webspresso 0.0.103 → 0.0.104

package/plugins/basic-auth/index.js

@@ -4,32 +4,7 @@
  * @module plugins/basic-auth
  */
 
-const crypto = require('crypto');
-
-/**
- * Compare two strings in constant time to prevent timing attacks.
- * Uses dummy buffer comparison if lengths differ to avoid leaking length via response timing.
- * 
- * @param {string} a
- * @param {string} b
- * @returns {boolean}
- */
-function safeCompare(a, b) {
-  if (typeof a !== 'string' || typeof b !== 'string') {
-    return false;
-  }
-
-  const bufA = Buffer.from(a, 'utf8');
-  const bufB = Buffer.from(b, 'utf8');
-
-  if (bufA.length !== bufB.length) {
-    // Perform dummy timing-safe comparison with itself to preserve constant execution time
-    crypto.timingSafeEqual(bufA, bufA);
-    return false;
-  }
-
-  return crypto.timingSafeEqual(bufA, bufB);
-}
+const { safeCompare } = require('../../core/utils/crypto');
 
 /**
  * Parse an HTTP Authorization header for Basic credentials.
@@ -69,6 +44,7 @@ function parseBasicAuthHeader(header) {
  * @returns {{ username: string, password: string } | null}
  */
 function extractCredentials(req) {
+  if (!req || !req.headers) return null;
   const header = req.headers.authorization || req.headers.Authorization;
   return parseBasicAuthHeader(header);
 }

package/plugins/cors.js

@@ -105,7 +105,7 @@ function createCorsMiddleware(options = {}) {
       return next();
     }
 
-    const reqOrigin = req.headers.origin;
+    const reqOrigin = req.headers?.origin;
 
     isOriginAllowed(reqOrigin, (err, allowedOrigin) => {
       if (err) {
@@ -134,7 +134,7 @@ function createCorsMiddleware(options = {}) {
           }
           if (allowedHeadersStr) {
             res.setHeader('Access-Control-Allow-Headers', allowedHeadersStr);
-          } else if (req.headers['access-control-request-headers']) {
+          } else if (req.headers?.['access-control-request-headers']) {
             res.setHeader('Access-Control-Allow-Headers', req.headers['access-control-request-headers']);
           }
           if (config.maxAge) {

package/plugins/csrf/index.js

@@ -15,21 +15,7 @@ const NOOP = () => {};
 const EMPTY_OBJECT = Object.freeze({});
 const ignoreRegexCache = new Map();
 
-/**
- * Compare two strings in constant time to prevent timing attacks
- * @param {string} a
- * @param {string} b
- * @returns {boolean}
- */
-function safeCompare(a, b) {
-  if (typeof a !== 'string' || typeof b !== 'string') return false;
-  if (a.length !== b.length) return false;
-  try {
-    return crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));
-  } catch (err) {
-    return false;
-  }
-}
+const { safeCompare } = require('../../core/utils/crypto');
 
 /**
  * Check if the request path matches any ignore patterns
@@ -241,3 +227,5 @@ function csrfPlugin(options = {}) {
 
 module.exports = csrfPlugin;
 module.exports.csrfPlugin = csrfPlugin;
+module.exports.safeCompare = safeCompare;
+csrfPlugin.safeCompare = safeCompare;

package/plugins/file-manager/admin-component.js

@@ -173,10 +173,12 @@ function generateFileManagerComponent(options = {}) {
 
       var uploadUrl = (window.__ADMIN_PATH__ || '/_admin') + '/api' + API + '/upload?path=' + encodeURIComponent(currentPath);
 
