webspresso 0.0.70 → 0.0.72

package/plugins/admin-panel/modules/menu.js

@@ -94,6 +94,7 @@ const Icon = {
       activity: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 10V3L4 14h7v7l9-11h-7z" />',
       filter: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 4a1 1 0 011-1h16a1 1 0 011 1v2.586a1 1 0 01-.293.707l-6.414 6.414a1 1 0 00-.293.707V17l-4 4v-6.586a1 1 0 00-.293-.707L3.293 7.293A1 1 0 013 6.586V4z" />',
       search: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z" />',
+      refresh: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15" />',
       'chevron-down': '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7" />',
       'chevron-right': '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 5l7 7-7 7" />',
       logout: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17 16l4-4m0 0l-4-4m4 4H7m6 4v1a3 3 0 01-3 3H6a3 3 0 01-3-3V7a3 3 0 013-3h4a3 3 0 013 3v1" />',
@@ -116,6 +117,48 @@ const Icon = {
   },
 };
 
+function getAdminAutoRefreshMs() {
+  const raw = window.__ADMIN_CONFIG__?.settings?.autoRefreshMs;
+  if (raw === 0 || raw === false) return 0;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 0) return 60000;
+  return Math.min(Math.max(n, 10000), 3600000);
+}
+
+function runAdminAutoRefresh(callback) {
+  const ms = getAdminAutoRefreshMs();
+  if (!ms) return function noop() {};
+  const id = setInterval(() => {
+    if (document.visibilityState === 'hidden') return;
+    try {
+      callback();
+    } catch (e) {
+      console.error(e);
+    }
+  }, ms);
+  return function stopAdminAutoRefresh() {
+    clearInterval(id);
+  };
+}
+
+const RefreshIconButton = {
+  view(vnode) {
+    const { title, spinning, onclick, disabled } = vnode.attrs;
+    return m('button.inline-flex.items-center.justify-center.p-2.rounded-lg.border.border-gray-200.dark:border-slate-600.bg-white.dark:bg-slate-800.text-gray-600.dark:text-slate-300.hover:bg-gray-50.dark:hover:bg-slate-700.transition-colors.disabled:opacity-50', {
+      type: 'button',
+      title: title || 'Refresh',
+      disabled: !!disabled || !!spinning,
+      onclick: (e) => {
+        e.preventDefault();
+        if (onclick) onclick(e);
+      },
+    }, m(Icon, {
+      name: 'refresh',
+      class: 'w-4 h-4' + (spinning ? ' animate-spin' : ''),
+    }));
+  },
+};
+
 var ADMIN_THEME_KEY = 'webspresso-admin-theme';
 function getAdminThemePref() {
   try { return localStorage.getItem(ADMIN_THEME_KEY); } catch (e) { return null; }

package/plugins/audit-log/middleware.js

@@ -109,4 +109,7 @@ function createAuditMiddleware(options) {
 
 module.exports = {
   createAuditMiddleware,
+  stringifyId,
+  extractResourceIdFromJsonBody,
+  buildMetadata,
 };

