webspresso 0.0.36 → 0.0.38

package/bin/commands/admin-password.js

@@ -0,0 +1,251 @@
+/**
+ * Admin Password Command
+ * Reset admin user password via CLI
+ */
+
+const fs = require('fs');
+const path = require('path');
+const readline = require('readline');
+
+function registerCommand(program) {
+  program
+    .command('admin:password')
+    .description('Reset admin user password')
+    .option('-e, --email <email>', 'Admin user email')
+    .option('-p, --password <password>', 'New password (not recommended, use interactive mode)')
+    .option('-c, --config <path>', 'Path to database config file')
+    .action(async (options) => {
+      try {
+        // Find project root and load database
+        const cwd = process.cwd();
+        
+        // Try to find and load the database config
+        let dbConfig = null;
+        const configPaths = [
+          options.config,
+          path.join(cwd, 'webspresso.config.js'),
+          path.join(cwd, 'database.config.js'),
+          path.join(cwd, 'db.config.js'),
+        ].filter(Boolean);
+        
+        for (const configPath of configPaths) {
+          if (fs.existsSync(configPath)) {
+            const config = require(configPath);
+            dbConfig = config.database || config;
+            break;
+          }
+        }
+        
+        if (!dbConfig) {
+          console.error('❌ Error: Could not find database configuration.');
+          console.error('   Please run this command from your project root.');
+          process.exit(1);
+        }
+        
+        // Lazy load dependencies
+        const bcrypt = require('bcrypt');
+        const knex = require('knex');
+        
+        // Initialize database connection
+        const db = knex(dbConfig);
+        
+        // Check if admin_users table exists
+        const hasTable = await db.schema.hasTable('admin_users');
+        if (!hasTable) {
+          console.error('❌ Error: admin_users table does not exist.');
+          console.error('   Run "webspresso admin:setup" and "webspresso db:migrate" first.');
+          await db.destroy();
+          process.exit(1);
+        }
+        
+        // Get email (interactive if not provided)
+        let email = options.email;
+        if (!email) {
+          const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stdout,
+          });
+          
+          email = await new Promise((resolve) => {
+            rl.question('Enter admin email: ', (answer) => {
+              rl.close();
+              resolve(answer.trim());
+            });
+          });
+        }
+        
+        if (!email) {
+          console.error('❌ Error: Email is required.');
+          await db.destroy();
+          process.exit(1);
+        }
+        
+        // Check if user exists
+        const user = await db('admin_users').where({ email }).first();
+        if (!user) {
+          console.error(`❌ Error: Admin user with email "${email}" not found.`);
+          
+          // Show available users
+          const users = await db('admin_users').select('id', 'email', 'name');
+          if (users.length > 0) {
+            console.log('\nAvailable admin users:');
+            users.forEach(u => console.log(`   - ${u.email} (${u.name || 'No name'})`));
+          }
+          
+          await db.destroy();
+          process.exit(1);
+        }
+        
+        // Get new password (interactive if not provided)
+        let password = options.password;
+        if (!password) {
+          const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stdout,
+          });
+          
+          // Disable echo for password input
+          if (process.stdin.isTTY) {
+            process.stdout.write('Enter new password: ');
+            password = await new Promise((resolve) => {
+              let pwd = '';
+              process.stdin.setRawMode(true);
+              process.stdin.resume();
+              process.stdin.on('data', (char) => {
+                char = char.toString();
+                if (char === '\n' || char === '\r') {
+                  process.stdin.setRawMode(false);
+                  process.stdin.pause();
+                  console.log(); // New line after password
+                  resolve(pwd);
+                } else if (char === '\u0003') {
+                  // Ctrl+C
+                  process.exit();
