free-framework 4.6.0 → 4.6.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "free-framework",
-  "version": "4.6.0",
+  "version": "4.6.1",
   "description": "Professional Node.js engine for the .free language. Blazing-fast SSR, Islands Architecture, and built-in ORM.",
   "main": "index.js",
   "bin": {

package/runtime/middleware/maintenance.js

@@ -3,13 +3,13 @@
  * Enterprise Maintenance Mode Guard.
  */
 
-module.exports = function maintenanceMiddleware(req, res) {
+module.exports = function maintenanceMiddleware(req, res, next) {
     const isMaintenance = process.env.MAINTENANCE_MODE === 'true';
     const bypassToken = process.env.MAINTENANCE_BYPASS;
 
     // Allow bypassing with a specific query token or if disabled
     if (!isMaintenance || (bypassToken && req.query.bypass === bypassToken)) {
-        return;
+        return next();
     }
 
     // Identify if it's an API request or HTML

package/runtime/middleware/security.js

@@ -3,7 +3,7 @@
  * Enterprise-grade Security Headers Middleware.
  */
 
-module.exports = function securityMiddleware(req, res) {
+module.exports = function securityMiddleware(req, res, next) {
     // 1. Core Security Headers
     res.setHeader('X-Powered-By', 'Free-Ultra/Enterprise');
     res.setHeader('X-Content-Type-Options', 'nosniff');
@@ -25,4 +25,6 @@ module.exports = function securityMiddleware(req, res) {
 
     // 4. Permissions Policy (Hardware restrictions)
     res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), interest-cohort=()');
+
+    next();
 };

package/runtime/server.js

@@ -23,9 +23,9 @@ class FreeServer {
 
         // Static Asset Serving Middleware
         const publicPath = nodePath.join(process.cwd(), 'public');
-        this.app.use((req, res) => {
+        this.app.use((req, res, next) => {
             const lookupPath = req.path.startsWith('/') ? req.path.substring(1) : req.path;
-            if (!lookupPath) return;
+            if (!lookupPath) return next();
 
             const fullPath = nodePath.join(publicPath, lookupPath);
             if (fs.existsSync(fullPath) && fs.statSync(fullPath).isFile()) {
@@ -34,6 +34,7 @@ class FreeServer {
                 const mimes = { '.js': 'application/javascript', '.css': 'text/css', '.png': 'image/png' };
                 return res.type(mimes[ext] || 'application/javascript').send(content);
             }
+            next();
         });
 
         this.app.get('/test-static', (req, res) => res.send('Static serving test'));
@@ -54,7 +55,7 @@ class FreeServer {
         this.app.use(maintenanceMiddleware);
         this.app.use(securityMiddleware);
 
-        this.app.use((req, res) => {
+        this.app.use((req, res, next) => {
             const ip = req.ip || req.headers['x-forwarded-for'] || 'unknown';
             const reqCount = this.rateLimits.get(ip) || 0;
 
@@ -65,6 +66,7 @@ class FreeServer {
             }
 
             this.rateLimits.set(ip, reqCount + 1);
+            next();
         });
     }