webspresso 0.0.89 → 0.0.91

package/bin/commands/service.js

@@ -0,0 +1,193 @@
+/**
+ * Webspresso CLI: Service Command
+ * Run and test services interactively without starting the HTTP server
+ * @module bin/commands/service
+ */
+
+const path = require('path');
+const inquirer = require('inquirer');
+const { createServiceRegistry } = require('../../src/services');
+const { resolveDbConfigIfExists, createDbInstance } = require('../utils/db');
+
+/**
+ * Parse input string into an object
+ * @param {string} inputStr
+ * @returns {*}
+ */
+function parseInputPayload(inputStr) {
+  if (!inputStr || typeof inputStr !== 'string') {
+    return {};
+  }
+
+  const trimmed = inputStr.trim();
+  if (!trimmed) return {};
+
+  // Try JSON first
+  if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+    try {
+      return JSON.parse(trimmed);
+    } catch (e) {
+      throw new Error(`Invalid JSON input: ${e.message}`);
+    }
+  }
+
+  // Try key=value pairs (e.g. "id=42 name=Alice" or "id=42&name=Alice")
+  const result = {};
+  const pairs = trimmed.includes('&') ? trimmed.split('&') : trimmed.split(/\s+/);
+
+  for (const pair of pairs) {
+    if (!pair.includes('=')) continue;
+    const [rawKey, ...valParts] = pair.split('=');
+    const key = rawKey.trim();
+    const val = valParts.join('=').trim();
+
+    // Auto coerce simple types
+    if (val === 'true') result[key] = true;
+    else if (val === 'false') result[key] = false;
+    else if (val === 'null') result[key] = null;
+    else if (!Number.isNaN(Number(val)) && val !== '') result[key] = Number(val);
+    else result[key] = val;
+  }
+
+  return Object.keys(result).length > 0 ? result : trimmed;
+}
+
+function registerCommand(program) {
+  program
+    .command('service [name]')
+    .alias('service:run')
+    .alias('service:call')
+    .description('Run and test services interactively without starting the HTTP server')
+    .option('-i, --input <payload>', 'Input payload as JSON string or key=val pairs')
+    .option('-d, --dir <path>', 'Path to services directory (default: ./services)')
+    .option('-c, --config <path>', 'Path to database config file (optional)')
+    .option('-E, --env <environment>', 'Environment (development, production)', 'development')
+    .action(async (nameArg, options) => {
+      let db = null;
+      try {
+        const servicesDir = options.dir
+          ? path.resolve(process.cwd(), options.dir)
+          : path.resolve(process.cwd(), 'services');
+
+        const registry = createServiceRegistry({
+          servicesDir,
+          isDev: true,
+        });
+
+        const serviceNames = registry.list();
+
+        if (serviceNames.length === 0) {
+          console.log(`\n⚠️  No services found in "${path.relative(process.cwd(), servicesDir) || '.'}".`);
+          console.log('   Create your first service file in services/user/get.js\n');
+          return;
+        }
+
+        let serviceName = nameArg;
+
+        // Interactive Service Selection if not provided
+        if (!serviceName) {
+          console.log(`\n⚡ Discovered ${serviceNames.length} service(s) in ${path.relative(process.cwd(), servicesDir) || 'services/'}:\n`);
+
+          const answer = await inquirer.prompt([
+            {
+              type: 'list',
+              name: 'selectedService',
+              message: 'Select a service to execute:',
+              choices: serviceNames.map((name) => {
+                const def = registry.get(name);
+                const hasSchema = !!def?.schema;
+                return {
+                  name: `${name.padEnd(25)} ${hasSchema ? '📋 (has schema)' : ''}`,
+                  value: name,
+                };
+              }),
+            },
+          ]);
+
+          serviceName = answer.selectedService;
+        }
+
+        if (!registry.has(serviceName)) {
+          console.error(`\n❌ Error: Service "${serviceName}" not found.`);
+          console.log(`   Available services: ${serviceNames.join(', ')}\n`);
+          process.exit(1);
+        }
+
+        const serviceDef = registry.get(serviceName);
+
+        // Input gathering
+        let input = {};
+        if (options.input) {
+          input = parseInputPayload(options.input);
+        } else {
+          console.log(`\n⚙️  Target: \x1b[36m${serviceName}\x1b[0m (${serviceDef.filePath ? path.relative(process.cwd(), serviceDef.filePath) : 'in-memory'})`);
+
+          const inputAnswer = await inquirer.prompt([
+            {
+              type: 'input',
+              name: 'rawInput',
+              message: 'Enter input (JSON or key=val pairs, leave empty for {}):',
+              default: '{}',
+            },
+          ]);
+
+          input = parseInputPayload(inputAnswer.rawInput);
+        }
+
+        // Initialize DB if config exists
+        const dbConfigResult = resolveDbConfigIfExists(options.config);
+        if (dbConfigResult) {
+          try {
+            db = await createDbInstance(dbConfigResult.config, options.env);
+          } catch (dbErr) {
+            console.warn(`\n⚠️  Could not connect to database: ${dbErr.message}`);
+          }
+        }
+
+        const ctx = {
+          db,
+          user: { id: 1, role: 'admin', email: 'cli-admin@webspresso.local' },
+          logger: console,
+        };
+
+        console.log(`\n🚀 Executing \x1b[36m${serviceName}\x1b[0m with input:`, JSON.stringify(input));
+        const startTime = Date.now();
+
+        try {
+          const result = await registry.call(serviceName, input, ctx);
+          const duration = Date.now() - startTime;
+
+          console.log(`\n✅ \x1b[32mExecution succeeded (${duration}ms)\x1b[0m\n`);
+          console.log(JSON.stringify(result, null, 2));
+          console.log('');
+        } catch (execErr) {
+          const duration = Date.now() - startTime;
+          console.error(`\n❌ \x1b[31mExecution failed (${duration}ms): ${execErr.message}\x1b[0m\n`);
+
+          if (execErr.fields) {
+            console.error('Validation Details:');
+            for (const [f, msg] of Object.entries(execErr.fields)) {
+              console.error(`  - ${f}: ${msg}`);
+            }
+            console.error('');
+          } else if (execErr.stack) {
+            console.error(execErr.stack);
+            console.error('');
+          }
+          process.exitCode = 1;
+        }
+      } catch (err) {
+        console.error(`\n❌ CLI Error: ${err.message}\n`);
+        process.exitCode = 1;
+      } finally {
+        if (db && typeof db.destroy === 'function') {
+          await db.destroy();
+        }
+      }
+    });
+}
+
+module.exports = {
+  registerCommand,
+  parseInputPayload,
+};

