4bnode 4.1.2 → 4.1.4

package/skeleton/.4bnode/dev-api.js

@@ -22,6 +22,8 @@ import {
   generateMongooseModel,
   buildZodSchemaFile,
   wireValidateIntoRouteContent,
+  buildAuthMiddleware,
+  wireAuthIntoRouteContent,
   addImportAfterLastImport,
   insertBeforeListenContent,
   AI_PLAN_SCHEMA,
@@ -1184,7 +1186,6 @@ router.get('/api/status', (req, res) => {
       rateLimit: indexContent.includes("from 'express-rate-limit'") || indexContent.includes('rateLimit('),
       errorHandler: mwExists('errorHandler.js'),
       roles: mwExists('roles.js'),
-      apiKey: mwExists('apiKey.js'),
       validation: mwExists('validate.js'),
     };
 
@@ -1203,11 +1204,8 @@ router.get('/api/status', (req, res) => {
       serialportConfigured,
       security,
       aiConfigured: !!getActiveAiKey(),
-      jobsConfigured: fs.existsSync(path.join(process.cwd(), 'src', 'jobs', 'scheduler.js')),
       docsConfigured: fs.existsSync(path.join(process.cwd(), 'src', 'docs.js')),
-      deployConfigured: fs.existsSync(path.join(process.cwd(), 'Dockerfile')),
-      mailConfigured: fs.existsSync(path.join(process.cwd(), 'src', 'services', 'mailer.js')),
-      testsConfigured: fs.existsSync(path.join(process.cwd(), 'vitest.config.js'))
+      mailConfigured: fs.existsSync(path.join(process.cwd(), 'src', 'services', 'mailer.js'))
     });
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -1215,38 +1213,8 @@ router.get('/api/status', (req, res) => {
 });
 
 // ---------------------------------------------------------------------------
-// API Key management — named keys + metadata in src/api-keys.json. This file
-// ships with the app (unlike .4bnode), and the apiKey middleware reads it live,
-// so generate/revoke take effect without a restart. Writing a .json file is not
-// watched by nodemon, so no restart is triggered here either.
+// Security configuration
 // ---------------------------------------------------------------------------
-function apiKeysFilePath() {
-  return path.join(process.cwd(), 'src', 'api-keys.json');
-}
-function readApiKeys() {
-  try {
-    const p = apiKeysFilePath();
-    if (fs.existsSync(p)) {
-      const list = JSON.parse(fs.readFileSync(p, 'utf8'));
-      if (Array.isArray(list)) return list;
-    }
-  } catch {}
-  return [];
-}
-function writeApiKeys(list) {
-  const p = apiKeysFilePath();
-  fs.mkdirSync(path.dirname(p), { recursive: true });
-  fs.writeFileSync(p, JSON.stringify(list, null, 2) + '\n', 'utf8');
-}
-function genApiKey(label) {
-  return {
-    id: crypto.randomBytes(8).toString('hex'),
-    label: (String(label || '').trim() || 'Untitled').slice(0, 60),
-    key: 'sk_' + crypto.randomBytes(24).toString('hex'),
-    createdAt: new Date().toISOString(),
-  };
-}
-
 // GET/POST rate-limit config — stored in .env (read by index.js at startup).
 router.get('/api/security/rate-limit', (req, res) => {
   try {
@@ -1271,56 +1239,6 @@ router.post('/api/security/rate-limit', (req, res) => {
   }
 });
 
