webspresso 0.0.103 → 0.0.105

package/plugins/rls/index.js

@@ -0,0 +1,170 @@
+/**
+ * Webspresso RLS Plugin — Dynamic Model Row-Level Security
+ * Automatically bridges request authentication (req.user, req.auth, req.tenantId)
+ * to ORM repositories with role-based bypass and route-level overrides.
+ * Zero external dependencies.
+ * @module plugins/rls
+ */
+
+/**
+ * Default user extractor from HTTP request
+ * @param {import('express').Request} req
+ * @returns {Object|null}
+ */
+function defaultGetUser(req) {
+  if (!req) return null;
+  return req.user || req.adminUser || (req.auth && req.auth.user) || null;
+}
+
+/**
+ * Default tenant extractor from HTTP request
+ * @param {import('express').Request} req
+ * @param {Object|null} [user]
+ * @returns {unknown|null}
+ */
+function defaultGetTenantId(req, user) {
+  if (!req) return null;
+  if (req.tenantId !== undefined && req.tenantId !== null) return req.tenantId;
+  if (req.tenant !== undefined && req.tenant !== null) return req.tenant;
+  if (user && typeof user === 'object') {
+    if (user.tenant_id !== undefined && user.tenant_id !== null) return user.tenant_id;
+    if (user.tenantId !== undefined && user.tenantId !== null) return user.tenantId;
+    if (user.organization_id !== undefined && user.organization_id !== null) return user.organization_id;
+    if (user.organizationId !== undefined && user.organizationId !== null) return user.organizationId;
+  }
+  return null;
+}
+
+/**
+ * Create Express middleware for Row Level Security
+ * Wraps req.db methods to automatically inject authenticated user and tenant context
+ *
+ * @param {Object} [options]
+ * @param {string[]|Function|false} [options.bypassRoles=['admin', 'superadmin']] - Roles that bypass RLS
+ * @param {Function} [options.getUser] - Custom user extractor (req) => user
+ * @param {Function} [options.getTenantId] - Custom tenant extractor (req, user) => tenantId
+ * @param {boolean} [options.enabled=true] - Whether RLS middleware is active
+ * @returns {Function} Express middleware handler
+ */
+function createRlsMiddleware(options = {}) {
+  const {
+    bypassRoles = ['admin', 'superadmin'],
+    getUser = defaultGetUser,
+    getTenantId = defaultGetTenantId,
+    enabled = true,
+  } = options;
+
+  return (req, res, next) => {
+    if (!enabled) return next();
+
+    const user = typeof getUser === 'function' ? getUser(req) : null;
+    const tenantId = typeof getTenantId === 'function' ? getTenantId(req, user) : null;
+
+    // Check if user has global bypass role
+    let isBypassed = false;
+    if (user && bypassRoles) {
+      if (typeof bypassRoles === 'function') {
+        isBypassed = Boolean(bypassRoles(user, req));
+      } else if (Array.isArray(bypassRoles)) {
+        const uRole = user.role || user.roleName || user.type;
+        const uRoles = Array.isArray(user.roles) ? user.roles : (uRole ? [uRole] : []);
+        isBypassed = bypassRoles.some((r) => uRoles.includes(r));
+      }
+    }
+
+    // Wrap req.db if it exists on the request
+    if (req.db && typeof req.db.getRepository === 'function' && !req.db._rlsWrapped) {
+      const origGetRepo = req.db.getRepository.bind(req.db);
+      const origQuery = req.db.query ? req.db.query.bind(req.db) : null;
+      const origCreateRepo = req.db.createRepository ? req.db.createRepository.bind(req.db) : null;
+
+      const reqDb = Object.create(req.db);
+      reqDb._rlsWrapped = true;
+
+      reqDb.getRepository = (modelName, customContext = {}) => {
+        const ctx = {
+          user,
+          tenantId: customContext.tenantId !== undefined ? customContext.tenantId : tenantId,
+          rlsDisabled: isBypassed || customContext.rlsDisabled === true,
+          ...customContext,
+        };
+        return origGetRepo(modelName, ctx);
+      };
+
+      if (origCreateRepo) {
+        reqDb.createRepository = (model, customContext = {}) => {
+          const ctx = {
+            user,
+            tenantId: customContext.tenantId !== undefined ? customContext.tenantId : tenantId,
+            rlsDisabled: isBypassed || customContext.rlsDisabled === true,
+            ...customContext,
+          };
+          return origCreateRepo(model, ctx);
+        };
+      }
+
+      if (origQuery) {
+        reqDb.query = (modelName, customContext = {}) => {
+          const ctx = {
+            user,
+            tenantId: customContext.tenantId !== undefined ? customContext.tenantId : tenantId,
+            rlsDisabled: isBypassed || customContext.rlsDisabled === true,
+            ...customContext,
+          };
+          return origQuery(modelName, ctx);
+        };
+      }
+
+      req.db = reqDb;
+    }
+
+    next();
+  };
+}
+
+/**
+ * Webspresso RLS Plugin Factory
+ *
+ * @param {Object} [options] - Plugin configuration options
+ * @param {boolean} [options.global=true] - Mount global middleware on app
+ * @param {string[]|Function|false} [options.bypassRoles=['admin', 'superadmin']] - Global roles bypassing RLS
+ * @param {Function} [options.getUser] - Custom user extractor
+ * @param {Function} [options.getTenantId] - Custom tenant extractor
+ * @param {boolean} [options.enabled=true] - Enabled flag
+ * @returns {Object} Webspresso Plugin Definition
+ */
+function rlsPlugin(options = {}) {
+  const { global: applyGlobal = true, ...pluginDefaults } = options;
+
+  return {
+    name: 'rls',
+    version: '1.0.0',
+    description: 'Dynamic Model Row-Level Security (RLS) with automatic request context binding',
+    options,
+
+    api: {
+      createMiddleware: (routeOpts = {}) =>
+        createRlsMiddleware({ ...pluginDefaults, ...routeOpts }),
+    },
+
+    register(ctx) {
+      // Named middleware for route definitions: middleware: ['rls']
+      if (ctx.middlewares) {
+        ctx.middlewares.rls = (routeOpts = {}) =>
+          createRlsMiddleware({ ...pluginDefaults, ...routeOpts });
+      }
+
+      // Global middleware (mounted by default unless global: false)
+      if (applyGlobal && ctx.app) {
+        ctx.app.use(createRlsMiddleware(options));
+      }
+    },
+  };
+}
+
+rlsPlugin.rlsPlugin = rlsPlugin;
+rlsPlugin.createRlsMiddleware = createRlsMiddleware;
+
+module.exports = rlsPlugin;
+module.exports.rlsPlugin = rlsPlugin;
+module.exports.createRlsMiddleware = createRlsMiddleware;