package/plugins/data-exchange/export-xlsx.js

@@ -0,0 +1,83 @@
+/**
+ * Excel (.xlsx) export using exceljs
+ * @module plugins/data-exchange/export-xlsx
+ */
+
+const ExcelJS = require('exceljs');
+const { sanitizeForOutput } = require('../../core/orm/utils');
+const { resolveExportRecords } = require('./record-selection');
+
+/**
+ * @param {import('../../core/orm/types').ModelDefinition} model
+ * @param {object[]} records
+ * @returns {Promise<Buffer>}
+ */
+async function buildXlsxBuffer(model, records) {
+  const clean = sanitizeForOutput(records, model);
+  const hiddenSet = new Set(model.hidden || []);
+  const columns = Array.from(model.columns.keys()).filter((c) => !hiddenSet.has(c));
+
+  const wb = new ExcelJS.Workbook();
+  const ws = wb.addWorksheet('Export', {
+    views: [{ state: 'frozen', ySplit: 1 }],
+  });
+
+  ws.addRow(columns);
+  const headerRow = ws.getRow(1);
+  headerRow.font = { bold: true };
+
+  for (const rec of clean) {
+    const rowValues = columns.map((c) => {
+      let v = rec[c];
+      if (v === null || v === undefined) return '';
+      if (typeof v === 'object') v = JSON.stringify(v);
+      if (typeof v === 'string' && /^[=+\-@]/.test(v)) return ` ${v}`;
+      return v;
+    });
+    ws.addRow(rowValues);
+  }
+
+  const buf = await wb.xlsx.writeBuffer();
+  return Buffer.isBuffer(buf) ? buf : Buffer.from(buf);
+}
+
+/**
+ * @param {object} opts
+ * @param {import('../../core/orm/database').Database} opts.db
+ * @param {number} opts.maxRows
+ */
+function createExportXlsxHandler(opts) {
+  const { db, maxRows } = opts;
+
+  return async function exportXlsxHandler(req, res) {
+    try {
+      const modelName = req.params.model || req.query.model;
+      const result = await resolveExportRecords(db, modelName, req);
+      if (result.error) {
+        return res.status(result.error).json({ error: result.message });
+      }
+      const { model, records } = result;
+      if (records.length > maxRows) {
+        return res.status(400).json({
+          error: `Too many rows to export (${records.length}). Limit is ${maxRows}.`,
+        });
+      }
+      const buffer = await buildXlsxBuffer(model, records);
+      const safeName = String(model.name).replace(/[^\w.-]+/g, '_');
+      res.setHeader(
+        'Content-Type',
+        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
+      );
+      res.setHeader('Content-Disposition', `attachment; filename="${safeName}_export.xlsx"`);
+      res.send(buffer);
+    } catch (err) {
+      console.error('[data-exchange] export xlsx:', err);
+      res.status(500).json({ error: err.message || 'Export failed' });
+    }
+  };
+}
+
+module.exports = {
+  buildXlsxBuffer,
+  createExportXlsxHandler,
+};

