4bnode 4.1.4 → 4.1.5

package/skeleton/.4bnode/codegen.js

@@ -363,6 +363,56 @@ export default ${camel}Schema;
 `;
 }
 
+// Parse a Zod validator's source into a { fieldName: isRequired } map for the
+// top-level fields of its `z.object({ ... })`. A field is "required" for the API
+// when its Zod chain has no `.optional()`/`.nullish()` — i.e. the request is
+// rejected without it. This is the right source of truth for OpenAPI `required`,
+// because the validator (not the Mongoose model) is what actually gates a request:
+// a field can be optional in the DB schema yet required by the API, or vice versa.
+// Returns null if no `z.object({...})` is found (caller should fall back to the model).
+export function requiredFieldsFromZod(src) {
+  if (!src || typeof src !== "string") return null;
+  const objIdx = src.indexOf("z.object(");
+  if (objIdx === -1) return null;
+  const braceStart = src.indexOf("{", objIdx);
+  if (braceStart === -1) return null;
+  // Walk balanced brackets so nested objects/arrays/calls don't end the block early.
+  let depth = 0;
+  let end = -1;
+  for (let i = braceStart; i < src.length; i++) {
+    const c = src[i];
+    if (c === "{" || c === "(" || c === "[") depth++;
+    else if (c === "}" || c === ")" || c === "]") {
+      depth--;
+      if (depth === 0 && c === "}") { end = i; break; }
+    }
+  }
+  if (end === -1) return null;
+  const inner = src.slice(braceStart + 1, end);
+  const map = {};
+  const flush = (entry) => {
+    const colon = entry.indexOf(":");
+    if (colon === -1) return;
+    const key = entry.slice(0, colon).trim().replace(/^['"]|['"]$/g, "");
+    if (!/^[A-Za-z_$][\w$]*$/.test(key)) return;
+    const expr = entry.slice(colon + 1);
+    // .nullable() still requires the key (value may be null), so it doesn't count.
+    map[key] = !/\.(optional|nullish)\s*\(\s*\)/.test(expr);
+  };
+  // Split top-level "key: expr" entries on depth-0 commas.
+  let d = 0;
+  let cur = "";
+  for (let i = 0; i < inner.length; i++) {
+    const c = inner[i];
+    if (c === "{" || c === "(" || c === "[") d++;
+    else if (c === "}" || c === ")" || c === "]") d--;
+    if (c === "," && d === 0) { flush(cur); cur = ""; }
+    else cur += c;
+  }
+  if (cur.trim()) flush(cur);
+  return Object.keys(map).length ? map : null;
+}
+
 // Wire `validate(<model>Schema)` into the write endpoints of a route file, and add
 // the two needed imports. POST/PUT use the full schema; PATCH uses
 // `<schema>.partial()` so partial updates aren't forced to send every required
@@ -446,13 +496,29 @@ app.use(helmet({
     imports.push("import rateLimit from 'express-rate-limit';");
     beforeRoutesParts.push(
       `// ── Rate limiting ──
+// Generous global cap — high enough that real frontends (which fire many calls
+// per page) never notice, low enough to stop scraping/abuse at scale.
+// Window + cap are read from .env (RATE_LIMIT_WINDOW_MS / RATE_LIMIT_MAX) so the
+// dashboard's Security page can tune them; fall back to 15 min / 500 requests.
 const apiLimiter = rateLimit({
+  windowMs: Number(process.env.RATE_LIMIT_WINDOW_MS) || 15 * 60 * 1000,
+  max: Number(process.env.RATE_LIMIT_MAX) || 500,
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+// Strict cap for authentication routes — defends against password brute-forcing.
+// Point this at your real auth routes (login / signup / password-reset).
+const authLimiter = rateLimit({
   windowMs: 15 * 60 * 1000, // 15 minutes
-  max: 100,                 // limit each IP to 100 requests per window
+  max: 10,                  // 10 attempts per IP per window
   standardHeaders: true,
   legacyHeaders: false,
 });
-app.use(apiLimiter);`
+// Only throttle in production — in dev, repeated/hot-reload requests shouldn't hit 429.
+if (process.env.NODE_ENV === 'production') {
+  app.use('/api/auth', authLimiter); // strict limiter first, on auth routes
+  app.use(apiLimiter);               // generous global limiter for everything else
+}`
     );
   }
   if (has("errorHandler")) {
@@ -729,6 +795,7 @@ export const PACKAGE_VERSIONS = {
   "@serialport/parser-readline": "^12.0.0",
   mongoose: "^8.8.0",
   multer: "^1.4.5-lts.1",
+  nodemailer: "^6.9.0",
 };
 
 // Add packages to package.json (dependencies, or devDependencies when dev:true).
@@ -780,6 +847,30 @@ export function extractRequestFields(handlerBody, source = "body") {
   return names;
 }
 
