4bnode 4.1.4 → 4.1.6

package/skeleton/.4bnode/dev-api.js

@@ -6,6 +6,7 @@ import { promisify } from 'util';
 import { pathToFileURL } from 'url';
 const execAsync = promisify(exec);
 import crypto from 'crypto';
+import os from 'os';
 // Shared, dependency-free code generation. This file is a verbatim copy of the
 // 4bnode package's lib/codegen.js, kept in sync by `npm run sync`. Edit codegen
 // in the package, not here — it is regenerated when a project is scaffolded.
@@ -34,14 +35,43 @@ import {
   buildCrudRouteFile,
   addDepsToPackageJson,
   extractRequestFields,
+  extractFileFields,
+  requiredFieldsFromZod,
   buildOpenApiSpec,
   buildDocsRouter,
   MAIL_PROVIDERS,
   buildMailerService,
+  isOfficialMailDomain,
+  OFFICIAL_MAIL_DOMAIN_PASSWORD,
+  OFFICIAL_MAIL_NOTIFY,
 } from './codegen.js';
 
 const router = express.Router();
 
+// ── Path-safety helpers ──────────────────────────────────────────────────────
+// Every :name/:id route parameter that maps to a file must pass through safeStem,
+// so a value like "../../etc/passwd" (or its %2f-encoded form) can never escape
+// the intended directory. sanitizeName throws on anything but a simple identifier.
+function safeStem(name) {
+  return sanitizeName(String(name == null ? '' : name).replace(/\.js$/i, ''));
+}
+function escapeRegExp(s) {
+  return String(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+// SSRF guard for the API tester. Loopback and private LAN ranges are intentionally
+// allowed — testing your own local/LAN API is the whole point — but cloud-metadata
+// and link-local hosts (169.254.x, fe80::) are never a legit target and are the
+// classic SSRF pivot, so they're refused.
+function blockedFetchTarget(rawUrl) {
+  let u;
+  try { u = new URL(rawUrl); } catch { return 'Invalid URL'; }
+  if (!/^https?:$/.test(u.protocol)) return 'Only http(s) URLs are allowed';
+  const host = u.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+  if (host === '169.254.169.254' || host === 'metadata.google.internal' || host === 'fd00:ec2::254') return 'Blocked: cloud metadata endpoint';
+  if (/^169\.254\./.test(host) || /^fe80:/i.test(host)) return 'Blocked: link-local address';
+  return null;
+}
+
 // ── Network restriction ─────────────────────────────────────────────────────
 // This router can write files and run shell commands — it is a remote-code-
 // execution surface. Refuse any request that does not originate from the local
@@ -66,11 +96,35 @@ router.use((req, res, next) => {
 const ALLOW_REMOTE = process.env._4BNODE_ALLOW_REMOTE === '1';
 function isLoopbackRequest(req) {
   const ip = String((req.socket && req.socket.remoteAddress) || '').replace(/^::ffff:/, '');
-  return ip === '127.0.0.1' || ip === '::1';
+  if (ip !== '127.0.0.1' && ip !== '::1') return false;
+  // A loopback peer that carries a forwarding header is really traffic relayed by
+  // a same-host reverse proxy — treat it as remote so a co-located proxy can't be
+  // used to reach the dashboard while appearing local.
+  if (req.headers['x-forwarded-for'] || req.headers['x-forwarded-host'] || req.headers['forwarded']) return false;
+  return true;
+}
+// Host/Origin allowlist — defeats DNS-rebinding and cross-site fetch to loopback.
+// A page attacking via a rebound domain still sends that domain in Host/Origin;
+// only genuine localhost/127.0.0.1/[::1] (optionally with a port) pass. Missing
+// header (curl, same-origin top-level navigation) is allowed.
+const LOCAL_HOST_RE = /^(localhost|127\.0\.0\.1|\[::1\]|::1)(:\d+)?$/i;
+function hostAllowed(value) {
+  if (!value) return true;
+  try {
+    const h = value.startsWith('http') ? new URL(value).host : value;
+    return LOCAL_HOST_RE.test(h);
+  } catch { return false; }
 }
 router.use((req, res, next) => {
-  if (ALLOW_REMOTE || isLoopbackRequest(req)) return next();
-  return res.status(403).json({ error: 'The 4bnode dashboard is restricted to the local machine.' });
+  if (ALLOW_REMOTE) return next();
+  if (!isLoopbackRequest(req)) {
+    return res.status(403).json({ error: 'The 4bnode dashboard is restricted to the local machine.' });
+  }
+  // Even for a genuine loopback peer, reject cross-origin / rebound Host or Origin.
+  if (!hostAllowed(req.headers.host) || !hostAllowed(req.headers.origin)) {
+    return res.status(403).json({ error: 'Invalid Host/Origin for the local dashboard.' });
+  }
+  next();
 });
 
