webspresso 0.0.84 → 0.0.86

package/core/auth/middleware.js

@@ -28,7 +28,7 @@ function createAuthMiddleware(authManager) {
 
   /**
    * Authenticate middleware
-   * Loads user from session or remember me token
+   * Loads user from Bearer JWT header, session, or remember me token
    * Should run on every request
    */
   async function authenticate(req, res, next) {
@@ -39,8 +39,27 @@ function createAuthMiddleware(authManager) {
       // Create request-bound auth helper
       req.auth = authManager.createRequestAuth(req, res);
 
-      // Try to load user from session
-      if (req.session?.userId) {
+      // Check Bearer JWT token header first
+      const authHeader = req.headers?.authorization || req.headers?.Authorization;
+      if (authHeader && authHeader.startsWith('Bearer ')) {
+        const token = authHeader.substring(7).trim();
+        try {
+          const payload = authManager.verifyJwt(token);
+          req.token = token;
+          req.jwtPayload = payload;
+          if (payload.id) {
+            const user = await authManager.findUserById(payload.id);
+            req.user = user || payload;
+          } else {
+            req.user = payload;
+          }
+        } catch (jwtErr) {
+          // Invalid or expired JWT token header
+        }
+      }
+
+      // Try to load user from session if not authenticated by JWT
+      if (!req.user && req.session?.userId) {
         const user = await authManager.findUserById(req.session.userId);
         if (user) {
           req.user = user;
@@ -50,7 +69,7 @@ function createAuthMiddleware(authManager) {
         }
       }
 
-      // If no user in session, try remember me token
+      // If no user in session or JWT, try remember me token
       if (!req.user && authManager.rememberTokens) {
         const user = await authManager.verifyRememberToken(req, res);
         if (user) {
@@ -96,6 +115,44 @@ function createAuthMiddleware(authManager) {
     };
   }
 
+  /**
+   * Require JWT middleware
+   * Enforces valid Bearer JWT token in Authorization header
+   * @param {Object} [options] - Verification options
+   */
+  function requireJwt(options = {}) {
+    return async (req, res, next) => {
+      const authHeader = req.headers?.authorization || req.headers?.Authorization;
+      if (!authHeader || !authHeader.startsWith('Bearer ')) {
+        return res.status(401).json({
+          error: 'Unauthorized',
+          message: 'Bearer token required',
+        });
+      }
+
+      const token = authHeader.substring(7).trim();
+      try {
+        const payload = authManager.verifyJwt(token, options);
+        req.token = token;
+        req.jwtPayload = payload;
+
+        if (payload.id) {
+          const user = await authManager.findUserById(payload.id);
+          req.user = user || payload;
+        } else {
+          req.user = payload;
+        }
+
+        next();
+      } catch (err) {
+        return res.status(401).json({
+          error: 'Unauthorized',
+          message: err.message || 'Invalid JWT token',
+        });
+      }
+    };
+  }
+
   /**
    * Require guest middleware
    * Redirects authenticated users away
@@ -192,6 +249,9 @@ function createAuthMiddleware(authManager) {
       case 'auth':
         return requireAuth({ api: args.includes('api') });
       
+      case 'jwt':
+        return requireJwt();
+      
       case 'guest':
         return requireGuest();
       
@@ -216,6 +276,7 @@ function createAuthMiddleware(authManager) {
     
     // Guard middleware
     requireAuth,
+    requireJwt,
     requireGuest,
     requireCan,
     requireVerified,
@@ -225,6 +286,7 @@ function createAuthMiddleware(authManager) {
     
     // Aliases for route config (factories — file-router calls requireAuth(opts) / requireGuest(opts))
     auth: requireAuth,
+    jwt: requireJwt,
     guest: requireGuest,
   };
 }

package/core/orm/model.js

@@ -91,6 +91,9 @@ function defineModel(options) {
       icon: admin.icon || null,
       customFields: admin.customFields || {},
       queries: admin.queries || {},
+      sortable: admin.sortable,
+      sortableColumns: admin.sortableColumns,
+      columns: admin.columns,
     },
     rest: {
       enabled: rest.enabled === true,

package/core/orm/schema-helpers.js

@@ -231,6 +231,7 @@ class SchemaBuilder {
     if (options.readonly !== undefined) this._ui.readonly = options.readonly;
     if (options.width !== undefined) this._ui.width = options.width;
     if (options.rows !== undefined) this._ui.rows = options.rows;
+    if (options.sortable !== undefined) this._ui.sortable = options.sortable;
     return this;
   }
 

package/index.d.ts

@@ -567,6 +567,28 @@ export function swaggerPlugin(options?: Record<string, unknown>): WebspressoPlug
 
 export function healthCheckPlugin(options?: Record<string, unknown>): WebspressoPlugin;
 
