webspresso 0.0.89 → 0.0.90

package/README.md

@@ -528,24 +528,39 @@ const { app } = createApp({
   pagesDir: './pages',
   viewsDir: './views',
   errorPages: {
-    // Option 1: Custom handler function
-    notFound: (req, res) => {
-      res.render('errors/404.njk', { url: req.url });
-    },
+    // 404 Not Found: Template path (relative to viewsDir) or custom handler fn
+    notFound: '404.njk', // or 'errors/404.njk', or (req, res, ctx) => res.render('404.njk', ctx)
     
-    // Option 2: Template path (rendered with Nunjucks)
-    serverError: 'errors/500.njk',
+    // 500 Internal Server Error: Template path or custom handler fn
+    serverError: 'errors/500.njk', // or (err, req, res, ctx) => ...
     
-    // Timeout error page (503)
-    timeout: 'errors/503.njk'
+    // 503 Request Timeout: Template path or custom handler fn
+    timeout: 'errors/503.njk' // or (req, res, ctx) => ...
   }
 });
 ```
 
-Error templates receive these variables:
-- `404.njk`: `{ url, method }`
-- `500.njk`: `{ error, status, isDev }`
-- `503.njk`: `{ url, method, isDev }`
+#### Error Template Context & Behavior
+
+All error templates rendered with Nunjucks automatically receive a rich request context:
+- **`404.njk` (`notFound`)**: `{ fsy, locale, isDev, url, method }` — sets HTTP status `404`. If omitted, Webspresso provides a responsive built-in HTML 404 page for browsers, or `{ error: 'Not Found', status: 404 }` JSON for API requests.
+- **`500.njk` (`serverError`)**: `{ fsy, locale, isDev, url, method, error, status }` — sets HTTP status `500` (or `err.status`).
+- **`503.njk` (`timeout`)**: `{ fsy, locale, isDev, url, method }` — sets HTTP status `503`.
+
+```njk
+{# Example views/404.njk #}
+{% extends "layout.njk" %}
+
+{% block content %}
+<div class="max-w-xl mx-auto text-center py-20">
+  <h1 class="text-6xl font-bold text-slate-800">404</h1>
+  <p class="text-xl text-slate-600 mt-4">Page Not Found: <code>{{ url }}</code></p>
+  <a href="{{ fsy.url('/') }}" class="mt-6 inline-block bg-blue-600 text-white px-6 py-2 rounded-lg">
+    Back to Home
+  </a>
+</div>
+{% endblock %}
+```
 
 **How errors reach this handler**
 
@@ -568,9 +583,11 @@ const { app } = createApp({
 });
 ```
 
-**Asset Management:**
+**Asset Management & Cache-Busting:**
+
+Webspresso includes a built-in `AssetManager` that automates static asset URL resolution, query-string cache-busting, Vite/Webpack build manifest lookups, and CDN prefixing in Nunjucks SSR templates.
 
-Configure asset handling with versioning and manifest support:
+Configure asset handling in `createApp`:
 
 ```javascript
 const { createApp } = require('webspresso');
@@ -579,54 +596,84 @@ const path = require('path');
 const { app } = createApp({
   pagesDir: './pages',
   viewsDir: './views',
-  publicDir: './public',
+  publicDir: './public', // default: 'public'
   assets: {
-    // Option 1: Simple versioning (cache busting)
-    version: '1.2.3',  // or process.env.APP_VERSION
-    
-    // Option 2: Manifest file (Vite, Webpack, etc.)
+    // 1. Static query-string versioning (Cache Busting)
+    // Appends ?v=1.2.3 (or &v=... if existing query params) to asset URLs
+    version: process.env.APP_VERSION || '1.0.0', // or Git commit hash, build timestamp
+
+    // 2. Build Tool Manifest (Vite, Webpack, etc.)
+    // Resolves hashed bundle filenames automatically (e.g. style.css -> assets/style-abc123.css)
     manifestPath: path.join(__dirname, 'public/.vite/manifest.json'),
-    
-    // URL prefix for assets
-    prefix: '/static'
+
+    // 3. Asset URL Prefix / CDN
+    // Prepended to all resolved asset paths
+    prefix: process.env.CDN_URL || '' // e.g. 'https://cdn.example.com' or '/static'
   }
 });
 ```
 
-Use asset helpers in templates:
+#### How Asset Resolution Works
+
+1. **Manifest Match First**: If `manifestPath` is configured and an entry matches the asset key, `AssetManager` resolves to the hashed filename (from Vite or Webpack manifest) and prepends `prefix`.
