webspresso 0.0.106 → 0.0.107

package/core/utils/string.js

@@ -18,10 +18,35 @@
  */
 function toCamelCase(str) {
   if (!str || typeof str !== 'string') return '';
-  const trimmed = str.replace(/^[-_\s]+|[-_\s]+$/g, '');
-  if (!trimmed) return '';
-  const res = trimmed.replace(/[-_\s]+([a-zA-Z0-9])/g, (_, letter) => letter.toUpperCase());
-  return res.charAt(0).toLowerCase() + res.slice(1);
+  const s = str.trim();
+  if (!s) return '';
+
+  let start = 0;
+  let end = s.length;
+  while (start < end && (s[start] === '-' || s[start] === '_')) {
+    start++;
+  }
+  while (end > start && (s[end - 1] === '-' || s[end - 1] === '_')) {
+    end--;
+  }
+  if (start >= end) return '';
+
+  let result = '';
+  let capitalizeNext = false;
+  for (let i = start; i < end; i++) {
+    const ch = s[i];
+    if (ch === '-' || ch === '_' || ch === ' ' || ch === '\t' || ch === '\n' || ch === '\r') {
+      capitalizeNext = true;
+    } else {
+      if (capitalizeNext) {
+        result += result.length === 0 ? ch.toLowerCase() : ch.toUpperCase();
+        capitalizeNext = false;
+      } else {
+        result += result.length === 0 ? ch.toLowerCase() : ch;
+      }
+    }
+  }
+  return result;
 }
 
 /**
@@ -35,12 +60,30 @@ function toCamelCase(str) {
  */
 function toSnakeCase(str) {
   if (!str || typeof str !== 'string') return '';
-  return str
-    .trim()
-    .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
-    .replace(/[-_\s]+/g, '_')
-    .replace(/^_+|_+$/g, '')
-    .toLowerCase();
+  const s = str.trim();
+  if (!s) return '';
+
+  const expanded = s.replace(/([a-z0-9])([A-Z])/g, '$1_$2');
+  let result = '';
+  let prevWasUnderscore = false;
+
+  for (let i = 0; i < expanded.length; i++) {
+    const ch = expanded[i];
+    if (ch === '-' || ch === '_' || ch === ' ' || ch === '\t' || ch === '\n' || ch === '\r') {
+      if (!prevWasUnderscore && result.length > 0) {
+        result += '_';
+        prevWasUnderscore = true;
+      }
+    } else {
+      result += ch.toLowerCase();
+      prevWasUnderscore = false;
+    }
+  }
+
+  while (result.endsWith('_')) {
+    result = result.slice(0, -1);
+  }
+  return result;
 }
 
 /**
@@ -54,12 +97,30 @@ function toSnakeCase(str) {
  */
 function toKebabCase(str) {
   if (!str || typeof str !== 'string') return '';
-  return str
-    .trim()
-    .replace(/([a-z0-9])([A-Z])/g, '$1-$2')
-    .replace(/[-_\s]+/g, '-')
-    .replace(/^-+|-+$/g, '')
-    .toLowerCase();
+  const s = str.trim();
+  if (!s) return '';
+
+  const expanded = s.replace(/([a-z0-9])([A-Z])/g, '$1-$2');
+  let result = '';
+  let prevWasDash = false;
+
+  for (let i = 0; i < expanded.length; i++) {
+    const ch = expanded[i];
+    if (ch === '-' || ch === '_' || ch === ' ' || ch === '\t' || ch === '\n' || ch === '\r') {
+      if (!prevWasDash && result.length > 0) {
+        result += '-';
+        prevWasDash = true;
+      }
+    } else {
+      result += ch.toLowerCase();
+      prevWasDash = false;
+    }
+  }
+
+  while (result.endsWith('-')) {
+    result = result.slice(0, -1);
+  }
+  return result;
 }
 
 /**

package/core/validation/index.js

@@ -12,6 +12,24 @@ const { extendZ, generateNanoid, zodNanoid } = require('../orm/utils/nanoid');
  */
 const zExtended = extendZ(z);
 
