webspresso 0.0.102 → 0.0.104

package/plugins/file-manager/admin-component.js

@@ -173,10 +173,12 @@ function generateFileManagerComponent(options = {}) {
 
       var uploadUrl = (window.__ADMIN_PATH__ || '/_admin') + '/api' + API + '/upload?path=' + encodeURIComponent(currentPath);
 
-      fetch(uploadUrl, {
+      var fetchFn = (typeof window !== 'undefined' && window.Admin && window.Admin.fetch) ? window.Admin.fetch : fetch;
+      fetchFn(uploadUrl, {
         method: 'POST',
         body: fd,
         credentials: 'include',
+        timeout: 60000,
       }).then(function(r) { return r.json(); }).then(function(res) {
         uploading = false;
         uploadStatus = '';

package/plugins/file-manager/api-handlers.js

@@ -4,15 +4,7 @@
  */
 
 const multer = require('multer');
-const {
-  listFiles,
-  createDirectory,
-  renameItem,
-  deleteItem,
-  moveItem,
-  saveUploadedFile,
-  calculateStorageUsage,
-} = require('./core');
+const core = require('./core');
 
 /**
  * Create Multer middleware for in-memory upload parsing
@@ -71,7 +63,7 @@ function createFileManagerApiHandlers(options = {}) {
   const permissions = options.permissions || null;
   const securityOpts = options.security || {};
 
-  const parseUpload = createUploadMiddleware(maxUploadBytes);
+  const parseUpload = options.uploadMiddleware || createUploadMiddleware(maxUploadBytes);
 
   return {
     async list(req, res) {
@@ -88,7 +80,7 @@ function createFileManagerApiHandlers(options = {}) {
         const page = req.query.page ? parseInt(req.query.page, 10) : undefined;
         const perPage = req.query.perPage ? parseInt(req.query.perPage, 10) : undefined;
 
-        const result = await listFiles(baseDir, relPath, {
+        const result = await core.listFiles(baseDir, relPath, {
           search,
           type,
           sort,
@@ -115,7 +107,7 @@ function createFileManagerApiHandlers(options = {}) {
         if (!name) {
           return res.status(400).json({ success: false, error: 'Directory name is required' });
         }
-        const result = await createDirectory(baseDir, relPath, name);
+        const result = await core.createDirectory(baseDir, relPath, name);
         return res.status(201).json({ success: true, data: result });
       } catch (err) {
         const status = err.statusCode || err.status || 400;
@@ -133,7 +125,7 @@ function createFileManagerApiHandlers(options = {}) {
         if (!itemPath || !newName) {
           return res.status(400).json({ success: false, error: 'Path and newName are required' });
         }
-        const result = await renameItem(baseDir, itemPath, newName);
+        const result = await core.renameItem(baseDir, itemPath, newName);
         return res.json({ success: true, data: result });
       } catch (err) {
         const status = err.statusCode || err.status || 400;
@@ -151,7 +143,7 @@ function createFileManagerApiHandlers(options = {}) {
         if (!source) {
           return res.status(400).json({ success: false, error: 'Source path is required' });
         }
-        const result = await moveItem(baseDir, source, destination);
+        const result = await core.moveItem(baseDir, source, destination);
         return res.json({ success: true, data: result });
       } catch (err) {
         const status = err.statusCode || err.status || 400;
@@ -169,7 +161,7 @@ function createFileManagerApiHandlers(options = {}) {
         if (!itemPath) {
           return res.status(400).json({ success: false, error: 'Path is required' });
         }
-        const result = await deleteItem(baseDir, itemPath);
+        const result = await core.deleteItem(baseDir, itemPath);
         return res.json({ success: true, data: result });
       } catch (err) {
         const status = err.statusCode || err.status || 400;
@@ -199,7 +191,7 @@ function createFileManagerApiHandlers(options = {}) {
 
