webspresso 0.0.103 → 0.0.104

package/core/utils/html.js

@@ -0,0 +1,72 @@
+/**
+ * Webspresso Zero-Dependency HTML Utilities
+ *
+ * High-performance, XSS-safe HTML entity escaping and unescaping.
+ *
+ * @module core/utils/html
+ */
+
+'use strict';
+
+const HTML_ESCAPE_TEST_RE = /[&<>"']/;
+const HTML_ESCAPE_RE = /[&<>"']/g;
+
+const HTML_ESCAPES = {
+  '&': '&amp;',
+  '<': '&lt;',
+  '>': '&gt;',
+  '"': '&quot;',
+  "'": '&#39;',
+};
+
+const HTML_UNESCAPE_RE = /&(?:amp|lt|gt|quot|#39|#039|#x27);/g;
+
+const HTML_UNESCAPES = {
+  '&amp;': '&',
+  '&lt;': '<',
+  '&gt;': '>',
+  '&quot;': '"',
+  '&#39;': "'",
+  '&#039;': "'",
+  '&#x27;': "'",
+};
+
+/**
+ * Escapes characters with special meaning in HTML to prevent XSS injection attacks.
+ * Fast-paths strings without special characters to avoid unnecessary allocations.
+ *
+ * @param {unknown} value - Value to escape (converted to string; null/undefined becomes '')
+ * @returns {string} HTML-escaped string
+ */
+function escapeHtml(value) {
+  if (value === null || value === undefined) {
+    return '';
+  }
+
+  const str = typeof value === 'string' ? value : String(value);
+  if (!HTML_ESCAPE_TEST_RE.test(str)) {
+    return str;
+  }
+
+  return str.replace(HTML_ESCAPE_RE, (char) => HTML_ESCAPES[char]);
+}
+
+/**
+ * Unescapes common HTML entities back to their literal character representations.
+ *
+ * @param {unknown} value - HTML string to unescape
+ * @returns {string} Unescaped string
+ */
+function unescapeHtml(value) {
+  if (value === null || value === undefined) {
+    return '';
+  }
+
+  const str = typeof value === 'string' ? value : String(value);
+  return str.replace(HTML_UNESCAPE_RE, (match) => HTML_UNESCAPES[match] || match);
+}
+
+module.exports = {
+  escapeHtml,
+  unescapeHtml,
+};

package/core/utils/ip.js

@@ -0,0 +1,86 @@
+'use strict';
+
+/**
+ * Universal Client IP Extraction Utility
+ * Safely extracts client IP address with proxy support, header normalizations,
+ * and customizable fallbacks.
+ *
+ * Precedence:
+ * 1. x-forwarded-for header (first IP if comma-separated or array)
+ * 2. x-real-ip header
+ * 3. req.ip (Express trust proxy / custom assignment)
+ * 4. req.connection.remoteAddress
+ * 5. req.socket.remoteAddress
+ * 6. req.info.remoteAddress (Fastify/Hapi compatibility)
+ * 7. fallback (defaults to '127.0.0.1' if not explicitly provided)
+ *
+ * @param {Object} [req] - Express / Node.js HTTP request object
+ * @param {any} [fallback='127.0.0.1'] - Fallback value if no IP could be extracted
+ * @returns {any}
+ */
+function getClientIp(req, fallback) {
+  const defaultFallback = arguments.length > 1 ? fallback : '127.0.0.1';
+  if (!req || typeof req !== 'object') {
+    return defaultFallback;
+  }
+
+  const headers = req.headers;
+
+  // 1. x-forwarded-for (can be string or array in Node HTTP/proxies)
+  let forwarded = headers ? (headers['x-forwarded-for'] || headers['X-Forwarded-For']) : undefined;
+  if (!forwarded && typeof req.get === 'function') {
+    forwarded = req.get('x-forwarded-for');
+  }
+
+  if (forwarded) {
+    const ips = typeof forwarded === 'string' ? forwarded.split(',') : forwarded;
+    const first = Array.isArray(ips) ? ips[0] : ips;
+    if (first && typeof first === 'string') {
+      const trimmed = first.trim();
+      if (trimmed) return trimmed;
+    }
+  }
+
+  // 2. x-real-ip
+  let realIp = headers ? (headers['x-real-ip'] || headers['X-Real-IP']) : undefined;
+  if (!realIp && typeof req.get === 'function') {
+    realIp = req.get('x-real-ip');
+  }
+  if (realIp && typeof realIp === 'string') {
+    const trimmed = realIp.trim();
+    if (trimmed) return trimmed;
+  }
+
+  // 3. req.ip
+  if (req.ip && typeof req.ip === 'string') {
+    const trimmed = req.ip.trim();
+    if (trimmed) return trimmed;
+  }
+
+  // 4. req.connection.remoteAddress
+  const connAddr = req.connection && req.connection.remoteAddress;
+  if (connAddr && typeof connAddr === 'string') {
+    const trimmed = connAddr.trim();
+    if (trimmed) return trimmed;
+  }
+
+  // 5. req.socket.remoteAddress
+  const sockAddr = req.socket && req.socket.remoteAddress;
+  if (sockAddr && typeof sockAddr === 'string') {
+    const trimmed = sockAddr.trim();
+    if (trimmed) return trimmed;
+  }
+
+  // 6. req.info.remoteAddress (Fastify/Hapi compatibility)
+  const infoAddr = req.info && req.info.remoteAddress;
+  if (infoAddr && typeof infoAddr === 'string') {
+    const trimmed = infoAddr.trim();
+    if (trimmed) return trimmed;
+  }
+
+  return defaultFallback;
+}
+
+module.exports = {
+  getClientIp,
+};

