4bnode 4.1.5 → 4.1.7

package/skeleton/.4bnode/codegen.js

@@ -40,6 +40,25 @@ export function sanitizeName(input) {
   return trimmed;
 }
 
+// Validate a model/route FIELD name before it is interpolated into generated code.
+// A field name becomes a JS identifier (destructuring, object keys), so anything
+// but a plain identifier could break out of the template or pollute a prototype.
+export function sanitizeFieldName(input) {
+  if (!input || typeof input !== "string") {
+    throw new Error("Field name is required.");
+  }
+  const trimmed = input.trim();
+  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(trimmed)) {
+    throw new Error(
+      `Invalid field name "${trimmed}". Use letters, numbers, and underscores; start with a letter or underscore.`
+    );
+  }
+  if (trimmed === "__proto__" || trimmed === "constructor" || trimmed === "prototype") {
+    throw new Error(`Field name "${trimmed}" is reserved.`);
+  }
+  return trimmed;
+}
+
 // ── Pure string helpers for route files ─────────────────────────────────────
 // These operate on file CONTENT (a string) and return new content. The
 // file-reading/writing wrappers live in lib/routeFile.js (CLI) and inline in
@@ -76,7 +95,20 @@ export function insertCodeIntoContent(content, codeBlock) {
 
 // ── CRUD route builders ─────────────────────────────────────────────────────
 
+// Field names that must never be mass-assigned from a request body — privilege
+// flags and prototype-pollution keys. Excluded from generated create/update DTOs
+// by default; set these server-side (e.g. in an admin route) instead.
+export const MASS_ASSIGN_BLOCKED = new Set([
+  "role", "roles", "isadmin", "admin", "isadministrator",
+  "verified", "isverified", "permissions", "scopes",
+  "__proto__", "constructor", "prototype",
+]);
+function writableFields(fields) {
+  return fields.filter((f) => !MASS_ASSIGN_BLOCKED.has(String(f).toLowerCase()));
+}
+
 export function buildInsertCode(pascalName, fields, dataSource) {
+  fields = writableFields(fields);
   const assignments = fields
     .map((f) => `    ${f}: ${dataSource}.${f}`)
     .join(",\n");
@@ -111,8 +143,15 @@ export function buildReadCode(pascalName) {
   return `
 router.get('/', async (req, res) => {
   try {
-    const documents = await ${pascalName}.find();
-    res.json({ data: documents });
+    // Paginate to avoid returning an unbounded collection. ?page & ?limit (max 100).
+    const page = Math.max(1, parseInt(req.query.page, 10) || 1);
+    const limit = Math.min(100, Math.max(1, parseInt(req.query.limit, 10) || 20));
+    const skip = (page - 1) * limit;
+    const [documents, total] = await Promise.all([
+      ${pascalName}.find().select('-password').skip(skip).limit(limit),
+      ${pascalName}.countDocuments(),
+    ]);
+    res.json({ data: documents, page, limit, total, totalPages: Math.ceil(total / limit) });
   } catch (err) {
     console.error(err);
     res.status(500).json({ message: 'Server error' });
@@ -121,7 +160,8 @@ router.get('/', async (req, res) => {
 
 router.get('/:id', async (req, res) => {
   try {
-    const document = await ${pascalName}.findById(req.params.id);
+    // .select('-password') never leaks credential hashes even if the model has one.
+    const document = await ${pascalName}.findById(req.params.id).select('-password');
     if (!document) {
       return res.status(404).json({ message: 'Document not found' });
     }
@@ -134,6 +174,7 @@ router.get('/:id', async (req, res) => {
 }
 
 export function buildUpdateCode(pascalName, fields, dataSource) {
+  fields = writableFields(fields);
   const assignments = fields
     .map((f) => `    ${f}: ${dataSource}.${f}`)
     .join(",\n");
@@ -201,6 +242,10 @@ export function generateMongooseModel(pascalName, fields, indexes = []) {
     if (f.index) parts.push("index: true");
     if (f.default !== undefined && f.default !== "")
       parts.push(`default: ${f.default}`);
+    // Never return credential fields by default — read queries must opt in with
+    // .select('+password'). Prevents accidental hash leaks through find()/findById.
+    if (/^password$/i.test(f.name) && f.select === undefined)
+      parts.push("select: false");
     return `  ${f.name}: { ${parts.join(", ")} }`;
   });
 
