webspresso 0.0.108 → 0.0.110

package/src/server.js

@@ -121,23 +121,40 @@ function fastETag(body, encoding) {
  * @param {Object} options - Nunjucks options
  * @returns {nunjucks.Environment}
  */
+const normalizedTemplateNameCache = new Map();
 function normalizeTemplateName(name) {
   if (typeof name !== 'string') return name;
-  if (!name.includes('\\') && !name.includes('views')) return name;
-  let normalized = name.replace(/\\/g, '/');
-  // Collapse any repeated views/views/... to a single views/ or clean path
-  while (/(?:^|\/)views\/(?:\.\/)?views(?:\/|$)/.test(normalized)) {
-    normalized = normalized.replace(/((?:^|\/)views)\/(?:\.\/)?views(?=\/|$)/g, '$1');
+  const cached = normalizedTemplateNameCache.get(name);
+  if (cached !== undefined) return cached;
+  let normalized = name;
+  if (name.includes('\\') || name.includes('views')) {
+    normalized = name.replace(/\\/g, '/');
+    // Collapse any repeated views/views/... to a single views/ or clean path
+    while (/(?:^|\/)views\/(?:\.\/)?views(?:\/|$)/.test(normalized)) {
+      normalized = normalized.replace(/((?:^|\/)views)\/(?:\.\/)?views(?=\/|$)/g, '$1');
+    }
+  }
+  if (normalizedTemplateNameCache.size < 512) {
+    normalizedTemplateNameCache.set(name, normalized);
   }
   return normalized;
 }
 
+const canonicalKeyCache = new Map();
 function canonicalTemplateKey(name) {
+  if (typeof name !== 'string') return String(name);
+  const cached = canonicalKeyCache.get(name);
+  if (cached !== undefined) return cached;
   const norm = normalizeTemplateName(name);
-  if (typeof norm !== 'string') return String(norm);
-  if (!norm.startsWith('.') && !norm.startsWith('views/')) return norm;
-  // Canonical key strips leading ./ or views/ for cycle detection
-  return norm.replace(/^\.\//, '').replace(/^views\//, '');
+  let key = norm;
+  if (typeof norm === 'string' && (norm.startsWith('.') || norm.startsWith('views/'))) {
+    // Canonical key strips leading ./ or views/ for cycle detection
+    key = norm.replace(/^\.\//, '').replace(/^views\//, '');
+  }
+  if (canonicalKeyCache.size < 512) {
+    canonicalKeyCache.set(name, key);
+  }
+  return key;
 }
 
 function configureSafeNunjucks(templateDirs, options = {}) {
@@ -348,8 +365,21 @@ function configureSafeNunjucks(templateDirs, options = {}) {
  */
 function getDefaultHelmetConfig(isDev) {
   return {
-    // Disable CSP in development for easier development (Nunjucks hot reload, etc.)
-    contentSecurityPolicy: isDev ? false : {
+    // In development: use reportOnly so developers are alerted to CSP violations without breaking local dev tools
+    contentSecurityPolicy: isDev ? {
+      reportOnly: true,
+      directives: {
+        defaultSrc: ["'self'"],
+        styleSrc: ["'self'", "'unsafe-inline'"], // Allow inline styles for Tailwind / Dev reload
+        scriptSrc: ["'self'", "'unsafe-inline'"], // Allow inline scripts for client runtime / dev tools
+        imgSrc: ["'self'", "data:", "https:"],
+        fontSrc: ["'self'", "data:"],
+        connectSrc: ["'self'", "ws:", "wss:"], // WebSockets for dev live reload
+        frameSrc: ["'none'"],
+        objectSrc: ["'none'"],
+        upgradeInsecureRequests: null, // Browser ignores & warns on upgrade-insecure-requests in Report-Only policy
+      }
+    } : {
       directives: {
         defaultSrc: ["'self'"],
         styleSrc: ["'self'", "'unsafe-inline'"], // Allow inline styles for Tailwind
@@ -569,6 +599,34 @@ function haltOnTimedout(req, res, next) {
   if (!req.timedout) next();
 }
 
