webspresso 0.0.103 → 0.0.104

package/plugins/rest-resources/index.js

@@ -8,8 +8,7 @@ const { getAllModels } = require('../../core/orm/model');
 const { omit } = require('../../core/orm/utils');
 const { trimUrlPathSlashes } = require('../../core/url-path-normalize');
 const { validateQueryComplexity } = require('../../core/orm/complexity');
-
-const RESERVED_QUERY_KEYS = new Set(['page', 'perPage', 'sort', 'order', 'include', 'trashed']);
+const { applyColumnFilters, RESERVED_QUERY_KEYS } = require('../../core/orm/query-filters');
 
 /**
  * Pluralize a PascalCase model name to a URL segment (e.g. User -> users, Company -> companies)
@@ -234,212 +233,7 @@ function parseSortParams(model, rawSort, rawOrder) {
   return result;
 }
 
-function applyColumnFilters(query, countQuery, model, req) {
-  let q = query;
-  let c = countQuery;
-
-  function applyCondition(col, op, rawVal) {
-    if (!model.columns.has(col)) return;
-    const meta = model.columns.get(col);
-    const colType = meta?.type;
-
-    let operator = String(op || 'eq').toLowerCase();
-    let val = rawVal;
-
-    // Normalize booleans
-    if (colType === 'boolean' && typeof val === 'string') {
-      if (val === 'true' || val === '1') val = true;
-      else if (val === 'false' || val === '0') val = false;
-    }
-
-    switch (operator) {
-      case 'eq':
-      case '=':
-        if (val !== undefined && val !== '') {
-          q = q.where(col, '=', val);
-          c = c.where(col, '=', val);
-        }
-        break;
-
-      case 'ne':
-      case '!=':
-      case '<>':
-        if (val !== undefined && val !== '') {
-          q = q.where(col, '!=', val);
-          c = c.where(col, '!=', val);
-        }
-        break;
-
-      case 'gt':
-      case '>':
-        if (val !== undefined && val !== '') {
-          q = q.where(col, '>', val);
-          c = c.where(col, '>', val);
-        }
-        break;
-
-      case 'gte':
-      case '>=':
-        if (val !== undefined && val !== '') {
-          q = q.where(col, '>=', val);
-          c = c.where(col, '>=', val);
-        }
-        break;
-
-      case 'lt':
-      case '<':
-        if (val !== undefined && val !== '') {
-          q = q.where(col, '<', val);
-          c = c.where(col, '<', val);
-        }
-        break;
-
-      case 'lte':
-      case '<=':
-        if (val !== undefined && val !== '') {
-          q = q.where(col, '<=', val);
-          c = c.where(col, '<=', val);
-        }
-        break;
-
-      case 'in': {
-        const arr = Array.isArray(val)
-          ? val
-          : (typeof val === 'string' ? val.split(',').map(s => s.trim()).filter(Boolean) : [val]);
-        if (arr.length > 0) {
-          q = q.whereIn(col, arr);
-          c = c.whereIn(col, arr);
-        }
-        break;
-      }
-
-      case 'nin':
-      case 'notin': {
-        const arr = Array.isArray(val)
-          ? val
-          : (typeof val === 'string' ? val.split(',').map(s => s.trim()).filter(Boolean) : [val]);
-        if (arr.length > 0) {
-          q = q.whereNotIn(col, arr);
-          c = c.whereNotIn(col, arr);
-        }
-        break;
-      }
-
-      case 'like':
-        if (val !== undefined && val !== '') {
-          q = q.where(col, 'like', String(val));
-          c = c.where(col, 'like', String(val));
-        }
-        break;
-
-      case 'ilike':
-        if (val !== undefined && val !== '') {
-          q = q.where(col, 'ilike', String(val));
-          c = c.where(col, 'ilike', String(val));
-        }
-        break;
-
-      case 'contains':
-        if (val !== undefined && val !== '') {
-          q = q.where(col, 'like', `%${String(val)}%`);
-          c = c.where(col, 'like', `%${String(val)}%`);
-        }
-        break;
-
-      case 'startswith':
-        if (val !== undefined && val !== '') {
-          q = q.where(col, 'like', `${String(val)}%`);
-          c = c.where(col, 'like', `${String(val)}%`);
-        }
-        break;
-
-      case 'endswith':
-        if (val !== undefined && val !== '') {
-          q = q.where(col, 'like', `%${String(val)}`);
-          c = c.where(col, 'like', `%${String(val)}`);
-        }
-        break;
-
-      case 'isnull':
-      case 'is_null': {
-        const isTrue = val === true || val === 'true' || val === '1' || val === 1 || val === '';
-        if (isTrue) {
-          q = q.whereNull(col);
-          c = c.whereNull(col);
-        }
-        break;
-      }
-
-      case 'isnotnull':
-      case 'is_not_null': {
-        const isTrue = val === true || val === 'true' || val === '1' || val === 1 || val === '';
-        if (isTrue) {
-          q = q.whereNotNull(col);
-          c = c.whereNotNull(col);
-        }
-        break;
-      }
-
-      case 'between': {
-        let parts = [];
-        if (Array.isArray(val)) {
-          parts = val;
-        } else if (typeof val === 'string') {
-          parts = val.split(',').map(s => s.trim());
-        }
-        if (parts.length === 2 && parts[0] !== '' && parts[1] !== '') {
-          q = q.where(col, '>=', parts[0]).where(col, '<=', parts[1]);
-          c = c.where(col, '>=', parts[0]).where(col, '<=', parts[1]);
-        }
-        break;
-      }
-
-      default:
-        if (val !== undefined && val !== '') {
-          q = q.where(col, '=', val);
-          c = c.where(col, '=', val);
-        }
-        break;
-    }
-  }
-
-  // 1. Process dedicated filter object ?filter[col]=... or ?filter[col][op]=...
-  if (req.query.filter && typeof req.query.filter === 'object') {
-    for (const [col, colFilter] of Object.entries(req.query.filter)) {
-      if (!model.columns.has(col)) continue;
-      if (colFilter && typeof colFilter === 'object' && !Array.isArray(colFilter)) {
-        if (colFilter.op !== undefined && colFilter.value !== undefined) {
-          applyCondition(col, colFilter.op, colFilter.value);
-        } else {
-          for (const [op, val] of Object.entries(colFilter)) {
-            applyCondition(col, op, val);
-          }
-        }
-      } else if (colFilter !== undefined && colFilter !== '') {
-        applyCondition(col, 'eq', colFilter);
-      }
-    }
-  }
 