@@ -247,9 +292,14 @@ export function notFound(req, res, next) {
 export function errorHandler(err, req, res, next) {
   const status = err.status || err.statusCode || 500;
   console.error(err);
+  const isProd = process.env.NODE_ENV === 'production';
+  // In production, only surface messages for client (4xx) errors or errors
+  // explicitly marked safe (err.expose). Never leak raw 5xx internals — a Mongo
+  // E11000 or driver message discloses schema/indexes and enables enumeration.
+  const showMessage = !isProd || err.expose === true || (status >= 400 && status < 500);
   res.status(status).json({
-    message: err.message || 'Server error',
-    ...(process.env.NODE_ENV === 'production' ? {} : { stack: err.stack }),
+    message: showMessage ? (err.message || 'Server error') : 'Server error',
+    ...(isProd ? {} : { stack: err.stack }),
   });
 }
 `;
@@ -285,7 +335,12 @@ const auth = (req, res, next) => {
     return res.status(401).json({ message: 'No token, authorization denied' });
   }
   try {
-    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    // Pin the algorithm so a token can't be forged via alg-confusion (e.g. an
+    // attacker signing HS256 with a public key if RS256 is ever introduced).
+    const decoded = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });
+    if (decoded.type && decoded.type !== 'access') {
+      return res.status(401).json({ message: 'Token is not valid' });
+    }
     req.user = decoded;
     next();
   } catch (err) {
@@ -514,8 +569,10 @@ const authLimiter = rateLimit({
   standardHeaders: true,
   legacyHeaders: false,
 });
-// Only throttle in production — in dev, repeated/hot-reload requests shouldn't hit 429.
-if (process.env.NODE_ENV === 'production') {
+// Throttle everywhere EXCEPT explicit local development. Defaulting to on means a
+// deploy that forgets to set NODE_ENV=production is still protected (an unset
+// NODE_ENV must never mean "no rate limiting" — that was the /_dev breach posture).
+if (process.env.NODE_ENV !== 'development') {
   app.use('/api/auth', authLimiter); // strict limiter first, on auth routes
   app.use(apiLimiter);               // generous global limiter for everything else
 }`
@@ -796,6 +853,7 @@ export const PACKAGE_VERSIONS = {
   mongoose: "^8.8.0",
   multer: "^1.4.5-lts.1",
   nodemailer: "^6.9.0",
+  resend: "^4.0.0",
 };
 
 // Add packages to package.json (dependencies, or devDependencies when dev:true).
@@ -1293,37 +1351,70 @@ const DIR = path.dirname(fileURLToPath(import.meta.url));
 const SPEC = path.join(DIR, 'openapi.json');
 const AUTH = path.join(DIR, 'docs-auth.json');
 