+// Ensure asynchronous refinements and superRefinements never leak dangling unhandled rejections
+// if evaluated during a synchronous parse attempt before falling back to async parsing.
+if (z.ZodType && z.ZodType.prototype && typeof z.ZodType.prototype._refinement === 'function' && !z.ZodType.prototype._refinement.__webspresso_wrapped) {
+  const origRefinement = z.ZodType.prototype._refinement;
+  const wrappedRefinement = function (refinement) {
+    const wrapped = (val, ctx) => {
+      const res = refinement(val, ctx);
+      if (res && typeof res.catch === 'function') {
+        res.catch(() => {});
+      }
+      return res;
+    };
+    return origRefinement.call(this, wrapped);
+  };
+  wrappedRefinement.__webspresso_wrapped = true;
+  z.ZodType.prototype._refinement = wrappedRefinement;
+}
+
 /**
  * Check if an object contains dangerous prototype pollution keys
  * @param {*} obj

package/index.d.ts

@@ -218,8 +218,14 @@ export interface ServiceContext {
   t?: unknown;
   service?: {
     <T = unknown>(name: string, input?: unknown, options?: unknown): Promise<T>;
+    call?: <T = unknown>(name: string, input?: unknown, options?: unknown) => Promise<T>;
+    execute?: <T = unknown>(name: string, input?: unknown, options?: unknown) => Promise<T>;
     invalidate?: (name: string, input?: unknown, ctx?: unknown) => boolean;
     clearCache?: (name?: string) => boolean;
+    invalidateByTag?: (tag: string, serviceName?: string) => number | Promise<number>;
+    invalidateByTags?: (tags: string | string[], serviceName?: string) => number | Promise<number>;
+    invalidateTag?: (tag: string, serviceName?: string) => number | Promise<number>;
+    invalidateTags?: (tags: string | string[], serviceName?: string) => number | Promise<number>;
   };
   breaker?: (name: string, options?: CircuitBreakerOptions) => CircuitBreaker;
   retry?: typeof retry;
@@ -231,6 +237,43 @@ export type ServiceHandler<TInput = unknown, TOutput = unknown> = (
   ctx: ServiceContext
 ) => Promise<TOutput> | TOutput;
 
+export interface ServiceMiddlewareContext<TInput = unknown> {
+  name: string;
+  input: TInput;
+  ctx: ServiceContext;
+  serviceDef: ServiceDefinition<TInput, any>;
+  options: unknown;
+  registry: ServiceRegistry;
+}
+
+export interface ServiceBeforeContext<TInput = unknown> {
+  name: string;
+  input: TInput;
+  ctx: ServiceContext;
+  serviceDef: ServiceDefinition<TInput, any>;
+  options: unknown;
+}
+
+export interface ServiceAfterContext<TInput = unknown, TOutput = unknown> {
+  name: string;
+  result: TOutput;
+  input: TInput;
+  ctx: ServiceContext;
+  serviceDef: ServiceDefinition<TInput, TOutput>;
+  duration: number;
+  options: unknown;
+}
+
+export interface ServiceErrorContext<TInput = unknown> {
+  name: string;
+  error: Error;
+  input: TInput;
+  ctx: ServiceContext;
+  serviceDef: ServiceDefinition<TInput, any>;
+  duration: number;
+  options: unknown;
+}
+
 export interface ServiceDefinition<TInput = unknown, TOutput = unknown> {
   schema?: import('zod').ZodType<any> | Record<string, unknown> | ((input: unknown) => unknown) | null;
   handler: ServiceHandler<TInput, TOutput>;
@@ -248,21 +291,66 @@ export interface ServiceDefinition<TInput = unknown, TOutput = unknown> {
   transaction?: boolean;
   circuitBreaker?: boolean | string | CircuitBreakerOptions | CircuitBreaker;
   retry?: boolean | number | RetryOptions;
+  before?: ((input: TInput, ctx: ServiceContext) => unknown) | Array<(input: TInput, ctx: ServiceContext) => unknown>;
+  after?: ((result: TOutput, input: TInput, ctx: ServiceContext) => unknown) | Array<(result: TOutput, input: TInput, ctx: ServiceContext) => unknown>;
+  onError?: ((error: Error, input: TInput, ctx: ServiceContext) => unknown) | Array<(error: Error, input: TInput, ctx: ServiceContext) => unknown>;
+  middleware?: ((context: ServiceMiddlewareContext<TInput>, next: () => Promise<unknown>) => Promise<unknown>) | Array<(context: ServiceMiddlewareContext<TInput>, next: () => Promise<unknown>) => Promise<unknown>>;
   [key: string]: unknown;
 }
 
