4bnode 4.1.4 → 4.1.5

package/lib/codegen.js

@@ -363,6 +363,56 @@ export default ${camel}Schema;
 `;
 }
 
+// Parse a Zod validator's source into a { fieldName: isRequired } map for the
+// top-level fields of its `z.object({ ... })`. A field is "required" for the API
+// when its Zod chain has no `.optional()`/`.nullish()` — i.e. the request is
+// rejected without it. This is the right source of truth for OpenAPI `required`,
+// because the validator (not the Mongoose model) is what actually gates a request:
+// a field can be optional in the DB schema yet required by the API, or vice versa.
+// Returns null if no `z.object({...})` is found (caller should fall back to the model).
+export function requiredFieldsFromZod(src) {
+  if (!src || typeof src !== "string") return null;
+  const objIdx = src.indexOf("z.object(");
+  if (objIdx === -1) return null;
+  const braceStart = src.indexOf("{", objIdx);
+  if (braceStart === -1) return null;
+  // Walk balanced brackets so nested objects/arrays/calls don't end the block early.
+  let depth = 0;
+  let end = -1;
+  for (let i = braceStart; i < src.length; i++) {
+    const c = src[i];
+    if (c === "{" || c === "(" || c === "[") depth++;
+    else if (c === "}" || c === ")" || c === "]") {
+      depth--;
+      if (depth === 0 && c === "}") { end = i; break; }
+    }
+  }
+  if (end === -1) return null;
+  const inner = src.slice(braceStart + 1, end);
+  const map = {};
+  const flush = (entry) => {
+    const colon = entry.indexOf(":");
+    if (colon === -1) return;
+    const key = entry.slice(0, colon).trim().replace(/^['"]|['"]$/g, "");
+    if (!/^[A-Za-z_$][\w$]*$/.test(key)) return;
+    const expr = entry.slice(colon + 1);
+    // .nullable() still requires the key (value may be null), so it doesn't count.
+    map[key] = !/\.(optional|nullish)\s*\(\s*\)/.test(expr);
+  };
+  // Split top-level "key: expr" entries on depth-0 commas.
+  let d = 0;
+  let cur = "";
+  for (let i = 0; i < inner.length; i++) {
+    const c = inner[i];
+    if (c === "{" || c === "(" || c === "[") d++;
+    else if (c === "}" || c === ")" || c === "]") d--;
+    if (c === "," && d === 0) { flush(cur); cur = ""; }
+    else cur += c;
+  }
+  if (cur.trim()) flush(cur);
+  return Object.keys(map).length ? map : null;
+}
+
 // Wire `validate(<model>Schema)` into the write endpoints of a route file, and add
 // the two needed imports. POST/PUT use the full schema; PATCH uses
 // `<schema>.partial()` so partial updates aren't forced to send every required
@@ -446,13 +496,29 @@ app.use(helmet({
     imports.push("import rateLimit from 'express-rate-limit';");
     beforeRoutesParts.push(
       `// ── Rate limiting ──
+// Generous global cap — high enough that real frontends (which fire many calls
+// per page) never notice, low enough to stop scraping/abuse at scale.
+// Window + cap are read from .env (RATE_LIMIT_WINDOW_MS / RATE_LIMIT_MAX) so the
+// dashboard's Security page can tune them; fall back to 15 min / 500 requests.
 const apiLimiter = rateLimit({
+  windowMs: Number(process.env.RATE_LIMIT_WINDOW_MS) || 15 * 60 * 1000,
+  max: Number(process.env.RATE_LIMIT_MAX) || 500,
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+// Strict cap for authentication routes — defends against password brute-forcing.
+// Point this at your real auth routes (login / signup / password-reset).
+const authLimiter = rateLimit({
   windowMs: 15 * 60 * 1000, // 15 minutes
-  max: 100,                 // limit each IP to 100 requests per window
+  max: 10,                  // 10 attempts per IP per window
   standardHeaders: true,
   legacyHeaders: false,
 });
-app.use(apiLimiter);`
+// Only throttle in production — in dev, repeated/hot-reload requests shouldn't hit 429.
+if (process.env.NODE_ENV === 'production') {
+  app.use('/api/auth', authLimiter); // strict limiter first, on auth routes
+  app.use(apiLimiter);               // generous global limiter for everything else
+}`
     );
   }
   if (has("errorHandler")) {
@@ -729,6 +795,7 @@ export const PACKAGE_VERSIONS = {
   "@serialport/parser-readline": "^12.0.0",
   mongoose: "^8.8.0",
   multer: "^1.4.5-lts.1",
+  nodemailer: "^6.9.0",
 };
 
