webspresso 0.0.102 → 0.0.104

package/index.js

@@ -219,6 +219,12 @@ module.exports = {
   defineSignal: require('./core/events').defineSignal,
   defineListener: require('./core/events').defineListener,
   loadListeners: require('./core/events').loadListeners,
+
+  // Shared Fetch, Crypto & HTML Utilities
+  fetchWithTimeout: require('./core/utils/fetch').fetchWithTimeout,
+  safeCompare: require('./core/utils/crypto').safeCompare,
+  escapeHtml: require('./core/utils/html').escapeHtml,
+  unescapeHtml: require('./core/utils/html').unescapeHtml,
 };
 
 // Define lazy getters for plugins, ORM, and heavy core subsystems
@@ -319,6 +325,10 @@ Object.defineProperties(module.exports, {
   generateQrDataUri: { get: () => require('./core/auth/qrcode').generateQrDataUri, enumerable: true, configurable: true },
   createAuthMiddleware: { get: () => require('./core/auth').createAuthMiddleware, enumerable: true, configurable: true },
   setupAuthMiddleware: { get: () => require('./core/auth').setupAuthMiddleware, enumerable: true, configurable: true },
+  getClientIp: { get: () => require('./core/utils/ip').getClientIp, enumerable: true, configurable: true },
+  parseUserAgent: { get: () => require('./core/auth').parseUserAgent, enumerable: true, configurable: true },
+  sessions: { get: () => require('./core/auth').sessions, enumerable: true, configurable: true },
+  SessionManager: { get: () => require('./core/auth').SessionManager, enumerable: true, configurable: true },
 
   // Validation
   z: { get: () => require('./core/validation').z, enumerable: true, configurable: true },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.102",
+  "version": "0.0.104",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",
@@ -176,6 +176,7 @@
     "dotenv": "^16.3.1",
     "express-rate-limit": "^8.4.1",
     "release-it": "^20.2.1",
+    "softscope": "^0.3.2",
     "supertest": "^6.3.4",
     "typescript": "~5.6.3",
     "vitest": "^4.1.11",

package/plugins/admin-panel/auth.js

@@ -115,13 +115,21 @@ async function login(adminUserRepo, email, password, compare) {
  */
 async function logout(req, res) {
   return new Promise((resolve, reject) => {
-    req.session.destroy((err) => {
-      if (err) {
-        reject(err);
-      } else {
-        resolve();
-      }
-    });
+    if (!req || !req.session) {
+      return resolve();
+    }
+    if (typeof req.session.destroy === 'function') {
+      req.session.destroy((err) => {
+        if (err) {
+          reject(err);
+        } else {
+          resolve();
+        }
+      });
+    } else {
+      delete req.session.adminUser;
+      resolve();
+    }
   });
 }
 