-      fetch(uploadUrl, {
+      var fetchFn = (typeof window !== 'undefined' && window.Admin && window.Admin.fetch) ? window.Admin.fetch : fetch;
+      fetchFn(uploadUrl, {
         method: 'POST',
         body: fd,
         credentials: 'include',
+        timeout: 60000,
       }).then(function(r) { return r.json(); }).then(function(res) {
         uploading = false;
         uploadStatus = '';

package/plugins/file-manager/core.js

@@ -137,7 +137,12 @@ function resolveSafePath(baseDir, relPath = '') {
   }
 
   // Prevent URL decoded traversal attempts
-  const decodedPath = decodeURIComponent(relPath);
+  let decodedPath;
+  try {
+    decodedPath = decodeURIComponent(relPath);
+  } catch (err) {
+    throw new ValidationError('Malformed URI path sequence', 400);
+  }
   if (decodedPath.includes('\0')) {
     throw new SecurityError('Null byte detected in path', 400);
   }
@@ -237,7 +242,7 @@ function buildBreadcrumbs(relPath) {
  */
 async function listFiles(baseDir, relPath = '', options = {}) {
   const targetDir = resolveSafePath(baseDir, relPath);
-  const normalizedRel = path.relative(path.resolve(baseDir), targetDir).replace(/\\/g, '');
+  const normalizedRel = path.relative(path.resolve(baseDir), targetDir).replace(/\\/g, '/');
   const publicBase = normalizePublicBase(options.publicBasePath);
 
   let dirents;
@@ -456,6 +461,7 @@ async function deleteItem(baseDir, itemRelPath) {
     await fs.unlink(targetFullPath);
   }
 
+  invalidateStorageCache(baseDir);
   return { success: true, path: itemRelPath };
 }
 
@@ -487,12 +493,33 @@ async function moveItem(baseDir, sourceRelPath, destDirRelPath) {
   return { success: true, oldPath: sourceRelPath, newPath: newRelPath };
 }
 
+const storageCache = new Map();
+const STORAGE_CACHE_TTL = 15000; // 15 seconds
+
+function invalidateStorageCache(baseDir) {
+  if (baseDir) {
+    storageCache.delete(path.resolve(baseDir));
+  } else {
+    storageCache.clear();
+  }
+}
+
 /**
  * Calculate total disk usage in bytes under baseDir
  * @param {string} baseDir
+ * @param {Object} [options]
+ * @param {boolean} [options.forceRefresh=false]
  * @returns {Promise<number>}
  */
-async function calculateStorageUsage(baseDir) {
+async function calculateStorageUsage(baseDir, options = {}) {
+  const resolvedBase = path.resolve(baseDir);
+  const now = Date.now();
+  const cached = storageCache.get(resolvedBase);
+
+  if (!options.forceRefresh && cached && (now - cached.timestamp) < STORAGE_CACHE_TTL) {
+    return cached.bytes;
+  }
+
   let totalBytes = 0;
   async function scan(dir) {
     try {
@@ -509,7 +536,8 @@ async function calculateStorageUsage(baseDir) {
       }
     } catch (e) {}
   }
-  await scan(path.resolve(baseDir));
+  await scan(resolvedBase);
+  storageCache.set(resolvedBase, { bytes: totalBytes, timestamp: now });
   return totalBytes;
 }
 
@@ -568,6 +596,7 @@ async function saveUploadedFile(baseDir, targetDirRelPath, buffer, originalName,
   resolveSafePath(baseDir, path.relative(baseDir, targetPath));
 
   await fs.writeFile(targetPath, finalBuffer);
+  invalidateStorageCache(baseDir);
 
   const relFilePath = path.relative(path.resolve(baseDir), targetPath).replace(/\\/g, '/');
   const publicBase = normalizePublicBase(publicBasePath);
@@ -598,4 +627,5 @@ module.exports = {
   moveItem,
   saveUploadedFile,
   calculateStorageUsage,
+  invalidateStorageCache,
 };

package/plugins/mcp/auth.js

@@ -6,19 +6,7 @@
 
 const crypto = require('crypto');
 
-/**
- * Constant-time string comparison to avoid timing attacks
- * @param {string} a
- * @param {string} b
- * @returns {boolean}
- */
-function safeEqual(a, b) {
-  if (typeof a !== 'string' || typeof b !== 'string') return false;
-  const bufA = Buffer.from(a);
-  const bufB = Buffer.from(b);
-  if (bufA.length !== bufB.length) return false;
-  return crypto.timingSafeEqual(bufA, bufB);
-}
+const { safeCompare: safeEqual } = require('../../core/utils/crypto');
 
