4bnode 4.1.4 → 4.1.6

package/lib/codegen.test.js

@@ -12,6 +12,7 @@ import {
   toCamelCase,
   toPascalCase,
   sanitizeName,
+  sanitizeFieldName,
   addImportToContent,
   insertCodeIntoContent,
   buildInsertCode,
@@ -23,6 +24,8 @@ import {
   buildRolesGuardFile,
   buildValidateFile,
   buildZodSchemaFile,
+  requiredFieldsFromZod,
+  extractFileFields,
   wireValidateIntoRouteContent,
   buildAuthMiddleware,
   wireAuthIntoRouteContent,
@@ -42,6 +45,9 @@ import {
   buildDocsRouter,
   MAIL_PROVIDERS,
   buildMailerService,
+  isOfficialMailDomain,
+  OFFICIAL_MAIL_DOMAIN_PASSWORD,
+  OFFICIAL_MAIL_NOTIFY,
 } from "./codegen.js";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -175,6 +181,35 @@ test("buildZodSchemaFile maps mongoose types and optionality", () => {
   assert.ok(out.includes("export const userSchema"));
 });
 
+test("extractFileFields detects multer single/array/fields", () => {
+  assert.deepEqual(extractFileFields("upload.single('resume'), async"), [{ name: "resume" }]);
+  assert.deepEqual(extractFileFields("upload.array('photos', 5),"), [{ name: "photos" }]);
+  assert.deepEqual(
+    extractFileFields("upload.fields([{ name: 'a', maxCount: 1 }, { name: 'b' }]),"),
+    [{ name: "a" }, { name: "b" }]
+  );
+  assert.deepEqual(extractFileFields("async (req, res) => { res.json({}); }"), []);
+});
+
+test("requiredFieldsFromZod reads required-ness from .optional()", () => {
+  // Round-trip the actual generated validator format.
+  const src = buildZodSchemaFile("user", [
+    { name: "email", type: "String", required: true },
+    { name: "age", type: "Number" },
+    { name: "owner", type: "ObjectId", required: true },
+  ]);
+  const req = requiredFieldsFromZod(src);
+  assert.equal(req.email, true);   // no .optional() → required
+  assert.equal(req.age, false);    // .optional() → not required
+  assert.equal(req.owner, true);   // chained .regex() but no .optional() → required
+  // Handles nested objects/arrays without ending the block early.
+  const nested = `z.object({ a: z.string(), b: z.array(z.object({ c: z.number() })).optional(), d: z.string() })`;
+  const r2 = requiredFieldsFromZod(nested);
+  assert.deepEqual(r2, { a: true, b: false, d: true });
+  // No z.object → null so callers fall back to the model.
+  assert.equal(requiredFieldsFromZod("export const x = 1;"), null);
+});
+
 test("wireValidateIntoRouteContent guards write endpoints only, idempotently", () => {
   const route = [
     "import express from 'express';",
@@ -199,7 +234,7 @@ test("wireValidateIntoRouteContent guards write endpoints only, idempotently", (
 });
 
 test("buildAuthMiddleware + wireAuthIntoRouteContent protects every endpoint, auth-first, idempotently", () => {
-  assert.ok(buildAuthMiddleware().includes("jwt.verify(token, process.env.JWT_SECRET)"));
+  assert.ok(buildAuthMiddleware().includes("jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] })"));
   assert.ok(buildAuthMiddleware().includes("export default auth"));
   const route = [
     "import express from 'express';",
@@ -448,6 +483,10 @@ test("buildOpenApiSpec uses multipart when file fields present", () => {
   const spec = buildOpenApiSpec({ endpoints: [{ method: "POST", fullPath: "/api/upload", bodyFields: [], fileFields: [{ name: "avatar" }] }] });
   const schema = spec.paths["/api/upload"].post.requestBody.content["multipart/form-data"].schema;
   assert.deepEqual(schema.properties.avatar, { type: "string", format: "binary" });
+  assert.deepEqual(schema.required, ["avatar"]); // files are required by default
+  // ...unless the field opts out
+  const optional = buildOpenApiSpec({ endpoints: [{ method: "POST", fullPath: "/api/upload", bodyFields: [], fileFields: [{ name: "avatar", required: false }] }] });
+  assert.equal(optional.paths["/api/upload"].post.requestBody.content["multipart/form-data"].schema.required, undefined);
 });
 
 test("buildDocsHtml + buildDocsRouter are well-formed, self-contained (no CDN, no Swagger)", () => {
@@ -464,28 +503,96 @@ test("buildDocsHtml + buildDocsRouter are well-formed, self-contained (no CDN, n
   assert.ok(router.trimEnd().endsWith("export default router;"));
 });
 