+2. **Fallback to Path & Versioning**: If no manifest is provided or the asset is not listed in the manifest, `AssetManager` uses the original path, prepends `prefix`, and appends `?v=<version>` (or `&v=<version>`) if `version` is set.
+3. **Leading Slash Normalization**: Paths with or without leading slashes (e.g., `'css/style.css'` or `'/css/style.css'`) are handled seamlessly.
+
+```json
+// Example Vite manifest format (.vite/manifest.json)
+{
+  "css/style.css": { "file": "assets/style-abc123.css", "src": "css/style.css" },
+  "js/app.js": { "file": "assets/app-xyz789.js", "src": "js/app.js" }
+}
+
+// Example Webpack manifest format (manifest.json)
+{
+  "/css/style.css": "/dist/style.abc123.css",
+  "/js/app.js": "/dist/app.xyz789.js"
+}
+```
+
+#### Template Helpers (`fsy`)
+
+Use `fsy` helpers inside your Nunjucks layouts and pages:
 
 ```njk
-{# Using fsy helpers (auto-resolved) #}
+{# 1. URL string resolution #}
 <link rel="stylesheet" href="{{ fsy.asset('/css/style.css') }}">
+{# Outputs: <link rel="stylesheet" href="/css/style.css?v=1.0.0"> (or /assets/style-abc123.css) #}
 
-{# Or generate full HTML tags #}
+{# 2. CSS link tag helper #}
 {{ fsy.css('/css/style.css') | safe }}
-{{ fsy.js('/js/app.js', { defer: true, type: 'module' }) | safe }}
-{{ fsy.img('/images/logo.png', 'Site Logo', { class: 'logo', loading: 'lazy' }) | safe }}
+{# With custom attributes (media, id, integrity, etc.): #}
+{{ fsy.css('/css/print.css', { media: 'print', id: 'print-styles' }) | safe }}
+
+{# 3. JS script tag helper #}
+{{ fsy.js('/js/app.js') | safe }}
+{# Supports boolean flags (async, defer) and module type: #}
+{{ fsy.js('/js/main.js', { defer: true, type: 'module' }) | safe }}
+{# Outputs: <script src="/js/main.js?v=1.0.0" defer type="module"></script> #}
+
+{# 4. Image tag helper #}
+{{ fsy.img('/images/logo.png', 'Company Logo') | safe }}
+{# With attributes (loading, class, width, height): #}
+{{ fsy.img('/images/hero.jpg', 'Hero Banner', { loading: 'lazy', class: 'w-full rounded', width: 1200, height: 600 }) | safe }}
 ```
 
-Asset helpers available in `fsy`:
-- `asset(path)` - Returns versioned/manifest-resolved URL
-- `css(href, attrs)` - Generates `<link>` tag
-- `js(src, attrs)` - Generates `<script>` tag
-- `img(src, alt, attrs)` - Generates `<img>` tag
+#### Programmatic Asset Manager API
 
-**Manifest Support:**
+You can also import and use `AssetManager` directly:
 
-Works with Vite and Webpack manifest formats:
+```javascript
+const { AssetManager, configureAssets, getAssetManager } = require('webspresso');
 
-```json
-// Vite manifest format (.vite/manifest.json)
-{
-  "css/style.css": { "file": "assets/style-abc123.css" },
-  "js/app.js": { "file": "assets/app-xyz789.js" }
-}
+// Configure global manager
+configureAssets({
+  version: '2.0.0',
+  prefix: 'https://cdn.example.com'
+});
 
-// Webpack manifest format
-{
-  "/css/style.css": "/dist/style.abc123.css",
-  "/js/app.js": "/dist/app.xyz789.js"
-}
+const manager = getAssetManager();
+console.log(manager.asset('/css/style.css')); // -> 'https://cdn.example.com/css/style.css?v=2.0.0'
 ```
 
 **Returns:** `{ app, nunjucksEnv, pluginManager, authMiddleware }` — `authMiddleware` is `null` when `auth` was not passed.

