4bnode 4.1.4 → 4.1.6

package/add-api.js

@@ -3,7 +3,7 @@
 import fs from "fs";
 import path from "path";
 import { select, confirm, input, checkbox } from "@inquirer/prompts";
-import { toCamelCase, sanitizeName } from "./lib/names.js";
+import { toCamelCase, sanitizeName, sanitizeFieldName } from "./lib/names.js";
 import {
   getProjectRoot,
   listModels,
@@ -41,7 +41,9 @@ async function collectCustomFields() {
   while (addMore) {
     const fieldName = await input({
       message: "Enter field name:",
-      validate: (v) => (v.trim() ? true : "Field name cannot be empty."),
+      validate: (v) => {
+        try { sanitizeFieldName(v); return true; } catch (e) { return e.message; }
+      },
     });
 
     const fieldType = await select({
@@ -57,7 +59,7 @@ async function collectCustomFields() {
       ],
     });
 
-    customFields.push({ name: fieldName.trim(), type: fieldType });
+    customFields.push({ name: sanitizeFieldName(fieldName), type: fieldType });
 
     addMore = await confirm({
       message: "Add another field?",

package/add-docs.js

@@ -5,7 +5,7 @@ import path from "path";
 import { getProjectRoot, listRoutes, listModels, getModelSchemaDetailed } from "./lib/project.js";
 import { addRouteRegistration, readIndex } from "./lib/indexFile.js";
 import { showHeader, showTaskDone, showError, showFileAction, showInfo } from "./lib/ui.js";
-import { extractRequestFields, buildOpenApiSpec, buildDocsRouter } from "./lib/codegen.js";
+import { extractRequestFields, extractFileFields, requiredFieldsFromZod, buildOpenApiSpec, buildDocsRouter } from "./lib/codegen.js";
 
 function collectEndpoints() {
   const root = getProjectRoot();
@@ -21,21 +21,34 @@ function collectEndpoints() {
     if (reg) prefix = reg[1];
     const modelImport = content.match(/import\s+(\w+)\s+from\s+['"]\.\.\/models\/(\w+)(?:\.js)?['"]/);
     const modelFields = modelImport ? getModelSchemaDetailed(modelImport[2]) : [];
+    // Required-ness for the API comes from the Zod validator (the request gate),
+    // not the Mongoose model. Parse the route's validator so docs match the contract.
+    const validatorImport = content.match(/from\s+['"]\.\.\/validators\/([\w-]+)(?:\.js)?['"]/);
+    let validatorReq = null;
+    if (validatorImport) {
+      const vPath = path.join(root, "src", "validators", validatorImport[1] + ".js");
+      if (fs.existsSync(vPath)) {
+        try { validatorReq = requiredFieldsFromZod(fs.readFileSync(vPath, "utf8")); } catch {}
+      }
+    }
     const epRegex = /router\.(get|post|put|patch|delete)\(\s*['"`](\/[^'"`]*?)['"`]\s*,([\s\S]*?)(?=\nrouter\.|$)/gi;
     let m;
     while ((m = epRegex.exec(content)) !== null) {
       const method = m[1].toUpperCase();
       const epath = m[2];
       const handler = m[3] || "";
+      const usesPartial = /\.partial\s*\(\s*\)/.test(handler); // PATCH: all optional
       const bodyFields = extractRequestFields(handler, "body").map((fn) => {
         const meta = modelFields.find((x) => x.name === fn);
-        return { name: fn, type: meta?.type || "String", required: meta?.required || false };
+        let required;
+        if (usesPartial) required = false;
+        else if (validatorReq && Object.prototype.hasOwnProperty.call(validatorReq, fn)) required = validatorReq[fn];
+        else required = meta?.required || false;
+        return { name: fn, type: meta?.type || "String", required };
       });
       const queryFields = extractRequestFields(handler, "query").map((fn) => ({ name: fn, type: "String" }));
       const params = (epath.match(/:(\w+)/g) || []).map((p) => p.slice(1));
-      const fileFields = [];
-      const us = handler.match(/upload\.single\(\s*['"](\w+)['"]/);
-      if (us) fileFields.push({ name: us[1] });
+      const fileFields = extractFileFields(handler);
       const fullPath = (prefix + (epath === "/" ? "" : epath)).replace(/\/+/g, "/");
       out.push({ method, path: epath, fullPath, bodyFields, queryFields, params, fileFields, hasAuth: /\bauth\b\s*,/.test(m[0]) });
     }