-  // 2. Process top-level query parameters ?price[gte]=100 or ?status=active
-  for (const [key, value] of Object.entries(req.query)) {
-    if (RESERVED_QUERY_KEYS.has(key) || key === 'filter') {
-      continue;
-    }
-    if (!model.columns.has(key)) {
-      continue;
-    }
-    if (value && typeof value === 'object' && !Array.isArray(value)) {
-      for (const [op, val] of Object.entries(value)) {
-        applyCondition(key, op, val);
-      }
-    } else if (value !== undefined && value !== '') {
-      applyCondition(key, 'eq', value);
-    }
-  }
-
-  return { query: q, countQuery: c };
-}
 
 /**
  * @param {Object} options

package/plugins/schema-explorer/admin-component.js

@@ -20,10 +20,12 @@ function generateSchemaExplorerAdminComponent(options = {}) {
 function getSchemaApi(method, path) {
   var adminPath = window.__ADMIN_PATH__ || '/_admin';
   var url = adminPath + '/api${apiPrefix}' + (path || '');
-  return fetch(url, {
+  var fetchFn = (typeof window !== 'undefined' && window.Admin && window.Admin.fetch) ? window.Admin.fetch : fetch;
+  return fetchFn(url, {
     method: method || 'GET',
     credentials: 'include',
-    headers: { 'Accept': 'application/json' }
+    headers: { 'Accept': 'application/json' },
+    timeout: 30000,
   }).then(function(res) {
     if (!res.ok) {
       return res.json().catch(function() { return { error: res.statusText }; }).then(function(err) {

package/plugins/schema-explorer.js

@@ -59,6 +59,25 @@ function schemaExplorerPlugin(options = {}) {
 
   const pageTitle = title || adminTitle || menuLabel;
 
