webspresso 0.0.103 → 0.0.105

package/plugins/webhooks/crypto.js

@@ -4,9 +4,7 @@
  * @module plugins/webhooks/crypto
  */
 
-'use strict';
-
-const crypto = require('crypto');
+const { safeCompare, hmacSha256, randomId } = require('../../core/utils/crypto');
 
 /**
  * Generate a cryptographically secure webhook signing secret
@@ -16,27 +14,7 @@ const crypto = require('crypto');
  * @returns {string} E.g. 'whsec_e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934c'
  */
 function generateSecret(prefix = 'whsec_', byteLength = 24) {
-  const bytes = crypto.randomBytes(byteLength).toString('hex');
-  return `${prefix || ''}${bytes}`;
-}
-
-/**
- * Perform constant-time string comparison to prevent timing attacks
- * 
- * @param {string} a 
- * @param {string} b 
- * @returns {boolean}
- */
-function safeCompare(a, b) {
-  if (typeof a !== 'string' || typeof b !== 'string') {
-    return false;
-  }
-  const bufA = Buffer.from(a, 'utf8');
-  const bufB = Buffer.from(b, 'utf8');
-  if (bufA.length !== bufB.length) {
-    return false;
-  }
-  return crypto.timingSafeEqual(bufA, bufB);
+  return randomId(prefix, byteLength, 'hex');
 }
 
 /**
@@ -59,12 +37,12 @@ function signPayload(payload, secret, options = {}) {
     : Math.floor(Date.now() / 1000);
 
   // 1. Direct payload HMAC-SHA256 (compatible with GitHub / standard webhooks)
-  const hex = crypto.createHmac('sha256', secret).update(payloadStr, 'utf8').digest('hex');
+  const hex = hmacSha256(payloadStr, secret, 'hex');
   const signature = `sha256=${hex}`;
 
   // 2. Timestamped HMAC-SHA256 (compatible with Stripe / Svix / Slack)
   const toSign = `${timestamp}.${payloadStr}`;
-  const timestampedHex = crypto.createHmac('sha256', secret).update(toSign, 'utf8').digest('hex');
+  const timestampedHex = hmacSha256(toSign, secret, 'hex');
   const timestampedSignature = `t=${timestamp},v1=${timestampedHex}`;
 
   return {
@@ -121,7 +99,7 @@ function verifySignature(payload, signatureHeader, secret, options = {}) {
     }
 
     const toSign = `${timestamp}.${payloadStr}`;
-    const expectedHex = crypto.createHmac('sha256', secret).update(toSign, 'utf8').digest('hex');
+    const expectedHex = hmacSha256(toSign, secret, 'hex');
 
     return signatures.some((sig) => safeCompare(sig, expectedHex));
   }
@@ -132,7 +110,7 @@ function verifySignature(payload, signatureHeader, secret, options = {}) {
     receivedHex = receivedHex.slice(7);
   }
 
-  const expectedHex = crypto.createHmac('sha256', secret).update(payloadStr, 'utf8').digest('hex');
+  const expectedHex = hmacSha256(payloadStr, secret, 'hex');
   return safeCompare(receivedHex, expectedHex);
 }
 

package/plugins/webhooks/dispatcher.js

@@ -8,9 +8,11 @@
 
 const EventEmitter = require('events');
 const crypto = require('crypto');
+const { randomTimestampedId } = require('../../core/utils/crypto');
 const { generateSecret } = require('./crypto');
 const { matchesAnyEvent, normalizeEvents } = require('./matcher');
 const { sendWebhook } = require('./sender');
+const { safeJsonParse } = require('../../core/utils/json');
 
 /**
  * Generate a standard unique delivery identifier
@@ -20,7 +22,7 @@ function generateDeliveryId() {
   if (typeof crypto.randomUUID === 'function') {
     return `dlv_${crypto.randomUUID().replace(/-/g, '')}`;
   }
-  return `dlv_${Date.now()}_${crypto.randomBytes(8).toString('hex')}`;
+  return randomTimestampedId('dlv', 8);
 }
 
