webspresso 0.0.90 → 0.0.93

package/plugins/basic-auth/index.js

@@ -0,0 +1,293 @@
+/**
+ * Basic Auth Plugin — HTTP Basic Authentication (RFC 7617) for Webspresso
+ * Zero external dependencies (uses native Node.js crypto for timing-safe equality)
+ * @module plugins/basic-auth
+ */
+
+const crypto = require('crypto');
+
+/**
+ * Compare two strings in constant time to prevent timing attacks.
+ * Uses dummy buffer comparison if lengths differ to avoid leaking length via response timing.
+ * 
+ * @param {string} a
+ * @param {string} b
+ * @returns {boolean}
+ */
+function safeCompare(a, b) {
+  if (typeof a !== 'string' || typeof b !== 'string') {
+    return false;
+  }
+
+  const bufA = Buffer.from(a, 'utf8');
+  const bufB = Buffer.from(b, 'utf8');
+
+  if (bufA.length !== bufB.length) {
+    // Perform dummy timing-safe comparison with itself to preserve constant execution time
+    crypto.timingSafeEqual(bufA, bufA);
+    return false;
+  }
+
+  return crypto.timingSafeEqual(bufA, bufB);
+}
+
+/**
+ * Parse an HTTP Authorization header for Basic credentials.
+ * 
+ * @param {string} header - e.g. "Basic dXNlcjpwYXNz"
+ * @returns {{ username: string, password: string } | null}
+ */
+function parseBasicAuthHeader(header) {
+  if (!header || typeof header !== 'string') {
+    return null;
+  }
+
+  const parts = header.trim().split(/\s+/);
+  if (parts.length !== 2 || parts[0].toLowerCase() !== 'basic') {
+    return null;
+  }
+
+  try {
+    const decoded = Buffer.from(parts[1], 'base64').toString('utf8');
+    const colonIndex = decoded.indexOf(':');
+    if (colonIndex === -1) {
+      return null;
+    }
+
+    const username = decoded.slice(0, colonIndex);
+    const password = decoded.slice(colonIndex + 1);
+    return { username, password };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Extract credentials from request Authorization header or proxy headers
+ * 
+ * @param {import('express').Request} req
+ * @returns {{ username: string, password: string } | null}
+ */
+function extractCredentials(req) {
+  const header = req.headers.authorization || req.headers.Authorization;
+  return parseBasicAuthHeader(header);
+}
+
+/**
+ * Check if request matches path prefix list
+ * 
+ * @param {string} path
+ * @param {string|string[]|boolean} routes
+ * @returns {boolean}
+ */
+function shouldApplyToRoute(path, routes) {
+  if (routes === true || routes == null) return true;
+  const list = Array.isArray(routes) ? routes : [routes];
+  return list.some((prefix) => path.startsWith(prefix));
+}
+
+/**
+ * Check if request path should be skipped
+ * 
+ * @param {import('express').Request} req
+ * @param {string[]} skipPaths
+ * @param {Function} [skipFn]
+ * @returns {boolean}
+ */
+function isSkipped(req, skipPaths = [], skipFn) {
+  if (typeof skipFn === 'function' && skipFn(req)) {
+    return true;
+  }
+  const p = req.path || req.url || '';
+  if (Array.isArray(skipPaths) && skipPaths.some((prefix) => p.startsWith(prefix))) {
+    return true;
+  }
+  return false;
+}
+
+/**
+ * Send 401 Unauthorized response with optional Basic challenge header
+ * 
+ * @param {import('express').Request} req
+ * @param {import('express').Response} res
+ * @param {Object} config
+ */
+function sendUnauthorized(req, res, config) {
+  res.statusCode = 401;
+
+  if (config.challenge !== false) {
+    const realm = String(config.realm || 'Restricted Area')
+      .split(/[\r\n]/)[0]
+      .replace(/"/g, '\\"');
+    res.setHeader('WWW-Authenticate', `Basic realm="${realm}"`);
+  }
+
+  if (typeof config.unauthorizedResponse === 'function') {
+    return config.unauthorizedResponse(req, res);
+  }
+
+  if (config.unauthorizedResponse && typeof config.unauthorizedResponse === 'object') {
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    return res.end(JSON.stringify(config.unauthorizedResponse));
+  }
+
+  if (typeof config.unauthorizedResponse === 'string') {
+    res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+    return res.end(config.unauthorizedResponse);
+  }
+
+  const acceptsJson = req.headers.accept && req.headers.accept.includes('application/json');
+  if (acceptsJson) {
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    return res.end(JSON.stringify({ error: 'Unauthorized', message: 'Authentication required.' }));
+  }
+
+  res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+  res.end('Unauthorized');
+}
+
+/**
+ * Create Basic Auth Express middleware
+ * 
+ * @param {Object} [options]
+ * @param {Record<string, string>} [options.users] - Static username-password map
+ * @param {Function} [options.verify] - Custom verification function (username, password, req) => boolean | object | Promise<boolean | object>
+ * @param {string} [options.realm='Restricted Area'] - Realm name in WWW-Authenticate header
+ * @param {boolean} [options.challenge=true] - Whether to send WWW-Authenticate challenge header
+ * @param {string|string[]|boolean} [options.routes=true] - Route prefixes to protect (used in global mode)