package/core/auth/manager.js

@@ -38,7 +38,7 @@ const DEFAULT_CONFIG = {
     saveUninitialized: false,
     cookie: {
       httpOnly: true,
-      secure: process.env.NODE_ENV === 'production',
+      secure: process.env.NODE_ENV === 'production' ? true : 'auto',
       sameSite: 'lax',
       maxAge: 24 * 60 * 60 * 1000, // 1 day
     },
@@ -272,9 +272,11 @@ class AuthManager {
           throw new AuthenticationError('Invalid user object', 'INVALID_USER');
         }
         
-        // Set session
-        req.session.userId = user.id;
-        req.session.loggedInAt = Date.now();
+        // Set session if active
+        if (req.session) {
+          req.session.userId = user.id;
+          req.session.loggedInAt = Date.now();
+        }
         
         // Set req.user
         req.user = user;
@@ -284,19 +286,21 @@ class AuthManager {
           await self.createRememberToken(user.id, res);
         }
         
-        // Regenerate session ID for security
-        return new Promise((resolve, reject) => {
-          req.session.regenerate((err) => {
-            if (err) {
-              reject(new AuthenticationError('Session regeneration failed', 'SESSION_ERROR'));
-            } else {
-              // Restore userId after regenerate
-              req.session.userId = user.id;
-              req.session.loggedInAt = Date.now();
-              resolve();
-            }
+        // Regenerate session ID for security if supported
+        if (req.session && typeof req.session.regenerate === 'function') {
+          return new Promise((resolve, reject) => {
+            req.session.regenerate((err) => {
+              if (err) {
+                reject(new AuthenticationError('Session regeneration failed', 'SESSION_ERROR'));
+              } else {
+                // Restore userId after regenerate
+                req.session.userId = user.id;
+                req.session.loggedInAt = Date.now();
+                resolve();
+              }
+            });
           });
-        });
+        }
       },
 
       /**
@@ -320,21 +324,25 @@ class AuthManager {
           }
           
           // Clear cookie
-          res.clearCookie(self.config.rememberMe.cookieName);
+          if (typeof res?.clearCookie === 'function') {
+            res.clearCookie(self.config.rememberMe.cookieName);
+          }
         }
         
         // Clear user
         req.user = null;
         
-        // Destroy session
-        return new Promise((resolve) => {
-          req.session.destroy((err) => {
-            if (err) {
-              console.error('Session destroy error:', err);
-            }
-            resolve();
+        // Destroy session if supported
+        if (req.session && typeof req.session.destroy === 'function') {
+          return new Promise((resolve) => {
+            req.session.destroy((err) => {
+              if (err) {
+                console.error('Session destroy error:', err);
+              }
+              resolve();
+            });
           });
-        });
+        }
       },
 
       /**
@@ -715,7 +723,9 @@ class AuthManager {
     const payload = {
       id: user.id,
       type: 'access',
-      [this.identifierField]: user[this.identifierField],
+      ...(this.identifierField && user[this.identifierField] ? { [this.identifierField]: user[this.identifierField] } : {}),
+      ...(user.email && { email: user.email }),
+      ...(user.role && { role: user.role }),
       ...options.payload,
     };
     return this.createJwt(payload, options);

package/core/auth/middleware.js

@@ -15,11 +15,21 @@ const cookieParser = require('cookie-parser');
 function createAuthMiddleware(authManager) {
   const config = authManager.config;
 
+  const sessionConfig = authManager.getSessionConfig();
+
   /**
    * Session middleware
-   * Sets up express-session
+   * Sets up express-session with secure cookie enforcement
    */
-  const sessionMiddleware = session(authManager.getSessionConfig());
+  const sessionMiddleware = session({
+    ...sessionConfig,
+    cookie: {
+      httpOnly: true,
+      sameSite: 'lax',
+      secure: 'auto',
+      ...(sessionConfig.cookie || {}),
+    },
+  });
 
   /**
    * Cookie parser middleware (needed for signed cookies / remember me)

package/core/orm/model.js

@@ -54,6 +54,7 @@ function defineModel(options) {