+  let cachedGraph = null;
+  let cachedGraphTime = 0;
+  const GRAPH_CACHE_TTL = 5000; // 5 seconds in dev, infinite in prod
+
+  function getEnrichedGraph() {
+    const isProd = process.env.NODE_ENV === 'production';
+    const now = Date.now();
+    if (cachedGraph && (isProd || (now - cachedGraphTime) < GRAPH_CACHE_TTL)) {
+      return cachedGraph;
+    }
+    const rawModels = serializeAllModels({ exclude, includeColumns, includeRelations, includeScopes });
+    const relationships = extractAllRelationships(rawModels);
+    const enriched = enrichModelsWithGraph(rawModels, relationships);
+    const mermaid = generateMermaidErDiagram(rawModels, relationships);
+    cachedGraph = { rawModels, relationships, enriched, mermaid };
+    cachedGraphTime = now;
+    return cachedGraph;
+  }
+
   return {
     name: 'schema-explorer',
     version: '1.0.0',
@@ -66,6 +85,14 @@ function schemaExplorerPlugin(options = {}) {
 
     // Expose API for other plugins & programmatic consumption
     api: {
+      /**
+       * Invalidate schema explorer cache
+       */
+      invalidateCache() {
+        cachedGraph = null;
+        cachedGraphTime = 0;
+      },
+
       /**
        * Get all models metadata
        * @returns {Object[]}
@@ -79,9 +106,7 @@ function schemaExplorerPlugin(options = {}) {
        * @returns {Object[]}
        */
       getEnrichedModels() {
-        const raw = serializeAllModels({ exclude, includeColumns, includeRelations, includeScopes });
-        const rels = extractAllRelationships(raw);
-        return enrichModelsWithGraph(raw, rels);
+        return getEnrichedGraph().enriched;
       },
 
       /**
@@ -109,8 +134,7 @@ function schemaExplorerPlugin(options = {}) {
        * @returns {Object[]}
        */
       getRelationships() {
-        const raw = serializeAllModels({ exclude, includeColumns, includeRelations, includeScopes });
-        return extractAllRelationships(raw);
+        return getEnrichedGraph().relationships;
       },
 
       /**
@@ -118,9 +142,7 @@ function schemaExplorerPlugin(options = {}) {
        * @returns {string}
        */
       getMermaid() {
-        const raw = serializeAllModels({ exclude, includeColumns, includeRelations, includeScopes });
-        const rels = extractAllRelationships(raw);
-        return generateMermaidErDiagram(raw, rels);
+        return getEnrichedGraph().mermaid;
       },
 
       extractAllRelationships,
@@ -250,21 +272,17 @@ function schemaExplorerPlugin(options = {}) {
                   method: 'get',
                   path: '',
                   handler: (req, res) => {
-                    const rawModels = serializeAllModels({ exclude, includeColumns, includeRelations, includeScopes });
-                    const relationships = extractAllRelationships(rawModels);
-                    const models = enrichModelsWithGraph(rawModels, relationships);
-                    const mermaid = generateMermaidErDiagram(rawModels, relationships);
-
+                    const graph = getEnrichedGraph();
                     res.json({
                       meta: {
                         version: '1.0.0',
                         generatedAt: new Date().toISOString(),
-                        modelCount: models.length,
-                        relationCount: relationships.length,
+                        modelCount: graph.enriched.length,
+                        relationCount: graph.relationships.length,
                       },
-                      models,
-                      relationships,
-                      mermaid,
+                      models: graph.enriched,
+                      relationships: graph.relationships,
+                      mermaid: graph.mermaid,
                     });
                   },
                 },
@@ -272,19 +290,14 @@ function schemaExplorerPlugin(options = {}) {
                   method: 'get',
                   path: '/relations',
                   handler: (req, res) => {
-                    const rawModels = serializeAllModels({ exclude, includeColumns, includeRelations, includeScopes });
-                    const relationships = extractAllRelationships(rawModels);
-                    res.json({ relationships });
+                    res.json({ relationships: getEnrichedGraph().relationships });
                   },
                 },
                 {
                   method: 'get',
                   path: '/mermaid',
                   handler: (req, res) => {
-                    const rawModels = serializeAllModels({ exclude, includeColumns, includeRelations, includeScopes });
-                    const relationships = extractAllRelationships(rawModels);
-                    const mermaid = generateMermaidErDiagram(rawModels, relationships);
-                    res.json({ mermaid });
+                    res.json({ mermaid: getEnrichedGraph().mermaid });
                   },
                 },
                 {
@@ -298,10 +311,8 @@ function schemaExplorerPlugin(options = {}) {
                       return res.status(404).json({ error: `Model "${modelName}" not found` });
                     }
 
