@qwickapps/server 1.6.0 → 1.6.1

package/src/plugins/users/__tests__/users-plugin.test.ts

@@ -158,9 +158,10 @@ describe('Users Plugin', () => {
       const plugin = createUsersPlugin({ store: mockStore });
       await plugin.onStart({}, mockRegistry);
 
-      // GET /users, GET /users/:id, POST /users, PUT /users/:id, DELETE /users/:id
-      // + GET /users/:id/info, POST /users/sync
-      expect(mockRegistry.addRoute).toHaveBeenCalledTimes(7);
+      // GET /, GET /:id, POST /, POST /invite, PUT /:id, DELETE /:id
+      // + GET /:id/info, POST /sync, GET /stats
+      // (paths are relative to plugin slug, framework adds /api/users prefix)
+      expect(mockRegistry.addRoute).toHaveBeenCalledTimes(9);
     });
 
     it('should register /users/:id/info route', async () => {
@@ -168,12 +169,12 @@ describe('Users Plugin', () => {
       await plugin.onStart({}, mockRegistry);
 
       const calls = (mockRegistry.addRoute as any).mock.calls;
-      const infoRoute = calls.find((c: any) => c[0].path === '/users/:id/info');
+      const infoRoute = calls.find((c: any) => c[0].path === '/:id/info');
 
       expect(infoRoute).toBeDefined();
       expect(infoRoute[0]).toMatchObject({
         method: 'get',
-        path: '/users/:id/info',
+        path: '/:id/info',
         pluginId: 'users',
       });
     });
@@ -183,12 +184,12 @@ describe('Users Plugin', () => {
       await plugin.onStart({}, mockRegistry);
 
       const calls = (mockRegistry.addRoute as any).mock.calls;
-      const syncRoute = calls.find((c: any) => c[0].path === '/users/sync');
+      const syncRoute = calls.find((c: any) => c[0].path === '/sync');
 
       expect(syncRoute).toBeDefined();
       expect(syncRoute[0]).toMatchObject({
         method: 'post',
-        path: '/users/sync',
+        path: '/sync',
         pluginId: 'users',
       });
     });
@@ -376,7 +377,7 @@ describe('Users Plugin', () => {
 
       // Find the handler for /users/:id/info
       const calls = (registryWithPlugins.addRoute as any).mock.calls;
-      const infoRoute = calls.find((c: any) => c[0].path === '/users/:id/info');
+      const infoRoute = calls.find((c: any) => c[0].path === '/:id/info');
       const handler = infoRoute[0].handler;
 
       // Mock request and response
@@ -405,7 +406,7 @@ describe('Users Plugin', () => {
 
       // Find the handler
       const calls = (registryNoPlugins.addRoute as any).mock.calls;
-      const infoRoute = calls.find((c: any) => c[0].path === '/users/:id/info');
+      const infoRoute = calls.find((c: any) => c[0].path === '/:id/info');
       const handler = infoRoute[0].handler;
 
       const req = { params: { id: mockUser.id } } as any;
@@ -427,7 +428,7 @@ describe('Users Plugin', () => {
       await plugin.onStart({}, mockRegistry);
 
       const calls = (mockRegistry.addRoute as any).mock.calls;
-      const infoRoute = calls.find((c: any) => c[0].path === '/users/:id/info');
+      const infoRoute = calls.find((c: any) => c[0].path === '/:id/info');
       const handler = infoRoute[0].handler;
 
       const req = { params: { id: 'non-existent' } } as any;
@@ -461,7 +462,7 @@ describe('Users Plugin', () => {
       await plugin.onStart({}, registryWithBans);
 
       const calls = (registryWithBans.addRoute as any).mock.calls;
-      const infoRoute = calls.find((c: any) => c[0].path === '/users/:id/info');
+      const infoRoute = calls.find((c: any) => c[0].path === '/:id/info');
       const handler = infoRoute[0].handler;
 
       const req = { params: { id: mockUser.id } } as any;
@@ -494,7 +495,7 @@ describe('Users Plugin', () => {
       await plugin.onStart({}, registryWithPlugins);
 
       const calls = (registryWithPlugins.addRoute as any).mock.calls;
-      const infoRoute = calls.find((c: any) => c[0].path === '/users/:id/info');
+      const infoRoute = calls.find((c: any) => c[0].path === '/:id/info');
       const handler = infoRoute[0].handler;
 
       const req = { params: { id: mockUser.id } } as any;
@@ -530,7 +531,7 @@ describe('Users Plugin', () => {
       await plugin.onStart({}, registryWithPlugins);
 
