webspresso 0.0.89 → 0.0.91

package/plugins/admin-panel/index.js

@@ -4,6 +4,8 @@
  * @module plugins/admin-panel
  */
 
+const path = require('path');
+const fs = require('fs');
 const { createAdminUserModel } = require('./admin-user-model');
 const { generateAdminUsersMigration } = require('./migration-template');
 const { createApiHandlers } = require('./api');
@@ -16,6 +18,7 @@ const { registerDefaultBulkActions, generateBulkActionsComponent } = require('./
 const { registerDefaultPages, createCustomPageApiHandlers, generateCustomPageComponent } = require('./modules/custom-pages');
 const { registerModelMenuItems, registerSystemMenuItems, generateMenuComponent } = require('./modules/menu');
 const { generateProfileComponent } = require('./modules/profile');
+const { registerAdminUsersManagement, createAdminUsersApiHandlers, generateAdminUsersComponent } = require('./modules/admin-users');
 const { registerModule, registerPageDir } = require('./core/admin-module');
 
 
@@ -44,11 +47,14 @@ function adminPanelPlugin(options = {}) {
     db,
     auth,
     userManagement: userMgmtConfig,
+    adminUsers: adminUsersOption = true,
     configure,
     uploadUrl: uploadUrlOption,
     richTextSanitize = true,
   } = options;
 
+  const adminUsersConfig = typeof adminUsersOption === 'object' ? adminUsersOption : { enabled: adminUsersOption !== false };
+
   // Validate required options
   if (!db) {
     throw new Error('Admin panel plugin requires a database instance. Pass `db` in options.');
@@ -71,22 +77,26 @@ function adminPanelPlugin(options = {}) {
     version: '2.0.0',
     description: 'Modular admin panel for Webspresso with extensions support',
     
-    // CSP requirements for admin panel scripts, styles, and custom page iframe sources
-    // Note: cdn.quilljs.com 301-redirects to cdn.jsdelivr.net; CSP is enforced on the final URL.
+    // CSP requirements for admin panel scripts, styles, and custom page iframe sources (Offline Zero-CDN)
     csp: {
       styleSrc: [
+        "'self'",
+        "'unsafe-inline'",
         'https://cdn.quilljs.com',
         'https://cdn.jsdelivr.net',
         'https://unpkg.com',
         'https://cdn.tailwindcss.com',
       ],
       scriptSrc: [
+        "'self'",
+        "'unsafe-inline'",
+        "'unsafe-eval'",
         'https://cdn.quilljs.com',
         'https://cdn.jsdelivr.net',
         'https://unpkg.com',
         'https://cdn.tailwindcss.com',
       ],
-      connectSrc: ['https://unpkg.com', 'https://cdn.tailwindcss.com', 'https://cdn.jsdelivr.net'],
+      connectSrc: ["'self'", 'https://unpkg.com', 'https://cdn.tailwindcss.com', 'https://cdn.jsdelivr.net'],
       frameSrc: ["'self'", 'data:', 'blob:', 'https:'],
     },
     enabled,
@@ -152,13 +162,29 @@ function adminPanelPlugin(options = {}) {
       // Session must be registered before file routes so SSR pages can read adminUser.
       if (enabled && ctx.app && !ctx.app._webspressoSessionInitialized) {
         const secret = sessionSecret || process.env.SESSION_SECRET || 'webspresso-admin-secret-change-in-production';
+        const secureMode =
+          process.env.NODE_ENV === 'production' ||
+          process.env.COOKIE_SECURE === 'true' ||
+          /^https:/i.test(String(process.env.BASE_URL || '').trim())
+            ? true
+            : 'auto';
+        if (process.env.NODE_ENV === 'production') {
+          const warnMsg = '[webspresso:admin] Warning: Admin panel is using default MemoryStore in production. Please configure a persistent session store to prevent memory leaks.';
+          if (typeof process !== 'undefined' && typeof process.emitWarning === 'function') {
+            process.emitWarning(warnMsg, 'SecurityWarning');
+          } else {
+            console.warn(warnMsg);
+          }
+        }
+
         ctx.app.use(session({
           secret,
           resave: false,
           saveUninitialized: false,
           cookie: {
-            secure: process.env.NODE_ENV === 'production',
+            secure: secureMode,
             httpOnly: true,
+            sameSite: 'lax',
             maxAge: 24 * 60 * 60 * 1000, // 24 hours
           },
         }));
@@ -178,22 +204,24 @@ function adminPanelPlugin(options = {}) {
       const { app } = ctx;
 
       const uploadUrlResolved =
-        uploadUrlOption || app.get('webspresso.uploadPath') || null;
+        uploadUrlOption || (app && typeof app.get === 'function' ? app.get('webspresso.uploadPath') : null);
       if (uploadUrlResolved) {
         registry.configure({ uploadUrl: uploadUrlResolved });
       }
 