 export class ServiceRegistry {
-  constructor(options?: { servicesDir?: string; isDev?: boolean; logger?: unknown });
+  constructor(options?: {
+    servicesDir?: string;
+    isDev?: boolean;
+    logger?: unknown;
+    timeouts?: unknown;
+    timeout?: number | string;
+    lazy?: boolean;
+    middlewares?: Array<(context: ServiceMiddlewareContext, next: () => Promise<unknown>) => Promise<unknown>>;
+    middleware?: (context: ServiceMiddlewareContext, next: () => Promise<unknown>) => Promise<unknown>;
+    before?: Array<(context: ServiceBeforeContext) => unknown> | ((context: ServiceBeforeContext) => unknown);
+    after?: Array<(context: ServiceAfterContext) => unknown> | ((context: ServiceAfterContext) => unknown);
+    onError?: Array<(context: ServiceErrorContext) => unknown> | ((context: ServiceErrorContext) => unknown);
+    events?: unknown;
+    cacheProvider?: unknown;
+    cache?: unknown;
+  });
   readonly services: Map<string, ServiceDefinition>;
+  readonly lazyServices: Map<string, unknown>;
+  readonly aliases: Map<string, string>;
+  readonly middlewares: Array<(context: ServiceMiddlewareContext, next: () => Promise<unknown>) => Promise<unknown>>;
+  readonly beforeHooks: Array<(context: ServiceBeforeContext) => unknown>;
+  readonly afterHooks: Array<(context: ServiceAfterContext) => unknown>;
+  readonly onErrorHooks: Array<(context: ServiceErrorContext) => unknown>;
   load(): this;
-  register(name: string, definition: ServiceDefinition | ServiceHandler): this;
+  loadAsync(): Promise<this>;
+  register(name: string, definition: ServiceDefinition | ServiceHandler, options?: { overwrite?: boolean; aliases?: string[] }): this;
+  registerLazy(
+    name: string,
+    loader: (() => Promise<unknown> | unknown) | string,
+    options?: { overwrite?: boolean; aliases?: string[]; filePath?: string }
+  ): this;
+  use(middleware: (context: ServiceMiddlewareContext, next: () => Promise<unknown>) => Promise<unknown>): this;
+  before(hook: (context: ServiceBeforeContext) => unknown): this;
+  after(hook: (context: ServiceAfterContext) => unknown): this;
+  onError(hook: (context: ServiceErrorContext) => unknown): this;
+  setEventDispatcher(events: unknown): this;
   get(name: string): ServiceDefinition | undefined;
+  getAsync(name: string): Promise<ServiceDefinition | undefined>;
   has(name: string): boolean;
   list(): string[];
+  unregister(name: string): boolean;
   invalidate(name: string, input?: unknown, ctx?: unknown): boolean;
   clearCache(name?: string): boolean;
+  clearAllCaches(): boolean;
+  invalidateByTag(tag: string, serviceName?: string): number | Promise<number>;
+  invalidateByTags(tags: string | string[], serviceName?: string): number | Promise<number>;
+  invalidateTag?(tag: string, serviceName?: string): number | Promise<number>;
+  invalidateTags?(tags: string | string[], serviceName?: string): number | Promise<number>;
   call<T = unknown>(name: string, input?: unknown, ctx?: unknown, options?: unknown): Promise<T>;
+  execute<T = unknown>(name: string, input?: unknown, ctx?: unknown, options?: unknown): Promise<T>;
   reload(): this;
+  reloadAsync(): Promise<this>;
 }
 