 // Add packages to package.json (dependencies, or devDependencies when dev:true).
@@ -780,6 +847,30 @@ export function extractRequestFields(handlerBody, source = "body") {
   return names;
 }
 
+// Detect multer upload fields in a route handler so the OpenAPI builder can mark
+// the body as multipart/form-data with the right file fields. Handles:
+//   upload.single('avatar')                        -> [{name:'avatar'}]
+//   upload.array('photos', 5)                      -> [{name:'photos'}]
+//   upload.fields([{ name: 'a' }, { name: 'b' }])  -> [{name:'a'},{name:'b'}]
+export function extractFileFields(handlerBody) {
+  const body = handlerBody || "";
+  const out = [];
+  const seen = new Set();
+  const add = (name) => { if (name && !seen.has(name)) { seen.add(name); out.push({ name }); } };
+  (body.match(/upload\.(?:single|array)\(\s*['"]([^'"]+)['"]/g) || []).forEach((s) => {
+    const m = s.match(/['"]([^'"]+)['"]/);
+    if (m) add(m[1]);
+  });
+  const fieldsCall = body.match(/upload\.fields\(\s*\[([\s\S]*?)\]/);
+  if (fieldsCall) {
+    (fieldsCall[1].match(/name\s*:\s*['"]([^'"]+)['"]/g) || []).forEach((n) => {
+      const m = n.match(/['"]([^'"]+)['"]/);
+      if (m) add(m[1]);
+    });
+  }
+  return out;
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // API Documentation — OpenAPI 3 spec + Swagger UI (served at /docs).
 // Reuses extractRequestFields output (endpoints) and model field metadata.
@@ -825,7 +916,9 @@ export function buildOpenApiSpec({ title = "API", version = "1.0.0", endpoints =
       const properties = {};
       const required = [];
       bodyFields.forEach((f) => { properties[f.name] = openApiType(f.type); if (f.required) required.push(f.name); });
-      fileFields.forEach((f) => { properties[f.name] = { type: "string", format: "binary" }; });
+      // Uploaded files are required by default (an upload endpoint exists to receive
+      // the file). A file field can opt out with required:false.
+      fileFields.forEach((f) => { properties[f.name] = { type: "string", format: "binary" }; if (f.required !== false) required.push(f.name); });
       const schema = { type: "object", properties };
       if (required.length) schema.required = required;
       const mime = fileFields.length ? "multipart/form-data" : "application/json";
@@ -912,21 +1005,19 @@ export function buildDocsHtml(specUrl = "openapi.json") {
   .req { color:#ef4444; font-size:11px; font-weight:700; }
   .opt { color:var(--faint); font-size:11px; }
   .resp-code { font-family:ui-monospace,Menlo,monospace; color:#22c55e; font-weight:700; }
-  input.f, textarea.f { width:100%; max-width:540px; background:var(--input); border:1px solid var(--border);
-    color:var(--text); border-radius:8px; padding:8px 10px; font-size:13px; outline:none;
+  .tabs { display:flex; gap:4px; flex-wrap:wrap; }
+  .tab { background:var(--input); color:var(--muted); border:1px solid var(--border); border-bottom:none;
+    border-radius:8px 8px 0 0; padding:6px 13px; font-size:12px; cursor:pointer; }
+  .tab:hover { color:var(--text); }
+  .tab.active { background:#0a0c12; color:var(--accent-light); }
+  .code-wrap { position:relative; max-width:560px; }
+  pre.code { background:#0a0c12; border:1px solid var(--border); border-radius:0 8px 8px 8px; padding:14px;
+    font-size:12.5px; color:#d5d8e3; overflow:auto; white-space:pre; margin:0;
     font-family:ui-monospace,Menlo,monospace; }
-  input.f:focus, textarea.f:focus { border-color:var(--accent); }
-  textarea.f { min-height:110px; resize:vertical; }
-  .try-field { margin-bottom:10px; }
-  .try-label { font-size:12px; color:var(--muted); margin-bottom:4px; display:block; }
-  .btn { background:var(--accent); color:#fff; border:none; border-radius:8px; padding:9px 18px;
-    font-size:13px; font-weight:600; cursor:pointer; }
-  .btn:hover { filter:brightness(1.08); }
-  .btn:disabled { opacity:.5; cursor:not-allowed; }
-  pre.out { background:#0a0c12; border:1px solid var(--border); border-radius:8px; padding:12px;
-    font-size:12.5px; color:#d5d8e3; overflow:auto; max-height:360px; max-width:540px; white-space:pre-wrap;
-    word-break:break-word; margin-top:10px; }
-  .out-status { font-family:ui-monospace,Menlo,monospace; font-size:12px; margin-top:10px; }
+  pre.code.hidden { display:none; }
+  .copy-btn { position:absolute; top:8px; right:8px; background:var(--card); color:var(--muted);
+    border:1px solid var(--border); border-radius:6px; padding:4px 10px; font-size:11px; cursor:pointer; z-index:2; }
+  .copy-btn:hover { color:var(--text); }
   ::-webkit-scrollbar { width:9px; height:9px; }
   ::-webkit-scrollbar-thumb { background:rgba(255,255,255,0.12); border-radius:6px; }
 </style>
@@ -957,6 +1048,90 @@ export function buildDocsHtml(specUrl = "openapi.json") {
   function groupKey(p){return (p.split('/').filter(Boolean)[0]||'general').replace(/[{}]/g,'');}
   function collect(spec){var out=[];var paths=spec.paths||{};Object.keys(paths).forEach(function(p){var item=paths[p];Object.keys(item).forEach(function(m){out.push({path:p,method:m,op:item[m]});});});return out;}
 
