webspresso 0.0.83 → 0.0.85

package/core/auth/middleware.js

@@ -28,7 +28,7 @@ function createAuthMiddleware(authManager) {
 
   /**
    * Authenticate middleware
-   * Loads user from session or remember me token
+   * Loads user from Bearer JWT header, session, or remember me token
    * Should run on every request
    */
   async function authenticate(req, res, next) {
@@ -39,8 +39,27 @@ function createAuthMiddleware(authManager) {
       // Create request-bound auth helper
       req.auth = authManager.createRequestAuth(req, res);
 
-      // Try to load user from session
-      if (req.session?.userId) {
+      // Check Bearer JWT token header first
+      const authHeader = req.headers?.authorization || req.headers?.Authorization;
+      if (authHeader && authHeader.startsWith('Bearer ')) {
+        const token = authHeader.substring(7).trim();
+        try {
+          const payload = authManager.verifyJwt(token);
+          req.token = token;
+          req.jwtPayload = payload;
+          if (payload.id) {
+            const user = await authManager.findUserById(payload.id);
+            req.user = user || payload;
+          } else {
+            req.user = payload;
+          }
+        } catch (jwtErr) {
+          // Invalid or expired JWT token header
+        }
+      }
+
+      // Try to load user from session if not authenticated by JWT
+      if (!req.user && req.session?.userId) {
         const user = await authManager.findUserById(req.session.userId);
         if (user) {
           req.user = user;
@@ -50,7 +69,7 @@ function createAuthMiddleware(authManager) {
         }
       }
 
-      // If no user in session, try remember me token
+      // If no user in session or JWT, try remember me token
       if (!req.user && authManager.rememberTokens) {
         const user = await authManager.verifyRememberToken(req, res);
         if (user) {
@@ -96,6 +115,44 @@ function createAuthMiddleware(authManager) {
     };
   }
 
+  /**
+   * Require JWT middleware
+   * Enforces valid Bearer JWT token in Authorization header
+   * @param {Object} [options] - Verification options
+   */
+  function requireJwt(options = {}) {
+    return async (req, res, next) => {
+      const authHeader = req.headers?.authorization || req.headers?.Authorization;
+      if (!authHeader || !authHeader.startsWith('Bearer ')) {
+        return res.status(401).json({
+          error: 'Unauthorized',
+          message: 'Bearer token required',
+        });
+      }
+
+      const token = authHeader.substring(7).trim();
+      try {
+        const payload = authManager.verifyJwt(token, options);
+        req.token = token;
+        req.jwtPayload = payload;
+
+        if (payload.id) {
+          const user = await authManager.findUserById(payload.id);
+          req.user = user || payload;
+        } else {
+          req.user = payload;
+        }
+
+        next();
+      } catch (err) {
+        return res.status(401).json({
+          error: 'Unauthorized',
+          message: err.message || 'Invalid JWT token',
+        });
+      }
+    };
+  }
+
   /**
    * Require guest middleware
    * Redirects authenticated users away
@@ -192,6 +249,9 @@ function createAuthMiddleware(authManager) {
       case 'auth':
         return requireAuth({ api: args.includes('api') });
       
+      case 'jwt':
+        return requireJwt();
+      
       case 'guest':
         return requireGuest();
       
@@ -216,6 +276,7 @@ function createAuthMiddleware(authManager) {
     
     // Guard middleware
     requireAuth,
+    requireJwt,
     requireGuest,
     requireCan,
     requireVerified,
@@ -225,6 +286,7 @@ function createAuthMiddleware(authManager) {
     
     // Aliases for route config (factories — file-router calls requireAuth(opts) / requireGuest(opts))
     auth: requireAuth,
+    jwt: requireJwt,
     guest: requireGuest,
   };
 }

package/index.d.ts

@@ -567,6 +567,28 @@ export function swaggerPlugin(options?: Record<string, unknown>): WebspressoPlug
 
 export function healthCheckPlugin(options?: Record<string, unknown>): WebspressoPlugin;
 