+/**
+ * Replace Express 5's re-parsing `req.query` getter with a per-request memoized accessor.
+ * The first read delegates to the inherited getter (honouring the app's `query parser`);
+ * later reads return the same object. Assignments (`req.query = …`) keep working.
+ * @param {import('express').Request} req
+ */
+function memoizeRequestQuery(req) {
+  if (Object.prototype.hasOwnProperty.call(req, 'query')) return;
+  const proto = Object.getPrototypeOf(req);
+  let parsed;
+  let ready = false;
+  Object.defineProperty(req, 'query', {
+    configurable: true,
+    enumerable: true,
+    get() {
+      if (!ready) {
+        parsed = Reflect.get(proto, 'query', req);
+        ready = true;
+      }
+      return parsed;
+    },
+    set(value) {
+      parsed = value;
+      ready = true;
+    },
+  });
+}
+
 /**
  * Create and configure the Express app
  * @param {Object} options - Configuration options
@@ -590,14 +648,14 @@ function haltOnTimedout(req, res, next) {
  * @param {string|boolean} options.timeout - Request timeout (default: '30s', false to disable)
  * @param {Object} options.auth - Authentication manager instance (from createAuth)
  * @param {Object} options.db - Database instance (exposed as ctx.db to plugins)
- * @param {Object} [options.clientRuntime] - Optional client assets: `{ alpine?: boolean|object, swup?: boolean|object }`. Overridable by env `WEBSPRESSO_ALPINE` / `WEBSPRESSO_SWUP` (=1 or true). Serves `/__webspresso/client-runtime/*` when either flag is on.
+ * @param {Object} [options.clientRuntime] - Optional client assets: `{ swup?: boolean|object }`. Overridable by env `WEBSPRESSO_SWUP` (=1 or true). Serves `/__webspresso/client-runtime/*` when enabled.
  * @param {boolean|{enabled?: boolean, stylesheets?: boolean, scripts?: boolean}} [options.pageAssets] - If truthy, route `load()` return values for `stylesheets` and `scripts` are reserved: removed from the root template context and passed as `pageHead` to Nunjucks, with `pageAssets: true` (for layout to emit `<link>` / `<script>`). Default off.
  * @param {function(import('express').Express, Object): void} [options.setupRoutes] - Called after file routes and plugins, before 404 handler
  * @returns {Object} { app, nunjucksEnv, pluginManager, authMiddleware }
  */
 function createApp(options = {}) {
-  const NODE_ENV = process.env.NODE_ENV || 'development';
-  const isDev = NODE_ENV !== 'production';
+  const NODE_ENV = process.env.NODE_ENV || 'production';
+  const isDev = options.isDev !== undefined ? Boolean(options.isDev) : (NODE_ENV === 'development');
   const isTest = NODE_ENV === 'test';
   
   const {
@@ -688,8 +746,16 @@ function createApp(options = {}) {
   };
 
   try {
+  // Adopt or resolve Background Queue
+  const queueManager = core.queue || (options.queue && typeof options.queue.dispatch === 'function' ? options.queue : null);
+  if (queueManager) {
+    app.queue = queueManager;
+    options.queue = queueManager;
+  }
+
   setAppContext({
     db: options.db ?? null,
+    queue: queueManager ?? null,
     shutdownManager,
     serviceRegistry,
     events: eventDispatcher,
@@ -714,14 +780,11 @@ function createApp(options = {}) {
   app.service.invalidateByTags = (tags, serviceName) => serviceRegistry.invalidateByTags(tags, serviceName);
   app.service.invalidateTag = app.service.invalidateByTag;
   app.service.invalidateTags = app.service.invalidateByTags;
-  if (options.queue) {
-    app.queue = options.queue;
-  }
 
   const { renderStream } = require('../core/ssr/stream');
   const { createSseStream } = require('../core/sse/stream');
   const { streamText, streamJson } = require('../core/stream/text-stream');
-  const { runWithContext } = require('../core/context/request');
+  const { runWithContext, getContext } = require('../core/context/request');
   app.use((req, res, next) => {
     // 1. Request draining check during graceful shutdown (allow health/readiness probes through)
     const isHealthEndpoint = req.path === '/healthz' || req.path === '/readyz' || req.path === '/health' ||
@@ -748,67 +811,109 @@ function createApp(options = {}) {
     req.id = reqId;
     res.setHeader('X-Request-Id', reqId);
 
