webspresso 0.0.102 → 0.0.103

package/core/orm/types.js

@@ -150,12 +150,23 @@
 // Model Types
 // ============================================================================
 
+/**
+ * @typedef {Object} ModelConfigOptions
+ * @property {boolean|{createdAt?: string, updatedAt?: string, snakeCase?: boolean}} [timestamps=false] - Auto timestamps
+ * @property {boolean|{deletedAt?: string, snakeCase?: boolean}} [softDelete=false] - Soft delete support
+ * @property {boolean|{deletedAt?: string, snakeCase?: boolean}} [softDeletes=false] - Soft delete support alias
+ */
+
 /**
  * @typedef {Object} ModelOptions
  * @property {string} name - Model name (e.g., 'User')
  * @property {string} table - Database table name (e.g., 'users')
- * @property {import('zod').ZodObject} schema - Zod schema for validation
+ * @property {import('zod').ZodObject|Record<string, any>} schema - Zod schema or plain object schema shape
  * @property {string} [primaryKey='id'] - Primary key column name
+ * @property {boolean|{createdAt?: string, updatedAt?: string, snakeCase?: boolean}} [timestamps] - Auto timestamps (injects createdAt/updatedAt)
+ * @property {boolean|{deletedAt?: string, snakeCase?: boolean}} [softDelete] - Soft delete support (injects deletedAt)
+ * @property {boolean|{deletedAt?: string, snakeCase?: boolean}} [softDeletes] - Soft delete support alias
+ * @property {ModelConfigOptions} [options] - Additional model options (e.g. timestamps, softDelete)
  * @property {RelationsMap} [relations={}] - Relation definitions
  * @property {ScopeOptions} [scopes={}] - Scope options
  * @property {AdminMetadata} [admin] - Admin panel metadata

package/core/queue/manager.js

@@ -527,6 +527,11 @@ class QueueManager extends EventEmitter {
       }
     } catch (err) {
       this.emit('error', err);
+      // Back off polling interval on database or adapter error to avoid tight spin-loop
+      this._currentPollInterval = Math.min(
+        this.maxPollInterval,
+        Math.round(this._currentPollInterval * 2)
+      );
       this._scheduleNextTick(this._currentPollInterval);
       return;
     }

package/core/validation/index.js

@@ -22,13 +22,19 @@ function hasDangerousKeys(obj) {
     return false;
   }
   if (Array.isArray(obj)) {
-    return obj.some(item => hasDangerousKeys(item));
+    const len = obj.length;
+    for (let i = 0; i < len; i++) {
+      if (hasDangerousKeys(obj[i])) return true;
+    }
+    return false;
   }
-  for (const key of Object.keys(obj)) {
+  for (const key in obj) {
+    if (!Object.prototype.hasOwnProperty.call(obj, key)) continue;
     if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
       return true;
     }
-    if (typeof obj[key] === 'object' && obj[key] !== null && hasDangerousKeys(obj[key])) {
+    const val = obj[key];
+    if (val !== null && typeof val === 'object' && hasDangerousKeys(val)) {
       return true;
     }
   }

package/index.d.ts

@@ -1072,11 +1072,20 @@ export type InferModel<T> = T extends ModelDefinition<infer TModel>
 export type InferModelCreate<T> = Partial<InferModel<T>> & Record<string, any>;
 export type InferModelUpdate<T> = Partial<InferModel<T>>;
 