package/plugins/data-exchange/import.js

@@ -0,0 +1,289 @@
+/**
+ * CSV / XLSX import (admin multipart upload)
+ * @module plugins/data-exchange/import
+ */
+
+const multer = require('multer');
+const ExcelJS = require('exceljs');
+const { parse: parseCsv } = require('csv-parse/sync');
+const { buildHeaderMapping, dataRowsToObjects } = require('./parse-table');
+
+function allowedImportColumns(model) {
+  const hidden = new Set(model.hidden || []);
+  return Array.from(model.columns.keys()).filter((c) => !hidden.has(c));
+}
+
+/**
+ * @param {*} raw
+ * @param {import('../../core/orm/types').ColumnMeta|undefined} meta
+ * @param {string} column
+ */
+function coerceCell(raw, meta, column) {
+  if (raw === null || raw === undefined) return undefined;
+  if (typeof raw === 'number' && Number.isNaN(raw)) return undefined;
+
+  if (typeof raw === 'string') {
+    const t = raw.trim();
+    if (t === '') return undefined;
+    raw = t;
+  }
+
+  if (!meta || !meta.type) return raw;
+
+  switch (meta.type) {
+    case 'bigint':
+    case 'integer': {
+      if (typeof raw === 'number') return Math.trunc(raw);
+      const n = parseInt(String(raw), 10);
+      if (Number.isNaN(n)) throw new Error(`Invalid integer for ${column}`);
+      return n;
+    }
+    case 'decimal':
+    case 'float': {
+      if (typeof raw === 'number') return raw;
+      const n = parseFloat(String(raw));
+      if (Number.isNaN(n)) throw new Error(`Invalid number for ${column}`);
+      return n;
+    }
+    case 'boolean': {
+      if (typeof raw === 'boolean') return raw;
+      const s = String(raw).toLowerCase();
+      if (s === 'true' || s === '1' || s === 'yes') return true;
+      if (s === 'false' || s === '0' || s === 'no') return false;
+      throw new Error(`Invalid boolean for ${column}`);
+    }
+    case 'json': {
+      if (typeof raw === 'object') return raw;
+      try {
+        return JSON.parse(String(raw));
+      } catch {
+        throw new Error(`Invalid JSON for ${column}`);
+      }
+    }
+    default:
+      return raw;
+  }
+}
+
+function buildPayloadForRow(model, data, mode) {
+  const allowed = new Set(allowedImportColumns(model));
+  const payload = {};
+  for (const [col, raw] of Object.entries(data)) {
+    if (!allowed.has(col)) continue;
+    const meta = model.columns.get(col);
+    let v;
+    try {
+      v = coerceCell(raw, meta, col);
+    } catch (e) {
+      throw e;
+    }
+    if (v === undefined) continue;
+    payload[col] = v;
+  }
+
+  const pk = model.primaryKey;
+  const pkMeta = model.columns.get(pk);
+  if (
+    mode === 'insert' &&
+    pkMeta?.autoIncrement &&
+    (payload[pk] === undefined || payload[pk] === null || payload[pk] === '')
+  ) {
+    delete payload[pk];
+  }
+
+  return payload;
+}
+
+function parseCsvToRows(buffer) {
+  const text = buffer.toString('utf8');
+  const records = parseCsv(text, {
+    relaxColumnCount: true,
+    skipEmptyLines: true,
+  });
+  if (records.length === 0) return [];
+  return records.map((row) => row.map((c) => (c === '' ? '' : c)));
+}
+
+async function parseXlsxToRows(buffer) {
+  const wb = new ExcelJS.Workbook();
+  await wb.xlsx.load(buffer);
+  const ws = wb.worksheets[0];
+  if (!ws) return [];
+  const rows = [];
+  ws.eachRow({ includeEmpty: true }, (row) => {
+    let maxCol = 0;
+    row.eachCell({ includeEmpty: true }, (_cell, colNumber) => {
+      maxCol = Math.max(maxCol, colNumber);
+    });
+    const arr = [];
+    for (let c = 1; c <= maxCol; c++) {
+      arr.push(cellValueToPlain(row.getCell(c)));
+    }
+    rows.push(arr);
+  });
+  return rows;
+}
+
+function cellValueToPlain(cell) {
+  const v = cell.value;
+  if (v === null || v === undefined) return '';
+  if (v instanceof Date) return v.toISOString();
+  if (typeof v === 'object' && v !== null) {
+    if ('text' in v && typeof v.text === 'string') return v.text;
+    if ('richText' in v && Array.isArray(v.richText)) {
+      return v.richText.map((t) => t.text || '').join('');
+    }
+    if ('result' in v && v.result !== undefined) return v.result;
+  }
+  return v;
+}
+
+function createMulter(maxFileBytes) {
+  return multer({
+    storage: multer.memoryStorage(),
+    limits: { fileSize: maxFileBytes, files: 1 },
+  });
+}
+
+/**
+ * @param {object} opts
+ * @param {import('../../core/orm/database').Database} opts.db
+ * @param {number} opts.maxRows
+ * @param {number} opts.maxFileBytes
+ */
+function createImportHandler(opts) {
+  const { db, maxRows, maxFileBytes } = opts;
+  const upload = createMulter(maxFileBytes).single('file');
+
+  return async function importHandler(req, res) {
+    upload(req, res, async (multerErr) => {
+      try {