package/plugins/admin-panel/client/parts/01-state-api-breadcrumb.js

@@ -1,14 +1,82 @@
 
+/**
+ * Shared client-side fetch wrapper with AbortController, timeout, and signal composition.
+ * @param {string} url
+ * @param {RequestInit & { timeout?: number }} [options]
+ * @returns {Promise<Response>}
+ */
+async function fetchWithTimeout(url, options = {}) {
+  const { timeout = 30000, signal, ...fetchOptions } = options;
+
+  if (signal && signal.aborted) {
+    const reason = (signal.reason !== undefined && signal.reason !== null)
+      ? signal.reason
+      : new Error('This operation was aborted');
+    throw reason;
+  }
+
+  if (typeof AbortController === 'undefined') {
+    return fetch(url, { ...fetchOptions, signal });
+  }
+
+  const controller = new AbortController();
+  let timer = null;
+  let callerSignalListener = null;
+
+  if (typeof timeout === 'number' && timeout > 0 && typeof setTimeout !== 'undefined') {
+    timer = setTimeout(() => {
+      const err = new Error('Request timed out after ' + timeout + 'ms');
+      err.name = 'TimeoutError';
+      err.code = 'ETIMEDOUT';
+      controller.abort(err);
+    }, timeout);
+  }
+
+  if (signal) {
+    callerSignalListener = () => {
+      controller.abort(signal.reason);
+    };
+    signal.addEventListener('abort', callerSignalListener, { once: true });
+  }
+
+  try {
+    return await fetch(url, {
+      ...fetchOptions,
+      signal: controller.signal,
+    });
+  } catch (err) {
+    if (controller.signal.aborted && controller.signal.reason) {
+      const reason = controller.signal.reason;
+      if (reason instanceof Error && (reason.name === 'TimeoutError' || reason.code === 'ETIMEDOUT')) {
+        throw reason;
+      }
+    }
+    if (err && err.name === 'AbortError' && controller.signal.aborted && controller.signal.reason) {
+      throw controller.signal.reason;
+    }
+    throw err;
+  } finally {
+    if (timer) clearTimeout(timer);
+    if (signal && callerSignalListener) {
+      signal.removeEventListener('abort', callerSignalListener);
+    }
+  }
+}
+
 // API helper
 const api = {
+  fetch: fetchWithTimeout,
   async request(path, options = {}) {
     const adminPath = window.__ADMIN_PATH__ || '/_admin';
     const url = adminPath + '/api' + path;
-    const response = await fetch(url, {
-      ...options,
+    const { timeout = 30000, signal, ...fetchOpts } = options;
+    const response = await fetchWithTimeout(url, {
+      ...fetchOpts,
+      timeout,
+      signal,
       headers: {
         'Content-Type': 'application/json',
-        ...options.headers,
+        ...fetchOpts.headers,
       },
       credentials: 'include',
     });
@@ -28,20 +96,24 @@ const api = {
     return response.json();
   },
   
-  get(path) { return this.request(path, { method: 'GET' }); },
-  post(path, data) { return this.request(path, { method: 'POST', body: JSON.stringify(data) }); },
-  put(path, data) { return this.request(path, { method: 'PUT', body: JSON.stringify(data) }); },
-  delete(path) { return this.request(path, { method: 'DELETE' }); },
+  get(path, options) { return this.request(path, { ...options, method: 'GET' }); },
+  post(path, data, options) { return this.request(path, { ...options, method: 'POST', body: JSON.stringify(data) }); },
+  put(path, data, options) { return this.request(path, { ...options, method: 'PUT', body: JSON.stringify(data) }); },
+  delete(path, options) { return this.request(path, { ...options, method: 'DELETE' }); },
 };
 
 /** POST /data-exchange/export/:model — validates JSON errors vs .xlsx blob */
-async function downloadDataExchangeXlsx(modelName, payload) {
+async function downloadDataExchangeXlsx(modelName, payload, options = {}) {
   const adminPath = window.__ADMIN_PATH__ || '/_admin';
-  const res = await fetch(adminPath + '/api/data-exchange/export/' + modelName, {
+  const { timeout = 60000, signal, headers = {}, ...restOpts } = options;
+  const res = await fetchWithTimeout(adminPath + '/api/data-exchange/export/' + modelName, {
     method: 'POST',
     credentials: 'include',
-    headers: { 'Content-Type': 'application/json' },
+    headers: { 'Content-Type': 'application/json', ...headers },
     body: JSON.stringify(payload),
+    timeout,
+    signal,
+    ...restOpts,
   });
   const ct = (res.headers.get('content-type') || '').toLowerCase();
   if (!res.ok || ct.indexOf('spreadsheet') === -1) {

package/plugins/admin-panel/client/parts/05-rich-text-file-helpers.js

@@ -572,7 +572,8 @@ async function handleAdminFileUpload(file, onChange, meta, state) {
   var fd = new FormData();
   fd.append('file', file);
   try {
-    var res = await fetch(uploadUrl, { method: 'POST', body: fd, credentials: 'include' });
+    var fetchFn = (typeof fetchWithTimeout === 'function' ? fetchWithTimeout : fetch);
+    var res = await fetchFn(uploadUrl, { method: 'POST', body: fd, credentials: 'include', timeout: 60000 });
     var data = {};
     try { data = await res.json(); } catch (e2) { data = {}; }
     if (!res.ok) {
@@ -619,7 +620,8 @@ async function handleAdminMultipleFilesUpload(files, onChange, meta, state, curr
       var fd = new FormData();
       fd.append('file', file);
       try {
-        var res = await fetch(uploadUrl, { method: 'POST', body: fd, credentials: 'include' });
+        var fetchFn = (typeof fetchWithTimeout === 'function' ? fetchWithTimeout : fetch);
+        var res = await fetchFn(uploadUrl, { method: 'POST', body: fd, credentials: 'include', timeout: 60000 });
         var data = {};
         try { data = await res.json(); } catch (_) { data = {}; }
         if (res.ok && (data.url || data.publicUrl)) {

