webspresso 0.0.104 → 0.0.106

package/plugins/rls/index.js

@@ -0,0 +1,170 @@
+/**
+ * Webspresso RLS Plugin — Dynamic Model Row-Level Security
+ * Automatically bridges request authentication (req.user, req.auth, req.tenantId)
+ * to ORM repositories with role-based bypass and route-level overrides.
+ * Zero external dependencies.
+ * @module plugins/rls
+ */
+
+/**
+ * Default user extractor from HTTP request
+ * @param {import('express').Request} req
+ * @returns {Object|null}
+ */
+function defaultGetUser(req) {
+  if (!req) return null;
+  return req.user || req.adminUser || (req.auth && req.auth.user) || null;
+}
+
+/**
+ * Default tenant extractor from HTTP request
+ * @param {import('express').Request} req
+ * @param {Object|null} [user]
+ * @returns {unknown|null}
+ */
+function defaultGetTenantId(req, user) {
+  if (!req) return null;
+  if (req.tenantId !== undefined && req.tenantId !== null) return req.tenantId;
+  if (req.tenant !== undefined && req.tenant !== null) return req.tenant;
+  if (user && typeof user === 'object') {
+    if (user.tenant_id !== undefined && user.tenant_id !== null) return user.tenant_id;
+    if (user.tenantId !== undefined && user.tenantId !== null) return user.tenantId;
+    if (user.organization_id !== undefined && user.organization_id !== null) return user.organization_id;
+    if (user.organizationId !== undefined && user.organizationId !== null) return user.organizationId;
+  }
+  return null;
+}
+
+/**
+ * Create Express middleware for Row Level Security
+ * Wraps req.db methods to automatically inject authenticated user and tenant context
+ *
+ * @param {Object} [options]
+ * @param {string[]|Function|false} [options.bypassRoles=['admin', 'superadmin']] - Roles that bypass RLS
+ * @param {Function} [options.getUser] - Custom user extractor (req) => user
+ * @param {Function} [options.getTenantId] - Custom tenant extractor (req, user) => tenantId
+ * @param {boolean} [options.enabled=true] - Whether RLS middleware is active
+ * @returns {Function} Express middleware handler
+ */
+function createRlsMiddleware(options = {}) {
+  const {
+    bypassRoles = ['admin', 'superadmin'],
+    getUser = defaultGetUser,
+    getTenantId = defaultGetTenantId,
+    enabled = true,
+  } = options;
+
+  return (req, res, next) => {
+    if (!enabled) return next();
+
+    const user = typeof getUser === 'function' ? getUser(req) : null;
+    const tenantId = typeof getTenantId === 'function' ? getTenantId(req, user) : null;
+
+    // Check if user has global bypass role
+    let isBypassed = false;
+    if (user && bypassRoles) {
+      if (typeof bypassRoles === 'function') {
+        isBypassed = Boolean(bypassRoles(user, req));
+      } else if (Array.isArray(bypassRoles)) {
+        const uRole = user.role || user.roleName || user.type;
+        const uRoles = Array.isArray(user.roles) ? user.roles : (uRole ? [uRole] : []);
+        isBypassed = bypassRoles.some((r) => uRoles.includes(r));
+      }
+    }
+
+    // Wrap req.db if it exists on the request
+    if (req.db && typeof req.db.getRepository === 'function' && !req.db._rlsWrapped) {
+      const origGetRepo = req.db.getRepository.bind(req.db);
+      const origQuery = req.db.query ? req.db.query.bind(req.db) : null;
+      const origCreateRepo = req.db.createRepository ? req.db.createRepository.bind(req.db) : null;
+
+      const reqDb = Object.create(req.db);
+      reqDb._rlsWrapped = true;
+
+      reqDb.getRepository = (modelName, customContext = {}) => {
+        const ctx = {
+          user,
+          tenantId: customContext.tenantId !== undefined ? customContext.tenantId : tenantId,
+          rlsDisabled: isBypassed || customContext.rlsDisabled === true,
+          ...customContext,
+        };
+        return origGetRepo(modelName, ctx);
+      };
+
+      if (origCreateRepo) {
+        reqDb.createRepository = (model, customContext = {}) => {
+          const ctx = {
+            user,
+            tenantId: customContext.tenantId !== undefined ? customContext.tenantId : tenantId,
+            rlsDisabled: isBypassed || customContext.rlsDisabled === true,
+            ...customContext,
+          };
+          return origCreateRepo(model, ctx);
+        };
+      }
+
+      if (origQuery) {
+        reqDb.query = (modelName, customContext = {}) => {
+          const ctx = {
+            user,
+            tenantId: customContext.tenantId !== undefined ? customContext.tenantId : tenantId,
+            rlsDisabled: isBypassed || customContext.rlsDisabled === true,
+            ...customContext,
+          };
+          return origQuery(modelName, ctx);
+        };
+      }
+
+      req.db = reqDb;
+    }
+
+    next();
+  };
+}
+
+/**
+ * Webspresso RLS Plugin Factory
+ *
+ * @param {Object} [options] - Plugin configuration options
+ * @param {boolean} [options.global=true] - Mount global middleware on app
+ * @param {string[]|Function|false} [options.bypassRoles=['admin', 'superadmin']] - Global roles bypassing RLS
+ * @param {Function} [options.getUser] - Custom user extractor
+ * @param {Function} [options.getTenantId] - Custom tenant extractor
+ * @param {boolean} [options.enabled=true] - Enabled flag
+ * @returns {Object} Webspresso Plugin Definition
+ */
+function rlsPlugin(options = {}) {
+  const { global: applyGlobal = true, ...pluginDefaults } = options;
+
+  return {
+    name: 'rls',
+    version: '1.0.0',
+    description: 'Dynamic Model Row-Level Security (RLS) with automatic request context binding',
+    options,
+
+    api: {
+      createMiddleware: (routeOpts = {}) =>
+        createRlsMiddleware({ ...pluginDefaults, ...routeOpts }),
+    },
+
+    register(ctx) {
+      // Named middleware for route definitions: middleware: ['rls']
+      if (ctx.middlewares) {
+        ctx.middlewares.rls = (routeOpts = {}) =>
+          createRlsMiddleware({ ...pluginDefaults, ...routeOpts });
+      }
+
+      // Global middleware (mounted by default unless global: false)
+      if (applyGlobal && ctx.app) {
+        ctx.app.use(createRlsMiddleware(options));
+      }
+    },
+  };
+}
+
+rlsPlugin.rlsPlugin = rlsPlugin;
+rlsPlugin.createRlsMiddleware = createRlsMiddleware;
+
+module.exports = rlsPlugin;
+module.exports.rlsPlugin = rlsPlugin;
+module.exports.createRlsMiddleware = createRlsMiddleware;