package/core/utils/safe-compare.js

@@ -0,0 +1,3 @@
+'use strict';
+
+module.exports = require('./crypto');

package/index.d.ts

@@ -830,6 +830,16 @@ export function loadListeners(dirPath: string, dispatcher: EventDispatcher, opti
 
 export function createHelpers(context: Record<string, unknown>): Record<string, unknown>;
 
+export interface FetchWithTimeoutOptions extends RequestInit {
+  timeout?: number;
+}
+
+export function fetchWithTimeout(url: string | URL | Request, options?: FetchWithTimeoutOptions): Promise<Response>;
+export function safeCompare(a: string | Buffer | null | undefined, b: string | Buffer | null | undefined): boolean;
+export function escapeHtml(value: unknown): string;
+export function unescapeHtml(value: unknown): string;
+export function getClientIp<T = string>(req?: any, fallback?: T): string | T;
+
 export const utils: Record<string, unknown>;
 
 export class AssetManager {
@@ -3787,7 +3797,7 @@ export class SessionManager {
 }
 
 export function parseUserAgent(userAgent?: string): DeviceInfo;
-export function getClientIp(req?: any): string;
+export function getClientIp<T = string>(req?: any, fallback?: T): string | T;
 export function createUserSessionsTable(knex: any): Promise<void>;
 export function dropUserSessionsTable(knex: any): Promise<void>;
 export function createKnexSessionTracker(db: any, options?: { tableName?: string }): SessionTracker;

package/index.js

@@ -219,6 +219,12 @@ module.exports = {
   defineSignal: require('./core/events').defineSignal,
   defineListener: require('./core/events').defineListener,
   loadListeners: require('./core/events').loadListeners,
+
+  // Shared Fetch, Crypto & HTML Utilities
+  fetchWithTimeout: require('./core/utils/fetch').fetchWithTimeout,
+  safeCompare: require('./core/utils/crypto').safeCompare,
+  escapeHtml: require('./core/utils/html').escapeHtml,
+  unescapeHtml: require('./core/utils/html').unescapeHtml,
 };
 
 // Define lazy getters for plugins, ORM, and heavy core subsystems
@@ -319,6 +325,10 @@ Object.defineProperties(module.exports, {
   generateQrDataUri: { get: () => require('./core/auth/qrcode').generateQrDataUri, enumerable: true, configurable: true },
   createAuthMiddleware: { get: () => require('./core/auth').createAuthMiddleware, enumerable: true, configurable: true },
   setupAuthMiddleware: { get: () => require('./core/auth').setupAuthMiddleware, enumerable: true, configurable: true },
+  getClientIp: { get: () => require('./core/utils/ip').getClientIp, enumerable: true, configurable: true },
+  parseUserAgent: { get: () => require('./core/auth').parseUserAgent, enumerable: true, configurable: true },
+  sessions: { get: () => require('./core/auth').sessions, enumerable: true, configurable: true },
+  SessionManager: { get: () => require('./core/auth').SessionManager, enumerable: true, configurable: true },
 
