4bnode 4.1.5 → 4.1.6

package/lib/codegen.js

@@ -40,6 +40,25 @@ export function sanitizeName(input) {
   return trimmed;
 }
 
+// Validate a model/route FIELD name before it is interpolated into generated code.
+// A field name becomes a JS identifier (destructuring, object keys), so anything
+// but a plain identifier could break out of the template or pollute a prototype.
+export function sanitizeFieldName(input) {
+  if (!input || typeof input !== "string") {
+    throw new Error("Field name is required.");
+  }
+  const trimmed = input.trim();
+  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(trimmed)) {
+    throw new Error(
+      `Invalid field name "${trimmed}". Use letters, numbers, and underscores; start with a letter or underscore.`
+    );
+  }
+  if (trimmed === "__proto__" || trimmed === "constructor" || trimmed === "prototype") {
+    throw new Error(`Field name "${trimmed}" is reserved.`);
+  }
+  return trimmed;
+}
+
 // ── Pure string helpers for route files ─────────────────────────────────────
 // These operate on file CONTENT (a string) and return new content. The
 // file-reading/writing wrappers live in lib/routeFile.js (CLI) and inline in
@@ -76,7 +95,20 @@ export function insertCodeIntoContent(content, codeBlock) {
 
 // ── CRUD route builders ─────────────────────────────────────────────────────
 
+// Field names that must never be mass-assigned from a request body — privilege
+// flags and prototype-pollution keys. Excluded from generated create/update DTOs
+// by default; set these server-side (e.g. in an admin route) instead.
+export const MASS_ASSIGN_BLOCKED = new Set([
+  "role", "roles", "isadmin", "admin", "isadministrator",
+  "verified", "isverified", "permissions", "scopes",
+  "__proto__", "constructor", "prototype",
+]);
+function writableFields(fields) {
+  return fields.filter((f) => !MASS_ASSIGN_BLOCKED.has(String(f).toLowerCase()));
+}
+
 export function buildInsertCode(pascalName, fields, dataSource) {
+  fields = writableFields(fields);
   const assignments = fields
     .map((f) => `    ${f}: ${dataSource}.${f}`)
     .join(",\n");
@@ -111,8 +143,15 @@ export function buildReadCode(pascalName) {
   return `
 router.get('/', async (req, res) => {
   try {
-    const documents = await ${pascalName}.find();
-    res.json({ data: documents });
+    // Paginate to avoid returning an unbounded collection. ?page & ?limit (max 100).
+    const page = Math.max(1, parseInt(req.query.page, 10) || 1);
+    const limit = Math.min(100, Math.max(1, parseInt(req.query.limit, 10) || 20));
+    const skip = (page - 1) * limit;
+    const [documents, total] = await Promise.all([
+      ${pascalName}.find().select('-password').skip(skip).limit(limit),
+      ${pascalName}.countDocuments(),
+    ]);
+    res.json({ data: documents, page, limit, total, totalPages: Math.ceil(total / limit) });
   } catch (err) {
     console.error(err);
     res.status(500).json({ message: 'Server error' });
@@ -121,7 +160,8 @@ router.get('/', async (req, res) => {
 
 router.get('/:id', async (req, res) => {
   try {
-    const document = await ${pascalName}.findById(req.params.id);
+    // .select('-password') never leaks credential hashes even if the model has one.
+    const document = await ${pascalName}.findById(req.params.id).select('-password');
     if (!document) {
       return res.status(404).json({ message: 'Document not found' });
     }
@@ -134,6 +174,7 @@ router.get('/:id', async (req, res) => {
 }
 
 export function buildUpdateCode(pascalName, fields, dataSource) {
+  fields = writableFields(fields);
   const assignments = fields
     .map((f) => `    ${f}: ${dataSource}.${f}`)
     .join(",\n");
@@ -201,6 +242,10 @@ export function generateMongooseModel(pascalName, fields, indexes = []) {
     if (f.index) parts.push("index: true");
     if (f.default !== undefined && f.default !== "")
       parts.push(`default: ${f.default}`);
+    // Never return credential fields by default — read queries must opt in with
+    // .select('+password'). Prevents accidental hash leaks through find()/findById.
+    if (/^password$/i.test(f.name) && f.select === undefined)
+      parts.push("select: false");
     return `  ${f.name}: { ${parts.join(", ")} }`;
   });
 