+                } else if (char === '\u007F') {
+                  // Backspace
+                  if (pwd.length > 0) {
+                    pwd = pwd.slice(0, -1);
+                    process.stdout.write('\b \b');
+                  }
+                } else {
+                  pwd += char;
+                  process.stdout.write('*');
+                }
+              });
+            });
+            rl.close();
+          } else {
+            password = await new Promise((resolve) => {
+              rl.question('Enter new password: ', (answer) => {
+                rl.close();
+                resolve(answer);
+              });
+            });
+          }
+        }
+        
+        if (!password || password.length < 6) {
+          console.error('❌ Error: Password must be at least 6 characters.');
+          await db.destroy();
+          process.exit(1);
+        }
+        
+        // Hash the password
+        const hashedPassword = await bcrypt.hash(password, 10);
+        
+        // Update the password
+        await db('admin_users')
+          .where({ email })
+          .update({
+            password: hashedPassword,
+            updated_at: new Date(),
+          });
+        
+        console.log(`\n✅ Password updated successfully for: ${email}\n`);
+        
+        await db.destroy();
+      } catch (err) {
+        console.error('❌ Error:', err.message);
+        process.exit(1);
+      }
+    });
+    
+  // Also add a command to list admin users
+  program
+    .command('admin:list')
+    .description('List all admin users')
+    .option('-c, --config <path>', 'Path to database config file')
+    .action(async (options) => {
+      try {
+        const cwd = process.cwd();
+        
+        // Try to find and load the database config
+        let dbConfig = null;
+        const configPaths = [
+          options.config,
+          path.join(cwd, 'webspresso.config.js'),
+          path.join(cwd, 'database.config.js'),
+          path.join(cwd, 'db.config.js'),
+        ].filter(Boolean);
+        
+        for (const configPath of configPaths) {
+          if (fs.existsSync(configPath)) {
+            const config = require(configPath);
+            dbConfig = config.database || config;
+            break;
+          }
+        }
+        
+        if (!dbConfig) {
+          console.error('❌ Error: Could not find database configuration.');
+          process.exit(1);
+        }
+        
+        const knex = require('knex');
+        const db = knex(dbConfig);
+        
+        // Check if admin_users table exists
+        const hasTable = await db.schema.hasTable('admin_users');
+        if (!hasTable) {
+          console.log('ℹ️  admin_users table does not exist yet.');
+          console.log('   Run "webspresso admin:setup" and "webspresso db:migrate" first.');
+          await db.destroy();
+          return;
+        }
+        
+        // Get all admin users
+        const users = await db('admin_users')
+          .select('id', 'email', 'name', 'role', 'active', 'created_at')
+          .orderBy('id');
+        
+        if (users.length === 0) {
+          console.log('\nNo admin users found.\n');
+          console.log('Create the first admin user via the admin panel setup page.');
+        } else {
+          console.log(`\n📋 Admin Users (${users.length}):\n`);
+          console.log('  ID  | Email                          | Name           | Role    | Active | Created');
+          console.log('  ' + '-'.repeat(90));
+          
+          users.forEach(user => {
+            const email = (user.email || '').padEnd(30).slice(0, 30);
+            const name = (user.name || '-').padEnd(14).slice(0, 14);
+            const role = (user.role || 'admin').padEnd(7).slice(0, 7);
+            const active = user.active ? '  ✓   ' : '  ✗   ';
+            const created = user.created_at 
+              ? new Date(user.created_at).toLocaleDateString()
+              : '-';
+            
+            console.log(`  ${String(user.id).padStart(3)} | ${email} | ${name} | ${role} | ${active} | ${created}`);
+          });
+          console.log();
+        }
+        
+        await db.destroy();
+      } catch (err) {
+        console.error('❌ Error:', err.message);
+        process.exit(1);
+      }
+    });
+}
+
+module.exports = { registerCommand };