-                    const rawModels = serializeAllModels({ exclude, includeColumns, includeRelations, includeScopes });
-                    const relationships = extractAllRelationships(rawModels);
-                    const models = enrichModelsWithGraph(rawModels, relationships);
-                    const found = models.find(m => m.name === modelName);
+                    const graph = getEnrichedGraph();
+                    const found = graph.enriched.find(m => m.name === modelName);
 
                     res.json({ model: found });
                   },

package/plugins/seo-checker/index.js

@@ -50,12 +50,15 @@ function seoCheckerPlugin(options = {}) {
       // Inject panel styles into head
       ctx.injectHead(generatePanelStyles(), { priority: 100 });
 
+      const safeSettings = JSON.stringify(mergedSettings).replace(/</g, '\\u003c').replace(/>/g, '\\u003e');
+      const safeChecks = JSON.stringify(checkDefinitions).replace(/</g, '\\u003c').replace(/>/g, '\\u003e');
+
       // Inject panel HTML and analyzer script into body
       ctx.injectBody(`
         ${generatePanelHtml(checkDefinitions)}
         <script>
-          window.__SEO_CHECKER_SETTINGS__ = ${JSON.stringify(mergedSettings)};
-          window.__SEO_CHECKER_CHECKS__ = ${JSON.stringify(checkDefinitions)};
+          window.__SEO_CHECKER_SETTINGS__ = ${safeSettings};
+          window.__SEO_CHECKER_CHECKS__ = ${safeChecks};
         </script>
         <script>${analyzerScript}</script>
       `);

package/plugins/site-analytics/tracking.js

@@ -5,6 +5,7 @@
  */
 
 const crypto = require('crypto');
+const { getClientIp: resolveClientIp } = require('../../core/utils/ip');
 const { detectBot } = require('./bot-patterns');
 const { detectCountry } = require('./geo');
 
@@ -82,17 +83,13 @@ function quickHash(str) {
  * Get client IP from request, handling proxies
  */
 function getClientIp(req) {
-  const forwarded = req.headers['x-forwarded-for'];
-  if (forwarded) {
-    return forwarded.split(',')[0].trim();
-  }
-  return req.headers['x-real-ip'] || req.ip || req.connection?.remoteAddress || '';
+  return resolveClientIp(req, '');
 }
 
 /**
  * Create tracking middleware
- * @param {Object} options
- * @param {Object} options.knex - Knex instance
+ * @param {Object} [options={}]
+ * @param {Object} [options.knex] - Knex instance
  * @param {string[]} [options.excludePaths] - Paths to exclude from tracking
  * @param {boolean} [options.trackBots=true] - Whether to record bot visits
  * @param {string} [options.tableName='analytics_page_views'] - DB table name
@@ -103,7 +100,8 @@ function getClientIp(req) {
  * @param {number} [options.maxQueueSize=5000] - Queue memory cap to prevent OOM
  * @param {number} [options.errorLogIntervalMs=60000] - Rate limit window for batch failure logs
  */
-function createTrackingMiddleware(options) {
+function createTrackingMiddleware(options = {}) {
+  const opts = options || {};
   const {
     knex,
     excludePaths = [],
@@ -115,7 +113,7 @@ function createTrackingMiddleware(options) {
     maxBackoffMs = 60000,
     maxQueueSize = 5000,
     errorLogIntervalMs = 60000,
-  } = options;
+  } = opts;
 
