webspresso 0.0.103 → 0.0.104

package/plugins/webhooks/matcher.js

@@ -48,6 +48,25 @@ function normalizeEvents(events) {
   return ['*'];
 }
 
+const regexCache = new Map();
+const MAX_REGEX_CACHE = 1000;
+
+function getPatternRegex(pattern) {
+  let cached = regexCache.get(pattern);
+  if (!cached) {
+    if (regexCache.size >= MAX_REGEX_CACHE) {
+      const first = regexCache.keys().next().value;
+      if (first !== undefined) regexCache.delete(first);
+    }
+    const escaped = pattern
+      .replace(/[.+?^${}()|[\]\\]/g, '\\$&') // escape regex specials except *
+      .replace(/\*/g, '.*');
+    cached = new RegExp(`^${escaped}$`, 'i');
+    regexCache.set(pattern, cached);
+  }
+  return cached;
+}
+
 /**
  * Test whether an event pattern matches an actual event name
  * 
@@ -56,12 +75,15 @@ function normalizeEvents(events) {
  * @returns {boolean}
  */
 function matchEvent(pattern, eventName) {
-  if (!pattern || !eventName) {
+  if (typeof pattern !== 'string' || typeof eventName !== 'string') {
     return false;
   }
 
   const p = pattern.trim();
   const e = eventName.trim();
+  if (!p || !e) {
+    return false;
+  }
 
   // 1. Wildcard matches all
   if (p === '*') {
@@ -73,15 +95,8 @@ function matchEvent(pattern, eventName) {
     return true;
   }
 
-  // 3. Glob / Wildcard conversion
-  // Convert 'user.*' to regular expression '^user\.[^.]+$' or '^user\..+$'
-  // Support prefix, middle, or suffix wildcards safely
-  const escaped = p
-    .replace(/[.+?^${}()|[\]\\]/g, '\\$&') // escape regex specials except *
-    .replace(/\*/g, '.*');
-
-  const regex = new RegExp(`^${escaped}$`, 'i');
-  return regex.test(e);
+  // 3. Glob / Wildcard conversion with bounded cache
+  return getPatternRegex(p).test(e);
 }
 
 /**

package/plugins/webhooks/sender.js

@@ -32,7 +32,8 @@ const { signPayload } = require('./crypto');
  *   timestamp: number
  * }>}
  */
-async function sendWebhook(options) {
+async function sendWebhook(options = {}) {
+  const opts = options || {};
   const {
     url,
     event,
@@ -43,7 +44,7 @@ async function sendWebhook(options) {
     timeoutMs = 10000,
     wrapPayload = true,
     maxResponseBodyLength = 2048,
-  } = options;
+  } = opts;
 
   if (!url || typeof url !== 'string') {
     return {
@@ -57,6 +58,32 @@ async function sendWebhook(options) {
     };
   }
 
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(url);
+    if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+      return {
+        success: false,
+        statusCode: 0,
+        responseBody: '',
+        durationMs: 0,
+        error: `Invalid webhook URL protocol: "${parsedUrl.protocol}". Only http: and https: are supported.`,
+        deliveryId,
+        timestamp: Math.floor(Date.now() / 1000),
+      };
+    }
+  } catch (err) {
+    return {
+      success: false,
+      statusCode: 0,
+      responseBody: '',
+      durationMs: 0,
+      error: 'Invalid webhook URL: destination URL is malformed.',
+      deliveryId,
+      timestamp: Math.floor(Date.now() / 1000),
+    };
+  }
+
   const timestamp = Math.floor(Date.now() / 1000);
 
   // Construct request body
@@ -116,6 +143,9 @@ async function sendWebhook(options) {
     timeoutId = setTimeout(() => {
       controller.abort();
     }, timeoutMs);
+    if (timeoutId && timeoutId.unref) {
+      timeoutId.unref();
+    }
 
     const response = await fetch(url, {
       method: 'POST',

package/src/dev-reload/index.js

@@ -15,6 +15,8 @@ const CLIENT_RUNTIME_SCRIPT = `(function() {
 
   var es = null;
   var reconnectTimer = null;
+  var wasConnected = false;
+  var reconnectDelay = 200;
 
   function reloadCss(targetFile) {
     var links = document.querySelectorAll('link[rel="stylesheet"]');
@@ -166,6 +168,36 @@ const CLIENT_RUNTIME_SCRIPT = `(function() {
     document.addEventListener('keydown', onKeyDown);
   }
 