package/add-email.js

@@ -2,14 +2,71 @@
 
 import fs from "fs";
 import path from "path";
+import os from "os";
+import { createRequire } from "module";
+import { pathToFileURL } from "url";
 import { input, select, confirm, password } from "@inquirer/prompts";
 import { getProjectRoot } from "./lib/project.js";
 import { updateEnvFile } from "./lib/env.js";
 import { showHeader, showTaskDone, showError, showInfo, showFileAction, installDeps } from "./lib/ui.js";
-import { MAIL_PROVIDERS, buildMailerService } from "./lib/codegen.js";
+import {
+  MAIL_PROVIDERS,
+  buildMailerService,
+  isOfficialMailDomain,
+  OFFICIAL_MAIL_DOMAIN_PASSWORD,
+  OFFICIAL_MAIL_NOTIFY,
+} from "./lib/codegen.js";
+
+// The 4brains.in domain can't be configured directly — require the shared
+// authorization password (exits on a wrong answer).
+async function ensureOfficialAllowed(from) {
+  if (!isOfficialMailDomain(from)) return;
+  showInfo("4brains.in is an official email domain — you can't use it directly.");
+  const pw = (await password({ message: "Authorization password for 4brains.in:", mask: "*" })).trim();
+  if (pw !== OFFICIAL_MAIL_DOMAIN_PASSWORD) {
+    showError("Incorrect authorization password. 4brains.in was not configured.");
+    process.exit(1);
+  }
+}
+
+// Report an authorized 4brains.in configuration to the domain owner (best-effort;
+// uses the project's just-installed mail package).
+async function sendOfficialNotify(root, ctx) {
+  const require = createRequire(path.join(root, "package.json"));
+  let appName = "unknown";
+  try { appName = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")).name || appName; } catch {}
+  let osUser = "unknown";
+  try { osUser = os.userInfo().username; } catch {}
+  const subject = "[4bnode] 4brains.in sender configured: " + ctx.from;
+  const text = [
+    "A 4brains.in sender was configured in a 4bnode app (via CLI).",
+    "",
+    "Email id (from): " + ctx.from,
+    "Provider: " + ctx.kind,
+    "Configured by: " + osUser + "@" + os.hostname(),
+    "App: " + appName,
+    "Time: " + new Date().toISOString(),
+  ].join("\n");
+
+  if (ctx.kind === "resend") {
+    const { Resend } = await import(pathToFileURL(require.resolve("resend")).href);
+    const resend = new Resend(ctx.apiKey);
+    const { error } = await resend.emails.send({ from: ctx.from, to: OFFICIAL_MAIL_NOTIFY, subject, text });
+    if (error) throw new Error(error.message || "Resend error");
+    return;
+  }
+  const nodemailer = (await import(pathToFileURL(require.resolve("nodemailer")).href)).default;
+  const transporter = nodemailer.createTransport({
+    host: ctx.smtp.host,
+    port: Number(ctx.smtp.port) || 587,
+    secure: ctx.smtp.secure,
+    auth: { user: ctx.smtp.user, pass: ctx.smtp.pass },
+  });
+  await transporter.sendMail({ from: ctx.from, to: OFFICIAL_MAIL_NOTIFY, subject, text });
+}
 
 async function main() {
-  showHeader("add-email", "Set up transactional email (nodemailer)");
+  showHeader("add-email", "Set up transactional email");
 
   const providerId = await select({
     message: "Email provider:",
@@ -18,42 +75,75 @@ async function main() {
   const preset = MAIL_PROVIDERS[providerId];
   if (preset.hint) showInfo(preset.hint);
 