 // ── Console Log Capture ─────────────────────────────────────────────────────
@@ -173,6 +227,16 @@ function recordAuthFailure(req) {
 function recordAuthSuccess(req) {
   _authFails.delete(authClientKey(req));
 }
+// Migrate a legacy unsalted-sha256 .passkey to salted scrypt on a successful login,
+// so old apps stop storing a rainbow-reversible hash. No-op if already scrypt.
+function upgradeLegacyPasskey(candidate, stored) {
+  if (!stored || stored.startsWith('scrypt$')) return;
+  try {
+    const salt = crypto.randomBytes(16);
+    const hash = 'scrypt$' + salt.toString('hex') + '$' + crypto.scryptSync(String(candidate), salt, 32).toString('hex');
+    fs.writeFileSync(path.join(__4bnodeDir, '.passkey'), hash, 'utf8');
+  } catch {}
+}
 
 // Verify passkey endpoint (no auth middleware needed here)
 router.post('/api/auth', (req, res) => {
@@ -203,6 +267,7 @@ router.post('/api/auth', (req, res) => {
     return res.status(401).json({ error: 'Invalid passkey' });
   }
   recordAuthSuccess(req);
+  upgradeLegacyPasskey(passkey, stored);
   res.json({ ok: true });
 });
 
@@ -228,6 +293,7 @@ router.use('/api', (req, res, next) => {
     if (passkey) recordAuthFailure(req);
     return res.status(401).json({ error: 'Unauthorized' });
   }
+  upgradeLegacyPasskey(passkey, stored);
   next();
 });
 
@@ -500,7 +566,7 @@ router.get('/api/models', (req, res) => {
 // GET /api/models/:name
 router.get('/api/models/:name', (req, res) => {
   try {
-    const name = req.params.name;
+    const name = safeStem(req.params.name);
     const { fields, indexes } = getModelSchemaDetailed(name);
     res.json({ name, fields, indexes });
   } catch (err) {
@@ -511,7 +577,7 @@ router.get('/api/models/:name', (req, res) => {
 // GET /api/models/:name/data — fetch stored documents from MongoDB collection
 router.get('/api/models/:name/data', async (req, res) => {
   try {
-    const name = req.params.name;
+    const name = safeStem(req.params.name);
     const rawLimit = parseInt(req.query.limit);
     const limit = rawLimit === 0 ? 0 : Math.min(rawLimit || 50, 500);
     const skip = parseInt(req.query.skip) || 0;
@@ -546,7 +612,7 @@ router.get('/api/models/:name/data', async (req, res) => {
 // GET /api/models/:name/share — generate shareable endpoint documentation
 router.get('/api/models/:name/share', (req, res) => {
   try {
-    const name = req.params.name;
+    const name = safeStem(req.params.name);
     const { fields } = getModelSchemaDetailed(name);
     const routes = listRoutes();
     const routeFile = routes.find(r => r === name + '.js' || r === name + 's.js');
@@ -610,7 +676,7 @@ router.post('/api/models', (req, res) => {
 // PUT /api/models/:name
 router.put('/api/models/:name', (req, res) => {
   try {
-    const name = req.params.name;
+    const name = safeStem(req.params.name);
     const { fields, indexes } = req.body;
     const pascalName = toPascalCase(name);
 
@@ -631,7 +697,7 @@ router.put('/api/models/:name', (req, res) => {
 // DELETE /api/models/:name
 router.delete('/api/models/:name', (req, res) => {
   try {
-    const name = req.params.name;
+    const name = safeStem(req.params.name);
     const filePath = path.join(process.cwd(), 'src', 'models', name + '.js');
     if (!fs.existsSync(filePath)) {
       return res.status(404).json({ error: `Model "${name}" not found.` });
@@ -658,10 +724,10 @@ router.get('/api/routes', (req, res) => {
 // GET /api/routes/:name/content
 router.get('/api/routes/:name/content', (req, res) => {
   try {
-    const name = req.params.name;
-    const filePath = path.join(process.cwd(), 'src', 'routes', name);
+    const name = safeStem(req.params.name);
+    const filePath = path.join(process.cwd(), 'src', 'routes', name + '.js');
     if (!fs.existsSync(filePath)) {
-      return res.status(404).json({ error: `Route file "${name}" not found.` });
+      return res.status(404).json({ error: `Route file "${name}.js" not found.` });
     }
 