+// Detect multer upload fields in a route handler so the OpenAPI builder can mark
+// the body as multipart/form-data with the right file fields. Handles:
+//   upload.single('avatar')                        -> [{name:'avatar'}]
+//   upload.array('photos', 5)                      -> [{name:'photos'}]
+//   upload.fields([{ name: 'a' }, { name: 'b' }])  -> [{name:'a'},{name:'b'}]
+export function extractFileFields(handlerBody) {
+  const body = handlerBody || "";
+  const out = [];
+  const seen = new Set();
+  const add = (name) => { if (name && !seen.has(name)) { seen.add(name); out.push({ name }); } };
+  (body.match(/upload\.(?:single|array)\(\s*['"]([^'"]+)['"]/g) || []).forEach((s) => {
+    const m = s.match(/['"]([^'"]+)['"]/);
+    if (m) add(m[1]);
+  });
+  const fieldsCall = body.match(/upload\.fields\(\s*\[([\s\S]*?)\]/);
+  if (fieldsCall) {
+    (fieldsCall[1].match(/name\s*:\s*['"]([^'"]+)['"]/g) || []).forEach((n) => {
+      const m = n.match(/['"]([^'"]+)['"]/);
+      if (m) add(m[1]);
+    });
+  }
+  return out;
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // API Documentation — OpenAPI 3 spec + Swagger UI (served at /docs).
 // Reuses extractRequestFields output (endpoints) and model field metadata.
@@ -825,7 +916,9 @@ export function buildOpenApiSpec({ title = "API", version = "1.0.0", endpoints =
       const properties = {};
       const required = [];
       bodyFields.forEach((f) => { properties[f.name] = openApiType(f.type); if (f.required) required.push(f.name); });
-      fileFields.forEach((f) => { properties[f.name] = { type: "string", format: "binary" }; });
+      // Uploaded files are required by default (an upload endpoint exists to receive
+      // the file). A file field can opt out with required:false.
+      fileFields.forEach((f) => { properties[f.name] = { type: "string", format: "binary" }; if (f.required !== false) required.push(f.name); });
       const schema = { type: "object", properties };
       if (required.length) schema.required = required;
       const mime = fileFields.length ? "multipart/form-data" : "application/json";
@@ -912,21 +1005,19 @@ export function buildDocsHtml(specUrl = "openapi.json") {
   .req { color:#ef4444; font-size:11px; font-weight:700; }
   .opt { color:var(--faint); font-size:11px; }
   .resp-code { font-family:ui-monospace,Menlo,monospace; color:#22c55e; font-weight:700; }
-  input.f, textarea.f { width:100%; max-width:540px; background:var(--input); border:1px solid var(--border);
-    color:var(--text); border-radius:8px; padding:8px 10px; font-size:13px; outline:none;
+  .tabs { display:flex; gap:4px; flex-wrap:wrap; }
+  .tab { background:var(--input); color:var(--muted); border:1px solid var(--border); border-bottom:none;
+    border-radius:8px 8px 0 0; padding:6px 13px; font-size:12px; cursor:pointer; }
+  .tab:hover { color:var(--text); }
+  .tab.active { background:#0a0c12; color:var(--accent-light); }
+  .code-wrap { position:relative; max-width:560px; }
+  pre.code { background:#0a0c12; border:1px solid var(--border); border-radius:0 8px 8px 8px; padding:14px;
+    font-size:12.5px; color:#d5d8e3; overflow:auto; white-space:pre; margin:0;
     font-family:ui-monospace,Menlo,monospace; }
-  input.f:focus, textarea.f:focus { border-color:var(--accent); }
-  textarea.f { min-height:110px; resize:vertical; }
-  .try-field { margin-bottom:10px; }
-  .try-label { font-size:12px; color:var(--muted); margin-bottom:4px; display:block; }
-  .btn { background:var(--accent); color:#fff; border:none; border-radius:8px; padding:9px 18px;
-    font-size:13px; font-weight:600; cursor:pointer; }
-  .btn:hover { filter:brightness(1.08); }
-  .btn:disabled { opacity:.5; cursor:not-allowed; }
-  pre.out { background:#0a0c12; border:1px solid var(--border); border-radius:8px; padding:12px;
-    font-size:12.5px; color:#d5d8e3; overflow:auto; max-height:360px; max-width:540px; white-space:pre-wrap;
-    word-break:break-word; margin-top:10px; }
-  .out-status { font-family:ui-monospace,Menlo,monospace; font-size:12px; margin-top:10px; }
+  pre.code.hidden { display:none; }
+  .copy-btn { position:absolute; top:8px; right:8px; background:var(--card); color:var(--muted);
+    border:1px solid var(--border); border-radius:6px; padding:4px 10px; font-size:11px; cursor:pointer; z-index:2; }
+  .copy-btn:hover { color:var(--text); }
   ::-webkit-scrollbar { width:9px; height:9px; }
   ::-webkit-scrollbar-thumb { background:rgba(255,255,255,0.12); border-radius:6px; }
 </style>
@@ -957,6 +1048,90 @@ export function buildDocsHtml(specUrl = "openapi.json") {
   function groupKey(p){return (p.split('/').filter(Boolean)[0]||'general').replace(/[{}]/g,'');}
   function collect(spec){var out=[];var paths=spec.paths||{};Object.keys(paths).forEach(function(p){var item=paths[p];Object.keys(item).forEach(function(m){out.push({path:p,method:m,op:item[m]});});});return out;}
 
