webspresso 0.0.100 → 0.0.102

package/bin/webspresso.js

@@ -26,6 +26,7 @@ const { registerCommand: registerDbRollback } = require('./commands/db-rollback'
 const { registerCommand: registerDbStatus } = require('./commands/db-status');
 const { registerCommand: registerDbMake } = require('./commands/db-make');
 const { registerCommand: registerDbScaffold } = require('./commands/db-scaffold');
+const { registerCommand: registerDbMakeMigrations } = require('./commands/db-makemigrations');
 const { registerCommand: registerSeed } = require('./commands/seed');
 const { registerCommand: registerAdminSetup } = require('./commands/admin-setup');
 const { registerCommand: registerAdminPassword } = require('./commands/admin-password');
@@ -49,6 +50,13 @@ const { registerCommand: registerOpenapi } = require('./commands/openapi');
 const { registerCommand: registerTypegen } = require('./commands/typegen');
 const { registerCommand: registerAddDocker } = require('./commands/add-docker');
 const { registerCommand: registerDeployCheck } = require('./commands/deploy-check');
+const { registerCommand: registerRun } = require('./commands/run');
+const { registerCommand: registerList } = require('./commands/list');
+const { registerCommand: registerMakeCommand } = require('./commands/make-command');
+const { registerCommand: registerMakePolicy } = require('./commands/make-policy');
+const { registerCommand: registerMakeFactory } = require('./commands/make-factory');
+const { registerCommand: registerMakeEvent } = require('./commands/make-event');
+const { registerCommand: registerMakeMail } = require('./commands/make-mail');
 
 registerNew(program);
 registerPage(program);
@@ -64,6 +72,7 @@ registerDbRollback(program);
 registerDbStatus(program);
 registerDbMake(program);
 registerDbScaffold(program);
+registerDbMakeMigrations(program);
 registerSeed(program);
 registerAdminSetup(program);
 registerAdminPassword(program);
@@ -84,8 +93,16 @@ registerAgentsInit(program);
 registerRoutes(program);
 registerMakeModel(program);
 registerMakeJob(program);
+registerMakeCommand(program);
+registerMakePolicy(program);
+registerMakeFactory(program);
+registerMakeEvent(program);
+registerMakeMail(program);
+registerRun(program);
+registerList(program);
 registerOpenapi(program);
 registerTypegen(program);
 
 // Parse arguments
 program.parse();
+

package/core/applySchema.js

@@ -49,8 +49,25 @@ function applySchema(req, compiledSchema) {
   }
 }
 
+let _translateValidationIssues = null;
+function getTranslateValidationIssues() {
+  if (!_translateValidationIssues) {
+    try {
+      _translateValidationIssues = require('../src/api/validation-i18n').translateValidationIssues;
+    } catch {
+      _translateValidationIssues = (issues) => issues;
+    }
+  }
+  return _translateValidationIssues;
+}
+
+function translateValidationIssues(issues, options) {
+  return getTranslateValidationIssues()(issues, options);
+}
+
 module.exports = {
-  applySchema
+  applySchema,
+  translateValidationIssues,
 };
 
 