package/plugins/admin-panel/client/parts/08-record-list.js

@@ -316,10 +316,11 @@ const RecordList = {
               const fd = new FormData();
               fd.append('file', file);
               try {
-                const res = await fetch(
+                const fetchFn = (typeof fetchWithTimeout === 'function' ? fetchWithTimeout : fetch);
+                const res = await fetchFn(
                   adminPath + '/api/data-exchange/import/' + modelName +
                     '?mode=' + encodeURIComponent(mode) + '&upsertKey=' + encodeURIComponent(upsertKey),
-                  { method: 'POST', body: fd, credentials: 'include' }
+                  { method: 'POST', body: fd, credentials: 'include', timeout: 60000 }
                 );
                 const body = await res.json().catch(function () { return ({}); });
                 if (!res.ok) {

package/plugins/admin-panel/client/parts/10-export-registry.js

@@ -8,6 +8,8 @@ window.__ADMIN_COMPONENTS__ = {
   RecordForm,
   api,
   state,
+  fetch: typeof fetchWithTimeout !== 'undefined' ? fetchWithTimeout : undefined,
+  fetchWithTimeout: typeof fetchWithTimeout !== 'undefined' ? fetchWithTimeout : undefined,
   notify: typeof window !== 'undefined' ? window.notify : undefined,
   confirmModal: typeof window !== 'undefined' ? window.confirmModal : undefined,
   toastState: typeof window !== 'undefined' ? window.toastState : undefined,
@@ -22,6 +24,10 @@ if (typeof window !== 'undefined') {
   window.Admin = window.Admin || {};
   window.Admin.api = api;
   window.Admin.state = state;
+  if (typeof fetchWithTimeout !== 'undefined') {
+    window.Admin.fetch = fetchWithTimeout;
+    window.Admin.fetchWithTimeout = fetchWithTimeout;
+  }
   if (typeof window.AdminUI !== 'undefined') {
     window.Admin.ui = window.AdminUI;
   }

package/plugins/admin-panel/core/api-extensions.js

@@ -7,6 +7,7 @@
 const os = require('os');
 const https = require('https');
 const { sanitizeForOutput } = require('../../../core/orm/utils');
+const { buildFilteredQuery } = require('../../../core/orm/query-filters');
 
 function getWebspressoVersion() {
   try {
@@ -115,82 +116,7 @@ function formatBytes(bytes) {
   return (bytes / (1024 * 1024)).toFixed(1) + ' MB';
 }
 
-/**
- * Build query with filters applied
- * @param {Object} repo - Repository instance
- * @param {Object} filters - Filter object from frontend
- * @param {Object} [options] - Options
- * @param {boolean} [options.onlyTrashed] - For soft delete: only trashed records
- * @returns {Object} Query builder with filters applied
- */
-function buildFilteredQuery(repo, filters, options = {}) {
-  let query = repo.query();
-  if (options.onlyTrashed) {
-    query = query.onlyTrashed();
-  }
-  
-  if (!filters || Object.keys(filters).length === 0) {
-    return query;
-  }
-  
-  for (const [column, filter] of Object.entries(filters)) {
-    if (!filter) continue;
-
-    const op = filter.op || filter.operator || 'contains';
 