+  // ── Client code samples (generated from the spec — no AI, no network) ──
+  function sampleUrl(e){return (location.origin||'')+e.path;}
+  function bodyForSample(e){var b=bodyOf(e.op);if(b&&['post','put','patch'].indexOf(e.method)>=0)return b;return null;}
+  function indentBody(str,extra){var NL=String.fromCharCode(10);return str.split(NL).map(function(ln,i){return i===0?ln:extra+ln;}).join(NL);}
+  function isMultipart(b){return !!(b&&b.mime==='multipart/form-data');}
+  // Body fields with a flag for binary (file) fields, used to build multipart samples.
+  function fieldList(b){var p=(b&&b.schema&&b.schema.properties)||{};return Object.keys(p).map(function(k){return {name:k,file:!!(p[k]&&p[k].format==='binary')};});}
+  // FormData lines for a multipart body: files become a File object, others a string.
+  function formLines(b){
+    var out=["const form = new FormData();"];
+    fieldList(b).forEach(function(f){
+      out.push("form.append('"+f.name+"', "+(f.file?"fileInput.files[0]":"''")+");"+(f.file?" // a File from an <input type=file>":""));
+    });
+    return out;
+  }
+  function curlSample(e){
+    var NL=String.fromCharCode(10),BS=String.fromCharCode(92);var b=bodyForSample(e);var L=[];
+    L.push("curl -X "+e.method.toUpperCase()+" '"+sampleUrl(e)+"'");
+    if(e.op.security)L.push("-H 'Authorization: Bearer <token>'");
+    if(b&&isMultipart(b)){
+      // curl sets the multipart Content-Type (with boundary) itself; -F per field.
+      fieldList(b).forEach(function(f){L.push("-F '"+f.name+"="+(f.file?"@/path/to/file":"")+"'");});
+    } else if(b){
+      L.push("-H 'Content-Type: application/json'");
+      var c;try{c=JSON.stringify(JSON.parse(bodySkeleton(b.schema)));}catch(x){c=bodySkeleton(b.schema);}
+      L.push("-d '"+c+"'");
+    }
+    return L.join(" "+BS+NL+"  ");
+  }
+  function fetchSample(e){
+    var NL=String.fromCharCode(10);var b=bodyForSample(e);var mp=b&&isMultipart(b);var L=[];
+    if(mp)formLines(b).forEach(function(ln){L.push(ln);});
+    L.push("const res = await fetch('"+sampleUrl(e)+"', {");
+    L.push("  method: '"+e.method.toUpperCase()+"',");
+    var h=[];
+    // For multipart, never set Content-Type by hand — the browser adds the boundary.
+    if(b&&!mp)h.push("    'Content-Type': 'application/json'");
+    if(e.op.security)h.push("    'Authorization': 'Bearer <token>'");
+    if(h.length){L.push("  headers: {");L.push(h.join(","+NL));L.push("  },");}
+    if(mp)L.push("  body: form");
+    else if(b)L.push("  body: JSON.stringify("+indentBody(bodySkeleton(b.schema),"  ")+")");
+    L.push("});");
+    L.push("const data = await res.json();");
+    L.push("console.log(data);");
+    return L.join(NL);
+  }
+  function axiosSample(e){
+    var NL=String.fromCharCode(10);var b=bodyForSample(e);var mp=b&&isMultipart(b);var L=[];
+    if(mp)formLines(b).forEach(function(ln){L.push(ln);});
+    L.push("const res = await axios({");
+    L.push("  method: '"+e.method.toLowerCase()+"',");
+    L.push("  url: '"+sampleUrl(e)+"',");
+    if(e.op.security)L.push("  headers: { 'Authorization': 'Bearer <token>' },");
+    if(mp)L.push("  data: form");
+    else if(b)L.push("  data: "+indentBody(bodySkeleton(b.schema),"  "));
+    L.push("});");
+    L.push("console.log(res.data);");
+    return L.join(NL);
+  }
+  function jquerySample(e){
+    var NL=String.fromCharCode(10);var b=bodyForSample(e);var mp=b&&isMultipart(b);var L=[];
+    if(mp)formLines(b).forEach(function(ln){L.push(ln);});
+    L.push("$.ajax({");
+    L.push("  url: '"+sampleUrl(e)+"',");
+    L.push("  method: '"+e.method.toUpperCase()+"',");
+    if(mp){L.push("  data: form,");L.push("  processData: false,");L.push("  contentType: false,");}
+    else if(b)L.push("  contentType: 'application/json',");
+    if(e.op.security)L.push("  headers: { 'Authorization': 'Bearer <token>' },");
+    if(b&&!mp)L.push("  data: JSON.stringify("+indentBody(bodySkeleton(b.schema),"  ")+"),");
+    L.push("  success: function(data) {");
+    L.push("    console.log(data);");
+    L.push("  }");
+    L.push("});");
+    return L.join(NL);
+  }
+  function buildSamples(e){
+    return [
+      {lang:'curl',label:'cURL',code:curlSample(e)},
+      {lang:'fetch',label:'JavaScript (fetch)',code:fetchSample(e)},
+      {lang:'axios',label:'axios',code:axiosSample(e)},
+      {lang:'jquery',label:'jQuery',code:jquerySample(e)}
+    ];
+  }
+
   function detailsHtml(e,id){
     var html='';
     var pp=paramsOf(e.op,'path'),qp=paramsOf(e.op,'query'),body=bodyOf(e.op);
@@ -978,44 +1153,34 @@ export function buildDocsHtml(specUrl = "openapi.json") {
     Object.keys(resp).forEach(function(code){
       html+='<div class="row"><span class="resp-code">'+esc(code)+'</span><span class="detail-sum" style="margin:0">'+esc((resp[code]||{}).description||'')+'</span></div>';
     });
-    html+='<div class="sec">Try it</div>';
-    pp.forEach(function(p){html+='<div class="try-field"><label class="try-label">'+esc(p.name)+' (path)</label><input class="f" data-kind="path" data-name="'+esc(p.name)+'" /></div>';});
-    qp.forEach(function(p){html+='<div class="try-field"><label class="try-label">'+esc(p.name)+' (query)</label><input class="f" data-kind="query" data-name="'+esc(p.name)+'" /></div>';});
-    if(e.op.security){html+='<div class="try-field"><label class="try-label">Authorization (Bearer token)</label><input class="f" id="'+id+'_auth" placeholder="token" /></div>';}
-    if(body){html+='<div class="try-field"><label class="try-label">Body (JSON)</label><textarea class="f" id="'+id+'_body">'+esc(bodySkeleton(body.schema))+'</textarea></div>';}
-    html+='<button class="btn" id="'+id+'_send">Send request</button>';
-    html+='<div class="out-status" id="'+id+'_status"></div>';
-    html+='<pre class="out" id="'+id+'_out" style="display:none"></pre>';
+    var samples=buildSamples(e);
+    html+='<div class="sec">Code samples</div>';
+    html+='<div class="tabs" id="'+id+'_tabs">';
+    samples.forEach(function(s,i){html+='<button class="tab'+(i===0?' active':'')+'" data-lang="'+s.lang+'">'+esc(s.label)+'</button>';});
+    html+='</div>';
+    html+='<div class="code-wrap"><button class="copy-btn">Copy</button>';
+    samples.forEach(function(s,i){html+='<pre class="code'+(i===0?'':' hidden')+'" data-lang="'+s.lang+'">'+esc(s.code)+'</pre>';});
+    html+='</div>';
     return html;
   }
 