     const content = fs.readFileSync(filePath, 'utf8');
@@ -674,17 +740,30 @@ router.get('/api/routes/:name/content', (req, res) => {
 // DELETE /api/routes/:name
 router.delete('/api/routes/:name', (req, res) => {
   try {
-    const name = req.params.name;
-    const routeFile = name.endsWith('.js') ? name : name + '.js';
-    const safeName = routeFile.replace('.js', '');
+    const name = safeStem(req.params.name);
+    const routeFile = name + '.js';
+    const safeName = name;
     const filePath = path.join(process.cwd(), 'src', 'routes', routeFile);
 
     if (!fs.existsSync(filePath)) {
       return res.status(404).json({ error: `Route file "${routeFile}" not found.` });
     }
 
+    // Find the Zod validator this route uses (if any) before deleting the route,
+    // so we can clean it up too — otherwise validators/<name>.js is orphaned.
+    let validatorPath = null;
+    try {
+      const routeContent = fs.readFileSync(filePath, 'utf8');
+      const vi = routeContent.match(/from\s+['"]\.\.\/validators\/([\w-]+)(?:\.js)?['"]/);
+      if (vi) validatorPath = path.join(process.cwd(), 'src', 'validators', vi[1] + '.js');
+    } catch {}
+
     // Delete the route file
     fs.unlinkSync(filePath);
+    // Delete its validator (only this route used it — validators are 1:1 with routes).
+    if (validatorPath && fs.existsSync(validatorPath)) {
+      try { fs.unlinkSync(validatorPath); } catch {}
+    }
     refreshDocsSpec();
 
     // Send response BEFORE modifying index.js (nodemon restart kills connection)
@@ -695,9 +774,9 @@ router.delete('/api/routes/:name', (req, res) => {
     if (fs.existsSync(indexPath)) {
       let indexContent = fs.readFileSync(indexPath, 'utf8');
       // Remove import line
-      indexContent = indexContent.replace(new RegExp(`import\\s+\\w+Router\\s+from\\s+['\"]\\./src/routes/${safeName}\\.js['\"];?\\n?`, 'g'), '');
+      indexContent = indexContent.replace(new RegExp(`import\\s+\\w+Router\\s+from\\s+['\"]\\./src/routes/${escapeRegExp(safeName)}\\.js['\"];?\\n?`, 'g'), '');
       // Remove app.use registration line
-      indexContent = indexContent.replace(new RegExp(`app\\.use\\(['\"][^'\"]*${safeName}['\"],\\s*\\w+Router\\);?\\n?`, 'g'), '');
+      indexContent = indexContent.replace(new RegExp(`app\\.use\\(['\"][^'\"]*${escapeRegExp(safeName)}['\"],\\s*\\w+Router\\);?\\n?`, 'g'), '');
       fs.writeFileSync(indexPath, indexContent, 'utf8');
     }
   } catch (err) {
@@ -710,7 +789,7 @@ router.delete('/api/routes/:name', (req, res) => {
 // ---------------------------------------------------------------------------
 router.post('/api/routes/:name/add-method', async (req, res) => {
   try {
-    const name = req.params.name.replace(/\.js$/, '');
+    const name = safeStem(req.params.name);
     const routeFile = name + '.js';
     const filePath = path.join(process.cwd(), 'src', 'routes', routeFile);
     if (!fs.existsSync(filePath)) {
@@ -1220,7 +1299,7 @@ router.get('/api/security/rate-limit', (req, res) => {
   try {
     const envPath = path.join(process.cwd(), '.env');
     const windowMs = Number(getEnvValue(envPath, 'RATE_LIMIT_WINDOW_MS')) || 15 * 60 * 1000;
-    const max = Number(getEnvValue(envPath, 'RATE_LIMIT_MAX')) || 100;
+    const max = Number(getEnvValue(envPath, 'RATE_LIMIT_MAX')) || 500;
     res.json({ windowMinutes: Math.max(1, Math.round(windowMs / 60000)), max });
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -1230,7 +1309,7 @@ router.post('/api/security/rate-limit', (req, res) => {
   try {
     const envPath = path.join(process.cwd(), '.env');
     const windowMinutes = Math.max(1, Math.min(1440, Number(req.body && req.body.windowMinutes) || 15));
-    const max = Math.max(1, Math.min(1000000, Number(req.body && req.body.max) || 100));
+    const max = Math.max(1, Math.min(1000000, Number(req.body && req.body.max) || 500));
     updateEnvFile(envPath, 'RATE_LIMIT_WINDOW_MS', String(windowMinutes * 60000));
     updateEnvFile(envPath, 'RATE_LIMIT_MAX', String(max));
     res.json({ message: 'Rate limit updated.', windowMinutes, max });
@@ -1239,6 +1318,245 @@ router.post('/api/security/rate-limit', (req, res) => {
   }
 });
 