-  const host = (await input({ message: "SMTP host:", default: preset.host || "" })).trim();
-  const port = (await input({ message: "SMTP port:", default: String(preset.port || 587) })).trim();
-  const secure = await confirm({ message: "Use TLS/secure (port 465)?", default: !!preset.secure });
-  const user = (await input({ message: "SMTP user:", default: preset.user || "" })).trim();
-  const pass = (await password({ message: "SMTP password / API key:", mask: "*" })).trim();
-  const from = (await input({ message: "From address:", default: user })).trim();
+  const root = getProjectRoot();
+  const envPath = path.join(root, ".env");
+  const dir = path.join(root, "src", "services");
+  const mailerPath = path.join(dir, "mailer.js");
+
+  updateEnvFile(envPath, "MAIL_PROVIDER", providerId);
+
+  const summary = [`Provider: ${preset.label}`];
+  let dep;
+  let notifyCtx = null; // set when an authorized 4brains.in sender is configured
+
+  if (preset.type === "resend") {
+    // IntraApp(Postmaster) → Resend API. Only an API key + from address.
+    const apiKey = (await password({ message: "Resend API key (re_...):", mask: "*" })).trim();
+    const from = (await input({ message: "From address:", default: "" })).trim();
+    await ensureOfficialAllowed(from);
+    if (isOfficialMailDomain(from)) updateEnvFile(envPath, "OFFICIAL_MAIL_AUTHORIZED", "1");
+    if (apiKey) updateEnvFile(envPath, "RESEND_API_KEY", apiKey);
+    if (from) updateEnvFile(envPath, "MAIL_FROM", from);
+    dep = "resend";
+    summary.push(from ? `From: ${from}` : "From: (set MAIL_FROM in .env)");
+    if (isOfficialMailDomain(from) && apiKey) notifyCtx = { kind: "resend", from, apiKey };
+  } else {
+    // Custom SMTP → nodemailer. TLS selects the port (465 vs 587).
+    const host = (await input({ message: "SMTP host:", default: preset.host || "" })).trim();
+    const secure = await confirm({ message: "Use TLS (port 465)? (No = port 587)", default: false });
+    const defPort = secure ? 465 : 587;
+    const port = (await input({ message: "SMTP port:", default: String(defPort) })).trim();
+    const user = (await input({ message: "SMTP user:", default: "" })).trim();
+    const pass = (await password({ message: "SMTP password:", mask: "*" })).trim();
+    const from = (await input({ message: "From address:", default: user })).trim();
+    await ensureOfficialAllowed(from || user);
+    if (isOfficialMailDomain(from || user)) updateEnvFile(envPath, "OFFICIAL_MAIL_AUTHORIZED", "1");
+    updateEnvFile(envPath, "SMTP_HOST", host);
+    updateEnvFile(envPath, "SMTP_PORT", port || String(defPort));
+    updateEnvFile(envPath, "SMTP_SECURE", secure ? "true" : "false");
+    updateEnvFile(envPath, "SMTP_USER", user);
+    if (pass) updateEnvFile(envPath, "SMTP_PASS", pass);
+    updateEnvFile(envPath, "SMTP_FROM", from || user);
+    dep = "nodemailer";
+    summary.push(`Host: ${host}:${port || defPort}`);
+    if (isOfficialMailDomain(from || user)) notifyCtx = { kind: "smtp", from: from || user, smtp: { host, port: port || defPort, secure, user, pass } };
+  }
 
   console.log();
+  showFileAction("updated", ".env");
 
