webspresso 0.0.89 → 0.0.91

package/plugins/basic-auth/index.js

@@ -0,0 +1,293 @@
+/**
+ * Basic Auth Plugin — HTTP Basic Authentication (RFC 7617) for Webspresso
+ * Zero external dependencies (uses native Node.js crypto for timing-safe equality)
+ * @module plugins/basic-auth
+ */
+
+const crypto = require('crypto');
+
+/**
+ * Compare two strings in constant time to prevent timing attacks.
+ * Uses dummy buffer comparison if lengths differ to avoid leaking length via response timing.
+ * 
+ * @param {string} a
+ * @param {string} b
+ * @returns {boolean}
+ */
+function safeCompare(a, b) {
+  if (typeof a !== 'string' || typeof b !== 'string') {
+    return false;
+  }
+
+  const bufA = Buffer.from(a, 'utf8');
+  const bufB = Buffer.from(b, 'utf8');
+
+  if (bufA.length !== bufB.length) {
+    // Perform dummy timing-safe comparison with itself to preserve constant execution time
+    crypto.timingSafeEqual(bufA, bufA);
+    return false;
+  }
+
+  return crypto.timingSafeEqual(bufA, bufB);
+}
+
+/**
+ * Parse an HTTP Authorization header for Basic credentials.
+ * 
+ * @param {string} header - e.g. "Basic dXNlcjpwYXNz"
+ * @returns {{ username: string, password: string } | null}
+ */
+function parseBasicAuthHeader(header) {
+  if (!header || typeof header !== 'string') {
+    return null;
+  }
+
+  const parts = header.trim().split(/\s+/);
+  if (parts.length !== 2 || parts[0].toLowerCase() !== 'basic') {
+    return null;
+  }
+
+  try {
+    const decoded = Buffer.from(parts[1], 'base64').toString('utf8');
+    const colonIndex = decoded.indexOf(':');
+    if (colonIndex === -1) {
+      return null;
+    }
+
+    const username = decoded.slice(0, colonIndex);
+    const password = decoded.slice(colonIndex + 1);
+    return { username, password };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Extract credentials from request Authorization header or proxy headers
+ * 
+ * @param {import('express').Request} req
+ * @returns {{ username: string, password: string } | null}
+ */
+function extractCredentials(req) {
+  const header = req.headers.authorization || req.headers.Authorization;
+  return parseBasicAuthHeader(header);
+}
+
+/**
+ * Check if request matches path prefix list
+ * 
+ * @param {string} path
+ * @param {string|string[]|boolean} routes
+ * @returns {boolean}
+ */
+function shouldApplyToRoute(path, routes) {
+  if (routes === true || routes == null) return true;
+  const list = Array.isArray(routes) ? routes : [routes];
+  return list.some((prefix) => path.startsWith(prefix));
+}
+
+/**
+ * Check if request path should be skipped
+ * 
+ * @param {import('express').Request} req
+ * @param {string[]} skipPaths
+ * @param {Function} [skipFn]
+ * @returns {boolean}
+ */
+function isSkipped(req, skipPaths = [], skipFn) {
+  if (typeof skipFn === 'function' && skipFn(req)) {
+    return true;
+  }
+  const p = req.path || req.url || '';
+  if (Array.isArray(skipPaths) && skipPaths.some((prefix) => p.startsWith(prefix))) {
+    return true;
+  }
+  return false;
+}
+
+/**
+ * Send 401 Unauthorized response with optional Basic challenge header
+ * 
+ * @param {import('express').Request} req
+ * @param {import('express').Response} res
+ * @param {Object} config
+ */
+function sendUnauthorized(req, res, config) {
+  res.statusCode = 401;
+
+  if (config.challenge !== false) {
+    const realm = String(config.realm || 'Restricted Area')
+      .split(/[\r\n]/)[0]
+      .replace(/"/g, '\\"');
+    res.setHeader('WWW-Authenticate', `Basic realm="${realm}"`);
+  }
+
+  if (typeof config.unauthorizedResponse === 'function') {
+    return config.unauthorizedResponse(req, res);
+  }
+
+  if (config.unauthorizedResponse && typeof config.unauthorizedResponse === 'object') {
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    return res.end(JSON.stringify(config.unauthorizedResponse));
+  }
+
+  if (typeof config.unauthorizedResponse === 'string') {
+    res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+    return res.end(config.unauthorizedResponse);
+  }
+
+  const acceptsJson = req.headers.accept && req.headers.accept.includes('application/json');
+  if (acceptsJson) {
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    return res.end(JSON.stringify({ error: 'Unauthorized', message: 'Authentication required.' }));
+  }
+
+  res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+  res.end('Unauthorized');
+}
+
+/**
+ * Create Basic Auth Express middleware
+ * 
+ * @param {Object} [options]
+ * @param {Record<string, string>} [options.users] - Static username-password map
+ * @param {Function} [options.verify] - Custom verification function (username, password, req) => boolean | object | Promise<boolean | object>
+ * @param {string} [options.realm='Restricted Area'] - Realm name in WWW-Authenticate header
+ * @param {boolean} [options.challenge=true] - Whether to send WWW-Authenticate challenge header