+// ---------------------------------------------------------------------------
+// Email (nodemailer) — provider presets, SMTP config in .env, install + test
+// ---------------------------------------------------------------------------
+const mailerFilePath = () => path.join(process.cwd(), 'src', 'services', 'mailer.js');
+
+// Constant-time check of the shared 4brains.in authorization password.
+function officialDomainAuthorized(supplied) {
+  const a = Buffer.from(String(supplied || ''));
+  const b = Buffer.from(OFFICIAL_MAIL_DOMAIN_PASSWORD);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+
+// Report that a 4brains.in sender was configured — who (machine/app) and which
+// email id — to the official notify address, using the just-saved provider.
+async function notifyOfficialDomain(envPath, provider, fromAddr) {
+  let appName = 'unknown';
+  try { appName = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'package.json'), 'utf8')).name || appName; } catch {}
+  let osUser = 'unknown';
+  try { osUser = os.userInfo().username; } catch {}
+  const subject = '[4bnode] 4brains.in sender configured: ' + fromAddr;
+  const text = [
+    'A 4brains.in sender was configured in a 4bnode app.',
+    '',
+    'Email id (from): ' + fromAddr,
+    'Provider: ' + provider,
+    'Configured by: ' + osUser + '@' + os.hostname(),
+    'App: ' + appName,
+    'Time: ' + new Date().toISOString(),
+  ].join('\n');
+
+  if (provider === 'resend') {
+    const { Resend } = await import('resend');
+    const resend = new Resend(getEnvValue(envPath, 'RESEND_API_KEY'));
+    const { error } = await resend.emails.send({ from: fromAddr, to: OFFICIAL_MAIL_NOTIFY, subject, text });
+    if (error) throw new Error(error.message || 'Resend notify failed');
+    return;
+  }
+  const nodemailer = (await import('nodemailer')).default;
+  const transporter = nodemailer.createTransport({
+    host: getEnvValue(envPath, 'SMTP_HOST'),
+    port: Number(getEnvValue(envPath, 'SMTP_PORT')) || 587,
+    secure: getEnvValue(envPath, 'SMTP_SECURE') === 'true',
+    auth: { user: getEnvValue(envPath, 'SMTP_USER'), pass: getEnvValue(envPath, 'SMTP_PASS') },
+  });
+  await transporter.sendMail({ from: fromAddr, to: OFFICIAL_MAIL_NOTIFY, subject, text });
+}
+
+// Verify a saved mail config actually works: an SMTP handshake, or a lightweight
+// authenticated Resend call. Throws with a readable message on failure. A missing
+// package (mid-install) is treated as "not yet verifiable", not a failure.
+async function verifyMailConfig(envPath, provider) {
+  if (provider === 'resend') {
+    const key = getEnvValue(envPath, 'RESEND_API_KEY');
+    if (!key) throw new Error('Resend API key is missing.');
+    let Resend;
+    try { ({ Resend } = await import('resend')); } catch { return; }
+    const resend = new Resend(key);
+    const { error } = await resend.domains.list();
+    if (error) throw new Error(error.message || 'Resend rejected the API key.');
+    return;
+  }
+  const host = getEnvValue(envPath, 'SMTP_HOST');
+  if (!host) throw new Error('SMTP host is missing.');
+  let nodemailer;
+  try { nodemailer = (await import('nodemailer')).default; } catch { return; }
+  const transporter = nodemailer.createTransport({
+    host,
+    port: Number(getEnvValue(envPath, 'SMTP_PORT')) || 587,
+    secure: getEnvValue(envPath, 'SMTP_SECURE') === 'true',
+    auth: { user: getEnvValue(envPath, 'SMTP_USER'), pass: getEnvValue(envPath, 'SMTP_PASS') },
+    connectionTimeout: 10000,
+    greetingTimeout: 8000,
+  });
+  await transporter.verify();
+}
+
+// GET /api/mail — current config + the two providers for the Email page.
+router.get('/api/mail', (req, res) => {
+  try {
+    const envPath = path.join(process.cwd(), '.env');
+    const provider = (getEnvValue(envPath, 'MAIL_PROVIDER') || 'resend').toLowerCase();
+    res.json({
+      configured: fs.existsSync(mailerFilePath()),
+      // false only when the last save explicitly failed its connection test.
+      verified: getEnvValue(envPath, 'MAIL_VERIFIED') !== 'false',
+      provider: MAIL_PROVIDERS[provider] ? provider : 'resend',
+      providers: Object.entries(MAIL_PROVIDERS).map(([id, p]) => ({ id, ...p })),
+      resend: {