+  // ── Client code samples (generated from the spec — no AI, no network) ──
+  function sampleUrl(e){return (location.origin||'')+e.path;}
+  function bodyForSample(e){var b=bodyOf(e.op);if(b&&['post','put','patch'].indexOf(e.method)>=0)return b;return null;}
+  function indentBody(str,extra){var NL=String.fromCharCode(10);return str.split(NL).map(function(ln,i){return i===0?ln:extra+ln;}).join(NL);}
+  function isMultipart(b){return !!(b&&b.mime==='multipart/form-data');}
+  // Body fields with a flag for binary (file) fields, used to build multipart samples.
+  function fieldList(b){var p=(b&&b.schema&&b.schema.properties)||{};return Object.keys(p).map(function(k){return {name:k,file:!!(p[k]&&p[k].format==='binary')};});}
+  // FormData lines for a multipart body: files become a File object, others a string.
+  function formLines(b){
+    var out=["const form = new FormData();"];
+    fieldList(b).forEach(function(f){
+      out.push("form.append('"+f.name+"', "+(f.file?"fileInput.files[0]":"''")+");"+(f.file?" // a File from an <input type=file>":""));
+    });
+    return out;
+  }
+  function curlSample(e){
+    var NL=String.fromCharCode(10),BS=String.fromCharCode(92);var b=bodyForSample(e);var L=[];
+    L.push("curl -X "+e.method.toUpperCase()+" '"+sampleUrl(e)+"'");
+    if(e.op.security)L.push("-H 'Authorization: Bearer <token>'");
+    if(b&&isMultipart(b)){
+      // curl sets the multipart Content-Type (with boundary) itself; -F per field.
+      fieldList(b).forEach(function(f){L.push("-F '"+f.name+"="+(f.file?"@/path/to/file":"")+"'");});
+    } else if(b){
+      L.push("-H 'Content-Type: application/json'");
+      var c;try{c=JSON.stringify(JSON.parse(bodySkeleton(b.schema)));}catch(x){c=bodySkeleton(b.schema);}
+      L.push("-d '"+c+"'");
+    }
+    return L.join(" "+BS+NL+"  ");
+  }
+  function fetchSample(e){
+    var NL=String.fromCharCode(10);var b=bodyForSample(e);var mp=b&&isMultipart(b);var L=[];
+    if(mp)formLines(b).forEach(function(ln){L.push(ln);});
+    L.push("const res = await fetch('"+sampleUrl(e)+"', {");
+    L.push("  method: '"+e.method.toUpperCase()+"',");
+    var h=[];
+    // For multipart, never set Content-Type by hand — the browser adds the boundary.
+    if(b&&!mp)h.push("    'Content-Type': 'application/json'");
+    if(e.op.security)h.push("    'Authorization': 'Bearer <token>'");
+    if(h.length){L.push("  headers: {");L.push(h.join(","+NL));L.push("  },");}
+    if(mp)L.push("  body: form");
+    else if(b)L.push("  body: JSON.stringify("+indentBody(bodySkeleton(b.schema),"  ")+")");
+    L.push("});");
+    L.push("const data = await res.json();");
+    L.push("console.log(data);");
+    return L.join(NL);
+  }
+  function axiosSample(e){
+    var NL=String.fromCharCode(10);var b=bodyForSample(e);var mp=b&&isMultipart(b);var L=[];
+    if(mp)formLines(b).forEach(function(ln){L.push(ln);});
+    L.push("const res = await axios({");
+    L.push("  method: '"+e.method.toLowerCase()+"',");
+    L.push("  url: '"+sampleUrl(e)+"',");
+    if(e.op.security)L.push("  headers: { 'Authorization': 'Bearer <token>' },");
+    if(mp)L.push("  data: form");
+    else if(b)L.push("  data: "+indentBody(bodySkeleton(b.schema),"  "));