package/core/auth/bouncer.js

@@ -0,0 +1,196 @@
+/**
+ * Webspresso Auth - Bouncer & Policy Authorization Engine (AdonisJS Bouncer & Django Permissions-inspired)
+ * Context-aware authorization helper for routes, handlers, and templates
+ * @module core/auth/bouncer
+ */
+
+const { defaultPolicyManager, AuthorizationError } = require('./policy');
+const { ForbiddenError, UnauthorizedError } = require('../errors');
+
+/**
+ * Context-aware Bouncer instance bound to a specific user
+ */
+class Bouncer {
+  /**
+   * @param {Object|null} user - The subject user (or null for guest)
+   * @param {import('./policy').PolicyManager} [policyManager]
+   */
+  constructor(user = null, policyManager = defaultPolicyManager) {
+    this.user = user;
+    this.policyManager = policyManager;
+  }
+
+  /**
+   * Create a new Bouncer instance for another user
+   * @param {Object|null} user
+   * @returns {Bouncer}
+   */
+  forUser(user) {
+    return new Bouncer(user, this.policyManager);
+  }
+
+  /**
+   * Parse policy and action from arguments
+   * Supports:
+   * 1. ('Post.update', post) -> policy='Post', action='update', resource=post
+   * 2. ('Post', 'update', post) -> policy='Post', action='update', resource=post
+   * 3. ('gate-name', resource) -> policy=null, action='gate-name', resource=resource
+   * 4. (functionRule, resource) -> direct function check
+   * @protected
+   */
+  _parseArgs(actionOrPolicy, ...rest) {
+    if (typeof actionOrPolicy === 'function') {
+      return {
+        isFn: true,
+        fn: actionOrPolicy,
+        resource: rest[0],
+      };
+    }
+
+    if (typeof actionOrPolicy === 'string') {
+      // 1. Dot-notation: 'Post.update'
+      if (actionOrPolicy.includes('.')) {
+        const parts = actionOrPolicy.split('.');
+        const policy = parts[0];
+        const action = parts.slice(1).join('.');
+        return { policy, action, resource: rest[0] };
+      }
+
+      // 2. Separate strings: ('Post', 'update', post)
+      if (rest.length > 0 && typeof rest[0] === 'string') {
+        const policy = actionOrPolicy;
+        const action = rest[0];
+        const resource = rest[1];
+        return { policy, action, resource };
+      }
+
+      // 3. Single gate / permission name: ('edit-settings', setting)
+      return { policy: null, action: actionOrPolicy, resource: rest[0] };
+    }
+
+    return { policy: null, action: String(actionOrPolicy), resource: rest[0] };
+  }
+
+  /**
+   * Check if current user is allowed to perform an action
+   * @param {string|Function} actionOrPolicy
+   * @param {...any} rest
+   * @returns {boolean}
+   */
+  allows(actionOrPolicy, ...rest) {
+    const parsed = this._parseArgs(actionOrPolicy, ...rest);
+
+    // Direct function rule
+    if (parsed.isFn) {
+      try {
+        return Boolean(parsed.fn(this.user, parsed.resource));
+      } catch {
+        return false;
+      }
+    }
+
+    const { policy, action, resource } = parsed;
+
+    // 1. Check Policy Manager (Gates & Policies)
+    if (policy) {
+      if (this.policyManager.hasPolicy(policy)) {
+        return this.policyManager.can(this.user, action, policy, resource);
+      }
+    } else {
+      if (this.policyManager.hasGate(action)) {
+        return this.policyManager.can(this.user, action, null, resource);
+      }
+    }
+
+    // 2. Django-style user permissions matrix check
+    // e.g. user.permissions = ['post.create', 'post.update'] or user.hasPerm(...)
+    if (this.user) {
+      const fullPerm = policy ? `${policy.toLowerCase()}.${action.toLowerCase()}` : action.toLowerCase();
+
+      // Check hasPerm / hasPermission method on user object
+      if (typeof this.user.hasPerm === 'function') {
+        if (this.user.hasPerm(fullPerm, resource)) return true;
+      }
+      if (typeof this.user.hasPermission === 'function') {
+        if (this.user.hasPermission(fullPerm, resource)) return true;
+      }
+
+      // Check permissions array or set
+      const perms = this.user.permissions;
+      if (Array.isArray(perms) || perms instanceof Set) {
+        const permSet = perms instanceof Set ? perms : new Set(perms);
+        if (permSet.has('*') || permSet.has(fullPerm)) {
+          return true;
+        }
+        if (policy && permSet.has(`${policy.toLowerCase()}.*`)) {
+          return true;
+        }
+      }
+
+      // If user has superuser / is_admin flag
+      if (this.user.isSuperuser || this.user.is_superuser) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  /**
+   * Check if current user is denied from performing an action
+   * @param {string|Function} actionOrPolicy
+   * @param {...any} rest
+   * @returns {boolean}
+   */
+  denies(actionOrPolicy, ...rest) {
+    return !this.allows(actionOrPolicy, ...rest);
+  }
+
+  /**
+   * Authorize an action. Throws ForbiddenError (or UnauthorizedError) if access is denied.
+   * @param {string|Function} actionOrPolicy
+   * @param {...any} rest
+   * @throws {ForbiddenError|UnauthorizedError}
+   */
+  authorize(actionOrPolicy, ...rest) {
+    if (this.denies(actionOrPolicy, ...rest)) {
+      if (!this.user) {
+        throw new UnauthorizedError('Authentication required to perform this action');
+      }
+      const label = typeof actionOrPolicy === 'string' ? actionOrPolicy : 'action';
+      throw new ForbiddenError(`You are not authorized to perform "${label}"`);
+    }
+    return true;
+  }
+}
+
+/**
+ * Create a Bouncer instance for a user
+ * @param {Object|null} user
+ * @param {import('./policy').PolicyManager} [policyManager]
+ * @returns {Bouncer}
+ */
+function createBouncer(user = null, policyManager = defaultPolicyManager) {
+  return new Bouncer(user, policyManager);
+}
+
+/**
+ * Express middleware that attaches `req.bouncer` automatically
+ * @param {Object} [options={}]
+ * @returns {import('express').RequestHandler}
+ */
+function createBouncerMiddleware(options = {}) {
+  const policyManager = options.policyManager || defaultPolicyManager;
+
+  return function bouncerMiddleware(req, res, next) {
+    const user = req.user || req.auth?.user || null;
+    req.bouncer = new Bouncer(user, policyManager);
+    next();
+  };
+}
+
+module.exports = {
+  Bouncer,
+  createBouncer,
+  createBouncerMiddleware,
+};