+ * @param {string|string[]|boolean} [options.routes=true] - Route prefixes to protect (used in global mode)
+ * @param {string[]} [options.skipPaths] - Array of path prefixes to skip authentication
+ * @param {Function} [options.skip] - Custom predicate function (req) => boolean
+ * @param {Function|string|Object} [options.unauthorizedResponse] - Custom 401 response
+ * @param {Function} [options.onAuthenticated] - Callback hook (req, user) => void
+ * @returns {Function} Express middleware handler
+ */
+function createBasicAuthMiddleware(options = {}) {
+  const config = {
+    realm: 'Restricted Area',
+    challenge: true,
+    routes: true,
+    skipPaths: [],
+    ...options,
+  };
+
+  return async (req, res, next) => {
+    const reqPath = req.path || req.url || '/';
+
+    if (!shouldApplyToRoute(reqPath, config.routes)) {
+      return next();
+    }
+
+    if (isSkipped(req, config.skipPaths, config.skip)) {
+      return next();
+    }
+
+    const credentials = extractCredentials(req);
+    if (!credentials) {
+      return sendUnauthorized(req, res, config);
+    }
+
+    const { username, password } = credentials;
+    let authResult = false;
+
+    if (typeof config.verify === 'function') {
+      try {
+        authResult = await config.verify(username, password, req);
+      } catch (err) {
+        return next(err);
+      }
+    } else if (config.users && typeof config.users === 'object') {
+      const expectedPassword = config.users[username];
+      if (typeof expectedPassword === 'string') {
+        authResult = safeCompare(password, expectedPassword);
+      }
+    }
+
+    if (!authResult) {
+      return sendUnauthorized(req, res, config);
+    }
+
+    // Attach authentication context to request
+    req.basicAuth = { username };
+    req.auth = req.auth || {};
+    const userObj = typeof authResult === 'object' && authResult !== null
+      ? authResult
+      : { username, type: 'basic' };
+
+    req.auth.user = userObj;
+    if (!req.user) {
+      req.user = userObj;
+    }
+
+    if (typeof config.onAuthenticated === 'function') {
+      try {
+        config.onAuthenticated(req, userObj);
+      } catch (err) {
+        return next(err);
+      }
+    }
+
+    next();
+  };
+}
+
+/**
+ * Webspresso Basic Auth Plugin Factory
+ * 
+ * @param {Object} [options] - Plugin configuration options
+ * @param {boolean} [options.global=false] - Whether to apply basic auth as a global middleware on the app
+ * @param {Record<string, string>} [options.users] - Default static username-password dictionary
+ * @param {Function} [options.verify] - Default custom verification function
+ * @param {string} [options.realm='Restricted Area'] - Default realm name
+ * @param {boolean} [options.challenge=true] - Default challenge header flag
+ * @param {string|string[]|boolean} [options.routes=true] - Route prefixes (when global: true)
+ * @param {string[]} [options.skipPaths] - Default skip path prefixes
+ * @param {Function} [options.skip] - Default skip predicate function
+ * @param {Function|string|Object} [options.unauthorizedResponse] - Custom 401 response
+ * @param {Function} [options.onAuthenticated] - Callback hook on successful login
+ * @returns {Object} Webspresso Plugin Definition
+ */
+function basicAuthPlugin(options = {}) {
+  const { global: applyGlobal = false, ...pluginDefaults } = options;
+
+  return {
+    name: 'basic-auth',
+    version: '1.0.0',
+    description: 'HTTP Basic Authentication (RFC 7617) plugin with named middleware and global guard',
+    options,
+
+    api: {
+      createMiddleware: (routeOpts = {}) =>
+        createBasicAuthMiddleware({ ...pluginDefaults, ...routeOpts }),
+      parseHeader: parseBasicAuthHeader,
+      safeCompare,
+      extractCredentials,
+    },
+
+    register(ctx) {
+      // Register named middleware factory for file routes: middleware: ['basicAuth'] or [['basicAuth', { ... }]]
+      if (ctx.middlewares) {
+        ctx.middlewares.basicAuth = (routeOpts = {}) =>
+          createBasicAuthMiddleware({ ...pluginDefaults, ...routeOpts });
+      }
+
+      // Mount global middleware if global: true
+      if (applyGlobal && ctx.app) {
+        const globalMw = createBasicAuthMiddleware(options);
+        ctx.app.use(globalMw);
+      }
+    },
+  };
+}
+
+basicAuthPlugin.basicAuthPlugin = basicAuthPlugin;
+basicAuthPlugin.createBasicAuthMiddleware = createBasicAuthMiddleware;
+basicAuthPlugin.parseBasicAuthHeader = parseBasicAuthHeader;
+basicAuthPlugin.safeCompare = safeCompare;
+basicAuthPlugin.extractCredentials = extractCredentials;
+
+module.exports = basicAuthPlugin;
+module.exports.basicAuthPlugin = basicAuthPlugin;
+module.exports.createBasicAuthMiddleware = createBasicAuthMiddleware;
+module.exports.parseBasicAuthHeader = parseBasicAuthHeader;
+module.exports.safeCompare = safeCompare;
+module.exports.extractCredentials = extractCredentials;

