webspresso 0.0.80 → 0.0.82

package/core/auth/tokens.js

@@ -0,0 +1,135 @@
+/**
+ * Auth token types and helpers (password reset, email verification)
+ * @module core/auth/tokens
+ */
+
+const { generateToken, hashToken, hash } = require('./hash');
+
+const TOKEN_TYPES = {
+  PASSWORD_RESET: 'password_reset',
+  EMAIL_VERIFY: 'email_verify',
+};
+
+/**
+ * @param {import('knex').Knex} knex
+ * @returns {Promise<void>}
+ */
+async function createAuthTokensTable(knex) {
+  const exists = await knex.schema.hasTable('auth_tokens');
+  if (exists) return;
+
+  await knex.schema.createTable('auth_tokens', (table) => {
+    table.bigIncrements('id').primary();
+    table.bigInteger('user_id').unsigned().notNullable();
+    table.string('token', 64).notNullable().unique();
+    table.string('type', 32).notNullable();
+    table.timestamp('expires_at').notNullable();
+    table.timestamp('created_at').defaultTo(knex.fn.now());
+
+    table.index(['user_id', 'type']);
+    table.index('token');
+    table.index('expires_at');
+  });
+}
+
+/**
+ * @param {import('knex').Knex} knex
+ * @returns {Promise<void>}
+ */
+async function dropAuthTokensTable(knex) {
+  await knex.schema.dropTableIfExists('auth_tokens');
+}
+
+/**
+ * Create Knex auth_tokens adapter
+ * @param {Object} db - Database with knex
+ * @returns {Object}
+ */
+function createKnexAuthTokensAdapter(db) {
+  const knex = db.knex || db;
+
+  return {
+    create: async (userId, tokenHash, type, expiresAt) => {
+      await knex('auth_tokens').insert({
+        user_id: userId,
+        token: tokenHash,
+        type,
+        expires_at: expiresAt,
+        created_at: new Date(),
+      });
+    },
+    find: async (tokenHash, type) => {
+      return knex('auth_tokens').where({ token: tokenHash, type }).first();
+    },
+    delete: async (tokenHash) => {
+      await knex('auth_tokens').where({ token: tokenHash }).delete();
+    },
+    deleteAllForUser: async (userId, type) => {
+      const q = knex('auth_tokens').where({ user_id: userId });
+      if (type) q.where({ type });
+      await q.delete();
+    },
+  };
+}
+
+/**
+ * @param {Object} authTokensAdapter
+ * @param {string} type
+ * @param {*} userId
+ * @param {number} ttlMs
+ * @returns {Promise<{ rawToken: string, expiresAt: Date }>}
+ */
+async function createAuthToken(authTokensAdapter, type, userId, ttlMs) {
+  const rawToken = generateToken(32);
+  const tokenHash = hashToken(rawToken);
+  const expiresAt = new Date(Date.now() + ttlMs);
+
+  await authTokensAdapter.deleteAllForUser(userId, type);
+  await authTokensAdapter.create(userId, tokenHash, type, expiresAt);
+
+  return { rawToken, expiresAt };
+}
+
+/**
+ * @param {Object} authTokensAdapter
+ * @param {string} type
+ * @param {string} rawToken
+ * @returns {Promise<{ userId: *, expiresAt: Date }|null>}
+ */
+async function verifyAuthToken(authTokensAdapter, type, rawToken) {
+  if (!rawToken) return null;
+
+  const tokenHash = hashToken(rawToken);
+  const record = await authTokensAdapter.find(tokenHash, type);
+  if (!record) return null;
+
+  if (new Date(record.expires_at) < new Date()) {
+    await authTokensAdapter.delete(tokenHash);
+    return null;
+  }
+
+  return {
+    userId: record.user_id,
+    expiresAt: new Date(record.expires_at),
+    tokenHash,
+  };
+}
+
+/**
+ * @param {Object} authTokensAdapter
+ * @param {string} tokenHash
+ */
+async function consumeAuthToken(authTokensAdapter, tokenHash) {
+  await authTokensAdapter.delete(tokenHash);
+}
+
+module.exports = {
+  TOKEN_TYPES,
+  createAuthTokensTable,
+  dropAuthTokensTable,
+  createKnexAuthTokensAdapter,
+  createAuthToken,
+  verifyAuthToken,
+  consumeAuthToken,
+  hash,
+};