 class WebhookDispatcher extends EventEmitter {
@@ -47,7 +49,10 @@ class WebhookDispatcher extends EventEmitter {
     this.deliveriesTable = options.deliveriesTable || 'webhook_deliveries';
     this.maxAttempts = typeof options.maxAttempts === 'number' ? options.maxAttempts : 3;
     this.backoffBaseMs = typeof options.backoffBaseMs === 'number' ? options.backoffBaseMs : 1000;
-    this.timeoutMs = typeof options.timeoutMs === 'number' ? options.timeoutMs : 10000;
+    const defaultWebhookTimeout = options.timeouts?.webhook || 10000;
+    this.timeoutMs = typeof options.timeoutMs === 'number'
+      ? options.timeoutMs
+      : (typeof options.timeout === 'number' ? options.timeout : defaultWebhookTimeout);
     this.wrapPayload = options.wrapPayload !== undefined ? options.wrapPayload : true;
     this.queue = options.queue || null;
     this.logger = options.logger || console;
@@ -461,9 +466,14 @@ class WebhookDispatcher extends EventEmitter {
             attempt: attempt + 1,
             autoRetry: true,
           }).catch((err) => {
-            this.emit('error', err);
+            if (this.listenerCount('error') > 0) {
+              this.emit('error', err);
+            } else {
+              console.error('[webhooks] Delivery retry failed:', err?.message || err);
+            }
           });
         }, delayMs);
+        if (timer.unref) timer.unref();
         this._activeTimers.add(timer);
       }
     } else {
@@ -522,12 +532,7 @@ class WebhookDispatcher extends EventEmitter {
       throw new Error(`Target endpoint #${delivery.endpoint_id} no longer exists.`);
     }
 
-    let parsedPayload = delivery.payload;
-    try {
-      parsedPayload = JSON.parse(delivery.payload);
-    } catch (e) {
-      // Keep string if not json
-    }
+    const parsedPayload = safeJsonParse(delivery.payload, delivery.payload);
 
     const nextAttempt = (delivery.attempt || 1) + 1;
     return this.executeDelivery({

package/plugins/webhooks/index.js

@@ -104,6 +104,12 @@ function webhooksPlugin(options = {}) {
         dispatcher.knex = db.knex || db;
       }
 
+      // Sync timeouts from app context if not explicitly passed
+      const timeouts = ctx?.timeouts || (ctx?.app && typeof ctx.app.get === 'function' ? ctx.app.get('timeouts') : null);
+      if (timeouts && timeouts.webhook && dispatcher.timeoutMs === 10000 && options.timeoutMs === undefined && options.timeout === undefined) {
+        dispatcher.timeoutMs = timeouts.webhook;
+      }
+
       // Attach dispatcher to app and request objects
       if (ctx.app) {
         ctx.app.webhooks = dispatcher;

package/plugins/webhooks/matcher.js

@@ -6,6 +6,9 @@
 
 'use strict';
 
+const { globToRegExp } = require('../../core/utils/regex');
+const { safeJsonParse } = require('../../core/utils/json');
+
 /**
  * Normalize an event filter into an array of strings
  * 
@@ -29,13 +32,9 @@ function normalizeEvents(events) {
 
     // If JSON array string like '["user.*", "order.created"]'
     if (trimmed.startsWith('[') && trimmed.endsWith(']')) {
-      try {
-        const parsed = JSON.parse(trimmed);
-        if (Array.isArray(parsed)) {
-          return parsed.map((e) => (typeof e === 'string' ? e.trim() : '')).filter(Boolean);
-        }
-      } catch (err) {
-        // Fall back to comma-separated
+      const parsed = safeJsonParse(trimmed, null);
+      if (Array.isArray(parsed)) {
+        return parsed.map((e) => (typeof e === 'string' ? e.trim() : '')).filter(Boolean);
       }
     }
 
@@ -48,6 +47,22 @@ function normalizeEvents(events) {
   return ['*'];
 }
 
+const regexCache = new Map();
+const MAX_REGEX_CACHE = 1000;
+
+function getPatternRegex(pattern) {
+  let cached = regexCache.get(pattern);
+  if (!cached) {
+    if (regexCache.size >= MAX_REGEX_CACHE) {
+      const first = regexCache.keys().next().value;
+      if (first !== undefined) regexCache.delete(first);
+    }
+    cached = globToRegExp(pattern, { separator: null, flags: 'i' });
+    regexCache.set(pattern, cached);
+  }
+  return cached;
+}
+
 /**
  * Test whether an event pattern matches an actual event name
  * 
@@ -56,12 +71,15 @@ function normalizeEvents(events) {
  * @returns {boolean}
  */
 function matchEvent(pattern, eventName) {
-  if (!pattern || !eventName) {
+  if (typeof pattern !== 'string' || typeof eventName !== 'string') {
     return false;
   }
 
   const p = pattern.trim();
   const e = eventName.trim();
+  if (!p || !e) {
+    return false;
+  }
 