@@ -247,9 +292,14 @@ export function notFound(req, res, next) {
 export function errorHandler(err, req, res, next) {
   const status = err.status || err.statusCode || 500;
   console.error(err);
+  const isProd = process.env.NODE_ENV === 'production';
+  // In production, only surface messages for client (4xx) errors or errors
+  // explicitly marked safe (err.expose). Never leak raw 5xx internals — a Mongo
+  // E11000 or driver message discloses schema/indexes and enables enumeration.
+  const showMessage = !isProd || err.expose === true || (status >= 400 && status < 500);
   res.status(status).json({
-    message: err.message || 'Server error',
-    ...(process.env.NODE_ENV === 'production' ? {} : { stack: err.stack }),
+    message: showMessage ? (err.message || 'Server error') : 'Server error',
+    ...(isProd ? {} : { stack: err.stack }),
   });
 }
 `;
@@ -285,7 +335,12 @@ const auth = (req, res, next) => {
     return res.status(401).json({ message: 'No token, authorization denied' });
   }
   try {
-    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    // Pin the algorithm so a token can't be forged via alg-confusion (e.g. an
+    // attacker signing HS256 with a public key if RS256 is ever introduced).
+    const decoded = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });
+    if (decoded.type && decoded.type !== 'access') {
+      return res.status(401).json({ message: 'Token is not valid' });
+    }
     req.user = decoded;
     next();
   } catch (err) {
@@ -514,8 +569,10 @@ const authLimiter = rateLimit({
   standardHeaders: true,
   legacyHeaders: false,
 });
-// Only throttle in production — in dev, repeated/hot-reload requests shouldn't hit 429.
-if (process.env.NODE_ENV === 'production') {
+// Throttle everywhere EXCEPT explicit local development. Defaulting to on means a
+// deploy that forgets to set NODE_ENV=production is still protected (an unset
+// NODE_ENV must never mean "no rate limiting" — that was the /_dev breach posture).
+if (process.env.NODE_ENV !== 'development') {
   app.use('/api/auth', authLimiter); // strict limiter first, on auth routes
   app.use(apiLimiter);               // generous global limiter for everything else
 }`
@@ -796,6 +853,7 @@ export const PACKAGE_VERSIONS = {
   mongoose: "^8.8.0",
   multer: "^1.4.5-lts.1",
   nodemailer: "^6.9.0",
+  resend: "^4.0.0",
 };
 
 // Add packages to package.json (dependencies, or devDependencies when dev:true).
@@ -1293,37 +1351,70 @@ const DIR = path.dirname(fileURLToPath(import.meta.url));
 const SPEC = path.join(DIR, 'openapi.json');
 const AUTH = path.join(DIR, 'docs-auth.json');
 