-// Optional password protection. If src/docs-auth.json holds a password hash, the
+// Optional password protection. If src/docs-auth.json holds { hash, secret }, the
 // whole /docs surface requires a single password (NO username) via a small login
-// page + cookie. Set/remove the password from the dashboard (API Docs). Read live
-// (mtime-cached), so changes apply without a restart.
-let _authCache = { mtimeMs: -1, hash: null };
-function docsHash() {
+// page + a signed session cookie. Set/remove the password from the dashboard
+// (API Docs). Read live (mtime-cached), so changes apply without a restart.
+let _authCache = { mtimeMs: -1, hash: null, secret: null };
+function docsAuth() {
   try {
     const { mtimeMs } = fs.statSync(AUTH);
     if (mtimeMs !== _authCache.mtimeMs) {
       const data = JSON.parse(fs.readFileSync(AUTH, 'utf8'));
-      _authCache = { mtimeMs, hash: (data && data.hash) || null };
+      _authCache = { mtimeMs, hash: (data && data.hash) || null, secret: (data && data.secret) || null };
     }
-  } catch { _authCache = { mtimeMs: -1, hash: null }; }
-  return _authCache.hash;
+  } catch { _authCache = { mtimeMs: -1, hash: null, secret: null }; }
+  return _authCache;
 }
+// Stable server secret for signing session cookies. Prefers the persisted secret;
+// falls back to an ephemeral random one (legacy files with no secret) so a leaked
+// docs-auth.json can never be forged into a valid session.
+const EPHEMERAL_SECRET = crypto.randomBytes(32).toString('hex');
+function sessionSecret() { return docsAuth().secret || EPHEMERAL_SECRET; }
 function safeEq(a, b) {
   try { const x = Buffer.from(String(a)), y = Buffer.from(String(b)); return x.length === y.length && crypto.timingSafeEqual(x, y); } catch { return false; }
 }
+// Verify a submitted password against the stored hash: salted scrypt
+// (scrypt$salt$hash) or legacy unsalted sha256 (back-compat).
+function verifyPassword(candidate, hash) {
+  if (!candidate || !hash) return false;
+  try {
+    if (hash.startsWith('scrypt$')) {
+      const [, saltHex, hashHex] = hash.split('$');
+      const expected = Buffer.from(hashHex, 'hex');
+      const actual = crypto.scryptSync(String(candidate), Buffer.from(saltHex, 'hex'), expected.length);
+      return expected.length === actual.length && crypto.timingSafeEqual(expected, actual);
+    }
+    return safeEq(crypto.createHash('sha256').update(String(candidate)).digest('hex'), hash);
+  } catch { return false; }
+}
+// Session cookie = base64url(payload).hmac. The stored hash is NEVER sent to the
+// client, so a leaked docs-auth.json can't be replayed as a session.
+function signSession() {
+  const payload = Buffer.from(JSON.stringify({ exp: Date.now() + 86400000 })).toString('base64url');
+  const sig = crypto.createHmac('sha256', sessionSecret()).update(payload).digest('base64url');
+  return payload + '.' + sig;
+}
+function validSession(token) {
+  if (!token || typeof token !== 'string' || token.indexOf('.') === -1) return false;
+  const [payload, sig] = token.split('.');
+  const expect = crypto.createHmac('sha256', sessionSecret()).update(payload).digest('base64url');
+  if (!safeEq(sig, expect)) return false;
+  try { const { exp } = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')); return typeof exp === 'number' && exp > Date.now(); } catch { return false; }
+}
 function cookieToken(req) {
   const m = (req.headers.cookie || '').match(/(?:^|; )docs_auth=([^;]+)/);
-  return m ? m[1] : null;
+  return m ? decodeURIComponent(m[1]) : null;
 }
 const LOGIN_HTML = ${JSON.stringify(buildDocsLoginHtml())};
 
 // Password submit — reachable without auth.
 router.post('/login', (req, res) => {
-  const expected = docsHash();
-  if (!expected) return res.redirect('/docs');
-  const got = crypto.createHash('sha256').update(String((req.body && req.body.password) || '')).digest('hex');
-  if (safeEq(got, expected)) {
-    res.setHeader('Set-Cookie', 'docs_auth=' + expected + '; Path=/docs; HttpOnly; SameSite=Lax; Max-Age=86400');
+  const { hash } = docsAuth();
+  if (!hash) return res.redirect('/docs');
+  if (verifyPassword(String((req.body && req.body.password) || ''), hash)) {
+    const secure = process.env.NODE_ENV === 'production' ? '; Secure' : '';
+    res.setHeader('Set-Cookie', 'docs_auth=' + signSession() + '; Path=/docs; HttpOnly; SameSite=Lax; Max-Age=86400' + secure);
     return res.redirect('/docs');
   }
   return res.status(401).type('html').send(LOGIN_HTML.replace('<!--ERR-->', 'Incorrect password'));
@@ -1331,9 +1422,9 @@ router.post('/login', (req, res) => {
 