-// GET — list keys + whether the apiKey middleware is configured
-router.get('/api/security/api-keys', (req, res) => {
-  try {
-    const configured = fs.existsSync(path.join(process.cwd(), 'src', 'middleware', 'apiKey.js'));
-    res.json({ configured, keys: readApiKeys() });
-  } catch (err) {
-    res.status(500).json({ error: err.message });
-  }
-});
-
-// POST — generate a new named key
-router.post('/api/security/api-keys', (req, res) => {
-  try {
-    const list = readApiKeys();
-    const key = genApiKey(req.body && req.body.label);
-    list.push(key);
-    writeApiKeys(list);
-    res.json({ message: 'API key generated.', key });
-  } catch (err) {
-    res.status(500).json({ error: err.message });
-  }
-});
-
-// PATCH — rename a key
-router.patch('/api/security/api-keys/:id', (req, res) => {
-  try {
-    const list = readApiKeys();
-    const key = list.find((k) => k.id === req.params.id);
-    if (!key) return res.status(404).json({ error: 'Key not found.' });
-    key.label = (String((req.body && req.body.label) || '').trim() || key.label).slice(0, 60);
-    writeApiKeys(list);
-    res.json({ message: 'API key renamed.', key });
-  } catch (err) {
-    res.status(500).json({ error: err.message });
-  }
-});
-
-// DELETE — revoke a key
-router.delete('/api/security/api-keys/:id', (req, res) => {
-  try {
-    const before = readApiKeys();
-    const after = before.filter((k) => k.id !== req.params.id);
-    if (after.length === before.length) return res.status(404).json({ error: 'Key not found.' });
-    writeApiKeys(after);
-    res.json({ message: 'API key revoked.' });
-  } catch (err) {
-    res.status(500).json({ error: err.message });
-  }
-});
-
 // ---------------------------------------------------------------------------
 // AI Builder — describe a backend in English, generate models + CRUD routes
 // ---------------------------------------------------------------------------
@@ -1564,12 +1482,164 @@ router.post('/api/ai/apply', async (req, res) => {
   }
 });
 
