4bnode 4.1.4 → 4.1.6

package/lib/codegen.js

@@ -40,6 +40,25 @@ export function sanitizeName(input) {
   return trimmed;
 }
 
+// Validate a model/route FIELD name before it is interpolated into generated code.
+// A field name becomes a JS identifier (destructuring, object keys), so anything
+// but a plain identifier could break out of the template or pollute a prototype.
+export function sanitizeFieldName(input) {
+  if (!input || typeof input !== "string") {
+    throw new Error("Field name is required.");
+  }
+  const trimmed = input.trim();
+  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(trimmed)) {
+    throw new Error(
+      `Invalid field name "${trimmed}". Use letters, numbers, and underscores; start with a letter or underscore.`
+    );
+  }
+  if (trimmed === "__proto__" || trimmed === "constructor" || trimmed === "prototype") {
+    throw new Error(`Field name "${trimmed}" is reserved.`);
+  }
+  return trimmed;
+}
+
 // ── Pure string helpers for route files ─────────────────────────────────────
 // These operate on file CONTENT (a string) and return new content. The
 // file-reading/writing wrappers live in lib/routeFile.js (CLI) and inline in
@@ -76,7 +95,20 @@ export function insertCodeIntoContent(content, codeBlock) {
 
 // ── CRUD route builders ─────────────────────────────────────────────────────
 
+// Field names that must never be mass-assigned from a request body — privilege
+// flags and prototype-pollution keys. Excluded from generated create/update DTOs
+// by default; set these server-side (e.g. in an admin route) instead.
+export const MASS_ASSIGN_BLOCKED = new Set([
+  "role", "roles", "isadmin", "admin", "isadministrator",
+  "verified", "isverified", "permissions", "scopes",
+  "__proto__", "constructor", "prototype",
+]);
+function writableFields(fields) {
+  return fields.filter((f) => !MASS_ASSIGN_BLOCKED.has(String(f).toLowerCase()));
+}
+
 export function buildInsertCode(pascalName, fields, dataSource) {
+  fields = writableFields(fields);
   const assignments = fields
     .map((f) => `    ${f}: ${dataSource}.${f}`)
     .join(",\n");
@@ -111,8 +143,15 @@ export function buildReadCode(pascalName) {
   return `
 router.get('/', async (req, res) => {
   try {
-    const documents = await ${pascalName}.find();
-    res.json({ data: documents });
+    // Paginate to avoid returning an unbounded collection. ?page & ?limit (max 100).
+    const page = Math.max(1, parseInt(req.query.page, 10) || 1);
+    const limit = Math.min(100, Math.max(1, parseInt(req.query.limit, 10) || 20));
+    const skip = (page - 1) * limit;
+    const [documents, total] = await Promise.all([
+      ${pascalName}.find().select('-password').skip(skip).limit(limit),
+      ${pascalName}.countDocuments(),
+    ]);
+    res.json({ data: documents, page, limit, total, totalPages: Math.ceil(total / limit) });
   } catch (err) {
     console.error(err);
     res.status(500).json({ message: 'Server error' });
@@ -121,7 +160,8 @@ router.get('/', async (req, res) => {
 
 router.get('/:id', async (req, res) => {
   try {
-    const document = await ${pascalName}.findById(req.params.id);
+    // .select('-password') never leaks credential hashes even if the model has one.
+    const document = await ${pascalName}.findById(req.params.id).select('-password');
     if (!document) {
       return res.status(404).json({ message: 'Document not found' });
     }
@@ -134,6 +174,7 @@ router.get('/:id', async (req, res) => {
 }
 
 export function buildUpdateCode(pascalName, fields, dataSource) {
+  fields = writableFields(fields);
   const assignments = fields
     .map((f) => `    ${f}: ${dataSource}.${f}`)
     .join(",\n");
@@ -201,6 +242,10 @@ export function generateMongooseModel(pascalName, fields, indexes = []) {
     if (f.index) parts.push("index: true");
     if (f.default !== undefined && f.default !== "")
       parts.push(`default: ${f.default}`);
+    // Never return credential fields by default — read queries must opt in with
+    // .select('+password'). Prevents accidental hash leaks through find()/findById.
+    if (/^password$/i.test(f.name) && f.select === undefined)
+      parts.push("select: false");
     return `  ${f.name}: { ${parts.join(", ")} }`;
   });
 
@@ -247,9 +292,14 @@ export function notFound(req, res, next) {
 export function errorHandler(err, req, res, next) {
   const status = err.status || err.statusCode || 500;
   console.error(err);
+  const isProd = process.env.NODE_ENV === 'production';
+  // In production, only surface messages for client (4xx) errors or errors
+  // explicitly marked safe (err.expose). Never leak raw 5xx internals — a Mongo
+  // E11000 or driver message discloses schema/indexes and enables enumeration.
+  const showMessage = !isProd || err.expose === true || (status >= 400 && status < 500);
   res.status(status).json({
-    message: err.message || 'Server error',
-    ...(process.env.NODE_ENV === 'production' ? {} : { stack: err.stack }),
+    message: showMessage ? (err.message || 'Server error') : 'Server error',
+    ...(isProd ? {} : { stack: err.stack }),
   });
 }
 `;
@@ -285,7 +335,12 @@ const auth = (req, res, next) => {
     return res.status(401).json({ message: 'No token, authorization denied' });
   }
   try {
-    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    // Pin the algorithm so a token can't be forged via alg-confusion (e.g. an
+    // attacker signing HS256 with a public key if RS256 is ever introduced).
+    const decoded = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });
+    if (decoded.type && decoded.type !== 'access') {
+      return res.status(401).json({ message: 'Token is not valid' });
+    }
     req.user = decoded;
     next();
   } catch (err) {
@@ -363,6 +418,56 @@ export default ${camel}Schema;
 `;
 }
 