   const allExcludes = [...DEFAULT_EXCLUDE, ...excludePaths];
   let tableReady = false;
@@ -213,7 +211,7 @@ function createTrackingMiddleware(options) {
 
   async function flushQueue() {
     if (flushPromise) return flushPromise;
-    if (queue.length === 0) return;
+    if (queue.length === 0 || !knex) return;
 
     const now = Date.now();
     if (now < nextAllowedFlushTime) {
@@ -299,16 +297,17 @@ function createTrackingMiddleware(options) {
   if (periodicFlushInterval.unref) periodicFlushInterval.unref();
 
   async function trackingMiddleware(req, res, next) {
-    next();
+    if (typeof next === 'function') next();
 
-    if (req.method !== 'GET') return;
+    if (!req || req.method !== 'GET') return;
 
-    const path = req.path;
-    if (STATIC_EXT.test(path)) return;
+    const path = req.path || req.url || '';
+    if (!path || STATIC_EXT.test(path)) return;
     if (allExcludes.some(prefix => path.startsWith(prefix))) return;
 
     try {
-      const userAgent = req.headers['user-agent'] || '';
+      const headers = req.headers || {};
+      const userAgent = headers['user-agent'] || '';
       const ip = getClientIp(req);
       const { isBot, botName } = detectBot(userAgent);
 
@@ -329,7 +328,7 @@ function createTrackingMiddleware(options) {
         : getSessionId(visitorId);
 
       const country = detectCountry(req);
-      const referrer = req.headers['referer'] || req.headers['referrer'] || null;
+      const referrer = headers['referer'] || headers['referrer'] || null;
 
       if (queue.length < maxQueueSize) {
         queue.push({
@@ -385,6 +384,10 @@ function createTrackingMiddleware(options) {
     }
     clearInterval(sessionCleanupInterval);
     clearInterval(periodicFlushInterval);
+    if (queue.length > 0 && knex) {
+      return flushQueue().catch(() => {});
+    }
+    return Promise.resolve();
   };
 
   return trackingMiddleware;

package/plugins/sitemap.js

@@ -157,8 +157,9 @@ function sitemapPlugin(options = {}) {
   const dynamicExclusions = [...exclude];
   const registeredSources = [...dynamicSources];
   
-  // Cached URLs (for dynamic sources)
+  // Cached URLs and pre-rendered XML (for dynamic sources)
   let cachedUrls = null;
+  let cachedXml = null;
   let cacheTime = null;
   const cacheMaxAge = options.cacheMaxAge || 5 * 60 * 1000; // 5 minutes default
   
@@ -326,7 +327,8 @@ function sitemapPlugin(options = {}) {
        */
       addUrl(path, opts = {}) {
         dynamicUrls.push({ path, ...opts });
-        cachedUrls = null; // Invalidate cache
+        cachedUrls = null;
+        cachedXml = null;
       },
       
       /**
@@ -335,7 +337,8 @@ function sitemapPlugin(options = {}) {
        */
       exclude(pattern) {
         dynamicExclusions.push(pattern);
-        cachedUrls = null; // Invalidate cache
+        cachedUrls = null;
+        cachedXml = null;
       },
       
       /**
@@ -347,7 +350,8 @@ function sitemapPlugin(options = {}) {
           throw new Error('urlPattern is required for dynamic source');
         }
         registeredSources.push(source);
-        cachedUrls = null; // Invalidate cache
+        cachedUrls = null;
+        cachedXml = null;
       },
       
       /**
@@ -369,6 +373,7 @@ function sitemapPlugin(options = {}) {
        */
       invalidateCache() {
         cachedUrls = null;
+        cachedXml = null;
         cacheTime = null;
       }
     },
@@ -384,28 +389,26 @@ function sitemapPlugin(options = {}) {
         try {
           // Check cache
           const now = Date.now();
-          if (cachedUrls && cacheTime && (now - cacheTime) < cacheMaxAge) {
+          if (cachedXml && cacheTime && (now - cacheTime) < cacheMaxAge) {
             res.type('application/xml');
-            return res.send(generateSitemapXml(cachedUrls, { 
-              hostname, 
-              defaultChangefreq: changefreq, 
-              defaultPriority: priority 
-            }));
+            return res.send(cachedXml);
           }
           