package/core/auth/index.js

@@ -225,6 +225,16 @@ module.exports = {
   // Classes
   AuthManager,
   PolicyManager,
+  Bouncer: require('./bouncer').Bouncer,
+  createBouncer: require('./bouncer').createBouncer,
+  createBouncerMiddleware: require('./bouncer').createBouncerMiddleware,
+
+  // Policies & Authorization (AdonisJS Bouncer & Django Permissions-inspired)
+  definePolicy: require('./policy').definePolicy,
+  defineGate: require('./policy').defineGate,
+  can: require('./policy').can,
+  cannot: require('./policy').cannot,
+  authorize: require('./policy').authorize,
   
   // Errors
   AuthenticationError,

package/core/auth/middleware.js

@@ -44,7 +44,21 @@ function createAuthMiddleware(authManager) {
   /**
    * Cookie parser middleware (needed for signed cookies / remember me)
    */
-  const cookieMiddleware = cookieParser(config.session.secret);
+  const baseCookieMiddleware = cookieParser(config.session?.secret);
+  const cookieMiddleware = (req, res, next) => {
+    if (!req.cookies) {
+      return baseCookieMiddleware(req, res, next);
+    }
+    if (config.session?.secret) {
+      if (!req.secret) {
+        req.secret = config.session.secret;
+      }
+      if (!req.signedCookies || Object.keys(req.signedCookies).length === 0) {
+        req.signedCookies = cookieParser.signedCookies(req.cookies, config.session.secret);
+      }
+    }
+    next();
+  };
 
   /**
    * Authenticate middleware

package/core/commands/define-command.js

@@ -0,0 +1,48 @@
+'use strict';
+
+/**
+ * Webspresso - Custom Command Definition
+ * Inspired by Django BaseCommand & AdonisJS Ace CLI
+ * @module core/commands/define-command
+ */
+
+/**
+ * Define a custom CLI management command
+ * @param {Object} definition
+ * @param {string} definition.name - Command identifier (e.g. 'users:sync' or 'send-invoices')
+ * @param {string} [definition.description] - Human-readable command description
+ * @param {Array<{flags: string, description?: string, defaultValue?: any}>} [definition.options] - CLI flags
+ * @param {Function} definition.handle - Execution function receiving ({ db, queue, services, mailer, events, logger, args, flags })
+ * @returns {Object} Validated command specification
+ */
+function defineCommand(definition) {
+  if (!definition || typeof definition !== 'object') {
+    throw new TypeError('defineCommand requires a configuration object');
+  }
+  if (!definition.name || typeof definition.name !== 'string' || !definition.name.trim()) {
+    throw new TypeError('Command definition must specify a non-empty string "name"');
+  }
+  const handleFn = definition.handle || definition.run;
+  if (typeof handleFn !== 'function') {
+    throw new TypeError(`Command "${definition.name}" must provide an executable "handle" function`);
+  }
+
+  const options = Array.isArray(definition.options)
+    ? definition.options.map((opt) => ({
+        flags: String(opt.flags || opt.name || '').trim(),
+        description: opt.description || '',
+        defaultValue: opt.defaultValue !== undefined ? opt.defaultValue : opt.default,
+      })).filter((opt) => opt.flags.length > 0)
+    : [];
+
+  return {
+    name: definition.name.trim(),
+    description: definition.description || '',
+    options,
+    handle: handleFn,
+  };
+}
+
+module.exports = {
+  defineCommand,
+};