   // Validation
   z: { get: () => require('./core/validation').z, enumerable: true, configurable: true },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.103",
+  "version": "0.0.104",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",

package/plugins/admin-panel/auth.js

@@ -115,13 +115,21 @@ async function login(adminUserRepo, email, password, compare) {
  */
 async function logout(req, res) {
   return new Promise((resolve, reject) => {
-    req.session.destroy((err) => {
-      if (err) {
-        reject(err);
-      } else {
-        resolve();
-      }
-    });
+    if (!req || !req.session) {
+      return resolve();
+    }
+    if (typeof req.session.destroy === 'function') {
+      req.session.destroy((err) => {
+        if (err) {
+          reject(err);
+        } else {
+          resolve();
+        }
+      });
+    } else {
+      delete req.session.adminUser;
+      resolve();
+    }
   });
 }
 

package/plugins/admin-panel/client/parts/01-state-api-breadcrumb.js

@@ -1,14 +1,82 @@
 
+/**
+ * Shared client-side fetch wrapper with AbortController, timeout, and signal composition.
+ * @param {string} url
+ * @param {RequestInit & { timeout?: number }} [options]
+ * @returns {Promise<Response>}
+ */
+async function fetchWithTimeout(url, options = {}) {
+  const { timeout = 30000, signal, ...fetchOptions } = options;
+
+  if (signal && signal.aborted) {
+    const reason = (signal.reason !== undefined && signal.reason !== null)
+      ? signal.reason
+      : new Error('This operation was aborted');
+    throw reason;
+  }
+
+  if (typeof AbortController === 'undefined') {
+    return fetch(url, { ...fetchOptions, signal });
+  }
+
+  const controller = new AbortController();
+  let timer = null;
+  let callerSignalListener = null;
+
+  if (typeof timeout === 'number' && timeout > 0 && typeof setTimeout !== 'undefined') {
+    timer = setTimeout(() => {
+      const err = new Error('Request timed out after ' + timeout + 'ms');
+      err.name = 'TimeoutError';
+      err.code = 'ETIMEDOUT';
+      controller.abort(err);
+    }, timeout);
+  }
+
+  if (signal) {
+    callerSignalListener = () => {
+      controller.abort(signal.reason);
+    };
+    signal.addEventListener('abort', callerSignalListener, { once: true });
+  }
+
+  try {
+    return await fetch(url, {
+      ...fetchOptions,
+      signal: controller.signal,
+    });
+  } catch (err) {
+    if (controller.signal.aborted && controller.signal.reason) {
+      const reason = controller.signal.reason;
+      if (reason instanceof Error && (reason.name === 'TimeoutError' || reason.code === 'ETIMEDOUT')) {
+        throw reason;
+      }
+    }
+    if (err && err.name === 'AbortError' && controller.signal.aborted && controller.signal.reason) {
+      throw controller.signal.reason;
+    }
+    throw err;
+  } finally {
+    if (timer) clearTimeout(timer);
+    if (signal && callerSignalListener) {
+      signal.removeEventListener('abort', callerSignalListener);
+    }
+  }
+}
+
 // API helper
 const api = {
+  fetch: fetchWithTimeout,
   async request(path, options = {}) {
     const adminPath = window.__ADMIN_PATH__ || '/_admin';
     const url = adminPath + '/api' + path;
-    const response = await fetch(url, {
-      ...options,
+    const { timeout = 30000, signal, ...fetchOpts } = options;
+    const response = await fetchWithTimeout(url, {
+      ...fetchOpts,
+      timeout,
+      signal,
       headers: {
         'Content-Type': 'application/json',
-        ...options.headers,
+        ...fetchOpts.headers,
       },
       credentials: 'include',
     });
@@ -28,20 +96,24 @@ const api = {
     return response.json();
   },
   