   const columns = extractColumnsFromSchema(schema);
 
   // Validate relations
+  const normalizedRelations = {};
   for (const [relationName, relation] of Object.entries(relations)) {
     if (!['belongsTo', 'hasMany', 'hasOne'].includes(relation.type)) {
       throw new Error(
@@ -70,6 +71,8 @@ function defineModel(options) {
         `Relation "${relationName}" in model "${name}" must have a foreignKey string`
       );
     }
+
+    normalizedRelations[relationName] = relation;
   }
 
   // Create model definition
@@ -78,7 +81,7 @@ function defineModel(options) {
     table,
     schema,
     primaryKey,
-    relations,
+    relations: normalizedRelations,
     scopes: {
       softDelete: scopes.softDelete || false,
       timestamps: scopes.timestamps || false,
@@ -186,7 +189,10 @@ function unregisterModel(name) {
  * @returns {import('./types').ModelDefinition}
  */
 function resolveRelationModel(relation) {
-  const model = relation.model();
+  let model = typeof relation.model === 'function' ? relation.model() : relation.model;
+  if (typeof model === 'string') {
+    model = getModel(model);
+  }
   if (!model || !model.name) {
     throw new Error('Invalid relation model reference');
   }

package/core/orm/scopes.js

@@ -185,11 +185,12 @@ function applyUpdateModifiers(data, model) {
  * Create default scope context
  * @returns {import('./types').ScopeContext}
  */
-function createScopeContext() {
+function createScopeContext(overrides = {}) {
   return {
     tenantId: undefined,
     withTrashed: false,
     onlyTrashed: false,
+    ...overrides,
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.89",
+  "version": "0.0.90",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",

package/plugins/admin-panel/app.js

@@ -171,6 +171,16 @@ var routes = {
       return ProfilePage;
     }
   },
+  '/admins': {
+    onmatch: async () => {
+      const isAuth = await checkAuth();
+      if (!isAuth) {
+        redirectToLogin();
+        return;
+      }
+      return AdminUsersPage;
+    }
+  },
   '/users/sessions': {
     onmatch: async () => {
       if (!(await guardUserManagementRoutes())) return;

package/plugins/admin-panel/client/parts/03-pagination-intro.js

@@ -16,52 +16,59 @@ const Pagination = {
       pages.push(i);
     }
     
-    return m('.flex.items-center.justify-between.px-4.py-3.bg-white dark:bg-slate-800.border-t', [
-      m('.text-sm.text-gray-700', [
+    return m('.flex.flex-col.sm:flex-row.items-center.justify-between.gap-3.px-4.py-3.bg-white.dark:bg-slate-800.border-t.border-gray-200.dark:border-slate-700', [
+      m('.text-xs.sm:text-sm.text-gray-600.dark:text-slate-400.text-center.sm:text-left', [
         'Showing ',
-        m('span.font-medium', ((page - 1) * perPage) + 1),
+        m('span.font-semibold.text-gray-900.dark:text-slate-200', ((page - 1) * perPage) + 1),
         ' to ',
-        m('span.font-medium', Math.min(page * perPage, total)),
+        m('span.font-semibold.text-gray-900.dark:text-slate-200', Math.min(page * perPage, total)),
         ' of ',
-        m('span.font-medium', total),
+        m('span.font-semibold.text-gray-900.dark:text-slate-200', total),
         ' results',
       ]),
-      m('nav.flex.items-center.space-x-1', [
+      m('nav.flex.items-center.gap-1', [
         // Previous button
-        m('button.px-3.py-1.rounded.border.text-sm', {
+        m('button.px-3.py-1.5.rounded-lg.border.border-gray-200.dark:border-slate-600.text-xs.sm:text-sm.font-medium.transition-colors', {
           disabled: page <= 1,
-          class: page <= 1 ? 'text-gray-300 cursor-not-allowed' : 'text-gray-700 hover:bg-gray-100 dark:hover:bg-slate-700 dark:hover:bg-slate-700',
+          class: page <= 1 
+            ? 'text-gray-300 dark:text-slate-600 cursor-not-allowed bg-gray-50 dark:bg-slate-900/50' 
+            : 'text-gray-700 dark:text-slate-200 hover:bg-gray-100 dark:hover:bg-slate-700 bg-white dark:bg-slate-800',
           onclick: () => page > 1 && onPageChange(page - 1),
         }, '← Prev'),
+
+        // Mobile page indicator
+        m('span.sm:hidden.px-2.text-xs.font-medium.text-gray-600.dark:text-slate-400', `${page} / ${totalPages}`),
         
-        // Page numbers
+        // Page numbers (desktop only)
         start > 1 ? [
-          m('button.px-3.py-1.rounded.text-sm.text-gray-700 dark:text-slate-300.hover:bg-gray-100 dark:hover:bg-slate-700 dark:hover:bg-slate-700', {