+    // 2b. Express 5 re-parses the query string (qs.parse) on every `req.query` read; the file
+    // router, validation and loaders read it ~3x per request. Parse once, keep it assignable.
+    memoizeRequestQuery(req);
+
     // 3. Request DB, Services, Queue, Events, and Context
     if (options.db) {
       req.db = options.db;
     }
-    if (options.queue) {
-      req.queue = options.queue;
+    if (queueManager) {
+      req.queue = queueManager;
     }
     req.events = eventDispatcher;
     req.cache = appCache;
     req.breakers = appBreakers;
-    req.breaker = (name, opts) => appBreakers.getBreaker(name, opts);
     req.retry = retry;
     req.context = core.createContext({
       req,
       res,
       app,
+      queue: queueManager ?? null,
       assetManager: appAssetManager,
       ...(req.context || {}),
     });
-    req.service = (name, input, opts) =>
-      core.service(name, input, req.context, opts);
-    req.service.call = (name, input, opts) => req.service(name, input, opts);
-    req.service.execute = (name, input, opts) => req.service(name, input, opts);
-    req.service.invalidate = (name, input, ctx) =>
-      serviceRegistry.invalidate(name, input, ctx || req.context);
-    req.service.clearCache = (name) =>
-      serviceRegistry.clearCache(name);
-    req.service.invalidateByTag = (tag, serviceName) =>
-      serviceRegistry.invalidateByTag(tag, serviceName);
-    req.service.invalidateByTags = (tags, serviceName) =>
-      serviceRegistry.invalidateByTags(tags, serviceName);
-    req.service.invalidateTag = req.service.invalidateByTag;
-    req.service.invalidateTags = req.service.invalidateByTags;
-
-    // 4. SSR Streaming Response Helper
-    res.renderStream = (templatePath, context = {}, renderOptions = {}) => {
-      return renderStream(res, templatePath, context, {
-        env: nunjucksEnv,
-        ...renderOptions,
-      });
-    };
-
-    // 5. Server-Sent Events (SSE) Response Helper
-    res.sse = (sourceOrOptions, maybeOptions) => {
-      return createSseStream(req, res, sourceOrOptions, maybeOptions);
-    };
-
-    // 6. Text and NDJSON Streaming Helpers (AI / LLM Tokens)
-    res.streamText = (sourceOrCallback, maybeOptions) => {
-      return streamText(req, res, sourceOrCallback, maybeOptions);
-    };
-
-    res.streamJson = (sourceOrCallback, maybeOptions) => {
-      return streamJson(req, res, sourceOrCallback, maybeOptions);
-    };
+    // Shared helper functions (no per-request closures). Assigned as own properties rather than
+    // on app.request/app.response so they survive Express sub-app prototype swaps.
+    req.breaker = requestBreaker;
+    Object.defineProperty(req, 'service', REQUEST_SERVICE_DESCRIPTOR);
+    res.renderStream = renderStreamHelper;
+    res.sse = sseHelper;
+    res.streamText = streamTextHelper;
+    res.streamJson = streamJsonHelper;
 
     runWithContext(req.context, () => {
       next();
     });
   });
 