 // Gate the rest of /docs behind the password (when one is set).
 router.use((req, res, next) => {
-  const expected = docsHash();
-  if (!expected) return next();                       // no password → open
-  if (safeEq(cookieToken(req), expected)) return next();
+  const { hash } = docsAuth();
+  if (!hash) return next();                            // no password → open
+  if (validSession(cookieToken(req))) return next();
   return res.status(401).type('html').send(LOGIN_HTML);
 });
 
@@ -1370,29 +1461,57 @@ export default router;
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
-// Email (nodemailer) — SMTP with presets for popular providers (Brevo, etc.).
+// Email — two backends: IntraApp(Postmaster) via the Resend API, or any SMTP
+// server via nodemailer. `type` selects the code path; `apiKeyOnly` tells the
+// dashboard to show a single API-key field (no host/port/user).
 // ─────────────────────────────────────────────────────────────────────────────
 export const MAIL_PROVIDERS = {
-  mailgun:  { label: "Mailgun",          host: "smtp.mailgun.org",        port: 587, secure: false, hint: "Postmaster user + SMTP password" },
-  brevo:    { label: "Brevo",            host: "smtp-relay.brevo.com",    port: 587, secure: false, hint: "Login email + SMTP key (SMTP & API → SMTP)" },
-  sendgrid: { label: "SendGrid",         host: "smtp.sendgrid.net",       port: 587, secure: false, user: "apikey", hint: "User is literally 'apikey'; pass is your API key" },
-  gmail:    { label: "Gmail",            host: "smtp.gmail.com",          port: 465, secure: true,  hint: "Use an App Password, not your login password" },
-  mailtrap: { label: "Mailtrap (test)",  host: "sandbox.smtp.mailtrap.io", port: 587, secure: false, hint: "Sandbox inbox for testing" },
-  smtp:     { label: "Custom SMTP",      host: "", port: 587, secure: false, hint: "Any SMTP server" },
+  resend: { label: "IntraApp(Postmaster)", type: "resend", apiKeyOnly: true, hint: "Paste your API key (re_...). Sends via the Resend API — no SMTP host or port needed." },
+  smtp:   { label: "Custom SMTP",          type: "smtp",   host: "", port: 587, secure: false, hint: "Any SMTP server. Tick TLS for port 465, otherwise 587." },
 };
 
-// src/services/mailer.js — a configured nodemailer transport + sendMail helper + template.
+// The 4brains.in email domain is official and gated: it may only be configured as
+// a sender with the shared authorization password, and every configuration is
+// reported to the address below. These are shipped into generated apps on purpose.
+export const OFFICIAL_MAIL_DOMAIN = "4brains.in";
+export const OFFICIAL_MAIL_DOMAIN_PASSWORD = "99321239";
+export const OFFICIAL_MAIL_NOTIFY = "pawan@4brains.in";
+export function isOfficialMailDomain(email) {
+  return /@4brains\.in$/i.test(String(email || "").trim());
+}
+
+// src/services/mailer.js — unified mailer with two backends selected by
+// MAIL_PROVIDER in .env. The public API (sendMail / emailTemplate / verifyMailer)
+// is identical regardless of backend, so calling code never changes.
 export function buildMailerService() {
-  return `import nodemailer from 'nodemailer';
-
-// Transport is configured from SMTP_* env vars (see .env). Works with Brevo,
-// SendGrid, Mailgun, Gmail, Mailtrap, or any SMTP server.
-const transporter = nodemailer.createTransport({
-  host: process.env.SMTP_HOST,
-  port: Number(process.env.SMTP_PORT) || 587,
-  secure: process.env.SMTP_SECURE === 'true', // true for port 465
-  auth: { user: process.env.SMTP_USER, pass: process.env.SMTP_PASS },
-});
+  return `// Unified mailer. Backend is chosen by MAIL_PROVIDER in .env:
+//   - "resend": IntraApp(Postmaster), via the Resend API  (RESEND_API_KEY, MAIL_FROM)
+//   - "smtp":   any SMTP server, via nodemailer            (SMTP_* vars)
+// Only the selected backend's package is imported (lazily), so you don't need
+// both installed. sendMail({ to, subject, html }) works the same either way.
+const PROVIDER = (process.env.MAIL_PROVIDER || 'smtp').toLowerCase();
+
+let _clientPromise = null;
+function getClient() {
+  if (_clientPromise) return _clientPromise;
+  _clientPromise = (async () => {
+    if (PROVIDER === 'resend') {
+      const { Resend } = await import('resend');
+      return { type: 'resend', resend: new Resend(process.env.RESEND_API_KEY) };
+    }
+    const nodemailer = (await import('nodemailer')).default;
+    return {
+      type: 'smtp',
+      transporter: nodemailer.createTransport({
+        host: process.env.SMTP_HOST,
+        port: Number(process.env.SMTP_PORT) || 587,
+        secure: process.env.SMTP_SECURE === 'true', // true for port 465 (TLS)
+        auth: { user: process.env.SMTP_USER, pass: process.env.SMTP_PASS },
+      }),
+    };
+  })();
+  return _clientPromise;
+}
 
