@intranefr/superbackend 1.6.4 → 1.6.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intranefr/superbackend",
-  "version": "1.6.4",
+  "version": "1.6.6",
   "description": "Node.js middleware that gives your project backend superpowers",
   "main": "index.js",
   "scripts": {

package/src/middleware/auth.js

@@ -131,9 +131,37 @@ const adminSessionAuth = (req, res, next) => {
 
 // Admin authentication middleware that supports both session and basic auth
 const adminAuth = (req, res, next) => {
-  // First try session authentication
-  if (req.session && req.session.authenticated) {
-    return adminSessionAuth(req, res, next);
+  // First try session authentication (only if session exists AND is authenticated)
+  if (req.session && req.session.authenticated === true) {
+    // Verify session is still valid (check login time)
+    const loginTime = new Date(req.session.loginTime);
+    const now = new Date();
+    const sessionAge = (now - loginTime) / (1000 * 60 * 60); // hours
+    
+    // Session expires after 24 hours
+    if (sessionAge > 24) {
+      req.session.destroy((err) => {
+        if (err) console.error('Error destroying expired session:', err);
+      });
+      
+      if (req.xhr || req.headers.accept?.includes('application/json')) {
+        return res.status(401).json({ 
+          error: "Session expired", 
+          redirectTo: `${req.adminPath || '/admin'}/login` 
+        });
+      }
+      
+      return res.redirect(`${req.adminPath || '/admin'}/login?error=Session expired`);
+    }
+
+    // Attach user info to request for consistency with other auth middleware
+    req.user = {
+      authenticated: true,
+      authType: req.session.authType,
+      role: req.session.role
+    };
+    
+    return next();
   }
   
   // Fallback to basic auth for backward compatibility

package/src/middleware.js

@@ -99,6 +99,12 @@ function createMiddleware(options = {}) {
 
   const bootstrapPluginsRuntime = async () => {
     try {
+      if (options.plugins?.extraRoots) {
+        const roots = Array.isArray(options.plugins.extraRoots) ? options.plugins.extraRoots : [];
+        for (const root of roots) {
+          await pluginsService.loadAllPluginsFromFolder(root, { context: {} });
+        }
+      }
       const superbackend = globalThis.superbackend || globalThis.saasbackend || {};
       await pluginsService.bootstrap({
         context: {

package/src/routes/experiments.routes.js

@@ -1,13 +1,13 @@
 const express = require('express');
 const router = express.Router();
 
-const { adminSessionAuth } = require('../middleware/auth');
+const { adminAuth } = require('../middleware/auth');
 const rateLimiter = require('../services/rateLimiter.service');
 
 const controller = require('../controllers/experiments.controller');
 
 router.use(express.json({ limit: '1mb' }));
-router.use(adminSessionAuth);
+router.use(adminAuth);
 
 router.get(
   '/:code/assignment',

package/src/services/llm.service.js

@@ -249,6 +249,7 @@ async function logAuditEntry({
         model,
         variables: variables || {},
         requestOptions: requestOptions || {},
+        auditContext: requestOptions?.auditContext || null,
         errorMessage,
         usage: usage || null,
       },

package/src/services/plugins.service.js

@@ -12,6 +12,8 @@ const DEFAULT_REGISTRY_ID = 'plugins';
 const exposedServices = {};
 const exposedHelpers = {};
 
+const additionalPluginsRoots = new Set();
+
 function sha256(value) {
   return crypto.createHash('sha256').update(String(value || ''), 'utf8').digest('hex');
 }
@@ -24,6 +26,24 @@ function resolvePluginsRoot(customRoot) {
   return customRoot || path.join(process.cwd(), 'plugins');
 }
 
+function listPluginsRoots({ pluginsRoot } = {}) {
+  const roots = [];
+  const primary = resolvePluginsRoot(pluginsRoot);
+  if (primary) roots.push(primary);
+  for (const extra of additionalPluginsRoots) {
+    if (extra && typeof extra === 'string') roots.push(extra);
+  }
+  // de-dup while preserving order
+  return Array.from(new Set(roots));
+}
+
+function registerPluginsRoot(absolutePath) {
+  const root = String(absolutePath || '').trim();
+  if (!root) return { ok: false, reason: 'empty_path' };
+  additionalPluginsRoots.add(root);
+  return { ok: true, root };
+}
+
 function normalizePlugin(rawModule, pluginId, absoluteDir) {
   const candidate = rawModule && typeof rawModule === 'object' ? rawModule : {};
   const hooks = candidate.hooks && typeof candidate.hooks === 'object' ? candidate.hooks : {};
@@ -131,28 +151,40 @@ function readPluginModule(pluginDir) {
 }
 
 async function discoverPlugins({ pluginsRoot } = {}) {
-  const root = resolvePluginsRoot(pluginsRoot);
-  if (!fs.existsSync(root)) return [];
-
-  const entries = fs.readdirSync(root, { withFileTypes: true });
-  const plugins = [];
-
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const pluginId = entry.name;
-    const absoluteDir = path.join(root, pluginId);
-    const loaded = readPluginModule(absoluteDir);
-    if (!loaded) continue;
-
-    const plugin = normalizePlugin(loaded, pluginId, absoluteDir);
-    if (!plugin.id) continue;
-    plugins.push(plugin);
+  const roots = listPluginsRoots({ pluginsRoot });
+  const pluginById = new Map();
+
+  for (const root of roots) {
+    if (!fs.existsSync(root)) continue;
+    const entries = fs.readdirSync(root, { withFileTypes: true });
+
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const pluginId = entry.name;
+      const absoluteDir = path.join(root, pluginId);
+      const loaded = readPluginModule(absoluteDir);
+      if (!loaded) continue;
+
+      const plugin = normalizePlugin(loaded, pluginId, absoluteDir);
+      if (!plugin.id) continue;
+
+      // First discovered wins (stable and avoids unexpected overrides)
+      if (!pluginById.has(plugin.id)) {
+        pluginById.set(plugin.id, plugin);
+      }
+    }
   }
 
+  const plugins = Array.from(pluginById.values());
   plugins.sort((a, b) => a.id.localeCompare(b.id));
   return plugins;
 }
 
+async function loadAllPluginsFromFolder(absolutePath, { context } = {}) {
+  registerPluginsRoot(absolutePath);
+  return bootstrap({ context });
+}
+
 async function ensurePluginsRegistry() {
   return registryService.ensureRegistry({
     id: DEFAULT_REGISTRY_ID,
@@ -337,6 +369,8 @@ module.exports = {
   PLUGINS_STATE_KEY,
   DEFAULT_REGISTRY_ID,
   ensurePluginsRegistry,
+  registerPluginsRoot,
+  loadAllPluginsFromFolder,
   discoverPlugins,
   bootstrap,
   listPlugins,