+    L.push("});");
+    L.push("console.log(res.data);");
+    return L.join(NL);
+  }
+  function jquerySample(e){
+    var NL=String.fromCharCode(10);var b=bodyForSample(e);var mp=b&&isMultipart(b);var L=[];
+    if(mp)formLines(b).forEach(function(ln){L.push(ln);});
+    L.push("$.ajax({");
+    L.push("  url: '"+sampleUrl(e)+"',");
+    L.push("  method: '"+e.method.toUpperCase()+"',");
+    if(mp){L.push("  data: form,");L.push("  processData: false,");L.push("  contentType: false,");}
+    else if(b)L.push("  contentType: 'application/json',");
+    if(e.op.security)L.push("  headers: { 'Authorization': 'Bearer <token>' },");
+    if(b&&!mp)L.push("  data: JSON.stringify("+indentBody(bodySkeleton(b.schema),"  ")+"),");
+    L.push("  success: function(data) {");
+    L.push("    console.log(data);");
+    L.push("  }");
+    L.push("});");
+    return L.join(NL);
+  }
+  function buildSamples(e){
+    return [
+      {lang:'curl',label:'cURL',code:curlSample(e)},
+      {lang:'fetch',label:'JavaScript (fetch)',code:fetchSample(e)},
+      {lang:'axios',label:'axios',code:axiosSample(e)},
+      {lang:'jquery',label:'jQuery',code:jquerySample(e)}
+    ];
+  }
+
   function detailsHtml(e,id){
     var html='';
     var pp=paramsOf(e.op,'path'),qp=paramsOf(e.op,'query'),body=bodyOf(e.op);
@@ -978,44 +1153,34 @@ export function buildDocsHtml(specUrl = "openapi.json") {
     Object.keys(resp).forEach(function(code){
       html+='<div class="row"><span class="resp-code">'+esc(code)+'</span><span class="detail-sum" style="margin:0">'+esc((resp[code]||{}).description||'')+'</span></div>';
     });
-    html+='<div class="sec">Try it</div>';
-    pp.forEach(function(p){html+='<div class="try-field"><label class="try-label">'+esc(p.name)+' (path)</label><input class="f" data-kind="path" data-name="'+esc(p.name)+'" /></div>';});
-    qp.forEach(function(p){html+='<div class="try-field"><label class="try-label">'+esc(p.name)+' (query)</label><input class="f" data-kind="query" data-name="'+esc(p.name)+'" /></div>';});
-    if(e.op.security){html+='<div class="try-field"><label class="try-label">Authorization (Bearer token)</label><input class="f" id="'+id+'_auth" placeholder="token" /></div>';}
-    if(body){html+='<div class="try-field"><label class="try-label">Body (JSON)</label><textarea class="f" id="'+id+'_body">'+esc(bodySkeleton(body.schema))+'</textarea></div>';}
-    html+='<button class="btn" id="'+id+'_send">Send request</button>';
-    html+='<div class="out-status" id="'+id+'_status"></div>';
-    html+='<pre class="out" id="'+id+'_out" style="display:none"></pre>';
+    var samples=buildSamples(e);
+    html+='<div class="sec">Code samples</div>';
+    html+='<div class="tabs" id="'+id+'_tabs">';
+    samples.forEach(function(s,i){html+='<button class="tab'+(i===0?' active':'')+'" data-lang="'+s.lang+'">'+esc(s.label)+'</button>';});
+    html+='</div>';
+    html+='<div class="code-wrap"><button class="copy-btn">Copy</button>';
+    samples.forEach(function(s,i){html+='<pre class="code'+(i===0?'':' hidden')+'" data-lang="'+s.lang+'">'+esc(s.code)+'</pre>';});
+    html+='</div>';
     return html;
   }
 