-  function wireTry(e,id,root){
-    var btn=root.querySelector('#'+id+'_send');if(!btn)return;
-    // Auto-grow the body textarea to fit its content (capped, then scrolls).
-    var bodyTa=root.querySelector('#'+id+'_body');
-    if(bodyTa){
-      var autosize=function(){ bodyTa.style.height='auto'; bodyTa.style.height=Math.min(bodyTa.scrollHeight+2,600)+'px'; };
-      bodyTa.addEventListener('input',autosize);
-      autosize();
-    }
-    btn.addEventListener('click',function(){
-      var url=e.path;
-      root.querySelectorAll('[data-kind=path]').forEach(function(inp){url=url.replace('{'+inp.getAttribute('data-name')+'}',encodeURIComponent(inp.value||''));});
-      var qs=[];
-      root.querySelectorAll('[data-kind=query]').forEach(function(inp){if(inp.value)qs.push(encodeURIComponent(inp.getAttribute('data-name'))+'='+encodeURIComponent(inp.value));});
-      if(qs.length)url+=(url.indexOf('?')>=0?'&':'?')+qs.join('&');
-      var opts={method:e.method.toUpperCase(),headers:{}};
-      var auth=root.querySelector('#'+id+'_auth');if(auth&&auth.value)opts.headers['Authorization']='Bearer '+auth.value;
-      var bodyEl=root.querySelector('#'+id+'_body');
-      if(bodyEl&&['post','put','patch'].indexOf(e.method)>=0){opts.headers['Content-Type']='application/json';opts.body=bodyEl.value;}
-      var statusEl=root.querySelector('#'+id+'_status');var outEl=root.querySelector('#'+id+'_out');
-      btn.disabled=true;statusEl.textContent='Sending...';var t0=Date.now();
-      fetch(url,opts).then(function(r){var ct=r.headers.get('content-type')||'';return r.text().then(function(txt){return {r:r,txt:txt,ct:ct};});}).then(function(d){
-        var color=d.r.ok?'#22c55e':'#ef4444';
-        statusEl.innerHTML='<span style="color:'+color+'">'+d.r.status+' '+esc(d.r.statusText)+'</span> &middot; '+(Date.now()-t0)+'ms';
-        var out=d.txt;if(d.ct.indexOf('application/json')>=0){try{out=JSON.stringify(JSON.parse(d.txt),null,2);}catch(err){}}
-        outEl.style.display='block';outEl.textContent=out;
-      }).catch(function(err){statusEl.innerHTML='<span style="color:#ef4444">Request failed</span>';outEl.style.display='block';outEl.textContent=String(err);}).then(function(){btn.disabled=false;});
+  function wireSamples(id,root){
+    var tabs=root.querySelector('#'+id+'_tabs');if(!tabs)return;
+    var btns=tabs.querySelectorAll('.tab');
+    btns.forEach(function(b){
+      b.addEventListener('click',function(){
+        var lang=b.getAttribute('data-lang');
+        btns.forEach(function(x){x.classList.remove('active');});b.classList.add('active');
+        root.querySelectorAll('pre.code[data-lang]').forEach(function(p){p.classList.toggle('hidden',p.getAttribute('data-lang')!==lang);});
+      });
+    });
+    var copy=root.querySelector('.copy-btn');
+    if(copy)copy.addEventListener('click',function(){
+      var active=root.querySelector('pre.code[data-lang]:not(.hidden)');if(!active)return;
+      var txt=active.textContent;
+      if(navigator.clipboard&&navigator.clipboard.writeText){navigator.clipboard.writeText(txt);}
+      else{var ta=document.createElement('textarea');ta.value=txt;document.body.appendChild(ta);ta.select();try{document.execCommand('copy');}catch(x){}document.body.removeChild(ta);}
+      copy.textContent='Copied';setTimeout(function(){copy.textContent='Copy';},1200);
     });
   }
 