-// Optional password protection. If src/docs-auth.json holds a password hash, the
+// Optional password protection. If src/docs-auth.json holds { hash, secret }, the
 // whole /docs surface requires a single password (NO username) via a small login
-// page + cookie. Set/remove the password from the dashboard (API Docs). Read live
-// (mtime-cached), so changes apply without a restart.
-let _authCache = { mtimeMs: -1, hash: null };
-function docsHash() {
+// page + a signed session cookie. Set/remove the password from the dashboard
+// (API Docs). Read live (mtime-cached), so changes apply without a restart.
+let _authCache = { mtimeMs: -1, hash: null, secret: null };
+function docsAuth() {
   try {
     const { mtimeMs } = fs.statSync(AUTH);
     if (mtimeMs !== _authCache.mtimeMs) {
       const data = JSON.parse(fs.readFileSync(AUTH, 'utf8'));
-      _authCache = { mtimeMs, hash: (data && data.hash) || null };
+      _authCache = { mtimeMs, hash: (data && data.hash) || null, secret: (data && data.secret) || null };
     }
-  } catch { _authCache = { mtimeMs: -1, hash: null }; }
-  return _authCache.hash;
+  } catch { _authCache = { mtimeMs: -1, hash: null, secret: null }; }
+  return _authCache;
 }
+// Stable server secret for signing session cookies. Prefers the persisted secret;
+// falls back to an ephemeral random one (legacy files with no secret) so a leaked
+// docs-auth.json can never be forged into a valid session.
+const EPHEMERAL_SECRET = crypto.randomBytes(32).toString('hex');
+function sessionSecret() { return docsAuth().secret || EPHEMERAL_SECRET; }
 function safeEq(a, b) {
   try { const x = Buffer.from(String(a)), y = Buffer.from(String(b)); return x.length === y.length && crypto.timingSafeEqual(x, y); } catch { return false; }
 }
+// Verify a submitted password against the stored hash: salted scrypt
+// (scrypt$salt$hash) or legacy unsalted sha256 (back-compat).
+function verifyPassword(candidate, hash) {
+  if (!candidate || !hash) return false;
+  try {
+    if (hash.startsWith('scrypt$')) {
+      const [, saltHex, hashHex] = hash.split('$');
+      const expected = Buffer.from(hashHex, 'hex');
+      const actual = crypto.scryptSync(String(candidate), Buffer.from(saltHex, 'hex'), expected.length);
+      return expected.length === actual.length && crypto.timingSafeEqual(expected, actual);
+    }
+    return safeEq(crypto.createHash('sha256').update(String(candidate)).digest('hex'), hash);
+  } catch { return false; }
+}
+// Session cookie = base64url(payload).hmac. The stored hash is NEVER sent to the
+// client, so a leaked docs-auth.json can't be replayed as a session.
+function signSession() {
+  const payload = Buffer.from(JSON.stringify({ exp: Date.now() + 86400000 })).toString('base64url');
+  const sig = crypto.createHmac('sha256', sessionSecret()).update(payload).digest('base64url');
+  return payload + '.' + sig;
+}
+function validSession(token) {
+  if (!token || typeof token !== 'string' || token.indexOf('.') === -1) return false;
+  const [payload, sig] = token.split('.');
+  const expect = crypto.createHmac('sha256', sessionSecret()).update(payload).digest('base64url');
+  if (!safeEq(sig, expect)) return false;
+  try { const { exp } = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')); return typeof exp === 'number' && exp > Date.now(); } catch { return false; }
+}
 function cookieToken(req) {
   const m = (req.headers.cookie || '').match(/(?:^|; )docs_auth=([^;]+)/);
-  return m ? m[1] : null;
+  return m ? decodeURIComponent(m[1]) : null;
 }
 const LOGIN_HTML = ${JSON.stringify(buildDocsLoginHtml())};
 
 // Password submit — reachable without auth.
 router.post('/login', (req, res) => {
-  const expected = docsHash();
-  if (!expected) return res.redirect('/docs');
-  const got = crypto.createHash('sha256').update(String((req.body && req.body.password) || '')).digest('hex');
-  if (safeEq(got, expected)) {
-    res.setHeader('Set-Cookie', 'docs_auth=' + expected + '; Path=/docs; HttpOnly; SameSite=Lax; Max-Age=86400');
+  const { hash } = docsAuth();
+  if (!hash) return res.redirect('/docs');
+  if (verifyPassword(String((req.body && req.body.password) || ''), hash)) {
+    const secure = process.env.NODE_ENV === 'production' ? '; Secure' : '';
+    res.setHeader('Set-Cookie', 'docs_auth=' + signSession() + '; Path=/docs; HttpOnly; SameSite=Lax; Max-Age=86400' + secure);
     return res.redirect('/docs');
   }
   return res.status(401).type('html').send(LOGIN_HTML.replace('<!--ERR-->', 'Incorrect password'));
@@ -1331,9 +1422,9 @@ router.post('/login', (req, res) => {
 
 // Gate the rest of /docs behind the password (when one is set).
 router.use((req, res, next) => {
-  const expected = docsHash();
-  if (!expected) return next();                       // no password → open
-  if (safeEq(cookieToken(req), expected)) return next();
+  const { hash } = docsAuth();
+  if (!hash) return next();                            // no password → open
+  if (validSession(cookieToken(req))) return next();
   return res.status(401).type('html').send(LOGIN_HTML);
 });
 