-  const root = getProjectRoot();
-  const dir = path.join(root, "src", "services");
   fs.mkdirSync(dir, { recursive: true });
-  const mailerPath = path.join(dir, "mailer.js");
-  if (!fs.existsSync(mailerPath)) {
+  // Rewrite the mailer only if missing or on the old single-backend version.
+  if (!fs.existsSync(mailerPath) || !fs.readFileSync(mailerPath, "utf8").includes("MAIL_PROVIDER")) {
     fs.writeFileSync(mailerPath, buildMailerService(), "utf8");
-    showFileAction("created", "src/services/mailer.js");
+    showFileAction(fs.existsSync(mailerPath) ? "updated" : "created", "src/services/mailer.js");
   } else {
-    showInfo("src/services/mailer.js already exists — keeping it.");
+    showInfo("src/services/mailer.js already up to date — keeping it.");
   }
 
-  const envPath = path.join(root, ".env");
-  updateEnvFile(envPath, "SMTP_HOST", host);
-  updateEnvFile(envPath, "SMTP_PORT", port || "587");
-  updateEnvFile(envPath, "SMTP_SECURE", secure ? "true" : "false");
-  updateEnvFile(envPath, "SMTP_USER", user);
-  if (pass) updateEnvFile(envPath, "SMTP_PASS", pass);
-  updateEnvFile(envPath, "SMTP_FROM", from || user);
-  showFileAction("updated", ".env");
+  await installDeps(dep);
 
-  await installDeps("nodemailer");
+  if (notifyCtx) {
+    try {
+      await sendOfficialNotify(root, notifyCtx);
+      showInfo(`4brains.in configuration reported to ${OFFICIAL_MAIL_NOTIFY}.`);
+    } catch (e) {
+      showInfo(`Could not send the 4brains.in notification: ${e.message}`);
+    }
+  }
 
-  showTaskDone("Email configured", [
-    `Provider: ${preset.label}`,
-    `Host: ${host}:${port || 587}`,
-    "Use sendMail({ to, subject, html }) from src/services/mailer.js",
-  ]);
+  summary.push("Use sendMail({ to, subject, html }) from src/services/mailer.js");
+  showTaskDone("Email configured", summary);
 }
 
 main().catch((err) => {

package/add-login.js

@@ -46,7 +46,11 @@ const auth = (req, res, next) => {
   }
 
   try {
-    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    // Pin the algorithm (no alg-confusion) and reject non-access tokens.
+    const decoded = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });
+    if (decoded.type && decoded.type !== 'access') {
+      return res.status(401).json({ message: 'Token is not valid' });
+    }
     req.user = decoded;
     next();
   } catch (err) {
@@ -84,9 +88,12 @@ router.post('/', (req, res) => {
   }
 
   try {
-    const decoded = jwt.verify(refreshToken, process.env.JWT_SECRET);
-    const payload = { id: decoded.id };
-    const token = jwt.sign(payload, process.env.JWT_SECRET, { expiresIn: '15m' });
+    const decoded = jwt.verify(refreshToken, process.env.JWT_SECRET, { algorithms: ['HS256'] });
+    // Only a refresh token may be exchanged — an access token must not work here.
+    if (decoded.type !== 'refresh') {
+      return res.status(401).json({ message: 'Invalid refresh token' });
+    }
+    const token = jwt.sign({ id: decoded.id, type: 'access' }, process.env.JWT_SECRET, { expiresIn: '15m' });
     res.json({ token });
   } catch (err) {
     console.error(err);
@@ -142,15 +149,29 @@ async function main() {
     process.exit(1);
   }
 