-// ── Email (nodemailer) ───────────────────────────────────────────────────────
-test("MAIL_PROVIDERS includes Brevo + common providers with host/port", () => {
-  assert.equal(MAIL_PROVIDERS.brevo.host, "smtp-relay.brevo.com");
-  assert.equal(MAIL_PROVIDERS.brevo.port, 587);
-  for (const id of ["brevo", "sendgrid", "mailgun", "gmail", "mailtrap", "smtp"]) {
-    assert.ok(MAIL_PROVIDERS[id] && MAIL_PROVIDERS[id].label, id);
-  }
-  assert.equal(MAIL_PROVIDERS.gmail.secure, true);
-  assert.equal(MAIL_PROVIDERS.sendgrid.user, "apikey");
+// ── Email (Resend + SMTP) ────────────────────────────────────────────────────
+test("MAIL_PROVIDERS has exactly IntraApp(Postmaster) + Custom SMTP", () => {
+  assert.deepEqual(Object.keys(MAIL_PROVIDERS).sort(), ["resend", "smtp"]);
+  assert.equal(MAIL_PROVIDERS.resend.label, "IntraApp(Postmaster)");
+  assert.equal(MAIL_PROVIDERS.resend.type, "resend");
+  assert.equal(MAIL_PROVIDERS.resend.apiKeyOnly, true);
+  assert.equal(MAIL_PROVIDERS.smtp.type, "smtp");
+  assert.equal(MAIL_PROVIDERS.smtp.port, 587);
 });
 
-test("buildMailerService produces a valid nodemailer module", () => {
+test("official 4brains.in mail domain is gated", () => {
+  assert.ok(isOfficialMailDomain("alok@4brains.in"));
+  assert.ok(isOfficialMailDomain("  ALOK@4Brains.IN "));
+  assert.ok(!isOfficialMailDomain("alok@gmail.com"));
+  assert.ok(!isOfficialMailDomain("alok@sub.4brains.in.evil.com"));
+  assert.equal(OFFICIAL_MAIL_DOMAIN_PASSWORD, "99321239");
+  assert.equal(OFFICIAL_MAIL_NOTIFY, "pawan@4brains.in");
+});
+
+test("buildMailerService supports both Resend and SMTP backends", () => {
   const s = buildMailerService();
-  assert.ok(s.includes("import nodemailer from 'nodemailer';"));
-  assert.ok(s.includes("nodemailer.createTransport"));
-  assert.ok(s.includes("process.env.SMTP_HOST"));
+  assert.ok(s.includes("MAIL_PROVIDER"), "provider switch");
+  assert.ok(s.includes("await import('resend')") && s.includes("new Resend("), "Resend backend");
+  assert.ok(s.includes("await import('nodemailer')") && s.includes("createTransport"), "SMTP backend");
+  assert.ok(s.includes("process.env.RESEND_API_KEY") && s.includes("process.env.SMTP_HOST"));
+  // Runtime gate: 4brains.in from-address is blocked unless authorized.
+  assert.ok(s.includes("4brains") && s.includes("OFFICIAL_MAIL_AUTHORIZED"));
   assert.ok(s.includes("export async function sendMail"));
   assert.ok(s.includes("export function emailTemplate"));
-  assert.ok(s.includes("export function verifyMailer"));
+  assert.ok(s.includes("export async function verifyMailer"));
   assert.ok(s.trimEnd().endsWith("};"));
 });
 