-export interface ModelOptions<TSchema extends ZodObject<any> = ZodObject<Record<string, ZodTypeAny>>> {
+export interface ModelOptions<TSchema = ZodObject<Record<string, ZodTypeAny>>> {
   name: string;
   table: string;
-  schema: TSchema;
+  schema: TSchema | Record<string, any>;
   primaryKey?: string;
+  timestamps?: boolean | { createdAt?: string; updatedAt?: string; snakeCase?: boolean };
+  softDelete?: boolean | { deletedAt?: string; snakeCase?: boolean };
+  softDeletes?: boolean | { deletedAt?: string; snakeCase?: boolean };
+  options?: {
+    timestamps?: boolean | { createdAt?: string; updatedAt?: string; snakeCase?: boolean };
+    softDelete?: boolean | { deletedAt?: string; snakeCase?: boolean };
+    softDeletes?: boolean | { deletedAt?: string; snakeCase?: boolean };
+    [key: string]: unknown;
+  };
   relations?: Record<string, RelationDefinition>;
   scopes?: ScopeOptions;
   admin?: AdminMetadata;
@@ -1104,6 +1113,11 @@ export interface ModelDefinition<TModel = Record<string, any>> {
     timestamps: boolean;
     tenant: string | null;
   };
+  options?: {
+    timestamps?: boolean | { createdAt?: string; updatedAt?: string; snakeCase?: boolean };
+    softDelete?: boolean | { deletedAt?: string; snakeCase?: boolean };
+    [key: string]: unknown;
+  };
   columns: Map<string, unknown>;
   admin: {
     enabled: boolean;
@@ -1129,9 +1143,9 @@ export interface ModelDefinition<TModel = Record<string, any>> {
   cache?: boolean | 'auto' | 'smart' | { strategy: 'auto' | 'smart' };
 }
 
-export function defineModel<TSchema extends ZodObject<any>>(
+export function defineModel<TSchema = ZodObject<any>>(
   options: ModelOptions<TSchema>
-): ModelDefinition<import('zod').z.infer<TSchema>>;
+): ModelDefinition<any>;
 
 export function getModel<T = Record<string, any>>(name: string): ModelDefinition<T> | undefined;
 
@@ -1147,7 +1161,10 @@ export function isCascadeEnabled(relation: RelationDefinition, operation: 'delet
 
 /** zdb column helpers (id, string, timestamp, …) + `schema()` */
 export type Zdb = Record<string, any> & {
-  schema(shape: Record<string, ZodTypeAny>): ZodObject<Record<string, ZodTypeAny>>;
+  schema(shape: Record<string, any>): ZodObject<Record<string, ZodTypeAny>>;
+  timestamps(options?: { snakeCase?: boolean; createdAt?: string; updatedAt?: string }): Record<string, any>;
+  softDelete(options?: Record<string, any>): any;
+  softDeletes(options?: { snakeCase?: boolean; deletedAt?: string }): Record<string, any>;
 };
 
 export const zdb: Zdb;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.102",
+  "version": "0.0.103",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",
@@ -176,6 +176,7 @@
     "dotenv": "^16.3.1",
     "express-rate-limit": "^8.4.1",
     "release-it": "^20.2.1",
+    "softscope": "^0.3.2",
     "supertest": "^6.3.4",
     "typescript": "~5.6.3",
     "vitest": "^4.1.11",

package/plugins/audit-log/middleware.js

@@ -95,11 +95,9 @@ function createAuditMiddleware(options) {
           metadata: metadata || null,
         };
 
-        knex(tableName).insert(row).catch((err) => {
-          console.warn('[audit-log] Failed to insert audit row:', err.message);
-        });
+        knex(tableName).insert(row).catch(logAuditError);
       } catch (e) {
-        console.warn('[audit-log] finish handler error:', e.message);
+        logAuditError(e, 'finish handler error');
       }
     });
 
@@ -107,9 +105,46 @@ function createAuditMiddleware(options) {
   };
 }
 
+let lastAuditWarnTime = 0;
+let suppressedAuditErrors = 0;
+
+/**
+ * Format and sanitize DB errors to prevent leaking raw SQL queries
+ * @param {Error|Object|string} e
+ * @returns {string}
+ */
+function formatDbError(e) {
+  if (!e) return 'Unknown error';
+  let msg;
+  if (typeof e.message === 'string' && e.message.includes(' - ')) {
+    msg = e.message.split(' - ').pop().trim();
+  } else {
+    msg = String(e.code || e.message || 'Database error');
+  }
+  return msg.replace(/[\r\n]+/g, ' ').trim().slice(0, 150);
+}
+
+function logAuditError(err, prefix = 'Failed to insert audit row') {
+  const now = Date.now();
+  const formatted = formatDbError(err);
+  if (lastAuditWarnTime === 0 || now - lastAuditWarnTime >= 60000) {
+    const elapsedSec = lastAuditWarnTime > 0 ? Math.round((now - lastAuditWarnTime) / 1000) : 0;
+    if (suppressedAuditErrors > 0) {
+      console.warn(`[audit-log] ${prefix} (suppressed ${suppressedAuditErrors} occurrences in last ${elapsedSec}s): ${formatted}`);
+    } else {
+      console.warn(`[audit-log] ${prefix}: ${formatted}`);
+    }
+    lastAuditWarnTime = now;
+    suppressedAuditErrors = 0;
+  } else {
+    suppressedAuditErrors++;
+  }
+}
+
 module.exports = {
   createAuditMiddleware,
   stringifyId,
   extractResourceIdFromJsonBody,
   buildMetadata,
+  formatDbError,
 };