 export function createServiceRegistry(options?: {
@@ -270,8 +358,42 @@ export function createServiceRegistry(options?: {
   isDev?: boolean;
   logger?: unknown;
   autoLoad?: boolean;
+  lazy?: boolean;
+  timeouts?: unknown;
+  timeout?: number | string;
+  middlewares?: Array<(context: ServiceMiddlewareContext, next: () => Promise<unknown>) => Promise<unknown>>;
+  middleware?: (context: ServiceMiddlewareContext, next: () => Promise<unknown>) => Promise<unknown>;
+  before?: Array<(context: ServiceBeforeContext) => unknown> | ((context: ServiceBeforeContext) => unknown);
+  after?: Array<(context: ServiceAfterContext) => unknown> | ((context: ServiceAfterContext) => unknown);
+  onError?: Array<(context: ServiceErrorContext) => unknown> | ((context: ServiceErrorContext) => unknown);
+  events?: unknown;
+  cacheProvider?: unknown;
+  cache?: unknown;
 }): ServiceRegistry;
 
+export function createServiceRegistryAsync(options?: {
+  servicesDir?: string;
+  isDev?: boolean;
+  logger?: unknown;
+  autoLoad?: boolean;
+  lazy?: boolean;
+  timeouts?: unknown;
+  timeout?: number | string;
+  middlewares?: Array<(context: ServiceMiddlewareContext, next: () => Promise<unknown>) => Promise<unknown>>;
+  middleware?: (context: ServiceMiddlewareContext, next: () => Promise<unknown>) => Promise<unknown>;
+  before?: Array<(context: ServiceBeforeContext) => unknown> | ((context: ServiceBeforeContext) => unknown);
+  after?: Array<(context: ServiceAfterContext) => unknown> | ((context: ServiceAfterContext) => unknown);
+  onError?: Array<(context: ServiceErrorContext) => unknown> | ((context: ServiceErrorContext) => unknown);
+  events?: unknown;
+  cacheProvider?: unknown;
+  cache?: unknown;
+}): Promise<ServiceRegistry>;
+
+export function composeMiddleware(middlewares: Function[]): (context: unknown, next?: Function) => Promise<unknown>;
+export function loadModuleSync(filePath: string, options?: { isDev?: boolean }): unknown;
+export function loadModuleAsync(filePath: string, options?: { isDev?: boolean }): Promise<unknown>;
+export function extractModuleExport(mod: unknown): unknown;
+
 export type InferServiceInput<T> = T extends ServiceDefinition<infer TInput, any>
   ? TInput
   : T extends { schema: import('zod').ZodType<infer TInput> }
@@ -297,15 +419,22 @@ export const service: typeof defineService;
 export interface MemoizeOptions {
   ttl?: string | number | boolean;
   maxSize?: number;
+  clone?: boolean;
   key?: (input: unknown, ctx?: unknown) => string;
+  tags?: string | string[] | ((input: unknown, ctx?: unknown) => string | string[]);
+  provider?: unknown;
 }
 
 export interface MemoizedFunction<TArgs extends unknown[], TReturn> {
   (...args: TArgs): Promise<TReturn>;
-  invalidate(...args: TArgs): boolean;
-  delete(...args: TArgs): boolean;
-  clear(): void;
-  has(...args: TArgs): boolean;
+  invalidate(...args: TArgs): boolean | Promise<boolean>;
+  delete(...args: TArgs): boolean | Promise<boolean>;
+  invalidateByTag(tag: string): number | Promise<number>;
+  invalidateByTags(tags: string | string[]): number | Promise<number>;
+  invalidateTag?(tag: string): number | Promise<number>;
+  invalidateTags?(tags: string | string[]): number | Promise<number>;
+  clear(): void | Promise<void>;
+  has(...args: TArgs): boolean | Promise<boolean>;
   readonly size: number;
 }
 