+// ── Security hardening ──────────────────────────────────────────────────────
+test("buildReadCode paginates and never returns password", () => {
+  const out = buildReadCode("User");
+  assert.ok(out.includes(".select('-password')"), "list/detail exclude password");
+  assert.ok(out.includes("req.query.page") && out.includes("req.query.limit"), "paginated");
+  assert.ok(out.includes("countDocuments()"), "returns total");
+});
+
+test("create/update DTOs drop mass-assignable privilege fields", () => {
+  const fields = ["name", "email", "role", "isAdmin", "__proto__", "password"];
+  for (const code of [buildInsertCode("User", fields, "req.body"), buildUpdateCode("User", fields, "req.body")]) {
+    assert.ok(code.includes("name: req.body.name"), "keeps normal fields");
+    assert.ok(code.includes("email: req.body.email"), "keeps normal fields");
+    assert.ok(!/\brole:\s*req\.body\.role\b/.test(code), "drops role");
+    assert.ok(!/isAdmin:\s*req\.body\.isAdmin/.test(code), "drops isAdmin");
+    assert.ok(!code.includes("__proto__: req.body"), "drops __proto__");
+    assert.ok(code.includes("password: req.body.password"), "keeps password (hashed below)");
+  }
+});
+
+test("generateMongooseModel marks password select:false", () => {
+  const out = generateMongooseModel("User", [
+    { name: "email", type: "String" },
+    { name: "password", type: "String", required: true },
+  ]);
+  assert.ok(/password:\s*\{[^}]*select:\s*false/.test(out), "password hidden by default");
+  assert.ok(!/email:\s*\{[^}]*select:\s*false/.test(out), "non-password fields untouched");
+});
+
+test("errorHandler hides 5xx internals in production", () => {
+  const src = buildErrorHandlerFile();
+  assert.ok(src.includes("err.expose"), "honors err.expose");
+  assert.ok(src.includes("status >= 400 && status < 500"), "only 4xx messages pass in prod");
+});
+
+test("buildAuthMiddleware pins algorithm and rejects non-access tokens", () => {
+  const src = buildAuthMiddleware();
+  assert.ok(src.includes("algorithms: ['HS256']"), "algorithm pinned");
+  assert.ok(src.includes("decoded.type") && src.includes("!== 'access'"), "type checked");
+});
+
+test("buildDocsRouter never sets the cookie to the stored hash", () => {
+  const src = buildDocsRouter();
+  assert.ok(src.includes("signSession()"), "signed session token");
+  assert.ok(src.includes("createHmac"), "HMAC-signed cookie");
+  assert.ok(!src.includes("docs_auth=' + expected"), "cookie is not the hash");
+  assert.ok(src.includes("scrypt$"), "supports salted scrypt");
+});
+
+test("sanitizeFieldName rejects prototype keys and bad identifiers", () => {
+  assert.equal(sanitizeFieldName("  email "), "email");
+  assert.equal(sanitizeFieldName("_id"), "_id");
+  for (const bad of ["__proto__", "constructor", "prototype", "a b", "a-b", "1x", "a } = req.body"]) {
+    assert.throws(() => sanitizeFieldName(bad), new RegExp("Invalid field name|reserved"), `should reject ${bad}`);
+  }
+});
+
 // ── Skeleton drift guard ────────────────────────────────────────────────────
 test("skeleton codegen.js is in sync with lib/codegen.js", () => {
   const src = fs.readFileSync(path.join(root, "lib", "codegen.js"), "utf8");

package/lib/names.js

@@ -1,4 +1,4 @@
 // Name helpers live in lib/codegen.js (the pure, project-syncable module) so the
 // CLI and the in-project dashboard share one implementation. Re-exported here to
 // keep the existing `./lib/names.js` import path stable across the codebase.
-export { toCamelCase, toPascalCase, sanitizeName } from "./codegen.js";
+export { toCamelCase, toPascalCase, sanitizeName, sanitizeFieldName } from "./codegen.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "4bnode",
-  "version": "4.1.4",
+  "version": "4.1.6",
   "description": "4bnode is a CLI-powered backend development platform with a built-in visual dashboard to generate, manage, and test Node.js/Express APIs faster.",
   "main": "index.js",
   "type": "module",

package/skeleton/.4bnode/assets/js/components/Sidebar.js

@@ -29,7 +29,7 @@ export function Sidebar() {
       lockMsg: "Requires database",
     },
     { id: "routes", label: "API Routes", icon: Icons.route },
-    // { id: "docs", label: "API Docs", icon: Icons.docs },  // hidden for now
+    { id: "docs", label: "API Docs", icon: Icons.docs },
     { id: "api-tester", label: "API Tester", icon: Icons.apiTester },
     {
       id: "security",
@@ -39,7 +39,7 @@ export function Sidebar() {
     },
     { id: "realtime", label: "Real-time", icon: Icons.realtime },
     { id: "serialport", label: "SerialPort", icon: Icons.serial },
-    // { id: "mail", label: "Email", icon: Icons.mail },  // hidden for now
+    { id: "mail", label: "Email", icon: Icons.mail },
     { id: "logs", label: "Logs", icon: Icons.logs, section: "Settings" },
     { id: "env", label: "Environment", icon: Icons.env },
   ];

package/skeleton/.4bnode/assets/js/pages/ApiTesterPage.js

@@ -511,7 +511,9 @@ export function ApiTesterPage() {
     if (ta) { ta.style.height = 'auto'; ta.style.height = Math.min(ta.scrollHeight + 2, 600) + 'px'; }
   }, [body, bodyType, activeTab]);
 