+// ---------------------------------------------------------------------------
+// API Documentation (OpenAPI spec + self-contained docs page at /docs)
+// ---------------------------------------------------------------------------
+function projectTitle() {
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'package.json'), 'utf8'));
+    return pkg.name || 'API';
+  } catch { return 'API'; }
+}
+
+// All models → { name, fields[] } for the OpenAPI components/schemas.
+function collectModels() {
+  const dir = path.join(process.cwd(), 'src', 'models');
+  if (!fs.existsSync(dir)) return [];
+  return fs.readdirSync(dir).filter((f) => f.endsWith('.js')).map((f) => {
+    const name = f.replace(/\.js$/, '');
+    const detailed = getModelSchemaDetailed(name);
+    return { name, fields: (detailed && detailed.fields) || [] };
+  });
+}
+
+// Parse every route file into endpoint descriptors (method, path, params, query,
+// body fields with model types) for the OpenAPI builder.
+function collectEndpoints() {
+  const routesDir = path.join(process.cwd(), 'src', 'routes');
+  if (!fs.existsSync(routesDir)) return [];
+  const indexPath = path.join(process.cwd(), 'index.js');
+  const indexContent = fs.existsSync(indexPath) ? fs.readFileSync(indexPath, 'utf8') : '';
+  const out = [];
+  fs.readdirSync(routesDir).filter((f) => f.endsWith('.js')).forEach((file) => {
+    const name = file.replace(/\.js$/, '');
+    const content = fs.readFileSync(path.join(routesDir, file), 'utf8');
+
+    let prefix = '/api/' + name;
+    const reg = indexContent.match(new RegExp("app\\.use\\(['\"]([^'\"]+)['\"]\\s*,\\s*\\w+Router\\s*\\)[^\\n]*" + name, 'i'))
+      || indexContent.match(new RegExp("app\\.use\\(['\"]([^'\"]+)['\"]\\s*,\\s*" + toCamelCase(name) + "Router"));
+    if (reg) prefix = reg[1];
+
+    const modelImportMatch = content.match(/import\s+(\w+)\s+from\s+['"]\.\.\/models\/(\w+)['"]/);
+    const modelFields = modelImportMatch ? (getModelSchemaDetailed(modelImportMatch[2]).fields || []) : [];
+
+    const epRegex = /router\.(get|post|put|patch|delete)\(\s*['"`](\/[^'"`]*?)['"`]\s*,\s*([\s\S]*?)(?=\nrouter\.|\nexport |$)/gi;
+    let m;
+    while ((m = epRegex.exec(content)) !== null) {
+      const method = m[1].toUpperCase();
+      const epath = m[2];
+      const body = m[3] || '';
+      const bodyFields = extractRequestFields(body, 'body').map((fn) => {
+        const meta = modelFields.find((x) => x.name === fn);
+        return { name: fn, type: (meta && meta.type) || 'String', required: !!(meta && meta.required) };
+      });
+      const queryFields = extractRequestFields(body, 'query').map((fn) => ({ name: fn, type: 'String' }));
+      const params = (epath.match(/:(\w+)/g) || []).map((p) => p.slice(1));
+      const hasAuth = /authorization|jwt|bearer|x-api-key/i.test(body);
+      const fullPath = (prefix + (epath === '/' ? '' : epath)).replace(/\/{2,}/g, '/');
+      out.push({ method, path: epath, fullPath, params, queryFields, bodyFields, fileFields: [], hasAuth });
+    }
+  });
+  return out;
+}
+
+function generateSpecFile() {
+  const spec = buildOpenApiSpec({ title: projectTitle(), endpoints: collectEndpoints(), models: collectModels() });
+  fs.writeFileSync(path.join(process.cwd(), 'src', 'openapi.json'), JSON.stringify(spec, null, 2), 'utf8');
+  return spec;
+}
+
+// Keep the API docs in sync automatically: whenever routes or models change, the
+// spec is regenerated — but only if docs have been set up. Writing openapi.json is
+// a .json write, so it doesn't trigger a nodemon restart.
+function refreshDocsSpec() {
+  try {
+    if (fs.existsSync(path.join(process.cwd(), 'src', 'docs.js'))) generateSpecFile();
+  } catch {}
+}
+
+const docsAuthFile = () => path.join(process.cwd(), 'src', 'docs-auth.json');
+
+// GET /api/docs — setup status + endpoint count + whether docs are password-protected