         // Storage Quota Check
         if (maxTotalStorageBytes && typeof maxTotalStorageBytes === 'number') {
-          const currentUsage = await calculateStorageUsage(baseDir);
+          const currentUsage = await core.calculateStorageUsage(baseDir);
           const incomingBytes = files.reduce((acc, f) => acc + (f.size || f.buffer?.length || 0), 0);
           if (currentUsage + incomingBytes > maxTotalStorageBytes) {
             return res.status(507).json({
@@ -229,7 +221,7 @@ function createFileManagerApiHandlers(options = {}) {
         try {
           const uploaded = [];
           for (const file of files) {
-            const saved = await saveUploadedFile(
+            const saved = await core.saveUploadedFile(
               baseDir,
               targetRelPath,
               file.buffer,
@@ -257,5 +249,6 @@ function createFileManagerApiHandlers(options = {}) {
 
 module.exports = {
   createFileManagerApiHandlers,
+  createUploadMiddleware,
   isActionAllowed,
 };

package/plugins/file-manager/core.js

@@ -137,7 +137,12 @@ function resolveSafePath(baseDir, relPath = '') {
   }
 
   // Prevent URL decoded traversal attempts
-  const decodedPath = decodeURIComponent(relPath);
+  let decodedPath;
+  try {
+    decodedPath = decodeURIComponent(relPath);
+  } catch (err) {
+    throw new ValidationError('Malformed URI path sequence', 400);
+  }
   if (decodedPath.includes('\0')) {
     throw new SecurityError('Null byte detected in path', 400);
   }
@@ -237,7 +242,7 @@ function buildBreadcrumbs(relPath) {
  */
 async function listFiles(baseDir, relPath = '', options = {}) {
   const targetDir = resolveSafePath(baseDir, relPath);
-  const normalizedRel = path.relative(path.resolve(baseDir), targetDir).replace(/\\/g, '');
+  const normalizedRel = path.relative(path.resolve(baseDir), targetDir).replace(/\\/g, '/');
   const publicBase = normalizePublicBase(options.publicBasePath);
 
   let dirents;
@@ -456,6 +461,7 @@ async function deleteItem(baseDir, itemRelPath) {
     await fs.unlink(targetFullPath);
   }
 
+  invalidateStorageCache(baseDir);
   return { success: true, path: itemRelPath };
 }
 
@@ -487,12 +493,33 @@ async function moveItem(baseDir, sourceRelPath, destDirRelPath) {
   return { success: true, oldPath: sourceRelPath, newPath: newRelPath };
 }
 
+const storageCache = new Map();
+const STORAGE_CACHE_TTL = 15000; // 15 seconds
+
+function invalidateStorageCache(baseDir) {
+  if (baseDir) {
+    storageCache.delete(path.resolve(baseDir));
+  } else {
+    storageCache.clear();
+  }
+}
+
 /**
  * Calculate total disk usage in bytes under baseDir
  * @param {string} baseDir
+ * @param {Object} [options]
+ * @param {boolean} [options.forceRefresh=false]
  * @returns {Promise<number>}
  */
-async function calculateStorageUsage(baseDir) {
+async function calculateStorageUsage(baseDir, options = {}) {
+  const resolvedBase = path.resolve(baseDir);
+  const now = Date.now();
+  const cached = storageCache.get(resolvedBase);
+
+  if (!options.forceRefresh && cached && (now - cached.timestamp) < STORAGE_CACHE_TTL) {
+    return cached.bytes;
+  }
+
   let totalBytes = 0;
   async function scan(dir) {
     try {
@@ -509,7 +536,8 @@ async function calculateStorageUsage(baseDir) {
       }
     } catch (e) {}
   }
-  await scan(path.resolve(baseDir));
+  await scan(resolvedBase);
+  storageCache.set(resolvedBase, { bytes: totalBytes, timestamp: now });
   return totalBytes;
 }
 
