4bnode 4.1.6 → 4.1.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "4bnode",
-  "version": "4.1.6",
+  "version": "4.1.8",
   "description": "4bnode is a CLI-powered backend development platform with a built-in visual dashboard to generate, manage, and test Node.js/Express APIs faster.",
   "main": "index.js",
   "type": "module",

package/skeleton/.4bnode/assets/js/pages/MailPage.js

@@ -121,6 +121,7 @@ export function MailPage() {
   async function save() {
     let body;
     if (provider === "resend") {
+      if (!form.resendFrom.trim()) { toast("From address is required", "error"); return; }
       if (!form.apiKey.trim() && !(info.resend && info.resend.hasKey)) { toast("API key is required", "error"); return; }
       body = { provider: "resend", apiKey: form.apiKey.trim(), from: form.resendFrom.trim(), domainPassword };
     } else {
@@ -239,7 +240,7 @@ export function MailPage() {
           <label className="form-label">Authorization password</label>
           <input className="form-input" type="password" value=${domainPassword} onInput=${(e) => setDomainPassword(e.target.value)} placeholder="Required for 4brains.in" />
         </div>`}
-        <button className="btn btn-primary" onClick=${save} disabled=${busy || (provider === "smtp" && !form.host.trim()) || (isOfficial && !domainPassword)}>
+        <button className="btn btn-primary" onClick=${save} disabled=${busy || (provider === "smtp" && !form.host.trim()) || (provider === "resend" && !form.resendFrom.trim()) || (isOfficial && !domainPassword)}>
           ${busy ? html`<span className="spinner" />` : html`<${LuCheck} size=${16} />`}
           ${busy ? "Saving..." : "Save & install"}
         </button>

package/skeleton/.4bnode/dev-api.js

@@ -1372,11 +1372,11 @@ async function verifyMailConfig(envPath, provider) {
   if (provider === 'resend') {
     const key = getEnvValue(envPath, 'RESEND_API_KEY');
     if (!key) throw new Error('Resend API key is missing.');
-    let Resend;
-    try { ({ Resend } = await import('resend')); } catch { return; }
-    const resend = new Resend(key);
-    const { error } = await resend.domains.list();
-    if (error) throw new Error(error.message || 'Resend rejected the API key.');
+    // Resend has no safe no-op verify — domains.list() needs a full-access key and
+    // rejects normal send-only keys, which would fail valid configs. So validate the
+    // key shape + From here, and let the "Send test" button confirm deliverability.
+    if (!/^re_/.test(key)) throw new Error('That does not look like a Resend API key — it should start with "re_".');
+    if (!getEnvValue(envPath, 'MAIL_FROM')) throw new Error('A From address is required for Postmaster.');
     return;
   }
   const host = getEnvValue(envPath, 'SMTP_HOST');
@@ -1456,6 +1456,7 @@ router.post('/api/mail/setup', async (req, res) => {
       if (from !== undefined) updateEnvFile(envPath, 'MAIL_FROM', String(from || '').trim());
       if (apiKey) updateEnvFile(envPath, 'RESEND_API_KEY', String(apiKey).trim());
       if (!getEnvValue(envPath, 'RESEND_API_KEY')) return res.status(400).json({ error: 'A Resend API key is required.' });
+      if (!getEnvValue(envPath, 'MAIL_FROM')) return res.status(400).json({ error: 'A From address is required.' });
       await installDeps('resend');
     } else {
       const { host, port, secure, user, pass, from } = req.body || {};

package/skeleton/index.js

@@ -50,13 +50,31 @@ app.use(cors({ origin: "*" }));
 // ── Security (built-in by default) ───────────────────
 // Mounted AFTER the /_dev dashboard so its CDN/inline scripts aren't blocked by
 // helmet's CSP and the dashboard isn't throttled by the rate limiter.
-app.use(helmet());
+// helmet() defaults to a strict Content-Security-Policy (script-src 'self',
+// etc.) that blocks CDN-loaded scripts, inline <script> blocks, and cross-origin
+// assets. We widen the policy so a typical frontend/docs page works while keeping
+// the rest of helmet's protections. Tighten these directives for production.
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'", 'https:', "'unsafe-inline'"],
+      styleSrc: ["'self'", 'https:', "'unsafe-inline'"],
+      imgSrc: ["'self'", 'data:', 'https:'],
+      connectSrc: ["'self'"],
+    },
+  },
+  crossOriginEmbedderPolicy: false,
+  // Allow other origins (e.g. a separate frontend host) to load assets served
+  // by this app. Default is 'same-origin'. Tighten to 'same-site' for production.
+  crossOriginResourcePolicy: { policy: 'cross-origin' },
+}));
 
 // ── Rate limiting ────────────────────────────────────
 // Tune via .env: RATE_LIMIT_WINDOW_MS (ms) and RATE_LIMIT_MAX (per window).
 const apiLimiter = rateLimit({
   windowMs: Number(process.env.RATE_LIMIT_WINDOW_MS) || 15 * 60 * 1000,
-  max: Number(process.env.RATE_LIMIT_MAX) || 100,
+  max: Number(process.env.RATE_LIMIT_MAX) || 500,
   standardHeaders: true,
   legacyHeaders: false,
 });