package/bin/webspresso.js

@@ -33,6 +33,7 @@ const { registerCommand: registerDoctor } = require('./commands/doctor');
 const { registerCommand: registerSkill } = require('./commands/skill');
 const { registerCommand: registerUpgrade } = require('./commands/upgrade');
 const { registerCommand: registerOrmMap } = require('./commands/orm-map');
+const { registerCommand: registerService } = require('./commands/service');
 
 registerNew(program);
 registerPage(program);
@@ -54,6 +55,7 @@ registerDoctor(program);
 registerSkill(program);
 registerUpgrade(program);
 registerOrmMap(program);
+registerService(program);
 
 // Parse arguments
 program.parse();

package/core/auth/manager.js

@@ -38,7 +38,7 @@ const DEFAULT_CONFIG = {
     saveUninitialized: false,
     cookie: {
       httpOnly: true,
-      secure: process.env.NODE_ENV === 'production',
+      secure: process.env.NODE_ENV === 'production' ? true : 'auto',
       sameSite: 'lax',
       maxAge: 24 * 60 * 60 * 1000, // 1 day
     },
@@ -272,9 +272,11 @@ class AuthManager {
           throw new AuthenticationError('Invalid user object', 'INVALID_USER');
         }
         
-        // Set session
-        req.session.userId = user.id;
-        req.session.loggedInAt = Date.now();
+        // Set session if active
+        if (req.session) {
+          req.session.userId = user.id;
+          req.session.loggedInAt = Date.now();
+        }
         
         // Set req.user
         req.user = user;
@@ -284,19 +286,21 @@ class AuthManager {
           await self.createRememberToken(user.id, res);
         }
         