+export interface CorsPluginOptions {
+  origin?:
+    | string
+    | string[]
+    | RegExp
+    | ((
+        origin: string,
+        callback: (err: Error | null, allow?: boolean | string) => void
+      ) => void);
+  methods?: string | string[];
+  allowedHeaders?: string | string[];
+  exposedHeaders?: string | string[];
+  credentials?: boolean;
+  maxAge?: number;
+  preflightContinue?: boolean;
+  optionsSuccessStatus?: number;
+  routes?: string | string[] | boolean;
+  global?: boolean;
+}
+
+export function corsPlugin(options?: CorsPluginOptions): WebspressoPlugin;
+
 export interface RedirectRule {
   from: string | RegExp;
   to: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.84",
+  "version": "0.0.86",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",
@@ -72,7 +72,7 @@
     "nodemailer": "^9.0.3",
     "nunjucks": "^3.2.4",
     "sanitize-html": "^2.17.3",
-    "sharp": "^0.33.5",
+    "sharp": "^0.35.3",
     "swup": "^4.8.3",
     "yaml": "^2.8.3",
     "zod": "^3.23.0",
@@ -116,7 +116,7 @@
     "chokidar": "^3.5.3",
     "dotenv": "^16.3.1",
     "express-rate-limit": "^8.4.1",
-    "release-it": "^19.0.0",
+    "release-it": "^20.2.1",
     "supertest": "^6.3.4",
     "typescript": "~5.6.3",
     "vitest": "^3.0.0"

package/plugins/admin-panel/api.js

@@ -268,6 +268,28 @@ function createApiHandlers(options) {
     }
   }
 
+/**
+ * Helper to determine if a column is sortable based on model and column configs
+ */
+function isColumnSortable(name, meta, model) {
+  if (!meta) return false;
+  if (model.admin && model.admin.sortable === false) return false;
+  if (model.admin && Array.isArray(model.admin.sortableColumns)) {
+    return model.admin.sortableColumns.includes(name);
+  }
+  if (model.admin?.columns?.[name]?.sortable !== undefined) {
+    return Boolean(model.admin.columns[name].sortable);
+  }
+  if (meta.sortable !== undefined) {
+    return Boolean(meta.sortable);
+  }
+  if (meta.ui?.sortable !== undefined) {
+    return Boolean(meta.ui.sortable);
+  }
+  const nonSortableTypes = ['json', 'array', 'file'];
+  return !nonSortableTypes.includes(meta.type);
+}
+
   /**
    * Get model metadata
    */
@@ -304,6 +326,7 @@ function createApiHandlers(options) {
           validations: meta.validations || null,
           ui: meta.ui ? { ...meta.ui, hidden: isHidden || meta.ui.hidden } : (isHidden ? { hidden: true } : null),
           hidden: isHidden, // Excluded from list display and API responses
+          sortable: isColumnSortable(name, meta, model),
         });
       }
 
@@ -486,9 +509,22 @@ function createApiHandlers(options) {
       // Apply pagination
       query = query.offset(offset).limit(perPage);
 
-      // Apply sorting (newest first by default)
+      // Apply sorting
       const primaryKey = model.primaryKey || 'id';
-      query = query.orderBy(primaryKey, 'desc');
+      const sortParam = req.query.sort;
+      const orderParam = (req.query.order || 'desc').toLowerCase();
+      const sortOrder = orderParam === 'asc' ? 'asc' : 'desc';
+
+      if (sortParam && model.columns.has(sortParam)) {
+        const colMeta = model.columns.get(sortParam);
+        if (isColumnSortable(sortParam, colMeta, model)) {
+          query = query.orderBy(sortParam, sortOrder);
+        } else {
+          query = query.orderBy(primaryKey, 'desc');
+        }
+      } else {
+        query = query.orderBy(primaryKey, 'desc');
+      }
 