package/core/kernel/app.js

@@ -50,7 +50,13 @@ function createApp(options = {}) {
       }
     };
     events.on(flowDef.trigger, handler);
-    const unregister = () => events.off(flowDef.trigger, handler);
+    const unregister = () => {
+      events.off(flowDef.trigger, handler);
+      const idx = flowHandles.findIndex((h) => h.unregister === unregister);
+      if (idx !== -1) {
+        flowHandles.splice(idx, 1);
+      }
+    };
     flowHandles.push({
       id,
       trigger: flowDef.trigger,

package/index.d.ts

@@ -74,6 +74,15 @@ export interface CreateAppResult {
 
 export function createApp(options?: CreateAppOptions): CreateAppResult;
 
+export function resolveClientRuntime(options?: {
+  clientRuntime?: {
+    alpine?: boolean | Record<string, unknown>;
+    swup?: boolean | Record<string, unknown>;
+  };
+}): { alpine: boolean; swup: boolean };
+
+export const CLIENT_RUNTIME_BASE: string;
+
 // --- App context ---
 
 export function attachDbMiddleware(req: Request, res: Response, next: NextFunction): void;
@@ -595,6 +604,29 @@ export interface RateLimitPluginOptions {
 
 export function rateLimitPlugin(options?: RateLimitPluginOptions): WebspressoPlugin;
 
+export interface CsrfCookieOptions {
+  key?: string;
+  signed?: boolean;
+  path?: string;
+  httpOnly?: boolean;
+  secure?: boolean;
+  sameSite?: 'lax' | 'strict' | 'none';
+  maxAge?: number;
+  [key: string]: unknown;
+}
+
+export interface CsrfPluginOptions {
+  cookie?: boolean | CsrfCookieOptions;
+  sessionKey?: string;
+  methods?: string[];
+  ignorePaths?: Array<string | RegExp | ((req: Request) => boolean)>;
+  global?: boolean;
+  errorMessage?: string;
+  errorStatus?: number;
+}
+
+export function csrfPlugin(options?: CsrfPluginOptions): WebspressoPlugin;
+
 export interface ContentPluginOptions {
   db: import('./index').Database;
   adminPath?: string;

package/index.js

@@ -63,6 +63,7 @@ const {
   redirectPlugin,
   rateLimitPlugin,
   contentPlugin,
+  csrfPlugin,
 } = require('./plugins');
 
 const content = require('./core/content');
@@ -133,6 +134,7 @@ module.exports = {
   redirectPlugin,
   rateLimitPlugin,
   contentPlugin,
+  csrfPlugin,
 
   // Schema-driven CMS core (framework-agnostic)
   content,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.80",
+  "version": "0.0.82",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",
@@ -67,7 +67,9 @@
     "helmet": "^7.2.0",
     "inquirer": "^8.2.6",
     "knex": "^3.1.0",
+    "mjml": "^5.4.0",
     "multer": "^2.1.1",
+    "nodemailer": "^9.0.3",
     "nunjucks": "^3.2.4",
     "sanitize-html": "^2.17.3",
     "sharp": "^0.33.5",
@@ -125,6 +127,7 @@
   "overrides": {
     "basic-ftp": "^5.3.0",
     "tar": "^7.5.11",
-    "undici": "^6.24.0"
+    "undici": "^6.24.0",
+    "uuid": "^11.1.1"
   }
 }

package/plugins/admin-panel/app.js

@@ -221,6 +221,47 @@ var routes = {
   },
 };
 