       const calls = (registryWithPlugins.addRoute as any).mock.calls;
-      const syncRoute = calls.find((c: any) => c[0].path === '/users/sync');
+      const syncRoute = calls.find((c: any) => c[0].path === '/sync');
       const handler = syncRoute[0].handler;
 
       const req = {
@@ -561,7 +562,7 @@ describe('Users Plugin', () => {
       await plugin.onStart({}, mockRegistry);
 
       const calls = (mockRegistry.addRoute as any).mock.calls;
-      const syncRoute = calls.find((c: any) => c[0].path === '/users/sync');
+      const syncRoute = calls.find((c: any) => c[0].path === '/sync');
       const handler = syncRoute[0].handler;
 
       const req = {
@@ -586,7 +587,7 @@ describe('Users Plugin', () => {
       await plugin.onStart({}, mockRegistry);
 
       const calls = (mockRegistry.addRoute as any).mock.calls;
-      const syncRoute = calls.find((c: any) => c[0].path === '/users/sync');
+      const syncRoute = calls.find((c: any) => c[0].path === '/sync');
       const handler = syncRoute[0].handler;
 
       const req = {
@@ -612,7 +613,7 @@ describe('Users Plugin', () => {
       await plugin.onStart({}, mockRegistry);
 
       const calls = (mockRegistry.addRoute as any).mock.calls;
-      const syncRoute = calls.find((c: any) => c[0].path === '/users/sync');
+      const syncRoute = calls.find((c: any) => c[0].path === '/sync');
       const handler = syncRoute[0].handler;
 
       const req = {
@@ -637,7 +638,7 @@ describe('Users Plugin', () => {
       await plugin.onStart({}, mockRegistry);
 
       const calls = (mockRegistry.addRoute as any).mock.calls;
-      const syncRoute = calls.find((c: any) => c[0].path === '/users/sync');
+      const syncRoute = calls.find((c: any) => c[0].path === '/sync');
       const handler = syncRoute[0].handler;
 
       const req = {
@@ -668,7 +669,7 @@ describe('Users Plugin', () => {
       await plugin.onStart({}, registryWithPlugins);
 
       const calls = (registryWithPlugins.addRoute as any).mock.calls;
-      const syncRoute = calls.find((c: any) => c[0].path === '/users/sync');
+      const syncRoute = calls.find((c: any) => c[0].path === '/sync');
       const handler = syncRoute[0].handler;
 
       const req = {

package/src/plugins/users/stores/postgres-store.ts

@@ -63,62 +63,71 @@ export function postgresUserStore(config: PostgresUserStoreConfig): UserStore {
     async initialize(): Promise<void> {
       if (!autoCreateTables) return;
 