package/plugins/schema-explorer/admin-component.js

@@ -20,10 +20,12 @@ function generateSchemaExplorerAdminComponent(options = {}) {
 function getSchemaApi(method, path) {
   var adminPath = window.__ADMIN_PATH__ || '/_admin';
   var url = adminPath + '/api${apiPrefix}' + (path || '');
-  return fetch(url, {
+  var fetchFn = (typeof window !== 'undefined' && window.Admin && window.Admin.fetch) ? window.Admin.fetch : fetch;
+  return fetchFn(url, {
     method: method || 'GET',
     credentials: 'include',
-    headers: { 'Accept': 'application/json' }
+    headers: { 'Accept': 'application/json' },
+    timeout: 30000,
   }).then(function(res) {
     if (!res.ok) {
       return res.json().catch(function() { return { error: res.statusText }; }).then(function(err) {

package/plugins/schema-explorer.js

@@ -59,6 +59,25 @@ function schemaExplorerPlugin(options = {}) {
 
   const pageTitle = title || adminTitle || menuLabel;
 
+  let cachedGraph = null;
+  let cachedGraphTime = 0;
+  const GRAPH_CACHE_TTL = 5000; // 5 seconds in dev, infinite in prod
+
+  function getEnrichedGraph() {
+    const isProd = process.env.NODE_ENV === 'production';
+    const now = Date.now();
+    if (cachedGraph && (isProd || (now - cachedGraphTime) < GRAPH_CACHE_TTL)) {
+      return cachedGraph;
+    }
+    const rawModels = serializeAllModels({ exclude, includeColumns, includeRelations, includeScopes });
+    const relationships = extractAllRelationships(rawModels);
+    const enriched = enrichModelsWithGraph(rawModels, relationships);
+    const mermaid = generateMermaidErDiagram(rawModels, relationships);
+    cachedGraph = { rawModels, relationships, enriched, mermaid };
+    cachedGraphTime = now;
+    return cachedGraph;
+  }
+
   return {
     name: 'schema-explorer',
     version: '1.0.0',
@@ -66,6 +85,14 @@ function schemaExplorerPlugin(options = {}) {
 