+export interface CorsPluginOptions {
+  origin?:
+    | string
+    | string[]
+    | RegExp
+    | ((
+        origin: string,
+        callback: (err: Error | null, allow?: boolean | string) => void
+      ) => void);
+  methods?: string | string[];
+  allowedHeaders?: string | string[];
+  exposedHeaders?: string | string[];
+  credentials?: boolean;
+  maxAge?: number;
+  preflightContinue?: boolean;
+  optionsSuccessStatus?: number;
+  routes?: string | string[] | boolean;
+  global?: boolean;
+}
+
+export function corsPlugin(options?: CorsPluginOptions): WebspressoPlugin;
+
 export interface RedirectRule {
   from: string | RegExp;
   to: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.83",
+  "version": "0.0.85",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",
@@ -72,7 +72,7 @@
     "nodemailer": "^9.0.3",
     "nunjucks": "^3.2.4",
     "sanitize-html": "^2.17.3",
-    "sharp": "^0.33.5",
+    "sharp": "^0.35.3",
     "swup": "^4.8.3",
     "yaml": "^2.8.3",
     "zod": "^3.23.0",
@@ -116,7 +116,7 @@
     "chokidar": "^3.5.3",
     "dotenv": "^16.3.1",
     "express-rate-limit": "^8.4.1",
-    "release-it": "^19.0.0",
+    "release-it": "^20.2.1",
     "supertest": "^6.3.4",
     "typescript": "~5.6.3",
     "vitest": "^3.0.0"

package/plugins/admin-panel/api.js

@@ -161,6 +161,78 @@ function createApiHandlers(options) {
     }
   }
 
+  /**
+   * Update current user profile
+   */
+  async function updateProfileHandler(req, res) {
+    try {
+      if (!req.session || !req.session.adminUser) {
+        return res.status(401).json({ error: 'Not authenticated' });
+      }
+
+      const userId = req.session.adminUser.id;
+      const { name, email, currentPassword, newPassword } = req.body || {};
+
+      if (!AdminUserRepo) {
+        return res.status(500).json({ error: 'Admin user system not initialized' });
+      }
+
+      const user = await AdminUserRepo.findById(userId);
+      if (!user) {
+        return res.status(404).json({ error: 'User not found' });
+      }
+
+      const updateData = {};
+
+      if (name && typeof name === 'string' && name.trim()) {
+        updateData.name = name.trim();
+      }
+
+      if (email && typeof email === 'string' && email.trim() && email.trim() !== user.email) {
+        const existing = await AdminUserRepo.query().where('email', email.trim()).whereNot('id', userId).first();
+        if (existing) {
+          return res.status(400).json({ error: 'Email is already in use by another user' });
+        }
+        updateData.email = email.trim();
+      }
+
+      if (newPassword) {
+        if (!currentPassword) {
+          return res.status(400).json({ error: 'Current password is required to set a new password' });
+        }
+        if (!comparePassword) {
+          return res.status(500).json({ error: 'Password comparison helper not available' });
+        }
+        const isValid = await comparePassword(currentPassword, user.password);
+        if (!isValid) {
+          return res.status(400).json({ error: 'Current password is incorrect' });
+        }
+        if (typeof newPassword !== 'string' || newPassword.length < 6) {
+          return res.status(400).json({ error: 'New password must be at least 6 characters long' });
+        }
+        updateData.password = await hashPassword(newPassword, 10);
+      }
+
+      if (Object.keys(updateData).length > 0) {
+        await AdminUserRepo.update(userId, updateData);
+      }
+
+      const updatedUser = await AdminUserRepo.findById(userId);
+      const sanitized = sanitizeForOutput(updatedUser, getModelFromDb('AdminUser') || { hidden: ['password'] });
+      if (sanitized) delete sanitized.password;
+
+      req.session.adminUser = {
+        ...req.session.adminUser,
+        name: updatedUser.name,
+        email: updatedUser.email,
+      };
+
+      res.json({ success: true, user: sanitized });
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  }
+
   /**
    * Get all models (admin enabled)
    */
@@ -680,6 +752,7 @@ function createApiHandlers(options) {
     loginHandler,
     logoutHandler,
     meHandler,
+    updateProfileHandler,
     modelsHandler,
     modelHandler,
     recordsListHandler,