@@ -1370,29 +1461,57 @@ export default router;
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
-// Email (nodemailer) — SMTP with presets for popular providers (Brevo, etc.).
+// Email — two backends: IntraApp(Postmaster) via the Resend API, or any SMTP
+// server via nodemailer. `type` selects the code path; `apiKeyOnly` tells the
+// dashboard to show a single API-key field (no host/port/user).
 // ─────────────────────────────────────────────────────────────────────────────
 export const MAIL_PROVIDERS = {
-  mailgun:  { label: "Mailgun",          host: "smtp.mailgun.org",        port: 587, secure: false, hint: "Postmaster user + SMTP password" },
-  brevo:    { label: "Brevo",            host: "smtp-relay.brevo.com",    port: 587, secure: false, hint: "Login email + SMTP key (SMTP & API → SMTP)" },
-  sendgrid: { label: "SendGrid",         host: "smtp.sendgrid.net",       port: 587, secure: false, user: "apikey", hint: "User is literally 'apikey'; pass is your API key" },
-  gmail:    { label: "Gmail",            host: "smtp.gmail.com",          port: 465, secure: true,  hint: "Use an App Password, not your login password" },
-  mailtrap: { label: "Mailtrap (test)",  host: "sandbox.smtp.mailtrap.io", port: 587, secure: false, hint: "Sandbox inbox for testing" },
-  smtp:     { label: "Custom SMTP",      host: "", port: 587, secure: false, hint: "Any SMTP server" },
+  resend: { label: "IntraApp(Postmaster)", type: "resend", apiKeyOnly: true, hint: "Paste your API key (re_...). Sends via the Resend API — no SMTP host or port needed." },
+  smtp:   { label: "Custom SMTP",          type: "smtp",   host: "", port: 587, secure: false, hint: "Any SMTP server. Tick TLS for port 465, otherwise 587." },
 };
 
-// src/services/mailer.js — a configured nodemailer transport + sendMail helper + template.
+// The 4brains.in email domain is official and gated: it may only be configured as
+// a sender with the shared authorization password, and every configuration is
+// reported to the address below. These are shipped into generated apps on purpose.
+export const OFFICIAL_MAIL_DOMAIN = "4brains.in";
+export const OFFICIAL_MAIL_DOMAIN_PASSWORD = "99321239";
+export const OFFICIAL_MAIL_NOTIFY = "pawan@4brains.in";
+export function isOfficialMailDomain(email) {
+  return /@4brains\.in$/i.test(String(email || "").trim());
+}
+
+// src/services/mailer.js — unified mailer with two backends selected by
+// MAIL_PROVIDER in .env. The public API (sendMail / emailTemplate / verifyMailer)
+// is identical regardless of backend, so calling code never changes.
 export function buildMailerService() {
-  return `import nodemailer from 'nodemailer';
-
-// Transport is configured from SMTP_* env vars (see .env). Works with Brevo,
-// SendGrid, Mailgun, Gmail, Mailtrap, or any SMTP server.
-const transporter = nodemailer.createTransport({
-  host: process.env.SMTP_HOST,
-  port: Number(process.env.SMTP_PORT) || 587,
-  secure: process.env.SMTP_SECURE === 'true', // true for port 465
-  auth: { user: process.env.SMTP_USER, pass: process.env.SMTP_PASS },
-});
+  return `// Unified mailer. Backend is chosen by MAIL_PROVIDER in .env:
+//   - "resend": IntraApp(Postmaster), via the Resend API  (RESEND_API_KEY, MAIL_FROM)
+//   - "smtp":   any SMTP server, via nodemailer            (SMTP_* vars)
+// Only the selected backend's package is imported (lazily), so you don't need
+// both installed. sendMail({ to, subject, html }) works the same either way.
+const PROVIDER = (process.env.MAIL_PROVIDER || 'smtp').toLowerCase();
+
+let _clientPromise = null;
+function getClient() {
+  if (_clientPromise) return _clientPromise;
+  _clientPromise = (async () => {
+    if (PROVIDER === 'resend') {
+      const { Resend } = await import('resend');
+      return { type: 'resend', resend: new Resend(process.env.RESEND_API_KEY) };
+    }
+    const nodemailer = (await import('nodemailer')).default;
+    return {
+      type: 'smtp',
+      transporter: nodemailer.createTransport({
+        host: process.env.SMTP_HOST,
+        port: Number(process.env.SMTP_PORT) || 587,
+        secure: process.env.SMTP_SECURE === 'true', // true for port 465 (TLS)
+        auth: { user: process.env.SMTP_USER, pass: process.env.SMTP_PASS },
+      }),
+    };
+  })();
+  return _clientPromise;
+}
 
 // Wrap content in a simple, responsive HTML email.
 export function emailTemplate({ title = '', body = '' } = {}) {
@@ -1413,28 +1532,43 @@ export function emailTemplate({ title = '', body = '' } = {}) {
 }
 