package/plugins/seo-checker/index.js

@@ -48,7 +48,7 @@ function seoCheckerPlugin(options = {}) {
       });
 
       // Inject panel styles into head
-      ctx.injectHead(generatePanelStyles(), { priority: 100 });
+      ctx.injectHead(generatePanelStyles(), { priority: 100, id: 'seo-checker-styles' });
 
       const safeSettings = JSON.stringify(mergedSettings).replace(/</g, '\\u003c').replace(/>/g, '\\u003e');
       const safeChecks = JSON.stringify(checkDefinitions).replace(/</g, '\\u003c').replace(/>/g, '\\u003e');
@@ -61,7 +61,7 @@ function seoCheckerPlugin(options = {}) {
           window.__SEO_CHECKER_CHECKS__ = ${safeChecks};
         </script>
         <script>${analyzerScript}</script>
-      `);
+      `, { id: 'seo-checker-panel' });
     },
 
     /**

package/plugins/site-analytics/index.js

@@ -192,7 +192,9 @@ function siteAnalyticsPlugin(options = {}) {
         errorLogIntervalMs: options.errorLogIntervalMs ?? 60000,
       });
 
-      ctx.app.use(trackingMiddleware);
+      if (typeof ctx.app?.use === 'function') {
+        ctx.app.use(trackingMiddleware);
+      }
 
       if (trackClientErrors) {
         const script = generateErrorTrackerScript({ endpoint: '/_analytics/report-error' });

package/plugins/site-analytics/tracking.js

@@ -4,7 +4,7 @@
  * @module plugins/site-analytics/tracking
  */
 
-const crypto = require('crypto');
+const { sha256 } = require('../../core/utils/crypto');
 const { getClientIp: resolveClientIp } = require('../../core/utils/ip');
 const { detectBot } = require('./bot-patterns');
 const { detectCountry } = require('./geo');
@@ -76,7 +76,7 @@ function isPermanentDbError(e) {
  * Hash a string with SHA-256 (truncated to 16 hex chars for compactness)
  */
 function quickHash(str) {
-  return crypto.createHash('sha256').update(str).digest('hex').slice(0, 16);
+  return sha256(str).slice(0, 16);
 }
 
 /**

package/plugins/sitemap.js

@@ -4,6 +4,7 @@
  */
 
 const { matchPattern } = require('../src/plugin-manager');
+const { stripTrailingSlash } = require('../core/utils/url');
 