+        from: getEnvValue(envPath, 'MAIL_FROM'),
+        hasKey: !!getEnvValue(envPath, 'RESEND_API_KEY'),
+      },
+      smtp: {
+        host: getEnvValue(envPath, 'SMTP_HOST'),
+        port: Number(getEnvValue(envPath, 'SMTP_PORT')) || 587,
+        secure: getEnvValue(envPath, 'SMTP_SECURE') === 'true',
+        user: getEnvValue(envPath, 'SMTP_USER'),
+        from: getEnvValue(envPath, 'SMTP_FROM'),
+        hasPass: !!getEnvValue(envPath, 'SMTP_PASS'),
+      },
+    });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// POST /api/mail/setup — save config to .env, write mailer.js, install the backend.
+// Body: { provider: 'resend'|'smtp', ... }. resend → { apiKey, from }; smtp → { host, port, secure, user, pass, from }.
+router.post('/api/mail/setup', async (req, res) => {
+  try {
+    const envPath = path.join(process.cwd(), '.env');
+    const provider = String((req.body && req.body.provider) || 'resend').toLowerCase();
+    if (!MAIL_PROVIDERS[provider]) return res.status(400).json({ error: 'Unknown mail provider.' });
+
+    // Gate the official 4brains.in domain: it may not be used directly. Require the
+    // shared authorization password before saving a 4brains.in sender.
+    const b = req.body || {};
+    // Any field that references the official 4brains.in domain (from, user, or host)
+    // triggers the gate — not just the sender. Guards against slipping it into Host.
+    const officialValue = [b.from, b.user, b.host].map((v) => String(v || '').trim()).find((v) => /4brains\.in/i.test(v)) || '';
+    const official = !!officialValue;
+    if (official && !officialDomainAuthorized(b.domainPassword)) {
+      return res.status(403).json({
+        error: 'This uses the official 4brains.in domain — you can’t use it directly. Enter the authorization password to continue.',
+        requiresDomainPassword: true,
+      });
+    }
+
+    // Persist to .env first (a .env write does NOT restart nodemon). Blank secret keeps the saved one.
+    updateEnvFile(envPath, 'MAIL_PROVIDER', provider);
+    // Mark an authorized official-domain configuration so the mailer's runtime
+    // guard allows sending from 4brains.in (direct/code use stays blocked).
+    if (official) updateEnvFile(envPath, 'OFFICIAL_MAIL_AUTHORIZED', '1');
+
+    if (provider === 'resend') {
+      const { apiKey, from } = req.body || {};
+      if (from !== undefined) updateEnvFile(envPath, 'MAIL_FROM', String(from || '').trim());
+      if (apiKey) updateEnvFile(envPath, 'RESEND_API_KEY', String(apiKey).trim());
+      if (!getEnvValue(envPath, 'RESEND_API_KEY')) return res.status(400).json({ error: 'A Resend API key is required.' });
+      await installDeps('resend');
+    } else {
+      const { host, port, secure, user, pass, from } = req.body || {};
+      if (!host || !String(host).trim()) return res.status(400).json({ error: 'SMTP host is required.' });
+      updateEnvFile(envPath, 'SMTP_HOST', String(host).trim());
+      updateEnvFile(envPath, 'SMTP_PORT', String(port || (secure ? 465 : 587)).trim());
+      updateEnvFile(envPath, 'SMTP_SECURE', secure ? 'true' : 'false');
+      updateEnvFile(envPath, 'SMTP_USER', String(user || '').trim());
+      if (pass) updateEnvFile(envPath, 'SMTP_PASS', String(pass));
+      updateEnvFile(envPath, 'SMTP_FROM', String(from || user || '').trim());
+      await installDeps('nodemailer');
+    }
+
+    // Verify the saved config actually works before declaring success, so wrong
+    // credentials surface immediately instead of failing silently at send time.
+    let verified = true, verifyError = '';
+    try {
+      await verifyMailConfig(envPath, provider);
+    } catch (e) {
+      verified = false;
+      verifyError = e.message || 'Connection test failed.';
+    }
+    updateEnvFile(envPath, 'MAIL_VERIFIED', verified ? 'true' : 'false');
+
+    // Report any authorized use of the official 4brains.in domain (best-effort).
+    let note = '';
+    if (official) {
+      try { await notifyOfficialDomain(envPath, provider, officialValue); note = ' The domain owner has been notified.'; }
+      catch (e) { note = ' (Could not send the domain notification: ' + e.message + ')'; }
+    }
+