-      // Create users table
-      await getPool().query(`
-        CREATE TABLE IF NOT EXISTS ${usersTableFull} (
-          id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-          email VARCHAR(255) NOT NULL UNIQUE,
-          name VARCHAR(255),
-          external_id VARCHAR(255),
-          provider VARCHAR(50),
-          picture TEXT,
-          status VARCHAR(20) DEFAULT 'active',
-          invitation_token VARCHAR(255),
-          invitation_expires_at TIMESTAMPTZ,
-          metadata JSONB DEFAULT '{}',
-          created_at TIMESTAMPTZ DEFAULT NOW(),
-          updated_at TIMESTAMPTZ DEFAULT NOW(),
-          last_login_at TIMESTAMPTZ
+      try {
+        // Create users table
+        await getPool().query(`
+          CREATE TABLE IF NOT EXISTS ${usersTableFull} (
+            id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+            email VARCHAR(255) NOT NULL UNIQUE,
+            name VARCHAR(255),
+            external_id VARCHAR(255),
+            provider VARCHAR(50),
+            picture TEXT,
+            status VARCHAR(20) DEFAULT 'active',
+            invitation_token VARCHAR(255),
+            invitation_expires_at TIMESTAMPTZ,
+            metadata JSONB DEFAULT '{}',
+            created_at TIMESTAMPTZ DEFAULT NOW(),
+            updated_at TIMESTAMPTZ DEFAULT NOW(),
+            last_login_at TIMESTAMPTZ
+          );
+        `);
+
+        // Add new columns to existing tables (migration)
+        // Use parameterized approach to avoid SQL injection
+        const pool = getPool();
+
+        // Check and add status column
+        const statusCheck = await pool.query(
+          `SELECT 1 FROM information_schema.columns
+           WHERE table_schema = $1 AND table_name = $2 AND column_name = 'status'`,
+          [schema, usersTable]
         );
-
-        CREATE INDEX IF NOT EXISTS idx_${usersTable}_email ON ${usersTableFull}(email);
-        CREATE INDEX IF NOT EXISTS idx_${usersTable}_external_id ON ${usersTableFull}(external_id, provider);
-        CREATE INDEX IF NOT EXISTS idx_${usersTable}_invitation_token ON ${usersTableFull}(invitation_token);
-        CREATE INDEX IF NOT EXISTS idx_${usersTable}_status ON ${usersTableFull}(status);
-      `);
-
-      // Add new columns to existing tables (migration)
-      await getPool().query(`
-        DO $$
-        BEGIN
-          IF NOT EXISTS (
-            SELECT 1 FROM information_schema.columns
-            WHERE table_schema = '${schema}'
-            AND table_name = '${usersTable}'
-            AND column_name = 'status'
-          ) THEN
-            ALTER TABLE ${usersTableFull} ADD COLUMN status VARCHAR(20) DEFAULT 'active';
-          END IF;
-
-          IF NOT EXISTS (
-            SELECT 1 FROM information_schema.columns
-            WHERE table_schema = '${schema}'
-            AND table_name = '${usersTable}'
-            AND column_name = 'invitation_token'
-          ) THEN
-            ALTER TABLE ${usersTableFull} ADD COLUMN invitation_token VARCHAR(255);
-          END IF;
-
-          IF NOT EXISTS (
-            SELECT 1 FROM information_schema.columns
-            WHERE table_schema = '${schema}'
-            AND table_name = '${usersTable}'
-            AND column_name = 'invitation_expires_at'
-          ) THEN
-            ALTER TABLE ${usersTableFull} ADD COLUMN invitation_expires_at TIMESTAMPTZ;
-          END IF;
-        END $$;
-      `);
+        if (statusCheck.rows.length === 0) {
+          await pool.query(`ALTER TABLE ${usersTableFull} ADD COLUMN status VARCHAR(20) DEFAULT 'active'`);
+        }
+
+        // Check and add invitation_token column
+        const tokenCheck = await pool.query(
+          `SELECT 1 FROM information_schema.columns
+           WHERE table_schema = $1 AND table_name = $2 AND column_name = 'invitation_token'`,
+          [schema, usersTable]
+        );
+        if (tokenCheck.rows.length === 0) {
+          await pool.query(`ALTER TABLE ${usersTableFull} ADD COLUMN invitation_token VARCHAR(255)`);
+        }
+
+        // Check and add invitation_expires_at column
+        const expiresCheck = await pool.query(
+          `SELECT 1 FROM information_schema.columns
+           WHERE table_schema = $1 AND table_name = $2 AND column_name = 'invitation_expires_at'`,
+          [schema, usersTable]
+        );
+        if (expiresCheck.rows.length === 0) {
+          await pool.query(`ALTER TABLE ${usersTableFull} ADD COLUMN invitation_expires_at TIMESTAMPTZ`);
+        }
+
+        // Create indexes after ensuring all columns exist
+        await pool.query(`
+          CREATE INDEX IF NOT EXISTS idx_${usersTable}_email ON ${usersTableFull}(email);
+          CREATE INDEX IF NOT EXISTS idx_${usersTable}_external_id ON ${usersTableFull}(external_id, provider);
+          CREATE INDEX IF NOT EXISTS idx_${usersTable}_invitation_token ON ${usersTableFull}(invitation_token);
+          CREATE INDEX IF NOT EXISTS idx_${usersTable}_status ON ${usersTableFull}(status);
+        `);
+      } catch (error) {
+        console.error('[PostgresUserStore] Failed to initialize:', error);
+        throw new Error(`Failed to initialize users table: ${error instanceof Error ? error.message : String(error)}`);
+      }
     },
 
     async getById(id: string): Promise<User | null> {

package/src/plugins/users/types.ts

@@ -244,7 +244,12 @@ export interface UserSyncConfig {
  * API configuration
  */
 export interface UsersApiConfig {
-  /** API route prefix (default: '/api/users') */
+  /**
+   * API route prefix relative to plugin slug (default: '/')
+   * Final path will be /api/{slug}{prefix}
+   * Example: prefix='/' results in /api/users/
+   *          prefix='/v2' results in /api/users/v2
+   */
   prefix?: string;
   /** Enable CRUD endpoints */
   crud?: boolean;
@@ -274,6 +279,8 @@ export interface UsersPluginConfig {
   api?: UsersApiConfig;
   /** UI configuration */
   ui?: UsersUiConfig;
+  /** Control panel mount path (default: '/cpanel') - used for generating invitation links */
+  controlPanelPath?: string;
   /** Enable debug logging */
   debug?: boolean;
 }