package/bin/webspresso.js

@@ -25,6 +25,7 @@ const { registerCommand: registerDbStatus } = require('./commands/db-status');
 const { registerCommand: registerDbMake } = require('./commands/db-make');
 const { registerCommand: registerSeed } = require('./commands/seed');
 const { registerCommand: registerAdminSetup } = require('./commands/admin-setup');
+const { registerCommand: registerAdminPassword } = require('./commands/admin-password');
 
 registerNew(program);
 registerPage(program);
@@ -38,6 +39,7 @@ registerDbStatus(program);
 registerDbMake(program);
 registerSeed(program);
 registerAdminSetup(program);
+registerAdminPassword(program);
 
 // Parse arguments
 program.parse();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.36",
+  "version": "0.0.38",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "bin": {

package/plugins/admin-panel/app.js

@@ -75,6 +75,16 @@ m.route(document.getElementById('app'), '/', {
       return SetupForm;
     }
   },
+  '/settings': {
+    onmatch: async () => {
+      const isAuth = await checkAuth();
+      if (!isAuth) {
+        m.route.set('/login');
+        return;
+      }
+      return SettingsPage;
+    }
+  },
   '/models/:model': {
     onmatch: async () => {
       const isAuth = await checkAuth();

package/plugins/admin-panel/components.js

@@ -68,6 +68,9 @@ const state = {
   filters: {}, // Active filters { column: { op, value, from, to } }
   filterPanelOpen: false, // Filter panel visibility (deprecated)
   filterDrawerOpen: false, // Filter drawer visibility
+  bulkFields: [], // Bulk-updatable fields (enum/boolean)
+  bulkFieldDropdownOpen: false, // Bulk field dropdown visibility
+  selectedBulkField: null, // Currently selected bulk field for update
 };
 