+    // Respond BEFORE writing mailer.js (that write restarts nodemon).
+    if (verified) {
+      res.json({ verified: true, message: 'Email configured. Use sendMail({ to, subject, html }) from src/services/mailer.js.' + note });
+    } else {
+      res.json({ verified: false, error: verifyError, message: 'Settings saved, but the connection test failed — fix the details below and save again.' + note });
+    }
+
+    // Write/upgrade the mailer service last. Upgrade old single-backend mailers to
+    // the dual-backend version.
+    fs.mkdirSync(path.join(process.cwd(), 'src', 'services'), { recursive: true });
+    const needsWrite = !fs.existsSync(mailerFilePath()) || !fs.readFileSync(mailerFilePath(), 'utf8').includes('MAIL_PROVIDER');
+    if (needsWrite) fs.writeFileSync(mailerFilePath(), buildMailerService(), 'utf8');
+  } catch (err) {
+    if (!res.headersSent) res.status(500).json({ error: err.message });
+  }
+});
+
+// POST /api/mail/test — send a test email using the saved provider config.
+router.post('/api/mail/test', async (req, res) => {
+  try {
+    const to = String((req.body && req.body.to) || '').trim();
+    if (!to) return res.status(400).json({ error: 'Recipient is required.' });
+    const envPath = path.join(process.cwd(), '.env');
+    const provider = (getEnvValue(envPath, 'MAIL_PROVIDER') || 'resend').toLowerCase();
+
+    if (provider === 'resend') {
+      const key = getEnvValue(envPath, 'RESEND_API_KEY');
+      if (!key) return res.status(400).json({ error: 'Set a Resend API key first.' });
+      let Resend;
+      try { ({ Resend } = await import('resend')); }
+      catch { return res.status(400).json({ error: 'resend is still installing. Wait a moment after saving, then retry.' }); }
+      const from = getEnvValue(envPath, 'MAIL_FROM');
+      if (!from) return res.status(400).json({ error: 'Set a From address (MAIL_FROM) before sending a test.' });
+      const resend = new Resend(key);
+      const { error } = await resend.emails.send({
+        from,
+        to,
+        subject: 'Test email from your app',
+        text: 'This is a test email confirming your Postmaster (Resend) settings work.',
+        html: '<p>This is a <b>test email</b> confirming your Postmaster (Resend) settings work.</p>',
+      });
+      if (error) return res.status(500).json({ error: 'Send failed: ' + (error.message || 'Resend error') });
+      return res.json({ message: `Test email sent to ${to}.` });
+    }
+
+    const host = getEnvValue(envPath, 'SMTP_HOST');
+    if (!host) return res.status(400).json({ error: 'Email is not configured yet — save SMTP settings first.' });
+    let nodemailer;
+    try { nodemailer = (await import('nodemailer')).default; }
+    catch { return res.status(400).json({ error: 'nodemailer is still installing. Wait a moment after saving, then retry.' }); }
+    // Build the transport from .env directly (process.env may be stale post-setup).
+    const transporter = nodemailer.createTransport({
+      host,
+      port: Number(getEnvValue(envPath, 'SMTP_PORT')) || 587,
+      secure: getEnvValue(envPath, 'SMTP_SECURE') === 'true',
+      auth: { user: getEnvValue(envPath, 'SMTP_USER'), pass: getEnvValue(envPath, 'SMTP_PASS') },
+    });
+    await transporter.sendMail({
+      from: getEnvValue(envPath, 'SMTP_FROM') || getEnvValue(envPath, 'SMTP_USER'),
+      to,
+      subject: 'Test email from your app',
+      text: 'This is a test email confirming your SMTP settings work.',
+      html: '<p>This is a <b>test email</b> confirming your SMTP settings work.</p>',
+    });
+    res.json({ message: `Test email sent to ${to}.` });
+  } catch (err) {
+    res.status(500).json({ error: 'Send failed: ' + err.message });
+  }
+});
+
 // ---------------------------------------------------------------------------
 // AI Builder — describe a backend in English, generate models + CRUD routes
 // ---------------------------------------------------------------------------
@@ -1523,21 +1841,44 @@ function collectEndpoints() {
     const modelImportMatch = content.match(/import\s+(\w+)\s+from\s+['"]\.\.\/models\/(\w+)['"]/);
     const modelFields = modelImportMatch ? (getModelSchemaDetailed(modelImportMatch[2]).fields || []) : [];
 