       // Get records
       const records = await query.list();

package/plugins/admin-panel/client/parts/01-state-api-breadcrumb.js

@@ -96,6 +96,8 @@ const state = {
   formData: {}, // Form field values
   editing: false,
   filters: {}, // Active filters { column: { op, value, from, to } }
+  sortColumn: null, // Currently sorted column name
+  sortDirection: null, // Sort direction: 'asc' | 'desc' | null
   filterPanelOpen: false, // Filter panel visibility (deprecated)
   filterDrawerOpen: false, // Filter drawer visibility
   bulkFields: [], // Bulk-updatable fields (enum/boolean/date/datetime/timestamp)

package/plugins/admin-panel/client/parts/04-field-renderers.js

@@ -300,7 +300,15 @@ const FieldRenderers = {
     const label = ui.label || formatColumnLabel(col.name);
     const placeholder = ui.placeholder || '';
     const hint = ui.hint || '';
-    const dateValue = value ? new Date(value).toISOString().split('T')[0] : '';
+    let dateValue = '';
+    if (value) {
+      try {
+        const d = new Date(value);
+        if (!isNaN(d.getTime())) {
+          dateValue = d.toISOString().split('T')[0];
+        }
+      } catch {}
+    }
     
     return m('.mb-4', [
       m('label.block.text-sm.font-medium.text-gray-700 dark:text-slate-300.mb-1', { for: col.name }, label),
@@ -329,7 +337,15 @@ const FieldRenderers = {
     const label = ui.label || formatColumnLabel(col.name);
     const placeholder = ui.placeholder || '';
     const hint = ui.hint || '';
-    const dateTimeValue = value ? new Date(value).toISOString().slice(0, 16) : '';
+    let dateTimeValue = '';
+    if (value) {
+      try {
+        const d = new Date(value);
+        if (!isNaN(d.getTime())) {
+          dateTimeValue = d.toISOString().slice(0, 16);
+        }
+      } catch {}
+    }
     
     return m('.mb-4', [
       m('label.block.text-sm.font-medium.text-gray-700 dark:text-slate-300.mb-1', { for: col.name }, label),

package/plugins/admin-panel/client/parts/07-model-list.js

@@ -90,13 +90,13 @@ function formatCellValue(value, col, record = null) {
     case 'timestamp':
       try {
         const date = new Date(value);
-        return date.toLocaleString();
+        return isNaN(date.getTime()) ? String(value) : date.toLocaleString();
       } catch { return String(value); }
     
     case 'date':
       try {
         const date = new Date(value);
-        return date.toLocaleDateString();
+        return isNaN(date.getTime()) ? String(value) : date.toLocaleDateString();
       } catch { return String(value); }
     
     case 'json':
@@ -523,21 +523,31 @@ function parseFilterQuery(queryString) {
   return filters;
 }
 
-// Load records with pagination and filters
-function loadRecords(modelName, page = 1, filters = null) {
+// Load records with pagination, filters, and sorting
+function loadRecords(modelName, page = 1, filters = null, sortColumn = undefined, sortDirection = undefined) {
   state.loading = true;
   state.error = null;
   
   const perPage = state.pagination.perPage || 20;
   const activeFilters = filters !== null ? filters : state.filters;
+  const activeSortCol = sortColumn !== undefined ? sortColumn : state.sortColumn;
+  const activeSortDir = sortDirection !== undefined ? sortDirection : state.sortDirection;
+  
+  state.sortColumn = activeSortCol;
+  state.sortDirection = activeSortDir;
+  
   const filterQuery = buildFilterQuery(activeFilters);
   