 /**
  * Escape XML special characters
@@ -140,7 +141,7 @@ function generateRobotsTxt(hostname, options = {}) {
  */
 function sitemapPlugin(options = {}) {
   const {
-    hostname = process.env.BASE_URL || 'http://localhost:3000',
+    hostname = process.env.BASE_URL || 'http://localhost:7331',
     exclude = ['/api/*'],
     changefreq = 'weekly',
     priority = 0.8,
@@ -229,7 +230,7 @@ function sitemapPlugin(options = {}) {
    */
   async function buildAllUrls(routes, dbInstance) {
     const urls = [];
-    const hostnameNormalized = hostname.replace(/\/$/, '');
+    const hostnameNormalized = stripTrailingSlash(hostname);
     
     // Filter static routes for sitemap
     const sitemapRoutes = routes

package/plugins/swagger.js

@@ -12,6 +12,7 @@ const { buildOpenApiDocument } = require('../core/openapi/build-from-api-routes'
 const PKG = require(path.join(__dirname, '..', 'package.json'));
 
 const { escapeHtml } = require('../core/utils/html');
+const { stripTrailingSlash } = require('../core/utils/url');
 
 /**
  * Generates Swagger UI HTML page
@@ -180,7 +181,7 @@ function generateApiDocsAdminComponent({ uiPath, jsonPath, title }) {
  * @param {string} [options.title] - OpenAPI info.title
  * @param {string} [options.version] - OpenAPI info.version
  * @param {string} [options.description] - OpenAPI info.description
- * @param {string} [options.serverUrl] - Override servers[0].url (default: BASE_URL or http://localhost:3000)
+ * @param {string} [options.serverUrl] - Override servers[0].url (default: BASE_URL or http://localhost:7331)
  * @param {string} [options.theme='default'] - Theme for Scalar UI
  * @param {boolean} [options.darkMode=true] - Dark mode default for Scalar UI
  * @param {boolean} [options.admin=true] - Auto-register in Admin Panel if admin-panel plugin is present
@@ -197,6 +198,7 @@ function swaggerPlugin(options = {}) {
     authorize,
     includeOrmSchemas = false,
     ormExclude = [],
+    jsonPath: customJsonPath,
     title,
     version,
     description,
@@ -211,7 +213,7 @@ function swaggerPlugin(options = {}) {
   } = options;
 
   const normalizedBase = `/${trimUrlPathSlashes(basePath)}`;
-  const jsonPath = `${normalizedBase}/openapi.json`;
+  const jsonPath = customJsonPath ? `/${trimUrlPathSlashes(customJsonPath)}` : `${normalizedBase}/openapi.json`;
   const uiPath = normalizedBase;
   const swaggerSubPath = `${normalizedBase}/swagger`;
   const scalarSubPath = `${normalizedBase}/scalar`;
@@ -243,7 +245,7 @@ function swaggerPlugin(options = {}) {
         return false;
       };
 
-      const server = serverUrl || process.env.BASE_URL || 'http://localhost:3000';
+      const server = serverUrl || process.env.BASE_URL || 'http://localhost:7331';
 
       let cachedDoc = null;
 
@@ -254,9 +256,14 @@ function swaggerPlugin(options = {}) {
           if (cachedDoc && process.env.NODE_ENV === 'production') {
             return res.json(cachedDoc);
           }
+          const resolvedPagesDir = ctx.pagesDir
+            || ctx.options?.pagesDir
+            || (typeof ctx.options?.pages === 'string' ? ctx.options.pages : null)
+            || (ctx.options?.rootDir ? path.join(ctx.options.rootDir, 'pages') : path.join(process.cwd(), 'pages'));
+
           const doc = buildOpenApiDocument({
             routes: ctx.routes || [],
-            pagesDir: ctx.options.pagesDir,
+            pagesDir: resolvedPagesDir,
             includeOrmSchemas,
             ormExclude,
             info: {
@@ -264,7 +271,7 @@ function swaggerPlugin(options = {}) {
               version: docVersion,
               description: docDescription,
             },
-            servers: [{ url: server.replace(/\/$/, '') }],
+            servers: [{ url: stripTrailingSlash(server) }],
           });
           if (process.env.NODE_ENV === 'production') {
             cachedDoc = doc;