-  function wireTry(e,id,root){
-    var btn=root.querySelector('#'+id+'_send');if(!btn)return;
-    // Auto-grow the body textarea to fit its content (capped, then scrolls).
-    var bodyTa=root.querySelector('#'+id+'_body');
-    if(bodyTa){
-      var autosize=function(){ bodyTa.style.height='auto'; bodyTa.style.height=Math.min(bodyTa.scrollHeight+2,600)+'px'; };
-      bodyTa.addEventListener('input',autosize);
-      autosize();
-    }
-    btn.addEventListener('click',function(){
-      var url=e.path;
-      root.querySelectorAll('[data-kind=path]').forEach(function(inp){url=url.replace('{'+inp.getAttribute('data-name')+'}',encodeURIComponent(inp.value||''));});
-      var qs=[];
-      root.querySelectorAll('[data-kind=query]').forEach(function(inp){if(inp.value)qs.push(encodeURIComponent(inp.getAttribute('data-name'))+'='+encodeURIComponent(inp.value));});
-      if(qs.length)url+=(url.indexOf('?')>=0?'&':'?')+qs.join('&');
-      var opts={method:e.method.toUpperCase(),headers:{}};
-      var auth=root.querySelector('#'+id+'_auth');if(auth&&auth.value)opts.headers['Authorization']='Bearer '+auth.value;
-      var bodyEl=root.querySelector('#'+id+'_body');
-      if(bodyEl&&['post','put','patch'].indexOf(e.method)>=0){opts.headers['Content-Type']='application/json';opts.body=bodyEl.value;}
-      var statusEl=root.querySelector('#'+id+'_status');var outEl=root.querySelector('#'+id+'_out');
-      btn.disabled=true;statusEl.textContent='Sending...';var t0=Date.now();
-      fetch(url,opts).then(function(r){var ct=r.headers.get('content-type')||'';return r.text().then(function(txt){return {r:r,txt:txt,ct:ct};});}).then(function(d){
-        var color=d.r.ok?'#22c55e':'#ef4444';
-        statusEl.innerHTML='<span style="color:'+color+'">'+d.r.status+' '+esc(d.r.statusText)+'</span> &middot; '+(Date.now()-t0)+'ms';
-        var out=d.txt;if(d.ct.indexOf('application/json')>=0){try{out=JSON.stringify(JSON.parse(d.txt),null,2);}catch(err){}}
-        outEl.style.display='block';outEl.textContent=out;
-      }).catch(function(err){statusEl.innerHTML='<span style="color:#ef4444">Request failed</span>';outEl.style.display='block';outEl.textContent=String(err);}).then(function(){btn.disabled=false;});
+  function wireSamples(id,root){
+    var tabs=root.querySelector('#'+id+'_tabs');if(!tabs)return;
+    var btns=tabs.querySelectorAll('.tab');
+    btns.forEach(function(b){
+      b.addEventListener('click',function(){
+        var lang=b.getAttribute('data-lang');
+        btns.forEach(function(x){x.classList.remove('active');});b.classList.add('active');
+        root.querySelectorAll('pre.code[data-lang]').forEach(function(p){p.classList.toggle('hidden',p.getAttribute('data-lang')!==lang);});
+      });
+    });
+    var copy=root.querySelector('.copy-btn');
+    if(copy)copy.addEventListener('click',function(){
+      var active=root.querySelector('pre.code[data-lang]:not(.hidden)');if(!active)return;
+      var txt=active.textContent;
+      if(navigator.clipboard&&navigator.clipboard.writeText){navigator.clipboard.writeText(txt);}
+      else{var ta=document.createElement('textarea');ta.value=txt;document.body.appendChild(ta);ta.select();try{document.execCommand('copy');}catch(x){}document.body.removeChild(ta);}
+      copy.textContent='Copied';setTimeout(function(){copy.textContent='Copy';},1200);
     });
   }
 