package/plugins/admin-panel/app.js

@@ -161,6 +161,16 @@ var routes = {
       return SettingsPage;
     }
   },
+  '/profile': {
+    onmatch: async () => {
+      const isAuth = await checkAuth();
+      if (!isAuth) {
+        redirectToLogin();
+        return;
+      }
+      return ProfilePage;
+    }
+  },
   '/users/sessions': {
     onmatch: async () => {
       if (!(await guardUserManagementRoutes())) return;
@@ -274,20 +284,28 @@ function wrapCustomPageWithLayout(page, rawComp) {
 var config = window.__ADMIN_CONFIG__;
 if (config && config.pages) {
   config.pages.forEach(function(page) {
-    if (!routes[page.path]) {
-      routes[page.path] = {
-        onmatch: async () => {
-          const isAuth = await checkAuth();
-          if (!isAuth) {
-            redirectToLogin();
-            return;
-          }
-          if (window.__customPages && window.__customPages[page.id]) {
-            return wrapCustomPageWithLayout(page, window.__customPages[page.id]);
-          }
-          return createCustomPage(page);
+    var normPath = page.path ? (page.path.startsWith('/') ? page.path : '/' + page.path) : '/';
+    var routeHandler = {
+      onmatch: async () => {
+        const isAuth = await checkAuth();
+        if (!isAuth) {
+          redirectToLogin();
+          return;
         }
-      };
+        const comp = (window.__customPages && window.__customPages[page.id])
+          ? wrapCustomPageWithLayout(page, window.__customPages[page.id])
+          : createCustomPage(page);
+        setTimeout(function() { m.redraw(); }, 10);
+        setTimeout(function() { m.redraw(); }, 100);
+        return comp;
+      }
+    };
+
+    if (!routes[normPath]) {
+      routes[normPath] = routeHandler;
+    }
+    if (normPath !== '/' && !routes[normPath + '/']) {
+      routes[normPath + '/'] = routeHandler;
     }
   });
 }

package/plugins/admin-panel/core/admin-module.js

@@ -41,6 +41,7 @@ function loadPagesFromDir(dirPath) {
 
     let pageConfig = null;
     let componentFile = null;
+    let htmlFile = null;
 
     if (entry.isDirectory()) {
       const folderPath = path.join(resolvedDir, entry.name);
@@ -63,13 +64,34 @@ function loadPagesFromDir(dirPath) {
           break;
         }
       }
+
+      if (!componentFile) {
+        const htmlCandidates = ['index.html', 'page.html', 'component.html', `${entry.name}.html`];
+        for (const cand of htmlCandidates) {
+          const fullCandPath = path.join(folderPath, cand);
+          if (fs.existsSync(fullCandPath)) {
+            htmlFile = fullCandPath;
+            break;
+          }
+        }
+      }
     } else if (entry.isFile() && entry.name.endsWith('.json')) {
       const jsonPath = path.join(resolvedDir, entry.name);
       pageConfig = JSON.parse(fs.readFileSync(jsonPath, 'utf8'));
       const baseName = entry.name.slice(0, -5);
       const jsCandidate = path.join(resolvedDir, baseName + '.js');
+      const htmlCandidate = path.join(resolvedDir, baseName + '.html');
       if (fs.existsSync(jsCandidate)) {
         componentFile = jsCandidate;
+      } else if (fs.existsSync(htmlCandidate)) {
+        htmlFile = htmlCandidate;
+      }
+    } else if (entry.isFile() && entry.name.endsWith('.html')) {
+      const baseName = entry.name.slice(0, -5);
+      const jsonCandidate = path.join(resolvedDir, baseName + '.json');
+      if (!fs.existsSync(jsonCandidate)) {
+        pageConfig = { id: baseName, title: baseName, path: '/' + baseName };
+        htmlFile = path.join(resolvedDir, entry.name);
       }
     }
 