 // Breadcrumb Component
@@ -1303,6 +1306,152 @@ function formatCellValue(value, col) {
   }
 }
 
+// Load bulk-updatable fields for a model
+async function loadBulkFields(modelName) {
+  try {
+    const response = await api.get('/extensions/bulk-fields/' + modelName);
+    state.bulkFields = response.fields || [];
+    m.redraw();
+  } catch (err) {
+    console.error('Failed to load bulk fields:', err);
+    state.bulkFields = [];
+  }
+}
+
+// Execute bulk field update
+async function executeBulkFieldUpdate(modelName, field, value, ids) {
+  try {
+    const response = await api.post('/extensions/bulk-update/' + modelName, {
+      ids: ids,
+      field: field,
+      value: value,
+    });
+    return response;
+  } catch (err) {
+    throw err;
+  }
+}
+
+// Bulk Field Update Dropdown Component
+const BulkFieldUpdateDropdown = {
+  view: (vnode) => {
+    const { modelName, selectedIds, onComplete } = vnode.attrs;
+    
+    if (!state.bulkFields || state.bulkFields.length === 0) {
+      return null;
+    }
+    
+    return m('.relative.inline-block', [
+      // Dropdown trigger
+      m('button.inline-flex.items-center.gap-1.px-3.py-1.5.text-sm.font-medium.text-purple-600.bg-white.border.border-purple-200.rounded.hover:bg-purple-50.transition-colors', {
+        disabled: state.bulkActionInProgress,
+        onclick: (e) => {
+          e.stopPropagation();
+          state.bulkFieldDropdownOpen = !state.bulkFieldDropdownOpen;
+          state.selectedBulkField = null;
+          m.redraw();
+        },
+      }, [
+        m('svg.w-4.h-4', { fill: 'none', viewBox: '0 0 24 24', stroke: 'currentColor' },
+          m('path', { 'stroke-linecap': 'round', 'stroke-linejoin': 'round', 'stroke-width': '2', d: 'M11 5H6a2 2 0 00-2 2v11a2 2 0 002 2h11a2 2 0 002-2v-5m-1.414-9.414a2 2 0 112.828 2.828L11.828 15H9v-2.828l8.586-8.586z' })
+        ),
+        'Set Field',
+        m('svg.w-4.h-4.ml-1', { fill: 'none', viewBox: '0 0 24 24', stroke: 'currentColor' },
+          m('path', { 'stroke-linecap': 'round', 'stroke-linejoin': 'round', 'stroke-width': '2', d: 'M19 9l-7 7-7-7' })
+        ),
+      ]),
+      
+      // Dropdown menu
+      state.bulkFieldDropdownOpen && m('.absolute.z-50.mt-1.w-64.bg-white.rounded-lg.shadow-lg.border.border-gray-200.overflow-hidden', {
+        style: 'left: 0; top: 100%;',
+        onclick: (e) => e.stopPropagation(),
+      }, [
+        // Close button area click handler
+        m('.fixed.inset-0.z-40', {
+          onclick: () => {
+            state.bulkFieldDropdownOpen = false;
+            state.selectedBulkField = null;
+            m.redraw();
+          },
+        }),
+        
+        // Dropdown content
+        m('.relative.z-50.bg-white', [
+          // Header
+          m('.px-3.py-2.bg-gray-50.border-b.border-gray-200', [
+            m('span.text-xs.font-medium.text-gray-500.uppercase.tracking-wider', 
+              state.selectedBulkField ? 'Select Value' : 'Select Field'
+            ),
+          ]),
+          
+          // Field list or value list
+          m('.max-h-64.overflow-y-auto', [
+            state.selectedBulkField 
+              // Show values for selected field
+              ? state.selectedBulkField.options.map(option => 
+                  m('button.w-full.px-3.py-2.text-left.text-sm.hover:bg-purple-50.flex.items-center.justify-between.transition-colors', {
+                    onclick: async () => {
+                      state.bulkActionInProgress = true;
+                      state.bulkFieldDropdownOpen = false;
+                      m.redraw();
+                      
+                      try {
+                        await executeBulkFieldUpdate(modelName, state.selectedBulkField.name, option.value, selectedIds);
+                        state.selectedBulkField = null;
+                        if (onComplete) onComplete();
+                      } catch (err) {
+                        alert('Error: ' + err.message);
+                      } finally {
+                        state.bulkActionInProgress = false;
+                        m.redraw();
+                      }
+                    },
+                  }, [
+                    m('span.text-gray-700', String(option.label)),
+                    state.selectedBulkField.type === 'boolean' && m('span.ml-2', 
+                      option.value === true 
+                        ? m('span.inline-flex.items-center.px-2.py-0.5.rounded-full.text-xs.font-medium.bg-green-100.text-green-800', '✓')
+                        : m('span.inline-flex.items-center.px-2.py-0.5.rounded-full.text-xs.font-medium.bg-gray-100.text-gray-600', '✗')
+                    ),
+                  ])
+                )
+              // Show field list
+              : state.bulkFields.map(field =>
+                  m('button.w-full.px-3.py-2.text-left.text-sm.hover:bg-purple-50.flex.items-center.justify-between.transition-colors', {
+                    onclick: () => {
+                      state.selectedBulkField = field;
+                      m.redraw();
+                    },
+                  }, [
+                    m('.flex.items-center.gap-2', [
+                      m('span.text-gray-700', formatColumnLabel(field.label || field.name)),
+                      m('span.text-xs.text-gray-400.uppercase', field.type),
+                    ]),
+                    m('svg.w-4.h-4.text-gray-400', { fill: 'none', viewBox: '0 0 24 24', stroke: 'currentColor' },
+                      m('path', { 'stroke-linecap': 'round', 'stroke-linejoin': 'round', 'stroke-width': '2', d: 'M9 5l7 7-7 7' })
+                    ),
+                  ])
+                ),
+            
+            // Back button when viewing values
+            state.selectedBulkField && m('button.w-full.px-3.py-2.text-left.text-sm.text-gray-500.hover:bg-gray-50.border-t.border-gray-100.flex.items-center.gap-1', {
+              onclick: () => {
+                state.selectedBulkField = null;
+                m.redraw();
+              },
+            }, [
+              m('svg.w-4.h-4', { fill: 'none', viewBox: '0 0 24 24', stroke: 'currentColor' },
+                m('path', { 'stroke-linecap': 'round', 'stroke-linejoin': 'round', 'stroke-width': '2', d: 'M15 19l-7-7 7-7' })
+              ),
+              'Back to fields',
+            ]),
+          ]),
+        ]),
+      ]),
+    ]);
+  },
+};
+
 // Get columns to display in table (limit to reasonable number)
 function getDisplayColumns(columns) {
   if (!columns || columns.length === 0) return [];
@@ -1454,34 +1603,55 @@ function loadRecords(modelName, page = 1, filters = null) {
     });
 }
 
