webspresso 0.0.50 → 0.0.52

package/README.md

@@ -215,6 +215,40 @@ npm run watch:css      # Watch and rebuild CSS on changes
 npm run dev            # Starts both CSS watch and dev server
 ```
 
+### `webspresso favicon:generate <source.png>`
+
+Generate favicon PNG files and `favicons.njk` partial from a single source PNG.
+
+```bash
+# Basic usage (creates files in public/, views/partials/)
+webspresso favicon:generate logo.png
+
+# With PWA manifest options
+webspresso favicon:generate logo.png --name "My App" --short-name "App" --theme-color "#22c55e"
+
+# Custom output directory
+webspresso favicon:generate logo.png -o static
+
+# Skip adding include to layout.njk
+webspresso favicon:generate logo.png --no-layout
+```
+
+This command will:
+- Resize the source PNG to all required sizes (Apple touch 57–180px, Android 192px, favicon 16/32/96px, MS Tile 144px)
+- Write PNGs to `public/` (or `-o` path)
+- Create `public/manifest.json` (PWA format)
+- Create `views/partials/favicons.njk` with `<link>` and `<meta>` tags
+- Add `{% include "partials/favicons.njk" %}` to `views/layout.njk` (unless `--no-layout`)
+
+**Options:**
+- `-o, --output-dir <path>` – Output directory for PNGs (default: `public`)
+- `--partial-dir <path>` – Directory for favicons.njk (default: `views/partials`)
+- `--layout-file <path>` – Layout file to update (default: `views/layout.njk`)
+- `--theme-color <hex>` – theme-color and msapplication-TileColor (default: `#ffffff`)
+- `--name <string>` – manifest.json `name` (PWA)
+- `--short-name <string>` – manifest.json `short_name` (PWA)
+- `--no-layout` – Do not add include to layout.njk
+
 ## Project Structure
 
 Create your app with this structure:
@@ -1130,9 +1164,13 @@ const User = defineModel({
     timestamps: true,     // Auto-manage created_at/updated_at
     tenant: 'tenant_id',  // Multi-tenant column (optional)
   },
+
+  hidden: ['password_hash', 'api_token'],  // Never expose in API/templates (security)
 });
 ```
 
+**Hidden columns:** Add column names to `hidden` so they are never exposed in admin API responses, exports, or when passing to templates. Use for sensitive data like `password_hash`, `api_token`, `secret_key`. The admin panel will exclude these from list views and forms automatically.
+
 ### Auto-Loading Models
 
 Models are automatically loaded from the `models/` directory when you create a database instance:

package/bin/commands/favicon-generate.js

@@ -0,0 +1,155 @@
+/**
+ * Favicon Generate Command
+ * Generate favicon PNGs and favicons.njk partial from a single source PNG
+ */
+
+const fs = require('fs');
+const path = require('path');
+const sharp = require('sharp');
+
+const APPLE_SIZES = [57, 60, 72, 76, 114, 120, 144, 152, 180];
+const ANDROID_SIZE = 192;
+const FAVICON_SIZES = [16, 32, 96];
+const MS_TILE_SIZE = 144;
+
+function registerCommand(program) {
+  program
+    .command('favicon:generate <source>')
+    .description('Generate favicon PNGs and favicons.njk partial from a single source PNG')
+    .option('-o, --output-dir <path>', 'Output directory for PNGs', 'public')
+    .option('--partial-dir <path>', 'Directory for favicons.njk partial', 'views/partials')
+    .option('--layout-file <path>', 'Layout file to update', 'views/layout.njk')
+    .option('--theme-color <hex>', 'theme-color and msapplication-TileColor', '#ffffff')
+    .option('--name <string>', 'manifest.json name (PWA)')
+    .option('--short-name <string>', 'manifest.json short_name (PWA)')
+    .option('--no-layout', 'Skip adding include to layout.njk')
+    .action(async (source, options) => {
+      try {
+        const cwd = process.cwd();
+        const sourcePath = path.resolve(cwd, source);
+        const outputDir = path.resolve(cwd, options.outputDir);
+        const partialDir = path.resolve(cwd, options.partialDir);
+        const partialPath = path.join(partialDir, 'favicons.njk');
+        const layoutPath = path.resolve(cwd, options.layoutFile || 'views/layout.njk');
+        const themeColor = options.themeColor || '#ffffff';
+
+        if (!fs.existsSync(sourcePath)) {
+          console.error(`\n❌ Source file not found: ${sourcePath}\n`);
+          process.exit(1);
+        }
+
+        const ext = path.extname(sourcePath).toLowerCase();
+        if (ext !== '.png') {
+          console.error(`\n❌ Source must be a PNG file. Got: ${ext}\n`);
+          process.exit(1);
+        }
+
+        console.log('\n🖼️  Generating favicons from:', source);
+
+        fs.mkdirSync(outputDir, { recursive: true });
+        fs.mkdirSync(partialDir, { recursive: true });
+
+        const allSizes = [...new Set([...APPLE_SIZES, ANDROID_SIZE, ...FAVICON_SIZES, MS_TILE_SIZE])].sort((a, b) => a - b);
+
+        for (const size of allSizes) {
+          const buffer = await sharp(sourcePath).resize(size, size).png().toBuffer();
+
+          if (APPLE_SIZES.includes(size)) {
+            const filename = `apple-icon-${size}x${size}.png`;
+            fs.writeFileSync(path.join(outputDir, filename), buffer);
+            console.log(`   ✓ ${filename}`);
+          }
+          if (size === ANDROID_SIZE) {
+            const filename = `android-icon-${size}x${size}.png`;
+            fs.writeFileSync(path.join(outputDir, filename), buffer);
+            console.log(`   ✓ ${filename}`);
+          }
+          if (size === MS_TILE_SIZE) {
+            const filename = `ms-icon-${size}x${size}.png`;
+            fs.writeFileSync(path.join(outputDir, filename), buffer);
+            console.log(`   ✓ ${filename}`);
+          }
+          if (FAVICON_SIZES.includes(size)) {
+            const filename = `favicon-${size}x${size}.png`;
+            fs.writeFileSync(path.join(outputDir, filename), buffer);
+            console.log(`   ✓ ${filename}`);
+          }
+        }
+
+        const manifest = {
+          name: options.name || 'Web App',
+          short_name: options.shortName || options.name || 'App',
+          icons: [
+            { src: '/android-icon-192x192.png', sizes: '192x192', type: 'image/png' },
+            { src: '/apple-icon-180x180.png', sizes: '180x180', type: 'image/png' },
+          ],
+          theme_color: themeColor,
+          background_color: themeColor,
+        };
+
+        fs.writeFileSync(
+          path.join(outputDir, 'manifest.json'),
+          JSON.stringify(manifest, null, 2)
+        );
+        console.log('   ✓ manifest.json');
+
+        const faviconsNjk = generateFaviconsNjk(themeColor, options.outputDir);
+        fs.writeFileSync(partialPath, faviconsNjk);
+        console.log(`   ✓ ${path.relative(cwd, partialPath)}`);
+
+        if (options.layout !== false) {
+          const updated = addIncludeToLayout(layoutPath, options.outputDir);
+          if (updated) {
+            console.log(`   ✓ Updated ${path.relative(cwd, layoutPath)}`);
+          } else {
+            console.log(`   - Layout already includes favicons or not found`);
+          }
+        }
+
+        console.log('\n✅ Favicons generated successfully.\n');
+      } catch (err) {
+        console.error('\n❌ Error:', err.message);
+        process.exit(1);
+      }
+    });
+}
+
+function generateFaviconsNjk(themeColor, outputDir) {
+  const pathPrefix = outputDir === 'public' ? '/' : `/${outputDir.replace(/^\/|\/$/g, '')}/`;
+  const lines = [
+    '{# Favicons - Generated by webspresso favicon:generate #}',
+    ...APPLE_SIZES.map((s) => `<link rel="apple-touch-icon" sizes="${s}x${s}" href="${pathPrefix}apple-icon-${s}x${s}.png">`),
+    `<link rel="icon" type="image/png" sizes="192x192" href="${pathPrefix}android-icon-192x192.png">`,
+    ...FAVICON_SIZES.map((s) => `<link rel="icon" type="image/png" sizes="${s}x${s}" href="${pathPrefix}favicon-${s}x${s}.png">`),
+    `<link rel="manifest" href="${pathPrefix}manifest.json">`,
+    `<meta name="msapplication-TileColor" content="${themeColor}">`,
+    `<meta name="msapplication-TileImage" content="${pathPrefix}ms-icon-144x144.png">`,
+    `<meta name="theme-color" content="${themeColor}">`,
+  ];
+  return lines.join('\n') + '\n';
+}
+
+function addIncludeToLayout(layoutPath, outputDir) {
+  if (!fs.existsSync(layoutPath)) {
+    return false;
+  }
+
+  const content = fs.readFileSync(layoutPath, 'utf8');
+  const includePattern = /favicons\.njk/;
+  if (includePattern.test(content)) {
+    return false;
+  }
+
+  const includeLine = '  {% include "partials/favicons.njk" %}';
+  const headClose = '</head>';
+
+  if (content.includes(headClose)) {
+    const newContent = content.replace(headClose, `${includeLine}\n${headClose}`);
+    fs.writeFileSync(layoutPath, newContent);
+    return true;
+  }
+
+  return false;
+}
+
+module.exports = { registerCommand };

