webspresso 0.0.101 → 0.0.103

package/plugins/file-manager/index.js

@@ -44,8 +44,21 @@ function fileManagerPlugin(options = {}) {
     permissions = null,
     security: securityOpts = { validateMagicBytes: true, sanitizeSvg: true },
     includePage = true,
+    lazy: lazyOption,
   } = options;
 
+  if (lazyOption) {
+    const { lazyPlugin } = require('../lazy');
+    const lazyOpts = typeof lazyOption === 'object' ? lazyOption : {};
+    return lazyPlugin(() => fileManagerPlugin({ ...options, lazy: false }), {
+      name: 'file-manager',
+      prefix: apiPrefix,
+      services: ['file-manager.list', 'file-manager.upload', 'file-manager.delete', 'file-manager.create-folder'],
+      dependencies: { 'admin-panel': '*' },
+      ...lazyOpts,
+    });
+  }
+
   const resolvedBaseDir = path.resolve(baseDir);
 
   const handlers = createFileManagerApiHandlers({
@@ -101,15 +114,17 @@ function fileManagerPlugin(options = {}) {
       // so window.__openFileManagerPicker is available across all admin pages (models, records, rich-text)
       if (typeof adminApi.getRegistry === 'function') {
         const registry = adminApi.getRegistry();
-        registry.configure({
-          fileManager: {
-            enabled: true,
-            apiPrefix,
-            publicBasePath,
-            pageTitle,
-          },
-        });
-        registry.registerClientComponent('files', componentCode);
+        if (registry) {
+          registry.configure({
+            fileManager: {
+              enabled: true,
+              apiPrefix,
+              publicBasePath,
+              pageTitle,
+            },
+          });
+          registry.registerClientComponent('files', componentCode);
+        }
       }
 
       adminApi.registerModule({

package/plugins/file-manager/security.js

@@ -24,6 +24,16 @@ const DANGEROUS_EXTENSIONS = new Set([
   'htaccess', 'htpasswd', 'ini', 'env', 'config', 'conf', 'passwd', 'shadow',
 ]);
 
+/**
+ * Common safe extensions allowed when passed as raw extensions (without filename dot)
+ */
+const COMMON_SAFE_EXTENSIONS = new Set([
+  'jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'avif', 'bmp', 'ico', 'tiff',
+  'pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'odt', 'ods', 'odp', 'rtf',
+  'txt', 'csv', 'md', 'json', 'xml', 'html', 'css', 'js', 'ts', 'jsx', 'tsx',
+  'sql', 'yaml', 'yml', 'zip', 'tar', 'gz', 'mp3', 'wav', 'mp4', 'mov', 'webm',
+]);
+
 /**
  * Known magic numbers table for high-speed signature verification.
  * Only validates when extension matches known binary format.
@@ -118,9 +128,8 @@ function validateSafeExtension(filename) {
     throw new ValidationError('Filename must have a valid extension');
   }
 
-  // Check all dotted segments against dangerous extensions to block double extensions (e.g. payload.php.jpg)
-  for (let i = 1; i < parts.length; i++) {
-    const segment = parts[i];
+  // Check all segments against dangerous extensions to block double extensions and dangerous dotfiles (e.g. .env, payload.php.jpg)
+  for (const segment of parts) {
     if (DANGEROUS_EXTENSIONS.has(segment)) {
       throw new SecurityError(
         `Dangerous extension or double-extension detected: .${segment}`,
@@ -129,11 +138,14 @@ function validateSafeExtension(filename) {
     }
   }
 
-  const finalExt = parts[parts.length - 1];
-  if (DANGEROUS_EXTENSIONS.has(finalExt)) {
-    throw new SecurityError(`File type .${finalExt} is forbidden for upload`, 403);
+  if (parts.length < 2 && !cleanName.startsWith('.')) {
+    if (COMMON_SAFE_EXTENSIONS.has(parts[0])) {
+      return parts[0];
+    }
+    throw new ValidationError('Filename must have a valid extension');
   }
 
+  const finalExt = parts[parts.length - 1];
   return finalExt;
 }
 

package/plugins/index.js

@@ -61,6 +61,8 @@ module.exports = {
   get createApiKeyMiddleware() { return require('./api-key').createApiKeyMiddleware; },
   get webhooksPlugin() { return require('./webhooks').webhooksPlugin; },
   get WebhookDispatcher() { return require('./webhooks').WebhookDispatcher; },
+  get lazyPlugin() { return require('./lazy').lazyPlugin; },
+  get defineLazyPlugin() { return require('./lazy').defineLazyPlugin; },
 };
 