+        if (multerErr) {
+          const code = multerErr.code === 'LIMIT_FILE_SIZE' ? 413 : 400;
+          return res.status(code).json({
+            error: multerErr.code === 'LIMIT_FILE_SIZE' ? 'File too large' : multerErr.message,
+          });
+        }
+
+        const modelName = req.params.model;
+        const { getModel } = require('../../core/orm/model');
+        const model = db.getModel ? db.getModel(modelName) : getModel(modelName);
+        if (!model || !model.admin?.enabled) {
+          return res.status(404).json({ error: 'Model not found or not enabled' });
+        }
+
+        const modeRaw = (req.query.mode || req.body?.mode || 'insert').toLowerCase();
+        const mode = modeRaw === 'upsert' ? 'upsert' : 'insert';
+        let upsertKey = req.query.upsertKey || req.body?.upsertKey || model.primaryKey;
+        upsertKey = String(upsertKey);
+
+        if (!model.columns.has(upsertKey)) {
+          return res.status(400).json({ error: `upsertKey "${upsertKey}" is not a column` });
+        }
+        if (model.hidden?.includes(upsertKey)) {
+          return res.status(400).json({ error: `upsertKey "${upsertKey}" is not allowed` });
+        }
+
+        if (!req.file || !req.file.buffer) {
+          return res.status(400).json({ error: 'Missing file field' });
+        }
+
+        const name = (req.file.originalname || '').toLowerCase();
+        const isCsv = name.endsWith('.csv') || (req.file.mimetype || '').includes('csv');
+        let rows;
+        if (isCsv) {
+          rows = parseCsvToRows(req.file.buffer);
+        } else {
+          try {
+            rows = await parseXlsxToRows(req.file.buffer);
+          } catch (e) {
+            return res.status(400).json({ error: `Invalid spreadsheet: ${e.message}` });
+          }
+        }
+
+        if (rows.length < 2) {
+          return res.status(400).json({ error: 'File must include a header row and at least one data row' });
+        }
+
+        const allowedKeys = allowedImportColumns(model);
+        const headerMapping = buildHeaderMapping(rows[0], allowedKeys);
+        const objects = dataRowsToObjects(rows, headerMapping);
+        if (objects.length > maxRows) {
+          return res.status(400).json({ error: `Too many data rows (${objects.length}). Limit is ${maxRows}.` });
+        }
+
+        const repo = db.getRepository(model.name);
+        const summary = {
+          success: true,
+          created: 0,
+          updated: 0,
+          failed: 0,
+          errors: [],
+        };
+
+        for (const { rowNumber, data } of objects) {
+          try {
+            const payload = buildPayloadForRow(model, data, mode);
+            if (Object.keys(payload).length === 0) {
+              summary.failed++;
+              summary.errors.push({ row: rowNumber, message: 'No mappable columns' });
+              continue;
+            }
+
+            if (mode === 'insert') {
+              await repo.create(payload);
+              summary.created++;
+              continue;
+            }
+
+            const keyMeta = model.columns.get(upsertKey);
+            let keyVal;
+            try {
+              keyVal = coerceCell(data[upsertKey], keyMeta, upsertKey);
+            } catch (e) {
+              summary.failed++;
+              summary.errors.push({ row: rowNumber, message: e.message || 'Bad upsert key' });
+              continue;
+            }
+
+            if (keyVal === undefined || keyVal === null) {
+              const insertPayload = { ...payload };
+              delete insertPayload[upsertKey];
+              await repo.create(insertPayload);
+              summary.created++;
+              continue;
+            }
+
+            const existing = await repo.findOne({ [upsertKey]: keyVal });
+            if (existing) {
+              const id = existing[model.primaryKey];
+              await repo.update(id, payload);
+              summary.updated++;
+            } else {
+              await repo.create({ ...payload, [upsertKey]: keyVal });
+              summary.created++;
+            }
+          } catch (e) {
+            summary.failed++;
+            summary.errors.push({ row: rowNumber, message: e.message || String(e) });
+          }
+        }
+
+        summary.success = summary.failed === 0;
+        res.json(summary);
+      } catch (err) {
+        console.error('[data-exchange] import:', err);
+        res.status(500).json({ error: err.message || 'Import failed' });
+      }
+    });
+  };
+}
+
+module.exports = {
+  createImportHandler,
+  createMulter,
+  allowedImportColumns,
+  parseCsvToRows,
+  parseXlsxToRows,
+  buildPayloadForRow,
+};