@@ -363,7 +492,28 @@ export function createExchangeServices(options?: {
   db?: unknown;
 }): Record<string, ServiceDefinition>;
 
-export function validateServiceInput(schema: unknown, input: unknown, serviceName: string): unknown;
+export function validateServiceInput(
+  schema: unknown,
+  input: unknown,
+  serviceName: string,
+  options?: { rejectDangerousKeys?: boolean }
+): unknown;
+
+export function createServiceValidationError(
+  message: string,
+  options?: {
+    serviceName: string;
+    fields?: Record<string, string>;
+    fieldErrors?: Record<string, string[]>;
+    details?: unknown[];
+    cause?: unknown;
+    status?: number;
+  }
+): ValidationError;
+
+export function normalizeValidationIssues(
+  issues: unknown[]
+): Array<{ path: string; message: string; code?: string }>;
 
 export function executeService(
   registry: ServiceRegistry,
@@ -650,7 +800,19 @@ export class CircuitBreakerTimeoutError extends GatewayTimeoutError {
 
 export class ValidationError extends HttpError {
   fields: Record<string, string[] | string>;
-  constructor(message?: string, options?: ErrorOptions & { fields?: Record<string, string[] | string> });
+  fieldErrors?: Record<string, string[]>;
+  service?: string;
+  issues?: unknown[];
+  details?: unknown[];
+  normalizedIssues?: Array<{ path: string; message: string; code?: string }>;
+  constructor(message?: string, options?: ErrorOptions & {
+    fields?: Record<string, string[] | string>;
+    fieldErrors?: Record<string, string[]>;
+    service?: string;
+    statusCode?: number;
+    issues?: unknown[];
+    details?: unknown[];
+  });
 }
 
 export class ConfigurationError extends WebspressoError { constructor(message: string, options?: ErrorOptions); }
@@ -5076,6 +5238,7 @@ export function createUserSessionsTable(knex: any): Promise<void>;
 export function dropUserSessionsTable(knex: any): Promise<void>;
 export function createKnexSessionTracker(db: any, options?: { tableName?: string }): SessionTracker;
 export function createMemorySessionTracker(): SessionTracker;
+export function createKvSessionTracker(kv: any, options?: { prefix?: string; ttlSeconds?: number }): SessionTracker;
 export function createListSessionsHandler(authManager: any): (req: any, res: any) => Promise<any>;
 export function createRevokeSessionHandler(authManager: any): (req: any, res: any) => Promise<any>;
 
@@ -5121,6 +5284,7 @@ export namespace sessions {
     dropUserSessionsTable,
     createKnexSessionTracker,
     createMemorySessionTracker,
+    createKvSessionTracker,
     createRedisSessionStore,
     createRedisSessionTracker,
     RedisSessionStore,