@@ -1030,7 +1195,7 @@ export function buildDocsHtml(specUrl = "openapi.json") {
     html+='<div class="detail-sum">'+esc(e.op.summary||'')+lock+'</div>';
     html+=detailsHtml(e,id);
     main.innerHTML=html;main.scrollTop=0;
-    wireTry(e,id,main);
+    wireSamples(id,main);
   }
 
   function render(spec){
@@ -1208,9 +1373,9 @@ export default router;
 // Email (nodemailer) — SMTP with presets for popular providers (Brevo, etc.).
 // ─────────────────────────────────────────────────────────────────────────────
 export const MAIL_PROVIDERS = {
+  mailgun:  { label: "Mailgun",          host: "smtp.mailgun.org",        port: 587, secure: false, hint: "Postmaster user + SMTP password" },
   brevo:    { label: "Brevo",            host: "smtp-relay.brevo.com",    port: 587, secure: false, hint: "Login email + SMTP key (SMTP & API → SMTP)" },
   sendgrid: { label: "SendGrid",         host: "smtp.sendgrid.net",       port: 587, secure: false, user: "apikey", hint: "User is literally 'apikey'; pass is your API key" },
-  mailgun:  { label: "Mailgun",          host: "smtp.mailgun.org",        port: 587, secure: false, hint: "Postmaster user + SMTP password" },
   gmail:    { label: "Gmail",            host: "smtp.gmail.com",          port: 465, secure: true,  hint: "Use an App Password, not your login password" },
   mailtrap: { label: "Mailtrap (test)",  host: "sandbox.smtp.mailtrap.io", port: 587, secure: false, hint: "Sandbox inbox for testing" },
   smtp:     { label: "Custom SMTP",      host: "", port: 587, secure: false, hint: "Any SMTP server" },
@@ -1248,14 +1413,19 @@ export function emailTemplate({ title = '', body = '' } = {}) {
 }
 