 

package/plugins/lazy.js

@@ -0,0 +1,258 @@
+/**
+ * Webspresso On-Demand (Lazy) Plugin Wrapper
+ *
+ * Defers execution of heavy plugin initialization, filesystem scans, route mounting,
+ * and dependency loading until the plugin is actually accessed via:
+ * 1. HTTP request matching its configured URL prefix (e.g. /_admin)
+ * 2. Service execution (e.g. ctx.service('email.send'))
+ * 3. Direct inter-plugin API access (e.g. ctx.usePlugin('admin-panel'))
+ * 4. Template helper execution (e.g. fsy.adminHelper())
+ * 5. Explicit programmatic hydration (lazyPlugin.hydrate())
+ *
+ * @module plugins/lazy
+ */
+
+const express = require('express');
+
+/**
+ * Wraps a plugin definition or factory function into an on-demand lazy plugin.
+ *
+ * @param {Function|Object} pluginFactory - Factory `() => plugin` or plugin definition object
+ * @param {Object} [lazyOptions={}]
+ * @param {string} [lazyOptions.name] - Plugin name (inferred if not provided)
+ * @param {string|string[]} [lazyOptions.prefix] - URL path prefix(es) that trigger on-demand hydration (e.g. '/_admin')
+ * @param {string[]} [lazyOptions.services=[]] - Service names that trigger on-demand hydration
+ * @param {string[]} [lazyOptions.helpers=[]] - Template helpers that trigger on-demand hydration
+ * @param {string[]} [lazyOptions.events=[]] - Event names that trigger on-demand hydration
+ * @param {Object} [lazyOptions.dependencies] - Plugin dependencies
+ * @param {Object} [lazyOptions.csp] - Content Security Policy requirements
+ * @param {Function} [lazyOptions.onHydrate] - Callback invoked when hydration finishes
+ * @returns {Object} Webspresso Lazy Plugin definition
+ */
+function lazyPlugin(pluginFactory, lazyOptions = {}) {
+  let realPlugin = null;
+  let isHydrated = false;
+  let isHydrating = false;
+
+  let regCtx = null;
+  let routesCtx = null;
+  const router = express.Router();
+
+  const name =
+    lazyOptions.name ||
+    (typeof pluginFactory === 'object' && pluginFactory ? pluginFactory.name : null) ||
+    'anonymous-lazy-plugin';
+
+  const rawPrefixes = lazyOptions.prefix
+    ? (Array.isArray(lazyOptions.prefix) ? lazyOptions.prefix : [lazyOptions.prefix])
+    : [];
+  // Normalize prefixes: ensure leading slash, remove trailing slash (except root '/')
+  const prefixes = rawPrefixes.map(p => {
+    let norm = String(p).trim();
+    if (!norm.startsWith('/')) norm = '/' + norm;
+    if (norm.length > 1 && norm.endsWith('/')) norm = norm.slice(0, -1);
+    return norm;
+  });
+
+  const lazyServices = Array.isArray(lazyOptions.services) ? lazyOptions.services : [];
+  const lazyHelpers = Array.isArray(lazyOptions.helpers) ? lazyOptions.helpers : [];
+  const lazyEvents = Array.isArray(lazyOptions.events) ? lazyOptions.events : [];
+
+  function hydrate() {
+    if (isHydrated) return realPlugin;
+    if (isHydrating) return realPlugin;
+    isHydrating = true;
+
+    try {
+      realPlugin = typeof pluginFactory === 'function' ? pluginFactory() : pluginFactory;
+      if (!realPlugin) {
+        throw new Error(`[lazyPlugin] Factory for plugin "${name}" did not return a valid plugin object`);
+      }
+
+      // 1. Call setup hook if present
+      if (typeof realPlugin.setup === 'function' && regCtx?.app) {
+        const disposer = realPlugin.setup(regCtx.app);
+        if (typeof disposer === 'function' && regCtx.onDispose) {
+          regCtx.onDispose(disposer);
+        }
+      }
+
+      // 2. Call register hook
+      if (typeof realPlugin.register === 'function' && regCtx) {
+        const disposer = realPlugin.register(regCtx);
+        if (typeof disposer === 'function' && regCtx.onDispose) {
+          regCtx.onDispose(disposer);
+        }
+      }
+
+      // 3. Register real routes onto the lazy router
+      if (typeof realPlugin.onRoutesReady === 'function' && routesCtx) {
+        const customRoutesCtx = {
+          ...routesCtx,
+          addRoute(method, routePath, ...handlers) {
+            const m = String(method).toLowerCase();
+            let matchedPrefix = null;
+            for (const p of prefixes) {
+              if (routePath === p || routePath.startsWith(p + '/')) {
+                matchedPrefix = p;
+                break;
+              }
+            }
+
+            if (matchedPrefix) {
+              // Convert absolute route path to router-relative subpath
+              let subPath = routePath.slice(matchedPrefix.length);
+              if (!subPath || !subPath.startsWith('/')) {
+                subPath = '/' + (subPath || '');
+              }
+              if (router[m]) {
+                router[m](subPath, ...handlers);
+              } else if (router.all) {
+                router.all(subPath, ...handlers);