@@ -1030,7 +1195,7 @@ export function buildDocsHtml(specUrl = "openapi.json") {
     html+='<div class="detail-sum">'+esc(e.op.summary||'')+lock+'</div>';
     html+=detailsHtml(e,id);
     main.innerHTML=html;main.scrollTop=0;
-    wireTry(e,id,main);
+    wireSamples(id,main);
   }
 
   function render(spec){
@@ -1208,9 +1373,9 @@ export default router;
 // Email (nodemailer) — SMTP with presets for popular providers (Brevo, etc.).
 // ─────────────────────────────────────────────────────────────────────────────
 export const MAIL_PROVIDERS = {
+  mailgun:  { label: "Mailgun",          host: "smtp.mailgun.org",        port: 587, secure: false, hint: "Postmaster user + SMTP password" },
   brevo:    { label: "Brevo",            host: "smtp-relay.brevo.com",    port: 587, secure: false, hint: "Login email + SMTP key (SMTP & API → SMTP)" },
   sendgrid: { label: "SendGrid",         host: "smtp.sendgrid.net",       port: 587, secure: false, user: "apikey", hint: "User is literally 'apikey'; pass is your API key" },
-  mailgun:  { label: "Mailgun",          host: "smtp.mailgun.org",        port: 587, secure: false, hint: "Postmaster user + SMTP password" },
   gmail:    { label: "Gmail",            host: "smtp.gmail.com",          port: 465, secure: true,  hint: "Use an App Password, not your login password" },
   mailtrap: { label: "Mailtrap (test)",  host: "sandbox.smtp.mailtrap.io", port: 587, secure: false, hint: "Sandbox inbox for testing" },
   smtp:     { label: "Custom SMTP",      host: "", port: 587, secure: false, hint: "Any SMTP server" },
@@ -1248,14 +1413,19 @@ export function emailTemplate({ title = '', body = '' } = {}) {
 }
 
 // Send an email. Pass html or text (or use emailTemplate for html).
-export async function sendMail({ to, subject, html, text, from } = {}) {
+// attachments: [{ filename, path }] or [{ filename, content }] (nodemailer format).
+export async function sendMail({ to, subject, html, text, from, cc, bcc, replyTo, attachments } = {}) {
   if (!to || !subject) throw new Error('sendMail requires { to, subject }');
   return transporter.sendMail({
     from: from || process.env.SMTP_FROM || process.env.SMTP_USER,
     to,
+    cc,
+    bcc,
+    replyTo,
     subject,
     text,
     html,
+    attachments,
   });
 }
 

package/lib/codegen.test.js

@@ -23,6 +23,8 @@ import {
   buildRolesGuardFile,
   buildValidateFile,
   buildZodSchemaFile,
+  requiredFieldsFromZod,
+  extractFileFields,
   wireValidateIntoRouteContent,
   buildAuthMiddleware,
   wireAuthIntoRouteContent,
@@ -175,6 +177,35 @@ test("buildZodSchemaFile maps mongoose types and optionality", () => {
   assert.ok(out.includes("export const userSchema"));
 });
 