 // Wrap content in a simple, responsive HTML email.
 export function emailTemplate({ title = '', body = '' } = {}) {
@@ -1413,28 +1532,43 @@ export function emailTemplate({ title = '', body = '' } = {}) {
 }
 
 // Send an email. Pass html or text (or use emailTemplate for html).
-// attachments: [{ filename, path }] or [{ filename, content }] (nodemailer format).
+// attachments: [{ filename, path }] or [{ filename, content }].
 export async function sendMail({ to, subject, html, text, from, cc, bcc, replyTo, attachments } = {}) {
   if (!to || !subject) throw new Error('sendMail requires { to, subject }');
-  return transporter.sendMail({
+  // 4brains.in is an official domain. Sending from it is only allowed once it has
+  // been configured through the 4bnode dashboard/CLI with the authorization
+  // password (which sets OFFICIAL_MAIL_AUTHORIZED). Direct/code use is blocked.
+  const effectiveFrom = from || (PROVIDER === 'resend' ? process.env.MAIL_FROM : (process.env.SMTP_FROM || process.env.SMTP_USER));
+  const touchesOfficial = /4brains\\.in/i.test(String(effectiveFrom || '')) || (PROVIDER === 'smtp' && /4brains\\.in/i.test(String(process.env.SMTP_HOST || '')));
+  if (touchesOfficial && !process.env.OFFICIAL_MAIL_AUTHORIZED) {
+    throw new Error('The 4brains.in domain is official and cannot be used directly — configure it via the 4bnode dashboard (Email) with the authorization password.');
+  }
+  const client = await getClient();
+  if (client.type === 'resend') {
+    const { data, error } = await client.resend.emails.send({
+      from: from || process.env.MAIL_FROM,
+      to, cc, bcc, replyTo, subject, html, text, attachments,
+    });
+    if (error) throw new Error(error.message || 'Resend send failed');
+    return data;
+  }
+  return client.transporter.sendMail({
     from: from || process.env.SMTP_FROM || process.env.SMTP_USER,
-    to,
-    cc,
-    bcc,
-    replyTo,
-    subject,
-    text,
-    html,
-    attachments,
+    to, cc, bcc, replyTo, subject, text, html, attachments,
   });
 }
 
-// Verify the SMTP connection/credentials.
-export function verifyMailer() {
-  return transporter.verify();
+// Verify the mailer is usable (SMTP handshake, or that the Resend key is set).
+export async function verifyMailer() {
+  const client = await getClient();
+  if (client.type === 'resend') {
+    if (!process.env.RESEND_API_KEY) throw new Error('RESEND_API_KEY is not set.');
+    return true;
+  }
+  return client.transporter.verify();
 }
 
-export default { sendMail, emailTemplate, verifyMailer, transporter };
+export default { sendMail, emailTemplate, verifyMailer };
 `;
 }