+              }
+            } else {
+              // Route is outside configured prefix: mount directly on app
+              if (routesCtx.addRoute) {
+                routesCtx.addRoute(method, routePath, ...handlers);
+              } else if (routesCtx.app && routesCtx.app[m]) {
+                routesCtx.app[m](routePath, ...handlers);
+              }
+            }
+          },
+        };
+
+        const disposer = realPlugin.onRoutesReady(customRoutesCtx);
+        if (typeof disposer === 'function' && routesCtx.onDispose) {
+          routesCtx.onDispose(disposer);
+        }
+      }
+
+      // 4. Update exposed API
+      if (realPlugin.api && lazyWrapper.api) {
+        Object.assign(lazyWrapper.api, realPlugin.api);
+      }
+
+      // 5. Fire optional callback
+      if (typeof lazyOptions.onHydrate === 'function') {
+        try {
+          lazyOptions.onHydrate(realPlugin);
+        } catch (_) {}
+      }
+
+      isHydrated = true;
+      return realPlugin;
+    } finally {
+      isHydrating = false;
+    }
+  }
+
+  // Create API Proxy that auto-hydrates on property access
+  const apiProxy = new Proxy({}, {
+    get(target, prop, receiver) {
+      if (prop === '_isLazyProxy') return true;
+      if (prop === 'hydrate') return hydrate;
+      if (prop === 'isHydrated') return isHydrated;
+      hydrate();
+      if (realPlugin && realPlugin.api) {
+        const val = Reflect.get(realPlugin.api, prop, receiver);
+        return typeof val === 'function' ? val.bind(realPlugin.api) : val;
+      }
+      return Reflect.get(target, prop, receiver);
+    },
+    has(target, prop) {
+      hydrate();
+      return realPlugin && realPlugin.api ? Reflect.has(realPlugin.api, prop) : Reflect.has(target, prop);
+    },
+    set(target, prop, value, receiver) {
+      hydrate();
+      if (realPlugin && realPlugin.api) {
+        return Reflect.set(realPlugin.api, prop, value, receiver);
+      }
+      return Reflect.set(target, prop, value, receiver);
+    },
+  });
+
+  const lazyWrapper = {
+    name,
+    version: lazyOptions.version || (typeof pluginFactory === 'object' && pluginFactory?.version) || '1.0.0',
+    dependencies: lazyOptions.dependencies || (typeof pluginFactory === 'object' && pluginFactory?.dependencies) || {},
+    csp: lazyOptions.csp || (typeof pluginFactory === 'object' && pluginFactory?.csp) || null,
+    isLazy: true,
+    get isHydrated() { return isHydrated; },
+    hydrate,
+    api: apiProxy,
+
+    register(ctx) {
+      regCtx = ctx;
+
+      // Register proxy services in app service registry
+      if (ctx.app && ctx.app.serviceRegistry && lazyServices.length > 0) {
+        for (const svcName of lazyServices) {
+          if (!ctx.app.serviceRegistry.has(svcName)) {
+            const proxyHandler = async (input, serviceCtx) => {
+              hydrate();
+              const realDef = ctx.app.serviceRegistry.get(svcName);
+              if (realDef && typeof realDef.handler === 'function' && realDef.handler !== proxyHandler) {
+                return typeof realDef.rawHandler === 'function'
+                  ? realDef.rawHandler(input, serviceCtx)
+                  : realDef.handler(input, serviceCtx);
+              }
+              return null;
+            };
+
+            ctx.app.serviceRegistry.register(
+              svcName,
+              { handler: proxyHandler },
+              { overwrite: true }
+            );
+          }
+        }
+      }
+
+      // Register proxy helpers in template engine
+      if (typeof ctx.addHelper === 'function' && lazyHelpers.length > 0) {
+        for (const helperName of lazyHelpers) {
+          ctx.addHelper(helperName, (...args) => {
+            hydrate();
+            const helpers = regCtx?.pluginManager?.getHelpers ? regCtx.pluginManager.getHelpers() : {};
+            if (typeof helpers[helperName] === 'function') {
+              return helpers[helperName](...args);
+            }
+          });
+        }
+      }
+
+      // Wire event triggers if eventDispatcher is available
+      if (ctx.app?.events && lazyEvents.length > 0) {
+        for (const eventName of lazyEvents) {
+          ctx.app.events.on(eventName, () => {
+            hydrate();
+          });
+        }
+      }
+    },
+
+    onRoutesReady(ctx) {
+      routesCtx = ctx;
+
+      if (!ctx.app) return;
+
+      // Mount lazy trigger router for each prefix
+      for (const prefix of prefixes) {
+        ctx.app.use(prefix, (req, res, next) => {
+          if (!isHydrated) {
+            hydrate();
+          }
+          router(req, res, next);
+        });
+      }
+    },
+  };
+
+  return lazyWrapper;
+}
+
+module.exports = {
+  lazyPlugin,
+  defineLazyPlugin: lazyPlugin,
+};