+          m('button.hidden.sm:inline-flex.px-3.py-1.5.rounded-lg.text-xs.sm:text-sm.font-medium.text-gray-700.dark:text-slate-300.hover:bg-gray-100.dark:hover:bg-slate-700.transition-colors', {
             onclick: () => onPageChange(1),
           }, '1'),
-          start > 2 ? m('span.px-2.text-gray-400', '...') : null,
+          start > 2 ? m('span.hidden.sm:inline-flex.px-1.text-gray-400.dark:text-slate-500', '...') : null,
         ] : null,
         
         ...pages.map(p => 
-          m('button.px-3.py-1.rounded.text-sm', {
+          m('button.hidden.sm:inline-flex.px-3.py-1.5.rounded-lg.text-xs.sm:text-sm.font-medium.transition-colors', {
             class: p === page 
-              ? 'bg-blue-600 text-white' 
-              : 'text-gray-700 hover:bg-gray-100 dark:hover:bg-slate-700 dark:hover:bg-slate-700',
+              ? 'bg-blue-600 dark:bg-blue-500 text-white shadow-sm' 
+              : 'text-gray-700 dark:text-slate-300 hover:bg-gray-100 dark:hover:bg-slate-700',
             onclick: () => onPageChange(p),
           }, p)
         ),
         
         end < totalPages ? [
-          end < totalPages - 1 ? m('span.px-2.text-gray-400', '...') : null,
-          m('button.px-3.py-1.rounded.text-sm.text-gray-700 dark:text-slate-300.hover:bg-gray-100 dark:hover:bg-slate-700 dark:hover:bg-slate-700', {
+          end < totalPages - 1 ? m('span.hidden.sm:inline-flex.px-1.text-gray-400.dark:text-slate-500', '...') : null,
+          m('button.hidden.sm:inline-flex.px-3.py-1.5.rounded-lg.text-xs.sm:text-sm.font-medium.text-gray-700.dark:text-slate-300.hover:bg-gray-100.dark:hover:bg-slate-700.transition-colors', {
             onclick: () => onPageChange(totalPages),
           }, totalPages),
         ] : null,
         
         // Next button
-        m('button.px-3.py-1.rounded.border.text-sm', {
+        m('button.px-3.py-1.5.rounded-lg.border.border-gray-200.dark:border-slate-600.text-xs.sm:text-sm.font-medium.transition-colors', {
           disabled: page >= totalPages,
-          class: page >= totalPages ? 'text-gray-300 cursor-not-allowed' : 'text-gray-700 hover:bg-gray-100 dark:hover:bg-slate-700 dark:hover:bg-slate-700',
+          class: page >= totalPages 
+            ? 'text-gray-300 dark:text-slate-600 cursor-not-allowed bg-gray-50 dark:bg-slate-900/50' 
+            : 'text-gray-700 dark:text-slate-200 hover:bg-gray-100 dark:hover:bg-slate-700 bg-white dark:bg-slate-800',
           onclick: () => page < totalPages && onPageChange(page + 1),
         }, 'Next →'),
       ]),

package/plugins/admin-panel/client/parts/08-record-list.js

@@ -61,7 +61,7 @@ const RecordList = {
     
     return m(Layout, { breadcrumbs }, [
       // Header
-      m('.flex.items-center.justify-between.mb-4', [
+      m('.flex.flex-col.sm:flex-row.sm:items-center.sm:justify-between.gap-3.mb-4', [
         m('.flex.items-center.gap-3', [
           m('h2.text-2xl.font-bold', modelMeta?.label || modelName),
           m(RefreshIconButton, {
@@ -76,16 +76,16 @@ const RecordList = {
               });
             },
           }),
-          modelMeta?.softDelete ? m('.flex.rounded-lg.border.border-gray-200 dark:border-slate-600.p-0.5', [
+          modelMeta?.softDelete ? m('.flex.rounded-lg.border.border-gray-200.dark:border-slate-600.p-0.5', [
             m('button.px-3.py-1.5.text-sm.font-medium.rounded-md.transition-colors', {
-              class: !state.trashedView ? 'bg-indigo-600.text-white' : 'text-gray-600.hover:text-gray-900 dark:hover:text-slate-100 dark:hover:text-slate-100',
+              class: !state.trashedView ? 'bg-indigo-600.text-white' : 'text-gray-600.hover:text-gray-900.dark:hover:text-slate-100',
               onclick: () => {
                 state.trashedView = false;
                 loadRecords(modelName, 1);
               },
             }, 'Active'),
             m('button.px-3.py-1.5.text-sm.font-medium.rounded-md.transition-colors', {
-              class: state.trashedView ? 'bg-indigo-600.text-white' : 'text-gray-600.hover:text-gray-900 dark:hover:text-slate-100 dark:hover:text-slate-100',
+              class: state.trashedView ? 'bg-indigo-600.text-white' : 'text-gray-600.hover:text-gray-900.dark:hover:text-slate-100',
               onclick: () => {
                 state.trashedView = true;