+ * @param {string[]} [options.skipPaths] - Array of path prefixes to skip authentication
+ * @param {Function} [options.skip] - Custom predicate function (req) => boolean
+ * @param {Function|string|Object} [options.unauthorizedResponse] - Custom 401 response
+ * @param {Function} [options.onAuthenticated] - Callback hook (req, user) => void
+ * @returns {Function} Express middleware handler
+ */
+function createBasicAuthMiddleware(options = {}) {
+  const config = {
+    realm: 'Restricted Area',
+    challenge: true,
+    routes: true,
+    skipPaths: [],
+    ...options,
+  };
+
+  return async (req, res, next) => {
+    const reqPath = req.path || req.url || '/';
+
+    if (!shouldApplyToRoute(reqPath, config.routes)) {
+      return next();
+    }
+
+    if (isSkipped(req, config.skipPaths, config.skip)) {
+      return next();
+    }
+
+    const credentials = extractCredentials(req);
+    if (!credentials) {
+      return sendUnauthorized(req, res, config);
+    }
+
+    const { username, password } = credentials;
+    let authResult = false;
+
+    if (typeof config.verify === 'function') {
+      try {
+        authResult = await config.verify(username, password, req);
+      } catch (err) {
+        return next(err);
+      }
+    } else if (config.users && typeof config.users === 'object') {
+      const expectedPassword = config.users[username];
+      if (typeof expectedPassword === 'string') {
+        authResult = safeCompare(password, expectedPassword);
+      }
+    }
+
+    if (!authResult) {
+      return sendUnauthorized(req, res, config);
+    }
+
+    // Attach authentication context to request
+    req.basicAuth = { username };
+    req.auth = req.auth || {};
+    const userObj = typeof authResult === 'object' && authResult !== null
+      ? authResult
+      : { username, type: 'basic' };
+
+    req.auth.user = userObj;
+    if (!req.user) {
+      req.user = userObj;
+    }
+
+    if (typeof config.onAuthenticated === 'function') {
+      try {
+        config.onAuthenticated(req, userObj);
+      } catch (err) {
+        return next(err);
+      }
+    }
+
+    next();
+  };
+}
+
+/**
+ * Webspresso Basic Auth Plugin Factory
+ * 
+ * @param {Object} [options] - Plugin configuration options
+ * @param {boolean} [options.global=false] - Whether to apply basic auth as a global middleware on the app
+ * @param {Record<string, string>} [options.users] - Default static username-password dictionary
+ * @param {Function} [options.verify] - Default custom verification function
+ * @param {string} [options.realm='Restricted Area'] - Default realm name
+ * @param {boolean} [options.challenge=true] - Default challenge header flag
+ * @param {string|string[]|boolean} [options.routes=true] - Route prefixes (when global: true)
+ * @param {string[]} [options.skipPaths] - Default skip path prefixes
+ * @param {Function} [options.skip] - Default skip predicate function
+ * @param {Function|string|Object} [options.unauthorizedResponse] - Custom 401 response
+ * @param {Function} [options.onAuthenticated] - Callback hook on successful login
+ * @returns {Object} Webspresso Plugin Definition
+ */
+function basicAuthPlugin(options = {}) {
+  const { global: applyGlobal = false, ...pluginDefaults } = options;
+
+  return {
+    name: 'basic-auth',
+    version: '1.0.0',
+    description: 'HTTP Basic Authentication (RFC 7617) plugin with named middleware and global guard',
+    options,
+
+    api: {
+      createMiddleware: (routeOpts = {}) =>
+        createBasicAuthMiddleware({ ...pluginDefaults, ...routeOpts }),
+      parseHeader: parseBasicAuthHeader,
+      safeCompare,
+      extractCredentials,
+    },
+
+    register(ctx) {
+      // Register named middleware factory for file routes: middleware: ['basicAuth'] or [['basicAuth', { ... }]]
+      if (ctx.middlewares) {
+        ctx.middlewares.basicAuth = (routeOpts = {}) =>
+          createBasicAuthMiddleware({ ...pluginDefaults, ...routeOpts });
+      }
+
+      // Mount global middleware if global: true
+      if (applyGlobal && ctx.app) {
+        const globalMw = createBasicAuthMiddleware(options);
+        ctx.app.use(globalMw);
+      }
+    },
+  };
+}
+
+basicAuthPlugin.basicAuthPlugin = basicAuthPlugin;
+basicAuthPlugin.createBasicAuthMiddleware = createBasicAuthMiddleware;
+basicAuthPlugin.parseBasicAuthHeader = parseBasicAuthHeader;
+basicAuthPlugin.safeCompare = safeCompare;
+basicAuthPlugin.extractCredentials = extractCredentials;
+
+module.exports = basicAuthPlugin;
+module.exports.basicAuthPlugin = basicAuthPlugin;
+module.exports.createBasicAuthMiddleware = createBasicAuthMiddleware;
+module.exports.parseBasicAuthHeader = parseBasicAuthHeader;
+module.exports.safeCompare = safeCompare;
+module.exports.extractCredentials = extractCredentials;

package/plugins/data-exchange/export-xlsx.js

@@ -7,6 +7,32 @@ const ExcelJS = require('exceljs');
 const { sanitizeForOutput } = require('../../core/orm/utils');
 const { resolveExportRecords } = require('./record-selection');
 