-  // Update URL with filters
+  // Update URL with filters and sort params
   const queryParams = new URLSearchParams();
   queryParams.set('page', page);
   if (state.trashedView) {
     queryParams.set('trashed', 'only');
   }
+  if (activeSortCol && activeSortDir) {
+    queryParams.set('sort', activeSortCol);
+    queryParams.set('order', activeSortDir);
+  }
   if (Object.keys(activeFilters).length > 0) {
     for (const [col, filter] of Object.entries(activeFilters)) {
       if (!filter || !filterPayloadIsActive(filter)) continue;
@@ -566,7 +576,8 @@ function loadRecords(modelName, page = 1, filters = null) {
   window.history.replaceState({}, '', newUrl);
   
   const trashedParam = state.trashedView ? '&trashed=only' : '';
-  return api.get('/models/' + modelName + '/records?page=' + page + '&perPage=' + perPage + trashedParam + filterQuery)
+  const sortParam = activeSortCol && activeSortDir ? '&sort=' + encodeURIComponent(activeSortCol) + '&order=' + encodeURIComponent(activeSortDir) : '';
+  return api.get('/models/' + modelName + '/records?page=' + page + '&perPage=' + perPage + trashedParam + filterQuery + sortParam)
     .then(result => {
       state.records = result.data || [];
       state.pagination = {
@@ -601,11 +612,16 @@ function initializeModelView(modelName) {
   state.selectedBulkField = null;
   state._currentModelName = modelName;
   
-  // Parse filters from URL query string
+  // Parse filters and sorting from URL query string
   const urlParams = new URLSearchParams(window.location.search);
   const page = parseInt(urlParams.get('page')) || 1;
   state.filters = parseFilterQuery(window.location.search);
   
+  const rawSort = urlParams.get('sort');
+  const rawOrder = (urlParams.get('order') || '').toLowerCase();
+  state.sortColumn = rawSort || null;
+  state.sortDirection = rawOrder === 'asc' ? 'asc' : rawOrder === 'desc' ? 'desc' : null;
+  
   // Load model metadata first, then records
   state.loading = true;
   api.get('/models/' + modelName)
@@ -614,7 +630,7 @@ function initializeModelView(modelName) {
       state.currentModel = modelMeta;
       // Load bulk-updatable fields for this model
       loadBulkFields(modelName);
-      return loadRecords(modelName, page, state.filters);
+      return loadRecords(modelName, page, state.filters, state.sortColumn, state.sortDirection);
     })
     .catch(err => {
       state.error = err.message;