     // Expose API for other plugins & programmatic consumption
     api: {
+      /**
+       * Invalidate schema explorer cache
+       */
+      invalidateCache() {
+        cachedGraph = null;
+        cachedGraphTime = 0;
+      },
+
       /**
        * Get all models metadata
        * @returns {Object[]}
@@ -79,9 +106,7 @@ function schemaExplorerPlugin(options = {}) {
        * @returns {Object[]}
        */
       getEnrichedModels() {
-        const raw = serializeAllModels({ exclude, includeColumns, includeRelations, includeScopes });
-        const rels = extractAllRelationships(raw);
-        return enrichModelsWithGraph(raw, rels);
+        return getEnrichedGraph().enriched;
       },
 
       /**
@@ -109,8 +134,7 @@ function schemaExplorerPlugin(options = {}) {
        * @returns {Object[]}
        */
       getRelationships() {
-        const raw = serializeAllModels({ exclude, includeColumns, includeRelations, includeScopes });
-        return extractAllRelationships(raw);
+        return getEnrichedGraph().relationships;
       },
 
       /**
@@ -118,9 +142,7 @@ function schemaExplorerPlugin(options = {}) {
        * @returns {string}
        */
       getMermaid() {
-        const raw = serializeAllModels({ exclude, includeColumns, includeRelations, includeScopes });
-        const rels = extractAllRelationships(raw);
-        return generateMermaidErDiagram(raw, rels);
+        return getEnrichedGraph().mermaid;
       },
 
       extractAllRelationships,
@@ -250,21 +272,17 @@ function schemaExplorerPlugin(options = {}) {
                   method: 'get',
                   path: '',
                   handler: (req, res) => {
-                    const rawModels = serializeAllModels({ exclude, includeColumns, includeRelations, includeScopes });
-                    const relationships = extractAllRelationships(rawModels);
-                    const models = enrichModelsWithGraph(rawModels, relationships);
-                    const mermaid = generateMermaidErDiagram(rawModels, relationships);
-
+                    const graph = getEnrichedGraph();
                     res.json({
                       meta: {
                         version: '1.0.0',
                         generatedAt: new Date().toISOString(),
-                        modelCount: models.length,
-                        relationCount: relationships.length,
+                        modelCount: graph.enriched.length,
+                        relationCount: graph.relationships.length,
                       },
-                      models,
-                      relationships,
-                      mermaid,
+                      models: graph.enriched,
+                      relationships: graph.relationships,
+                      mermaid: graph.mermaid,
                     });
                   },
                 },
@@ -272,19 +290,14 @@ function schemaExplorerPlugin(options = {}) {
                   method: 'get',
                   path: '/relations',
                   handler: (req, res) => {
-                    const rawModels = serializeAllModels({ exclude, includeColumns, includeRelations, includeScopes });
-                    const relationships = extractAllRelationships(rawModels);
-                    res.json({ relationships });
+                    res.json({ relationships: getEnrichedGraph().relationships });
                   },
                 },
                 {
                   method: 'get',
                   path: '/mermaid',
                   handler: (req, res) => {
-                    const rawModels = serializeAllModels({ exclude, includeColumns, includeRelations, includeScopes });
-                    const relationships = extractAllRelationships(rawModels);
-                    const mermaid = generateMermaidErDiagram(rawModels, relationships);
-                    res.json({ mermaid });
+                    res.json({ mermaid: getEnrichedGraph().mermaid });
                   },
                 },
                 {
@@ -298,10 +311,8 @@ function schemaExplorerPlugin(options = {}) {
                       return res.status(404).json({ error: `Model "${modelName}" not found` });
                     }
 
-                    const rawModels = serializeAllModels({ exclude, includeColumns, includeRelations, includeScopes });
-                    const relationships = extractAllRelationships(rawModels);
-                    const models = enrichModelsWithGraph(rawModels, relationships);
-                    const found = models.find(m => m.name === modelName);
+                    const graph = getEnrichedGraph();
+                    const found = graph.enriched.find(m => m.name === modelName);
 
                     res.json({ model: found });
                   },

package/plugins/seo-checker/index.js

@@ -50,12 +50,15 @@ function seoCheckerPlugin(options = {}) {
       // Inject panel styles into head
       ctx.injectHead(generatePanelStyles(), { priority: 100 });
 