package/plugins/content/client/inline-edit.js

@@ -243,35 +243,59 @@
       });
   }
 
-  function sanitizeClientHtml(htmlStr) {
-    if (!htmlStr) return '';
+  function setSanitizedHtmlContent(el, htmlStr) {
+    if (!htmlStr) {
+      el.textContent = '';
+      return;
+    }
     try {
       var parser = new DOMParser();
       var doc = parser.parseFromString(htmlStr, 'text/html');
-      var forbiddenTags = ['script', 'iframe', 'object', 'embed', 'applet', 'base'];
-      forbiddenTags.forEach(function (tag) {
-        var nodes = doc.querySelectorAll(tag);
-        for (var i = 0; i < nodes.length; i++) {
-          nodes[i].parentNode.removeChild(nodes[i]);
-        }
-      });
-      var allNodes = doc.querySelectorAll('*');
-      for (var i = 0; i < allNodes.length; i++) {
+      var allowedTags = {
+        p: 1, br: 1, b: 1, i: 1, strong: 1, em: 1, u: 1, s: 1, strike: 1,
+        h1: 1, h2: 1, h3: 1, h4: 1, h5: 1, h6: 1, ul: 1, ol: 1, li: 1,
+        blockquote: 1, pre: 1, code: 1, a: 1, span: 1, div: 1, hr: 1,
+        table: 1, thead: 1, tbody: 1, tr: 1, th: 1, td: 1, img: 1
+      };
+      var allowedAttrs = {
+        href: 1, title: 1, target: 1, rel: 1, class: 1, id: 1, src: 1, alt: 1, width: 1, height: 1
+      };
+      var allNodes = doc.body.querySelectorAll('*');
+      for (var i = allNodes.length - 1; i >= 0; i--) {
         var node = allNodes[i];
+        var tag = node.tagName.toLowerCase();
+        if (!allowedTags[tag]) {
+          if (node.parentNode) {
+            node.parentNode.removeChild(node);
+          } else {
+            node.remove();
+          }
+          continue;
+        }
         var attrs = Array.prototype.slice.call(node.attributes);
         for (var j = 0; j < attrs.length; j++) {
           var attrName = attrs[j].name.toLowerCase();
-          var attrVal = attrs[j].value.toLowerCase().trim();
-          if (attrName.indexOf('on') === 0) {
+          var attrVal = attrs[j].value.toLowerCase().replace(/[\x00-\x20\s]+/g, '').trim();
+          if (attrName.indexOf('on') === 0 || !allowedAttrs[attrName]) {
             node.removeAttribute(attrs[j].name);
-          } else if ((attrName === 'href' || attrName === 'src') && attrVal.indexOf('javascript:') === 0) {
+          } else if ((attrName === 'href' || attrName === 'src' || attrName === 'action' || attrName === 'formaction' || attrName === 'xlink:href') &&
+                     /^(?:javascript|data|vbscript):/i.test(attrVal)) {
             node.removeAttribute(attrs[j].name);
+          } else if (tag === 'a' && node.getAttribute('target') === '_blank') {
+            node.setAttribute('rel', 'noopener noreferrer');
           }
         }
       }
-      return doc.body.innerHTML;
+
+      // Transfer DOM nodes directly to target element
+      while (el.firstChild) {
+        el.removeChild(el.firstChild);
+      }
+      while (doc.body.firstChild) {
+        el.appendChild(doc.body.firstChild);
+      }
     } catch (e) {
-      return '';
+      el.textContent = htmlStr;
     }
   }
 