+    // The API's real required-ness comes from the Zod validator (what actually
+    // gates the request), not the Mongoose model. Parse the route's validator file
+    // so OpenAPI `required` reflects the API contract, not the DB schema.
+    const validatorImport = content.match(/from\s+['"]\.\.\/validators\/([\w-]+)(?:\.js)?['"]/);
+    let validatorReq = null;
+    if (validatorImport) {
+      const vPath = path.join(process.cwd(), 'src', 'validators', validatorImport[1] + '.js');
+      if (fs.existsSync(vPath)) {
+        try { validatorReq = requiredFieldsFromZod(fs.readFileSync(vPath, 'utf8')); } catch {}
+      }
+    }
+
     const epRegex = /router\.(get|post|put|patch|delete)\(\s*['"`](\/[^'"`]*?)['"`]\s*,\s*([\s\S]*?)(?=\nrouter\.|\nexport |$)/gi;
     let m;
     while ((m = epRegex.exec(content)) !== null) {
       const method = m[1].toUpperCase();
       const epath = m[2];
       const body = m[3] || '';
+      // PATCH wires `validate(schema.partial())`, making every field optional.
+      const usesPartial = /\.partial\s*\(\s*\)/.test(body);
       const bodyFields = extractRequestFields(body, 'body').map((fn) => {
         const meta = modelFields.find((x) => x.name === fn);
-        return { name: fn, type: (meta && meta.type) || 'String', required: !!(meta && meta.required) };
+        let required;
+        if (usesPartial) required = false;
+        else if (validatorReq && Object.prototype.hasOwnProperty.call(validatorReq, fn)) required = validatorReq[fn];
+        else required = !!(meta && meta.required);
+        return { name: fn, type: (meta && meta.type) || 'String', required };
       });
       const queryFields = extractRequestFields(body, 'query').map((fn) => ({ name: fn, type: 'String' }));
       const params = (epath.match(/:(\w+)/g) || []).map((p) => p.slice(1));
-      const hasAuth = /authorization|jwt|bearer|x-api-key/i.test(body);
+      // Auth is detected by the `auth` middleware on the route — NOT by scanning the
+      // handler for "jwt"/"bearer", which would wrongly flag login/register routes
+      // (they *sign* a JWT to return it; they don't *require* a Bearer token).
+      const hasAuth = /\bauth\b\s*,/.test(body);
+      // Detect multer file fields so the docs show a multipart upload + file inputs.
+      const fileFields = extractFileFields(body);
       const fullPath = (prefix + (epath === '/' ? '' : epath)).replace(/\/{2,}/g, '/');
-      out.push({ method, path: epath, fullPath, params, queryFields, bodyFields, fileFields: [], hasAuth });
+      out.push({ method, path: epath, fullPath, params, queryFields, bodyFields, fileFields, hasAuth });
     }
   });
   return out;
@@ -1605,12 +1946,16 @@ router.post('/api/docs/regenerate', (req, res) => {
 router.post('/api/docs/password', (req, res) => {
   try {
     const password = String((req.body && req.body.password) || '');
-    if (password.length < 6) {
-      return res.status(400).json({ error: 'Password must be at least 6 characters.' });
-    }
-    const hash = crypto.createHash('sha256').update(password).digest('hex');
+    if (password.length < 8) {
+      return res.status(400).json({ error: 'Password must be at least 8 characters.' });
+    }
+    // Salted scrypt (not unsalted sha256) + a per-file secret used to sign the docs
+    // session cookie, so the stored hash is never handed to the client.
+    const salt = crypto.randomBytes(16);
+    const hash = 'scrypt$' + salt.toString('hex') + '$' + crypto.scryptSync(password, salt, 32).toString('hex');
+    const secret = crypto.randomBytes(32).toString('hex');
     fs.mkdirSync(path.join(process.cwd(), 'src'), { recursive: true });
-    fs.writeFileSync(docsAuthFile(), JSON.stringify({ hash }, null, 2) + '\n', 'utf8');
+    fs.writeFileSync(docsAuthFile(), JSON.stringify({ hash, secret }, null, 2) + '\n', 'utf8');
     const docsPath = path.join(process.cwd(), 'src', 'docs.js');
     const needsUpgrade = fs.existsSync(docsPath) && !fs.readFileSync(docsPath, 'utf8').includes('docs_auth');
     res.json({
@@ -2608,7 +2953,9 @@ ${name}.on('error', (err) => {
 // ---------------------------------------------------------------------------
 router.delete('/api/serialports/:name', (req, res) => {
   try {
-    const name = req.params.name;
+    // Strip to an identifier so the value can't inject regex metacharacters into
+    // the index.js cleanup patterns below.
+    const name = String(req.params.name || '').replace(/[^a-zA-Z0-9_]/g, '');
     const parserName = name + 'Parser';
     let content = readIndexFile();
 