+// Parse a Zod validator's source into a { fieldName: isRequired } map for the
+// top-level fields of its `z.object({ ... })`. A field is "required" for the API
+// when its Zod chain has no `.optional()`/`.nullish()` — i.e. the request is
+// rejected without it. This is the right source of truth for OpenAPI `required`,
+// because the validator (not the Mongoose model) is what actually gates a request:
+// a field can be optional in the DB schema yet required by the API, or vice versa.
+// Returns null if no `z.object({...})` is found (caller should fall back to the model).
+export function requiredFieldsFromZod(src) {
+  if (!src || typeof src !== "string") return null;
+  const objIdx = src.indexOf("z.object(");
+  if (objIdx === -1) return null;
+  const braceStart = src.indexOf("{", objIdx);
+  if (braceStart === -1) return null;
+  // Walk balanced brackets so nested objects/arrays/calls don't end the block early.
+  let depth = 0;
+  let end = -1;
+  for (let i = braceStart; i < src.length; i++) {
+    const c = src[i];
+    if (c === "{" || c === "(" || c === "[") depth++;
+    else if (c === "}" || c === ")" || c === "]") {
+      depth--;
+      if (depth === 0 && c === "}") { end = i; break; }
+    }
+  }
+  if (end === -1) return null;
+  const inner = src.slice(braceStart + 1, end);
+  const map = {};
+  const flush = (entry) => {
+    const colon = entry.indexOf(":");
+    if (colon === -1) return;
+    const key = entry.slice(0, colon).trim().replace(/^['"]|['"]$/g, "");
+    if (!/^[A-Za-z_$][\w$]*$/.test(key)) return;
+    const expr = entry.slice(colon + 1);
+    // .nullable() still requires the key (value may be null), so it doesn't count.
+    map[key] = !/\.(optional|nullish)\s*\(\s*\)/.test(expr);
+  };
+  // Split top-level "key: expr" entries on depth-0 commas.
+  let d = 0;
+  let cur = "";
+  for (let i = 0; i < inner.length; i++) {
+    const c = inner[i];
+    if (c === "{" || c === "(" || c === "[") d++;
+    else if (c === "}" || c === ")" || c === "]") d--;
+    if (c === "," && d === 0) { flush(cur); cur = ""; }
+    else cur += c;
+  }
+  if (cur.trim()) flush(cur);
+  return Object.keys(map).length ? map : null;
+}
+
 // Wire `validate(<model>Schema)` into the write endpoints of a route file, and add
 // the two needed imports. POST/PUT use the full schema; PATCH uses
 // `<schema>.partial()` so partial updates aren't forced to send every required
@@ -446,13 +551,31 @@ app.use(helmet({
     imports.push("import rateLimit from 'express-rate-limit';");
     beforeRoutesParts.push(
       `// ── Rate limiting ──
+// Generous global cap — high enough that real frontends (which fire many calls
+// per page) never notice, low enough to stop scraping/abuse at scale.
+// Window + cap are read from .env (RATE_LIMIT_WINDOW_MS / RATE_LIMIT_MAX) so the
+// dashboard's Security page can tune them; fall back to 15 min / 500 requests.
 const apiLimiter = rateLimit({
+  windowMs: Number(process.env.RATE_LIMIT_WINDOW_MS) || 15 * 60 * 1000,
+  max: Number(process.env.RATE_LIMIT_MAX) || 500,
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+// Strict cap for authentication routes — defends against password brute-forcing.
+// Point this at your real auth routes (login / signup / password-reset).
+const authLimiter = rateLimit({
   windowMs: 15 * 60 * 1000, // 15 minutes
-  max: 100,                 // limit each IP to 100 requests per window
+  max: 10,                  // 10 attempts per IP per window
   standardHeaders: true,
   legacyHeaders: false,
 });
-app.use(apiLimiter);`
+// Throttle everywhere EXCEPT explicit local development. Defaulting to on means a
+// deploy that forgets to set NODE_ENV=production is still protected (an unset
+// NODE_ENV must never mean "no rate limiting" — that was the /_dev breach posture).
+if (process.env.NODE_ENV !== 'development') {
+  app.use('/api/auth', authLimiter); // strict limiter first, on auth routes
+  app.use(apiLimiter);               // generous global limiter for everything else
+}`
     );
   }
   if (has("errorHandler")) {
@@ -729,6 +852,8 @@ export const PACKAGE_VERSIONS = {
   "@serialport/parser-readline": "^12.0.0",
   mongoose: "^8.8.0",
   multer: "^1.4.5-lts.1",
+  nodemailer: "^6.9.0",
+  resend: "^4.0.0",
 };
 