+  function requestBreaker(name, opts) {
+    return appBreakers.getBreaker(name, opts);
+  }
+
+  /** Build the request-bound service caller (only when a handler actually touches req.service). */
+  function createRequestService(req) {
+    const service = (name, input, opts) => core.service(name, input, req.context, opts);
+    service.call = service;
+    service.execute = service;
+    service.invalidate = (name, input, ctx) => serviceRegistry.invalidate(name, input, ctx || req.context);
+    service.clearCache = (name) => serviceRegistry.clearCache(name);
+    service.invalidateByTag = (tag, serviceName) => serviceRegistry.invalidateByTag(tag, serviceName);
+    service.invalidateByTags = (tags, serviceName) => serviceRegistry.invalidateByTags(tags, serviceName);
+    service.invalidateTag = service.invalidateByTag;
+    service.invalidateTags = service.invalidateByTags;
+    return service;
+  }
+
+  const REQUEST_SERVICE_DESCRIPTOR = {
+    configurable: true,
+    enumerable: true,
+    get() {
+      const service = createRequestService(this);
+      Object.defineProperty(this, 'service', { value: service, writable: true, configurable: true, enumerable: true });
+      return service;
+    },
+    set(value) {
+      Object.defineProperty(this, 'service', { value, writable: true, configurable: true, enumerable: true });
+    },
+  };
+
+  function resolveStreamReqRes(receiver) {
+    const ctx = getContext();
+    const res = receiver && typeof receiver.setHeader === 'function'
+      ? receiver
+      : (ctx?.res || null);
+    const req = (res && res.req) || (receiver && receiver.req) || (ctx?.req || null);
+    return { req, res };
+  }
+
+  // 4. SSR Streaming Response Helper
+  function renderStreamHelper(templatePath, context = {}, renderOptions = {}) {
+    const { res } = resolveStreamReqRes(this);
+    return renderStream(res || this, templatePath, context, {
+      env: nunjucksEnv,
+      ...renderOptions,
+    });
+  }
+
+  // 5. Server-Sent Events (SSE) Response Helper
+  function sseHelper(sourceOrOptions, maybeOptions) {
+    const { req, res } = resolveStreamReqRes(this);
+    return createSseStream(req, res, sourceOrOptions, maybeOptions);
+  }
+
+  // 6. Text and NDJSON Streaming Helpers (AI / LLM Tokens)
+  function streamTextHelper(sourceOrCallback, maybeOptions) {
+    const { req, res } = resolveStreamReqRes(this);
+    return streamText(req, res, sourceOrCallback, maybeOptions);
+  }
+
+  function streamJsonHelper(sourceOrCallback, maybeOptions) {
+    const { req, res } = resolveStreamReqRes(this);
+    return streamJson(req, res, sourceOrCallback, maybeOptions);
+  }
+
   // Async handler wrapper helper for automatic promise rejection handling
   function wrapAsync(fn) {
     if (typeof fn !== 'function') return fn;
@@ -1128,7 +1233,7 @@ function createApp(options = {}) {
         }
       }
     }
-    
+
     const helmetMw = helmet(finalConfig);
 
     // Check if configuration uses purely static directives (no per-request dynamic functions)
@@ -1243,9 +1348,6 @@ function createApp(options = {}) {
     app.set('trust proxy', false);
   }
 
-  // Ensure extended query parser for nested filter/sort query parameters (?filter[field]=val)
-  app.set('query parser', 'extended');
-  
   // Fast hardware-accelerated Weak ETag (CRC32 + Hex length) as default
   // Configurable via options.etag or options.server.etag
   const etagSetting = options.etag !== undefined
@@ -1264,11 +1366,6 @@ function createApp(options = {}) {
   const limitsOpt = options.limits ?? options.server?.limits;
   const activeLimits = setupLimitsMiddleware(app, limitsOpt);
 
-  // Cookie parser & Flash messages (AdonisJS & Django-inspired old input and errors)
-  const cookieParser = require('cookie-parser');
-  app.use(cookieParser());
-  app.use(createFlashMiddleware());
-  
   // Ensure default empty object for body on mutating requests if not populated
   // and halt processing if request has timed out (after body parsers)
   app.use((req, res, next) => {
@@ -1281,12 +1378,63 @@ function createApp(options = {}) {
     next();
   });
 
+
+  // Hardened, prototype-safe Query Parser with DoS depth & parameter limits
+  const queryParserOpt = options.queryParser ?? options.server?.queryParser;
+  if (queryParserOpt === false) {
+    app.set('query parser', false);
+  } else if (queryParserOpt === 'simple') {
+    app.set('query parser', 'simple');
+  } else if (typeof queryParserOpt === 'function') {
+    app.set('query parser', queryParserOpt);
+  } else {
+    const qs = require('qs');
+    const parserConfig = (typeof queryParserOpt === 'object' && queryParserOpt !== null) ? queryParserOpt : {};
+    const safeDepth = parserConfig.depth !== undefined ? parserConfig.depth : 5;
+    const safeParamLimit = parserConfig.parameterLimit !== undefined
+      ? parserConfig.parameterLimit
+      : (activeLimits?.parameterLimit || 1000);
+    const safeArrayLimit = parserConfig.arrayLimit !== undefined ? parserConfig.arrayLimit : 100;
+    const safeAllowDots = parserConfig.allowDots !== undefined ? Boolean(parserConfig.allowDots) : true;
+
+    app.set('query parser', function safeExtendedQueryParser(str) {
+      return qs.parse(str, {
+        depth: safeDepth,
+        parameterLimit: safeParamLimit,
+        arrayLimit: safeArrayLimit,
+        allowDots: safeAllowDots,
+        allowPrototypes: false,
+      });
+    });
+  }
+
+  // Cookie parser & Flash messages (AdonisJS & Django-inspired old input and errors)
+  const cookieSecret =
+    options.secret ||
+    options.cookieSecret ||
+    options.session?.secret ||
+    options.cookies?.secret ||
+    (typeof authManager?.getSessionConfig === 'function' ? authManager.getSessionConfig()?.secret : authManager?.config?.session?.secret) ||
+    process.env.COOKIE_SECRET ||
+    process.env.SESSION_SECRET ||
+    undefined;
+
+  const cookieParser = require('cookie-parser');
+  app.use(cookieParser(cookieSecret));
+
+  const flashConfig = typeof options.flash === 'object' ? { ...options.flash } : {};
+  if (cookieSecret && flashConfig.secret === undefined) {
+    flashConfig.secret = cookieSecret;
+  }
+  app.use(createFlashMiddleware(flashConfig));
+  
+
   // Native Health & Readiness Probes (/healthz & /readyz)
   const { setupHealthMiddleware } = require('../core/health');
   const healthOpt = options.healthCheck ?? options.server?.healthCheck;
   setupHealthMiddleware(app, healthOpt, {
     db: options.db,
-    queue: options.queue,
+    queue: queueManager || options.queue,
     shutdownManager,
   });
 