+function wrapCustomPageWithLayout(page, rawComp) {
+  if (!rawComp) return createCustomPage(page);
+  if (page.layout === false) return rawComp;
+
+  return {
+    oninit: function(vnode) {
+      if (typeof rawComp.oninit === 'function') return rawComp.oninit.call(this, vnode);
+    },
+    oncreate: function(vnode) {
+      if (typeof rawComp.oncreate === 'function') return rawComp.oncreate.call(this, vnode);
+    },
+    onupdate: function(vnode) {
+      if (typeof rawComp.onupdate === 'function') return rawComp.onupdate.call(this, vnode);
+    },
+    onbeforeremove: function(vnode) {
+      if (typeof rawComp.onbeforeremove === 'function') return rawComp.onbeforeremove.call(this, vnode);
+    },
+    onremove: function(vnode) {
+      if (typeof rawComp.onremove === 'function') return rawComp.onremove.call(this, vnode);
+    },
+    view: function(vnode) {
+      var content;
+      if (typeof rawComp.view === 'function') {
+        content = rawComp.view.call(this, vnode);
+      } else if (typeof rawComp === 'function') {
+        content = rawComp.call(this, vnode);
+      } else {
+        content = rawComp;
+      }
+      if (content && (content.tag === Layout || (content.tag && content.tag.name === 'Layout'))) {
+        return content;
+      }
+      var breadcrumbs = [{ label: page.title, href: page.path }];
+      return m(Layout, [
+        m(Breadcrumb, { items: breadcrumbs }),
+        content
+      ]);
+    }
+  };
+}
+
 // Dynamic routes for custom pages registered via plugins
 var config = window.__ADMIN_CONFIG__;
 if (config && config.pages) {
@@ -234,7 +275,7 @@ if (config && config.pages) {
             return;
           }
           if (window.__customPages && window.__customPages[page.id]) {
-            return window.__customPages[page.id];
+            return wrapCustomPageWithLayout(page, window.__customPages[page.id]);
           }
           return createCustomPage(page);
         }
@@ -245,3 +286,4 @@ if (config && config.pages) {
 
 m.route(document.getElementById('app'), '/', routes);
 `;
+

package/plugins/admin-panel/core/admin-module.js

@@ -1,25 +1,118 @@
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * Format client component code to ensure it assigns to window.__customPages[pageId]
+ */
+function formatClientComponent(pageId, rawCode) {
+  let code = (rawCode || '').trim();
+  if (!code) return '';
+  if (code.includes('window.__customPages')) {
+    return code;
+  }
+  if (code.startsWith('module.exports =')) {
+    code = code.replace(/^module\.exports\s*=\s*/, '');
+  }
+  if (code.endsWith(';')) {
+    code = code.slice(0, -1);
+  }
+  return `window.__customPages = window.__customPages || {};\nwindow.__customPages[${JSON.stringify(pageId)}] = ${code};`;
+}
+
 /**
- * Admin Module Registration System
- * Declarative API for registering admin pages, menu items, API routes, and widgets
- * @module plugins/admin-panel/core/admin-module
+ * Load page definitions and components from a directory structure
  */
+function loadPagesFromDir(dirPath) {
+  const resolvedDir = path.resolve(dirPath);
+  if (!fs.existsSync(resolvedDir)) {
+    throw new Error(`pagesDir directory not found: ${dirPath}`);
+  }
+  const stat = fs.statSync(resolvedDir);
+  if (!stat.isDirectory()) {
+    throw new Error(`pagesDir path is not a directory: ${dirPath}`);
+  }
+
+  const entries = fs.readdirSync(resolvedDir, { withFileTypes: true });
+  const pages = [];
+  const menuItems = [];
+
+  for (const entry of entries) {
+    if (entry.name.startsWith('.')) continue;
+
+    let pageConfig = null;
+    let componentFile = null;
+
+    if (entry.isDirectory()) {
+      const folderPath = path.join(resolvedDir, entry.name);
+      const jsonCandidate = path.join(folderPath, 'page.json');
+      const configJsonCandidate = path.join(folderPath, 'config.json');
+
+      if (fs.existsSync(jsonCandidate)) {
+        pageConfig = JSON.parse(fs.readFileSync(jsonCandidate, 'utf8'));
+      } else if (fs.existsSync(configJsonCandidate)) {
+        pageConfig = JSON.parse(fs.readFileSync(configJsonCandidate, 'utf8'));
+      } else {
+        pageConfig = { id: entry.name, title: entry.name, path: '/' + entry.name };
+      }
+
+      const jsCandidates = ['component.js', 'index.js', 'page.js', `${entry.name}.js`];
+      for (const cand of jsCandidates) {
+        const fullCandPath = path.join(folderPath, cand);
+        if (fs.existsSync(fullCandPath)) {
+          componentFile = fullCandPath;
+          break;
+        }
+      }
+    } else if (entry.isFile() && entry.name.endsWith('.json')) {
+      const jsonPath = path.join(resolvedDir, entry.name);
+      pageConfig = JSON.parse(fs.readFileSync(jsonPath, 'utf8'));
+      const baseName = entry.name.slice(0, -5);
+      const jsCandidate = path.join(resolvedDir, baseName + '.js');
+      if (fs.existsSync(jsCandidate)) {
+        componentFile = jsCandidate;
+      }
+    }
+
+    if (pageConfig) {
+      if (componentFile && !pageConfig.componentFile) {
+        pageConfig.componentFile = componentFile;
+      }
+      if (pageConfig.menu) {
+        if (pageConfig.menu === true) {
+          menuItems.push({
+            id: pageConfig.id,
+            label: pageConfig.title,
+            path: pageConfig.path,
+            icon: pageConfig.icon,
+          });
+        } else if (typeof pageConfig.menu === 'object') {
+          menuItems.push({
+            id: pageConfig.id,
+            label: pageConfig.title,
+            path: pageConfig.path,
+            icon: pageConfig.icon,
+            ...pageConfig.menu,
+          });
+        }
+      }
+      pages.push(pageConfig);
+    }
+  }
+
+  return { pages, menuItems };
+}
 