package/plugins/email/service.js

@@ -30,6 +30,37 @@ function createEmailService(options) {
     console.warn('[email]', err.message);
   }
 
+  let lastEmailLogWarnTime = 0;
+  let suppressedEmailLogErrors = 0;
+
+  function formatDbError(e) {
+    if (!e) return 'Unknown error';
+    let msg;
+    if (typeof e.message === 'string' && e.message.includes(' - ')) {
+      msg = e.message.split(' - ').pop().trim();
+    } else {
+      msg = String(e.code || e.message || 'Database error');
+    }
+    return msg.replace(/[\r\n]+/g, ' ').trim().slice(0, 150);
+  }
+
+  function logEmailError(err) {
+    const now = Date.now();
+    const formatted = formatDbError(err);
+    if (lastEmailLogWarnTime === 0 || now - lastEmailLogWarnTime >= 60000) {
+      const elapsedSec = lastEmailLogWarnTime > 0 ? Math.round((now - lastEmailLogWarnTime) / 1000) : 0;
+      if (suppressedEmailLogErrors > 0) {
+        console.warn(`[email] Failed to write email log (suppressed ${suppressedEmailLogErrors} occurrences in last ${elapsedSec}s): ${formatted}`);
+      } else {
+        console.warn('[email] Failed to write email log:', formatted);
+      }
+      lastEmailLogWarnTime = now;
+      suppressedEmailLogErrors = 0;
+    } else {
+      suppressedEmailLogErrors++;
+    }
+  }
+
   /**
    * @param {Object} row
    */
@@ -49,7 +80,7 @@ function createEmailService(options) {
         created_at: new Date(),
       });
     } catch (err) {
-      console.warn('[email] Failed to write email log:', err.message);
+      logEmailError(err);
     }
   }
 

package/plugins/file-manager/api-handlers.js

@@ -4,15 +4,7 @@
  */
 
 const multer = require('multer');
-const {
-  listFiles,
-  createDirectory,
-  renameItem,
-  deleteItem,
-  moveItem,
-  saveUploadedFile,
-  calculateStorageUsage,
-} = require('./core');
+const core = require('./core');
 
 /**
  * Create Multer middleware for in-memory upload parsing
@@ -71,7 +63,7 @@ function createFileManagerApiHandlers(options = {}) {
   const permissions = options.permissions || null;
   const securityOpts = options.security || {};
 
-  const parseUpload = createUploadMiddleware(maxUploadBytes);
+  const parseUpload = options.uploadMiddleware || createUploadMiddleware(maxUploadBytes);
 
   return {
     async list(req, res) {
@@ -88,7 +80,7 @@ function createFileManagerApiHandlers(options = {}) {
         const page = req.query.page ? parseInt(req.query.page, 10) : undefined;
         const perPage = req.query.perPage ? parseInt(req.query.perPage, 10) : undefined;
 