package/plugins/site-analytics/bot-patterns.js

@@ -27,9 +27,12 @@ const BOT_PATTERNS = [
   { pattern: /petalbot/i, name: 'PetalBot' },
   { pattern: /gptbot/i, name: 'GPTBot' },
   { pattern: /claudebot/i, name: 'ClaudeBot' },
+  { pattern: /amazonbot/i, name: 'Amazon' },
   { pattern: /anthropic/i, name: 'Anthropic' },
   { pattern: /ccbot/i, name: 'CCBot' },
   { pattern: /bytespider/i, name: 'ByteSpider' },
+  { pattern: /dataforseo/i, name: 'DataForSEO' },
+  { pattern: /yisouspider/i, name: 'Yisou' },
   { pattern: /open-research-bot/i, name: 'open-research-bot' },
   { pattern: /ptb12/i, name: 'PTB12' },
   { pattern: /curl\//i, name: 'curl' },

package/plugins/site-analytics/client-error-handler.js

@@ -4,6 +4,8 @@
  * @module plugins/site-analytics/client-error-handler
  */
 
+const { formatDbError } = require('./tracking');
+
 const DEFAULT_TABLE = 'analytics_client_errors';
 
 /**
@@ -71,7 +73,7 @@ function createErrorReportHandler(options) {
 
       res.status(202).json({ ok: true });
     } catch (e) {
-      console.error('[site-analytics] Client error report failed:', e.message);
+      console.error('[site-analytics] Client error report failed:', formatDbError(e));
       res.status(500).json({ error: 'Report failed' });
     }
   };

package/plugins/site-analytics/index.js

@@ -140,6 +140,8 @@ function siteAnalyticsPlugin(options = {}) {
     }
   }
 
+  let trackingMiddleware = null;
+
   return {
     name: 'site-analytics',
     version: '1.0.0',
@@ -177,13 +179,17 @@ function siteAnalyticsPlugin(options = {}) {
     register(ctx) {
       const knex = db.knex || db;
 
-      const trackingMiddleware = createTrackingMiddleware({
+      trackingMiddleware = createTrackingMiddleware({
         knex,
         excludePaths,
         trackBots,
         tableName,
         batchSize: options.batchSize ?? 20,
         flushIntervalMs: options.flushIntervalMs ?? 3000,
+        maxRetries: options.maxRetries ?? 3,
+        maxBackoffMs: options.maxBackoffMs ?? 60000,
+        maxQueueSize: options.maxQueueSize ?? 5000,
+        errorLogIntervalMs: options.errorLogIntervalMs ?? 60000,
       });
 
       ctx.app.use(trackingMiddleware);
@@ -199,15 +205,18 @@ function siteAnalyticsPlugin(options = {}) {
 
       return () => {
         stopCleanup();
+        if (trackingMiddleware && trackingMiddleware.stop) trackingMiddleware.stop();
       };
     },
 
     dispose() {
       stopCleanup();
+      if (trackingMiddleware && trackingMiddleware.stop) trackingMiddleware.stop();
     },
 
     shutdown() {
       stopCleanup();
+      if (trackingMiddleware && trackingMiddleware.stop) trackingMiddleware.stop();
     },
 
     onRoutesReady(ctx) {