webspresso 0.0.75 → 0.0.76

package/README.md

@@ -2165,10 +2165,34 @@ const { app } = createApp({
 ```
 
 - **ORM:** `zdb.file({ maxLength: 2048, nullable: true })` — string column for the stored public URL or path; migrations use `table.string(..., maxLength)`.
-- **Admin:** the panel reads **`settings.uploadUrl`** from the registry (set automatically when `uploadPlugin` is registered **before** `adminPanelPlugin`, or pass **`adminPanelPlugin({ uploadUrl: '/api/upload' })`**). File fields (`type: 'file'` or `customFields` type `file-upload`) POST to that URL with credentials.
+- **Admin forms:** columns with `zdb.file()` automatically render a drag-and-drop upload widget (or a manual URL text field when `uploadUrl` is not configured). Optional `ui: { label, hint, accept, maxBytes }` on the column customizes the widget. For existing `zdb.string()` columns you can use `admin.customFields: { columnName: { type: 'file-upload' } }` instead of changing the schema type.
+- **Admin:** the panel reads **`settings.uploadUrl`** from the registry (set automatically when `uploadPlugin` is registered **before** `adminPanelPlugin`, or pass **`adminPanelPlugin({ uploadUrl: '/api/upload' })`**). File fields (`type: 'file'` or `customFields` type `file-upload`) POST to that URL with credentials; the saved record stores the returned **`url`** / **`publicUrl`** string.
 - **Response:** `{ url, publicUrl, key? }` — clients typically persist **`url`** / **`publicUrl`** in the model.
 - **Custom storage:** `uploadPlugin({ provider: { async put({ buffer, originalName, mimeType, size, req }) { return { publicUrl: '...' }; } } })`.
 
+**Admin model example** (`zdb.file()` picks up the upload widget from schema; no extra `customFields` needed):
+
+```javascript
+const { defineModel, zdb } = require('webspresso');
+
+const Post = defineModel({
+  name: 'Post',
+  table: 'posts',
+  schema: zdb.schema({
+    id: zdb.id(),
+    title: zdb.string(),
+    cover_image: zdb.file({
+      maxLength: 2048,
+      nullable: true,
+      ui: { label: 'Cover', accept: 'image/*', hint: 'JPEG or PNG' },
+    }),
+  }),
+  admin: { enabled: true, label: 'Posts' },
+});
+```
+
+For a plain string column, use `admin.customFields: { attachment: { type: 'file-upload' } }` instead of `zdb.file()`.
+
 ### Health check plugin
 
 Exposes a lightweight **GET** endpoint for load balancers and orchestrators (Kubernetes, Docker healthcheck, etc.). **Enabled by default** in all environments; set `enabled: false` to turn it off.

package/bin/commands/admin-password.js

@@ -3,7 +3,8 @@
  * Reset admin user password via CLI
  */
 
-const readline = require('readline');
+const inquirer = require('inquirer');
+const { hash } = require('../../core/auth/hash');
 const { loadDbConfig, createDbInstance } = require('../utils/db');
 
 function registerCommand(program) {
@@ -32,17 +33,14 @@ function registerCommand(program) {
         // Get email (interactive if not provided)
         let email = options.email;
         if (!email) {
-          const rl = readline.createInterface({
-            input: process.stdin,
-            output: process.stdout,
-          });
-          
-          email = await new Promise((resolve) => {
-            rl.question('Enter admin email: ', (answer) => {
-              rl.close();
-              resolve(answer.trim());
-            });
-          });
+          const answers = await inquirer.prompt([
+            {
+              type: 'input',
+              name: 'email',
+              message: 'Enter admin email:',
+            },
+          ]);
+          email = answers.email.trim();
         }
         
         if (!email) {
@@ -70,49 +68,15 @@ function registerCommand(program) {
         // Get new password (interactive if not provided)
         let password = options.password;
         if (!password) {
-          const rl = readline.createInterface({
-            input: process.stdin,
-            output: process.stdout,
-          });
-          
-          // Disable echo for password input
-          if (process.stdin.isTTY) {
-            process.stdout.write('Enter new password: ');
-            password = await new Promise((resolve) => {
-              let pwd = '';
-              process.stdin.setRawMode(true);
-              process.stdin.resume();
-              process.stdin.on('data', (char) => {
-                char = char.toString();
-                if (char === '\n' || char === '\r') {
-                  process.stdin.setRawMode(false);
-                  process.stdin.pause();
-                  console.log(); // New line after password
-                  resolve(pwd);
-                } else if (char === '\u0003') {