 // Add packages to package.json (dependencies, or devDependencies when dev:true).
@@ -780,6 +905,30 @@ export function extractRequestFields(handlerBody, source = "body") {
   return names;
 }
 
+// Detect multer upload fields in a route handler so the OpenAPI builder can mark
+// the body as multipart/form-data with the right file fields. Handles:
+//   upload.single('avatar')                        -> [{name:'avatar'}]
+//   upload.array('photos', 5)                      -> [{name:'photos'}]
+//   upload.fields([{ name: 'a' }, { name: 'b' }])  -> [{name:'a'},{name:'b'}]
+export function extractFileFields(handlerBody) {
+  const body = handlerBody || "";
+  const out = [];
+  const seen = new Set();
+  const add = (name) => { if (name && !seen.has(name)) { seen.add(name); out.push({ name }); } };
+  (body.match(/upload\.(?:single|array)\(\s*['"]([^'"]+)['"]/g) || []).forEach((s) => {
+    const m = s.match(/['"]([^'"]+)['"]/);
+    if (m) add(m[1]);
+  });
+  const fieldsCall = body.match(/upload\.fields\(\s*\[([\s\S]*?)\]/);
+  if (fieldsCall) {
+    (fieldsCall[1].match(/name\s*:\s*['"]([^'"]+)['"]/g) || []).forEach((n) => {
+      const m = n.match(/['"]([^'"]+)['"]/);
+      if (m) add(m[1]);
+    });
+  }
+  return out;
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // API Documentation — OpenAPI 3 spec + Swagger UI (served at /docs).
 // Reuses extractRequestFields output (endpoints) and model field metadata.
@@ -825,7 +974,9 @@ export function buildOpenApiSpec({ title = "API", version = "1.0.0", endpoints =
       const properties = {};
       const required = [];
       bodyFields.forEach((f) => { properties[f.name] = openApiType(f.type); if (f.required) required.push(f.name); });
-      fileFields.forEach((f) => { properties[f.name] = { type: "string", format: "binary" }; });
+      // Uploaded files are required by default (an upload endpoint exists to receive
+      // the file). A file field can opt out with required:false.
+      fileFields.forEach((f) => { properties[f.name] = { type: "string", format: "binary" }; if (f.required !== false) required.push(f.name); });
       const schema = { type: "object", properties };
       if (required.length) schema.required = required;
       const mime = fileFields.length ? "multipart/form-data" : "application/json";
@@ -912,21 +1063,19 @@ export function buildDocsHtml(specUrl = "openapi.json") {
   .req { color:#ef4444; font-size:11px; font-weight:700; }
   .opt { color:var(--faint); font-size:11px; }
   .resp-code { font-family:ui-monospace,Menlo,monospace; color:#22c55e; font-weight:700; }
-  input.f, textarea.f { width:100%; max-width:540px; background:var(--input); border:1px solid var(--border);
-    color:var(--text); border-radius:8px; padding:8px 10px; font-size:13px; outline:none;
+  .tabs { display:flex; gap:4px; flex-wrap:wrap; }
+  .tab { background:var(--input); color:var(--muted); border:1px solid var(--border); border-bottom:none;
+    border-radius:8px 8px 0 0; padding:6px 13px; font-size:12px; cursor:pointer; }
+  .tab:hover { color:var(--text); }
+  .tab.active { background:#0a0c12; color:var(--accent-light); }
+  .code-wrap { position:relative; max-width:560px; }
+  pre.code { background:#0a0c12; border:1px solid var(--border); border-radius:0 8px 8px 8px; padding:14px;
+    font-size:12.5px; color:#d5d8e3; overflow:auto; white-space:pre; margin:0;
     font-family:ui-monospace,Menlo,monospace; }
-  input.f:focus, textarea.f:focus { border-color:var(--accent); }
-  textarea.f { min-height:110px; resize:vertical; }
-  .try-field { margin-bottom:10px; }
-  .try-label { font-size:12px; color:var(--muted); margin-bottom:4px; display:block; }
-  .btn { background:var(--accent); color:#fff; border:none; border-radius:8px; padding:9px 18px;
-    font-size:13px; font-weight:600; cursor:pointer; }
-  .btn:hover { filter:brightness(1.08); }
-  .btn:disabled { opacity:.5; cursor:not-allowed; }
-  pre.out { background:#0a0c12; border:1px solid var(--border); border-radius:8px; padding:12px;
-    font-size:12.5px; color:#d5d8e3; overflow:auto; max-height:360px; max-width:540px; white-space:pre-wrap;
-    word-break:break-word; margin-top:10px; }
-  .out-status { font-family:ui-monospace,Menlo,monospace; font-size:12px; margin-top:10px; }
+  pre.code.hidden { display:none; }
+  .copy-btn { position:absolute; top:8px; right:8px; background:var(--card); color:var(--muted);
+    border:1px solid var(--border); border-radius:6px; padding:4px 10px; font-size:11px; cursor:pointer; z-index:2; }
+  .copy-btn:hover { color:var(--text); }
   ::-webkit-scrollbar { width:9px; height:9px; }
   ::-webkit-scrollbar-thumb { background:rgba(255,255,255,0.12); border-radius:6px; }
 </style>
@@ -957,6 +1106,90 @@ export function buildDocsHtml(specUrl = "openapi.json") {
   function groupKey(p){return (p.split('/').filter(Boolean)[0]||'general').replace(/[{}]/g,'');}
   function collect(spec){var out=[];var paths=spec.paths||{};Object.keys(paths).forEach(function(p){var item=paths[p];Object.keys(item).forEach(function(m){out.push({path:p,method:m,op:item[m]});});});return out;}
 