@@ -568,6 +596,7 @@ async function saveUploadedFile(baseDir, targetDirRelPath, buffer, originalName,
   resolveSafePath(baseDir, path.relative(baseDir, targetPath));
 
   await fs.writeFile(targetPath, finalBuffer);
+  invalidateStorageCache(baseDir);
 
   const relFilePath = path.relative(path.resolve(baseDir), targetPath).replace(/\\/g, '/');
   const publicBase = normalizePublicBase(publicBasePath);
@@ -598,4 +627,5 @@ module.exports = {
   moveItem,
   saveUploadedFile,
   calculateStorageUsage,
+  invalidateStorageCache,
 };

package/plugins/file-manager/index.js

@@ -114,15 +114,17 @@ function fileManagerPlugin(options = {}) {
       // so window.__openFileManagerPicker is available across all admin pages (models, records, rich-text)
       if (typeof adminApi.getRegistry === 'function') {
         const registry = adminApi.getRegistry();
-        registry.configure({
-          fileManager: {
-            enabled: true,
-            apiPrefix,
-            publicBasePath,
-            pageTitle,
-          },
-        });
-        registry.registerClientComponent('files', componentCode);
+        if (registry) {
+          registry.configure({
+            fileManager: {
+              enabled: true,
+              apiPrefix,
+              publicBasePath,
+              pageTitle,
+            },
+          });
+          registry.registerClientComponent('files', componentCode);
+        }
       }
 
       adminApi.registerModule({

package/plugins/file-manager/security.js

@@ -24,6 +24,16 @@ const DANGEROUS_EXTENSIONS = new Set([
   'htaccess', 'htpasswd', 'ini', 'env', 'config', 'conf', 'passwd', 'shadow',
 ]);
 
+/**
+ * Common safe extensions allowed when passed as raw extensions (without filename dot)
+ */
+const COMMON_SAFE_EXTENSIONS = new Set([
+  'jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'avif', 'bmp', 'ico', 'tiff',
+  'pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'odt', 'ods', 'odp', 'rtf',
+  'txt', 'csv', 'md', 'json', 'xml', 'html', 'css', 'js', 'ts', 'jsx', 'tsx',
+  'sql', 'yaml', 'yml', 'zip', 'tar', 'gz', 'mp3', 'wav', 'mp4', 'mov', 'webm',
+]);
+
 /**
  * Known magic numbers table for high-speed signature verification.
  * Only validates when extension matches known binary format.
@@ -118,9 +128,8 @@ function validateSafeExtension(filename) {
     throw new ValidationError('Filename must have a valid extension');
   }
 
-  // Check all dotted segments against dangerous extensions to block double extensions (e.g. payload.php.jpg)
-  for (let i = 1; i < parts.length; i++) {
-    const segment = parts[i];
+  // Check all segments against dangerous extensions to block double extensions and dangerous dotfiles (e.g. .env, payload.php.jpg)
+  for (const segment of parts) {
     if (DANGEROUS_EXTENSIONS.has(segment)) {
       throw new SecurityError(
         `Dangerous extension or double-extension detected: .${segment}`,
@@ -129,11 +138,14 @@ function validateSafeExtension(filename) {
     }
   }
 
-  const finalExt = parts[parts.length - 1];
-  if (DANGEROUS_EXTENSIONS.has(finalExt)) {
-    throw new SecurityError(`File type .${finalExt} is forbidden for upload`, 403);
+  if (parts.length < 2 && !cleanName.startsWith('.')) {
+    if (COMMON_SAFE_EXTENSIONS.has(parts[0])) {
+      return parts[0];
+    }
+    throw new ValidationError('Filename must have a valid extension');
   }
 
+  const finalExt = parts[parts.length - 1];
   return finalExt;
 }
 

package/plugins/mcp/auth.js

@@ -6,19 +6,7 @@
 
 const crypto = require('crypto');
 
-/**
- * Constant-time string comparison to avoid timing attacks
- * @param {string} a
- * @param {string} b
- * @returns {boolean}
- */
-function safeEqual(a, b) {
-  if (typeof a !== 'string' || typeof b !== 'string') return false;
-  const bufA = Buffer.from(a);
-  const bufB = Buffer.from(b);
-  if (bufA.length !== bufB.length) return false;
-  return crypto.timingSafeEqual(bufA, bufB);
-}
+const { safeCompare: safeEqual } = require('../../core/utils/crypto');
 