 // Send an email. Pass html or text (or use emailTemplate for html).
-export async function sendMail({ to, subject, html, text, from } = {}) {
+// attachments: [{ filename, path }] or [{ filename, content }] (nodemailer format).
+export async function sendMail({ to, subject, html, text, from, cc, bcc, replyTo, attachments } = {}) {
   if (!to || !subject) throw new Error('sendMail requires { to, subject }');
   return transporter.sendMail({
     from: from || process.env.SMTP_FROM || process.env.SMTP_USER,
     to,
+    cc,
+    bcc,
+    replyTo,
     subject,
     text,
     html,
+    attachments,
   });
 }
 

package/skeleton/.4bnode/dev-api.js

@@ -34,6 +34,8 @@ import {
   buildCrudRouteFile,
   addDepsToPackageJson,
   extractRequestFields,
+  extractFileFields,
+  requiredFieldsFromZod,
   buildOpenApiSpec,
   buildDocsRouter,
   MAIL_PROVIDERS,
@@ -683,8 +685,21 @@ router.delete('/api/routes/:name', (req, res) => {
       return res.status(404).json({ error: `Route file "${routeFile}" not found.` });
     }
 
+    // Find the Zod validator this route uses (if any) before deleting the route,
+    // so we can clean it up too — otherwise validators/<name>.js is orphaned.
+    let validatorPath = null;
+    try {
+      const routeContent = fs.readFileSync(filePath, 'utf8');
+      const vi = routeContent.match(/from\s+['"]\.\.\/validators\/([\w-]+)(?:\.js)?['"]/);
+      if (vi) validatorPath = path.join(process.cwd(), 'src', 'validators', vi[1] + '.js');
+    } catch {}
+
     // Delete the route file
     fs.unlinkSync(filePath);
+    // Delete its validator (only this route used it — validators are 1:1 with routes).
+    if (validatorPath && fs.existsSync(validatorPath)) {
+      try { fs.unlinkSync(validatorPath); } catch {}
+    }
     refreshDocsSpec();
 
     // Send response BEFORE modifying index.js (nodemon restart kills connection)
@@ -1220,7 +1235,7 @@ router.get('/api/security/rate-limit', (req, res) => {
   try {
     const envPath = path.join(process.cwd(), '.env');
     const windowMs = Number(getEnvValue(envPath, 'RATE_LIMIT_WINDOW_MS')) || 15 * 60 * 1000;
-    const max = Number(getEnvValue(envPath, 'RATE_LIMIT_MAX')) || 100;
+    const max = Number(getEnvValue(envPath, 'RATE_LIMIT_MAX')) || 500;
     res.json({ windowMinutes: Math.max(1, Math.round(windowMs / 60000)), max });
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -1230,7 +1245,7 @@ router.post('/api/security/rate-limit', (req, res) => {
   try {
     const envPath = path.join(process.cwd(), '.env');
     const windowMinutes = Math.max(1, Math.min(1440, Number(req.body && req.body.windowMinutes) || 15));
-    const max = Math.max(1, Math.min(1000000, Number(req.body && req.body.max) || 100));
+    const max = Math.max(1, Math.min(1000000, Number(req.body && req.body.max) || 500));
     updateEnvFile(envPath, 'RATE_LIMIT_WINDOW_MS', String(windowMinutes * 60000));
     updateEnvFile(envPath, 'RATE_LIMIT_MAX', String(max));
     res.json({ message: 'Rate limit updated.', windowMinutes, max });
@@ -1239,6 +1254,94 @@ router.post('/api/security/rate-limit', (req, res) => {
   }
 });
 