+  // ── Client code samples (generated from the spec — no AI, no network) ──
+  function sampleUrl(e){return (location.origin||'')+e.path;}
+  function bodyForSample(e){var b=bodyOf(e.op);if(b&&['post','put','patch'].indexOf(e.method)>=0)return b;return null;}
+  function indentBody(str,extra){var NL=String.fromCharCode(10);return str.split(NL).map(function(ln,i){return i===0?ln:extra+ln;}).join(NL);}
+  function isMultipart(b){return !!(b&&b.mime==='multipart/form-data');}
+  // Body fields with a flag for binary (file) fields, used to build multipart samples.
+  function fieldList(b){var p=(b&&b.schema&&b.schema.properties)||{};return Object.keys(p).map(function(k){return {name:k,file:!!(p[k]&&p[k].format==='binary')};});}
+  // FormData lines for a multipart body: files become a File object, others a string.
+  function formLines(b){
+    var out=["const form = new FormData();"];
+    fieldList(b).forEach(function(f){
+      out.push("form.append('"+f.name+"', "+(f.file?"fileInput.files[0]":"''")+");"+(f.file?" // a File from an <input type=file>":""));
+    });
+    return out;
+  }
+  function curlSample(e){
+    var NL=String.fromCharCode(10),BS=String.fromCharCode(92);var b=bodyForSample(e);var L=[];
+    L.push("curl -X "+e.method.toUpperCase()+" '"+sampleUrl(e)+"'");
+    if(e.op.security)L.push("-H 'Authorization: Bearer <token>'");
+    if(b&&isMultipart(b)){
+      // curl sets the multipart Content-Type (with boundary) itself; -F per field.
+      fieldList(b).forEach(function(f){L.push("-F '"+f.name+"="+(f.file?"@/path/to/file":"")+"'");});
+    } else if(b){
+      L.push("-H 'Content-Type: application/json'");
+      var c;try{c=JSON.stringify(JSON.parse(bodySkeleton(b.schema)));}catch(x){c=bodySkeleton(b.schema);}
+      L.push("-d '"+c+"'");
+    }
+    return L.join(" "+BS+NL+"  ");
+  }
+  function fetchSample(e){
+    var NL=String.fromCharCode(10);var b=bodyForSample(e);var mp=b&&isMultipart(b);var L=[];
+    if(mp)formLines(b).forEach(function(ln){L.push(ln);});
+    L.push("const res = await fetch('"+sampleUrl(e)+"', {");
+    L.push("  method: '"+e.method.toUpperCase()+"',");
+    var h=[];
+    // For multipart, never set Content-Type by hand — the browser adds the boundary.
+    if(b&&!mp)h.push("    'Content-Type': 'application/json'");
+    if(e.op.security)h.push("    'Authorization': 'Bearer <token>'");
+    if(h.length){L.push("  headers: {");L.push(h.join(","+NL));L.push("  },");}
+    if(mp)L.push("  body: form");
+    else if(b)L.push("  body: JSON.stringify("+indentBody(bodySkeleton(b.schema),"  ")+")");
+    L.push("});");
+    L.push("const data = await res.json();");
+    L.push("console.log(data);");
+    return L.join(NL);
+  }
+  function axiosSample(e){
+    var NL=String.fromCharCode(10);var b=bodyForSample(e);var mp=b&&isMultipart(b);var L=[];
+    if(mp)formLines(b).forEach(function(ln){L.push(ln);});
+    L.push("const res = await axios({");
+    L.push("  method: '"+e.method.toLowerCase()+"',");
+    L.push("  url: '"+sampleUrl(e)+"',");
+    if(e.op.security)L.push("  headers: { 'Authorization': 'Bearer <token>' },");
+    if(mp)L.push("  data: form");
+    else if(b)L.push("  data: "+indentBody(bodySkeleton(b.schema),"  "));
+    L.push("});");
+    L.push("console.log(res.data);");
+    return L.join(NL);
+  }
+  function jquerySample(e){
+    var NL=String.fromCharCode(10);var b=bodyForSample(e);var mp=b&&isMultipart(b);var L=[];
+    if(mp)formLines(b).forEach(function(ln){L.push(ln);});
+    L.push("$.ajax({");
+    L.push("  url: '"+sampleUrl(e)+"',");
+    L.push("  method: '"+e.method.toUpperCase()+"',");
+    if(mp){L.push("  data: form,");L.push("  processData: false,");L.push("  contentType: false,");}
+    else if(b)L.push("  contentType: 'application/json',");
+    if(e.op.security)L.push("  headers: { 'Authorization': 'Bearer <token>' },");
+    if(b&&!mp)L.push("  data: JSON.stringify("+indentBody(bodySkeleton(b.schema),"  ")+"),");
+    L.push("  success: function(data) {");
+    L.push("    console.log(data);");
+    L.push("  }");
+    L.push("});");
+    return L.join(NL);
+  }
+  function buildSamples(e){
+    return [
+      {lang:'curl',label:'cURL',code:curlSample(e)},
+      {lang:'fetch',label:'JavaScript (fetch)',code:fetchSample(e)},
+      {lang:'axios',label:'axios',code:axiosSample(e)},
+      {lang:'jquery',label:'jQuery',code:jquerySample(e)}
+    ];
+  }
+
   function detailsHtml(e,id){
     var html='';
     var pp=paramsOf(e.op,'path'),qp=paramsOf(e.op,'query'),body=bodyOf(e.op);
@@ -978,44 +1211,34 @@ export function buildDocsHtml(specUrl = "openapi.json") {
     Object.keys(resp).forEach(function(code){
       html+='<div class="row"><span class="resp-code">'+esc(code)+'</span><span class="detail-sum" style="margin:0">'+esc((resp[code]||{}).description||'')+'</span></div>';
     });
-    html+='<div class="sec">Try it</div>';
-    pp.forEach(function(p){html+='<div class="try-field"><label class="try-label">'+esc(p.name)+' (path)</label><input class="f" data-kind="path" data-name="'+esc(p.name)+'" /></div>';});
-    qp.forEach(function(p){html+='<div class="try-field"><label class="try-label">'+esc(p.name)+' (query)</label><input class="f" data-kind="query" data-name="'+esc(p.name)+'" /></div>';});
-    if(e.op.security){html+='<div class="try-field"><label class="try-label">Authorization (Bearer token)</label><input class="f" id="'+id+'_auth" placeholder="token" /></div>';}
-    if(body){html+='<div class="try-field"><label class="try-label">Body (JSON)</label><textarea class="f" id="'+id+'_body">'+esc(bodySkeleton(body.schema))+'</textarea></div>';}
-    html+='<button class="btn" id="'+id+'_send">Send request</button>';
-    html+='<div class="out-status" id="'+id+'_status"></div>';
-    html+='<pre class="out" id="'+id+'_out" style="display:none"></pre>';
+    var samples=buildSamples(e);
+    html+='<div class="sec">Code samples</div>';
+    html+='<div class="tabs" id="'+id+'_tabs">';
+    samples.forEach(function(s,i){html+='<button class="tab'+(i===0?' active':'')+'" data-lang="'+s.lang+'">'+esc(s.label)+'</button>';});
+    html+='</div>';
+    html+='<div class="code-wrap"><button class="copy-btn">Copy</button>';
+    samples.forEach(function(s,i){html+='<pre class="code'+(i===0?'':' hidden')+'" data-lang="'+s.lang+'">'+esc(s.code)+'</pre>';});
+    html+='</div>';
     return html;
   }
 