@@ -77,6 +99,9 @@ function loadPagesFromDir(dirPath) {
       if (componentFile && !pageConfig.componentFile) {
         pageConfig.componentFile = componentFile;
       }
+      if (htmlFile && !pageConfig.htmlFile && !pageConfig.componentFile) {
+        pageConfig.htmlFile = htmlFile;
+      }
       if (pageConfig.menu) {
         if (pageConfig.menu === true) {
           menuItems.push({
@@ -129,6 +154,24 @@ function registerModule(config, deps) {
     registerMenuGroups(config.menuGroups, registry);
   }
 
+  if (config.scripts) {
+    if (!Array.isArray(config.scripts)) {
+      throw new Error(`Module "${config.id}": scripts must be an array`);
+    }
+    for (const s of config.scripts) {
+      registry.registerScript(s);
+    }
+  }
+
+  if (config.styles) {
+    if (!Array.isArray(config.styles)) {
+      throw new Error(`Module "${config.id}": styles must be an array`);
+    }
+    for (const s of config.styles) {
+      registry.registerStyle(s);
+    }
+  }
+
   if (config.pages !== undefined) {
     if (!Array.isArray(config.pages)) {
       throw new Error(`Module "${config.id}": pages must be an array`);
@@ -150,6 +193,27 @@ function registerModule(config, deps) {
     menuList = menuList.concat(dirMenuItems);
   }
 
+  for (const p of pagesList) {
+    if (p.menu && !menuList.some(m => m.id === p.id)) {
+      if (p.menu === true) {
+        menuList.push({
+          id: p.id,
+          label: p.title,
+          path: p.path,
+          icon: p.icon,
+        });
+      } else if (typeof p.menu === 'object') {
+        menuList.push({
+          id: p.id,
+          label: p.title,
+          path: p.path,
+          icon: p.icon,
+          ...p.menu,
+        });
+      }
+    }
+  }
+
   if (pagesList.length > 0) {
     registerPages(config.id, pagesList, { registry, adminPath, ctx, optionalAuth, serveAdminPanel });
   }
@@ -192,8 +256,13 @@ function registerPages(moduleId, pages, deps) {
   for (const page of pages) {
     const pageId = page.id || moduleId;
 
-    if (!page.title || !page.path) {
-      throw new Error(`Module "${moduleId}", page "${pageId}": requires title and path`);
+    let htmlContent = page.html || null;
+    if (page.htmlFile) {
+      const resolvedHtmlPath = path.resolve(page.htmlFile);
+      if (!fs.existsSync(resolvedHtmlPath)) {
+        throw new Error(`Module "${moduleId}", page "${pageId}": htmlFile not found at ${page.htmlFile}`);
+      }
+      htmlContent = fs.readFileSync(resolvedHtmlPath, 'utf8');
     }
 
     registry.registerPage(pageId, {
@@ -203,6 +272,8 @@ function registerPages(moduleId, pages, deps) {
       description: page.description,
       permission: page.permission,
       layout: page.layout !== undefined ? page.layout : true,
+      url: page.url || page.iframeUrl || undefined,
+      html: htmlContent || undefined,
     });
 
     if (page.componentFile) {
@@ -218,7 +289,8 @@ function registerPages(moduleId, pages, deps) {
       registry.registerClientComponent(pageId, formattedCode);
     }
 
-    ctx.addRoute('get', `${adminPath}${page.path}`, optionalAuth, serveAdminPanel);
+    const normPath = page.path.startsWith('/') ? page.path : '/' + page.path;
+    ctx.addRoute('get', `${adminPath}${normPath}`, optionalAuth, serveAdminPanel);
   }
 }
 

package/plugins/admin-panel/core/registry.js

@@ -46,6 +46,10 @@ class AdminRegistry {
 
     // Client components: JS code strings for custom page rendering
     this.clientComponents = new Map();
+
+    // Custom scripts & styles for Admin Panel SSR rendering
+    this.scripts = [];
+    this.styles = [];
     
     // Hooks: lifecycle hooks
     this.hooks = {
@@ -266,6 +270,66 @@ class AdminRegistry {
     return this;
   }
 