-        const result = await listFiles(baseDir, relPath, {
+        const result = await core.listFiles(baseDir, relPath, {
           search,
           type,
           sort,
@@ -115,7 +107,7 @@ function createFileManagerApiHandlers(options = {}) {
         if (!name) {
           return res.status(400).json({ success: false, error: 'Directory name is required' });
         }
-        const result = await createDirectory(baseDir, relPath, name);
+        const result = await core.createDirectory(baseDir, relPath, name);
         return res.status(201).json({ success: true, data: result });
       } catch (err) {
         const status = err.statusCode || err.status || 400;
@@ -133,7 +125,7 @@ function createFileManagerApiHandlers(options = {}) {
         if (!itemPath || !newName) {
           return res.status(400).json({ success: false, error: 'Path and newName are required' });
         }
-        const result = await renameItem(baseDir, itemPath, newName);
+        const result = await core.renameItem(baseDir, itemPath, newName);
         return res.json({ success: true, data: result });
       } catch (err) {
         const status = err.statusCode || err.status || 400;
@@ -151,7 +143,7 @@ function createFileManagerApiHandlers(options = {}) {
         if (!source) {
           return res.status(400).json({ success: false, error: 'Source path is required' });
         }
-        const result = await moveItem(baseDir, source, destination);
+        const result = await core.moveItem(baseDir, source, destination);
         return res.json({ success: true, data: result });
       } catch (err) {
         const status = err.statusCode || err.status || 400;
@@ -169,7 +161,7 @@ function createFileManagerApiHandlers(options = {}) {
         if (!itemPath) {
           return res.status(400).json({ success: false, error: 'Path is required' });
         }
-        const result = await deleteItem(baseDir, itemPath);
+        const result = await core.deleteItem(baseDir, itemPath);
         return res.json({ success: true, data: result });
       } catch (err) {
         const status = err.statusCode || err.status || 400;
@@ -199,7 +191,7 @@ function createFileManagerApiHandlers(options = {}) {
 
         // Storage Quota Check
         if (maxTotalStorageBytes && typeof maxTotalStorageBytes === 'number') {
-          const currentUsage = await calculateStorageUsage(baseDir);
+          const currentUsage = await core.calculateStorageUsage(baseDir);
           const incomingBytes = files.reduce((acc, f) => acc + (f.size || f.buffer?.length || 0), 0);
           if (currentUsage + incomingBytes > maxTotalStorageBytes) {
             return res.status(507).json({
@@ -229,7 +221,7 @@ function createFileManagerApiHandlers(options = {}) {
         try {
           const uploaded = [];
           for (const file of files) {
-            const saved = await saveUploadedFile(
+            const saved = await core.saveUploadedFile(
               baseDir,
               targetRelPath,
               file.buffer,
@@ -257,5 +249,6 @@ function createFileManagerApiHandlers(options = {}) {
 
 module.exports = {
   createFileManagerApiHandlers,
+  createUploadMiddleware,
   isActionAllowed,
 };

package/plugins/file-manager/index.js

@@ -114,15 +114,17 @@ function fileManagerPlugin(options = {}) {
       // so window.__openFileManagerPicker is available across all admin pages (models, records, rich-text)
       if (typeof adminApi.getRegistry === 'function') {
         const registry = adminApi.getRegistry();
-        registry.configure({
-          fileManager: {
-            enabled: true,
-            apiPrefix,
-            publicBasePath,
-            pageTitle,
-          },
-        });
-        registry.registerClientComponent('files', componentCode);
+        if (registry) {
+          registry.configure({
+            fileManager: {
+              enabled: true,
+              apiPrefix,
+              publicBasePath,
+              pageTitle,
+            },
+          });
+          registry.registerClientComponent('files', componentCode);
+        }
       }
 
       adminApi.registerModule({

package/plugins/file-manager/security.js

@@ -24,6 +24,16 @@ const DANGEROUS_EXTENSIONS = new Set([
   'htaccess', 'htpasswd', 'ini', 'env', 'config', 'conf', 'passwd', 'shadow',
 ]);
 
+/**
+ * Common safe extensions allowed when passed as raw extensions (without filename dot)
+ */
+const COMMON_SAFE_EXTENSIONS = new Set([
+  'jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'avif', 'bmp', 'ico', 'tiff',
+  'pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'odt', 'ods', 'odp', 'rtf',
+  'txt', 'csv', 'md', 'json', 'xml', 'html', 'css', 'js', 'ts', 'jsx', 'tsx',
+  'sql', 'yaml', 'yml', 'zip', 'tar', 'gz', 'mp3', 'wav', 'mp4', 'mov', 'webm',
+]);
+
 /**
  * Known magic numbers table for high-speed signature verification.
  * Only validates when extension matches known binary format.
@@ -118,9 +128,8 @@ function validateSafeExtension(filename) {
     throw new ValidationError('Filename must have a valid extension');
   }
 