 /**
  * Check if incoming request is from localhost

package/plugins/mcp/index.js

@@ -52,6 +52,7 @@ function mcpPlugin(options = {}) {
   } = options;
 
   let serverInstance = null;
+  let sseTransport = null;
 
   return {
     name: 'mcp',
@@ -63,6 +64,19 @@ function mcpPlugin(options = {}) {
       registerTool: (tool) => serverInstance && serverInstance.registerTool(tool),
       registerResource: (res) => serverInstance && serverInstance.registerResource(res),
       registerPrompt: (prompt) => serverInstance && serverInstance.registerPrompt(prompt),
+      closeTransport: () => sseTransport && sseTransport.close && sseTransport.close(),
+    },
+
+    dispose() {
+      if (sseTransport && typeof sseTransport.close === 'function') {
+        sseTransport.close();
+      }
+    },
+
+    shutdown() {
+      if (sseTransport && typeof sseTransport.close === 'function') {
+        sseTransport.close();
+      }
     },
 
     register(ctx) {
@@ -180,12 +194,20 @@ function mcpPlugin(options = {}) {
       const authMiddleware =
         auth.token || auth.localhostOnly || auth.verify ? createMcpAuthMiddleware(auth) : null;
 
-      mountSseTransport({
+      sseTransport = mountSseTransport({
         app,
         server: serverInstance,
         path,
         authMiddleware,
       });
+
+      if (typeof ctx.onDispose === 'function') {
+        ctx.onDispose(() => {
+          if (sseTransport && typeof sseTransport.close === 'function') {
+            sseTransport.close();
+          }
+        });
+      }
     },
   };
 }

package/plugins/mcp/transports/sse.js

@@ -150,7 +150,16 @@ function mountSseTransport(options) {
     }
   });
 
-  return { sessions };
+  const close = () => {
+    for (const [id, session] of sessions.entries()) {
+      try {
+        session.res.end();
+      } catch {}
+    }
+    sessions.clear();
+  };
+
+  return { sessions, close };
 }
 
 module.exports = {

package/plugins/orm-cache-admin/admin-component.js

@@ -8,12 +8,13 @@ function generateOrmCacheAdminComponent() {
 (function() {
 
 function ormCacheApi(method, path, body) {
-  var opts = { method: method, credentials: 'same-origin' };
+  var opts = { method: method, credentials: 'same-origin', timeout: 30000 };
   if (body !== undefined) {
     opts.headers = { 'Content-Type': 'application/json' };
     opts.body = JSON.stringify(body);
   }
-  return fetch('/_admin/api/orm-cache' + path, opts).then(function(r) {
+  var fetchFn = (typeof window !== 'undefined' && window.Admin && window.Admin.fetch) ? window.Admin.fetch : fetch;
+  return fetchFn('/_admin/api/orm-cache' + path, opts).then(function(r) {
     return r.json().then(function(j) {
       if (!r.ok) throw new Error(j.error || r.statusText);
       return j;

package/plugins/polar/src/api.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { fetchWithTimeout } = require('../../../core/utils/fetch');
+
 function getPolarApiBase(sandbox) {
   return sandbox ? 'https://sandbox-api.polar.sh/v1' : 'https://api.polar.sh/v1';
 }
@@ -11,14 +13,17 @@ function getPolarApiBase(sandbox) {
  * @param {Object} [opts.body]
  * @param {string} opts.accessToken
  * @param {boolean} [opts.sandbox=false]
+ * @param {number} [opts.timeoutMs=15000]
+ * @param {AbortSignal} [opts.signal]
  */
-async function polarApiRequest(path, { method = 'GET', body, accessToken, sandbox = false } = {}) {
+async function polarApiRequest(path, { method = 'GET', body, accessToken, sandbox = false, timeoutMs = 15000, signal } = {}) {
   if (!accessToken) {
     throw new Error('POLAR_ACCESS_TOKEN is not configured');
   }
 