+router.get('/api/docs', (req, res) => {
+  try {
+    const configured = fs.existsSync(path.join(process.cwd(), 'src', 'docs.js'));
+    res.json({ configured, endpointCount: collectEndpoints().length, passwordProtected: fs.existsSync(docsAuthFile()) });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// POST /api/docs/setup — create the docs route, generate the spec, wire index.js
+router.post('/api/docs/setup', (req, res) => {
+  try {
+    // Writing src/docs.js and index.js triggers a nodemon restart (it watches .js
+    // files). Respond FIRST so the restart can't drop this request, THEN write.
+    res.json({ message: 'API docs set up at /docs.', endpointCount: collectEndpoints().length });
+    fs.writeFileSync(path.join(process.cwd(), 'src', 'docs.js'), buildDocsRouter(), 'utf8');
+    generateSpecFile();
+    addImportToIndex("import docsRouter from './src/docs.js';");
+    const reg = "app.use('/docs', docsRouter);";
+    if (!readIndexFile().includes(reg)) insertBeforeListen(reg);
+  } catch (err) {
+    if (!res.headersSent) res.status(500).json({ error: err.message });
+  }
+});
+
+// POST /api/docs/regenerate — rebuild the spec + refresh the docs page
+router.post('/api/docs/regenerate', (req, res) => {
+  try {
+    const docsPath = path.join(process.cwd(), 'src', 'docs.js');
+    if (!fs.existsSync(docsPath)) {
+      return res.status(400).json({ error: 'Set up API docs first.' });
+    }
+    res.json({ message: 'API spec regenerated.', endpointCount: collectEndpoints().length });
+    generateSpecFile();
+    fs.writeFileSync(docsPath, buildDocsRouter(), 'utf8');
+  } catch (err) {
+    if (!res.headersSent) res.status(500).json({ error: err.message });
+  }
+});
+
+// POST /api/docs/password — protect /docs with a password (single password, no username)
+router.post('/api/docs/password', (req, res) => {
+  try {
+    const password = String((req.body && req.body.password) || '');
+    if (password.length < 6) {
+      return res.status(400).json({ error: 'Password must be at least 6 characters.' });
+    }
+    const hash = crypto.createHash('sha256').update(password).digest('hex');
+    fs.mkdirSync(path.join(process.cwd(), 'src'), { recursive: true });
+    fs.writeFileSync(docsAuthFile(), JSON.stringify({ hash }, null, 2) + '\n', 'utf8');
+    const docsPath = path.join(process.cwd(), 'src', 'docs.js');
+    const needsUpgrade = fs.existsSync(docsPath) && !fs.readFileSync(docsPath, 'utf8').includes('docs_auth');
+    res.json({
+      message: needsUpgrade
+        ? 'Docs password set — updating the docs route (server will restart).'
+        : 'Docs are now password-protected.',
+    });
+    if (needsUpgrade) fs.writeFileSync(docsPath, buildDocsRouter(), 'utf8');
+  } catch (err) {
+    if (!res.headersSent) res.status(500).json({ error: err.message });
+  }
+});
+
+// DELETE /api/docs/password — remove protection (docs become open again)
+router.delete('/api/docs/password', (req, res) => {
+  try {
+    if (fs.existsSync(docsAuthFile())) fs.unlinkSync(docsAuthFile());
+    res.json({ message: 'Docs password removed.' });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
 // ---------------------------------------------------------------------------
 // POST /api/add-api
 // ---------------------------------------------------------------------------
 router.post('/api/add-api', async (req, res) => {
   try {
-    const { name, pathPrefix = '/api/', routeType, methods = [], modelName, loginField, passwordField, registerFields = [], selectedFields = [], customFields = [] } = req.body;
+    const { name, pathPrefix = '/api/', routeType, methods = [], modelName, loginField, passwordField, registerFields = [], selectedFields = [], customFields = [], authRequired = false } = req.body;
     // Legacy support: single method field
     const method = req.body.method;
 