-    if (op === 'is_null') {
-      query = query.whereNull(column);
-      continue;
-    }
-    if (op === 'is_not_null') {
-      query = query.whereNotNull(column);
-      continue;
-    }
-
-    if (filter.value === '' && !filter.from && !filter.to) continue;
-
-    switch (op) {
-      case 'contains':
-        query = query.where(column, 'like', `%${filter.value}%`);
-        break;
-      case 'equals':
-        query = query.where(column, '=', filter.value);
-        break;
-      case 'starts_with':
-        query = query.where(column, 'like', `${filter.value}%`);
-        break;
-      case 'ends_with':
-        query = query.where(column, 'like', `%${filter.value}`);
-        break;
-      case 'eq':
-        query = query.where(column, '=', filter.value);
-        break;
-      case 'gt':
-        query = query.where(column, '>', filter.value);
-        break;
-      case 'gte':
-        query = query.where(column, '>=', filter.value);
-        break;
-      case 'lt':
-        query = query.where(column, '<', filter.value);
-        break;
-      case 'lte':
-        query = query.where(column, '<=', filter.value);
-        break;
-      case 'between':
-        if (filter.from) query = query.where(column, '>=', filter.from);
-        if (filter.to) query = query.where(column, '<=', filter.to);
-        break;
-      case 'in':
-        if (Array.isArray(filter.value) && filter.value.length > 0) {
-          query = query.whereIn(column, filter.value);
-        }
-        break;
-    }
-  }
-  
-  return query;
-}
 
 /**
  * Get all record IDs matching filters (for selectAll mode)

package/plugins/admin-panel/lib/login-rate-limiter.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { getClientIp } = require('../../../core/utils/ip');
+
 /**
  * In-memory brute-force rate limiter for admin login.
  * Zero external dependencies.
@@ -20,19 +22,7 @@ class LoginRateLimiter {
   }
 
   getClientIp(req) {
-    if (!req) return '127.0.0.1';
-    if (req.ip) return String(req.ip);
-    if (req.headers && req.headers['x-forwarded-for']) {
-      const forwarded = String(req.headers['x-forwarded-for']).split(',')[0].trim();
-      if (forwarded) return forwarded;
-    }
-    if (req.connection && req.connection.remoteAddress) {
-      return String(req.connection.remoteAddress);
-    }
-    if (req.socket && req.socket.remoteAddress) {
-      return String(req.socket.remoteAddress);
-    }
-    return '127.0.0.1';
+    return getClientIp(req);
   }
 
   isBlocked(req) {
@@ -111,6 +101,18 @@ class LoginRateLimiter {
         this.attempts.delete(ip);
       }
     }
+
+    // Hard ceiling to prevent unbounded memory growth under distributed IP attacks
+    const MAX_ENTRIES = 5000;
+    if (this.attempts.size > MAX_ENTRIES) {
+      const excess = this.attempts.size - MAX_ENTRIES;
+      let count = 0;
+      for (const ip of this.attempts.keys()) {
+        this.attempts.delete(ip);
+        count++;
+        if (count >= excess) break;
+      }
+    }
   }
 }
 

package/plugins/api-key/crypto.js

@@ -8,30 +8,7 @@
 
 const crypto = require('crypto');
 
-/**
- * Compare two strings in constant time to prevent timing attacks.
- * Uses dummy buffer comparison if lengths differ to avoid leaking length via response timing.
- * 
- * @param {string} a
- * @param {string} b
- * @returns {boolean}
- */
-function safeCompare(a, b) {
-  if (typeof a !== 'string' || typeof b !== 'string') {
-    return false;
-  }
-
-  const bufA = Buffer.from(a, 'utf8');
-  const bufB = Buffer.from(b, 'utf8');
-
-  if (bufA.length !== bufB.length) {
-    // Perform dummy timing-safe comparison with itself to preserve constant execution time
-    crypto.timingSafeEqual(bufA, bufA);
-    return false;
-  }
-
-  return crypto.timingSafeEqual(bufA, bufB);
-}
+const { safeCompare } = require('../../core/utils/crypto');
 
 /**
  * Hash a raw API key using SHA-256

package/plugins/audit-log/api-handlers.js

@@ -66,8 +66,18 @@ function createAuditLogHandlers(options) {
         .offset((page - 1) * perPage)
         .limit(perPage);
 