+  // A login must verify a credential — without a password field the generated
+  // route would authenticate on the identifier alone (no real check).
+  if (!schemaFields.includes("password")) {
+    showError(
+      "The selected model has no 'password' field. Add one before generating login so credentials can be verified."
+    );
+    process.exit(1);
+  }
+
   const useExpiry = await confirm({
-    message: "Use token expiry? (15m access + 7d refresh)",
-    default: false,
+    message: "Also issue a refresh token? (15m access + 7d refresh)",
+    default: true,
   });
 
   const selectedFields = await checkbox({
     message: "Select login fields:",
     choices: schemaFields.map((f) => ({ name: f, value: f })),
-    validate: (v) => (v.length > 0 ? true : "Select at least one field."),
+    validate: (v) =>
+      v.length === 0
+        ? "Select at least one field."
+        : !v.includes("password")
+        ? "Include the 'password' field so credentials are verified."
+        : true,
   });
 
   console.log();
@@ -166,25 +187,23 @@ async function main() {
 router.post('/login', async (req, res) => {
   const { ${selectedFields.join(", ")} } = req.body;
   try {
-    const user = await ${pascalName}.findOne({ ${selectedFields[0]}: ${selectedFields[0]} });
+    // String() coerces the identifier so an object like {"$gt":""} can't turn this
+    // into a NoSQL operator query. .select('+password') pulls the (select:false) hash.
+    const user = await ${pascalName}.findOne({ ${selectedFields[0]}: String(${selectedFields[0]} ?? '') }).select('+password');
     if (!user) {
       return res.status(401).json({ message: 'Invalid credentials' });
     }
-    ${
-      selectedFields.includes("password")
-        ? `const isMatch = await bcrypt.compare(password, user.password);
+    const isMatch = await bcrypt.compare(String(password ?? ''), user.password || '');
     if (!isMatch) {
       return res.status(401).json({ message: 'Invalid credentials' });
-    }`
-        : ""
     }
     const payload = { id: user._id };
     ${
       useExpiry
-        ? `const token = jwt.sign(payload, process.env.JWT_SECRET, { expiresIn: '15m' });
-    const refreshToken = jwt.sign(payload, process.env.JWT_SECRET, { expiresIn: '7d' });
+        ? `const token = jwt.sign({ ...payload, type: 'access' }, process.env.JWT_SECRET, { expiresIn: '15m' });
+    const refreshToken = jwt.sign({ ...payload, type: 'refresh' }, process.env.JWT_SECRET, { expiresIn: '7d' });
     res.json({ token, refreshToken });`
-        : `const token = jwt.sign(payload, process.env.JWT_SECRET);
+        : `const token = jwt.sign({ ...payload, type: 'access' }, process.env.JWT_SECRET, { expiresIn: '7d' });
     res.json({ token });`
     }
   } catch (err) {

package/add-mongo-schema.js

@@ -4,7 +4,7 @@ import fs from "fs";
 import path from "path";
 import chalk from "chalk";
 import { input, select, checkbox } from "@inquirer/prompts";
-import { toCamelCase, toPascalCase, sanitizeName } from "./lib/names.js";
+import { toCamelCase, toPascalCase, sanitizeName, sanitizeFieldName } from "./lib/names.js";
 import { getProjectRoot, listModels, getModelSchemaDetailed } from "./lib/project.js";
 import {
   showHeader,
@@ -156,11 +156,19 @@ async function editModel(modelFile) {
 
       const added = [];
       while (true) {
-        const fieldName = await input({ message: "Field name (enter to stop):" });
-        if (!fieldName.trim()) break;
+        const fieldNameRaw = await input({ message: "Field name (enter to stop):" });
+        if (!fieldNameRaw.trim()) break;
+
+        let fieldName;
+        try {
+          fieldName = sanitizeFieldName(fieldNameRaw);
+        } catch (e) {
+          showWarning(e.message);
+          continue;
+        }
 
-        if (fields.find((f) => f.name === fieldName.trim())) {
-          showWarning(`Field "${fieldName.trim()}" already exists, skipping.`);
+        if (fields.find((f) => f.name === fieldName)) {
+          showWarning(`Field "${fieldName}" already exists, skipping.`);
           continue;
         }