block-database-access.sh

#!/bin/bash
# Block direct database CLI access and cloud-sql-proxy socket usage.
# Defense-in-depth: complements deny rules in settings.json.
# Exit code 2 blocks the tool and sends stderr as feedback to Claude.

INPUT=$(cat)
CMD=$(echo "$INPUT" | jq -r '.tool_input.command // ""' 2>/dev/null)

# Extract the first token of the command (the actual binary being invoked)
# This avoids false positives when DB keywords appear in commit messages, strings, etc.
FIRST_TOKEN=$(echo "$CMD" | sed 's/^[[:space:]]*//' | awk '{print $1}')

# Block MySQL CLI tools invoked as primary command
DB_TOOLS="mysql|mysqldump|mysqladmin|mysqlsh|mycli"
if echo "$FIRST_TOKEN" | grep -qEi "^($DB_TOOLS)$"; then
    echo "BLOCKED: Direct database CLI access is forbidden. Use the application layer (API, ORM) to interact with databases. This rule protects production data from unintended modifications." >&2
    exit 2
fi

# Block DB tools invoked after pipe, semicolon, &&, || or via subshell
if echo "$CMD" | grep -qEi '(;|\||&&|\|\|)\s*(mysql|mysqldump|mysqladmin|mysqlsh|mycli)\b'; then
    echo "BLOCKED: Direct database CLI access is forbidden (chained command detected). Use the application layer instead." >&2
    exit 2
fi

# Block DB tools invoked via docker exec or similar wrappers
if echo "$CMD" | grep -qEi 'exec\s+(--?\w+\s+)*\w+\s+(mysql|mysqldump|mysqladmin|mysqlsh|mycli)\b'; then
    echo "BLOCKED: Direct database CLI access via container exec is forbidden. Use the application layer instead." >&2
    exit 2
fi

# Block any reference to cloud-sql-proxy sockets
if echo "$CMD" | grep -qF '/tmp/cloud-sql-proxy-sockets'; then
    echo "BLOCKED: Direct access to cloud-sql-proxy sockets is forbidden. These sockets provide raw access to production databases. Use the application layer instead." >&2
    exit 2
fi