 /**
  * Register an admin module with all its components in a single declarative call
  * @param {Object} config - Module configuration
  * @param {string} config.id - Unique module identifier (required)
  * @param {Array} [config.pages] - Custom admin pages
+ * @param {string} [config.pagesDir] - Directory path containing page folders/configs
  * @param {Array} [config.menu] - Sidebar menu items
  * @param {Object} [config.menuGroups] - Menu group definitions
  * @param {Object} [config.api] - API endpoint definitions
  * @param {Array} [config.widgets] - Dashboard widgets
  * @param {Object} deps - Internal dependencies injected by admin-panel
- * @param {Object} deps.registry - AdminRegistry instance
- * @param {string} deps.adminPath - Admin panel base path
- * @param {Object} deps.ctx - Plugin context
- * @param {Function} deps.requireAuth - Auth middleware
- * @param {Function} deps.optionalAuth - Optional auth middleware
- * @param {Function} deps.serveAdminPanel - SPA HTML handler
  */
 function registerModule(config, deps) {
   if (!config || typeof config !== 'object') {
@@ -36,14 +129,36 @@ function registerModule(config, deps) {
     registerMenuGroups(config.menuGroups, registry);
   }
 
-  if (config.pages) {
-    registerPages(config.id, config.pages, { registry, adminPath, ctx, optionalAuth, serveAdminPanel });
+  if (config.pages !== undefined) {
+    if (!Array.isArray(config.pages)) {
+      throw new Error(`Module "${config.id}": pages must be an array`);
+    }
+  }
+
+  if (config.menu !== undefined) {
+    if (!Array.isArray(config.menu)) {
+      throw new Error('menu must be an array');
+    }
+  }
+
+  let pagesList = config.pages ? [...config.pages] : [];
+  let menuList = config.menu ? [...config.menu] : [];
+
+  if (config.pagesDir) {
+    const { pages: dirPages, menuItems: dirMenuItems } = loadPagesFromDir(config.pagesDir);
+    pagesList = pagesList.concat(dirPages);
+    menuList = menuList.concat(dirMenuItems);
   }
 