       // Check if admin_users table exists (migration run)
-      db.knex.schema.hasTable('admin_users').then((hasAdminTable) => {
-        if (!hasAdminTable) {
-          console.warn(
-            '\n⚠️  [admin-panel] admin_users table not found. Run: webspresso admin:setup\n' +
-            '   Or create the table manually via migration. See: AdminUser model / getMigrationTemplate()\n'
-          );
-        }
-      }).catch((err) => {
-        console.warn('[admin-panel] Could not check admin_users table:', err.message);
-      });
+      if (db?.knex?.schema?.hasTable) {
+        db.knex.schema.hasTable('admin_users').then((hasAdminTable) => {
+          if (!hasAdminTable) {
+            console.warn(
+              '\n⚠️  [admin-panel] admin_users table not found. Run: webspresso admin:setup\n' +
+              '   Or create the table manually via migration. See: AdminUser model / getMigrationTemplate()\n'
+            );
+          }
+        }).catch((err) => {
+          console.warn('[admin-panel] Could not check admin_users table:', err.message);
+        });
+      }
 
       // Create and register AdminUser model
       const { hasModel: hasGlobalModel, getModel: getGlobalModel } = require('../../core/orm/model');
@@ -227,6 +255,14 @@ function adminPanelPlugin(options = {}) {
         });
       }
 
+      // Register admin user management if enabled
+      if (adminUsersConfig.enabled !== false) {
+        registerAdminUsersManagement({
+          registry,
+          config: adminUsersConfig,
+        });
+      }
+
       // Create API handlers
       const apiHandlers = createApiHandlers({
         path: adminPath,
@@ -245,6 +281,16 @@ function adminPanelPlugin(options = {}) {
 
       const pageHandlers = createCustomPageApiHandlers({ registry, db });
 
+      // Admin users management API handlers
+      let adminUsersHandlers = null;
+      if (adminUsersConfig.enabled !== false) {
+        adminUsersHandlers = createAdminUsersApiHandlers({
+          db,
+          AdminUser,
+          hashPassword: (password, rounds) => bcrypt.hash(password, rounds),
+        });
+      }
+
       // User management API handlers
       let userHandlers = null;
       if (userMgmtConfig?.enabled) {
@@ -284,11 +330,22 @@ function adminPanelPlugin(options = {}) {
       // Settings API routes
       ctx.addRoute('get', `${adminPath}/api/extensions/settings`, requireAuth, extensionHandlers.settingsGetHandler);
       ctx.addRoute('post', `${adminPath}/api/extensions/settings`, requireAuth, extensionHandlers.settingsUpdateHandler);
+      ctx.addRoute('get', `${adminPath}/api/extensions/system-info`, requireAuth, extensionHandlers.systemInfoHandler);
+      ctx.addRoute('get', `${adminPath}/api/system-info`, requireAuth, extensionHandlers.systemInfoHandler);
 
       // Custom pages API routes
       ctx.addRoute('get', `${adminPath}/api/extensions/pages/:pageId/data`, requireAuth, pageHandlers.getPageData);
       ctx.addRoute('all', `${adminPath}/api/extensions/pages/:pageId/actions/:actionId`, requireAuth, pageHandlers.executePageAction);
 
+      // Admin users management API routes
+      if (adminUsersHandlers) {
+        ctx.addRoute('get', `${adminPath}/api/admins`, requireAuth, adminUsersHandlers.listAdmins);
+        ctx.addRoute('get', `${adminPath}/api/admins/:id`, requireAuth, adminUsersHandlers.getAdmin);
+        ctx.addRoute('post', `${adminPath}/api/admins`, requireAuth, adminUsersHandlers.createAdmin);
+        ctx.addRoute('put', `${adminPath}/api/admins/:id`, requireAuth, adminUsersHandlers.updateAdmin);
+        ctx.addRoute('delete', `${adminPath}/api/admins/:id`, requireAuth, adminUsersHandlers.deleteAdmin);
+      }
+
       // User management API routes
       if (userHandlers) {
         ctx.addRoute('get', `${adminPath}/api/users`, requireAuth, userHandlers.listUsers);
@@ -322,6 +379,30 @@ function adminPanelPlugin(options = {}) {
       // Query API routes (auth required)
       ctx.addRoute('get', `${adminPath}/api/models/:model/queries/:query`, requireAuth, apiHandlers.queryHandler);
 