+test("extractFileFields detects multer single/array/fields", () => {
+  assert.deepEqual(extractFileFields("upload.single('resume'), async"), [{ name: "resume" }]);
+  assert.deepEqual(extractFileFields("upload.array('photos', 5),"), [{ name: "photos" }]);
+  assert.deepEqual(
+    extractFileFields("upload.fields([{ name: 'a', maxCount: 1 }, { name: 'b' }]),"),
+    [{ name: "a" }, { name: "b" }]
+  );
+  assert.deepEqual(extractFileFields("async (req, res) => { res.json({}); }"), []);
+});
+
+test("requiredFieldsFromZod reads required-ness from .optional()", () => {
+  // Round-trip the actual generated validator format.
+  const src = buildZodSchemaFile("user", [
+    { name: "email", type: "String", required: true },
+    { name: "age", type: "Number" },
+    { name: "owner", type: "ObjectId", required: true },
+  ]);
+  const req = requiredFieldsFromZod(src);
+  assert.equal(req.email, true);   // no .optional() → required
+  assert.equal(req.age, false);    // .optional() → not required
+  assert.equal(req.owner, true);   // chained .regex() but no .optional() → required
+  // Handles nested objects/arrays without ending the block early.
+  const nested = `z.object({ a: z.string(), b: z.array(z.object({ c: z.number() })).optional(), d: z.string() })`;
+  const r2 = requiredFieldsFromZod(nested);
+  assert.deepEqual(r2, { a: true, b: false, d: true });
+  // No z.object → null so callers fall back to the model.
+  assert.equal(requiredFieldsFromZod("export const x = 1;"), null);
+});
+
 test("wireValidateIntoRouteContent guards write endpoints only, idempotently", () => {
   const route = [
     "import express from 'express';",
@@ -448,6 +479,10 @@ test("buildOpenApiSpec uses multipart when file fields present", () => {
   const spec = buildOpenApiSpec({ endpoints: [{ method: "POST", fullPath: "/api/upload", bodyFields: [], fileFields: [{ name: "avatar" }] }] });
   const schema = spec.paths["/api/upload"].post.requestBody.content["multipart/form-data"].schema;
   assert.deepEqual(schema.properties.avatar, { type: "string", format: "binary" });
+  assert.deepEqual(schema.required, ["avatar"]); // files are required by default
+  // ...unless the field opts out
+  const optional = buildOpenApiSpec({ endpoints: [{ method: "POST", fullPath: "/api/upload", bodyFields: [], fileFields: [{ name: "avatar", required: false }] }] });
+  assert.equal(optional.paths["/api/upload"].post.requestBody.content["multipart/form-data"].schema.required, undefined);
 });
 
 test("buildDocsHtml + buildDocsRouter are well-formed, self-contained (no CDN, no Swagger)", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "4bnode",
-  "version": "4.1.4",
+  "version": "4.1.5",
   "description": "4bnode is a CLI-powered backend development platform with a built-in visual dashboard to generate, manage, and test Node.js/Express APIs faster.",
   "main": "index.js",
   "type": "module",

package/skeleton/.4bnode/assets/js/components/Sidebar.js

@@ -29,7 +29,7 @@ export function Sidebar() {
       lockMsg: "Requires database",
     },
     { id: "routes", label: "API Routes", icon: Icons.route },
-    // { id: "docs", label: "API Docs", icon: Icons.docs },  // hidden for now
+    { id: "docs", label: "API Docs", icon: Icons.docs },
     { id: "api-tester", label: "API Tester", icon: Icons.apiTester },
     {
       id: "security",
@@ -39,7 +39,7 @@ export function Sidebar() {
     },
     { id: "realtime", label: "Real-time", icon: Icons.realtime },
     { id: "serialport", label: "SerialPort", icon: Icons.serial },
-    // { id: "mail", label: "Email", icon: Icons.mail },  // hidden for now
+    { id: "mail", label: "Email", icon: Icons.mail },
     { id: "logs", label: "Logs", icon: Icons.logs, section: "Settings" },
     { id: "env", label: "Environment", icon: Icons.env },
   ];