+  /**
+   * Register a custom script URL or definition
+   * @param {string|Object} script - Script URL string or config object { src, code, async, defer, type, position }
+   */
+  registerScript(script) {
+    if (!script) return this;
+    if (typeof script === 'string') {
+      this.scripts.push({ src: script, position: 'head' });
+    } else if (typeof script === 'object') {
+      this.scripts.push({ position: 'head', ...script });
+    }
+    return this;
+  }
+
+  /**
+   * Register a custom style URL or CSS definition
+   * @param {string|Object} style - Style URL string or config object { href, code, rel }
+   */
+  registerStyle(style) {
+    if (!style) return this;
+    if (typeof style === 'string') {
+      this.styles.push({ href: style, rel: 'stylesheet' });
+    } else if (typeof style === 'object') {
+      this.styles.push({ rel: 'stylesheet', ...style });
+    }
+    return this;
+  }
+
+  /**
+   * Get formatted HTML tags for registered styles
+   */
+  getStylesHtml() {
+    return this.styles.map(s => {
+      if (s.code) return `<style>${s.code}</style>`;
+      if (s.href) return `<link rel="${s.rel || 'stylesheet'}" href="${s.href}">`;
+      return '';
+    }).filter(Boolean).join('\n');
+  }
+
+  /**
+   * Get formatted HTML tags for registered scripts
+   * @param {string} [position] - Filter by position ('head' or 'body')
+   */
+  getScriptsHtml(position) {
+    return this.scripts
+      .filter(s => !position || s.position === position)
+      .map(s => {
+        if (s.code) return `<script>${s.code}</script>`;
+        if (s.src) {
+          const asyncAttr = s.async ? ' async' : '';
+          const deferAttr = s.defer ? ' defer' : '';
+          const typeAttr = s.type ? ` type="${s.type}"` : '';
+          return `<script src="${s.src}"${asyncAttr}${deferAttr}${typeAttr}></script>`;
+        }
+        return '';
+      })
+      .filter(Boolean)
+      .join('\n');
+  }
+
   /**
    * Register a client-side component for a custom page
    * @param {string} pageId - Page ID (must match a registered page)
@@ -415,6 +479,8 @@ class AdminRegistry {
         description: p.description,
         permission: p.permission,
         layout: p.layout !== undefined ? p.layout : true,
+        url: p.url || p.iframeUrl,
+        html: p.html,
         hasClientComponent: this.clientComponents.has(p.id),
       })),
 
@@ -460,6 +526,8 @@ class AdminRegistry {
     this.menuGroups.clear();
     this.fieldRenderers.clear();
     this.clientComponents.clear();
+    this.scripts = [];
+    this.styles = [];
     Object.keys(this.hooks).forEach(k => this.hooks[k] = []);
   }
 }

package/plugins/admin-panel/index.js

@@ -15,6 +15,7 @@ const { registerDashboardWidgets, generateDashboardComponent } = require('./modu
 const { registerDefaultBulkActions, generateBulkActionsComponent } = require('./modules/bulk-actions');
 const { registerDefaultPages, createCustomPageApiHandlers, generateCustomPageComponent } = require('./modules/custom-pages');
 const { registerModelMenuItems, registerSystemMenuItems, generateMenuComponent } = require('./modules/menu');
+const { generateProfileComponent } = require('./modules/profile');
 const { registerModule, registerPageDir } = require('./core/admin-module');
 
 
@@ -70,10 +71,15 @@ function adminPanelPlugin(options = {}) {
     version: '2.0.0',
     description: 'Modular admin panel for Webspresso with extensions support',
     