package/bin/webspresso.js

@@ -26,6 +26,7 @@ const { registerCommand: registerDbMake } = require('./commands/db-make');
 const { registerCommand: registerSeed } = require('./commands/seed');
 const { registerCommand: registerAdminSetup } = require('./commands/admin-setup');
 const { registerCommand: registerAdminPassword } = require('./commands/admin-password');
+const { registerCommand: registerFaviconGenerate } = require('./commands/favicon-generate');
 
 registerNew(program);
 registerPage(program);
@@ -40,6 +41,7 @@ registerDbMake(program);
 registerSeed(program);
 registerAdminSetup(program);
 registerAdminPassword(program);
+registerFaviconGenerate(program);
 
 // Parse arguments
 program.parse();

package/core/orm/index.js

@@ -13,6 +13,7 @@ const { createMigrationManager } = require('./migrations');
 const { createSeeder } = require('./seeder');
 const { createScopeContext } = require('./scopes');
 const { ModelEvents, Hooks, HookCancellationError, createEventContext } = require('./events');
+const { omitHiddenColumns, sanitizeForOutput } = require('./utils');
 
 /**
  * Create a database instance
@@ -272,6 +273,9 @@ module.exports = {
   // Column utilities
   extractColumnsFromSchema,
   getColumnMeta,
+  // Output sanitization (exclude hidden columns from API/templates)
+  omitHiddenColumns,
+  sanitizeForOutput,
   // Events/Signals
   ModelEvents,
   Hooks,

package/core/orm/model.js

@@ -28,6 +28,7 @@ function defineModel(options) {
     scopes = {},
     admin = {},
     hooks = {},
+    hidden = [],
   } = options;
 
   // Validate required fields
@@ -88,6 +89,7 @@ function defineModel(options) {
       customFields: admin.customFields || {},
       queries: admin.queries || {},
     },
+    hidden: Array.isArray(hidden) ? hidden : [],
     hooks: {},
   };
 

package/core/orm/types.js

@@ -147,6 +147,7 @@
  * @property {RelationsMap} [relations={}] - Relation definitions
  * @property {ScopeOptions} [scopes={}] - Scope options
  * @property {AdminMetadata} [admin] - Admin panel metadata
+ * @property {string[]} [hidden=[]] - Column names to never expose in API/templates (e.g. password_hash, api_token)
  */
 
 /**
@@ -159,6 +160,7 @@
  * @property {ScopeOptions} scopes - Scope options
  * @property {Map<string, ColumnMeta>} columns - Parsed column metadata
  * @property {AdminMetadata} [admin] - Admin panel metadata
+ * @property {string[]} hidden - Column names never exposed in API/templates
  */
 