+// Initialize model data
+function initializeModelView(modelName) {
+  state.records = [];
+  state.currentModelMeta = null;
+  state.pagination = { page: 1, perPage: 20, total: 0, totalPages: 0 };
+  state.filterPanelOpen = false;
+  state.filterDrawerOpen = false;
+  state.selectedRecords = new Set(); // Bulk selection
+  state.bulkActionInProgress = false;
+  state.bulkFields = []; // Reset bulk fields
+  state.bulkFieldDropdownOpen = false;
+  state.selectedBulkField = null;
+  state._currentModelName = modelName;
+  
+  // Parse filters from URL query string
+  const urlParams = new URLSearchParams(window.location.search);
+  const page = parseInt(urlParams.get('page')) || 1;
+  state.filters = parseFilterQuery(window.location.search);
+  
+  // Load model metadata first, then records
+  state.loading = true;
+  api.get('/models/' + modelName)
+    .then(modelMeta => {
+      state.currentModelMeta = modelMeta;
+      state.currentModel = modelMeta;
+      // Load bulk-updatable fields for this model
+      loadBulkFields(modelName);
+      return loadRecords(modelName, page, state.filters);
+    })
+    .catch(err => {
+      state.error = err.message;
+      state.loading = false;
+      m.redraw();
+    });
+}
+
 // Record List Component - displays records with dynamic columns
 const RecordList = {
   oninit: () => {
     const modelName = m.route.param('model');
-    state.records = [];
-    state.currentModelMeta = null;
-    state.pagination = { page: 1, perPage: 20, total: 0, totalPages: 0 };
-    state.filterPanelOpen = false;
-    state.filterDrawerOpen = false;
-    
-    // Parse filters from URL query string
-    const urlParams = new URLSearchParams(window.location.search);
-    const page = parseInt(urlParams.get('page')) || 1;
-    state.filters = parseFilterQuery(window.location.search);
-    
-    // Load model metadata first, then records
-    state.loading = true;
-    api.get('/models/' + modelName)
-      .then(modelMeta => {
-        state.currentModelMeta = modelMeta;
-        state.currentModel = modelMeta;
-        return loadRecords(modelName, page, state.filters);
-      })
-      .catch(err => {
-        state.error = err.message;
-        state.loading = false;
-        m.redraw();
-      });
+    initializeModelView(modelName);
+  },
+  onbeforeupdate: () => {
+    // Check if model changed (navigation between different models)
+    const modelName = m.route.param('model');
+    if (state._currentModelName !== modelName) {
+      initializeModelView(modelName);
+    }
+    return true;
   },
   view: () => {
     const modelName = m.route.param('model');
@@ -1601,12 +1771,134 @@ const RecordList = {
               m('p.text-gray-500', activeFilterCount > 0 ? 'Try adjusting your filters' : 'Get started by creating your first record'),
             ])
           : m('.bg-white.rounded-lg.shadow-sm.border.border-gray-200.overflow-hidden', [
+            // Bulk Actions Toolbar (shown when items selected)
+            state.selectedRecords && state.selectedRecords.size > 0 && m('.bg-indigo-50.border-b.border-indigo-100.px-4.py-3.flex.items-center.justify-between', [
+              m('span.text-sm.text-indigo-700.font-medium', 
+                state.selectedRecords.size + ' record' + (state.selectedRecords.size > 1 ? 's' : '') + ' selected'
+              ),
+              m('.flex.items-center.gap-2', [
+                m('button.inline-flex.items-center.gap-1.px-3.py-1.5.text-sm.font-medium.text-red-600.bg-white.border.border-red-200.rounded.hover:bg-red-50.transition-colors', {
+                  disabled: state.bulkActionInProgress,
+                  onclick: async () => {
+                    if (!confirm('Are you sure you want to delete ' + state.selectedRecords.size + ' records? This action cannot be undone.')) return;
+                    state.bulkActionInProgress = true;
+                    m.redraw();
+                    try {
+                      const ids = Array.from(state.selectedRecords);
+                      await api.post('/extensions/bulk-actions/bulk-delete/' + modelName, { ids });
+                      state.selectedRecords = new Set();
+                      loadRecords(modelName, state.pagination.page);
+                    } catch (err) {
+                      alert('Error: ' + err.message);
+                    } finally {
+                      state.bulkActionInProgress = false;
+                      m.redraw();
+                    }
+                  },
+                }, [
+                  m('svg.w-4.h-4', { fill: 'none', viewBox: '0 0 24 24', stroke: 'currentColor' },
+                    m('path', { 'stroke-linecap': 'round', 'stroke-linejoin': 'round', 'stroke-width': '2', d: 'M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16' })
+                  ),
+                  'Delete',
+                ]),
+                m('button.inline-flex.items-center.gap-1.px-3.py-1.5.text-sm.font-medium.text-blue-600.bg-white.border.border-blue-200.rounded.hover:bg-blue-50.transition-colors', {
+                  disabled: state.bulkActionInProgress,
+                  onclick: async () => {
+                    state.bulkActionInProgress = true;
+                    m.redraw();
+                    try {
+                      const ids = Array.from(state.selectedRecords);
+                      const response = await api.post('/extensions/export?model=' + modelName + '&format=json', { ids });
+                      // Download as file
+                      const blob = new Blob([JSON.stringify(response.data, null, 2)], { type: 'application/json' });
+                      const url = URL.createObjectURL(blob);
+                      const a = document.createElement('a');
+                      a.href = url;
+                      a.download = modelName + '-export.json';
+                      a.click();
+                      URL.revokeObjectURL(url);
+                    } catch (err) {
+                      alert('Error: ' + err.message);
+                    } finally {