                 loadRecords(modelName, 1);
@@ -232,29 +232,29 @@ const RecordList = {
             ])
           : m('.bg-white dark:bg-slate-800.rounded-lg.shadow-sm.border.border-gray-200 dark:border-slate-600.overflow-hidden', [
             // Bulk Actions Toolbar (shown when items selected)
-            (state.selectedRecords && state.selectedRecords.size > 0) || state.selectAllMode ? m('.bg-indigo-50.border-b.border-indigo-100.px-4.py-3.flex.items-center.justify-between', [
-              m('.flex.items-center.gap-3', [
-                m('span.text-sm.text-indigo-700.font-medium', 
+            (state.selectedRecords && state.selectedRecords.size > 0) || state.selectAllMode ? m('.bg-indigo-50.dark:bg-indigo-950/40.border-b.border-indigo-100.dark:border-indigo-900/50.px-4.py-3.flex.flex-col.sm:flex-row.sm:items-center.sm:justify-between.gap-3', [
+              m('.flex.flex-wrap.items-center.gap-2', [
+                m('span.text-sm.text-indigo-700.dark:text-indigo-300.font-medium', 
                   state.selectAllMode 
                     ? 'All ' + state.pagination.total + ' records selected'
                     : state.selectedRecords.size + ' record' + (state.selectedRecords.size > 1 ? 's' : '') + ' selected'
                 ),
                 // Show "Select all X records" option when current page is fully selected
-                !state.selectAllMode && state.selectedRecords.size === state.records.length && state.pagination.total > state.records.length && m('button.text-sm.text-indigo-600.hover:text-indigo-800.underline.font-medium', {
+                !state.selectAllMode && state.selectedRecords.size === state.records.length && state.pagination.total > state.records.length && m('button.text-sm.text-indigo-600.dark:text-indigo-400.hover:text-indigo-800.underline.font-medium', {
                   onclick: () => {
                     state.selectAllMode = true;
                     m.redraw();
                   },
                 }, 'Select all ' + state.pagination.total + ' records'),
                 // Show "Select only this page" when in selectAllMode
-                state.selectAllMode && m('button.text-sm.text-indigo-600.hover:text-indigo-800.underline', {
+                state.selectAllMode && m('button.text-sm.text-indigo-600.dark:text-indigo-400.hover:text-indigo-800.underline', {
                   onclick: () => {
                     state.selectAllMode = false;
                     m.redraw();
                   },
                 }, 'Select only this page (' + state.selectedRecords.size + ')'),
               ]),
-              m('.flex.items-center.gap-2', [
+              m('.flex.flex-wrap.items-center.gap-1.5', [
                 state.trashedView && modelMeta?.softDelete
                   ? m('button.inline-flex.items-center.gap-1.px-3.py-1.5.text-sm.font-medium.text-green-600.bg-white dark:bg-slate-800.border.border-green-200.rounded.hover:bg-green-50.transition-colors', {
                       disabled: state.bulkActionInProgress,

package/plugins/admin-panel/index.js

@@ -16,6 +16,7 @@ const { registerDefaultBulkActions, generateBulkActionsComponent } = require('./
 const { registerDefaultPages, createCustomPageApiHandlers, generateCustomPageComponent } = require('./modules/custom-pages');
 const { registerModelMenuItems, registerSystemMenuItems, generateMenuComponent } = require('./modules/menu');
 const { generateProfileComponent } = require('./modules/profile');
+const { registerAdminUsersManagement, createAdminUsersApiHandlers, generateAdminUsersComponent } = require('./modules/admin-users');
 const { registerModule, registerPageDir } = require('./core/admin-module');
 
 
@@ -44,11 +45,14 @@ function adminPanelPlugin(options = {}) {
     db,
     auth,
     userManagement: userMgmtConfig,
+    adminUsers: adminUsersOption = true,
     configure,
     uploadUrl: uploadUrlOption,
     richTextSanitize = true,
   } = options;
 
+  const adminUsersConfig = typeof adminUsersOption === 'object' ? adminUsersOption : { enabled: adminUsersOption !== false };
+
   // Validate required options
   if (!db) {
     throw new Error('Admin panel plugin requires a database instance. Pass `db` in options.');
@@ -152,13 +156,20 @@ function adminPanelPlugin(options = {}) {
       // Session must be registered before file routes so SSR pages can read adminUser.
