4bnode 4.0.9 → 4.1.1

package/index.js

@@ -54,21 +54,52 @@ function updatePackageName(destinationPath, projectName) {
   );
 }
 
-function hashPasskey(pin) {
-  return crypto.createHash("sha256").update(pin).digest("hex");
+// Salted scrypt (slow KDF) so a leaked .passkey can't be brute-forced or
+// reversed via rainbow tables. Format: scrypt$<saltHex>$<hashHex>.
+function hashPasskey(passphrase) {
+  const salt = crypto.randomBytes(16);
+  const hash = crypto.scryptSync(String(passphrase), salt, 64);
+  return `scrypt$${salt.toString("hex")}$${hash.toString("hex")}`;
+}
+
+// A few obviously-weak passkeys to reject outright.
+const WEAK_PASSKEYS = new Set([
+  "password", "passw0rd", "12345678", "123456789", "1234567890",
+  "qwertyui", "11111111", "00000000", "iloveyou", "letmein1",
+]);
+
+// True if every consecutive char steps by +1 (ascending, e.g. "123456",
+// "abcdef") or by -1 (descending/reverse, e.g. "654321", "fedcba").
+function isSequential(s) {
+  if (s.length < 2) return false;
+  let asc = true;
+  let desc = true;
+  for (let i = 1; i < s.length; i++) {
+    const step = s.charCodeAt(i) - s.charCodeAt(i - 1);
+    if (step !== 1) asc = false;
+    if (step !== -1) desc = false;
+  }
+  return asc || desc;
+}
+
+// Returns an error string for a weak passkey, or null if it's acceptable.
+function passkeyWeakness(v) {
+  const s = String(v || "");
+  if (s.length < 8) return "Passkey must be at least 8 characters";
+  if (WEAK_PASSKEYS.has(s.toLowerCase())) return "That passkey is too common — pick something less guessable";
+  if (/^(.)\1+$/.test(s)) return "Don't use a single repeated character (e.g. 11111111)";
+  if (isSequential(s)) return "Don't use a sequential or reversed run (e.g. 12345678 or 87654321)";
+  return null;
 }
 
 async function promptPasskey() {
   const passkey = await password({
-    message: "Set a 6-digit passkey for the dev dashboard:",
+    message: "Set a dashboard passkey (min 8 chars, letters + numbers recommended):",
     mask: "*",
-    validate: (v) => {
-      if (!/^\d{6}$/.test(v)) return "Passkey must be exactly 6 digits";
-      return true;
-    },
+    validate: (v) => passkeyWeakness(v) || true,
   });
 
-  const confirm = await password({
+  await password({
     message: "Confirm passkey:",
     mask: "*",
     validate: (v) => {
@@ -85,6 +116,20 @@ function savePasskey(projectPath, passkey) {
   fs.writeFileSync(path.join(projectPath, ".4bnode", ".passkey"), hash, "utf8");
 }
 
+// Seed a unique API key so the baked apiKey middleware works out of the box
+// (never bundle a shared key into the skeleton — each project gets its own).
+function seedApiKey(projectPath) {
+  const file = path.join(projectPath, "src", "api-keys.json");
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const key = {
+    id: crypto.randomBytes(8).toString("hex"),
+    label: "Default",
+    key: "sk_" + crypto.randomBytes(24).toString("hex"),
+    createdAt: new Date().toISOString(),
+  };
+  fs.writeFileSync(file, JSON.stringify([key], null, 2) + "\n", "utf8");
+}
+
 async function createSkeletonApp(projectName) {
   showBanner();
 
@@ -111,6 +156,7 @@ async function createSkeletonApp(projectName) {
   console.log();
   const passkey = await promptPasskey();
   savePasskey(targetPath, passkey);
+  seedApiKey(targetPath);
   console.log(chalk.hex("#00f260").bold("  ✔ Dashboard passkey set"));
 
   const installSpinner = createSpinner("Installing dependencies...");
@@ -163,6 +209,17 @@ const addOptions = [
     requiresRoutes: true,
     requiresModels: true,
   },
+  {
+    name: "API Docs             OpenAPI 3 spec + Swagger UI at /docs",
+    value: "docs",
+    script: "add-docs.js",
+    requiresRoutes: true,
+  },
+  {
+    name: "Security             Helmet, rate-limit, RBAC, API keys, validation",
+    value: "security",
+    script: "add-security.js",
+  },
   {
     name: "Socket.IO            Real-time with Socket.IO",
     value: "socket",
@@ -178,6 +235,11 @@ const addOptions = [
     value: "serialport",
     script: "add-serialport.js",
   },
+  {
+    name: "Email                Transactional email (Brevo, SendGrid, SMTP…)",
+    value: "email",
+    script: "add-email.js",
+  },
 ];
 
 // ── List ────────────────────────────────────────────
@@ -263,9 +325,12 @@ function showHelp() {
   console.log(`  ${c("add mongo")}           MongoDB connection`);
   console.log(`  ${c("add crud")}            CRUD routes (create/read/update/delete)`);
   console.log(`  ${c("add login")}           JWT authentication & login`);
+  console.log(`  ${c("add docs")}            OpenAPI 3 spec + Swagger UI at /docs`);
+  console.log(`  ${c("add security")}        Helmet, rate-limit, RBAC, API keys, validation`);
   console.log(`  ${c("add socket")}          Socket.IO integration`);
   console.log(`  ${c("add websocket")}       Native WebSocket support`);
   console.log(`  ${c("add serialport")}      Serial port communication`);
+  console.log(`  ${c("add email")}           Transactional email (Brevo, SendGrid, SMTP)`);
   console.log();
   console.log(h("  OPTIONS\n"));
   console.log(`  ${c("-h, --help")}          Show this help message`);
@@ -394,6 +459,8 @@ async function main() {
       "add-mongo": "mongo",
       "add-crud": "crud",
       "add-login": "login",
+      "add-docs": "docs",
+      "add-security": "security",
       "add-mongo-insert": "crud",
       "add-mongo-update": "crud",
       "add-mongo-read": "crud",
@@ -401,6 +468,7 @@ async function main() {
       "add-socket": "socket",
       "add-websocket": "websocket",
       "add-serialport": "serialport",
+      "add-email": "email",
     };
     const mapped = legacyMap[command];
     if (mapped) {