-  // Check all dotted segments against dangerous extensions to block double extensions (e.g. payload.php.jpg)
-  for (let i = 1; i < parts.length; i++) {
-    const segment = parts[i];
+  // Check all segments against dangerous extensions to block double extensions and dangerous dotfiles (e.g. .env, payload.php.jpg)
+  for (const segment of parts) {
     if (DANGEROUS_EXTENSIONS.has(segment)) {
       throw new SecurityError(
         `Dangerous extension or double-extension detected: .${segment}`,
@@ -129,11 +138,14 @@ function validateSafeExtension(filename) {
     }
   }
 
-  const finalExt = parts[parts.length - 1];
-  if (DANGEROUS_EXTENSIONS.has(finalExt)) {
-    throw new SecurityError(`File type .${finalExt} is forbidden for upload`, 403);
+  if (parts.length < 2 && !cleanName.startsWith('.')) {
+    if (COMMON_SAFE_EXTENSIONS.has(parts[0])) {
+      return parts[0];
+    }
+    throw new ValidationError('Filename must have a valid extension');
   }
 
+  const finalExt = parts[parts.length - 1];
   return finalExt;
 }
 

package/plugins/site-analytics/bot-patterns.js

@@ -27,9 +27,12 @@ const BOT_PATTERNS = [
   { pattern: /petalbot/i, name: 'PetalBot' },
   { pattern: /gptbot/i, name: 'GPTBot' },
   { pattern: /claudebot/i, name: 'ClaudeBot' },
+  { pattern: /amazonbot/i, name: 'Amazon' },
   { pattern: /anthropic/i, name: 'Anthropic' },
   { pattern: /ccbot/i, name: 'CCBot' },
   { pattern: /bytespider/i, name: 'ByteSpider' },
+  { pattern: /dataforseo/i, name: 'DataForSEO' },
+  { pattern: /yisouspider/i, name: 'Yisou' },
   { pattern: /open-research-bot/i, name: 'open-research-bot' },
   { pattern: /ptb12/i, name: 'PTB12' },
   { pattern: /curl\//i, name: 'curl' },

package/plugins/site-analytics/client-error-handler.js

@@ -4,6 +4,8 @@
  * @module plugins/site-analytics/client-error-handler
  */
 
+const { formatDbError } = require('./tracking');
+
 const DEFAULT_TABLE = 'analytics_client_errors';
 
 /**
@@ -71,7 +73,7 @@ function createErrorReportHandler(options) {
 
       res.status(202).json({ ok: true });
     } catch (e) {
-      console.error('[site-analytics] Client error report failed:', e.message);
+      console.error('[site-analytics] Client error report failed:', formatDbError(e));
       res.status(500).json({ error: 'Report failed' });
     }
   };

package/plugins/site-analytics/index.js

@@ -140,6 +140,8 @@ function siteAnalyticsPlugin(options = {}) {
     }
   }
 
+  let trackingMiddleware = null;
+
   return {
     name: 'site-analytics',
     version: '1.0.0',
@@ -177,13 +179,17 @@ function siteAnalyticsPlugin(options = {}) {
     register(ctx) {
       const knex = db.knex || db;
 
-      const trackingMiddleware = createTrackingMiddleware({
+      trackingMiddleware = createTrackingMiddleware({
         knex,
         excludePaths,
         trackBots,
         tableName,
         batchSize: options.batchSize ?? 20,
         flushIntervalMs: options.flushIntervalMs ?? 3000,
+        maxRetries: options.maxRetries ?? 3,
+        maxBackoffMs: options.maxBackoffMs ?? 60000,
+        maxQueueSize: options.maxQueueSize ?? 5000,
+        errorLogIntervalMs: options.errorLogIntervalMs ?? 60000,
       });
 
       ctx.app.use(trackingMiddleware);
@@ -199,15 +205,18 @@ function siteAnalyticsPlugin(options = {}) {
 
       return () => {
         stopCleanup();
+        if (trackingMiddleware && trackingMiddleware.stop) trackingMiddleware.stop();
       };
     },
 
     dispose() {
       stopCleanup();
+      if (trackingMiddleware && trackingMiddleware.stop) trackingMiddleware.stop();
     },
 
     shutdown() {
       stopCleanup();
+      if (trackingMiddleware && trackingMiddleware.stop) trackingMiddleware.stop();
     },
 
     onRoutesReady(ctx) {