+  function safeReload(reason) {
+    clearOverlay();
+    var reasonMsg = reason ? ' (' + reason + ')' : '';
+    console.log('[Webspresso] 🔄 Reloading page' + reasonMsg + '...');
+
+    // Ping server with lightweight HEAD request to make sure it is ready before full reload.
+    // This prevents browser "This site can't be reached" (ERR_CONNECTION_REFUSED) screens
+    // when the dev server is in the middle of restarting.
+    function pingAndReload() {
+      if (typeof window.fetch !== 'function') {
+        window.location.reload();
+        return;
+      }
+
+      fetch(window.location.href, { method: 'HEAD', cache: 'no-store' })
+        .then(function(res) {
+          if (res.ok || res.status < 500) {
+            window.location.reload();
+          } else {
+            setTimeout(pingAndReload, 150);
+          }
+        })
+        .catch(function() {
+          setTimeout(pingAndReload, 150);
+        });
+    }
+
+    setTimeout(pingAndReload, 30);
+  }
+
   function connect() {
     if (es) {
       try { es.close(); } catch (_) {}
@@ -173,6 +205,16 @@ const CLIENT_RUNTIME_SCRIPT = `(function() {
 
     es = new window.EventSource('${SSE_ENDPOINT_PATH}');
 
+    es.addEventListener('open', function() {
+      reconnectDelay = 200;
+      if (wasConnected) {
+        console.log('[Webspresso] 🔄 Dev server reconnected, reloading page...');
+        safeReload('server reconnected');
+        return;
+      }
+      wasConnected = true;
+    });
+
     es.addEventListener('reload', function(e) {
       try {
         var data = JSON.parse(e.data);
@@ -180,10 +222,7 @@ const CLIENT_RUNTIME_SCRIPT = `(function() {
           clearOverlay();
           reloadCss(data.file);
         } else if (data.type === 'full') {
-          clearOverlay();
-          var reasonMsg = data.reason ? ' (' + data.reason + ')' : '';
-          console.log('[Webspresso] 🔄 Reloading page' + reasonMsg + '...');
-          window.location.reload();
+          safeReload(data.reason);
         } else if (data.type === 'error') {
           showOverlay(data);
         } else if (data.type === 'clear-error') {
@@ -195,12 +234,14 @@ const CLIENT_RUNTIME_SCRIPT = `(function() {
     });
 
     es.onerror = function() {
-      es.close();
+      try { es.close(); } catch (_) {}
       if (!reconnectTimer) {
+        var delay = reconnectDelay;
+        reconnectDelay = Math.min(reconnectDelay * 1.5, 1500);
         reconnectTimer = setTimeout(function() {
           reconnectTimer = null;
           connect();
-        }, 2000);
+        }, delay);
       }
     };
   }

package/src/helpers.js

@@ -627,15 +627,7 @@ class AssetManager {
    * Escape HTML special characters
    */
   escapeHtml(str) {
-    if (!str || typeof str !== 'string' || !/[&"'<>]/.test(str)) {
-      return str;
-    }
-    return str
-      .replace(/&/g, '&amp;')
-      .replace(/"/g, '&quot;')
-      .replace(/'/g, '&#39;')
-      .replace(/</g, '&lt;')
-      .replace(/>/g, '&gt;');
+    return require('../core/utils/html').escapeHtml(str);
   }
 }
 
@@ -2204,6 +2196,26 @@ const utils = {
 
   pageAssets(nameOrAttrs, attrs) {
     return getAssetManager().pageAssets(nameOrAttrs, attrs);
+  },
+
+  fetchWithTimeout(url, options) {
+    return require('../core/utils/fetch').fetchWithTimeout(url, options);
+  },
+
+  safeCompare(a, b) {
+    return require('../core/utils/crypto').safeCompare(a, b);
+  },
+
+  escapeHtml(value) {
+    return require('../core/utils/html').escapeHtml(value);
+  },
+
+  unescapeHtml(value) {
+    return require('../core/utils/html').unescapeHtml(value);
+  },
+
+  getClientIp(req, fallback) {
+    return require('../core/utils/ip').getClientIp(req, fallback);
   }
 };
 

package/src/server.js

@@ -642,8 +642,8 @@ function createApp(options = {}) {
 
   const shutdownConfig = {
     enabled: true,
-    mode: 'graceful',
-    timeout: 10_000,
+    mode: isDev ? 'force' : 'graceful',
+    timeout: isDev ? 1000 : 10_000,
     ...(options.shutdown || options.server?.shutdown || {}),
   };