+      const normalizedRows = rows.map((r) => {
+        let parsedMetadata = r.metadata;
+        if (typeof parsedMetadata === 'string') {
+          try {
+            parsedMetadata = JSON.parse(parsedMetadata);
+          } catch {}
+        }
+        return { ...r, metadata: parsedMetadata };
+      });
+
       res.json({
-        data: rows,
+        data: normalizedRows,
         meta: { page, perPage, total },
       });
     } catch (err) {

package/plugins/audit-log/middleware.js

@@ -4,6 +4,7 @@
  */
 
 const { parseAdminModelAudit } = require('./parse');
+const { getClientIp } = require('../../core/utils/ip');
 
 function stringifyId(val) {
   if (val === undefined || val === null) {
@@ -81,6 +82,14 @@ function createAuditMiddleware(options) {
         }
 
         const metadata = buildMetadata(action, req);
+        let metadataVal = metadata || null;
+        if (metadataVal && typeof metadataVal === 'object') {
+          const clientName = knex?.client?.config?.client || '';
+          if (typeof clientName === 'string' && clientName.includes('sqlite')) {
+            metadataVal = JSON.stringify(metadataVal);
+          }
+        }
+
         const pathStr = (req.originalUrl || req.url || req.path || '').slice(0, 2000);
         const row = {
           actor_id: actor.id != null ? Number(actor.id) : null,
@@ -90,16 +99,14 @@ function createAuditMiddleware(options) {
           resource_id: resourceId,
           http_method: req.method,
           path: pathStr,
-          ip: req.ip || (req.connection && req.connection.remoteAddress) || null,
+          ip: getClientIp(req, null),
           user_agent: req.get && req.get('user-agent') ? req.get('user-agent').slice(0, 2000) : null,
-          metadata: metadata || null,
+          metadata: metadataVal,
         };
 
-        knex(tableName).insert(row).catch((err) => {
-          console.warn('[audit-log] Failed to insert audit row:', err.message);
-        });
+        knex(tableName).insert(row).catch(logAuditError);
       } catch (e) {
-        console.warn('[audit-log] finish handler error:', e.message);
+        logAuditError(e, 'finish handler error');
       }
     });
 
@@ -107,9 +114,46 @@ function createAuditMiddleware(options) {
   };
 }
 
+let lastAuditWarnTime = 0;
+let suppressedAuditErrors = 0;
+
+/**
+ * Format and sanitize DB errors to prevent leaking raw SQL queries
+ * @param {Error|Object|string} e
+ * @returns {string}
+ */
+function formatDbError(e) {
+  if (!e) return 'Unknown error';
+  let msg;
+  if (typeof e.message === 'string' && e.message.includes(' - ')) {
+    msg = e.message.split(' - ').pop().trim();
+  } else {
+    msg = String(e.code || e.message || 'Database error');
+  }
+  return msg.replace(/[\r\n]+/g, ' ').trim().slice(0, 150);
+}
+
+function logAuditError(err, prefix = 'Failed to insert audit row') {
+  const now = Date.now();
+  const formatted = formatDbError(err);
+  if (lastAuditWarnTime === 0 || now - lastAuditWarnTime >= 60000) {
+    const elapsedSec = lastAuditWarnTime > 0 ? Math.round((now - lastAuditWarnTime) / 1000) : 0;
+    if (suppressedAuditErrors > 0) {
+      console.warn(`[audit-log] ${prefix} (suppressed ${suppressedAuditErrors} occurrences in last ${elapsedSec}s): ${formatted}`);
+    } else {
+      console.warn(`[audit-log] ${prefix}: ${formatted}`);
+    }
+    lastAuditWarnTime = now;
+    suppressedAuditErrors = 0;
+  } else {
+    suppressedAuditErrors++;
+  }
+}
+
 module.exports = {
   createAuditMiddleware,
   stringifyId,
   extractResourceIdFromJsonBody,
   buildMetadata,
+  formatDbError,
 };

package/plugins/basic-auth/index.js

@@ -4,32 +4,7 @@
  * @module plugins/basic-auth
  */
 
-const crypto = require('crypto');
-
-/**
- * Compare two strings in constant time to prevent timing attacks.
- * Uses dummy buffer comparison if lengths differ to avoid leaking length via response timing.
- * 
- * @param {string} a
- * @param {string} b
- * @returns {boolean}
- */
-function safeCompare(a, b) {
-  if (typeof a !== 'string' || typeof b !== 'string') {
-    return false;
-  }
-
-  const bufA = Buffer.from(a, 'utf8');
-  const bufB = Buffer.from(b, 'utf8');
-
-  if (bufA.length !== bufB.length) {
-    // Perform dummy timing-safe comparison with itself to preserve constant execution time
-    crypto.timingSafeEqual(bufA, bufA);
-    return false;
-  }
-
-  return crypto.timingSafeEqual(bufA, bufB);
-}
+const { safeCompare } = require('../../core/utils/crypto');
 