   // 1. Wildcard matches all
   if (p === '*') {
@@ -73,15 +91,8 @@ function matchEvent(pattern, eventName) {
     return true;
   }
 
-  // 3. Glob / Wildcard conversion
-  // Convert 'user.*' to regular expression '^user\.[^.]+$' or '^user\..+$'
-  // Support prefix, middle, or suffix wildcards safely
-  const escaped = p
-    .replace(/[.+?^${}()|[\]\\]/g, '\\$&') // escape regex specials except *
-    .replace(/\*/g, '.*');
-
-  const regex = new RegExp(`^${escaped}$`, 'i');
-  return regex.test(e);
+  // 3. Glob / Wildcard conversion with bounded cache
+  return getPatternRegex(p).test(e);
 }
 
 /**

package/plugins/webhooks/sender.js

@@ -8,6 +8,8 @@
 
 const crypto = require('crypto');
 const { signPayload } = require('./crypto');
+const { safeJsonParse } = require('../../core/utils/json');
+const { parseDurationMs } = require('../../core/utils/time');
 
 /**
  * Send a webhook HTTP request to a target endpoint
@@ -32,7 +34,8 @@ const { signPayload } = require('./crypto');
  *   timestamp: number
  * }>}
  */
-async function sendWebhook(options) {
+async function sendWebhook(options = {}) {
+  const opts = options || {};
   const {
     url,
     event,
@@ -40,10 +43,11 @@ async function sendWebhook(options) {
     secret,
     deliveryId = crypto.randomUUID ? crypto.randomUUID() : `dlv_${Date.now()}_${crypto.randomBytes(6).toString('hex')}`,
     headers: customHeaders = {},
-    timeoutMs = 10000,
     wrapPayload = true,
     maxResponseBodyLength = 2048,
-  } = options;
+  } = opts;
+
+  const timeoutMs = parseDurationMs(opts.timeout !== undefined ? opts.timeout : (opts.timeoutMs !== undefined ? opts.timeoutMs : 10000), 10000);
 
   if (!url || typeof url !== 'string') {
     return {
@@ -57,6 +61,32 @@ async function sendWebhook(options) {
     };
   }
 
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(url);
+    if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+      return {
+        success: false,
+        statusCode: 0,
+        responseBody: '',
+        durationMs: 0,
+        error: `Invalid webhook URL protocol: "${parsedUrl.protocol}". Only http: and https: are supported.`,
+        deliveryId,
+        timestamp: Math.floor(Date.now() / 1000),
+      };
+    }
+  } catch (err) {
+    return {
+      success: false,
+      statusCode: 0,
+      responseBody: '',
+      durationMs: 0,
+      error: 'Invalid webhook URL: destination URL is malformed.',
+      deliveryId,
+      timestamp: Math.floor(Date.now() / 1000),
+    };
+  }
+
   const timestamp = Math.floor(Date.now() / 1000);
 
   // Construct request body
@@ -83,16 +113,10 @@ async function sendWebhook(options) {
   }
 
   // Parse custom headers if stored as JSON string
-  let parsedCustomHeaders = {};
-  if (typeof customHeaders === 'string') {
-    try {
-      parsedCustomHeaders = JSON.parse(customHeaders);
-    } catch (e) {
-      parsedCustomHeaders = {};
-    }
-  } else if (typeof customHeaders === 'object' && customHeaders !== null) {
-    parsedCustomHeaders = customHeaders;
-  }
+  const parsedHeadersObj = safeJsonParse(customHeaders, {});
+  const parsedCustomHeaders = (parsedHeadersObj && typeof parsedHeadersObj === 'object' && !Array.isArray(parsedHeadersObj))
+    ? parsedHeadersObj
+    : {};
 
   const requestHeaders = {
     'content-type': 'application/json',
@@ -116,6 +140,9 @@ async function sendWebhook(options) {
     timeoutId = setTimeout(() => {
       controller.abort();
     }, timeoutMs);
+    if (timeoutId && timeoutId.unref) {
+      timeoutId.unref();
+    }
 