package/src/plugins/users/users-plugin.ts

@@ -9,6 +9,7 @@
  * Copyright (c) 2025 QwickApps.com. All rights reserved.
  */
 
+import { randomBytes } from 'node:crypto';
 import type { Request, Response } from 'express';
 import type { Plugin, PluginConfig, PluginRegistry } from '../../core/plugin-registry.js';
 import type {
@@ -39,7 +40,7 @@ let currentRegistry: PluginRegistry | null = null;
 export function createUsersPlugin(config: UsersPluginConfig): Plugin {
   const debug = config.debug || false;
   // Routes are mounted under /api by the control panel, so don't include /api in prefix
-  const apiPrefix = config.api?.prefix || '/users';
+  const apiPrefix = config.api?.prefix || '/'; // Framework adds /users prefix automatically
 
   function log(message: string, data?: Record<string, unknown>) {
     if (debug) {
@@ -159,6 +160,110 @@ export function createUsersPlugin(config: UsersPluginConfig): Plugin {
           },
         });
 
+        // Invite user
+        registry.addRoute({
+          method: 'post',
+          path: apiPrefix === '/' ? '/invite' : `${apiPrefix}/invite`,
+          pluginId: 'users',
+          handler: async (req: Request, res: Response) => {
+            try {
+              const { email, name, role } = req.body;
+
+              if (!email) {
+                return res.status(400).json({ error: 'Email is required' });
+              }
+
+              // Check if user already exists
+              const existing = await config.store.getByEmail(email);
+              if (existing) {
+                return res.status(409).json({ error: 'User with this email already exists' });
+              }
+
+              // Generate invitation token (32 bytes = 64 hex chars)
+              const token = randomBytes(32).toString('hex');
+
+              // Set expiration to 7 days from now
+              const expiresAt = new Date();
+              expiresAt.setDate(expiresAt.getDate() + 7);
+
+              // Create user with invited status
+              const user = await config.store.create({
+                email,
+                name,
+                metadata: role ? { role } : undefined,
+              });
+
+              // Update with invitation token
+              const { getPostgres } = await import('../postgres-plugin.js');
+              const pool = getPostgres().getPool();
+              await pool.query(
+                `UPDATE users SET
+                  status = 'invited',
+                  invitation_token = $1,
+                  invitation_expires_at = $2
+                WHERE id = $3`,
+                [token, expiresAt, user.id]
+              );
+
+              // Get base URL from request
+              const protocol = req.get('x-forwarded-proto') || req.protocol;
+              const host = req.get('host');
+              const baseUrl = `${protocol}://${host}`;
+              const cpanelPath = config.controlPanelPath || '/cpanel';
+              const inviteLink = `${baseUrl}${cpanelPath}/accept-invitation/${token}`;
+
+              res.status(201).json({
+                user: { ...user, status: 'invited' as const, invitation_token: token, invitation_expires_at: expiresAt },
+                token,
+                inviteLink,
+                expiresAt: expiresAt.toISOString(),
+              });
+            } catch (error) {
+              console.error('[UsersPlugin] Invite user error:', error);
+              res.status(500).json({ error: 'Failed to invite user' });
+            }
+          },
+        });
+
+        // Accept invitation
+        registry.addRoute({
+          method: 'post',
+          path: apiPrefix === '/' ? '/accept-invitation/:token' : `${apiPrefix}/accept-invitation/:token`,
+          pluginId: 'users',
+          handler: async (req: Request, res: Response) => {
+            try {
+              const { token } = req.params;
+
+              if (!token) {
+                return res.status(400).json({ error: 'Invitation token is required' });
+              }
+
+              const user = await config.store.acceptInvitation(token);
+
+              if (!user) {
+                return res.status(404).json({
+                  error: 'Invalid or expired invitation token',
+                  details: 'The invitation link may have expired or already been used'
+                });
+              }
+
+              res.json({
+                success: true,
+                user: {
+                  id: user.id,
+                  email: user.email,
+                  name: user.name,
+                  status: user.status,
+                },
+                message: 'Invitation accepted successfully. You can now log in.',
+              });
+            } catch (error) {
+              console.error('[UsersPlugin] Accept invitation error:', error);
+              res.status(500).json({ error: 'Failed to accept invitation' });
+            }
+          },
+        });
+
         // Update user
         registry.addRoute({
           method: 'put',
@@ -206,7 +311,7 @@ export function createUsersPlugin(config: UsersPluginConfig): Plugin {
         // GET /users/:id/info - Get comprehensive user info
         registry.addRoute({
           method: 'get',
-          path: `${apiPrefix}/:id/info`,
+          path: apiPrefix === '/' ? '/:id/info' : `${apiPrefix}/:id/info`,
           pluginId: 'users',
           handler: async (req: Request, res: Response) => {
             try {
@@ -227,7 +332,7 @@ export function createUsersPlugin(config: UsersPluginConfig): Plugin {
         // POST /users/sync - Find or create user, return comprehensive info
         registry.addRoute({
           method: 'post',
-          path: `${apiPrefix}/sync`,
+          path: apiPrefix === '/' ? '/sync' : `${apiPrefix}/sync`,
           pluginId: 'users',
           handler: async (req: Request, res: Response) => {
             try {
@@ -265,6 +370,35 @@ export function createUsersPlugin(config: UsersPluginConfig): Plugin {
             }
           },
         });
+
+        // GET /users/stats - Get user statistics
+        registry.addRoute({
+          method: 'get',
+          path: apiPrefix === '/' ? '/stats' : `${apiPrefix}/stats`,
+          pluginId: 'users',
+          handler: async (_req: Request, res: Response) => {
+            try {
+              const allUsers = await config.store.search({ limit: 10000 });
+              const now = Date.now();
+              const sevenDaysAgo = now - 7 * 24 * 60 * 60 * 1000;
+
+              const stats = {
+                totalUsers: allUsers.total,
+                activeUsers: allUsers.users.filter((u) => u.status === 'active').length,
+                invitedUsers: allUsers.users.filter((u) => u.status === 'invited').length,
+                suspendedUsers: allUsers.users.filter((u) => u.status === 'suspended').length,
+                recentSignups: allUsers.users.filter(
+                  (u) => new Date(u.created_at).getTime() > sevenDaysAgo
+                ).length,
+              };
+
+              res.json(stats);
+            } catch (error) {
+              console.error('[UsersPlugin] Get stats error:', error);
+              res.status(500).json({ error: 'Failed to get user stats' });
+            }
+          },
+        });
       }
 