 /**
  * Parse an HTTP Authorization header for Basic credentials.
@@ -69,6 +44,7 @@ function parseBasicAuthHeader(header) {
  * @returns {{ username: string, password: string } | null}
  */
 function extractCredentials(req) {
+  if (!req || !req.headers) return null;
   const header = req.headers.authorization || req.headers.Authorization;
   return parseBasicAuthHeader(header);
 }

package/plugins/cors.js

@@ -105,7 +105,7 @@ function createCorsMiddleware(options = {}) {
       return next();
     }
 
-    const reqOrigin = req.headers.origin;
+    const reqOrigin = req.headers?.origin;
 
     isOriginAllowed(reqOrigin, (err, allowedOrigin) => {
       if (err) {
@@ -134,7 +134,7 @@ function createCorsMiddleware(options = {}) {
           }
           if (allowedHeadersStr) {
             res.setHeader('Access-Control-Allow-Headers', allowedHeadersStr);
-          } else if (req.headers['access-control-request-headers']) {
+          } else if (req.headers?.['access-control-request-headers']) {
             res.setHeader('Access-Control-Allow-Headers', req.headers['access-control-request-headers']);
           }
           if (config.maxAge) {

package/plugins/csrf/index.js

@@ -15,21 +15,7 @@ const NOOP = () => {};
 const EMPTY_OBJECT = Object.freeze({});
 const ignoreRegexCache = new Map();
 
-/**
- * Compare two strings in constant time to prevent timing attacks
- * @param {string} a
- * @param {string} b
- * @returns {boolean}
- */
-function safeCompare(a, b) {
-  if (typeof a !== 'string' || typeof b !== 'string') return false;
-  if (a.length !== b.length) return false;
-  try {
-    return crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));
-  } catch (err) {
-    return false;
-  }
-}
+const { safeCompare } = require('../../core/utils/crypto');
 
 /**
  * Check if the request path matches any ignore patterns
@@ -241,3 +227,5 @@ function csrfPlugin(options = {}) {
 
 module.exports = csrfPlugin;
 module.exports.csrfPlugin = csrfPlugin;
+module.exports.safeCompare = safeCompare;
+csrfPlugin.safeCompare = safeCompare;

package/plugins/email/service.js

@@ -30,6 +30,37 @@ function createEmailService(options) {
     console.warn('[email]', err.message);
   }
 
+  let lastEmailLogWarnTime = 0;
+  let suppressedEmailLogErrors = 0;
+
+  function formatDbError(e) {
+    if (!e) return 'Unknown error';
+    let msg;
+    if (typeof e.message === 'string' && e.message.includes(' - ')) {
+      msg = e.message.split(' - ').pop().trim();
+    } else {
+      msg = String(e.code || e.message || 'Database error');
+    }
+    return msg.replace(/[\r\n]+/g, ' ').trim().slice(0, 150);
+  }
+
+  function logEmailError(err) {
+    const now = Date.now();
+    const formatted = formatDbError(err);
+    if (lastEmailLogWarnTime === 0 || now - lastEmailLogWarnTime >= 60000) {
+      const elapsedSec = lastEmailLogWarnTime > 0 ? Math.round((now - lastEmailLogWarnTime) / 1000) : 0;
+      if (suppressedEmailLogErrors > 0) {
+        console.warn(`[email] Failed to write email log (suppressed ${suppressedEmailLogErrors} occurrences in last ${elapsedSec}s): ${formatted}`);
+      } else {
+        console.warn('[email] Failed to write email log:', formatted);
+      }
+      lastEmailLogWarnTime = now;
+      suppressedEmailLogErrors = 0;
+    } else {
+      suppressedEmailLogErrors++;
+    }
+  }
+
   /**
    * @param {Object} row
    */
@@ -49,7 +80,7 @@ function createEmailService(options) {
         created_at: new Date(),
       });
     } catch (err) {
-      console.warn('[email] Failed to write email log:', err.message);
+      logEmailError(err);
     }
   }