+                      state.bulkActionInProgress = false;
+                      m.redraw();
+                    }
+                  },
+                }, [
+                  m('svg.w-4.h-4', { fill: 'none', viewBox: '0 0 24 24', stroke: 'currentColor' },
+                    m('path', { 'stroke-linecap': 'round', 'stroke-linejoin': 'round', 'stroke-width': '2', d: 'M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4' })
+                  ),
+                  'Export JSON',
+                ]),
+                m('button.inline-flex.items-center.gap-1.px-3.py-1.5.text-sm.font-medium.text-green-600.bg-white.border.border-green-200.rounded.hover:bg-green-50.transition-colors', {
+                  disabled: state.bulkActionInProgress,
+                  onclick: async () => {
+                    state.bulkActionInProgress = true;
+                    m.redraw();
+                    try {
+                      const ids = Array.from(state.selectedRecords);
+                      const response = await api.post('/extensions/export?model=' + modelName + '&format=csv', { ids });
+                      // Download as file
+                      const blob = new Blob([response.data], { type: 'text/csv' });
+                      const url = URL.createObjectURL(blob);
+                      const a = document.createElement('a');
+                      a.href = url;
+                      a.download = modelName + '-export.csv';
+                      a.click();
+                      URL.revokeObjectURL(url);
+                    } catch (err) {
+                      alert('Error: ' + err.message);
+                    } finally {
+                      state.bulkActionInProgress = false;
+                      m.redraw();
+                    }
+                  },
+                }, [
+                  m('svg.w-4.h-4', { fill: 'none', viewBox: '0 0 24 24', stroke: 'currentColor' },
+                    m('path', { 'stroke-linecap': 'round', 'stroke-linejoin': 'round', 'stroke-width': '2', d: 'M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4' })
+                  ),
+                  'Export CSV',
+                ]),
+                // Bulk Field Update Dropdown
+                m(BulkFieldUpdateDropdown, {
+                  modelName: modelName,
+                  selectedIds: Array.from(state.selectedRecords),
+                  onComplete: () => {
+                    state.selectedRecords = new Set();
+                    loadRecords(modelName, state.pagination.page);
+                  },
+                }),
+                m('button.px-3.py-1.5.text-sm.text-gray-500.hover:text-gray-700', {
+                  onclick: () => {
+                    state.selectedRecords = new Set();
+                    state.bulkFieldDropdownOpen = false;
+                    state.selectedBulkField = null;
+                    m.redraw();
+                  },
+                }, 'Clear'),
+              ]),
+            ]),
             // Table container with sticky header and actions
             m('.overflow-x-auto.max-h-[calc(100vh-380px)]', { style: 'position: relative;' }, [
               m('table.w-full.border-collapse', { style: 'min-width: 100%;' }, [
                 // Sticky header
                 m('thead.bg-gray-50', { style: 'position: sticky; top: 0; z-index: 10;' }, [
                   m('tr', [
+                    // Checkbox column header
+                    m('th.px-4.py-3.text-left.bg-gray-50.border-b.border-gray-200', { style: 'width: 40px;' }, [
+                      m('input[type=checkbox].rounded.border-gray-300.text-indigo-600.focus:ring-indigo-500', {
+                        checked: state.records.length > 0 && state.selectedRecords && state.selectedRecords.size === state.records.length,
+                        indeterminate: state.selectedRecords && state.selectedRecords.size > 0 && state.selectedRecords.size < state.records.length,
+                        onchange: (e) => {
+                          if (e.target.checked) {
+                            state.selectedRecords = new Set(state.records.map(r => r[primaryKey]));
+                          } else {
+                            state.selectedRecords = new Set();
+                          }
+                          m.redraw();
+                        },
+                      }),
+                    ]),
                     // Dynamic column headers
                     ...displayColumns.map(col => 
                       m('th.px-4.py-3.text-left.text-xs.font-medium.text-gray-500.uppercase.tracking-wider.whitespace-nowrap.bg-gray-50.border-b.border-gray-200', 
@@ -1620,7 +1912,24 @@ const RecordList = {
                   ]),
                 ]),
                 m('tbody.divide-y.divide-gray-100', state.records.map(record => 
-                  m('tr.hover:bg-gray-50.transition-colors', [
+                  m('tr.hover:bg-gray-50.transition-colors', {
+                    class: state.selectedRecords && state.selectedRecords.has(record[primaryKey]) ? 'bg-indigo-50' : '',
+                  }, [
+                    // Checkbox cell
+                    m('td.px-4.py-3', [
+                      m('input[type=checkbox].rounded.border-gray-300.text-indigo-600.focus:ring-indigo-500', {
+                        checked: state.selectedRecords && state.selectedRecords.has(record[primaryKey]),
+                        onchange: (e) => {
+                          if (!state.selectedRecords) state.selectedRecords = new Set();
+                          if (e.target.checked) {
+                            state.selectedRecords.add(record[primaryKey]);
+                          } else {
+                            state.selectedRecords.delete(record[primaryKey]);
+                          }
+                          m.redraw();
+                        },
+                      }),
+                    ]),
                     // Dynamic cell values
                     ...displayColumns.map(col => 
                       m('td.px-4.py-3.text-sm.whitespace-nowrap.text-gray-700', 

