webspresso 0.0.39 → 0.0.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.39",
+  "version": "0.0.41",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "bin": {

package/plugins/admin-panel/core/api-extensions.js

@@ -263,23 +263,23 @@ function createExtensionApiHandlers(options) {
         return res.status(404).json({ error: 'Model not found or not enabled' });
       }
 
-      // Get field metadata
-      const column = model.columns.get(field);
-      if (!column) {
+      // Get field metadata - model.columns is Map<string, ColumnMeta>
+      const columnMeta = model.columns.get(field);
+      if (!columnMeta) {
         return res.status(400).json({ error: `Field "${field}" not found in model` });
       }
 
       // Validate field type - only allow enum and boolean
-      const columnMeta = column._meta || {};
-      const isEnum = columnMeta.enum && Array.isArray(columnMeta.enum);
-      const isBoolean = columnMeta.type === 'boolean' || column._def?.typeName === 'ZodBoolean';
+      const enumValues = columnMeta.enumValues || columnMeta.enum;
+      const isEnum = enumValues && Array.isArray(enumValues);
+      const isBoolean = columnMeta.type === 'boolean';
 
       if (!isEnum && !isBoolean) {
         return res.status(400).json({ error: `Field "${field}" is not an enum or boolean type` });
       }
 
       // Validate value for enum fields
-      if (isEnum && !columnMeta.enum.includes(value)) {
+      if (isEnum && !enumValues.includes(value)) {
         return res.status(400).json({ error: `Invalid value "${value}" for enum field "${field}"` });
       }
 
@@ -352,17 +352,19 @@ function createExtensionApiHandlers(options) {
 
       const bulkFields = [];
 
-      for (const [fieldName, column] of model.columns.entries()) {
-        const columnMeta = column._meta || {};
-        const isEnum = columnMeta.enum && Array.isArray(columnMeta.enum);
-        const isBoolean = columnMeta.type === 'boolean' || column._def?.typeName === 'ZodBoolean';
+      // model.columns is a Map<string, ColumnMeta> - values are already metadata objects
+      for (const [fieldName, columnMeta] of model.columns.entries()) {
+        // Check for enum - schema uses 'enumValues' property
+        const enumValues = columnMeta.enumValues || columnMeta.enum;
+        const isEnum = enumValues && Array.isArray(enumValues);
+        const isBoolean = columnMeta.type === 'boolean';
 
         if (isEnum) {
           bulkFields.push({
             name: fieldName,
             type: 'enum',
             label: columnMeta.label || fieldName,
-            options: columnMeta.enum.map(v => ({ value: v, label: v })),
+            options: enumValues.map(v => ({ value: v, label: v })),
           });
         } else if (isBoolean) {
           bulkFields.push({

package/plugins/admin-panel/index.js

@@ -58,6 +58,12 @@ function adminPanelPlugin(options = {}) {
     name: 'admin-panel',
     version: '2.0.0',
     description: 'Modular admin panel for Webspresso with extensions support',
+    
+    // CSP requirements for Quill.js rich text editor
+    csp: {
+      styleSrc: ['https://cdn.quilljs.com'],
+      scriptSrc: ['https://cdn.quilljs.com'],
+    },
     enabled,
     registry, // Expose registry for external configuration
 

package/src/plugin-manager.js

@@ -122,6 +122,7 @@ class PluginManager {
     this.registeredFilters = new Map(); // name -> filter function
     this.routes = [];                   // Collected route metadata
     this.customRoutes = [];             // Routes added by plugins
+    this.cspDirectives = new Map();     // directive -> Set of sources (from plugins)
     this.app = null;
     this.nunjucksEnv = null;
   }
@@ -263,6 +264,11 @@ class PluginManager {
       this.pluginAPIs.set(plugin.name, boundAPI);
     }
 
+    // Collect CSP requirements from plugin
+    if (plugin.csp) {
+      this._collectCspDirectives(plugin.csp);
+    }
+
     // Call register hook
     if (typeof plugin.register === 'function') {
       await plugin.register(ctx);
@@ -295,6 +301,11 @@ class PluginManager {
       this.pluginAPIs.set(plugin.name, boundAPI);
     }
 
+    // Collect CSP requirements from plugin
+    if (plugin.csp) {
+      this._collectCspDirectives(plugin.csp);
+    }
+
     // Call register hook (sync - if plugin has async register, it won't wait)
     if (typeof plugin.register === 'function') {
       plugin.register(ctx);
@@ -436,6 +447,35 @@ class PluginManager {
     }
   }
 
+  /**
+   * Collect CSP directives from a plugin
+   * @param {Object} csp - CSP directives object { styleSrc: [...], scriptSrc: [...], ... }
+   */
+  _collectCspDirectives(csp) {
+    for (const [directive, sources] of Object.entries(csp)) {
+      if (!this.cspDirectives.has(directive)) {
+        this.cspDirectives.set(directive, new Set());
+      }
+      const directiveSet = this.cspDirectives.get(directive);
+      const sourceArray = Array.isArray(sources) ? sources : [sources];
+      for (const source of sourceArray) {
+        directiveSet.add(source);
+      }
+    }
+  }
+
+  /**
+   * Get merged CSP directives from all plugins
+   * @returns {Object} CSP directives object to merge with helmet config
+   */
+  getCspDirectives() {
+    const directives = {};
+    for (const [directive, sources] of this.cspDirectives) {
+      directives[directive] = Array.from(sources);
+    }
+    return directives;
+  }
+
   /**
    * Get all registered helpers (to be merged with fsy)
    */

package/src/server.js

@@ -203,10 +203,45 @@ function createApp(options = {}) {
   // Security headers with Helmet
   if (helmetConfig !== false) {
     const defaultConfig = getDefaultHelmetConfig(isDev);
-    const finalConfig = helmetConfig === undefined || helmetConfig === true
+    let finalConfig = helmetConfig === undefined || helmetConfig === true
       ? defaultConfig
       : { ...defaultConfig, ...helmetConfig };
     
+    // Collect CSP requirements from plugins (before they're fully registered)
+    if (plugins && Array.isArray(plugins) && finalConfig.contentSecurityPolicy) {
+      const pluginCspSources = {
+        styleSrc: new Set(),
+        scriptSrc: new Set(),
+        imgSrc: new Set(),
+        fontSrc: new Set(),
+        connectSrc: new Set(),
+        frameSrc: new Set(),
+      };
+      
+      for (const plugin of plugins) {
+        if (plugin && plugin.csp) {
+          for (const [directive, sources] of Object.entries(plugin.csp)) {
+            if (pluginCspSources[directive]) {
+              const sourceArray = Array.isArray(sources) ? sources : [sources];
+              for (const source of sourceArray) {
+                pluginCspSources[directive].add(source);
+              }
+            }
+          }
+        }
+      }
+      
+      // Merge plugin CSP sources with default config
+      if (finalConfig.contentSecurityPolicy && finalConfig.contentSecurityPolicy.directives) {
+        const directives = finalConfig.contentSecurityPolicy.directives;
+        for (const [directive, sources] of Object.entries(pluginCspSources)) {
+          if (sources.size > 0 && directives[directive]) {
+            directives[directive] = [...directives[directive], ...Array.from(sources)];
+          }
+        }
+      }
+    }
+    
     app.use(helmet(finalConfig));
   }