@@ -282,7 +306,7 @@
       var val = data[field];
       var isHtml = el.getAttribute('data-ws-content-html') === 'true';
       if (isHtml) {
-        el.innerHTML = sanitizeClientHtml(val);
+        setSanitizedHtmlContent(el, val);
       } else {
         el.textContent = val != null ? val : '';
       }

package/plugins/cors.js

@@ -47,9 +47,12 @@ function createCorsMiddleware(options = {}) {
 
   function isOriginAllowed(reqOrigin, callback) {
     if (!config.origin || config.origin === '*') {
-      return callback(null, config.origin);
+      if (config.credentials) {
+        return callback(null, false);
+      }
+      return callback(null, '*');
     }
-    if (!reqOrigin) {
+    if (!reqOrigin || reqOrigin === 'null') {
       return callback(null, false);
     }
     if (typeof config.origin === 'string') {
@@ -72,6 +75,9 @@ function createCorsMiddleware(options = {}) {
     if (typeof config.origin === 'function') {
       return config.origin(reqOrigin, callback);
     }
+    if (config.origin === true) {
+      return callback(null, reqOrigin);
+    }
     return callback(null, false);
   }
 
@@ -96,15 +102,13 @@ function createCorsMiddleware(options = {}) {
       }
 
       if (allowedOrigin) {
-        if (allowedOrigin === '*' && config.credentials) {
-          res.setHeader('Access-Control-Allow-Origin', reqOrigin || '*');
-        } else {
-          res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
+        res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
+        if (allowedOrigin !== '*') {
+          res.setHeader('Vary', 'Origin');
         }
-        res.setHeader('Vary', 'Origin');
       }
 
-      if (config.credentials) {
+      if (config.credentials && allowedOrigin && allowedOrigin !== '*') {
         res.setHeader('Access-Control-Allow-Credentials', 'true');
       }
 

package/plugins/csrf/index.js

@@ -158,11 +158,11 @@ function csrfPlugin(options = {}) {
       }
 
       // 1. Retrieve or generate secret token
-      let secret;
+      let csrfTokenValue;
       if (useCookie) {
-        secret = cookieOptions.signed ? req.signedCookies[cookieKey] : req.cookies[cookieKey];
-        if (!secret) {
-          secret = crypto.randomBytes(32).toString('hex');
+        csrfTokenValue = cookieOptions.signed ? req.signedCookies[cookieKey] : req.cookies[cookieKey];
+        if (!csrfTokenValue) {
+          csrfTokenValue = crypto.randomBytes(32).toString('hex');
           const isHttps = req.secure || req.headers?.['x-forwarded-proto'] === 'https' || process.env.NODE_ENV === 'production' || process.env.COOKIE_SECURE === 'true';
           const effectiveCookieOptions = {
             httpOnly: true,
@@ -170,18 +170,18 @@ function csrfPlugin(options = {}) {
             ...cookieOptions,
             secure: cookieOpts.secure !== undefined ? cookieOpts.secure : isHttps,
           };
-          res.cookie(cookieKey, secret, effectiveCookieOptions);
+          res.cookie(cookieKey, csrfTokenValue, effectiveCookieOptions);
         }
       } else {
         // Session based
         if (!req.session[sessionKey]) {
           req.session[sessionKey] = crypto.randomBytes(32).toString('hex');
         }
-        secret = req.session[sessionKey];
+        csrfTokenValue = req.session[sessionKey];
       }
 
       // Define standard req.csrfToken()
-      req.csrfToken = () => secret;
+      req.csrfToken = () => csrfTokenValue;
 
       // 2. Perform CSRF verification for mutating HTTP methods
       const method = req.method ? req.method.toUpperCase() : 'GET';
@@ -196,7 +196,7 @@ function csrfPlugin(options = {}) {
           req.headers['x-xsrf-token']
         );
 