package/plugins/admin-panel/core/api-extensions.js

@@ -151,6 +151,131 @@ function createExtensionApiHandlers(options) {
     }
   }
 
+  /**
+   * Bulk update field values (for enum/boolean fields)
+   */
+  async function bulkUpdateFieldHandler(req, res) {
+    try {
+      const { model: modelName } = req.params;
+      const { ids, field, value } = req.body;
+
+      if (!ids || !Array.isArray(ids) || ids.length === 0) {
+        return res.status(400).json({ error: 'No records selected' });
+      }
+
+      if (!field) {
+        return res.status(400).json({ error: 'Field name is required' });
+      }
+
+      const { getModel } = require('../../../core/orm/model');
+      const model = db.getModel ? db.getModel(modelName) : getModel(modelName);
+
+      if (!model || !model.admin?.enabled) {
+        return res.status(404).json({ error: 'Model not found or not enabled' });
+      }
+
+      // Get field metadata
+      const column = model.columns.get(field);
+      if (!column) {
+        return res.status(400).json({ error: `Field "${field}" not found in model` });
+      }
+
+      // Validate field type - only allow enum and boolean
+      const columnMeta = column._meta || {};
+      const isEnum = columnMeta.enum && Array.isArray(columnMeta.enum);
+      const isBoolean = columnMeta.type === 'boolean' || column._def?.typeName === 'ZodBoolean';
+
+      if (!isEnum && !isBoolean) {
+        return res.status(400).json({ error: `Field "${field}" is not an enum or boolean type` });
+      }
+
+      // Validate value for enum fields
+      if (isEnum && !columnMeta.enum.includes(value)) {
+        return res.status(400).json({ error: `Invalid value "${value}" for enum field "${field}"` });
+      }
+
+      // Coerce boolean value
+      let updateValue = value;
+      if (isBoolean) {
+        updateValue = value === true || value === 'true' || value === 1 || value === '1';
+      }
+
+      // Perform bulk update
+      const repo = db.getRepository(modelName);
+      let updated = 0;
+
+      for (const id of ids) {
+        try {
+          await repo.update(id, { [field]: updateValue });
+          updated++;
+        } catch (e) {
+          console.error(`Failed to update record ${id}:`, e.message);
+        }
+      }
+
+      res.json({
+        success: true,
+        result: {
+          message: `${updated} of ${ids.length} records updated`,
+          updated,
+          field,
+          value: updateValue,
+        },
+        affected: updated,
+      });
+    } catch (error) {
+      console.error('Bulk update field error:', error);
+      res.status(500).json({ error: error.message });
+    }
+  }
+
+  /**
+   * Get bulk-updatable fields for a model (enum and boolean fields)
+   */
+  function bulkFieldsHandler(req, res) {
+    try {
+      const { model: modelName } = req.params;
+
+      const { getModel } = require('../../../core/orm/model');
+      const model = db.getModel ? db.getModel(modelName) : getModel(modelName);
+
+      if (!model || !model.admin?.enabled) {
+        return res.status(404).json({ error: 'Model not found or not enabled' });
+      }
+
+      const bulkFields = [];
+
+      for (const [fieldName, column] of model.columns.entries()) {
+        const columnMeta = column._meta || {};
+        const isEnum = columnMeta.enum && Array.isArray(columnMeta.enum);
+        const isBoolean = columnMeta.type === 'boolean' || column._def?.typeName === 'ZodBoolean';
+
+        if (isEnum) {
+          bulkFields.push({
+            name: fieldName,
+            type: 'enum',
+            label: columnMeta.label || fieldName,
+            options: columnMeta.enum.map(v => ({ value: v, label: v })),
+          });
+        } else if (isBoolean) {
+          bulkFields.push({
+            name: fieldName,
+            type: 'boolean',
+            label: columnMeta.label || fieldName,
+            options: [
+              { value: true, label: 'True' },
+              { value: false, label: 'False' },
+            ],
+          });
+        }
+      }
+
+      res.json({ fields: bulkFields });
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  }
+
   /**
    * Dashboard stats
    */
@@ -188,11 +313,25 @@ function createExtensionApiHandlers(options) {
 