 // ============================================================================

package/core/orm/utils.js

@@ -114,9 +114,37 @@ function deepClone(obj) {
   return cloned;
 }
 
+/**
+ * Remove hidden columns from a record for safe API/template output
+ * @param {Object} record - Record from database
+ * @param {import('./types').ModelDefinition} model - Model definition with hidden columns
+ * @returns {Object} Record without hidden columns
+ */
+function omitHiddenColumns(record, model) {
+  if (!record) return record;
+  if (!model?.hidden?.length) return record;
+  return omit(record, model.hidden);
+}
+
+/**
+ * Remove hidden columns from records (array or single) for safe output
+ * @param {Object|Object[]} records - Record(s) from database
+ * @param {import('./types').ModelDefinition} model - Model definition
+ * @returns {Object|Object[]} Sanitized record(s)
+ */
+function sanitizeForOutput(records, model) {
+  if (!model?.hidden?.length) return records;
+  if (Array.isArray(records)) {
+    return records.map((r) => omit(r, model.hidden));
+  }
+  return omit(records, model.hidden);
+}
+
 module.exports = {
   pick,
   omit,
+  omitHiddenColumns,
+  sanitizeForOutput,
   formatDateForDb,
   generateMigrationTimestamp,
   snakeToCamel,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.50",
+  "version": "0.0.52",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "bin": {
@@ -55,6 +55,7 @@
     "inquirer": "^8.2.6",
     "knex": "^3.1.0",
     "nunjucks": "^3.2.4",
+    "sharp": "^0.33.5",
     "zod": "^3.23.0"
   },
   "peerDependencies": {

package/plugins/admin-panel/admin-user-model.js

@@ -33,6 +33,7 @@ function createAdminUserModel() {
     scopes: {
       timestamps: true,
     },
+    hidden: ['password'], // Never expose in API/templates
   });
 }
 

package/plugins/admin-panel/api.js

@@ -5,6 +5,7 @@
  */
 
 const { getAllModels, getModel } = require('../../core/orm/model');
+const { sanitizeForOutput } = require('../../core/orm/utils');
 const { checkAdminExists, setupAdmin, login, logout, requireAuth } = require('./auth');
 
 /**
@@ -198,9 +199,11 @@ function createApiHandlers(options) {
         return res.status(403).json({ error: 'Model not enabled in admin panel' });
       }
 
-      // Build column metadata
+      // Build column metadata (hidden columns excluded from list/forms for security)
+      const hiddenSet = new Set(model.hidden || []);
       const columns = [];
       for (const [name, meta] of model.columns) {
+        const isHidden = hiddenSet.has(name);
         columns.push({
           name,
           type: meta.type,
@@ -214,7 +217,8 @@ function createApiHandlers(options) {
           autoIncrement: meta.autoIncrement || false,
           customField: model.admin.customFields?.[name] || null,
           validations: meta.validations || null,
-          ui: meta.ui || null,
+          ui: meta.ui ? { ...meta.ui, hidden: isHidden || meta.ui.hidden } : (isHidden ? { hidden: true } : null),
+          hidden: isHidden, // Excluded from list display and API responses
         });
       }
 
@@ -394,7 +398,7 @@ function createApiHandlers(options) {
       const records = await query.list();
 
       res.json({
-        data: records,
+        data: sanitizeForOutput(records, model),
         pagination: {
           page,
           perPage,
@@ -426,7 +430,7 @@ function createApiHandlers(options) {
         return res.status(404).json({ error: 'Record not found' });
       }
 
-      res.json({ data: record });
+      res.json({ data: sanitizeForOutput(record, model) });
     } catch (error) {
       res.status(500).json({ error: error.message });
     }
@@ -459,7 +463,7 @@ function createApiHandlers(options) {
       const repo = db.getRepository(model.name);
       const record = await repo.create(req.body);
 