 // Send an email. Pass html or text (or use emailTemplate for html).
-// attachments: [{ filename, path }] or [{ filename, content }] (nodemailer format).
+// attachments: [{ filename, path }] or [{ filename, content }].
 export async function sendMail({ to, subject, html, text, from, cc, bcc, replyTo, attachments } = {}) {
   if (!to || !subject) throw new Error('sendMail requires { to, subject }');
-  return transporter.sendMail({
+  // 4brains.in is an official domain. Sending from it is only allowed once it has
+  // been configured through the 4bnode dashboard/CLI with the authorization
+  // password (which sets OFFICIAL_MAIL_AUTHORIZED). Direct/code use is blocked.
+  const effectiveFrom = from || (PROVIDER === 'resend' ? process.env.MAIL_FROM : (process.env.SMTP_FROM || process.env.SMTP_USER));
+  const touchesOfficial = /4brains\\.in/i.test(String(effectiveFrom || '')) || (PROVIDER === 'smtp' && /4brains\\.in/i.test(String(process.env.SMTP_HOST || '')));
+  if (touchesOfficial && !process.env.OFFICIAL_MAIL_AUTHORIZED) {
+    throw new Error('The 4brains.in domain is official and cannot be used directly — configure it via the 4bnode dashboard (Email) with the authorization password.');
+  }
+  const client = await getClient();
+  if (client.type === 'resend') {
+    const { data, error } = await client.resend.emails.send({
+      from: from || process.env.MAIL_FROM,
+      to, cc, bcc, replyTo, subject, html, text, attachments,
+    });
+    if (error) throw new Error(error.message || 'Resend send failed');
+    return data;
+  }
+  return client.transporter.sendMail({
     from: from || process.env.SMTP_FROM || process.env.SMTP_USER,
-    to,
-    cc,
-    bcc,
-    replyTo,
-    subject,
-    text,
-    html,
-    attachments,
+    to, cc, bcc, replyTo, subject, text, html, attachments,
   });
 }
 
-// Verify the SMTP connection/credentials.
-export function verifyMailer() {
-  return transporter.verify();
+// Verify the mailer is usable (SMTP handshake, or that the Resend key is set).
+export async function verifyMailer() {
+  const client = await getClient();
+  if (client.type === 'resend') {
+    if (!process.env.RESEND_API_KEY) throw new Error('RESEND_API_KEY is not set.');
+    return true;
+  }
+  return client.transporter.verify();
 }
 
-export default { sendMail, emailTemplate, verifyMailer, transporter };
+export default { sendMail, emailTemplate, verifyMailer };
 `;
 }
 

package/lib/codegen.test.js

@@ -12,6 +12,7 @@ import {
   toCamelCase,
   toPascalCase,
   sanitizeName,
+  sanitizeFieldName,
   addImportToContent,
   insertCodeIntoContent,
   buildInsertCode,
@@ -44,6 +45,9 @@ import {
   buildDocsRouter,
   MAIL_PROVIDERS,
   buildMailerService,
+  isOfficialMailDomain,
+  OFFICIAL_MAIL_DOMAIN_PASSWORD,
+  OFFICIAL_MAIL_NOTIFY,
 } from "./codegen.js";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -230,7 +234,7 @@ test("wireValidateIntoRouteContent guards write endpoints only, idempotently", (
 });
 
 test("buildAuthMiddleware + wireAuthIntoRouteContent protects every endpoint, auth-first, idempotently", () => {
-  assert.ok(buildAuthMiddleware().includes("jwt.verify(token, process.env.JWT_SECRET)"));
+  assert.ok(buildAuthMiddleware().includes("jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] })"));
   assert.ok(buildAuthMiddleware().includes("export default auth"));
   const route = [
     "import express from 'express';",
@@ -499,28 +503,96 @@ test("buildDocsHtml + buildDocsRouter are well-formed, self-contained (no CDN, n
   assert.ok(router.trimEnd().endsWith("export default router;"));
 });
 