-  get(path) { return this.request(path, { method: 'GET' }); },
-  post(path, data) { return this.request(path, { method: 'POST', body: JSON.stringify(data) }); },
-  put(path, data) { return this.request(path, { method: 'PUT', body: JSON.stringify(data) }); },
-  delete(path) { return this.request(path, { method: 'DELETE' }); },
+  get(path, options) { return this.request(path, { ...options, method: 'GET' }); },
+  post(path, data, options) { return this.request(path, { ...options, method: 'POST', body: JSON.stringify(data) }); },
+  put(path, data, options) { return this.request(path, { ...options, method: 'PUT', body: JSON.stringify(data) }); },
+  delete(path, options) { return this.request(path, { ...options, method: 'DELETE' }); },
 };
 
 /** POST /data-exchange/export/:model — validates JSON errors vs .xlsx blob */
-async function downloadDataExchangeXlsx(modelName, payload) {
+async function downloadDataExchangeXlsx(modelName, payload, options = {}) {
   const adminPath = window.__ADMIN_PATH__ || '/_admin';
-  const res = await fetch(adminPath + '/api/data-exchange/export/' + modelName, {
+  const { timeout = 60000, signal, headers = {}, ...restOpts } = options;
+  const res = await fetchWithTimeout(adminPath + '/api/data-exchange/export/' + modelName, {
     method: 'POST',
     credentials: 'include',
-    headers: { 'Content-Type': 'application/json' },
+    headers: { 'Content-Type': 'application/json', ...headers },
     body: JSON.stringify(payload),
+    timeout,
+    signal,
+    ...restOpts,
   });
   const ct = (res.headers.get('content-type') || '').toLowerCase();
   if (!res.ok || ct.indexOf('spreadsheet') === -1) {

package/plugins/admin-panel/client/parts/05-rich-text-file-helpers.js

@@ -572,7 +572,8 @@ async function handleAdminFileUpload(file, onChange, meta, state) {
   var fd = new FormData();
   fd.append('file', file);
   try {
-    var res = await fetch(uploadUrl, { method: 'POST', body: fd, credentials: 'include' });
+    var fetchFn = (typeof fetchWithTimeout === 'function' ? fetchWithTimeout : fetch);
+    var res = await fetchFn(uploadUrl, { method: 'POST', body: fd, credentials: 'include', timeout: 60000 });
     var data = {};
     try { data = await res.json(); } catch (e2) { data = {}; }
     if (!res.ok) {
@@ -619,7 +620,8 @@ async function handleAdminMultipleFilesUpload(files, onChange, meta, state, curr
       var fd = new FormData();
       fd.append('file', file);
       try {
-        var res = await fetch(uploadUrl, { method: 'POST', body: fd, credentials: 'include' });
+        var fetchFn = (typeof fetchWithTimeout === 'function' ? fetchWithTimeout : fetch);
+        var res = await fetchFn(uploadUrl, { method: 'POST', body: fd, credentials: 'include', timeout: 60000 });
         var data = {};
         try { data = await res.json(); } catch (_) { data = {}; }
         if (res.ok && (data.url || data.publicUrl)) {

package/plugins/admin-panel/client/parts/08-record-list.js

@@ -316,10 +316,11 @@ const RecordList = {
               const fd = new FormData();
               fd.append('file', file);
               try {
-                const res = await fetch(
+                const fetchFn = (typeof fetchWithTimeout === 'function' ? fetchWithTimeout : fetch);
+                const res = await fetchFn(
                   adminPath + '/api/data-exchange/import/' + modelName +
                     '?mode=' + encodeURIComponent(mode) + '&upsertKey=' + encodeURIComponent(upsertKey),
-                  { method: 'POST', body: fd, credentials: 'include' }
+                  { method: 'POST', body: fd, credentials: 'include', timeout: 60000 }
                 );
                 const body = await res.json().catch(function () { return ({}); });
                 if (!res.ok) {