package/plugins/admin-panel/client/parts/08-record-list.js

@@ -441,12 +441,54 @@ const RecordList = {
                       }),
                     ]),
                     // Dynamic column headers (first column sticky left with box-shadow)
-                    ...displayColumns.map((col, i) => 
-                      m('th.px-4.py-3.text-left.text-xs.font-medium.text-gray-500 dark:text-slate-400.uppercase.tracking-wider.whitespace-nowrap.bg-gray-50 dark:bg-slate-900.border-b.border-gray-200 dark:border-slate-700', 
-                        i === 0 ? { style: 'position: sticky; left: 40px; z-index: 15; box-shadow: 4px 0 8px -4px rgba(0,0,0,0.08);' } : {},
-                        formatColumnLabel(col.name)
-                      )
-                    ),
+                    ...displayColumns.map((col, i) => {
+                      const isSortable = col.sortable !== false;
+                      const isSorted = isSortable && state.sortColumn === col.name;
+                      const dir = isSorted ? state.sortDirection : null;
+                      const stickyStyle = i === 0 ? 'position: sticky; left: 40px; z-index: 15; box-shadow: 4px 0 8px -4px rgba(0,0,0,0.08);' : '';
+
+                      if (!isSortable) {
+                        return m('th.px-4.py-3.text-left.text-xs.font-medium.text-gray-500.dark:text-slate-400.uppercase.tracking-wider.whitespace-nowrap.bg-gray-50.dark:bg-slate-900.border-b.border-gray-200.dark:border-slate-700',
+                          stickyStyle ? { style: stickyStyle } : {},
+                          formatColumnLabel(col.name)
+                        );
+                      }
+
+                      return m('th.px-4.py-3.text-left.text-xs.font-medium.text-gray-500.dark:text-slate-400.uppercase.tracking-wider.whitespace-nowrap.bg-gray-50.dark:bg-slate-900.border-b.border-gray-200.dark:border-slate-700.cursor-pointer.select-none.hover:bg-gray-100.dark:hover:bg-slate-800/80.transition-colors.group',
+                        {
+                          style: stickyStyle || undefined,
+                          onclick: () => {
+                            let nextSort = col.name;
+                            let nextDir = 'asc';
+                            if (state.sortColumn === col.name) {
+                              if (state.sortDirection === 'asc') {
+                                nextDir = 'desc';
+                              } else if (state.sortDirection === 'desc') {
+                                nextSort = null;
+                                nextDir = null;
+                              }
+                            }
+                            state.sortColumn = nextSort;
+                            state.sortDirection = nextDir;
+                            loadRecords(modelName, 1, state.filters, nextSort, nextDir);
+                          },
+                        },
+                        m('.flex.items-center.gap-1.5', [
+                          m('span', formatColumnLabel(col.name)),
+                          dir === 'asc'
+                            ? m('svg.w-3.5.h-3.5.text-indigo-600.dark:text-indigo-400.flex-shrink-0', { fill: 'currentColor', viewBox: '0 0 20 20' },
+                                m('path', { 'fill-rule': 'evenodd', d: 'M14.707 12.707a1 1 0 01-1.414 0L10 9.414l-3.293 3.293a1 1 0 01-1.414-1.414l4-4a1 1 0 011.414 0l4 4a1 1 0 010 1.414z', 'clip-rule': 'evenodd' })
+                              )
+                            : dir === 'desc'
+                              ? m('svg.w-3.5.h-3.5.text-indigo-600.dark:text-indigo-400.flex-shrink-0', { fill: 'currentColor', viewBox: '0 0 20 20' },
+                                  m('path', { 'fill-rule': 'evenodd', d: 'M5.293 7.293a1 1 0 011.414 0L10 10.586l3.293-3.293a1 1 0 111.414 1.414l-4 4a1 1 0 01-1.414 0l-4-4a1 1 0 010-1.414z', 'clip-rule': 'evenodd' })
+                                )
+                              : m('svg.w-3.5.h-3.5.text-gray-300.dark:text-slate-600.group-hover:text-gray-400.flex-shrink-0', { fill: 'currentColor', viewBox: '0 0 20 20' },
+                                  m('path', { d: 'M5 12a1 1 0 100 2h10a1 1 0 100-2H5zM5 6a1 1 0 100 2h10a1 1 0 100-2H5z' })
+                                )
+                        ])
+                      );
+                    }),
                     // Sticky actions header (sticky right, box-shadow on left)
                     m('th.px-4.py-3.text-right.text-xs.font-medium.text-gray-500 dark:text-slate-400.uppercase.tracking-wider.bg-gray-50 dark:bg-slate-900.border-b.border-gray-200 dark:border-slate-700', {
                       style: 'position: sticky; right: 0; min-width: 120px; z-index: 15; box-shadow: -4px 0 8px -4px rgba(0,0,0,0.08);',

package/plugins/admin-panel/field-renderers/basic.js

@@ -121,7 +121,15 @@ module.exports = {
   DateField: {
     view: (vnode) => {
       const { name, value = '', meta = {}, required = false } = vnode.attrs;
-      const dateValue = value ? new Date(value).toISOString().split('T')[0] : '';
+      let dateValue = '';
+      if (value) {
+        try {
+          const d = new Date(value);
+          if (!isNaN(d.getTime())) {
+            dateValue = d.toISOString().split('T')[0];
+          }
+        } catch {}
+      }
       return m('.mb-4', [
         m('label.block.text-sm.font-medium.mb-2', { for: name },
           meta.label || name,
@@ -149,7 +157,15 @@ module.exports = {
   DateTimeField: {
     view: (vnode) => {
       const { name, value = '', meta = {}, required = false } = vnode.attrs;
-      const dateTimeValue = value ? new Date(value).toISOString().slice(0, 16) : '';
+      let dateTimeValue = '';
+      if (value) {
+        try {
+          const d = new Date(value);
+          if (!isNaN(d.getTime())) {
+            dateTimeValue = d.toISOString().slice(0, 16);
+          }
+        } catch {}
+      }
       return m('.mb-4', [
         m('label.block.text-sm.font-medium.mb-2', { for: name },
           meta.label || name,

package/plugins/admin-panel/index.js

@@ -71,10 +71,15 @@ function adminPanelPlugin(options = {}) {
     version: '2.0.0',
     description: 'Modular admin panel for Webspresso with extensions support',
     