   const normalizedPath = path.startsWith('/') ? path : `/${path}`;
-  const res = await fetch(`${getPolarApiBase(sandbox)}${normalizedPath}`, {
+
+  const res = await fetchWithTimeout(`${getPolarApiBase(sandbox)}${normalizedPath}`, {
     method,
     headers: {
       Authorization: `Bearer ${accessToken}`,
@@ -26,6 +31,8 @@ async function polarApiRequest(path, { method = 'GET', body, accessToken, sandbo
       Accept: 'application/json',
     },
     body: body ? JSON.stringify(body) : undefined,
+    timeout: timeoutMs,
+    signal,
   });
 
   const raw = await res.text();

package/plugins/polar/src/webhooks.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const crypto = require('crypto');
+const { safeCompare } = require('../../../core/utils/crypto');
 const { syncPolarBillingForUser, applyPolarProSubscription } = require('./sync');
 const {
   collectPolarMetadata,
@@ -46,14 +47,8 @@ function verifyPolarWebhook(rawPayload, headers, secret) {
 
   for (const candidate of candidates) {
     for (const exp of expectedList) {
-      try {
-        const a = Buffer.from(candidate);
-        const b = Buffer.from(exp);
-        if (a.length === b.length && crypto.timingSafeEqual(a, b)) {
-          return true;
-        }
-      } catch {
-        // continue
+      if (safeCompare(candidate, exp)) {
+        return true;
       }
     }
   }

package/plugins/recaptcha/helpers.js

@@ -72,13 +72,7 @@ function recaptchaV3ExecuteScript(opts = {}) {
   return hidden + script;
 }
 
-function escapeHtml(s) {
-  return String(s)
-    .replace(/&/g, '&')
-    .replace(/"/g, '"')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;');
-}
+const { escapeHtml } = require('../../core/utils/html');
 
 function escapeJsInline(s) {
   return String(s).replace(/\\/g, '\\\\').replace(/'/g, "\\'");

package/plugins/recaptcha/verify.js

@@ -3,6 +3,9 @@
  * @module plugins/recaptcha/verify
  */
 
+const { fetchWithTimeout } = require('../../core/utils/fetch');
+const { getClientIp } = require('../../core/utils/ip');
+
 const SITEVERIFY_URL = 'https://www.google.com/recaptcha/api/siteverify';
 
 /**
@@ -20,7 +23,8 @@ const SITEVERIFY_URL = 'https://www.google.com/recaptcha/api/siteverify';
  * @param {VerifyOptions} options
  * @returns {Promise<{ success: boolean, score?: number, action?: string, hostname?: string, challenge_ts?: string, errorCodes?: string[], raw: object }>}
  */
-async function verifyRecaptcha(options) {
+async function verifyRecaptcha(options = {}) {
+  const opts = options || {};
   const {
     secret,
     token,
@@ -28,7 +32,8 @@ async function verifyRecaptcha(options) {
     version = 'v2',
     minScore = 0.5,
     expectedAction,
-  } = options;
+    timeoutMs = 10000,
+  } = opts;
 
   if (!secret || typeof secret !== 'string') {
     throw new Error('recaptcha: secret is required');
@@ -49,13 +54,24 @@ async function verifyRecaptcha(options) {
     body.set('remoteip', remoteIp);
   }
 
-  const res = await fetch(SITEVERIFY_URL, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/x-www-form-urlencoded',
-    },
-    body: body.toString(),
-  });
+  let res;
+  try {
+    res = await fetchWithTimeout(SITEVERIFY_URL, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+      },
+      body: body.toString(),
+      timeout: timeoutMs,
+    });
+  } catch (netErr) {
+    const isTimeout = netErr.name === 'AbortError' || netErr.name === 'TimeoutError' || netErr.code === 'ETIMEDOUT';
+    return {
+      success: false,
+      errorCodes: [isTimeout ? 'timeout' : 'network-error'],
+      raw: {},
+    };
+  }
 
   if (!res.ok) {
     return {
@@ -66,8 +82,17 @@ async function verifyRecaptcha(options) {
   }
 