-    // CSP requirements for admin panel scripts
+    // CSP requirements for admin panel scripts, styles, and custom page iframe sources
     // Note: cdn.quilljs.com 301-redirects to cdn.jsdelivr.net; CSP is enforced on the final URL.
     csp: {
-      styleSrc: ['https://cdn.quilljs.com', 'https://cdn.jsdelivr.net'],
+      styleSrc: [
+        'https://cdn.quilljs.com',
+        'https://cdn.jsdelivr.net',
+        'https://unpkg.com',
+        'https://cdn.tailwindcss.com',
+      ],
       scriptSrc: [
         'https://cdn.quilljs.com',
         'https://cdn.jsdelivr.net',
@@ -81,6 +87,7 @@ function adminPanelPlugin(options = {}) {
         'https://cdn.tailwindcss.com',
       ],
       connectSrc: ['https://unpkg.com', 'https://cdn.tailwindcss.com', 'https://cdn.jsdelivr.net'],
+      frameSrc: ["'self'", 'data:', 'blob:', 'https:'],
     },
     enabled,
     registry, // Expose registry for external configuration
@@ -120,6 +127,12 @@ function adminPanelPlugin(options = {}) {
           serveAdminPanel,
         });
       },
+      registerScript(script) {
+        return registry.registerScript(script);
+      },
+      registerStyle(style) {
+        return registry.registerStyle(style);
+      },
 
       _ctx: null,
     },
@@ -252,6 +265,7 @@ function adminPanelPlugin(options = {}) {
       ctx.addRoute('post', `${adminPath}/api/auth/login`, apiHandlers.loginHandler);
       ctx.addRoute('post', `${adminPath}/api/auth/logout`, requireAuth, apiHandlers.logoutHandler);
       ctx.addRoute('get', `${adminPath}/api/auth/me`, requireAuth, apiHandlers.meHandler);
+      ctx.addRoute('put', `${adminPath}/api/auth/profile`, requireAuth, apiHandlers.updateProfileHandler);
 
       // Extensions API routes
       ctx.addRoute('get', `${adminPath}/api/extensions/config`, requireAuth, extensionHandlers.configHandler);
@@ -273,7 +287,7 @@ function adminPanelPlugin(options = {}) {
 
       // Custom pages API routes
       ctx.addRoute('get', `${adminPath}/api/extensions/pages/:pageId/data`, requireAuth, pageHandlers.getPageData);
-      ctx.addRoute('post', `${adminPath}/api/extensions/pages/:pageId/actions/:actionId`, requireAuth, pageHandlers.executePageAction);
+      ctx.addRoute('all', `${adminPath}/api/extensions/pages/:pageId/actions/:actionId`, requireAuth, pageHandlers.executePageAction);
 
       // User management API routes
       if (userHandlers) {
@@ -376,6 +390,7 @@ function generateAdminPanelHtml(adminPath, registry) {
   const dashboardComponent = generateDashboardComponent();
   const bulkActionsComponent = generateBulkActionsComponent();
   const customPageComponent = generateCustomPageComponent();
+  const profileComponent = generateProfileComponent();
 
   const settings = registry.settings;
   const fieldRenderersCode = Array.from(registry.fieldRenderers.entries()).map(([type, r]) => {
@@ -431,12 +446,14 @@ function generateAdminPanelHtml(adminPath, registry) {
     .dark .ql-snow .ql-fill { fill: #94a3b8; }
     .dark .ql-picker { color: #cbd5e1; }
   </style>
+  ${registry.getStylesHtml()}
+  ${registry.getScriptsHtml('head')}
 </head>
 <body class="min-h-screen bg-gray-50 dark:bg-slate-950 text-gray-900 dark:text-slate-100 antialiased">
   <div id="app"></div>
   <script>
     window.__ADMIN_PATH__ = ${JSON.stringify(adminPath)};
-    window.__ADMIN_CONFIG__ = ${JSON.stringify(registry.toClientConfig())};
+    window.__ADMIN_CONFIG__ = ${JSON.stringify(registry.toClientConfig()).replace(/</g, '\\u003c')};
   </script>
   <script>
     // Helper functions
@@ -455,6 +472,7 @@ function generateAdminPanelHtml(adminPath, registry) {
     ${dashboardComponent}
     ${bulkActionsComponent}
     ${customPageComponent}
+    ${profileComponent}
 
     // Custom page components container
     window.__customPages = window.__customPages || {};
@@ -465,6 +483,7 @@ function generateAdminPanelHtml(adminPath, registry) {
     ${fieldRenderersCode}
   </script>
   <script>${appScript}</script>
+  ${registry.getScriptsHtml('body')}
 </body>
 </html>`;
 }