-      res.status(201).json({ data: record });
+      res.status(201).json({ data: sanitizeForOutput(record, model) });
     } catch (error) {
       res.status(400).json({ error: error.message });
     }
@@ -496,7 +500,7 @@ function createApiHandlers(options) {
         return res.status(404).json({ error: 'Record not found' });
       }
 
-      res.json({ data: record });
+      res.json({ data: sanitizeForOutput(record, model) });
     } catch (error) {
       res.status(400).json({ error: error.message });
     }
@@ -550,7 +554,7 @@ function createApiHandlers(options) {
         return res.status(404).json({ error: 'Record not found in trash' });
       }
 
-      res.json({ success: true, data: record });
+      res.json({ success: true, data: sanitizeForOutput(record, model) });
     } catch (error) {
       res.status(500).json({ error: error.message });
     }
@@ -579,7 +583,7 @@ function createApiHandlers(options) {
       // Get all related records (for dropdown/select)
       const records = await relatedRepo.findAll();
 
-      res.json({ data: records });
+      res.json({ data: sanitizeForOutput(records, relatedModel) });
     } catch (error) {
       res.status(500).json({ error: error.message });
     }

package/plugins/admin-panel/components.js

@@ -1484,12 +1484,15 @@ const BulkFieldUpdateDropdown = {
 // Get columns to display in table (limit to reasonable number)
 function getDisplayColumns(columns) {
   if (!columns || columns.length === 0) return [];
-  
+
+  // Filter out hidden columns (password_hash, api_token, etc.)
+  const visible = [...columns].filter((col) => !col.hidden);
+
   // Prioritize: id, name/title, then others (excluding long text/json fields)
   const priority = ['id', 'name', 'title', 'email', 'slug', 'status', 'published', 'created_at'];
   const exclude = ['password', 'content', 'body', 'description']; // Usually too long
-  
-  const sorted = [...columns].sort((a, b) => {
+
+  const sorted = visible.sort((a, b) => {
     const aIdx = priority.indexOf(a.name);
     const bIdx = priority.indexOf(b.name);
     if (aIdx !== -1 && bIdx !== -1) return aIdx - bIdx;

package/plugins/admin-panel/core/api-extensions.js

@@ -4,6 +4,8 @@
  * @module plugins/admin-panel/core/api-extensions
  */
 
+const { sanitizeForOutput } = require('../../../core/orm/utils');
+
 /**
  * Build query with filters applied
  * @param {Object} repo - Repository instance
@@ -573,8 +575,9 @@ function createExtensionApiHandlers(options) {
       }
 
       if (format === 'csv') {
-        // CSV export
-        const columns = Array.from(model.columns.keys());
+        // CSV export (exclude hidden columns)
+        const hiddenSet = new Set(model.hidden || []);
+        const columns = Array.from(model.columns.keys()).filter((c) => !hiddenSet.has(c));
         const header = columns.join(',');
         const rows = records.map(record => {
           return columns.map(col => {
@@ -595,8 +598,8 @@ function createExtensionApiHandlers(options) {
         res.setHeader('Content-Disposition', `attachment; filename="${modelName}_export.csv"`);
         res.json({ data: csvContent, format: 'csv' });
       } else {
-        // JSON export
-        res.json({ data: records, model: modelName, exportedAt: new Date().toISOString() });
+        // JSON export (exclude hidden columns)
+        res.json({ data: sanitizeForOutput(records, model), model: modelName, exportedAt: new Date().toISOString() });
       }
     } catch (error) {
       console.error('Export error:', error);

package/plugins/admin-panel/index.js

@@ -85,13 +85,15 @@ function adminPanelPlugin(options = {}) {
       requireAuth,
       optionalAuth,
       registerModule(config) {
-        if (!this._ctx) {
+        // When bound to plugin, "this" is the plugin; _ctx lives on this.api
+        const ctx = this.api?._ctx ?? this._ctx;
+        if (!ctx) {
           throw new Error('registerModule can only be called during or after onRoutesReady');
         }
         return registerModule(config, {
           registry,
           adminPath,
-          ctx: this._ctx,
+          ctx,
           requireAuth,
           optionalAuth,
           serveAdminPanel,