package/plugins/data-exchange/index.js

@@ -0,0 +1,80 @@
+/**
+ * Admin-only CSV/Excel import and Excel export.
+ *
+ * Usage: add after adminPanelPlugin in createApp({ plugins: [...] }) so session
+ * middleware and admin-panel registry exist. Same adminPath as admin panel.
+ *
+ * @module plugins/data-exchange
+ */
+
+const { createExportXlsxHandler } = require('./export-xlsx');
+const { createImportHandler } = require('./import');
+
+/**
+ * @param {Object} [options]
+ * @param {boolean} [options.enabled=true]
+ * @param {import('../../core/orm/database').Database} [options.db] - defaults to ctx.db
+ * @param {string} [options.adminPath='/_admin'] - must match admin panel path
+ * @param {number} [options.maxRows=10000] - export/import row cap
+ * @param {number} [options.maxFileBytes=10485760] - multipart size (10 MiB)
+ */
+function dataExchangePlugin(options = {}) {
+  const {
+    enabled = true,
+    db: dbOption,
+    adminPath = '/_admin',
+    maxRows = 10_000,
+    maxFileBytes = 10 * 1024 * 1024,
+  } = options;
+
+  return {
+    name: 'data-exchange',
+    version: '1.0.0',
+    description: 'Admin spreadsheet import (CSV/XLSX) and Excel export',
+    enabled,
+
+    onRoutesReady(ctx) {
+      if (!enabled) return;
+
+      const db = dbOption ?? ctx.db;
+      if (!db) {
+        console.warn('[data-exchange] Skipping routes: no database (pass options.db or createApp({ db }))');
+        return;
+      }
+
+      const { requireAuth } = require('../admin-panel/auth');
+      const exportHandler = createExportXlsxHandler({ db, maxRows });
+      const importHandler = createImportHandler({ db, maxRows, maxFileBytes });
+
+      const base = `${adminPath}/api/data-exchange`;
+      ctx.addRoute('get', `${base}/export/:model`, requireAuth, exportHandler);
+      ctx.addRoute('post', `${base}/export/:model`, requireAuth, exportHandler);
+      ctx.addRoute('post', `${base}/import/:model`, requireAuth, importHandler);
+
+      const adminApi = typeof ctx.usePlugin === 'function' ? ctx.usePlugin('admin-panel') : null;
+      if (adminApi && typeof adminApi.getRegistry === 'function') {
+        const registry = adminApi.getRegistry();
+        registry.registerBulkAction('export-xlsx', {
+          label: 'Export as Excel',
+          icon: 'download',
+          color: 'blue',
+          models: '*',
+          confirm: false,
+          handler: async (records, modelName, { db: d }) => {
+            const { getModel } = require('../../core/orm/model');
+            const model = d.getModel ? d.getModel(modelName) : getModel(modelName);
+            const pk = model?.primaryKey || 'id';
+            const ids = records.map((r) => r[pk]).join(',');
+            return {
+              download: true,
+              url: `${adminPath}/api/data-exchange/export/${modelName}?ids=${encodeURIComponent(ids)}`,
+              filename: `${modelName}_export.xlsx`,
+            };
+          },
+        });
+      }
+    },
+  };
+}
+
+module.exports = { dataExchangePlugin };