   /**
    * Export records (CSV/JSON)
+   * Supports both GET (with ids in query) and POST (with ids in body)
    */
   async function exportHandler(req, res) {
     try {
-      const { model: modelName } = req.params;
-      const { format = 'json', ids } = req.query;
+      // Support both path param and query param for model name
+      const modelName = req.params.model || req.query.model;
+      const format = req.query.format || 'json';
+      
+      // Support IDs from query string (GET) or body (POST)
+      let idList = null;
+      if (req.body?.ids && Array.isArray(req.body.ids)) {
+        idList = req.body.ids;
+      } else if (req.query.ids) {
+        idList = req.query.ids.split(',');
+      }
+      
+      if (!modelName) {
+        return res.status(400).json({ error: 'Model name is required' });
+      }
       
       const { getModel } = require('../../../core/orm/model');
       const model = db.getModel ? db.getModel(modelName) : getModel(modelName);
@@ -205,8 +344,7 @@ function createExtensionApiHandlers(options) {
       let records;
 
       // If specific IDs provided, fetch those
-      if (ids) {
-        const idList = ids.split(',');
+      if (idList && idList.length > 0) {
         records = [];
         for (const id of idList) {
           const record = await repo.findById(id);
@@ -224,23 +362,26 @@ function createExtensionApiHandlers(options) {
           return columns.map(col => {
             const val = record[col];
             if (val === null || val === undefined) return '';
-            if (typeof val === 'string' && (val.includes(',') || val.includes('"'))) {
+            if (typeof val === 'string' && (val.includes(',') || val.includes('"') || val.includes('\n'))) {
               return `"${val.replace(/"/g, '""')}"`;
             }
+            if (typeof val === 'object') {
+              return `"${JSON.stringify(val).replace(/"/g, '""')}"`;
+            }
             return String(val);
           }).join(',');
         });
 
+        const csvContent = [header, ...rows].join('\n');
         res.setHeader('Content-Type', 'text/csv');
         res.setHeader('Content-Disposition', `attachment; filename="${modelName}_export.csv"`);
-        res.send([header, ...rows].join('\n'));
+        res.json({ data: csvContent, format: 'csv' });
       } else {
         // JSON export
-        res.setHeader('Content-Type', 'application/json');
-        res.setHeader('Content-Disposition', `attachment; filename="${modelName}_export.json"`);
         res.json({ data: records, model: modelName, exportedAt: new Date().toISOString() });
       }
     } catch (error) {
+      console.error('Export error:', error);
       res.status(500).json({ error: error.message });
     }
   }
@@ -284,6 +425,8 @@ function createExtensionApiHandlers(options) {
     widgetDataHandler,
     actionHandler,
     bulkActionHandler,
+    bulkUpdateFieldHandler,
+    bulkFieldsHandler,
     dashboardStatsHandler,
     exportHandler,
     activityLogHandler,

package/plugins/admin-panel/index.js

@@ -177,7 +177,12 @@ function adminPanelPlugin(options = {}) {
       ctx.addRoute('get', `${adminPath}/api/extensions/dashboard/stats`, requireAuth, extensionHandlers.dashboardStatsHandler);
       ctx.addRoute('post', `${adminPath}/api/extensions/actions/:actionId/:model/:id`, requireAuth, extensionHandlers.actionHandler);
       ctx.addRoute('post', `${adminPath}/api/extensions/bulk-actions/:actionId/:model`, requireAuth, extensionHandlers.bulkActionHandler);
+      ctx.addRoute('get', `${adminPath}/api/extensions/bulk-fields/:model`, requireAuth, extensionHandlers.bulkFieldsHandler);
+      ctx.addRoute('post', `${adminPath}/api/extensions/bulk-update/:model`, requireAuth, extensionHandlers.bulkUpdateFieldHandler);
       ctx.addRoute('get', `${adminPath}/api/extensions/export/:model`, requireAuth, extensionHandlers.exportHandler);
+      ctx.addRoute('get', `${adminPath}/api/extensions/export`, requireAuth, extensionHandlers.exportHandler);
+      ctx.addRoute('post', `${adminPath}/api/extensions/export/:model`, requireAuth, extensionHandlers.exportHandler);
+      ctx.addRoute('post', `${adminPath}/api/extensions/export`, requireAuth, extensionHandlers.exportHandler);
       ctx.addRoute('get', `${adminPath}/api/extensions/activity`, requireAuth, extensionHandlers.activityLogHandler);
 
       // Custom pages API routes