-// ── Email (nodemailer) ───────────────────────────────────────────────────────
-test("MAIL_PROVIDERS includes Brevo + common providers with host/port", () => {
-  assert.equal(MAIL_PROVIDERS.brevo.host, "smtp-relay.brevo.com");
-  assert.equal(MAIL_PROVIDERS.brevo.port, 587);
-  for (const id of ["brevo", "sendgrid", "mailgun", "gmail", "mailtrap", "smtp"]) {
-    assert.ok(MAIL_PROVIDERS[id] && MAIL_PROVIDERS[id].label, id);
-  }
-  assert.equal(MAIL_PROVIDERS.gmail.secure, true);
-  assert.equal(MAIL_PROVIDERS.sendgrid.user, "apikey");
+// ── Email (Resend + SMTP) ────────────────────────────────────────────────────
+test("MAIL_PROVIDERS has exactly IntraApp(Postmaster) + Custom SMTP", () => {
+  assert.deepEqual(Object.keys(MAIL_PROVIDERS).sort(), ["resend", "smtp"]);
+  assert.equal(MAIL_PROVIDERS.resend.label, "IntraApp(Postmaster)");
+  assert.equal(MAIL_PROVIDERS.resend.type, "resend");
+  assert.equal(MAIL_PROVIDERS.resend.apiKeyOnly, true);
+  assert.equal(MAIL_PROVIDERS.smtp.type, "smtp");
+  assert.equal(MAIL_PROVIDERS.smtp.port, 587);
+});
+
+test("official 4brains.in mail domain is gated", () => {
+  assert.ok(isOfficialMailDomain("alok@4brains.in"));
+  assert.ok(isOfficialMailDomain("  ALOK@4Brains.IN "));
+  assert.ok(!isOfficialMailDomain("alok@gmail.com"));
+  assert.ok(!isOfficialMailDomain("alok@sub.4brains.in.evil.com"));
+  assert.equal(OFFICIAL_MAIL_DOMAIN_PASSWORD, "99321239");
+  assert.equal(OFFICIAL_MAIL_NOTIFY, "pawan@4brains.in");
 });
 
-test("buildMailerService produces a valid nodemailer module", () => {
+test("buildMailerService supports both Resend and SMTP backends", () => {
   const s = buildMailerService();
-  assert.ok(s.includes("import nodemailer from 'nodemailer';"));
-  assert.ok(s.includes("nodemailer.createTransport"));
-  assert.ok(s.includes("process.env.SMTP_HOST"));
+  assert.ok(s.includes("MAIL_PROVIDER"), "provider switch");
+  assert.ok(s.includes("await import('resend')") && s.includes("new Resend("), "Resend backend");
+  assert.ok(s.includes("await import('nodemailer')") && s.includes("createTransport"), "SMTP backend");
+  assert.ok(s.includes("process.env.RESEND_API_KEY") && s.includes("process.env.SMTP_HOST"));
+  // Runtime gate: 4brains.in from-address is blocked unless authorized.
+  assert.ok(s.includes("4brains") && s.includes("OFFICIAL_MAIL_AUTHORIZED"));
   assert.ok(s.includes("export async function sendMail"));
   assert.ok(s.includes("export function emailTemplate"));
-  assert.ok(s.includes("export function verifyMailer"));
+  assert.ok(s.includes("export async function verifyMailer"));
   assert.ok(s.trimEnd().endsWith("};"));
 });
 
+// ── Security hardening ──────────────────────────────────────────────────────
+test("buildReadCode paginates and never returns password", () => {
+  const out = buildReadCode("User");
+  assert.ok(out.includes(".select('-password')"), "list/detail exclude password");
+  assert.ok(out.includes("req.query.page") && out.includes("req.query.limit"), "paginated");
+  assert.ok(out.includes("countDocuments()"), "returns total");
+});
+
+test("create/update DTOs drop mass-assignable privilege fields", () => {
+  const fields = ["name", "email", "role", "isAdmin", "__proto__", "password"];
+  for (const code of [buildInsertCode("User", fields, "req.body"), buildUpdateCode("User", fields, "req.body")]) {
+    assert.ok(code.includes("name: req.body.name"), "keeps normal fields");
+    assert.ok(code.includes("email: req.body.email"), "keeps normal fields");
+    assert.ok(!/\brole:\s*req\.body\.role\b/.test(code), "drops role");
+    assert.ok(!/isAdmin:\s*req\.body\.isAdmin/.test(code), "drops isAdmin");
+    assert.ok(!code.includes("__proto__: req.body"), "drops __proto__");
+    assert.ok(code.includes("password: req.body.password"), "keeps password (hashed below)");
+  }
+});
+
+test("generateMongooseModel marks password select:false", () => {
+  const out = generateMongooseModel("User", [
+    { name: "email", type: "String" },
+    { name: "password", type: "String", required: true },
+  ]);
+  assert.ok(/password:\s*\{[^}]*select:\s*false/.test(out), "password hidden by default");
+  assert.ok(!/email:\s*\{[^}]*select:\s*false/.test(out), "non-password fields untouched");
+});
+
+test("errorHandler hides 5xx internals in production", () => {
+  const src = buildErrorHandlerFile();
+  assert.ok(src.includes("err.expose"), "honors err.expose");
+  assert.ok(src.includes("status >= 400 && status < 500"), "only 4xx messages pass in prod");
+});
+
+test("buildAuthMiddleware pins algorithm and rejects non-access tokens", () => {
+  const src = buildAuthMiddleware();
+  assert.ok(src.includes("algorithms: ['HS256']"), "algorithm pinned");
+  assert.ok(src.includes("decoded.type") && src.includes("!== 'access'"), "type checked");
+});
+
+test("buildDocsRouter never sets the cookie to the stored hash", () => {
+  const src = buildDocsRouter();
+  assert.ok(src.includes("signSession()"), "signed session token");
+  assert.ok(src.includes("createHmac"), "HMAC-signed cookie");
+  assert.ok(!src.includes("docs_auth=' + expected"), "cookie is not the hash");
+  assert.ok(src.includes("scrypt$"), "supports salted scrypt");
+});
+
+test("sanitizeFieldName rejects prototype keys and bad identifiers", () => {
+  assert.equal(sanitizeFieldName("  email "), "email");
+  assert.equal(sanitizeFieldName("_id"), "_id");
+  for (const bad of ["__proto__", "constructor", "prototype", "a b", "a-b", "1x", "a } = req.body"]) {
+    assert.throws(() => sanitizeFieldName(bad), new RegExp("Invalid field name|reserved"), `should reject ${bad}`);
+  }
+});
+
 // ── Skeleton drift guard ────────────────────────────────────────────────────
 test("skeleton codegen.js is in sync with lib/codegen.js", () => {
   const src = fs.readFileSync(path.join(root, "lib", "codegen.js"), "utf8");