-        // Regenerate session ID for security
-        return new Promise((resolve, reject) => {
-          req.session.regenerate((err) => {
-            if (err) {
-              reject(new AuthenticationError('Session regeneration failed', 'SESSION_ERROR'));
-            } else {
-              // Restore userId after regenerate
-              req.session.userId = user.id;
-              req.session.loggedInAt = Date.now();
-              resolve();
-            }
+        // Regenerate session ID for security if supported
+        if (req.session && typeof req.session.regenerate === 'function') {
+          return new Promise((resolve, reject) => {
+            req.session.regenerate((err) => {
+              if (err) {
+                reject(new AuthenticationError('Session regeneration failed', 'SESSION_ERROR'));
+              } else {
+                // Restore userId after regenerate
+                req.session.userId = user.id;
+                req.session.loggedInAt = Date.now();
+                resolve();
+              }
+            });
           });
-        });
+        }
       },
 
       /**
@@ -320,21 +324,25 @@ class AuthManager {
           }
           
           // Clear cookie
-          res.clearCookie(self.config.rememberMe.cookieName);
+          if (typeof res?.clearCookie === 'function') {
+            res.clearCookie(self.config.rememberMe.cookieName);
+          }
         }
         
         // Clear user
         req.user = null;
         
-        // Destroy session
-        return new Promise((resolve) => {
-          req.session.destroy((err) => {
-            if (err) {
-              console.error('Session destroy error:', err);
-            }
-            resolve();
+        // Destroy session if supported
+        if (req.session && typeof req.session.destroy === 'function') {
+          return new Promise((resolve) => {
+            req.session.destroy((err) => {
+              if (err) {
+                console.error('Session destroy error:', err);
+              }
+              resolve();
+            });
           });
-        });
+        }
       },
 
       /**
@@ -715,7 +723,9 @@ class AuthManager {
     const payload = {
       id: user.id,
       type: 'access',
-      [this.identifierField]: user[this.identifierField],
+      ...(this.identifierField && user[this.identifierField] ? { [this.identifierField]: user[this.identifierField] } : {}),
+      ...(user.email && { email: user.email }),
+      ...(user.role && { role: user.role }),
       ...options.payload,
     };
     return this.createJwt(payload, options);

package/core/auth/middleware.js

@@ -15,11 +15,30 @@ const cookieParser = require('cookie-parser');
 function createAuthMiddleware(authManager) {
   const config = authManager.config;
 
+  const sessionConfig = authManager.getSessionConfig();
+
+  if (!sessionConfig.store && process.env.NODE_ENV === 'production') {
+    const warnMsg = '[webspresso:auth] Warning: Default MemoryStore is being used in production. It is not designed for production environments and will leak memory under high load. Please configure a persistent session store (e.g. Knex or Redis).';
+    if (typeof process !== 'undefined' && typeof process.emitWarning === 'function') {
+      process.emitWarning(warnMsg, 'SecurityWarning');
+    } else {
+      console.warn(warnMsg);
+    }
+  }
+
   /**
    * Session middleware
-   * Sets up express-session
+   * Sets up express-session with secure cookie enforcement
    */
-  const sessionMiddleware = session(authManager.getSessionConfig());
+  const sessionMiddleware = session({
+    ...sessionConfig,
+    cookie: {
+      httpOnly: true,
+      sameSite: 'lax',
+      secure: 'auto',
+      ...(sessionConfig.cookie || {}),
+    },
+  });
 
   /**
    * Cookie parser middleware (needed for signed cookies / remember me)