+      const safeSettings = JSON.stringify(mergedSettings).replace(/</g, '\\u003c').replace(/>/g, '\\u003e');
+      const safeChecks = JSON.stringify(checkDefinitions).replace(/</g, '\\u003c').replace(/>/g, '\\u003e');
+
       // Inject panel HTML and analyzer script into body
       ctx.injectBody(`
         ${generatePanelHtml(checkDefinitions)}
         <script>
-          window.__SEO_CHECKER_SETTINGS__ = ${JSON.stringify(mergedSettings)};
-          window.__SEO_CHECKER_CHECKS__ = ${JSON.stringify(checkDefinitions)};
+          window.__SEO_CHECKER_SETTINGS__ = ${safeSettings};
+          window.__SEO_CHECKER_CHECKS__ = ${safeChecks};
         </script>
         <script>${analyzerScript}</script>
       `);

package/plugins/site-analytics/tracking.js

@@ -4,7 +4,8 @@
  * @module plugins/site-analytics/tracking
  */
 
-const crypto = require('crypto');
+const { sha256 } = require('../../core/utils/crypto');
+const { getClientIp: resolveClientIp } = require('../../core/utils/ip');
 const { detectBot } = require('./bot-patterns');
 const { detectCountry } = require('./geo');
 
@@ -75,24 +76,20 @@ function isPermanentDbError(e) {
  * Hash a string with SHA-256 (truncated to 16 hex chars for compactness)
  */
 function quickHash(str) {
-  return crypto.createHash('sha256').update(str).digest('hex').slice(0, 16);
+  return sha256(str).slice(0, 16);
 }
 
 /**
  * Get client IP from request, handling proxies
  */
 function getClientIp(req) {
-  const forwarded = req.headers['x-forwarded-for'];
-  if (forwarded) {
-    return forwarded.split(',')[0].trim();
-  }
-  return req.headers['x-real-ip'] || req.ip || req.connection?.remoteAddress || '';
+  return resolveClientIp(req, '');
 }
 
 /**
  * Create tracking middleware
- * @param {Object} options
- * @param {Object} options.knex - Knex instance
+ * @param {Object} [options={}]
+ * @param {Object} [options.knex] - Knex instance
  * @param {string[]} [options.excludePaths] - Paths to exclude from tracking
  * @param {boolean} [options.trackBots=true] - Whether to record bot visits
  * @param {string} [options.tableName='analytics_page_views'] - DB table name
@@ -103,7 +100,8 @@ function getClientIp(req) {
  * @param {number} [options.maxQueueSize=5000] - Queue memory cap to prevent OOM
  * @param {number} [options.errorLogIntervalMs=60000] - Rate limit window for batch failure logs
  */
-function createTrackingMiddleware(options) {
+function createTrackingMiddleware(options = {}) {
+  const opts = options || {};
   const {
     knex,
     excludePaths = [],
@@ -115,7 +113,7 @@ function createTrackingMiddleware(options) {
     maxBackoffMs = 60000,
     maxQueueSize = 5000,
     errorLogIntervalMs = 60000,
-  } = options;
+  } = opts;
 
   const allExcludes = [...DEFAULT_EXCLUDE, ...excludePaths];
   let tableReady = false;
@@ -213,7 +211,7 @@ function createTrackingMiddleware(options) {
 
   async function flushQueue() {
     if (flushPromise) return flushPromise;
-    if (queue.length === 0) return;
+    if (queue.length === 0 || !knex) return;
 
     const now = Date.now();
     if (now < nextAllowedFlushTime) {
@@ -299,16 +297,17 @@ function createTrackingMiddleware(options) {
   if (periodicFlushInterval.unref) periodicFlushInterval.unref();
 
   async function trackingMiddleware(req, res, next) {
-    next();
+    if (typeof next === 'function') next();
 
-    if (req.method !== 'GET') return;
+    if (!req || req.method !== 'GET') return;
 
-    const path = req.path;
-    if (STATIC_EXT.test(path)) return;
+    const path = req.path || req.url || '';
+    if (!path || STATIC_EXT.test(path)) return;
     if (allExcludes.some(prefix => path.startsWith(prefix))) return;
 
     try {
-      const userAgent = req.headers['user-agent'] || '';
+      const headers = req.headers || {};
+      const userAgent = headers['user-agent'] || '';
       const ip = getClientIp(req);
       const { isBot, botName } = detectBot(userAgent);
 