package/index.js

@@ -117,6 +117,7 @@ module.exports = {
   setAppContext,
 
   // Services Layer
+  services: require('./core/services'),
   createServiceRegistry,
   defineService,
   service: defineService,
@@ -541,6 +542,9 @@ Object.defineProperties(module.exports, {
   parseUserAgent: { get: () => require('./core/auth').parseUserAgent, enumerable: true, configurable: true },
   sessions: { get: () => require('./core/auth').sessions, enumerable: true, configurable: true },
   SessionManager: { get: () => require('./core/auth').SessionManager, enumerable: true, configurable: true },
+  createKnexSessionTracker: { get: () => require('./core/auth').createKnexSessionTracker, enumerable: true, configurable: true },
+  createMemorySessionTracker: { get: () => require('./core/auth').createMemorySessionTracker, enumerable: true, configurable: true },
+  createKvSessionTracker: { get: () => require('./core/auth').createKvSessionTracker, enumerable: true, configurable: true },
   createRedisSessionStore: { get: () => require('./core/auth').createRedisSessionStore, enumerable: true, configurable: true },
   createRedisSessionTracker: { get: () => require('./core/auth').createRedisSessionTracker, enumerable: true, configurable: true },
   RedisSessionStore: { get: () => require('./core/auth').RedisSessionStore, enumerable: true, configurable: true },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.106",
+  "version": "0.0.107",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",
@@ -18,7 +18,15 @@
     "./plugins/polar/src/*": "./plugins/polar/src/*.js",
     "./plugins/*": "./plugins/*/index.js",
     "./realtime": "./core/realtime/index.js",
+    "./services": {
+      "types": "./index.d.ts",
+      "default": "./core/services/index.js"
+    },
     "./core": "./core/index.js",
+    "./core/services": {
+      "types": "./index.d.ts",
+      "default": "./core/services/index.js"
+    },
     "./core/auth": "./core/auth/index.js",
     "./core/auth/*": "./core/auth/*.js",
     "./core/errors": "./core/errors/index.js",
@@ -39,17 +47,17 @@
   },
   "scripts": {
     "test": "vitest run",
-    "test:unit": "vitest run tests/unit/",
-    "test:integration": "vitest run tests/integration/",
+    "test:unit": "vitest run tests/unit/ tests/plugins/unit/",
+    "test:integration": "vitest run tests/integration/ tests/plugins/integration/",
     "test:security": "vitest run tests/security/",
     "test:orm": "vitest run tests/**/orm* tests/**/database*",
     "test:auth": "vitest run tests/**/auth* tests/unit/server-auth-branches.test.js",
     "test:admin": "vitest run tests/**/admin*",
-    "test:services": "vitest run tests/**/service*",
-    "test:plugins": "vitest run tests/**/plugin* tests/unit/*plugin*.test.js",
+    "test:services": "vitest run tests/unit/services/ tests/**/service*",
+    "test:plugins": "vitest run tests/plugins/",
     "test:core": "vitest run tests/unit/core* tests/unit/server* tests/unit/routing* tests/unit/template*",
     "test:branches": "vitest run tests/unit/*scenarios*.test.js tests/unit/*branches*.test.js",
-    "test:fast": "vitest run tests/unit/*scenarios*.test.js tests/unit/*branches*.test.js tests/unit/auth.test.js tests/unit/services.test.js tests/unit/server.test.js",
+    "test:fast": "vitest run tests/unit/*scenarios*.test.js tests/unit/*branches*.test.js tests/unit/auth.test.js tests/unit/services/services.test.js tests/unit/server.test.js",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "test:coverage:quick": "vitest run --coverage",
@@ -129,7 +137,7 @@
     "multer": "^2.4.0",
     "nodemailer": "^10.0.10",
     "nunjucks": "^3.2.4",
-    "sanitize-html": "^2.17.7",
+    "sanitize-html": "^2.18.1",
     "sharp": "^0.35.5",
     "swup": "^4.8.3",
     "yaml": "^2.8.3",
@@ -194,7 +202,9 @@
     "undici": "^6.28.1",
     "uuid": "^11.1.1",
     "js-yaml": "^5.4.2",
-    "qs": "^6.16.0"
+    "qs": "^6.16.0",
+    "sanitize-html": "^2.18.1",
+    "vite": "^8.3.5"
   },
   "allowScripts": {
     "better-sqlite3@11.10.0": true

package/plugins/admin-panel/client/parts/07-model-list.js

@@ -518,7 +518,7 @@ function parseFilterQuery(queryString) {
   if (!queryString) return filters;
   
   const params = new URLSearchParams(queryString);
-  const filterParams = {};
+  const filterParams = Object.create(null);
   
   // Group filter parameters using simple string parsing (no regex needed)
   for (const [key, value] of params.entries()) {
@@ -532,7 +532,10 @@ function parseFilterQuery(queryString) {
         const col = key.substring(7, firstClose);
         const prop = key.substring(secondOpen + 1, secondClose);
         