     const response = await fetch(url, {
       method: 'POST',

package/src/app-context.js

@@ -3,18 +3,22 @@
  * @module src/app-context
  */
 
-/** @type {{ db: object|null, shutdownManager: object|null, serviceRegistry: object|null, events: object|null, mailer: object|null }} */
+const { circuitBreakerRegistry, retry } = require('../core/resilience');
+
+/** @type {{ db: object|null, shutdownManager: object|null, serviceRegistry: object|null, events: object|null, mailer: object|null, cache: object|null, breakers: object|null }} */
 let context = {
   db: null,
   shutdownManager: null,
   serviceRegistry: null,
   events: null,
   mailer: null,
+  cache: null,
+  breakers: circuitBreakerRegistry,
 };
 
 /**
  * Merge into the current context (typically called once from createApp).
- * @param {{ db?: object|null, shutdownManager?: object|null, serviceRegistry?: object|null, events?: object|null, mailer?: object|null }} partial
+ * @param {{ db?: object|null, shutdownManager?: object|null, serviceRegistry?: object|null, events?: object|null, mailer?: object|null, cache?: object|null }} partial
  */
 function setAppContext(partial) {
   context = { ...context, ...partial };
@@ -99,7 +103,7 @@ function hasEvents() {
  * Clear context (e.g. between tests).
  */
 function resetAppContext() {
-  context = { db: null, shutdownManager: null, serviceRegistry: null, events: null, mailer: null };
+  context = { db: null, shutdownManager: null, serviceRegistry: null, events: null, mailer: null, cache: null };
 }
 
 /**
@@ -117,7 +121,21 @@ function hasMailer() {
 }
 
 /**
- * Express middleware: sets `req.db`, `req.service`, `req.events`, and `req.mailer` from registered app context.
+ * @returns {object|null}
+ */
+function getCache() {
+  return context.cache;
+}
+
+/**
+ * @returns {boolean}
+ */
+function hasCache() {
+  return context.cache != null;
+}
+
+/**
+ * Express middleware: sets `req.db`, `req.service`, `req.events`, `req.mailer`, and `req.cache` from registered app context.
  * File-based `pages/api/*` routes attach this automatically; use in `setupRoutes`
  * for manually registered handlers that need `req.db` and `req.service`.
  * @type {import('express').RequestHandler}
@@ -132,9 +150,25 @@ function attachDbMiddleware(req, res, next) {
   if (context.mailer != null) {
     req.mailer = context.mailer;
   }
+  if (context.cache != null) {
+    req.cache = context.cache;
+  }
+  req.breakers = context.breakers || circuitBreakerRegistry;
+  req.breaker = (name, opts) => (context.breakers || circuitBreakerRegistry).getBreaker(name, opts);
+  req.retry = retry;
   if (context.serviceRegistry != null) {
     req.service = (name, input, opts) =>
-      context.serviceRegistry.call(name, input, req.context || { req, res, db: context.db, events: context.events, mailer: context.mailer }, opts);
+      context.serviceRegistry.call(name, input, req.context || {
+        req,
+        res,
+        db: context.db,
+        events: context.events,
+        mailer: context.mailer,
+        cache: context.cache,
+        breakers: req.breakers,
+        breaker: req.breaker,
+        retry,
+      }, opts);
   }
   next();
 }
@@ -152,6 +186,8 @@ module.exports = {
   hasEvents,
   getMailer,
   hasMailer,
+  getCache,
+  hasCache,
   resetAppContext,
   attachDbMiddleware,
 };

package/src/dev/banner.js

@@ -94,7 +94,7 @@ function collectBannerSummary(context = {}) {
     db,
     serviceRegistry,
     pluginManager,
-    port = 3000,
+    port = 7331,
     host = 'localhost',
   } = context;
 
@@ -141,9 +141,13 @@ function collectBannerSummary(context = {}) {
   // 5. Plugins
   let pluginsList = [];
   let hasAdmin = false;
-  if (pluginManager && pluginManager.plugins instanceof Map) {
+  if (context.hasAdmin !== undefined) {
+    hasAdmin = Boolean(context.hasAdmin);
+  } else if (pluginManager && pluginManager.plugins instanceof Map) {
     pluginsList = Array.from(pluginManager.plugins.keys());
     hasAdmin = pluginManager.plugins.has('adminPanel') || pluginManager.plugins.has('admin');
+  } else {
+    hasAdmin = true;
   }
 