       log('Users plugin started');

package/ui/src/App.tsx

@@ -19,6 +19,8 @@ import { RateLimitPage } from './pages/RateLimitPage';
 import { NotificationsPage } from './pages/NotificationsPage';
 import { IntegrationsPage } from './pages/IntegrationsPage';
 import { APIKeysPage } from './pages/APIKeysPage';
+import { ContentOpsJobsPage } from './pages/ContentOpsJobsPage';
+import { MaintenancePage } from './pages/MaintenancePage';
 import { PluginPage } from './pages/PluginPage';
 import { NotFoundPage } from './pages/NotFoundPage';
 import { api, type MenuContribution } from './api/controlPanelApi';
@@ -46,7 +48,7 @@ const builtInPluginNavItems: Record<string, NavigationItem> = {
 };
 
 // Routes that have dedicated page components
-const dedicatedRoutes = new Set(['/', '/plugins', '/logs', '/system', '/users', '/entitlements', '/auth', '/rate-limits', '/notifications', '/integrations', '/api-keys']);
+const dedicatedRoutes = new Set(['/', '/plugins', '/logs', '/system', '/users', '/entitlements', '/auth', '/rate-limits', '/notifications', '/integrations', '/api-keys', '/contentops/jobs', '/maintenance']);
 
 // Package version - injected at build time or fallback
 const SERVER_VERSION = '1.0.0';
@@ -63,12 +65,13 @@ declare global {
  *
  * The server injects window.__APP_BASE_PATH__ at runtime based on
  * either the configured mountPath or X-Forwarded-Prefix header.
- * This is a simple, robust approach - no complex detection needed.
+ * This is used for BrowserRouter routing, but NOT for API calls.
  */
 const basePath = window.__APP_BASE_PATH__ ?? '';
 
-// Configure API with the detected base path
-api.setBaseUrl(basePath);
+// API routes are always at '/api' regardless of control panel mount path
+// The control panel might be mounted at /cpanel, but API is always at /api
+api.setBaseUrl('');
 
 // Footer content with QwickApps Server branding
 const footerContent = (
@@ -227,6 +230,12 @@ export function App() {
             {registeredPlugins.has('api-keys') && (
               <Route path="/api-keys" element={<APIKeysPage />} />
             )}
+            {registeredPlugins.has('contentops') && (
+              <Route path="/contentops/jobs" element={<ContentOpsJobsPage />} />
+            )}
+            {registeredPlugins.has('maintenance') && (
+              <Route path="/maintenance" element={<MaintenancePage />} />
+            )}
 
             {/* Dynamic plugin routes - render generic PluginPage for non-dedicated routes */}
             {pluginMenuItems