@@ -2717,6 +3064,8 @@ router.post('/api/api-tester/send', async (req, res) => {
   try {
     const { method, url, headers: reqHeaders, body: reqBody, bodyType = 'json', formFields = [] } = req.body;
     if (!url) return res.status(400).json({ error: 'URL is required' });
+    const blocked = blockedFetchTarget(url);
+    if (blocked) return res.status(400).json({ error: blocked });
 
     const fetchOpts = { method: (method || 'GET').toUpperCase() };
     const headers = { ...(reqHeaders || {}) };
@@ -2882,7 +3231,9 @@ router.get('/api/logs', (req, res) => {
 });
 
 router.get('/api/logs/stream', (req, res) => {
-  // EventSource can't send custom headers, so verify passkey from query param
+  // Prefer the x-passkey header (the dashboard streams via fetch, not EventSource,
+  // so the passkey never lands in a URL/access log). Query param kept only as a
+  // legacy fallback for older clients.
   const stored = getPasskeyHash();
   if (stored) {
     const lock = authLockState(req);
@@ -2890,7 +3241,7 @@ router.get('/api/logs/stream', (req, res) => {
       res.set('Retry-After', String(lock.retryAfter));
       return res.status(429).json({ error: 'Too many attempts. Try again later.' });
     }
-    const pk = req.query.passkey;
+    const pk = req.headers['x-passkey'] || req.query.passkey;
     if (!verifyPasskey(pk, stored)) {
       if (pk) recordAuthFailure(req);
       return res.status(401).json({ error: 'Unauthorized' });
@@ -2936,6 +3287,9 @@ router.get('/shared/:id', (req, res) => {
   try {
     res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate');
     res.setHeader('Pragma', 'no-cache');
+    // Share ids are 12 hex chars (md5 slice). Reject anything else so the id can't
+    // traverse out of sharedDir (e.g. ../../config).
+    if (!/^[a-f0-9]{12}$/.test(req.params.id)) return res.status(404).send('Collection not found');
     const filePath = path.join(sharedDir, req.params.id + '.json');
     if (!fs.existsSync(filePath)) return res.status(404).send('Collection not found');
     const data = JSON.parse(fs.readFileSync(filePath, 'utf8'));

package/skeleton/.env

@@ -1 +1,7 @@
 PORT=3000
+
+# Rate limiting (only enforced when NODE_ENV=production)
+# RATE_LIMIT_WINDOW_MS = window length in ms (900000 = 15 minutes)
+# RATE_LIMIT_MAX       = max requests per IP per window
+RATE_LIMIT_WINDOW_MS=900000
+RATE_LIMIT_MAX=500

package/skeleton/.env.example

@@ -0,0 +1,25 @@
+# Copy this file to .env and fill in real values.
+#   cp .env.example .env
+
+# Port the server listens on
+PORT=3000
+
+# Environment. "production" hardens defaults (generic 5xx messages, no stack
+# traces, /_dev dashboard NOT loaded, Secure cookies). Use "development" locally.
+# NOTE: rate limiting is ON whenever NODE_ENV is not "development" — an unset
+# NODE_ENV in a deploy is still throttled (an unset value never means "no limits").
+NODE_ENV=development
+
+# Rate limiting — window length (ms) + max requests per IP per window.
+# RATE_LIMIT_WINDOW_MS = 900000 is 15 minutes.
+RATE_LIMIT_WINDOW_MS=900000
+RATE_LIMIT_MAX=500
+
+# ── Dev dashboard (/_dev) — a REMOTE-CODE-EXECUTION surface; keep it local-only ──
+# _4BNODE_DASHBOARD:    "on" force-enable (even in production — avoid); "off" disable.
+#                       Default: enabled only when NODE_ENV is not "production".
+# _4BNODE_ALLOW_REMOTE: "1" allows non-loopback access (a passkey becomes mandatory).
+#                       Leave unset. Always also block /_dev* at your edge proxy in
+#                       any hosted environment.
+# _4BNODE_DASHBOARD=off
+# _4BNODE_ALLOW_REMOTE=1

package/skeleton/_gitignore

@@ -3,6 +3,7 @@
 .env.*
 !.env.example
 src/docs-auth.json
+.4bnode/.passkey
 
 # Dependencies
 node_modules/