-        if (!submitted || !safeCompare(submitted, secret)) {
+        if (!submitted || !safeCompare(submitted, csrfTokenValue)) {
           res.status(errorStatus);
           if (req.accepts('html') && !req.path.startsWith('/api')) {
             return res.send(`<h1>${errorStatus} Forbidden</h1><p>${errorMessage}</p>`);

package/plugins/data-exchange/export-xlsx.js

@@ -15,7 +15,11 @@ const { resolveExportRecords } = require('./record-selection');
 async function buildXlsxBuffer(model, records) {
   const clean = sanitizeForOutput(records, model);
   const hiddenSet = new Set(model.hidden || []);
-  const columns = Array.from(model.columns.keys()).filter((c) => !hiddenSet.has(c));
+  const columns = (model.columns && model.columns.size > 0)
+    ? Array.from(model.columns.keys()).filter((c) => !hiddenSet.has(c))
+    : (model.schema?.shape
+        ? Object.keys(model.schema.shape).filter((c) => !hiddenSet.has(c))
+        : Object.keys(clean[0] || {}));
 
   const wb = new ExcelJS.Workbook();
   const ws = wb.addWorksheet('Export', {

package/plugins/data-exchange/import.js

@@ -10,7 +10,13 @@ const { buildHeaderMapping, dataRowsToObjects } = require('./parse-table');
 
 function allowedImportColumns(model) {
   const hidden = new Set(model.hidden || []);
-  return Array.from(model.columns.keys()).filter((c) => !hidden.has(c));
+  if (model.columns && model.columns.size > 0) {
+    return Array.from(model.columns.keys()).filter((c) => !hidden.has(c));
+  }
+  if (model.schema && model.schema.shape) {
+    return Object.keys(model.schema.shape).filter((c) => !hidden.has(c));
+  }
+  return [];
 }
 
 /**
@@ -28,7 +34,15 @@ function coerceCell(raw, meta, column) {
     raw = t;
   }
 
-  if (!meta || !meta.type) return raw;
+  if (!meta || !meta.type) {
+    if (raw === 'true' || raw === '1' || raw === 'yes') return true;
+    if (raw === 'false' || raw === '0' || raw === 'no') return false;
+    if (typeof raw === 'string' && /^-?\d+(\.\d+)?$/.test(raw)) {
+      const num = Number(raw);
+      if (!Number.isNaN(num)) return num;
+    }
+    return raw;
+  }
 
   switch (meta.type) {
     case 'bigint':

package/plugins/data-exchange/index.js

@@ -33,6 +33,20 @@ function dataExchangePlugin(options = {}) {
     description: 'Admin spreadsheet import (CSV/XLSX) and Excel export',
     enabled,
 
+    register(ctx) {
+      if (!enabled) return;
+      const db = dbOption ?? ctx.db ?? ctx.app?.get?.('db') ?? null;
+      if (ctx.app && ctx.app.serviceRegistry) {
+        const { createExchangeServices } = require('../../src/services/builtins/exchange');
+        const exchangeServices = createExchangeServices({ db });
+        for (const [name, def] of Object.entries(exchangeServices)) {
+          if (!ctx.app.serviceRegistry.has(name)) {
+            ctx.app.serviceRegistry.register(name, def);
+          }
+        }
+      }
+    },
+
     onRoutesReady(ctx) {
       if (!enabled) return;
 

package/plugins/email/index.js

@@ -106,7 +106,20 @@ function emailPlugin(options = {}) {
     },
 
     register(ctx) {
-      // noop — templates loaded at plugin init; register available for future hot-reload
+      if (ctx.app && ctx.app.serviceRegistry) {
+        const { createMailServices } = require('../../src/services/builtins/mail');
+        const mailServices = createMailServices({
+          emailService,
+          registry,
+          db,
+          tableName,
+        });
+        for (const [name, def] of Object.entries(mailServices)) {
+          if (!ctx.app.serviceRegistry.has(name)) {
+            ctx.app.serviceRegistry.register(name, def);
+          }
+        }
+      }
     },
 
     onRoutesReady(ctx) {

package/plugins/index.js

@@ -25,6 +25,20 @@ const emailPlugin = require('./email');
 const contentPlugin = require('./content');
 const csrfPlugin = require('./csrf');
 const corsPlugin = require('./cors');
+const { basicAuthPlugin, createBasicAuthMiddleware } = require('./basic-auth');
+const {
+  realtimePlugin,
+  realtime,
+  createRealtime,
+  websocket,
+  createWebSocketAdapter,
+  sse,
+  createSseAdapter,
+  socketIo,
+  createSocketIoAdapter,
+  redis,
+  createRedisAdapter,
+} = require('./realtime');
 
 module.exports = {
   sitemapPlugin,
@@ -49,5 +63,20 @@ module.exports = {
   contentPlugin,
   csrfPlugin,
   corsPlugin,
+  basicAuthPlugin,
+  createBasicAuthMiddleware,
+  realtimePlugin,
+  realtime,
+  createRealtime,
+  websocket,
+  createWebSocketAdapter,
+  sse,
+  createSseAdapter,
+  socketIo,
+  createSocketIoAdapter,
+  redis,
+  createRedisAdapter,
+  queuePlugin: require('./queue'),
 };
 
+