           // Build URLs
           const urls = await buildAllUrls(ctx.routes, dbInstance);
+          const xml = generateSitemapXml(urls, { 
+            hostname, 
+            defaultChangefreq: changefreq, 
+            defaultPriority: priority 
+          });
           
           // Cache results
           cachedUrls = urls;
+          cachedXml = xml;
           cacheTime = now;
           
           res.type('application/xml');
-          res.send(generateSitemapXml(urls, { 
-            hostname, 
-            defaultChangefreq: changefreq, 
-            defaultPriority: priority 
-          }));
+          res.send(xml);
         } catch (err) {
           console.error('Sitemap generation error:', err);
           res.status(500).send('Error generating sitemap');

package/plugins/swagger.js

@@ -11,20 +11,7 @@ const { buildOpenApiDocument } = require('../core/openapi/build-from-api-routes'
 
 const PKG = require(path.join(__dirname, '..', 'package.json'));
 
-/**
- * HTML Escaping
- * @param {string} str
- * @returns {string}
- */
-function escapeHtml(str) {
-  if (!str) return '';
-  return String(str)
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#039;');
-}
+const { escapeHtml } = require('../core/utils/html');
 
 /**
  * Generates Swagger UI HTML page
@@ -258,10 +245,15 @@ function swaggerPlugin(options = {}) {
 
       const server = serverUrl || process.env.BASE_URL || 'http://localhost:3000';
 
+      let cachedDoc = null;
+
       // 1. OpenAPI 3 JSON Endpoint
       ctx.addRoute('get', jsonPath, (req, res) => {
         if (forbid(req, res)) return;
         try {
+          if (cachedDoc && process.env.NODE_ENV === 'production') {
+            return res.json(cachedDoc);
+          }
           const doc = buildOpenApiDocument({
             routes: ctx.routes || [],
             pagesDir: ctx.options.pagesDir,
@@ -274,6 +266,9 @@ function swaggerPlugin(options = {}) {
             },
             servers: [{ url: server.replace(/\/$/, '') }],
           });
+          if (process.env.NODE_ENV === 'production') {
+            cachedDoc = doc;
+          }
           res.json(doc);
         } catch (err) {
           console.warn('[swagger] OpenAPI generation failed:', err.message);

package/plugins/webhooks/crypto.js

@@ -20,24 +20,7 @@ function generateSecret(prefix = 'whsec_', byteLength = 24) {
   return `${prefix || ''}${bytes}`;
 }
 
-/**
- * Perform constant-time string comparison to prevent timing attacks
- * 
- * @param {string} a 
- * @param {string} b 
- * @returns {boolean}
- */
-function safeCompare(a, b) {
-  if (typeof a !== 'string' || typeof b !== 'string') {
-    return false;
-  }
-  const bufA = Buffer.from(a, 'utf8');
-  const bufB = Buffer.from(b, 'utf8');
-  if (bufA.length !== bufB.length) {
-    return false;
-  }
-  return crypto.timingSafeEqual(bufA, bufB);
-}
+const { safeCompare } = require('../../core/utils/crypto');
 
 /**
  * Sign a webhook payload using HMAC-SHA256

package/plugins/webhooks/dispatcher.js

@@ -461,9 +461,14 @@ class WebhookDispatcher extends EventEmitter {
             attempt: attempt + 1,
             autoRetry: true,
           }).catch((err) => {
-            this.emit('error', err);
+            if (this.listenerCount('error') > 0) {
+              this.emit('error', err);
+            } else {
+              console.error('[webhooks] Delivery retry failed:', err?.message || err);
+            }
           });
         }, delayMs);
+        if (timer.unref) timer.unref();
         this._activeTimers.add(timer);
       }
     } else {