package/core/commands/index.js

@@ -0,0 +1,18 @@
+'use strict';
+
+/**
+ * Webspresso - Management Commands Core Module
+ * @module core/commands
+ */
+
+const { defineCommand } = require('./define-command');
+const { createCommandRegistry, findCommandFiles, deriveCommandName } = require('./registry');
+const { executeCommand } = require('./runner');
+
+module.exports = {
+  defineCommand,
+  createCommandRegistry,
+  findCommandFiles,
+  deriveCommandName,
+  executeCommand,
+};

package/core/commands/registry.js

@@ -0,0 +1,156 @@
+'use strict';
+
+/**
+ * Webspresso - Command Registry & Auto-Discovery
+ * Scans commands/ directory and registers custom management commands
+ * @module core/commands/registry
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { defineCommand } = require('./define-command');
+
+/**
+ * Recursively find command files in directory
+ * @param {string} dir
+ * @returns {string[]}
+ */
+function findCommandFiles(dir) {
+  if (!fs.existsSync(dir)) return [];
+  const entries = fs.readdirSync(dir, { withFileTypes: true });
+  const files = [];
+
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...findCommandFiles(fullPath));
+    } else if (
+      entry.isFile() &&
+      entry.name.endsWith('.js') &&
+      !entry.name.startsWith('_') &&
+      !entry.name.endsWith('.test.js') &&
+      !entry.name.endsWith('.spec.js')
+    ) {
+      files.push(fullPath);
+    }
+  }
+
+  return files;
+}
+
+/**
+ * Derive command name from relative path
+ * e.g. "users/prune.js" -> "users:prune", "send-invoices.js" -> "send-invoices"
+ * @param {string} relPath
+ * @returns {string}
+ */
+function deriveCommandName(relPath) {
+  const withoutExt = relPath.replace(/\.js$/, '');
+  const segments = withoutExt.split(/[\\/]/).filter(Boolean);
+  return segments.join(':');
+}
+
+/**
+ * Create a CommandRegistry instance
+ * @param {Object} [options]
+ * @param {string} [options.commandsDir] - Root directory for commands (default: ./commands)
+ * @param {boolean} [options.autoLoad=true] - Whether to discover files immediately
+ * @returns {Object} CommandRegistry
+ */
+function createCommandRegistry(options = {}) {
+  const commandsDir = options.commandsDir
+    ? path.resolve(process.cwd(), options.commandsDir)
+    : path.resolve(process.cwd(), 'commands');
+
+  /** @type {Map<string, Object>} */
+  const commands = new Map();
+
+  function register(cmdDef) {
+    if (!cmdDef || typeof cmdDef !== 'object') {
+      throw new TypeError('Invalid command definition object');
+    }
+    const def = typeof cmdDef.handle === 'function' && defIsNormalized(cmdDef)
+      ? cmdDef
+      : defineCommand(cmdDef);
+
+    commands.set(def.name, def);
+    return def;
+  }
+
+  function defIsNormalized(obj) {
+    return typeof obj.name === 'string' && typeof obj.handle === 'function' && Array.isArray(obj.options);
+  }
+
+  function load() {
+    commands.clear();
+    const files = findCommandFiles(commandsDir);
+
+    for (const file of files) {
+      try {
+        delete require.cache[require.resolve(file)];
+        const exported = require(file);
+        const rel = path.relative(commandsDir, file);
+        const derivedName = deriveCommandName(rel);
+
+        let cmdDef = null;
+
+        if (typeof exported === 'function') {
+          cmdDef = defineCommand({
+            name: derivedName,
+            handle: exported,
+          });
+        } else if (exported && typeof exported === 'object') {
+          // Check if exported is an ES default or CJS module
+          const target = exported.default || exported;
+          const name = target.name || derivedName;
+          const handle = target.handle || target.run;
+
+          if (typeof handle === 'function') {
+            cmdDef = defineCommand({
+              name,
+              description: target.description || '',
+              options: target.options || [],
+              handle,
+            });
+          }
+        }
+
+        if (cmdDef) {
+          commands.set(cmdDef.name, cmdDef);
+        }
+      } catch (err) {
+        console.warn(`[commands] Failed to load command from "${file}":`, err.message);
+      }
+    }
+  }
+
+  if (options.autoLoad !== false) {
+    load();
+  }
+
+  return {
+    register,
+    reload: load,
+    has(name) {
+      return commands.has(name);
+    },
+    get(name) {
+      return commands.get(name) || null;
+    },
+    list() {
+      return Array.from(commands.values());
+    },
+    names() {
+      return Array.from(commands.keys());
+    },
+    get commandsDir() {
+      return commandsDir;
+    },
+  };
+}
+
+module.exports = {
+  createCommandRegistry,
+  findCommandFiles,
+  deriveCommandName,
+};