 /**
  * Check if incoming request is from localhost

package/plugins/mcp/index.js

@@ -52,6 +52,7 @@ function mcpPlugin(options = {}) {
   } = options;
 
   let serverInstance = null;
+  let sseTransport = null;
 
   return {
     name: 'mcp',
@@ -63,6 +64,19 @@ function mcpPlugin(options = {}) {
       registerTool: (tool) => serverInstance && serverInstance.registerTool(tool),
       registerResource: (res) => serverInstance && serverInstance.registerResource(res),
       registerPrompt: (prompt) => serverInstance && serverInstance.registerPrompt(prompt),
+      closeTransport: () => sseTransport && sseTransport.close && sseTransport.close(),
+    },
+
+    dispose() {
+      if (sseTransport && typeof sseTransport.close === 'function') {
+        sseTransport.close();
+      }
+    },
+
+    shutdown() {
+      if (sseTransport && typeof sseTransport.close === 'function') {
+        sseTransport.close();
+      }
     },
 
     register(ctx) {
@@ -180,12 +194,20 @@ function mcpPlugin(options = {}) {
       const authMiddleware =
         auth.token || auth.localhostOnly || auth.verify ? createMcpAuthMiddleware(auth) : null;
 
-      mountSseTransport({
+      sseTransport = mountSseTransport({
         app,
         server: serverInstance,
         path,
         authMiddleware,
       });
+
+      if (typeof ctx.onDispose === 'function') {
+        ctx.onDispose(() => {
+          if (sseTransport && typeof sseTransport.close === 'function') {
+            sseTransport.close();
+          }
+        });
+      }
     },
   };
 }

package/plugins/mcp/transports/sse.js

@@ -150,7 +150,16 @@ function mountSseTransport(options) {
     }
   });
 
-  return { sessions };
+  const close = () => {
+    for (const [id, session] of sessions.entries()) {
+      try {
+        session.res.end();
+      } catch {}
+    }
+    sessions.clear();
+  };
+
+  return { sessions, close };
 }
 
 module.exports = {

package/plugins/orm-cache-admin/admin-component.js

@@ -8,12 +8,13 @@ function generateOrmCacheAdminComponent() {
 (function() {
 
 function ormCacheApi(method, path, body) {
-  var opts = { method: method, credentials: 'same-origin' };
+  var opts = { method: method, credentials: 'same-origin', timeout: 30000 };
   if (body !== undefined) {
     opts.headers = { 'Content-Type': 'application/json' };
     opts.body = JSON.stringify(body);
   }
-  return fetch('/_admin/api/orm-cache' + path, opts).then(function(r) {
+  var fetchFn = (typeof window !== 'undefined' && window.Admin && window.Admin.fetch) ? window.Admin.fetch : fetch;
+  return fetchFn('/_admin/api/orm-cache' + path, opts).then(function(r) {
     return r.json().then(function(j) {
       if (!r.ok) throw new Error(j.error || r.statusText);
       return j;

package/plugins/polar/src/api.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { fetchWithTimeout } = require('../../../core/utils/fetch');
+
 function getPolarApiBase(sandbox) {
   return sandbox ? 'https://sandbox-api.polar.sh/v1' : 'https://api.polar.sh/v1';
 }
@@ -11,14 +13,17 @@ function getPolarApiBase(sandbox) {
  * @param {Object} [opts.body]
  * @param {string} opts.accessToken
  * @param {boolean} [opts.sandbox=false]
+ * @param {number} [opts.timeoutMs=15000]
+ * @param {AbortSignal} [opts.signal]
  */
-async function polarApiRequest(path, { method = 'GET', body, accessToken, sandbox = false } = {}) {
+async function polarApiRequest(path, { method = 'GET', body, accessToken, sandbox = false, timeoutMs = 15000, signal } = {}) {
   if (!accessToken) {
     throw new Error('POLAR_ACCESS_TOKEN is not configured');
   }
 