package/plugins/upload/gcs-provider.js

@@ -0,0 +1,148 @@
+/**
+ * Google Cloud Storage (GCS) File Provider for Webspresso
+ * Enables direct file storage, streaming, and signed upload URLs with Google Cloud Storage
+ * Zero-dependency compatible: supports official @google-cloud/storage or standard duck-typed client interfaces
+ * @module plugins/upload/gcs-provider
+ */
+
+'use strict';
+
+const { generateStorageKey } = require('./s3-provider');
+
+/**
+ * Google Cloud Storage Provider
+ * @param {Object} options
+ * @param {Object|string} options.bucket - GCS Bucket name (string) or Bucket instance (e.g. storage.bucket('my-bucket'))
+ * @param {Object} [options.storageClient] - Optional Storage instance from @google-cloud/storage
+ * @param {string} [options.publicBaseUrl] - Custom public domain or CDN URL (e.g. 'https://cdn.example.com')
+ * @param {string} [options.prefix='uploads'] - Subdirectory prefix inside the GCS bucket
+ * @returns {Object} Upload storage provider implementing put, delete, and createSignedUploadUrl
+ */
+function createGcsFileProvider(options = {}) {
+  const { storageClient, publicBaseUrl, prefix = 'uploads' } = options;
+  let bucket = options.bucket;
+
+  if (!bucket) {
+    throw new Error('[createGcsFileProvider] GCS Bucket (name string or Bucket object) is required.');
+  }
+
+  const bucketName = typeof bucket === 'string' ? bucket : (bucket.name || 'bucket');
+  let bucketInstance = typeof bucket === 'object' && bucket !== null ? bucket : null;
+
+  if (typeof bucket === 'string' && storageClient && typeof storageClient.bucket === 'function') {
+    bucketInstance = storageClient.bucket(bucket);
+  }
+
+  const defaultBaseUrl = `https://storage.googleapis.com/${bucketName}`;
+  const normalizedBaseUrl = (publicBaseUrl || defaultBaseUrl).replace(/\/+$/, '');
+
+  return {
+    bucketName,
+    publicBaseUrl: normalizedBaseUrl,
+
+    /**
+     * Store file in Google Cloud Storage
+     * @param {Object} args
+     * @param {Buffer} args.buffer
+     * @param {string} args.originalName
+     * @param {string} args.mimeType
+     * @returns {Promise<{ publicUrl: string, key: string }>}
+     */
+    async put({ buffer, originalName, mimeType }) {
+      const key = generateStorageKey(originalName, mimeType, prefix);
+
+      if (bucketInstance && typeof bucketInstance.file === 'function') {
+        const file = bucketInstance.file(key);
+        await file.save(buffer, {
+          metadata: {
+            contentType: mimeType || 'application/octet-stream',
+            metadata: {
+              originalName: originalName || '',
+              uploadedAt: new Date().toISOString(),
+            },
+          },
+          resumable: false,
+        });
+      } else {
+        throw new Error(
+          '[createGcsFileProvider] A valid GCS bucket instance with .file() is required to perform .put().'
+        );
+      }
+
+      const publicUrl = `${normalizedBaseUrl}/${key}`;
+      return { publicUrl, key };
+    },
+
+    /**
+     * Delete file from Google Cloud Storage
+     * @param {string} key
+     * @returns {Promise<boolean>}
+     */
+    async delete(key) {
+      if (bucketInstance && typeof bucketInstance.file === 'function') {
+        const file = bucketInstance.file(key);
+        try {
+          if (typeof file.delete === 'function') {
+            await file.delete({ ignoreNotFound: true });
+            return true;
+          }
+        } catch (_) {
+          return false;
+        }
+      }
+      return false;
+    },
+
+    /**
+     * Generate a V4 signed URL for direct browser-to-GCS upload
+     * @param {Object} [params]
+     * @param {string} [params.originalName]
+     * @param {string} [params.mimeType]
+     * @param {number} [params.expiresInMs=900000] - 15 minutes default
+     * @param {string} [params.key] - Custom key override
+     * @returns {Promise<{ uploadUrl: string, publicUrl: string, key: string, method: string, headers: Record<string, string> }>}
+     */
+    async createSignedUploadUrl(params = {}) {
+      const {
+        originalName = 'upload',
+        mimeType = 'application/octet-stream',
+        expiresInMs = 15 * 60 * 1000,
+        key: customKey,
+      } = params;
+
+      const key = customKey || generateStorageKey(originalName, mimeType, prefix);
+
+      if (!bucketInstance || typeof bucketInstance.file !== 'function') {
+        throw new Error('[createGcsFileProvider] GCS bucket instance required for generating signed upload URLs.');
+      }
+
+      const file = bucketInstance.file(key);
+      if (typeof file.getSignedUrl !== 'function') {
+        throw new Error('[createGcsFileProvider] file.getSignedUrl() method is not implemented on GCS File instance.');
+      }
+
+      const [signedUrl] = await file.getSignedUrl({
+        version: 'v4',
+        action: 'write',
+        expires: Date.now() + expiresInMs,
+        contentType: mimeType,
+      });
+
+      const publicUrl = `${normalizedBaseUrl}/${key}`;
+
+      return {
+        uploadUrl: signedUrl,
+        publicUrl,
+        key,
+        method: 'PUT',
+        headers: {
+          'Content-Type': mimeType,
+        },
+      };
+    },
+  };
+}
+
+module.exports = {
+  createGcsFileProvider,
+};