-        if (!filterParams[col]) filterParams[col] = {};
+        if (col === '__proto__' || col === 'constructor' || col === 'prototype') continue;
+        if (prop === '__proto__' || prop === 'constructor' || prop === 'prototype') continue;
+
+        if (!filterParams[col]) filterParams[col] = Object.create(null);
         if (prop === 'value' && filterParams[col].value) {
           // Multiple values for 'in' operator
           if (!Array.isArray(filterParams[col].value)) {

package/plugins/admin-panel/index.js

@@ -324,6 +324,7 @@ function adminPanelPlugin(options = {}) {
           db,
           auth,
           config: userMgmtConfig,
+          hashPassword: (password, rounds) => bcrypt.hash(password, process.env.NODE_ENV === 'test' ? 4 : (rounds || 10)),
         });
       }
 
@@ -570,24 +571,36 @@ function adminPanelPlugin(options = {}) {
       // Static Vendor Assets (Offline Zero-CDN)
       // ==========================================
       const vendorDir = path.join(__dirname, 'vendor');
+      const vendorAssetCache = new Map();
       ctx.addRoute('get', `${adminPath}/vendor/:file`, (req, res) => {
         const fileName = path.basename(req.params.file);
-        const filePath = path.join(vendorDir, fileName);
-
-        if (!fs.existsSync(filePath)) {
-          return res.status(404).send('Vendor asset not found');
+        let cached = vendorAssetCache.get(fileName);
+        if (cached === undefined) {
+          const filePath = path.join(vendorDir, fileName);
+          if (!fs.existsSync(filePath)) {
+            vendorAssetCache.set(fileName, null);
+            return res.status(404).send('Vendor asset not found');
+          }
+          let contentType = 'application/octet-stream';
+          if (fileName.endsWith('.js')) {
+            contentType = 'application/javascript';
+          } else if (fileName.endsWith('.css')) {
+            contentType = 'text/css';
+          }
+          cached = {
+            buffer: fs.readFileSync(filePath),
+            contentType,
+          };
+          vendorAssetCache.set(fileName, cached);
         }
 
-        if (fileName.endsWith('.js')) {
-          res.type('application/javascript');
-        } else if (fileName.endsWith('.css')) {
-          res.type('text/css');
-        } else {
-          res.type('application/octet-stream');
+        if (!cached) {
+          return res.status(404).send('Vendor asset not found');
         }
 
+        res.type(cached.contentType);
         res.setHeader('Cache-Control', 'public, max-age=86400');
-        res.sendFile(filePath);
+        res.send(cached.buffer);
       });
 
       // ==========================================

package/plugins/admin-panel/modules/user-management.js

@@ -50,7 +50,7 @@ function resolveUserManagementModelName(config = {}) {
  * @param {Object} [options.config] - User management config
  */
 function registerUserManagement(options) {
-  const { registry, db, auth, config = {} } = options;
+  const { registry, db, auth, config = {}, hashPassword: customHashPassword } = options;
   
   const {
     fields = {},
@@ -230,7 +230,8 @@ function registerUserManagement(options) {
       const repo = db.getRepository(targetModel);
       // Generate random password
       const newPassword = generateRandomPassword(12);
-      const hashedPassword = await hash(newPassword);
+      const hashFn = customHashPassword || ((p) => hash(p, process.env.NODE_ENV === 'test' ? 4 : 10));
+      const hashedPassword = await hashFn(newPassword);
       await repo.update(record.id, { [fieldMap.password]: hashedPassword });
       return { message: 'Password reset', newPassword }; // Return new password to show in UI
     },

package/plugins/csrf/index.js

@@ -171,13 +171,14 @@ function csrfPlugin(options = {}) {
       if (activeMethods.includes(method) && !isIgnored(req, activeIgnorePaths)) {
         const body = req.body && typeof req.body === 'object' ? req.body : EMPTY_OBJECT;
         const query = req.query && typeof req.query === 'object' ? req.query : EMPTY_OBJECT;
-        const submitted = (
+        const rawSubmitted = (
           body._csrf ||
           query._csrf ||
           req.headers['x-csrf-token'] ||
           req.headers['xsrf-token'] ||
           req.headers['x-xsrf-token']
         );
+        const submitted = typeof rawSubmitted === 'string' ? rawSubmitted : null;
 
         if (!submitted || !safeCompare(submitted, csrfTokenValue)) {
           res.status(errorStatus);