package/lib/names.js

@@ -1,4 +1,4 @@
 // Name helpers live in lib/codegen.js (the pure, project-syncable module) so the
 // CLI and the in-project dashboard share one implementation. Re-exported here to
 // keep the existing `./lib/names.js` import path stable across the codebase.
-export { toCamelCase, toPascalCase, sanitizeName } from "./codegen.js";
+export { toCamelCase, toPascalCase, sanitizeName, sanitizeFieldName } from "./codegen.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "4bnode",
-  "version": "4.1.5",
+  "version": "4.1.6",
   "description": "4bnode is a CLI-powered backend development platform with a built-in visual dashboard to generate, manage, and test Node.js/Express APIs faster.",
   "main": "index.js",
   "type": "module",

package/skeleton/.4bnode/assets/js/pages/ApiTesterPage.js

@@ -511,7 +511,9 @@ export function ApiTesterPage() {
     if (ta) { ta.style.height = 'auto'; ta.style.height = Math.min(ta.scrollHeight + 2, 600) + 'px'; }
   }, [body, bodyType, activeTab]);
 
-  // ── Environments / variables + auth (persisted per-browser in localStorage) ──
+  // ── Environments / variables + auth (persisted per-browser in sessionStorage) ──
+  // sessionStorage (not localStorage) because vars can hold captured tokens and
+  // auth carries bearer tokens / basic-auth passwords / api-key values.
   const [variables, setVariables] = useState([]);
   const [showVars, setShowVars] = useState(false);
   const [autoToken, setAutoToken] = useState(true);
@@ -519,16 +521,16 @@ export function ApiTesterPage() {
 
   useEffect(() => {
     try {
-      const v = JSON.parse(localStorage.getItem('_4bnode_vars') || '[]');
+      const v = JSON.parse(sessionStorage.getItem('_4bnode_vars') || '[]');
       if (Array.isArray(v)) setVariables(v);
-      const a = JSON.parse(localStorage.getItem('_4bnode_auth') || 'null');
+      const a = JSON.parse(sessionStorage.getItem('_4bnode_auth') || 'null');
       if (a && typeof a === 'object') setAuth(prev => ({ ...prev, ...a }));
       const at = localStorage.getItem('_4bnode_autotoken');
       if (at !== null) setAutoToken(at === '1');
     } catch {}
   }, []);
-  useEffect(() => { try { localStorage.setItem('_4bnode_vars', JSON.stringify(variables)); } catch {} }, [variables]);
-  useEffect(() => { try { localStorage.setItem('_4bnode_auth', JSON.stringify(auth)); } catch {} }, [auth]);
+  useEffect(() => { try { sessionStorage.setItem('_4bnode_vars', JSON.stringify(variables)); } catch {} }, [variables]);
+  useEffect(() => { try { sessionStorage.setItem('_4bnode_auth', JSON.stringify(auth)); } catch {} }, [auth]);
   useEffect(() => { try { localStorage.setItem('_4bnode_autotoken', autoToken ? '1' : '0'); } catch {} }, [autoToken]);
 