-                  // Ctrl+C
-                  process.exit();
-                } else if (char === '\u007F') {
-                  // Backspace
-                  if (pwd.length > 0) {
-                    pwd = pwd.slice(0, -1);
-                    process.stdout.write('\b \b');
-                  }
-                } else {
-                  pwd += char;
-                  process.stdout.write('*');
-                }
-              });
-            });
-            rl.close();
-          } else {
-            password = await new Promise((resolve) => {
-              rl.question('Enter new password: ', (answer) => {
-                rl.close();
-                resolve(answer);
-              });
-            });
-          }
+          const answers = await inquirer.prompt([
+            {
+              type: 'password',
+              name: 'password',
+              message: 'Enter new password:',
+              mask: '*',
+            },
+          ]);
+          password = answers.password;
         }
         
         if (!password || password.length < 6) {
@@ -121,8 +85,8 @@ function registerCommand(program) {
           process.exit(1);
         }
         
-        // Hash the password
-        const hashedPassword = await bcrypt.hash(password, 10);
+        // Hash the password (same rounds as admin panel setup)
+        const hashedPassword = await hash(password, 10);
         
         // Update the password
         await db('admin_users')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.75",
+  "version": "0.0.76",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",

package/templates/skills/webspresso-usage/REFERENCE-framework.md

@@ -169,6 +169,7 @@ Analytics plugin adds `fsy.analyticsHead`, `fsy.verificationTags`, etc., when co
 - **Relations:** `belongsTo`, `hasMany`, `hasOne` with `model: () => OtherModel`.
 - **Scopes:** `softDelete`, `timestamps`, optional `tenant` column.
 - **`hidden`:** columns never exposed in admin/API (e.g. `password_hash`).
+- **`zdb.file()`:** varchar column for uploaded asset URL/path; admin forms render a file upload widget when `uploadPlugin` is registered (or `adminPanelPlugin({ uploadUrl })`). Optional `ui: { label, accept, maxBytes }`. For `zdb.string()` columns use `admin.customFields: { col: { type: 'file-upload' } }`.
 - **Nanoid PK:** `zdb.nanoid()` / `zdb.nanoid({ maxLength: 12 })` — string primary key; migrations use `string(length)`. On **`create()`**, omitting the PK auto-fills a URL-safe id (built-in generator, same alphabet as `nanoid`). Use **`zdb.foreignNanoid('table', { maxLength })`** when the parent uses nanoid PKs; **`generateNanoid`** is exported from `webspresso` for manual ids. In API **`schema`**, use **`z.nanoid()`** / **`z.nanoid(12)`** / **`z.nanoid({ maxLength })`** (the `z` from `schema: ({ z })` is extended by Webspresso). **`zodNanoid`** / **`extendZ`** are also exported for non-route use.
 
 **Database:** `createDatabase({ client, connection, models: './models' })` — auto-loads `models/*.js` (ignore `_prefix`).
@@ -197,7 +198,7 @@ Pass **`db`** into **`createApp({ db })`** so **`ctx.db`** works in pages and pl
 | `adminPanelPlugin` | SPA admin CRUD — needs **`db`**; optional **`uploadUrl`** (or infer from **`uploadPlugin`**); optional **`userManagement: { enabled, model, fields }`** + **`auth`** (same **`AuthManager`** as **`createApp({ auth })`**) for site-user CRUD + remember-me session UI — see **Session authentication** above |
 | `dataExchangePlugin` | Admin-only **Excel export** + **CSV/XLSX import** under `${adminPath}/api/data-exchange/*`; register **after** `adminPanelPlugin` with same `db` / `adminPath`; optional `maxRows`, `maxFileBytes`; adds UI buttons + bulk `export-xlsx` |
 | `redirectPlugin` | Configurable **301–308** redirects in `register()` — runs **before** file-based SSR routes; `rules` (`from` path or `RegExp`, `to`, `status`, `methods`), `preserveQuery`, `allowExternal`, `trailingSlash`, `defaultMethods`; docs **[`doc/index.html#plugins-redirect`](../../../doc/index.html#plugins-redirect)**, README **Redirect plugin** |
-| `uploadPlugin` | `POST` multipart (`multer`), `createLocalFileProvider` or custom `provider`; set **`mimeAllowlist`** / **`maxBytes`** in production |
+| `uploadPlugin` | `POST` multipart (`multer`), `createLocalFileProvider` or custom `provider`; set **`mimeAllowlist`** / **`maxBytes`** in production; pairs with admin **`zdb.file()`** / **`customFields.file-upload`** when registered before **`adminPanelPlugin`** |
 | `siteAnalyticsPlugin` | Self-hosted page views + admin charts |
 | `auditLogPlugin` | Admin mutation audit trail |
 | `recaptchaPlugin` | v2/v3 + middleware |