
+func (q Query) IsPermitted(host, user, database, mode string) bool {
+	// All fields must be provided for matching
+	if q.Meta == nil || host == "" || user == "" || database == "" || mode == "" {
+		return false
+	}
+
+	meta := q.Meta
+
+	return meta.Host.matches(host) &&
+		meta.User.matches(user) &&
+		meta.Database.matches(database) &&
+		meta.Mode.matches(mode)
+}

pkg/queries/query_test.go

@@ -0,0 +1,77 @@
+package queries
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestQueryIsPermitted(t *testing.T) {
+	examples := []struct {
+		name     string
+		query    Query
+		args     []string
+		expected bool
+	}{
+		{
+			name:     "no input provided",
+			query:    makeQuery("localhost", "someuser", "somedb", "default"),
+			args:     makeArgs("", "", "", ""),
+			expected: false,
+		},
+		{
+			name:     "match on host",
+			query:    makeQuery("localhost", "*", "*", "*"),
+			args:     makeArgs("localhost", "user", "db", "default"),
+			expected: true,
+		},
+		{
+			name:     "match on full set",
+			query:    makeQuery("localhost", "user", "database", "mode"),
+			args:     makeArgs("localhost", "someuser", "somedb", "default"),
+			expected: false,
+		},
+		{
+			name:     "match on partial database",
+			query:    makeQuery("localhost", "*", "myapp_*", "*"),
+			args:     makeArgs("localhost", "user", "myapp_development", "default"),
+			expected: true,
+		},
+		{
+			name:     "match on full set but not mode",
+			query:    makeQuery("localhost", "*", "*", "readonly"),
+			args:     makeArgs("localhost", "user", "db", "default"),
+			expected: false,
+		},
+	}
+
+	for _, ex := range examples {
+		t.Run(ex.name, func(t *testing.T) {
+			result := ex.query.IsPermitted(ex.args[0], ex.args[1], ex.args[2], ex.args[3])
+			assert.Equal(t, ex.expected, result)
+		})
+	}
+}
+
+func makeArgs(vals ...string) []string {
+	return vals
+}
+
+func makeQuery(host, user, database, mode string) Query {
+	mustfield := func(input string) field {
+		f, err := newField(input)
+		if err != nil {
+			panic(err)
+		}
+		return f
+	}
+
+	return Query{
+		Meta: &Metadata{
+			Host:     mustfield(host),
+			User:     mustfield(user),
+			Database: mustfield(database),
+			Mode:     mustfield(mode),
+		},
+	}
+}

pkg/queries/store.go

@@ -0,0 +1,88 @@
+package queries
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+var (
+	ErrQueryDirNotExist  = errors.New("queries directory does not exist")
+	ErrQueryFileNotExist = errors.New("query file does not exist")
+)
+
+type Store struct {
+	dir string
+}
+
+func NewStore(dir string) *Store {
+	return &Store{
+		dir: dir,
+	}
+}
+
+func (s Store) Read(id string) (*Query, error) {
+	path := filepath.Join(s.dir, fmt.Sprintf("%s.sql", id))
+	return readQuery(path)
+}
+
+func (s Store) ReadAll() ([]Query, error) {
+	entries, err := os.ReadDir(s.dir)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			err = ErrQueryDirNotExist
+		}
+		return nil, err
+	}
+
+	queries := []Query{}
+
+	for _, entry := range entries {
+		name := entry.Name()
+		if filepath.Ext(name) != ".sql" {
+			continue
+		}
+
+		path := filepath.Join(s.dir, name)
+		query, err := readQuery(path)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "[WARN] skipping %q query file due to error: %v\n", name, err)
+			continue
+		}
+		if query == nil {
+			continue
+		}
+
+		queries = append(queries, *query)
+	}
+
+	return queries, nil
+}
+
+func readQuery(path string) (*Query, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return nil, ErrQueryFileNotExist
+		}
+		return nil, err
+	}
+	dataStr := string(data)
+
+	meta, err := parseMetadata(dataStr)
+	if err != nil {
+		return nil, err
+	}
+	if meta == nil {
+		return nil, nil
+	}
+
+	return &Query{
+		ID:   strings.Replace(filepath.Base(path), ".sql", "", 1),
+		Path: path,
+		Meta: meta,
+		Data: sanitizeMetadata(dataStr),
+	}, nil
+}

pkg/queries/store_test.go

@@ -0,0 +1,71 @@
+//go:build !windows
+
+package queries
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestStoreReadAll(t *testing.T) {
+	t.Run("valid dir", func(t *testing.T) {
+		queries, err := NewStore("../../data").ReadAll()
+		assert.NoError(t, err)
+		assert.Equal(t, 2, len(queries))
+	})
+
+	t.Run("invalid dir", func(t *testing.T) {
+		queries, err := NewStore("../../data2").ReadAll()
+		assert.Equal(t, err.Error(), "queries directory does not exist")
+		assert.Equal(t, 0, len(queries))
+	})
+}
+
+func TestStoreRead(t *testing.T) {
+	examples := []struct {
+		id    string
+		err   string
+		check func(*testing.T, *Query)
+	}{
+		{id: "foo", err: "query file does not exist"},
+		{id: "lc_no_meta"},
+		{id: "lc_invalid_meta", err: `invalid "mode" field value: "foo"`},
+		{
+			id: "lc_example1",
+			check: func(t *testing.T, q *Query) {
+				assert.Equal(t, "lc_example1", q.ID)
+				assert.Equal(t, "../../data/lc_example1.sql", q.Path)
+				assert.Equal(t, "select 'foo'", q.Data)
+				assert.Equal(t, "localhost", q.Meta.Host.String())
+				assert.Equal(t, "*", q.Meta.User.String())
+				assert.Equal(t, "*", q.Meta.Database.String())
+			},
+		},
+		{
+			id: "lc_example2",
+			check: func(t *testing.T, q *Query) {
+				assert.Equal(t, "lc_example2", q.ID)
+				assert.Equal(t, "../../data/lc_example2.sql", q.Path)
+				assert.Equal(t, "-- some comment\nselect 'foo'", q.Data)
+				assert.Equal(t, "localhost", q.Meta.Host.String())
+				assert.Equal(t, "foo", q.Meta.User.String())
+				assert.Equal(t, "*", q.Meta.Database.String())
+			},
+		},
+	}
+
+	store := NewStore("../../data")
+
+	for _, ex := range examples {
+		t.Run(ex.id, func(t *testing.T) {
+			query, err := store.Read(ex.id)
+			if ex.err != "" || err != nil {
+				assert.Equal(t, ex.err, err.Error())
+			}
+			if ex.check != nil {
+				ex.check(t, query)
+			}
+		})
+	}
+}

pkg/shared/ssh_info.go

@@ -0,0 +1,19 @@
+package shared
+
+import (
+	"fmt"
+)
+
+// SSHInfo contains ssh server configuration
+type SSHInfo struct {
+	Host        string `json:"host,omitempty"`
+	Port        string `json:"port,omitempty"`
+	User        string `json:"user,omitempty"`
+	Password    string `json:"password,omitempty"`
+	Key         string `json:"key,omitempty"`
+	KeyPassword string `json:"keypassword,omitempty"`
+}
+
+func (info SSHInfo) String() string {
+	return fmt.Sprintf("%s@%s:%s", info.User, info.Host, info.Port)
+}