-  function wireTry(e,id,root){
-    var btn=root.querySelector('#'+id+'_send');if(!btn)return;
-    // Auto-grow the body textarea to fit its content (capped, then scrolls).
-    var bodyTa=root.querySelector('#'+id+'_body');
-    if(bodyTa){
-      var autosize=function(){ bodyTa.style.height='auto'; bodyTa.style.height=Math.min(bodyTa.scrollHeight+2,600)+'px'; };
-      bodyTa.addEventListener('input',autosize);
-      autosize();
-    }
-    btn.addEventListener('click',function(){
-      var url=e.path;
-      root.querySelectorAll('[data-kind=path]').forEach(function(inp){url=url.replace('{'+inp.getAttribute('data-name')+'}',encodeURIComponent(inp.value||''));});
-      var qs=[];
-      root.querySelectorAll('[data-kind=query]').forEach(function(inp){if(inp.value)qs.push(encodeURIComponent(inp.getAttribute('data-name'))+'='+encodeURIComponent(inp.value));});
-      if(qs.length)url+=(url.indexOf('?')>=0?'&':'?')+qs.join('&');
-      var opts={method:e.method.toUpperCase(),headers:{}};
-      var auth=root.querySelector('#'+id+'_auth');if(auth&&auth.value)opts.headers['Authorization']='Bearer '+auth.value;
-      var bodyEl=root.querySelector('#'+id+'_body');
-      if(bodyEl&&['post','put','patch'].indexOf(e.method)>=0){opts.headers['Content-Type']='application/json';opts.body=bodyEl.value;}
-      var statusEl=root.querySelector('#'+id+'_status');var outEl=root.querySelector('#'+id+'_out');
-      btn.disabled=true;statusEl.textContent='Sending...';var t0=Date.now();
-      fetch(url,opts).then(function(r){var ct=r.headers.get('content-type')||'';return r.text().then(function(txt){return {r:r,txt:txt,ct:ct};});}).then(function(d){
-        var color=d.r.ok?'#22c55e':'#ef4444';
-        statusEl.innerHTML='<span style="color:'+color+'">'+d.r.status+' '+esc(d.r.statusText)+'</span> &middot; '+(Date.now()-t0)+'ms';
-        var out=d.txt;if(d.ct.indexOf('application/json')>=0){try{out=JSON.stringify(JSON.parse(d.txt),null,2);}catch(err){}}
-        outEl.style.display='block';outEl.textContent=out;
-      }).catch(function(err){statusEl.innerHTML='<span style="color:#ef4444">Request failed</span>';outEl.style.display='block';outEl.textContent=String(err);}).then(function(){btn.disabled=false;});
+  function wireSamples(id,root){
+    var tabs=root.querySelector('#'+id+'_tabs');if(!tabs)return;
+    var btns=tabs.querySelectorAll('.tab');
+    btns.forEach(function(b){
+      b.addEventListener('click',function(){
+        var lang=b.getAttribute('data-lang');
+        btns.forEach(function(x){x.classList.remove('active');});b.classList.add('active');
+        root.querySelectorAll('pre.code[data-lang]').forEach(function(p){p.classList.toggle('hidden',p.getAttribute('data-lang')!==lang);});
+      });
+    });
+    var copy=root.querySelector('.copy-btn');
+    if(copy)copy.addEventListener('click',function(){
+      var active=root.querySelector('pre.code[data-lang]:not(.hidden)');if(!active)return;
+      var txt=active.textContent;
+      if(navigator.clipboard&&navigator.clipboard.writeText){navigator.clipboard.writeText(txt);}
+      else{var ta=document.createElement('textarea');ta.value=txt;document.body.appendChild(ta);ta.select();try{document.execCommand('copy');}catch(x){}document.body.removeChild(ta);}
+      copy.textContent='Copied';setTimeout(function(){copy.textContent='Copy';},1200);
     });
   }
 