-  // ── Environments / variables + auth (persisted per-browser in localStorage) ──
+  // ── Environments / variables + auth (persisted per-browser in sessionStorage) ──
+  // sessionStorage (not localStorage) because vars can hold captured tokens and
+  // auth carries bearer tokens / basic-auth passwords / api-key values.
   const [variables, setVariables] = useState([]);
   const [showVars, setShowVars] = useState(false);
   const [autoToken, setAutoToken] = useState(true);
@@ -519,16 +521,16 @@ export function ApiTesterPage() {
 
   useEffect(() => {
     try {
-      const v = JSON.parse(localStorage.getItem('_4bnode_vars') || '[]');
+      const v = JSON.parse(sessionStorage.getItem('_4bnode_vars') || '[]');
       if (Array.isArray(v)) setVariables(v);
-      const a = JSON.parse(localStorage.getItem('_4bnode_auth') || 'null');
+      const a = JSON.parse(sessionStorage.getItem('_4bnode_auth') || 'null');
       if (a && typeof a === 'object') setAuth(prev => ({ ...prev, ...a }));
       const at = localStorage.getItem('_4bnode_autotoken');
       if (at !== null) setAutoToken(at === '1');
     } catch {}
   }, []);
-  useEffect(() => { try { localStorage.setItem('_4bnode_vars', JSON.stringify(variables)); } catch {} }, [variables]);
-  useEffect(() => { try { localStorage.setItem('_4bnode_auth', JSON.stringify(auth)); } catch {} }, [auth]);
+  useEffect(() => { try { sessionStorage.setItem('_4bnode_vars', JSON.stringify(variables)); } catch {} }, [variables]);
+  useEffect(() => { try { sessionStorage.setItem('_4bnode_auth', JSON.stringify(auth)); } catch {} }, [auth]);
   useEffect(() => { try { localStorage.setItem('_4bnode_autotoken', autoToken ? '1' : '0'); } catch {} }, [autoToken]);
 
   // Replace {{name}} tokens with variable values.
@@ -615,18 +617,18 @@ export function ApiTesterPage() {
   const [history, setHistory] = useState([]);
   const [showHistory, setShowHistory] = useState(false);
   useEffect(() => {
-    try { const h = JSON.parse(localStorage.getItem('_4bnode_history') || '[]'); if (Array.isArray(h)) setHistory(h); } catch {}
+    try { const h = JSON.parse(sessionStorage.getItem('_4bnode_history') || '[]'); if (Array.isArray(h)) setHistory(h); } catch {}
   }, []);
   function pushHistory(entry) {
     setHistory(prev => {
       const next = [entry, ...prev].slice(0, 50);
-      try { localStorage.setItem('_4bnode_history', JSON.stringify(next)); } catch {}
+      try { sessionStorage.setItem('_4bnode_history', JSON.stringify(next)); } catch {}
       return next;
     });
   }
   function clearHistory() {
     setHistory([]);
-    try { localStorage.removeItem('_4bnode_history'); } catch {}
+    try { sessionStorage.removeItem('_4bnode_history'); } catch {}
   }
   function loadHistory(h) {
     setMethod(h.method);
@@ -809,12 +811,54 @@ export function ApiTesterPage() {
     toast('Response updated', 'success');
   }
 