-  if (config.menu) {
-    registerMenuItems(config.menu, registry);
+  if (pagesList.length > 0) {
+    registerPages(config.id, pagesList, { registry, adminPath, ctx, optionalAuth, serveAdminPanel });
   }
 
+  if (menuList.length > 0) {
+    registerMenuItems(menuList, registry);
+  }
+
+
   if (config.api) {
     registerApiRoutes(config.id, config.api, { adminPath, ctx, requireAuth, optionalAuth });
   }
@@ -53,6 +168,20 @@ function registerModule(config, deps) {
   }
 }
 
+/**
+ * Register custom admin pages from a directory directly
+ * @param {string} dirPath - Directory path containing custom page folders/configs
+ * @param {Object} deps - Dependencies injected by admin-panel
+ */
+function registerPageDir(dirPath, deps) {
+  const { pages, menuItems } = loadPagesFromDir(dirPath);
+  const moduleId = path.basename(dirPath);
+  registerPages(moduleId, pages, deps);
+  if (menuItems.length > 0) {
+    registerMenuItems(menuItems, deps.registry);
+  }
+}
+
 function registerPages(moduleId, pages, deps) {
   if (!Array.isArray(pages)) {
     throw new Error(`Module "${moduleId}": pages must be an array`);
@@ -73,10 +202,20 @@ function registerPages(moduleId, pages, deps) {
       icon: page.icon,
       description: page.description,
       permission: page.permission,
+      layout: page.layout !== undefined ? page.layout : true,
     });
 
-    if (page.component) {
-      registry.registerClientComponent(pageId, page.component);
+    if (page.componentFile) {
+      const resolvedPath = path.resolve(page.componentFile);
+      if (!fs.existsSync(resolvedPath)) {
+        throw new Error(`Module "${moduleId}", page "${pageId}": componentFile not found at ${page.componentFile}`);
+      }
+      const rawCode = fs.readFileSync(resolvedPath, 'utf8');
+      const formattedCode = formatClientComponent(pageId, rawCode);
+      registry.registerClientComponent(pageId, formattedCode);
+    } else if (page.component) {
+      const formattedCode = formatClientComponent(pageId, page.component);
+      registry.registerClientComponent(pageId, formattedCode);
     }
 
     ctx.addRoute('get', `${adminPath}${page.path}`, optionalAuth, serveAdminPanel);
@@ -143,4 +282,5 @@ function registerWidgets(widgets, registry) {
   }
 }
 
-module.exports = { registerModule };
+module.exports = { registerModule, registerPageDir, loadPagesFromDir, formatClientComponent };
+

package/plugins/admin-panel/core/registry.js

@@ -412,9 +412,12 @@ class AdminRegistry {
         title: p.title,
         path: p.path,
         icon: p.icon,
+        description: p.description,
         permission: p.permission,
+        layout: p.layout !== undefined ? p.layout : true,
         hasClientComponent: this.clientComponents.has(p.id),
       })),
+
       widgets: this.getWidgets().map(w => ({
         id: w.id,
         title: w.title,

package/plugins/admin-panel/field-renderers/file-upload.js

@@ -223,6 +223,8 @@ module.exports = {
   FilesUploadField: {
     oninit: (vnode) => {
       vnode.state.uploading = false;
+      vnode.state.draggedIndex = null;
+      vnode.state.dragOverIndex = null;
     },
     oncreate: (vnode) => {
       const { name, meta = {} } = vnode.attrs;
@@ -298,19 +300,63 @@ module.exports = {
 