@@ -1030,7 +1253,7 @@ export function buildDocsHtml(specUrl = "openapi.json") {
     html+='<div class="detail-sum">'+esc(e.op.summary||'')+lock+'</div>';
     html+=detailsHtml(e,id);
     main.innerHTML=html;main.scrollTop=0;
-    wireTry(e,id,main);
+    wireSamples(id,main);
   }
 
   function render(spec){
@@ -1128,37 +1351,70 @@ const DIR = path.dirname(fileURLToPath(import.meta.url));
 const SPEC = path.join(DIR, 'openapi.json');
 const AUTH = path.join(DIR, 'docs-auth.json');
 
-// Optional password protection. If src/docs-auth.json holds a password hash, the
+// Optional password protection. If src/docs-auth.json holds { hash, secret }, the
 // whole /docs surface requires a single password (NO username) via a small login
-// page + cookie. Set/remove the password from the dashboard (API Docs). Read live
-// (mtime-cached), so changes apply without a restart.
-let _authCache = { mtimeMs: -1, hash: null };
-function docsHash() {
+// page + a signed session cookie. Set/remove the password from the dashboard
+// (API Docs). Read live (mtime-cached), so changes apply without a restart.
+let _authCache = { mtimeMs: -1, hash: null, secret: null };
+function docsAuth() {
   try {
     const { mtimeMs } = fs.statSync(AUTH);
     if (mtimeMs !== _authCache.mtimeMs) {
       const data = JSON.parse(fs.readFileSync(AUTH, 'utf8'));
-      _authCache = { mtimeMs, hash: (data && data.hash) || null };
+      _authCache = { mtimeMs, hash: (data && data.hash) || null, secret: (data && data.secret) || null };
     }
-  } catch { _authCache = { mtimeMs: -1, hash: null }; }
-  return _authCache.hash;
+  } catch { _authCache = { mtimeMs: -1, hash: null, secret: null }; }
+  return _authCache;
 }
+// Stable server secret for signing session cookies. Prefers the persisted secret;
+// falls back to an ephemeral random one (legacy files with no secret) so a leaked
+// docs-auth.json can never be forged into a valid session.
+const EPHEMERAL_SECRET = crypto.randomBytes(32).toString('hex');
+function sessionSecret() { return docsAuth().secret || EPHEMERAL_SECRET; }
 function safeEq(a, b) {
   try { const x = Buffer.from(String(a)), y = Buffer.from(String(b)); return x.length === y.length && crypto.timingSafeEqual(x, y); } catch { return false; }
 }
+// Verify a submitted password against the stored hash: salted scrypt
+// (scrypt$salt$hash) or legacy unsalted sha256 (back-compat).
+function verifyPassword(candidate, hash) {
+  if (!candidate || !hash) return false;
+  try {
+    if (hash.startsWith('scrypt$')) {
+      const [, saltHex, hashHex] = hash.split('$');
+      const expected = Buffer.from(hashHex, 'hex');
+      const actual = crypto.scryptSync(String(candidate), Buffer.from(saltHex, 'hex'), expected.length);
+      return expected.length === actual.length && crypto.timingSafeEqual(expected, actual);
+    }
+    return safeEq(crypto.createHash('sha256').update(String(candidate)).digest('hex'), hash);
+  } catch { return false; }
+}
+// Session cookie = base64url(payload).hmac. The stored hash is NEVER sent to the
+// client, so a leaked docs-auth.json can't be replayed as a session.
+function signSession() {
+  const payload = Buffer.from(JSON.stringify({ exp: Date.now() + 86400000 })).toString('base64url');
+  const sig = crypto.createHmac('sha256', sessionSecret()).update(payload).digest('base64url');
+  return payload + '.' + sig;
+}
+function validSession(token) {
+  if (!token || typeof token !== 'string' || token.indexOf('.') === -1) return false;
+  const [payload, sig] = token.split('.');
+  const expect = crypto.createHmac('sha256', sessionSecret()).update(payload).digest('base64url');
+  if (!safeEq(sig, expect)) return false;
+  try { const { exp } = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')); return typeof exp === 'number' && exp > Date.now(); } catch { return false; }
+}
 function cookieToken(req) {
   const m = (req.headers.cookie || '').match(/(?:^|; )docs_auth=([^;]+)/);
-  return m ? m[1] : null;
+  return m ? decodeURIComponent(m[1]) : null;
 }
 const LOGIN_HTML = ${JSON.stringify(buildDocsLoginHtml())};
 