+      // ==========================================
+      // Static Vendor Assets (Offline Zero-CDN)
+      // ==========================================
+      const vendorDir = path.join(__dirname, 'vendor');
+      ctx.addRoute('get', `${adminPath}/vendor/:file`, (req, res) => {
+        const fileName = path.basename(req.params.file);
+        const filePath = path.join(vendorDir, fileName);
+
+        if (!fs.existsSync(filePath)) {
+          return res.status(404).send('Vendor asset not found');
+        }
+
+        if (fileName.endsWith('.js')) {
+          res.type('application/javascript');
+        } else if (fileName.endsWith('.css')) {
+          res.type('text/css');
+        } else {
+          res.type('application/octet-stream');
+        }
+
+        res.setHeader('Cache-Control', 'public, max-age=86400');
+        res.sendFile(filePath);
+      });
+
       // ==========================================
       // HTML Endpoints
       // ==========================================
@@ -391,6 +472,7 @@ function generateAdminPanelHtml(adminPath, registry) {
   const bulkActionsComponent = generateBulkActionsComponent();
   const customPageComponent = generateCustomPageComponent();
   const profileComponent = generateProfileComponent();
+  const adminUsersComponent = generateAdminUsersComponent();
 
   const settings = registry.settings;
   const fieldRenderersCode = Array.from(registry.fieldRenderers.entries()).map(([type, r]) => {
@@ -426,9 +508,9 @@ function generateAdminPanelHtml(adminPath, registry) {
       });
     } catch (e) {}
   })();
-  </script>
-  <script src="https://unpkg.com/mithril/mithril.js"></script>
-  <script src="https://cdn.tailwindcss.com"></script>
+  <script>window.__ADMIN_PATH__ = ${JSON.stringify(adminPath)};</script>
+  <script src="${adminPath}/vendor/mithril.min.js"></script>
+  <script src="${adminPath}/vendor/tailwind.min.js"></script>
   <script>tailwind.config = { darkMode: 'class' };</script>
   <style>
     body { margin: 0; font-family: system-ui, -apple-system, sans-serif; }
@@ -445,6 +527,35 @@ function generateAdminPanelHtml(adminPath, registry) {
     .dark .ql-snow .ql-stroke { stroke: #94a3b8; }
     .dark .ql-snow .ql-fill { fill: #94a3b8; }
     .dark .ql-picker { color: #cbd5e1; }
+    @media (min-width: 768px) {
+      .admin-table-sticky-check {
+        position: sticky;
+        left: 0;
+        z-index: 5;
+        box-shadow: 4px 0 8px -4px rgba(0, 0, 0, 0.08);
+      }
+      th.admin-table-sticky-check {
+        z-index: 15;
+      }
+      .admin-table-sticky-first {
+        position: sticky;
+        left: 40px;
+        z-index: 5;
+        box-shadow: 4px 0 8px -4px rgba(0, 0, 0, 0.08);
+      }
+      th.admin-table-sticky-first {
+        z-index: 15;
+      }
+      .admin-table-sticky-actions {
+        position: sticky;
+        right: 0;
+        z-index: 5;
+        box-shadow: -4px 0 8px -4px rgba(0, 0, 0, 0.08);
+      }
+      th.admin-table-sticky-actions {
+        z-index: 15;
+      }
+    }
   </style>
   ${registry.getStylesHtml()}
   ${registry.getScriptsHtml('head')}
@@ -473,6 +584,7 @@ function generateAdminPanelHtml(adminPath, registry) {
     ${bulkActionsComponent}
     ${customPageComponent}
     ${profileComponent}
+    ${adminUsersComponent}
 
     // Custom page components container
     window.__customPages = window.__customPages || {};
@@ -490,5 +602,6 @@ function generateAdminPanelHtml(adminPath, registry) {
 
 // Export registry and utilities for external use
 module.exports = adminPanelPlugin;
+module.exports.adminPanelPlugin = adminPanelPlugin;
 module.exports.AdminRegistry = AdminRegistry;
 module.exports.defaultRegistry = defaultRegistry;