   const normalizedPath = path.startsWith('/') ? path : `/${path}`;
-  const res = await fetch(`${getPolarApiBase(sandbox)}${normalizedPath}`, {
+
+  const res = await fetchWithTimeout(`${getPolarApiBase(sandbox)}${normalizedPath}`, {
     method,
     headers: {
       Authorization: `Bearer ${accessToken}`,
@@ -26,6 +31,8 @@ async function polarApiRequest(path, { method = 'GET', body, accessToken, sandbo
       Accept: 'application/json',
     },
     body: body ? JSON.stringify(body) : undefined,
+    timeout: timeoutMs,
+    signal,
   });
 
   const raw = await res.text();

package/plugins/polar/src/webhooks.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const crypto = require('crypto');
+const { safeCompare } = require('../../../core/utils/crypto');
 const { syncPolarBillingForUser, applyPolarProSubscription } = require('./sync');
 const {
   collectPolarMetadata,
@@ -46,14 +47,8 @@ function verifyPolarWebhook(rawPayload, headers, secret) {
 
   for (const candidate of candidates) {
     for (const exp of expectedList) {
-      try {
-        const a = Buffer.from(candidate);
-        const b = Buffer.from(exp);
-        if (a.length === b.length && crypto.timingSafeEqual(a, b)) {
-          return true;
-        }
-      } catch {
-        // continue
+      if (safeCompare(candidate, exp)) {
+        return true;
       }
     }
   }

package/plugins/recaptcha/helpers.js

@@ -72,13 +72,7 @@ function recaptchaV3ExecuteScript(opts = {}) {
   return hidden + script;
 }
 
-function escapeHtml(s) {
-  return String(s)
-    .replace(/&/g, '&')
-    .replace(/"/g, '"')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;');
-}
+const { escapeHtml } = require('../../core/utils/html');
 
 function escapeJsInline(s) {
   return String(s).replace(/\\/g, '\\\\').replace(/'/g, "\\'");

package/plugins/recaptcha/verify.js

@@ -3,6 +3,9 @@
  * @module plugins/recaptcha/verify
  */
 
+const { fetchWithTimeout } = require('../../core/utils/fetch');
+const { getClientIp } = require('../../core/utils/ip');
+
 const SITEVERIFY_URL = 'https://www.google.com/recaptcha/api/siteverify';
 
 /**
@@ -20,7 +23,8 @@ const SITEVERIFY_URL = 'https://www.google.com/recaptcha/api/siteverify';
  * @param {VerifyOptions} options
  * @returns {Promise<{ success: boolean, score?: number, action?: string, hostname?: string, challenge_ts?: string, errorCodes?: string[], raw: object }>}
  */
-async function verifyRecaptcha(options) {
+async function verifyRecaptcha(options = {}) {
+  const opts = options || {};
   const {
     secret,
     token,
@@ -28,7 +32,8 @@ async function verifyRecaptcha(options) {
     version = 'v2',
     minScore = 0.5,
     expectedAction,
-  } = options;
+    timeoutMs = 10000,
+  } = opts;
 
   if (!secret || typeof secret !== 'string') {
     throw new Error('recaptcha: secret is required');
@@ -49,13 +54,24 @@ async function verifyRecaptcha(options) {
     body.set('remoteip', remoteIp);
   }
 
-  const res = await fetch(SITEVERIFY_URL, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/x-www-form-urlencoded',
-    },
-    body: body.toString(),
-  });
+  let res;
+  try {
+    res = await fetchWithTimeout(SITEVERIFY_URL, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+      },
+      body: body.toString(),
+      timeout: timeoutMs,
+    });
+  } catch (netErr) {
+    const isTimeout = netErr.name === 'AbortError' || netErr.name === 'TimeoutError' || netErr.code === 'ETIMEDOUT';
+    return {
+      success: false,
+      errorCodes: [isTimeout ? 'timeout' : 'network-error'],
+      raw: {},
+    };
+  }
 
   if (!res.ok) {
     return {
@@ -66,8 +82,17 @@ async function verifyRecaptcha(options) {
   }
 