-    // CSP requirements for admin panel scripts
+    // CSP requirements for admin panel scripts, styles, and custom page iframe sources
     // Note: cdn.quilljs.com 301-redirects to cdn.jsdelivr.net; CSP is enforced on the final URL.
     csp: {
-      styleSrc: ['https://cdn.quilljs.com', 'https://cdn.jsdelivr.net'],
+      styleSrc: [
+        'https://cdn.quilljs.com',
+        'https://cdn.jsdelivr.net',
+        'https://unpkg.com',
+        'https://cdn.tailwindcss.com',
+      ],
       scriptSrc: [
         'https://cdn.quilljs.com',
         'https://cdn.jsdelivr.net',
@@ -82,6 +87,7 @@ function adminPanelPlugin(options = {}) {
         'https://cdn.tailwindcss.com',
       ],
       connectSrc: ['https://unpkg.com', 'https://cdn.tailwindcss.com', 'https://cdn.jsdelivr.net'],
+      frameSrc: ["'self'", 'data:', 'blob:', 'https:'],
     },
     enabled,
     registry, // Expose registry for external configuration
@@ -281,7 +287,7 @@ function adminPanelPlugin(options = {}) {
 
       // Custom pages API routes
       ctx.addRoute('get', `${adminPath}/api/extensions/pages/:pageId/data`, requireAuth, pageHandlers.getPageData);
-      ctx.addRoute('post', `${adminPath}/api/extensions/pages/:pageId/actions/:actionId`, requireAuth, pageHandlers.executePageAction);
+      ctx.addRoute('all', `${adminPath}/api/extensions/pages/:pageId/actions/:actionId`, requireAuth, pageHandlers.executePageAction);
 
       // User management API routes
       if (userHandlers) {

package/plugins/admin-panel/modules/custom-pages.js

@@ -128,7 +128,15 @@ function createCustomPageApiHandlers(options) {
         return res.status(404).json({ error: 'Action not found' });
       }
 
-      const result = await action({ db, req, body: req.body, user: req.session?.adminUser });
+      const payload = { ...(req.query || {}), ...(req.body || {}) };
+      const result = await action({
+        db,
+        req,
+        body: payload,
+        payload,
+        query: req.query || {},
+        user: req.session?.adminUser,
+      });
       res.json({ success: true, result });
     } catch (error) {
       res.status(500).json({ error: error.message });

package/plugins/content/client/inline-edit.js

@@ -243,6 +243,38 @@
       });
   }
 
+  function sanitizeClientHtml(htmlStr) {
+    if (!htmlStr) return '';
+    try {
+      var parser = new DOMParser();
+      var doc = parser.parseFromString(htmlStr, 'text/html');
+      var forbiddenTags = ['script', 'iframe', 'object', 'embed', 'applet', 'base'];
+      forbiddenTags.forEach(function (tag) {
+        var nodes = doc.querySelectorAll(tag);
+        for (var i = 0; i < nodes.length; i++) {
+          nodes[i].parentNode.removeChild(nodes[i]);
+        }
+      });
+      var allNodes = doc.querySelectorAll('*');
+      for (var i = 0; i < allNodes.length; i++) {
+        var node = allNodes[i];
+        var attrs = Array.prototype.slice.call(node.attributes);
+        for (var j = 0; j < attrs.length; j++) {
+          var attrName = attrs[j].name.toLowerCase();
+          var attrVal = attrs[j].value.toLowerCase().trim();
+          if (attrName.indexOf('on') === 0) {
+            node.removeAttribute(attrs[j].name);
+          } else if ((attrName === 'href' || attrName === 'src') && attrVal.indexOf('javascript:') === 0) {
+            node.removeAttribute(attrs[j].name);
+          }
+        }
+      }
+      return doc.body.innerHTML;
+    } catch (e) {
+      return '';
+    }
+  }
+
   function updateDomFields(entryId, data) {
     qsa('[data-ws-content-entry="' + entryId + '"][data-ws-content-field]').forEach(function (el) {
       var field = el.getAttribute('data-ws-content-field');
@@ -250,7 +282,7 @@
       var val = data[field];
       var isHtml = el.getAttribute('data-ws-content-html') === 'true';
       if (isHtml) {
-        el.innerHTML = val || '';
+        el.innerHTML = sanitizeClientHtml(val);
       } else {
         el.textContent = val != null ? val : '';
       }