$ show clidey/whodb
WhoDB is a self-hosted, multi-database workspace and management platform by Clidey (Apache-2.0). The production system is a Go backend (chi router, gqlgen GraphQL API, BAML-generated LLM clients) served alongside a React/TypeScript SPA (Vite, Apollo, Redux), plus a Cobra/Bubbletea CLI/TUI, a Wails desktop app, an MCP server exposing database tools to AI agents, and multi-language SDKs (Python, TypeScript, Go, Rust, Java) targeting the hosted platform API. It lets users browse/edit/query rows, inspect schemas and relationships, run arbitrary SQL/NoSQL commands, import/export CSV and Excel, generate mock data, and chat with an AI assistant that produces SQL, explains queries, and executes verified operations. Supported engines include PostgreSQL, MySQL/MariaDB, SQLite, CockroachDB, TiDB, DuckDB, ClickHouse, QuestDB, YugabyteDB, MongoDB, Redis/Valkey/Dragonfly, Elasticsearch/OpenSearch, and Memcached, with automatic discovery of cloud-hosted instances on AWS, Azure, and GCP. Architecturally the backend is a database-plugin registry: every engine implements a PluginFunctions interface, mostly by embedding a shared GORM-based SQL plugin and overriding dialect specifics (constraint parsing, batch operations, SQL builders); non-relational stores use native adapters. Security is treated seriously: a SQL guard classifies commands as read-only vs mutating across SQL/MongoDB/Redis, egress validation blocks SSRF targets including cloud-metadata IPs, sessions use hashed cookie tokens with CSRF double-submit, and audit logging classifies events into telemetry/access/compliance. The frontend uses registry patterns (component-registry, route-registry, sidebar-registry) to keep CE/EE edition differences declarative. The most reusable pieces are security components (sqlguard read-only classification, egress SSRF filter), the mock-data generator's column-pattern matching, and the schema-diff engine — all self-contained enough to extract into other projects. The codebase is actively maintained with extensive CI/CD (Docker, npm, Snap, Windows Store, macOS releases), per-database e2e suites, and accessibility checks. Weaknesses are inherent complexity: five SDKs must stay synchronized with a generated manifest, BAML generation introduces platform-specific build stubs, cloud-provider connectivity logic is duplicated across AWS/GCP/Azure, and the broad plugin interface gives new database adapters a large implementation surface.
The LLM identified 5 files worth highlighting for reuse:
Package-level command classifier that determines whether SQL, MongoDB, or Redis statements are read-only or mutating, enabling read-only enforcement across GraphQL and MCP surfaces. Uses tokenized command detection plus dangerous-pattern blocklists (INTO OUTFILE, pg_read_file, etc.) rather than naive string matching. Self-contained classification tables and pure functions make it extractable as a standalone security library for any database-facing tool.
Validates outbound URLs against loopback, RFC1918, and cloud-metadata IP ranges (169.254.169.254 etc.) with configurable CIDR allow/deny lists and DNS rebinding defense via a safe dial context. Cleanly separated from the rest of the app, depending only on stdlib net packages and a small config surface. Demonstrates a production-grade, extractable SSRF guard for any network-facing Go service.
Ordered regex rules that map column names (email, phone, address, uuid, etc.) to realistic value generators with length-constraint awareness, used for mock-row creation across all supported databases. Pure data-plus-regex logic with zero coupling to the rest of the codebase; can be dropped into any project needing schema-aware synthetic data. The specificity-ordered matching pattern is a non-obvious design choice that avoids false positives.
Compares two database connection snapshots and produces structured added/removed/changed lists for storage units, columns, and relationships. Operates on abstract snapshot types rather than live connections, making it unit-testable without database infrastructure and reusable as a general schema-version diffing engine for migration tooling or drift detection.
Production-grade session and CSRF cookie management: hashes session tokens before any storage, uses __Host- prefixed cookies, sliding TTL, and a double-submit CSRF pattern. Implements the kind of cookie hardening most web apps get wrong, in an isolated module that can be extracted as an auth library for other Go web services.