package/core/compression/compressible.js

@@ -0,0 +1,51 @@
+/**
+ * Content-Type Compressibility Filter
+ * Determines if a given MIME type benefits from HTTP compression.
+ * @module core/compression/compressible
+ */
+
+// Regex patterns for MIME types that benefit from compression
+const COMPRESSIBLE_TYPE_REGEX = /^(?:text\/[a-z0-9.+_-]+|application\/(?:javascript|x-javascript|json|ld\+json|manifest\+json|graphql\+json|geo\+json|xml|atom\+xml|rss\+xml|xhtml\+xml|x-yaml|yaml|vnd\.api\+json|schema\+json|hal\+json)|image\/svg\+xml)$/i;
+
+// Regex patterns for already-compressed or non-compressible types
+const INCOMPRESSIBLE_TYPE_REGEX = /^(?:image\/(?:jpeg|png|gif|webp|avif|heic|heif)|video\/[a-z0-9.+_-]+|audio\/[a-z0-9.+_-]+|application\/(?:zip|gzip|x-gzip|x-bzip2|x-compress|x-7z-compressed|x-rar-compressed|pdf|wasm|octet-stream))$/i;
+
+/**
+ * Determine if a Content-Type is compressible
+ * @param {string|undefined|null} contentType - Raw Content-Type header (e.g. 'text/html; charset=utf-8')
+ * @returns {boolean}
+ */
+function isCompressible(contentType) {
+  if (!contentType || typeof contentType !== 'string') {
+    return false;
+  }
+
+  // Extract base MIME type (strip parameters like ; charset=utf-8)
+  const semiIndex = contentType.indexOf(';');
+  const mime = (semiIndex !== -1 ? contentType.slice(0, semiIndex) : contentType).trim().toLowerCase();
+
+  if (!mime) {
+    return false;
+  }
+
+  // Fast negative check
+  if (INCOMPRESSIBLE_TYPE_REGEX.test(mime)) {
+    return false;
+  }
+
+  // Check compressible match
+  if (COMPRESSIBLE_TYPE_REGEX.test(mime)) {
+    return true;
+  }
+
+  // General text or suffix match (+json, +xml, +yaml)
+  if (mime.startsWith('text/') || mime.endsWith('+json') || mime.endsWith('+xml') || mime.endsWith('+yaml')) {
+    return true;
+  }
+
+  return false;
+}
+
+module.exports = {
+  isCompressible,
+};

package/core/compression/compression-stream.js

@@ -0,0 +1,59 @@
+/**
+ * Compression Stream Factory
+ * Instantiates native node:zlib transform streams (brotli, gzip, deflate).
+ * @module core/compression/compression-stream
+ */
+
+const zlib = require('zlib');
+const { supportsBrotli } = require('./negotiate');
+
+/**
+ * Create a zlib compression transform stream based on encoding
+ * @param {'br'|'gzip'|'deflate'} encoding
+ * @param {Object} [options]
+ * @param {number} [options.level=6] - Default compression level (0-9 for gzip/deflate, 0-11 for brotli)
+ * @param {Object} [options.brotli] - Custom options for zlib.createBrotliCompress
+ * @param {Object} [options.gzip] - Custom options for zlib.createGzip
+ * @param {Object} [options.deflate] - Custom options for zlib.createDeflate
+ * @returns {import('stream').Transform|null}
+ */
+function createCompressionStream(encoding, options = {}) {
+  const enc = (encoding || '').toLowerCase();
+  const level = typeof options.level === 'number' ? options.level : 6;
+
+  switch (enc) {
+    case 'br': {
+      if (!supportsBrotli()) {
+        return null;
+      }
+      const brotliOpts = { ...(options.brotli || {}) };
+      if (!brotliOpts.params) {
+        brotliOpts.params = {};
+      }
+      if (brotliOpts.params[zlib.constants.BROTLI_PARAM_QUALITY] === undefined) {
+        // Brotli quality 4 is standard for dynamic HTTP compression (fast & high ratio)
+        brotliOpts.params[zlib.constants.BROTLI_PARAM_QUALITY] = typeof options.brotli?.quality === 'number'
+          ? options.brotli.quality
+          : (options.level !== undefined ? options.level : 4);
+      }
+      return zlib.createBrotliCompress(brotliOpts);
+    }
+
+    case 'gzip': {
+      const gzipOpts = { level, ...(options.gzip || {}) };
+      return zlib.createGzip(gzipOpts);
+    }
+
+    case 'deflate': {
+      const deflateOpts = { level, ...(options.deflate || {}) };
+      return zlib.createDeflate(deflateOpts);
+    }
+
+    default:
+      return null;
+  }
+}
+
+module.exports = {
+  createCompressionStream,
+};

package/core/compression/index.js

@@ -0,0 +1,25 @@
+/**
+ * Webspresso HTTP Response Compression Module
+ * @module core/compression
+ */
+
+const {
+  supportsBrotli,
+  getDefaultSupportedEncodings,
+  parseAcceptEncoding,
+  selectEncoding,
+} = require('./negotiate');
+const { isCompressible } = require('./compressible');
+const { createCompressionStream } = require('./compression-stream');
+const { createCompressionMiddleware, appendVary } = require('./middleware');
+
+module.exports = {
+  supportsBrotli,
+  getDefaultSupportedEncodings,
+  parseAcceptEncoding,
+  selectEncoding,
+  isCompressible,
+  createCompressionStream,
+  createCompressionMiddleware,
+  appendVary,
+};