package/plugins/admin-panel/client/parts/10-export-registry.js

@@ -8,6 +8,8 @@ window.__ADMIN_COMPONENTS__ = {
   RecordForm,
   api,
   state,
+  fetch: typeof fetchWithTimeout !== 'undefined' ? fetchWithTimeout : undefined,
+  fetchWithTimeout: typeof fetchWithTimeout !== 'undefined' ? fetchWithTimeout : undefined,
   notify: typeof window !== 'undefined' ? window.notify : undefined,
   confirmModal: typeof window !== 'undefined' ? window.confirmModal : undefined,
   toastState: typeof window !== 'undefined' ? window.toastState : undefined,
@@ -22,6 +24,10 @@ if (typeof window !== 'undefined') {
   window.Admin = window.Admin || {};
   window.Admin.api = api;
   window.Admin.state = state;
+  if (typeof fetchWithTimeout !== 'undefined') {
+    window.Admin.fetch = fetchWithTimeout;
+    window.Admin.fetchWithTimeout = fetchWithTimeout;
+  }
   if (typeof window.AdminUI !== 'undefined') {
     window.Admin.ui = window.AdminUI;
   }

package/plugins/admin-panel/core/api-extensions.js

@@ -7,6 +7,7 @@
 const os = require('os');
 const https = require('https');
 const { sanitizeForOutput } = require('../../../core/orm/utils');
+const { buildFilteredQuery } = require('../../../core/orm/query-filters');
 
 function getWebspressoVersion() {
   try {
@@ -115,82 +116,7 @@ function formatBytes(bytes) {
   return (bytes / (1024 * 1024)).toFixed(1) + ' MB';
 }
 
-/**
- * Build query with filters applied
- * @param {Object} repo - Repository instance
- * @param {Object} filters - Filter object from frontend
- * @param {Object} [options] - Options
- * @param {boolean} [options.onlyTrashed] - For soft delete: only trashed records
- * @returns {Object} Query builder with filters applied
- */
-function buildFilteredQuery(repo, filters, options = {}) {
-  let query = repo.query();
-  if (options.onlyTrashed) {
-    query = query.onlyTrashed();
-  }
-  
-  if (!filters || Object.keys(filters).length === 0) {
-    return query;
-  }
-  
-  for (const [column, filter] of Object.entries(filters)) {
-    if (!filter) continue;
-
-    const op = filter.op || filter.operator || 'contains';
 
-    if (op === 'is_null') {
-      query = query.whereNull(column);
-      continue;
-    }
-    if (op === 'is_not_null') {
-      query = query.whereNotNull(column);
-      continue;
-    }
-
-    if (filter.value === '' && !filter.from && !filter.to) continue;
-
-    switch (op) {
-      case 'contains':
-        query = query.where(column, 'like', `%${filter.value}%`);
-        break;
-      case 'equals':
-        query = query.where(column, '=', filter.value);
-        break;
-      case 'starts_with':
-        query = query.where(column, 'like', `${filter.value}%`);
-        break;
-      case 'ends_with':
-        query = query.where(column, 'like', `%${filter.value}`);
-        break;
-      case 'eq':
-        query = query.where(column, '=', filter.value);
-        break;
-      case 'gt':
-        query = query.where(column, '>', filter.value);
-        break;
-      case 'gte':
-        query = query.where(column, '>=', filter.value);
-        break;
-      case 'lt':
-        query = query.where(column, '<', filter.value);
-        break;
-      case 'lte':
-        query = query.where(column, '<=', filter.value);
-        break;
-      case 'between':
-        if (filter.from) query = query.where(column, '>=', filter.from);
-        if (filter.to) query = query.where(column, '<=', filter.to);
-        break;
-      case 'in':
-        if (Array.isArray(filter.value) && filter.value.length > 0) {
-          query = query.whereIn(column, filter.value);
-        }
-        break;
-    }
-  }
-  
-  return query;
-}
 