   /** @type {Record<string, unknown>} */
-  const raw = await res.json();
-  const googleSuccess = raw.success === true;
+  let raw;
+  try {
+    raw = await res.json();
+  } catch (jsonErr) {
+    return {
+      success: false,
+      errorCodes: ['invalid-json-response'],
+      raw: {},
+    };
+  }
+  const googleSuccess = raw && raw.success === true;
 
   if (!googleSuccess) {
     return {
@@ -129,18 +154,7 @@ async function verifyRecaptcha(options) {
  * @returns {string|undefined}
  */
 function getRemoteIp(req) {
-  if (!req) return undefined;
-  const xf = req.headers && req.headers['x-forwarded-for'];
-  if (typeof xf === 'string' && xf.length) {
-    return xf.split(',')[0].trim();
-  }
-  if (req.ip) {
-    return req.ip;
-  }
-  if (req.socket && req.socket.remoteAddress) {
-    return req.socket.remoteAddress;
-  }
-  return undefined;
+  return getClientIp(req, undefined);
 }
 
 module.exports = {

package/plugins/redirect/index.js

@@ -151,6 +151,7 @@ function methodMatches(compiled, method) {
  * @returns {{ name: string, version: string, description: string, register: Function }}
  */
 function redirectPlugin(options = {}) {
+  const opts = options || {};
   const {
     rules = [],
     defaultStatus = 302,
@@ -158,7 +159,7 @@ function redirectPlugin(options = {}) {
     allowExternal = false,
     trailingSlash = false,
     defaultMethods = ['GET', 'HEAD'],
-  } = options;
+  } = opts;
 
   const pluginOpts = {
     defaultStatus: REDIRECT_STATUSES.has(Number(defaultStatus)) ? Number(defaultStatus) : 302,
@@ -169,16 +170,63 @@ function redirectPlugin(options = {}) {
   };
 
   const compiled = [];
-  for (const rule of rules) {
+  const stringRulesMap = new Map();
+  let hasRegexRules = false;
+
+  const ruleList = Array.isArray(rules) ? rules : [];
+  for (const rule of ruleList) {
     const c = compileRule(rule, pluginOpts);
-    if (c) compiled.push(c);
+    if (!c) continue;
+    compiled.push(c);
+    if (c.kind === 'string') {
+      const keys = [c.fromNorm];
+      if (!c.trailing) {
+        const alt = c.fromRaw.replace(/\/$/, '') || '/';
+        if (!keys.includes(alt)) keys.push(alt);
+      }
+      for (const k of keys) {
+        let list = stringRulesMap.get(k);
+        if (!list) {
+          list = [];
+          stringRulesMap.set(k, list);
+        }
+        list.push(c);
+      }
+    } else {
+      hasRegexRules = true;
+    }
   }
 
   function redirectMiddleware(req, res, next) {
+    if (!req) return next();
     const rawPath = req.path || '/';
     const pathForMatch = normalizePathForTrailingSlash(pluginOpts.trailingSlash, rawPath);
     const method = req.method || 'GET';
 
+    // Fast O(1) path when all configured rules are string based
+    if (!hasRegexRules) {
+      const candidates = stringRulesMap.get(pathForMatch) || (!pluginOpts.trailingSlash ? stringRulesMap.get(rawPath.replace(/\/$/, '') || '/') : null);
+      if (candidates) {
+        for (const c of candidates) {
+          if (!methodMatches(c, method)) continue;
+          if (!pathMatches(c, pathForMatch, rawPath)) continue;
+
+          let location = c.to;
+          if (pluginOpts.preserveQuery && !location.includes('?')) {
+            const full = req.originalUrl || req.url || '';
+            const qi = full.indexOf('?');
+            if (qi !== -1) {
+              location += full.slice(qi);
+            }
+          }
+          res.redirect(c.status, location);
+          return;
+        }
+      }
+      return next();
+    }
+
+    // Linear path when regex rules are present to preserve definition order
     for (const c of compiled) {
       if (!methodMatches(c, method)) continue;
       if (!pathMatches(c, pathForMatch, rawPath)) continue;