         urls.length > 0
           ? m('.grid.grid-cols-2.sm:grid-cols-3.md:grid-cols-4.gap-4.mb-3', urls.map((url, idx) => {
-              return m('.relative.group.border.border-gray-200.dark:border-slate-700.rounded-lg.p-2.bg-gray-50.dark:bg-slate-900', [
+              const isDragOver = state.dragOverIndex === idx;
+              const baseClasses = '.relative.group.border.rounded-lg.p-2.transition-all';
+              const cursorClass = readonly ? '' : '.cursor-move';
+              const borderClasses = isDragOver ? '.border-blue-500.border-2.dark:border-blue-500' : '.border-gray-200.dark:border-slate-700';
+              const bgClasses = isDragOver ? '.bg-blue-50.dark:bg-slate-800' : '.bg-gray-50.dark:bg-slate-900';
+              
+              return m(baseClasses + cursorClass + borderClasses + bgClasses, {
+                draggable: !readonly,
+                ondragstart: (e) => {
+                  state.draggedIndex = idx;
+                  e.dataTransfer.effectAllowed = 'move';
+                  e.dataTransfer.setData('text/plain', idx);
+                },
+                ondragover: (e) => {
+                  e.preventDefault();
+                  e.dataTransfer.dropEffect = 'move';
+                },
+                ondragenter: (e) => {
+                  state.dragOverIndex = idx;
+                },
+                ondragleave: (e) => {
+                  if (state.dragOverIndex === idx) {
+                    state.dragOverIndex = null;
+                  }
+                },
+                ondrop: (e) => {
+                  e.preventDefault();
+                  const fromIdx = state.draggedIndex;
+                  const toIdx = idx;
+                  if (fromIdx !== null && fromIdx !== undefined && fromIdx !== toIdx) {
+                    const newUrls = [...urls];
+                    const [movedItem] = newUrls.splice(fromIdx, 1);
+                    newUrls.splice(toIdx, 0, movedItem);
+                    if (vnode.attrs.onchange) vnode.attrs.onchange(newUrls);
+                  }
+                  state.draggedIndex = null;
+                  state.dragOverIndex = null;
+                },
+                ondragend: (e) => {
+                  state.draggedIndex = null;
+                  state.dragOverIndex = null;
+                }
+              }, [
                 shouldShowImagePreview(url, accept)
-                  ? m('a.block', { href: url, target: '_blank', rel: 'noopener noreferrer' },
+                  ? m('a.block', { href: url, target: '_blank', rel: 'noopener noreferrer', draggable: false },
                       m('img.h-32.w-full.rounded.object-contain.bg-white.dark:bg-slate-950', {
                         src: url,
                         alt: `${label} ${idx + 1}`,
                         loading: 'lazy',
+                        draggable: false,
                       })
                     )
                   : m('a.flex.items-center.justify-center.h-32.w-full.text-sm.text-indigo-600.dark:text-indigo-400.break-all.p-2', {
                       href: url,
                       target: '_blank',
                       rel: 'noopener noreferrer',
+                      draggable: false,
                     }, url.substring(url.lastIndexOf('/') + 1) || url),
                 !readonly
                   ? m('button.absolute.top-1.right-1.bg-red-500.text-white.rounded-full.p-1.shadow-md.opacity-0.group-hover:opacity-100.hover:bg-red-700.transition-opacity', {

package/plugins/admin-panel/index.js

@@ -15,7 +15,8 @@ const { registerDashboardWidgets, generateDashboardComponent } = require('./modu
 const { registerDefaultBulkActions, generateBulkActionsComponent } = require('./modules/bulk-actions');
 const { registerDefaultPages, createCustomPageApiHandlers, generateCustomPageComponent } = require('./modules/custom-pages');
 const { registerModelMenuItems, registerSystemMenuItems, generateMenuComponent } = require('./modules/menu');
-const { registerModule } = require('./core/admin-module');
+const { registerModule, registerPageDir } = require('./core/admin-module');
+
 
 /**
  * Admin Panel Plugin Factory
@@ -105,6 +106,21 @@ function adminPanelPlugin(options = {}) {
           serveAdminPanel,
         });
       },
+      registerPageDir(dirPath) {
+        const ctx = this.api?._ctx ?? this._ctx;
+        if (!ctx) {
+          throw new Error('registerPageDir can only be called during or after onRoutesReady');
+        }
+        return registerPageDir(dirPath, {
+          registry,
+          adminPath,
+          ctx,
+          requireAuth,
+          optionalAuth,
+          serveAdminPanel,
+        });
+      },
+
       _ctx: null,
     },