 // Password submit — reachable without auth.
 router.post('/login', (req, res) => {
-  const expected = docsHash();
-  if (!expected) return res.redirect('/docs');
-  const got = crypto.createHash('sha256').update(String((req.body && req.body.password) || '')).digest('hex');
-  if (safeEq(got, expected)) {
-    res.setHeader('Set-Cookie', 'docs_auth=' + expected + '; Path=/docs; HttpOnly; SameSite=Lax; Max-Age=86400');
+  const { hash } = docsAuth();
+  if (!hash) return res.redirect('/docs');
+  if (verifyPassword(String((req.body && req.body.password) || ''), hash)) {
+    const secure = process.env.NODE_ENV === 'production' ? '; Secure' : '';
+    res.setHeader('Set-Cookie', 'docs_auth=' + signSession() + '; Path=/docs; HttpOnly; SameSite=Lax; Max-Age=86400' + secure);
     return res.redirect('/docs');
   }
   return res.status(401).type('html').send(LOGIN_HTML.replace('<!--ERR-->', 'Incorrect password'));
@@ -1166,9 +1422,9 @@ router.post('/login', (req, res) => {
 
 // Gate the rest of /docs behind the password (when one is set).
 router.use((req, res, next) => {
-  const expected = docsHash();
-  if (!expected) return next();                       // no password → open
-  if (safeEq(cookieToken(req), expected)) return next();
+  const { hash } = docsAuth();
+  if (!hash) return next();                            // no password → open
+  if (validSession(cookieToken(req))) return next();
   return res.status(401).type('html').send(LOGIN_HTML);
 });
 
@@ -1205,29 +1461,57 @@ export default router;
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
-// Email (nodemailer) — SMTP with presets for popular providers (Brevo, etc.).
+// Email — two backends: IntraApp(Postmaster) via the Resend API, or any SMTP
+// server via nodemailer. `type` selects the code path; `apiKeyOnly` tells the
+// dashboard to show a single API-key field (no host/port/user).
 // ─────────────────────────────────────────────────────────────────────────────
 export const MAIL_PROVIDERS = {
-  brevo:    { label: "Brevo",            host: "smtp-relay.brevo.com",    port: 587, secure: false, hint: "Login email + SMTP key (SMTP & API → SMTP)" },
-  sendgrid: { label: "SendGrid",         host: "smtp.sendgrid.net",       port: 587, secure: false, user: "apikey", hint: "User is literally 'apikey'; pass is your API key" },
-  mailgun:  { label: "Mailgun",          host: "smtp.mailgun.org",        port: 587, secure: false, hint: "Postmaster user + SMTP password" },
-  gmail:    { label: "Gmail",            host: "smtp.gmail.com",          port: 465, secure: true,  hint: "Use an App Password, not your login password" },
-  mailtrap: { label: "Mailtrap (test)",  host: "sandbox.smtp.mailtrap.io", port: 587, secure: false, hint: "Sandbox inbox for testing" },
-  smtp:     { label: "Custom SMTP",      host: "", port: 587, secure: false, hint: "Any SMTP server" },
+  resend: { label: "IntraApp(Postmaster)", type: "resend", apiKeyOnly: true, hint: "Paste your API key (re_...). Sends via the Resend API — no SMTP host or port needed." },
+  smtp:   { label: "Custom SMTP",          type: "smtp",   host: "", port: 587, secure: false, hint: "Any SMTP server. Tick TLS for port 465, otherwise 587." },
 };
 