package/plugins/data-exchange/parse-table.js

@@ -0,0 +1,64 @@
+/**
+ * Header row → column index mapping for spreadsheet import.
+ * @module plugins/data-exchange/parse-table
+ */
+
+function normalizeHeaderCell(h) {
+  if (h == null || h === '') return '';
+  return String(h).replace(/^\uFEFF/, '').trim();
+}
+
+/**
+ * Map header labels to model column names (case-insensitive; spaces → underscores).
+ * @param {string[]} headerRow
+ * @param {Iterable<string>} allowedKeys
+ * @returns {(string|null)[]} index → model column or null if unknown
+ */
+function buildHeaderMapping(headerRow, allowedKeys) {
+  const lowerToKey = new Map();
+  for (const k of allowedKeys) {
+    lowerToKey.set(String(k).toLowerCase().replace(/\s+/g, '_'), k);
+  }
+  const mapping = [];
+  for (let i = 0; i < headerRow.length; i++) {
+    const norm = normalizeHeaderCell(headerRow[i]).toLowerCase().replace(/\s+/g, '_');
+    if (!norm) {
+      mapping.push(null);
+      continue;
+    }
+    mapping.push(lowerToKey.get(norm) ?? null);
+  }
+  return mapping;
+}
+
+/**
+ * @param {Array<Array<*>>} rows including header as rows[0]
+ * @param {(string|null)[]} headerMapping
+ * @returns {{ rowNumber: number, data: Record<string, *> }[]} rowNumber = 1-based sheet row
+ */
+function dataRowsToObjects(rows, headerMapping) {
+  const out = [];
+  for (let r = 1; r < rows.length; r++) {
+    const row = rows[r] || [];
+    const data = {};
+    for (let i = 0; i < headerMapping.length; i++) {
+      const key = headerMapping[i];
+      if (!key) continue;
+      if (!(i in row)) continue;
+      const cell = row[i];
+      if (cell === undefined || cell === null) continue;
+      if (typeof cell === 'string' && cell.trim() === '') continue;
+      data[key] = cell;
+    }
+    if (Object.keys(data).length > 0) {
+      out.push({ rowNumber: r + 1, data });
+    }
+  }
+  return out;
+}
+
+module.exports = {
+  normalizeHeaderCell,
+  buildHeaderMapping,
+  dataRowsToObjects,
+};

package/plugins/data-exchange/record-selection.js

@@ -0,0 +1,64 @@
+/**
+ * Resolve which records to export (same semantics as admin export handler).
+ * @module plugins/data-exchange/record-selection
+ */
+
+const { buildFilteredQuery } = require('../admin-panel/core/api-extensions');
+
+/**
+ * @param {import('../../core/orm/database').Database} db
+ * @param {string} modelName
+ * @param {import('express').Request} req
+ * @returns {Promise<{ model?: import('../../core/orm/types').ModelDefinition, records?: object[], error?: number, message?: string }>}
+ */
+async function resolveExportRecords(db, modelName, req) {
+  const body = req.body || {};
+  let selectAll = body.selectAll ?? req.query.selectAll;
+  let filters = body.filters ?? req.query.filters;
+  if (typeof selectAll === 'string') selectAll = selectAll === 'true';
+  if (typeof filters === 'string') {
+    try {
+      filters = JSON.parse(filters);
+    } catch {
+      filters = undefined;
+    }
+  }
+
+  let idList = null;
+  if (req.body?.ids && Array.isArray(req.body.ids)) {
+    idList = req.body.ids;
+  } else if (req.query.ids) {
+    idList = String(req.query.ids).split(',').filter(Boolean);
+  }
+
+  if (!modelName) {
+    return { error: 400, message: 'Model name is required' };
+  }
+
+  const { getModel } = require('../../core/orm/model');
+  const model = db.getModel ? db.getModel(modelName) : getModel(modelName);
+
+  if (!model || !model.admin?.enabled) {
+    return { error: 404, message: 'Model not found or not enabled' };
+  }
+
+  const repo = db.getRepository(model.name);
+  let records;
+
+  if (selectAll) {
+    const query = buildFilteredQuery(repo, filters);
+    records = await query.list();
+  } else if (idList && idList.length > 0) {
+    records = [];
+    for (const id of idList) {
+      const record = await repo.findById(id);
+      if (record) records.push(record);
+    }
+  } else {
+    records = await repo.findAll();
+  }
+
+  return { model, records };
+}
+
+module.exports = { resolveExportRecords };

package/plugins/index.js

@@ -17,6 +17,8 @@ const healthCheckPlugin = require('./health-check');
 const restResourcePlugin = require('./rest-resources');
 const ormCacheAdminPlugin = require('./orm-cache-admin');
 const { uploadPlugin, createLocalFileProvider } = require('./upload');
+/** Register after adminPanelPlugin (same db + adminPath) for session and routes. */
+const { dataExchangePlugin } = require('./data-exchange');
 
 module.exports = {
   sitemapPlugin,
@@ -34,5 +36,6 @@ module.exports = {
   ormCacheAdminPlugin,
   uploadPlugin,
   createLocalFileProvider,
+  dataExchangePlugin,
 };