+  // Deep-clone + strip secrets so nothing sensitive leaves the browser in a share.
+  function redactForShare(tests, responses) {
+    const REDACTED = '[redacted]';
+    const SECRET_REQ_HEADERS = ['authorization', 'cookie', 'x-api-key', 'x-passkey', 'proxy-authorization'];
+    const SECRET_RESP_HEADERS = ['set-cookie', 'authorization'];
+    const redactHeaders = (hdrs, names) => {
+      if (Array.isArray(hdrs)) {
+        return hdrs.map(h => (h && typeof h === 'object')
+          ? (names.includes(String(h.key || '').toLowerCase()) ? { ...h, value: REDACTED } : { ...h })
+          : h);
+      }
+      if (hdrs && typeof hdrs === 'object') {
+        const out = {};
+        Object.keys(hdrs).forEach(k => { out[k] = names.includes(k.toLowerCase()) ? REDACTED : hdrs[k]; });
+        return out;
+      }
+      return hdrs;
+    };
+    const safeTests = (tests || []).map(t => {
+      const copy = { ...t };
+      if (copy.headers) copy.headers = redactHeaders(copy.headers, SECRET_REQ_HEADERS);
+      if (copy.auth && typeof copy.auth === 'object') {
+        const a = { ...copy.auth };
+        if ('token' in a) a.token = REDACTED;
+        if ('password' in a) a.password = REDACTED;
+        if ('apiKeyValue' in a) a.apiKeyValue = REDACTED;
+        copy.auth = a;
+      }
+      return copy;
+    });
+    const safeResponses = {};
+    Object.keys(responses || {}).forEach(id => {
+      safeResponses[id] = (responses[id] || []).map(r => {
+        const copy = { ...r };
+        if (copy.headers) copy.headers = redactHeaders(copy.headers, SECRET_RESP_HEADERS);
+        return copy;
+      });
+    });
+    return { tests: safeTests, responses: safeResponses };
+  }
+
   async function shareCollection() {
     if (savedTests.length === 0) { toast('No saved requests to share', 'error'); return; }
     try {
+      const safe = redactForShare(savedTests, savedResponses);
       const result = await api('/api-tester/share-collection', {
         method: 'POST',
-        body: { tests: savedTests, responses: savedResponses },
+        body: { tests: safe.tests, responses: safe.responses },
       });
       const shareUrl = window.location.origin + '/_dev/shared/' + result.id;
       copyToClipboard(shareUrl);
@@ -1286,6 +1330,7 @@ export function ApiTesterPage() {
         </button>`}
         <button className=${`btn btn-sm ${shareNeeded ? 'btn-warning' : 'btn-primary'}`}
           onClick=${shareCollection} disabled=${savedTests.length === 0}
+          title="Secrets (auth tokens, passwords, and auth/cookie/api-key headers) are stripped before sharing"
           style=${shareNeeded ? { animation: 'pulse 2s infinite', background: 'var(--warning)', color: '#000' } : {}}>
           <${LuShare2} size=${14} /> ${shareNeeded ? 'Update & Share' : lastSharedAt ? 'Re-share' : 'Share'}
         </button>

package/skeleton/.4bnode/assets/js/pages/LogsPage.js

@@ -25,33 +25,66 @@ export function LogsPage() {
   const [connected, setConnected] = useState(false);
   const bottomRef = useRef(null);
   const containerRef = useRef(null);
-  const eventSourceRef = useRef(null);
 
   // Load existing logs
   useEffect(() => {
     api("/logs").then(setLogs).catch(() => {});
   }, []);
 
-  // SSE stream for real-time logs
+  // SSE stream for real-time logs.
+  // Uses fetch() so the passkey travels in the x-passkey header instead of the
+  // query string (EventSource can't set headers, which leaked it into logs).
   useEffect(() => {
-    const passkey = getStoredPasskey();
-    const url = API + "/logs/stream" + (passkey ? "?passkey=" + encodeURIComponent(passkey) : "");
-    const es = new EventSource(url);
-    eventSourceRef.current = es;
+    const controller = new AbortController();
+    let aborted = false;
+    let retryTimer = null;
 
-    es.onopen = () => setConnected(true);
-    es.onmessage = (e) => {
+    async function stream() {
+      const passkey = getStoredPasskey();
       try {
-        const entry = JSON.parse(e.data);
-        setLogs((prev) => {
-          const next = [...prev, entry];
-          return next.length > 500 ? next.slice(-500) : next;
+        const res = await fetch(API + "/logs/stream", {
+          headers: passkey ? { "x-passkey": passkey } : {},
+          signal: controller.signal,
         });
-      } catch {}
-    };
-    es.onerror = () => setConnected(false);
+        if (!res.ok || !res.body) throw new Error("stream failed");
+        setConnected(true);
+        const reader = res.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = "";
+        while (true) {
+          const { value, done } = await reader.read();
+          if (done) break;
+          buffer += decoder.decode(value, { stream: true });
+          let idx;
+          while ((idx = buffer.indexOf("\n")) !== -1) {
+            const line = buffer.slice(0, idx);
+            buffer = buffer.slice(idx + 1);
+            if (!line.startsWith("data: ")) continue;
+            try {
+              const entry = JSON.parse(line.slice(6));
+              setLogs((prev) => {
+                const next = [...prev, entry];
+                return next.length > 500 ? next.slice(-500) : next;
+              });
+            } catch {}
+          }
+        }
+      } catch {
+        // network/parse error — fall through to reconnect below
+      }
+      if (!aborted) {
+        setConnected(false);
+        retryTimer = setTimeout(stream, 2000);
+      }
+    }
 
-    return () => es.close();
+    stream();
+
+    return () => {
+      aborted = true;
+      controller.abort();
+      if (retryTimer) clearTimeout(retryTimer);
+    };
   }, []);
 
   // Auto-scroll to bottom