       if (enabled && ctx.app && !ctx.app._webspressoSessionInitialized) {
         const secret = sessionSecret || process.env.SESSION_SECRET || 'webspresso-admin-secret-change-in-production';
+        const secureMode =
+          process.env.NODE_ENV === 'production' ||
+          process.env.COOKIE_SECURE === 'true' ||
+          /^https:/i.test(String(process.env.BASE_URL || '').trim())
+            ? true
+            : 'auto';
         ctx.app.use(session({
           secret,
           resave: false,
           saveUninitialized: false,
           cookie: {
-            secure: process.env.NODE_ENV === 'production',
+            secure: secureMode,
             httpOnly: true,
+            sameSite: 'lax',
             maxAge: 24 * 60 * 60 * 1000, // 24 hours
           },
         }));
@@ -227,6 +238,14 @@ function adminPanelPlugin(options = {}) {
         });
       }
 
+      // Register admin user management if enabled
+      if (adminUsersConfig.enabled !== false) {
+        registerAdminUsersManagement({
+          registry,
+          config: adminUsersConfig,
+        });
+      }
+
       // Create API handlers
       const apiHandlers = createApiHandlers({
         path: adminPath,
@@ -245,6 +264,16 @@ function adminPanelPlugin(options = {}) {
 
       const pageHandlers = createCustomPageApiHandlers({ registry, db });
 
+      // Admin users management API handlers
+      let adminUsersHandlers = null;
+      if (adminUsersConfig.enabled !== false) {
+        adminUsersHandlers = createAdminUsersApiHandlers({
+          db,
+          AdminUser,
+          hashPassword: (password, rounds) => bcrypt.hash(password, rounds),
+        });
+      }
+
       // User management API handlers
       let userHandlers = null;
       if (userMgmtConfig?.enabled) {
@@ -289,6 +318,15 @@ function adminPanelPlugin(options = {}) {
       ctx.addRoute('get', `${adminPath}/api/extensions/pages/:pageId/data`, requireAuth, pageHandlers.getPageData);
       ctx.addRoute('all', `${adminPath}/api/extensions/pages/:pageId/actions/:actionId`, requireAuth, pageHandlers.executePageAction);
 
+      // Admin users management API routes
+      if (adminUsersHandlers) {
+        ctx.addRoute('get', `${adminPath}/api/admins`, requireAuth, adminUsersHandlers.listAdmins);
+        ctx.addRoute('get', `${adminPath}/api/admins/:id`, requireAuth, adminUsersHandlers.getAdmin);
+        ctx.addRoute('post', `${adminPath}/api/admins`, requireAuth, adminUsersHandlers.createAdmin);
+        ctx.addRoute('put', `${adminPath}/api/admins/:id`, requireAuth, adminUsersHandlers.updateAdmin);
+        ctx.addRoute('delete', `${adminPath}/api/admins/:id`, requireAuth, adminUsersHandlers.deleteAdmin);
+      }
+
       // User management API routes
       if (userHandlers) {
         ctx.addRoute('get', `${adminPath}/api/users`, requireAuth, userHandlers.listUsers);
@@ -391,6 +429,7 @@ function generateAdminPanelHtml(adminPath, registry) {
   const bulkActionsComponent = generateBulkActionsComponent();
   const customPageComponent = generateCustomPageComponent();
   const profileComponent = generateProfileComponent();
+  const adminUsersComponent = generateAdminUsersComponent();
 
   const settings = registry.settings;
   const fieldRenderersCode = Array.from(registry.fieldRenderers.entries()).map(([type, r]) => {
@@ -473,6 +512,7 @@ function generateAdminPanelHtml(adminPath, registry) {
     ${bulkActionsComponent}
     ${customPageComponent}
     ${profileComponent}
+    ${adminUsersComponent}
 
     // Custom page components container
     window.__customPages = window.__customPages || {};