+// ---------------------------------------------------------------------------
+// Email (nodemailer) — provider presets, SMTP config in .env, install + test
+// ---------------------------------------------------------------------------
+const mailerFilePath = () => path.join(process.cwd(), 'src', 'services', 'mailer.js');
+
+// GET /api/mail — current config + provider presets for the Email page.
+router.get('/api/mail', (req, res) => {
+  try {
+    const envPath = path.join(process.cwd(), '.env');
+    res.json({
+      configured: fs.existsSync(mailerFilePath()),
+      providers: Object.entries(MAIL_PROVIDERS).map(([id, p]) => ({ id, ...p })),
+      host: getEnvValue(envPath, 'SMTP_HOST'),
+      port: Number(getEnvValue(envPath, 'SMTP_PORT')) || 587,
+      secure: getEnvValue(envPath, 'SMTP_SECURE') === 'true',
+      user: getEnvValue(envPath, 'SMTP_USER'),
+      from: getEnvValue(envPath, 'SMTP_FROM'),
+      hasPass: !!getEnvValue(envPath, 'SMTP_PASS'),
+    });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// POST /api/mail/setup — write src/services/mailer.js, save SMTP_* to .env, install nodemailer.
+router.post('/api/mail/setup', async (req, res) => {
+  try {
+    const { host, port, secure, user, pass, from } = req.body || {};
+    if (!host || !String(host).trim()) return res.status(400).json({ error: 'SMTP host is required.' });
+    const envPath = path.join(process.cwd(), '.env');
+
+    // Persist SMTP config to .env first (a .env write does NOT restart nodemon).
+    // A blank password keeps the saved one.
+    updateEnvFile(envPath, 'SMTP_HOST', String(host).trim());
+    updateEnvFile(envPath, 'SMTP_PORT', String(port || 587).trim());
+    updateEnvFile(envPath, 'SMTP_SECURE', secure ? 'true' : 'false');
+    updateEnvFile(envPath, 'SMTP_USER', String(user || '').trim());
+    if (pass) updateEnvFile(envPath, 'SMTP_PASS', String(pass));
+    updateEnvFile(envPath, 'SMTP_FROM', String(from || user || '').trim());
+
+    // Install nodemailer BEFORE writing mailer.js. Writing into src/ restarts
+    // nodemon, which would kill an in-flight npm install — so finish it first.
+    await installDeps('nodemailer');
+
+    // Write the mailer service last (idempotent — keep an existing one). This is
+    // the step that triggers the nodemon restart, by which point install is done.
+    fs.mkdirSync(path.join(process.cwd(), 'src', 'services'), { recursive: true });
+    if (!fs.existsSync(mailerFilePath())) fs.writeFileSync(mailerFilePath(), buildMailerService(), 'utf8');
+
+    res.json({ message: 'Email configured. Use sendMail({ to, subject, html }) from src/services/mailer.js.' });
+  } catch (err) {
+    if (!res.headersSent) res.status(500).json({ error: err.message });
+  }
+});
+
+// POST /api/mail/test — send a test email using the saved SMTP settings.
+router.post('/api/mail/test', async (req, res) => {
+  try {
+    const to = String((req.body && req.body.to) || '').trim();
+    if (!to) return res.status(400).json({ error: 'Recipient is required.' });
+    const envPath = path.join(process.cwd(), '.env');
+    const host = getEnvValue(envPath, 'SMTP_HOST');
+    if (!host) return res.status(400).json({ error: 'Email is not configured yet — save SMTP settings first.' });
+
+    let nodemailer;
+    try { nodemailer = (await import('nodemailer')).default; }
+    catch { return res.status(400).json({ error: 'nodemailer is still installing. Wait a moment after saving, then retry.' }); }
+
+    // Build the transport from .env directly (process.env may be stale post-setup).
+    const transporter = nodemailer.createTransport({
+      host,
+      port: Number(getEnvValue(envPath, 'SMTP_PORT')) || 587,
+      secure: getEnvValue(envPath, 'SMTP_SECURE') === 'true',
+      auth: { user: getEnvValue(envPath, 'SMTP_USER'), pass: getEnvValue(envPath, 'SMTP_PASS') },
+    });
+    await transporter.sendMail({
+      from: getEnvValue(envPath, 'SMTP_FROM') || getEnvValue(envPath, 'SMTP_USER'),
+      to,
+      subject: 'Test email from your app',
+      text: 'This is a test email confirming your SMTP settings work.',
+      html: '<p>This is a <b>test email</b> confirming your SMTP settings work.</p>',
+    });
+    res.json({ message: `Test email sent to ${to}.` });
+  } catch (err) {
+    res.status(500).json({ error: 'Send failed: ' + err.message });
+  }
+});
+
 // ---------------------------------------------------------------------------
 // AI Builder — describe a backend in English, generate models + CRUD routes
 // ---------------------------------------------------------------------------
@@ -1523,21 +1626,44 @@ function collectEndpoints() {
     const modelImportMatch = content.match(/import\s+(\w+)\s+from\s+['"]\.\.\/models\/(\w+)['"]/);
     const modelFields = modelImportMatch ? (getModelSchemaDetailed(modelImportMatch[2]).fields || []) : [];
 