@@ -1669,6 +1817,7 @@ function createApp(options = {}) {
       pageAssets: options.pageAssets,
       serviceRegistry,
       skipExistingRoutes: routeTable,
+      isDev,
     });
     classicRouteMeta = classicMount.routeMetadata || [];
     registerDynamicFileRoutes = classicMount.registerDynamicFileRoutes || (() => {});
@@ -1677,6 +1826,18 @@ function createApp(options = {}) {
   // Combine route metadata for plugin manager
   const allRouteMeta = [...discoveredMeta, ...classicRouteMeta];
   pluginManager.setRoutes(allRouteMeta);
+
+  // The dev banner lists every mounted route: discovered routes plus classic .njk/.js page routes
+  const bannerRoutes = [];
+  const bannerRouteKeys = new Set();
+  for (const r of allRouteMeta) {
+    const method = String(r.method || 'GET').toUpperCase();
+    const routePath = r.path || r.pattern;
+    const key = `${method} ${routePath}`;
+    if (!routePath || bannerRouteKeys.has(key)) continue;
+    bannerRouteKeys.add(key);
+    bannerRoutes.push({ method, path: routePath, type: r.type === 'api' ? 'api' : 'page', source: r.file || '' });
+  }
   
   // Call onRoutesReady hook on plugins with full unified context and mount routes
   pluginManager.onRoutesReadySync({
@@ -2001,7 +2162,7 @@ function createApp(options = {}) {
         printDevBanner({
           app,
           server,
-          routeTable,
+          routeTable: bannerRoutes,
           options,
           db: options.db ?? null,
           serviceRegistry,
@@ -2019,7 +2180,7 @@ function createApp(options = {}) {
     printDevBanner({
       app,
       server: app.server,
-      routeTable,
+      routeTable: bannerRoutes,
       options,
       db: options.db ?? null,
       serviceRegistry,
@@ -2034,7 +2195,7 @@ function createApp(options = {}) {
     return formatDevBanner({
       app,
       server: app.server,
-      routeTable,
+      routeTable: bannerRoutes,
       options,
       db: options.db ?? null,
       serviceRegistry,

package/views/partials/webspresso-client-runtime.njk

@@ -1,15 +1,7 @@
-{# Served by createApp when clientRuntime.alpine / .swup are enabled. See src/client-runtime/. #}
-{% if clientRuntime and clientRuntime.alpine %}
-<style>[x-cloak] { display: none !important; }</style>
-<script defer src="/__webspresso/client-runtime/alpine.min.js"></script>
-{% endif %}
+{# Served by createApp when clientRuntime.swup is enabled. See src/client-runtime/. #}
 {% if clientRuntime and clientRuntime.swup %}
 <script defer src="/__webspresso/client-runtime/swup.umd.js"></script>
 <script defer src="/__webspresso/client-runtime/swup-head-plugin.umd.js"></script>
 <script defer src="/__webspresso/client-runtime/swup-scripts-plugin.umd.js"></script>
-{% if clientRuntime.alpine %}
-<script defer src="/__webspresso/client-runtime/bootstrap-alpine-swup.js"></script>
-{% else %}
 <script defer src="/__webspresso/client-runtime/bootstrap-swup.js"></script>
 {% endif %}
-{% endif %}