   // URLs

package/src/dev-reload/index.js

@@ -15,6 +15,8 @@ const CLIENT_RUNTIME_SCRIPT = `(function() {
 
   var es = null;
   var reconnectTimer = null;
+  var wasConnected = false;
+  var reconnectDelay = 200;
 
   function reloadCss(targetFile) {
     var links = document.querySelectorAll('link[rel="stylesheet"]');
@@ -166,6 +168,36 @@ const CLIENT_RUNTIME_SCRIPT = `(function() {
     document.addEventListener('keydown', onKeyDown);
   }
 
+  function safeReload(reason) {
+    clearOverlay();
+    var reasonMsg = reason ? ' (' + reason + ')' : '';
+    console.log('[Webspresso] 🔄 Reloading page' + reasonMsg + '...');
+
+    // Ping server with lightweight HEAD request to make sure it is ready before full reload.
+    // This prevents browser "This site can't be reached" (ERR_CONNECTION_REFUSED) screens
+    // when the dev server is in the middle of restarting.
+    function pingAndReload() {
+      if (typeof window.fetch !== 'function') {
+        window.location.reload();
+        return;
+      }
+
+      fetch(window.location.href, { method: 'HEAD', cache: 'no-store' })
+        .then(function(res) {
+          if (res.ok || res.status < 500) {
+            window.location.reload();
+          } else {
+            setTimeout(pingAndReload, 150);
+          }
+        })
+        .catch(function() {
+          setTimeout(pingAndReload, 150);
+        });
+    }
+
+    setTimeout(pingAndReload, 30);
+  }
+
   function connect() {
     if (es) {
       try { es.close(); } catch (_) {}
@@ -173,6 +205,16 @@ const CLIENT_RUNTIME_SCRIPT = `(function() {
 
     es = new window.EventSource('${SSE_ENDPOINT_PATH}');
 
+    es.addEventListener('open', function() {
+      reconnectDelay = 200;
+      if (wasConnected) {
+        console.log('[Webspresso] 🔄 Dev server reconnected, reloading page...');
+        safeReload('server reconnected');
+        return;
+      }
+      wasConnected = true;
+    });
+
     es.addEventListener('reload', function(e) {
       try {
         var data = JSON.parse(e.data);
@@ -180,10 +222,7 @@ const CLIENT_RUNTIME_SCRIPT = `(function() {
           clearOverlay();
           reloadCss(data.file);
         } else if (data.type === 'full') {
-          clearOverlay();
-          var reasonMsg = data.reason ? ' (' + data.reason + ')' : '';
-          console.log('[Webspresso] 🔄 Reloading page' + reasonMsg + '...');
-          window.location.reload();
+          safeReload(data.reason);
         } else if (data.type === 'error') {
           showOverlay(data);
         } else if (data.type === 'clear-error') {
@@ -195,12 +234,14 @@ const CLIENT_RUNTIME_SCRIPT = `(function() {
     });
 
     es.onerror = function() {
-      es.close();
+      try { es.close(); } catch (_) {}
       if (!reconnectTimer) {
+        var delay = reconnectDelay;
+        reconnectDelay = Math.min(reconnectDelay * 1.5, 1500);
         reconnectTimer = setTimeout(function() {
           reconnectTimer = null;
           connect();
-        }, 2000);
+        }, delay);
       }
     };
   }

package/src/file-router.js

@@ -32,6 +32,7 @@ const {
   resolveNamedMiddleware,
   resolveMiddlewares,
 } = require('./routing/middleware-resolver');
+const { escapeRegExp } = require('../core/utils/regex');
 
 const NOOP = () => {};
 const EMPTY_OBJECT = Object.freeze({});
@@ -372,9 +373,6 @@ function rewriteDynamicRouteMarkers(route) {
   return out;
 }
 
-function escapeRegExp(s) {
-  return String(s).replace(/[\\^$*+?.()|[\]{}]/g, '\\$&');
-}
 
 /**
  * Checks if a path segment is a route group, e.g. '(marketing)', '(auth)'.