+    // The API's real required-ness comes from the Zod validator (what actually
+    // gates the request), not the Mongoose model. Parse the route's validator file
+    // so OpenAPI `required` reflects the API contract, not the DB schema.
+    const validatorImport = content.match(/from\s+['"]\.\.\/validators\/([\w-]+)(?:\.js)?['"]/);
+    let validatorReq = null;
+    if (validatorImport) {
+      const vPath = path.join(process.cwd(), 'src', 'validators', validatorImport[1] + '.js');
+      if (fs.existsSync(vPath)) {
+        try { validatorReq = requiredFieldsFromZod(fs.readFileSync(vPath, 'utf8')); } catch {}
+      }
+    }
+
     const epRegex = /router\.(get|post|put|patch|delete)\(\s*['"`](\/[^'"`]*?)['"`]\s*,\s*([\s\S]*?)(?=\nrouter\.|\nexport |$)/gi;
     let m;
     while ((m = epRegex.exec(content)) !== null) {
       const method = m[1].toUpperCase();
       const epath = m[2];
       const body = m[3] || '';
+      // PATCH wires `validate(schema.partial())`, making every field optional.
+      const usesPartial = /\.partial\s*\(\s*\)/.test(body);
       const bodyFields = extractRequestFields(body, 'body').map((fn) => {
         const meta = modelFields.find((x) => x.name === fn);
-        return { name: fn, type: (meta && meta.type) || 'String', required: !!(meta && meta.required) };
+        let required;
+        if (usesPartial) required = false;
+        else if (validatorReq && Object.prototype.hasOwnProperty.call(validatorReq, fn)) required = validatorReq[fn];
+        else required = !!(meta && meta.required);
+        return { name: fn, type: (meta && meta.type) || 'String', required };
       });
       const queryFields = extractRequestFields(body, 'query').map((fn) => ({ name: fn, type: 'String' }));
       const params = (epath.match(/:(\w+)/g) || []).map((p) => p.slice(1));
-      const hasAuth = /authorization|jwt|bearer|x-api-key/i.test(body);
+      // Auth is detected by the `auth` middleware on the route — NOT by scanning the
+      // handler for "jwt"/"bearer", which would wrongly flag login/register routes
+      // (they *sign* a JWT to return it; they don't *require* a Bearer token).
+      const hasAuth = /\bauth\b\s*,/.test(body);
+      // Detect multer file fields so the docs show a multipart upload + file inputs.
+      const fileFields = extractFileFields(body);
       const fullPath = (prefix + (epath === '/' ? '' : epath)).replace(/\/{2,}/g, '/');
-      out.push({ method, path: epath, fullPath, params, queryFields, bodyFields, fileFields: [], hasAuth });
+      out.push({ method, path: epath, fullPath, params, queryFields, bodyFields, fileFields, hasAuth });
     }
   });
   return out;

package/skeleton/.env

@@ -1 +1,7 @@
 PORT=3000
+
+# Rate limiting (only enforced when NODE_ENV=production)
+# RATE_LIMIT_WINDOW_MS = window length in ms (900000 = 15 minutes)
+# RATE_LIMIT_MAX       = max requests per IP per window
+RATE_LIMIT_WINDOW_MS=900000
+RATE_LIMIT_MAX=500

package/skeleton/.env.example

@@ -0,0 +1,11 @@
+# Copy this file to .env and fill in real values.
+#   cp .env.example .env
+
+# Port the server listens on
+PORT=3000
+
+# Rate limiting (only enforced when NODE_ENV=production)
+# RATE_LIMIT_WINDOW_MS = window length in ms (900000 = 15 minutes)
+# RATE_LIMIT_MAX       = max requests per IP per window
+RATE_LIMIT_WINDOW_MS=900000
+RATE_LIMIT_MAX=500

package/app-1/src/models/login.js

@@ -1,9 +0,0 @@
-import mongoose from 'mongoose';
-
-const LoginSchema = new mongoose.Schema({
-  first_name: { type: String }
-}, { timestamps: true });
-
-const Login = mongoose.model('Login', LoginSchema);
-
-export default Login;

package/app-1/src/routes/products.js

@@ -1,26 +0,0 @@
-import { productsSchema } from '../validators/products.js';
-import validate from '../middleware/validate.js';
-import express from 'express';
-import jwt from 'jsonwebtoken';
-import Login from '../models/login.js';
-
-const router = express.Router();
-
-// Register
-router.post('/', validate(productsSchema), async (req, res) => {
-  try {
-    const { first_name } = req.body;
-    const existing = await Login.findOne({ first_name });
-    if (existing) return res.status(400).json({ message: 'Login already exists' });
-
-    const item = new Login({ first_name });
-    const saved = await item.save();
-
-    const token = jwt.sign({ id: saved._id }, process.env.JWT_SECRET, { expiresIn: '7d' });
-    res.status(201).json({ token, login: { id: saved._id, first_name: saved.first_name } });
-  } catch (err) {
-    res.status(400).json({ message: err.message });
-  }
-});
-
-export default router;

package/app-1/src/validators/products.js

@@ -1,7 +0,0 @@
-import { z } from 'zod';
-
-export const productsSchema = z.object({
-  first_name: z.string(),
-});
-
-export default productsSchema;

package/app-1/src/validators/user.js

@@ -1,7 +0,0 @@
-import { z } from 'zod';
-
-export const userSchema = z.object({
-  first_name: z.string(),
-});
-
-export default userSchema;