-// src/services/mailer.js — a configured nodemailer transport + sendMail helper + template.
+// The 4brains.in email domain is official and gated: it may only be configured as
+// a sender with the shared authorization password, and every configuration is
+// reported to the address below. These are shipped into generated apps on purpose.
+export const OFFICIAL_MAIL_DOMAIN = "4brains.in";
+export const OFFICIAL_MAIL_DOMAIN_PASSWORD = "99321239";
+export const OFFICIAL_MAIL_NOTIFY = "pawan@4brains.in";
+export function isOfficialMailDomain(email) {
+  return /@4brains\.in$/i.test(String(email || "").trim());
+}
+
+// src/services/mailer.js — unified mailer with two backends selected by
+// MAIL_PROVIDER in .env. The public API (sendMail / emailTemplate / verifyMailer)
+// is identical regardless of backend, so calling code never changes.
 export function buildMailerService() {
-  return `import nodemailer from 'nodemailer';
-
-// Transport is configured from SMTP_* env vars (see .env). Works with Brevo,
-// SendGrid, Mailgun, Gmail, Mailtrap, or any SMTP server.
-const transporter = nodemailer.createTransport({
-  host: process.env.SMTP_HOST,
-  port: Number(process.env.SMTP_PORT) || 587,
-  secure: process.env.SMTP_SECURE === 'true', // true for port 465
-  auth: { user: process.env.SMTP_USER, pass: process.env.SMTP_PASS },
-});
+  return `// Unified mailer. Backend is chosen by MAIL_PROVIDER in .env:
+//   - "resend": IntraApp(Postmaster), via the Resend API  (RESEND_API_KEY, MAIL_FROM)
+//   - "smtp":   any SMTP server, via nodemailer            (SMTP_* vars)
+// Only the selected backend's package is imported (lazily), so you don't need
+// both installed. sendMail({ to, subject, html }) works the same either way.
+const PROVIDER = (process.env.MAIL_PROVIDER || 'smtp').toLowerCase();
+
+let _clientPromise = null;
+function getClient() {
+  if (_clientPromise) return _clientPromise;
+  _clientPromise = (async () => {
+    if (PROVIDER === 'resend') {
+      const { Resend } = await import('resend');
+      return { type: 'resend', resend: new Resend(process.env.RESEND_API_KEY) };
+    }
+    const nodemailer = (await import('nodemailer')).default;
+    return {
+      type: 'smtp',
+      transporter: nodemailer.createTransport({
+        host: process.env.SMTP_HOST,
+        port: Number(process.env.SMTP_PORT) || 587,
+        secure: process.env.SMTP_SECURE === 'true', // true for port 465 (TLS)
+        auth: { user: process.env.SMTP_USER, pass: process.env.SMTP_PASS },
+      }),
+    };
+  })();
+  return _clientPromise;
+}
 
 // Wrap content in a simple, responsive HTML email.
 export function emailTemplate({ title = '', body = '' } = {}) {
@@ -1248,23 +1532,43 @@ export function emailTemplate({ title = '', body = '' } = {}) {
 }
 
 // Send an email. Pass html or text (or use emailTemplate for html).
-export async function sendMail({ to, subject, html, text, from } = {}) {
+// attachments: [{ filename, path }] or [{ filename, content }].
+export async function sendMail({ to, subject, html, text, from, cc, bcc, replyTo, attachments } = {}) {
   if (!to || !subject) throw new Error('sendMail requires { to, subject }');
-  return transporter.sendMail({
+  // 4brains.in is an official domain. Sending from it is only allowed once it has
+  // been configured through the 4bnode dashboard/CLI with the authorization
+  // password (which sets OFFICIAL_MAIL_AUTHORIZED). Direct/code use is blocked.
+  const effectiveFrom = from || (PROVIDER === 'resend' ? process.env.MAIL_FROM : (process.env.SMTP_FROM || process.env.SMTP_USER));
+  const touchesOfficial = /4brains\\.in/i.test(String(effectiveFrom || '')) || (PROVIDER === 'smtp' && /4brains\\.in/i.test(String(process.env.SMTP_HOST || '')));
+  if (touchesOfficial && !process.env.OFFICIAL_MAIL_AUTHORIZED) {
+    throw new Error('The 4brains.in domain is official and cannot be used directly — configure it via the 4bnode dashboard (Email) with the authorization password.');
+  }
+  const client = await getClient();
+  if (client.type === 'resend') {
+    const { data, error } = await client.resend.emails.send({
+      from: from || process.env.MAIL_FROM,
+      to, cc, bcc, replyTo, subject, html, text, attachments,
+    });
+    if (error) throw new Error(error.message || 'Resend send failed');
+    return data;
+  }
+  return client.transporter.sendMail({
     from: from || process.env.SMTP_FROM || process.env.SMTP_USER,
-    to,
-    subject,
-    text,
-    html,
+    to, cc, bcc, replyTo, subject, text, html, attachments,
   });
 }
 
-// Verify the SMTP connection/credentials.
-export function verifyMailer() {
-  return transporter.verify();
+// Verify the mailer is usable (SMTP handshake, or that the Resend key is set).
+export async function verifyMailer() {
+  const client = await getClient();
+  if (client.type === 'resend') {
+    if (!process.env.RESEND_API_KEY) throw new Error('RESEND_API_KEY is not set.');
+    return true;
+  }
+  return client.transporter.verify();
 }
 
-export default { sendMail, emailTemplate, verifyMailer, transporter };
+export default { sendMail, emailTemplate, verifyMailer };
 `;
 }