@@ -329,7 +328,7 @@ function createTrackingMiddleware(options) {
         : getSessionId(visitorId);
 
       const country = detectCountry(req);
-      const referrer = req.headers['referer'] || req.headers['referrer'] || null;
+      const referrer = headers['referer'] || headers['referrer'] || null;
 
       if (queue.length < maxQueueSize) {
         queue.push({
@@ -385,6 +384,10 @@ function createTrackingMiddleware(options) {
     }
     clearInterval(sessionCleanupInterval);
     clearInterval(periodicFlushInterval);
+    if (queue.length > 0 && knex) {
+      return flushQueue().catch(() => {});
+    }
+    return Promise.resolve();
   };
 
   return trackingMiddleware;

package/plugins/sitemap.js

@@ -4,6 +4,7 @@
  */
 
 const { matchPattern } = require('../src/plugin-manager');
+const { stripTrailingSlash } = require('../core/utils/url');
 
 /**
  * Escape XML special characters
@@ -140,7 +141,7 @@ function generateRobotsTxt(hostname, options = {}) {
  */
 function sitemapPlugin(options = {}) {
   const {
-    hostname = process.env.BASE_URL || 'http://localhost:3000',
+    hostname = process.env.BASE_URL || 'http://localhost:7331',
     exclude = ['/api/*'],
     changefreq = 'weekly',
     priority = 0.8,
@@ -157,8 +158,9 @@ function sitemapPlugin(options = {}) {
   const dynamicExclusions = [...exclude];
   const registeredSources = [...dynamicSources];
   
-  // Cached URLs (for dynamic sources)
+  // Cached URLs and pre-rendered XML (for dynamic sources)
   let cachedUrls = null;
+  let cachedXml = null;
   let cacheTime = null;
   const cacheMaxAge = options.cacheMaxAge || 5 * 60 * 1000; // 5 minutes default
   
@@ -228,7 +230,7 @@ function sitemapPlugin(options = {}) {
    */
   async function buildAllUrls(routes, dbInstance) {
     const urls = [];
-    const hostnameNormalized = hostname.replace(/\/$/, '');
+    const hostnameNormalized = stripTrailingSlash(hostname);
     
     // Filter static routes for sitemap
     const sitemapRoutes = routes
@@ -326,7 +328,8 @@ function sitemapPlugin(options = {}) {
        */
       addUrl(path, opts = {}) {
         dynamicUrls.push({ path, ...opts });
-        cachedUrls = null; // Invalidate cache
+        cachedUrls = null;
+        cachedXml = null;
       },
       
       /**
@@ -335,7 +338,8 @@ function sitemapPlugin(options = {}) {
        */
       exclude(pattern) {
         dynamicExclusions.push(pattern);
-        cachedUrls = null; // Invalidate cache
+        cachedUrls = null;
+        cachedXml = null;
       },
       
       /**
@@ -347,7 +351,8 @@ function sitemapPlugin(options = {}) {
           throw new Error('urlPattern is required for dynamic source');
         }
         registeredSources.push(source);
-        cachedUrls = null; // Invalidate cache
+        cachedUrls = null;
+        cachedXml = null;
       },
       
       /**
@@ -369,6 +374,7 @@ function sitemapPlugin(options = {}) {
        */
       invalidateCache() {
         cachedUrls = null;
+        cachedXml = null;
         cacheTime = null;
       }
     },
@@ -384,28 +390,26 @@ function sitemapPlugin(options = {}) {
         try {
           // Check cache
           const now = Date.now();
-          if (cachedUrls && cacheTime && (now - cacheTime) < cacheMaxAge) {
+          if (cachedXml && cacheTime && (now - cacheTime) < cacheMaxAge) {
             res.type('application/xml');
-            return res.send(generateSitemapXml(cachedUrls, { 
-              hostname, 
-              defaultChangefreq: changefreq, 
-              defaultPriority: priority 
-            }));
+            return res.send(cachedXml);
           }
           
           // Build URLs
           const urls = await buildAllUrls(ctx.routes, dbInstance);
+          const xml = generateSitemapXml(urls, { 
+            hostname, 
+            defaultChangefreq: changefreq, 
+            defaultPriority: priority 
+          });
           
           // Cache results
           cachedUrls = urls;
+          cachedXml = xml;
           cacheTime = now;
           
           res.type('application/xml');
-          res.send(generateSitemapXml(urls, { 
-            hostname, 
-            defaultChangefreq: changefreq, 
-            defaultPriority: priority 
-          }));
+          res.send(xml);
         } catch (err) {
           console.error('Sitemap generation error:', err);
           res.status(500).send('Error generating sitemap');

package/plugins/swagger.js

@@ -11,20 +11,8 @@ const { buildOpenApiDocument } = require('../core/openapi/build-from-api-routes'
 
 const PKG = require(path.join(__dirname, '..', 'package.json'));
 