 /**
  * Get all record IDs matching filters (for selectAll mode)

package/plugins/admin-panel/lib/login-rate-limiter.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { getClientIp } = require('../../../core/utils/ip');
+
 /**
  * In-memory brute-force rate limiter for admin login.
  * Zero external dependencies.
@@ -20,19 +22,7 @@ class LoginRateLimiter {
   }
 
   getClientIp(req) {
-    if (!req) return '127.0.0.1';
-    if (req.ip) return String(req.ip);
-    if (req.headers && req.headers['x-forwarded-for']) {
-      const forwarded = String(req.headers['x-forwarded-for']).split(',')[0].trim();
-      if (forwarded) return forwarded;
-    }
-    if (req.connection && req.connection.remoteAddress) {
-      return String(req.connection.remoteAddress);
-    }
-    if (req.socket && req.socket.remoteAddress) {
-      return String(req.socket.remoteAddress);
-    }
-    return '127.0.0.1';
+    return getClientIp(req);
   }
 
   isBlocked(req) {
@@ -111,6 +101,18 @@ class LoginRateLimiter {
         this.attempts.delete(ip);
       }
     }
+
+    // Hard ceiling to prevent unbounded memory growth under distributed IP attacks
+    const MAX_ENTRIES = 5000;
+    if (this.attempts.size > MAX_ENTRIES) {
+      const excess = this.attempts.size - MAX_ENTRIES;
+      let count = 0;
+      for (const ip of this.attempts.keys()) {
+        this.attempts.delete(ip);
+        count++;
+        if (count >= excess) break;
+      }
+    }
   }
 }
 

package/plugins/api-key/crypto.js

@@ -8,30 +8,7 @@
 
 const crypto = require('crypto');
 
-/**
- * Compare two strings in constant time to prevent timing attacks.
- * Uses dummy buffer comparison if lengths differ to avoid leaking length via response timing.
- * 
- * @param {string} a
- * @param {string} b
- * @returns {boolean}
- */
-function safeCompare(a, b) {
-  if (typeof a !== 'string' || typeof b !== 'string') {
-    return false;
-  }
-
-  const bufA = Buffer.from(a, 'utf8');
-  const bufB = Buffer.from(b, 'utf8');
-
-  if (bufA.length !== bufB.length) {
-    // Perform dummy timing-safe comparison with itself to preserve constant execution time
-    crypto.timingSafeEqual(bufA, bufA);
-    return false;
-  }
-
-  return crypto.timingSafeEqual(bufA, bufB);
-}
+const { safeCompare } = require('../../core/utils/crypto');
 
 /**
  * Hash a raw API key using SHA-256

package/plugins/audit-log/api-handlers.js

@@ -66,8 +66,18 @@ function createAuditLogHandlers(options) {
         .offset((page - 1) * perPage)
         .limit(perPage);
 
+      const normalizedRows = rows.map((r) => {
+        let parsedMetadata = r.metadata;
+        if (typeof parsedMetadata === 'string') {
+          try {
+            parsedMetadata = JSON.parse(parsedMetadata);
+          } catch {}
+        }
+        return { ...r, metadata: parsedMetadata };
+      });
+
       res.json({
-        data: rows,
+        data: normalizedRows,
         meta: { page, perPage, total },
       });
     } catch (err) {

package/plugins/audit-log/middleware.js

@@ -4,6 +4,7 @@
  */
 
 const { parseAdminModelAudit } = require('./parse');
+const { getClientIp } = require('../../core/utils/ip');
 
 function stringifyId(val) {
   if (val === undefined || val === null) {
@@ -81,6 +82,14 @@ function createAuditMiddleware(options) {
         }
 
         const metadata = buildMetadata(action, req);
+        let metadataVal = metadata || null;
+        if (metadataVal && typeof metadataVal === 'object') {
+          const clientName = knex?.client?.config?.client || '';
+          if (typeof clientName === 'string' && clientName.includes('sqlite')) {
+            metadataVal = JSON.stringify(metadataVal);
+          }
+        }
+
         const pathStr = (req.originalUrl || req.url || req.path || '').slice(0, 2000);
         const row = {
           actor_id: actor.id != null ? Number(actor.id) : null,
@@ -90,9 +99,9 @@ function createAuditMiddleware(options) {
           resource_id: resourceId,
           http_method: req.method,
           path: pathStr,
-          ip: req.ip || (req.connection && req.connection.remoteAddress) || null,
+          ip: getClientIp(req, null),
           user_agent: req.get && req.get('user-agent') ? req.get('user-agent').slice(0, 2000) : null,
-          metadata: metadata || null,
+          metadata: metadataVal,
         };
 
         knex(tableName).insert(row).catch(logAuditError);