   /** @type {Record<string, unknown>} */
-  const raw = await res.json();
-  const googleSuccess = raw.success === true;
+  let raw;
+  try {
+    raw = await res.json();
+  } catch (jsonErr) {
+    return {
+      success: false,
+      errorCodes: ['invalid-json-response'],
+      raw: {},
+    };
+  }
+  const googleSuccess = raw && raw.success === true;
 
   if (!googleSuccess) {
     return {
@@ -129,18 +154,7 @@ async function verifyRecaptcha(options) {
  * @returns {string|undefined}
  */
 function getRemoteIp(req) {
-  if (!req) return undefined;
-  const xf = req.headers && req.headers['x-forwarded-for'];
-  if (typeof xf === 'string' && xf.length) {
-    return xf.split(',')[0].trim();
-  }
-  if (req.ip) {
-    return req.ip;
-  }
-  if (req.socket && req.socket.remoteAddress) {
-    return req.socket.remoteAddress;
-  }
-  return undefined;
+  return getClientIp(req, undefined);
 }
 
 module.exports = {

package/plugins/redirect/index.js

@@ -151,6 +151,7 @@ function methodMatches(compiled, method) {
  * @returns {{ name: string, version: string, description: string, register: Function }}
  */
 function redirectPlugin(options = {}) {
+  const opts = options || {};
   const {
     rules = [],
     defaultStatus = 302,
@@ -158,7 +159,7 @@ function redirectPlugin(options = {}) {
     allowExternal = false,
     trailingSlash = false,
     defaultMethods = ['GET', 'HEAD'],
-  } = options;
+  } = opts;
 
   const pluginOpts = {
     defaultStatus: REDIRECT_STATUSES.has(Number(defaultStatus)) ? Number(defaultStatus) : 302,
@@ -169,16 +170,63 @@ function redirectPlugin(options = {}) {
   };
 
   const compiled = [];
-  for (const rule of rules) {
+  const stringRulesMap = new Map();
+  let hasRegexRules = false;
+
+  const ruleList = Array.isArray(rules) ? rules : [];
+  for (const rule of ruleList) {
     const c = compileRule(rule, pluginOpts);
-    if (c) compiled.push(c);
+    if (!c) continue;
+    compiled.push(c);
+    if (c.kind === 'string') {
+      const keys = [c.fromNorm];
+      if (!c.trailing) {
+        const alt = c.fromRaw.replace(/\/$/, '') || '/';
+        if (!keys.includes(alt)) keys.push(alt);
+      }
+      for (const k of keys) {
+        let list = stringRulesMap.get(k);
+        if (!list) {
+          list = [];
+          stringRulesMap.set(k, list);
+        }
+        list.push(c);
+      }
+    } else {
+      hasRegexRules = true;
+    }
   }
 
   function redirectMiddleware(req, res, next) {
+    if (!req) return next();
     const rawPath = req.path || '/';
     const pathForMatch = normalizePathForTrailingSlash(pluginOpts.trailingSlash, rawPath);
     const method = req.method || 'GET';
 
+    // Fast O(1) path when all configured rules are string based
+    if (!hasRegexRules) {
+      const candidates = stringRulesMap.get(pathForMatch) || (!pluginOpts.trailingSlash ? stringRulesMap.get(rawPath.replace(/\/$/, '') || '/') : null);
+      if (candidates) {
+        for (const c of candidates) {
+          if (!methodMatches(c, method)) continue;
+          if (!pathMatches(c, pathForMatch, rawPath)) continue;
+
+          let location = c.to;
+          if (pluginOpts.preserveQuery && !location.includes('?')) {
+            const full = req.originalUrl || req.url || '';
+            const qi = full.indexOf('?');
+            if (qi !== -1) {
+              location += full.slice(qi);
+            }
+          }
+          res.redirect(c.status, location);
+          return;
+        }
+      }
+      return next();
+    }
+
+    // Linear path when regex rules are present to preserve definition order
     for (const c of compiled) {
       if (!methodMatches(c, method)) continue;
       if (!pathMatches(c, pathForMatch, rawPath)) continue;