@@ -1596,6 +1666,7 @@ router.post('/api/add-api', async (req, res) => {
     const allFieldsCombined = [...selectedFields.map(f => typeof f === 'string' ? { name: f, type: 'String' } : f), ...customFields];
     const needsMulter = allFieldsCombined.some(f => f.type === 'File');
     if (needsMulter) packagesToInstall.push('multer');
+    if (authRequired && type !== 'login' && type !== 'register') packagesToInstall.push('jsonwebtoken');
     if (packagesToInstall.length > 0) {
       recordDeps(packagesToInstall);
       await execAsync(`npm install ${packagesToInstall.join(' ')}`, { cwd: process.cwd() });
@@ -1930,6 +2001,21 @@ export default router;
       content = wireValidateIntoRouteContent(content, safeName);
     }
 
+    // Require JWT auth on this route: ensure the auth middleware + JWT_SECRET exist,
+    // then protect every endpoint. Login/register are exempt (they issue tokens).
+    if (authRequired && type !== 'login' && type !== 'register') {
+      const authPath = path.join(process.cwd(), 'src', 'middleware', 'auth.js');
+      if (!fs.existsSync(authPath)) {
+        fs.mkdirSync(path.dirname(authPath), { recursive: true });
+        fs.writeFileSync(authPath, buildAuthMiddleware(), 'utf8');
+      }
+      const envFile = path.join(process.cwd(), '.env');
+      if (!getEnvValue(envFile, 'JWT_SECRET')) {
+        updateEnvFile(envFile, 'JWT_SECRET', crypto.randomBytes(32).toString('hex'));
+      }
+      content = wireAuthIntoRouteContent(content);
+    }
+
     fs.writeFileSync(routeFilePath, content, 'utf8');
 
     const label = type === 'methods' ? methodList.map(m => m.toUpperCase()).join(', ') : type === 'crud' ? 'CRUD (' + (methodList.length > 0 ? methodList.map(m => m.toUpperCase()).join(', ') : 'ALL') + ')' : type === 'plain' ? 'PLAIN' : type.toUpperCase();

package/skeleton/_gitignore

@@ -2,7 +2,6 @@
 .env
 .env.*
 !.env.example
-src/api-keys.json
 src/docs-auth.json
 
 # Dependencies

package/skeleton/index.js

@@ -8,12 +8,15 @@ import helmet from "helmet";
 import rateLimit from "express-rate-limit";
 import { createInterface } from "readline";
 import { notFound, errorHandler } from "./src/middleware/errorHandler.js";
-import apiKey from "./src/middleware/apiKey.js";
 
 // ── Environment ─────────────────────────────────────
 dotenv.config();
 
 const app = express();
+// Behind reverse proxies (e.g. nginx → load balancer). Lets Express read the real
+// client IP from X-Forwarded-For so rate limiting and req.ip are correct. The number
+// is how many proxy hops to trust — adjust to your infrastructure.
+app.set("trust proxy", 2);
 const port = process.env.PORT || 3000;
 const __dirname = path.resolve();
 