package/core/commands/runner.js

@@ -0,0 +1,76 @@
+'use strict';
+
+/**
+ * Webspresso - Command Runner & Execution Engine
+ * Injects framework services, database, queue, mailer, events and manages execution lifecycle
+ * @module core/commands/runner
+ */
+
+/**
+ * Execute a command definition with dependency injection
+ * @param {Object} commandDef - Command specification returned by defineCommand
+ * @param {Object} [executionOptions]
+ * @param {Array<string>} [executionOptions.args] - Positional CLI arguments
+ * @param {Object} [executionOptions.flags] - Named flags / options
+ * @param {Object} [executionOptions.db] - Knex / ORM database instance
+ * @param {Object} [executionOptions.queue] - Background job queue dispatcher
+ * @param {Object} [executionOptions.services] - Service registry or caller
+ * @param {Object} [executionOptions.mailer] - Mailer service
+ * @param {Object} [executionOptions.events] - Application event dispatcher
+ * @param {Object} [executionOptions.logger] - Logger instance (default: console)
+ * @returns {Promise<{ success: boolean, result?: any, error?: Error, durationMs: number }>}
+ */
+async function executeCommand(commandDef, executionOptions = {}) {
+  if (!commandDef || typeof commandDef !== 'object') {
+    throw new TypeError('executeCommand requires a command definition');
+  }
+
+  const handleFn = commandDef.handle || commandDef.run;
+  if (typeof handleFn !== 'function') {
+    throw new TypeError(`Command "${commandDef.name || 'anonymous'}" has no executable handle function`);
+  }
+
+  const {
+    args = [],
+    flags = {},
+    db = null,
+    queue = null,
+    services = null,
+    mailer = null,
+    events = null,
+    logger = console,
+  } = executionOptions;
+
+  const start = Date.now();
+  const context = {
+    db,
+    queue,
+    services,
+    mailer,
+    events,
+    logger,
+    args: Array.isArray(args) ? args : [],
+    flags: flags && typeof flags === 'object' ? flags : {},
+  };
+
+  try {
+    const result = await handleFn(context);
+    const durationMs = Date.now() - start;
+    return {
+      success: true,
+      result,
+      durationMs,
+    };
+  } catch (error) {
+    const durationMs = Date.now() - start;
+    return {
+      success: false,
+      error,
+      durationMs,
+    };
+  }
+}
+
+module.exports = {
+  executeCommand,
+};

package/core/compression/compressible.js

@@ -8,7 +8,7 @@
 const COMPRESSIBLE_TYPE_REGEX = /^(?:text\/[a-z0-9.+_-]+|application\/(?:javascript|x-javascript|json|ld\+json|manifest\+json|graphql\+json|geo\+json|xml|atom\+xml|rss\+xml|xhtml\+xml|x-yaml|yaml|vnd\.api\+json|schema\+json|hal\+json)|image\/svg\+xml)$/i;
 
 // Regex patterns for already-compressed or non-compressible types
-const INCOMPRESSIBLE_TYPE_REGEX = /^(?:image\/(?:jpeg|png|gif|webp|avif|heic|heif)|video\/[a-z0-9.+_-]+|audio\/[a-z0-9.+_-]+|application\/(?:zip|gzip|x-gzip|x-bzip2|x-compress|x-7z-compressed|x-rar-compressed|pdf|wasm|octet-stream))$/i;
+const INCOMPRESSIBLE_TYPE_REGEX = /^(?:text\/event-stream|image\/(?:jpeg|png|gif|webp|avif|heic|heif)|video\/[a-z0-9.+_-]+|audio\/[a-z0-9.+_-]+|application\/(?:zip|gzip|x-gzip|x-bzip2|x-compress|x-7z-compressed|x-rar-compressed|pdf|wasm|octet-stream))$/i;
 
 const compressibleCache = new Map();
 const MAX_MIME_CACHE_SIZE = 256;