-/**
- * HTML Escaping
- * @param {string} str
- * @returns {string}
- */
-function escapeHtml(str) {
-  if (!str) return '';
-  return String(str)
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#039;');
-}
+const { escapeHtml } = require('../core/utils/html');
+const { stripTrailingSlash } = require('../core/utils/url');
 
 /**
  * Generates Swagger UI HTML page
@@ -193,7 +181,7 @@ function generateApiDocsAdminComponent({ uiPath, jsonPath, title }) {
  * @param {string} [options.title] - OpenAPI info.title
  * @param {string} [options.version] - OpenAPI info.version
  * @param {string} [options.description] - OpenAPI info.description
- * @param {string} [options.serverUrl] - Override servers[0].url (default: BASE_URL or http://localhost:3000)
+ * @param {string} [options.serverUrl] - Override servers[0].url (default: BASE_URL or http://localhost:7331)
  * @param {string} [options.theme='default'] - Theme for Scalar UI
  * @param {boolean} [options.darkMode=true] - Dark mode default for Scalar UI
  * @param {boolean} [options.admin=true] - Auto-register in Admin Panel if admin-panel plugin is present
@@ -256,12 +244,17 @@ function swaggerPlugin(options = {}) {
         return false;
       };
 
-      const server = serverUrl || process.env.BASE_URL || 'http://localhost:3000';
+      const server = serverUrl || process.env.BASE_URL || 'http://localhost:7331';
+
+      let cachedDoc = null;
 
       // 1. OpenAPI 3 JSON Endpoint
       ctx.addRoute('get', jsonPath, (req, res) => {
         if (forbid(req, res)) return;
         try {
+          if (cachedDoc && process.env.NODE_ENV === 'production') {
+            return res.json(cachedDoc);
+          }
           const doc = buildOpenApiDocument({
             routes: ctx.routes || [],
             pagesDir: ctx.options.pagesDir,
@@ -272,8 +265,11 @@ function swaggerPlugin(options = {}) {
               version: docVersion,
               description: docDescription,
             },
-            servers: [{ url: server.replace(/\/$/, '') }],
+            servers: [{ url: stripTrailingSlash(server) }],
           });
+          if (process.env.NODE_ENV === 'production') {
+            cachedDoc = doc;
+          }
           res.json(doc);
         } catch (err) {
           console.warn('[swagger] OpenAPI generation failed:', err.message);

package/plugins/upload/index.js

@@ -6,6 +6,8 @@
 const multer = require('multer');
 const path = require('path');
 const { createLocalFileProvider } = require('./local-file-provider');
+const { ensureLeadingSlash } = require('../../core/utils/url');
+const { ensureArray } = require('../../core/utils/object');
 
 /**
  * @typedef {import('express').Request} ExpressRequest
@@ -37,8 +39,7 @@ const { createLocalFileProvider } = require('./local-file-provider');
  * @returns {string}
  */
 function normalizeRoutePath(p) {
-  const s = (p || '/api/upload').trim();
-  return s.startsWith('/') ? s : `/${s}`;
+  return ensureLeadingSlash((p || '/api/upload').trim());
 }
 
 /**
@@ -118,7 +119,7 @@ function uploadPlugin(options = {}) {
       publicBasePath: local?.publicBasePath,
     });
 
-  const mw = (Array.isArray(middleware) ? middleware : [middleware]).filter(Boolean);
+  const mw = ensureArray(middleware).filter(Boolean);
   const parseMultipart = createMulterMiddleware(maxBytes, fieldName, multiple, maxFiles);
 
   return {

package/plugins/upload/orphan-pruner.js

@@ -11,6 +11,7 @@ const fs = require('fs/promises');
 const fsSync = require('fs');
 const path = require('path');
 const { normalizePublicBase } = require('./local-file-provider');
+const { safeJsonParse } = require('../../core/utils/json');
 
 /**
  * Format bytes into human readable string
@@ -137,10 +138,10 @@ async function extractDbFileReferences(db) {
         for (const [key, value] of Object.entries(row)) {
           // If value is a JSON string, try to parse
           if (typeof value === 'string' && (value.startsWith('{') || value.startsWith('['))) {
-            try {
-              const parsed = JSON.parse(value);
+            const parsed = safeJsonParse(value, null);
+            if (parsed) {
               scanValue(parsed);
-            } catch (e) {
+            } else {
               addStringReference(value);
             }
           } else {