@@ -54,13 +57,6 @@ const apiLimiter = rateLimit({
 });
 app.use(apiLimiter);
 
-// ── API key gate ─────────────────────────────────────
-// Every /api/* request must present a valid key in the `x-api-key` header.
-// Manage keys in the dashboard (API Keys). Set API_KEY_REQUIRED=off to disable.
-if (process.env.API_KEY_REQUIRED !== "off") {
-  app.use("/api", apiKey);
-}
-
 // ── Static Files ────────────────────────────────────
 app.use(express.static(path.join(__dirname, "public")));
 

package/skeleton/.4bnode/assets/js/pages/ApiKeysPage.js

@@ -1,164 +0,0 @@
-import React, { useState, useEffect } from "react";
-import { LuKeyRound, LuPlus, LuTrash2, LuCopy, LuEye, LuEyeOff, LuPencil, LuCheck, LuX } from "react-icons/lu";
-import { html, api, copyToClipboard } from "../lib.js";
-import { useApp } from "../context.js";
-
-export function ApiKeysPage() {
-  const { toast, showConfirm } = useApp();
-  const [keys, setKeys] = useState(null);
-  const [label, setLabel] = useState("");
-  const [busy, setBusy] = useState(false);
-  const [revealed, setRevealed] = useState({});
-  const [editId, setEditId] = useState(null);
-  const [editLabel, setEditLabel] = useState("");
-
-  async function load() {
-    try {
-      const r = await api("/security/api-keys");
-      setKeys(r.keys || []);
-    } catch (err) {
-      toast(err.message, "error");
-      setKeys([]);
-    }
-  }
-  useEffect(() => { load(); }, []);
-
-  async function generate() {
-    setBusy(true);
-    try {
-      const r = await api("/security/api-keys", { method: "POST", body: { label: label.trim() } });
-      setLabel("");
-      setRevealed((s) => ({ ...s, [r.key.id]: true }));
-      toast("API key generated", "success");
-      await load();
-    } catch (err) {
-      toast(err.message, "error");
-    }
-    setBusy(false);
-  }
-
-  async function revoke(k) {
-    const ok = await showConfirm(`Revoke API key "${k.label}"? Any client using it will stop working immediately.`, { danger: true, confirmLabel: "Revoke" });
-    if (!ok) return;
-    try {
-      await api("/security/api-keys/" + k.id, { method: "DELETE" });
-      toast("API key revoked", "success");
-      await load();
-    } catch (err) {
-      toast(err.message, "error");
-    }
-  }
-
-  function startRename(k) {
-    setEditId(k.id);
-    setEditLabel(k.label);
-  }
-  function cancelRename() {
-    setEditId(null);
-    setEditLabel("");
-  }
-  async function saveRename(k) {
-    const next = editLabel.trim();
-    if (!next || next === k.label) { cancelRename(); return; }
-    try {
-      await api("/security/api-keys/" + k.id, { method: "PATCH", body: { label: next } });
-      toast("API key renamed", "success");
-      cancelRename();
-      await load();
-    } catch (err) {
-      toast(err.message, "error");
-    }
-  }
-
-  function copy(k) {
-    copyToClipboard(k.key);
-    toast("Key copied to clipboard", "success");
-  }
-
-  function mask(key) {
-    if (key.length <= 12) return key;
-    return key.slice(0, 7) + "…" + key.slice(-4);
-  }
-
-  function fmtDate(iso) {
-    if (!iso) return "";
-    try { return new Date(iso).toLocaleDateString(undefined, { year: "numeric", month: "short", day: "numeric" }); }
-    catch { return ""; }
-  }
-
-  return html`<div>
-    <div className="flex items-center gap-2 mb-1">
-      <${LuKeyRound} size=${20} />
-      <div className="card-title" style=${{ margin: 0 }}>API Keys</div>
-    </div>
-    <div className="card-subtitle mb-4">
-      Named keys for machine/service access. A caller sends one in the
-      <span style=${{ fontFamily: "monospace" }}> x-api-key</span> header.
-      Protect a route with <span style=${{ fontFamily: "monospace" }}>apiKey</span> middleware:
-      <span style=${{ fontFamily: "monospace" }}>app.use('/api/private', apiKey)</span>.
-      Keys live in <span style=${{ fontFamily: "monospace" }}>src/api-keys.json</span> and take effect immediately.
-    </div>
-
-    <div className="card">
-      <div style=${{ display: "flex", gap: "8px", marginBottom: "16px", flexWrap: "wrap" }}>
-        <input className="form-input" placeholder="Key name (e.g. Mobile app, Partner X)"
-          value=${label} maxLength=${60}
-          onInput=${(e) => setLabel(e.target.value)}
-          onKeyDown=${(e) => { if (e.key === "Enter" && !busy) generate(); }}
-          style=${{ flex: 1, minWidth: "220px" }} />
-        <button className="btn btn-primary" onClick=${generate} disabled=${busy}>
-          ${busy ? html`<span className="spinner" />` : html`<${LuPlus} size=${15} />`} Generate key
-        </button>
-      </div>
-
-      ${keys === null
-        ? html`<div className="text-muted text-sm">Loading…</div>`
-        : keys.length === 0
-          ? html`<div className="text-muted text-sm">No keys yet — generate one above.</div>`
-          : html`<div style=${{ display: "flex", flexDirection: "column", gap: "8px" }}>
-              ${keys.map((k) => html`<div key=${k.id}
-                style=${{ display: "flex", alignItems: "center", gap: "10px", padding: "10px 12px",
-                  border: "1px solid var(--border)", borderRadius: "10px", background: "var(--bg-surface)" }}>
-                <div style=${{ flex: 1, minWidth: 0 }}>
-                  ${editId === k.id
-                    ? html`<input className="form-input" autoFocus value=${editLabel} maxLength=${60}
-                        onInput=${(e) => setEditLabel(e.target.value)}
-                        onKeyDown=${(e) => { if (e.key === "Enter") saveRename(k); if (e.key === "Escape") cancelRename(); }}
-                        style=${{ fontSize: "13px", padding: "4px 8px", marginBottom: "2px", maxWidth: "260px" }} />`
-                    : html`<div style=${{ fontWeight: 600, fontSize: "13px" }}>${k.label}</div>`}
-                  <div style=${{ fontFamily: "monospace", fontSize: "12px", color: "var(--text-muted)" }}>
-                    ${revealed[k.id] ? k.key : mask(k.key)}
-                    ${k.createdAt && html`<span style=${{ marginLeft: "8px" }}>· ${fmtDate(k.createdAt)}</span>`}
-                  </div>
-                </div>
-                ${editId === k.id
-                  ? html`<${React.Fragment}>
-                      <button className="btn btn-sm btn-ghost" title="Save" onClick=${() => saveRename(k)}
-                        style=${{ color: "var(--success, #22c55e)" }}>
-                        <${LuCheck} size=${15} />
-                      </button>
-                      <button className="btn btn-sm btn-ghost" title="Cancel" onClick=${cancelRename}>
-                        <${LuX} size=${15} />
-                      </button>
-                    <//>`
-                  : html`<${React.Fragment}>
-                      <button className="btn btn-sm btn-ghost" title="Rename" onClick=${() => startRename(k)}>
-                        <${LuPencil} size=${15} />
-                      </button>
-                      <button className="btn btn-sm btn-ghost" title=${revealed[k.id] ? "Hide" : "Reveal"}
-                        onClick=${() => setRevealed((s) => ({ ...s, [k.id]: !s[k.id] }))}>
-                        ${revealed[k.id] ? html`<${LuEyeOff} size=${15} />` : html`<${LuEye} size=${15} />`}
-                      </button>
-                      <button className="btn btn-sm btn-ghost" title="Copy" onClick=${() => copy(k)}>
-                        <${LuCopy} size=${15} />
-                      </button>
-                      <button className="btn btn-sm btn-ghost" title="Revoke" onClick=${() => revoke(k)}
-                        style=${{ color: "var(--danger, #ef4444)" }}>
-                        <${LuTrash2} size=${15} />
-                      </button>
-                    <//>`}
-              </div>`)}
-            </div>`}
-    </div>
-  </div>`;
-}