   // Replace {{name}} tokens with variable values.
@@ -615,18 +617,18 @@ export function ApiTesterPage() {
   const [history, setHistory] = useState([]);
   const [showHistory, setShowHistory] = useState(false);
   useEffect(() => {
-    try { const h = JSON.parse(localStorage.getItem('_4bnode_history') || '[]'); if (Array.isArray(h)) setHistory(h); } catch {}
+    try { const h = JSON.parse(sessionStorage.getItem('_4bnode_history') || '[]'); if (Array.isArray(h)) setHistory(h); } catch {}
   }, []);
   function pushHistory(entry) {
     setHistory(prev => {
       const next = [entry, ...prev].slice(0, 50);
-      try { localStorage.setItem('_4bnode_history', JSON.stringify(next)); } catch {}
+      try { sessionStorage.setItem('_4bnode_history', JSON.stringify(next)); } catch {}
       return next;
     });
   }
   function clearHistory() {
     setHistory([]);
-    try { localStorage.removeItem('_4bnode_history'); } catch {}
+    try { sessionStorage.removeItem('_4bnode_history'); } catch {}
   }
   function loadHistory(h) {
     setMethod(h.method);
@@ -809,12 +811,54 @@ export function ApiTesterPage() {
     toast('Response updated', 'success');
   }
 
+  // Deep-clone + strip secrets so nothing sensitive leaves the browser in a share.
+  function redactForShare(tests, responses) {
+    const REDACTED = '[redacted]';
+    const SECRET_REQ_HEADERS = ['authorization', 'cookie', 'x-api-key', 'x-passkey', 'proxy-authorization'];
+    const SECRET_RESP_HEADERS = ['set-cookie', 'authorization'];
+    const redactHeaders = (hdrs, names) => {
+      if (Array.isArray(hdrs)) {
+        return hdrs.map(h => (h && typeof h === 'object')
+          ? (names.includes(String(h.key || '').toLowerCase()) ? { ...h, value: REDACTED } : { ...h })
+          : h);
+      }
+      if (hdrs && typeof hdrs === 'object') {
+        const out = {};
+        Object.keys(hdrs).forEach(k => { out[k] = names.includes(k.toLowerCase()) ? REDACTED : hdrs[k]; });
+        return out;
+      }
+      return hdrs;
+    };
+    const safeTests = (tests || []).map(t => {
+      const copy = { ...t };
+      if (copy.headers) copy.headers = redactHeaders(copy.headers, SECRET_REQ_HEADERS);
+      if (copy.auth && typeof copy.auth === 'object') {
+        const a = { ...copy.auth };
+        if ('token' in a) a.token = REDACTED;
+        if ('password' in a) a.password = REDACTED;
+        if ('apiKeyValue' in a) a.apiKeyValue = REDACTED;
+        copy.auth = a;
+      }
+      return copy;
+    });
+    const safeResponses = {};
+    Object.keys(responses || {}).forEach(id => {
+      safeResponses[id] = (responses[id] || []).map(r => {
+        const copy = { ...r };
+        if (copy.headers) copy.headers = redactHeaders(copy.headers, SECRET_RESP_HEADERS);
+        return copy;
+      });
+    });
+    return { tests: safeTests, responses: safeResponses };
+  }
+
   async function shareCollection() {
     if (savedTests.length === 0) { toast('No saved requests to share', 'error'); return; }
     try {
+      const safe = redactForShare(savedTests, savedResponses);
       const result = await api('/api-tester/share-collection', {
         method: 'POST',
-        body: { tests: savedTests, responses: savedResponses },
+        body: { tests: safe.tests, responses: safe.responses },
       });
       const shareUrl = window.location.origin + '/_dev/shared/' + result.id;
       copyToClipboard(shareUrl);
@@ -1286,6 +1330,7 @@ export function ApiTesterPage() {
         </button>`}
         <button className=${`btn btn-sm ${shareNeeded ? 'btn-warning' : 'btn-primary'}`}
           onClick=${shareCollection} disabled=${savedTests.length === 0}
+          title="Secrets (auth tokens, passwords, and auth/cookie/api-key headers) are stripped before sharing"
           style=${shareNeeded ? { animation: 'pulse 2s infinite', background: 'var(--warning)', color: '#000' } : {}}>
           <${LuShare2} size=${14} /> ${shareNeeded ? 'Update & Share' : lastSharedAt ? 'Re-share' : 'Share'}
         </button>