+/**
+ * @param {import('../../core/orm/types').ModelDefinition} model
+ * @param {object[]} records
+ * @returns {Promise<Buffer>}
+ */
+function getModelExportColumns(model, cleanRecords = []) {
+  const hiddenSet = new Set(model.hidden || []);
+  const colSet = new Set();
+  if (model.columns && typeof model.columns.keys === 'function') {
+    for (const c of model.columns.keys()) {
+      if (!hiddenSet.has(c)) colSet.add(c);
+    }
+  }
+  if (model.schema?.shape) {
+    for (const c of Object.keys(model.schema.shape)) {
+      if (!hiddenSet.has(c)) colSet.add(c);
+    }
+  }
+  if (colSet.size === 0 && cleanRecords.length > 0) {
+    for (const c of Object.keys(cleanRecords[0])) {
+      if (!hiddenSet.has(c)) colSet.add(c);
+    }
+  }
+  return Array.from(colSet);
+}
+
 /**
  * @param {import('../../core/orm/types').ModelDefinition} model
  * @param {object[]} records
@@ -14,8 +40,7 @@ const { resolveExportRecords } = require('./record-selection');
  */
 async function buildXlsxBuffer(model, records) {
   const clean = sanitizeForOutput(records, model);
-  const hiddenSet = new Set(model.hidden || []);
-  const columns = Array.from(model.columns.keys()).filter((c) => !hiddenSet.has(c));
+  const columns = getModelExportColumns(model, clean);
 
   const wb = new ExcelJS.Workbook();
   const ws = wb.addWorksheet('Export', {
@@ -83,4 +108,5 @@ function createExportXlsxHandler(opts) {
 module.exports = {
   buildXlsxBuffer,
   createExportXlsxHandler,
+  getModelExportColumns,
 };

package/plugins/data-exchange/import.js

@@ -10,7 +10,18 @@ const { buildHeaderMapping, dataRowsToObjects } = require('./parse-table');
 
 function allowedImportColumns(model) {
   const hidden = new Set(model.hidden || []);
-  return Array.from(model.columns.keys()).filter((c) => !hidden.has(c));
+  const cols = new Set();
+  if (model.columns && typeof model.columns.keys === 'function') {
+    for (const c of model.columns.keys()) {
+      if (!hidden.has(c)) cols.add(c);
+    }
+  }
+  if (model.schema && model.schema.shape) {
+    for (const c of Object.keys(model.schema.shape)) {
+      if (!hidden.has(c)) cols.add(c);
+    }
+  }
+  return Array.from(cols);
 }
 
 /**
@@ -28,7 +39,15 @@ function coerceCell(raw, meta, column) {
     raw = t;
   }
 
-  if (!meta || !meta.type) return raw;
+  if (!meta || !meta.type) {
+    if (typeof raw === 'string' && /^-?\d+(\.\d+)?$/.test(raw)) {
+      const num = Number(raw);
+      if (!Number.isNaN(num)) return num;
+    }
+    if (raw === 'true' || raw === 'yes') return true;
+    if (raw === 'false' || raw === 'no') return false;
+    return raw;
+  }
 
   switch (meta.type) {
     case 'bigint':
@@ -52,6 +71,14 @@ function coerceCell(raw, meta, column) {
       if (s === 'false' || s === '0' || s === 'no') return false;
       throw new Error(`Invalid boolean for ${column}`);
     }
+    case 'date':
+    case 'datetime':
+    case 'timestamp': {
+      if (raw instanceof Date) return raw;
+      const d = new Date(raw);
+      if (Number.isNaN(d.getTime())) throw new Error(`Invalid date for ${column}`);
+      return raw;
+    }
     case 'json': {
       if (typeof raw === 'object') return raw;
       try {
@@ -70,7 +97,7 @@ function buildPayloadForRow(model, data, mode) {
   const payload = {};
   for (const [col, raw] of Object.entries(data)) {
     if (!allowed.has(col)) continue;
-    const meta = model.columns.get(col);
+    const meta = model.columns?.get ? model.columns.get(col) : undefined;
     let v;
     try {
       v = coerceCell(raw, meta, col);
@@ -81,14 +108,14 @@ function buildPayloadForRow(model, data, mode) {
     payload[col] = v;
   }
 
-  const pk = model.primaryKey;
-  const pkMeta = model.columns.get(pk);
-  if (
-    mode === 'insert' &&
-    pkMeta?.autoIncrement &&
-    (payload[pk] === undefined || payload[pk] === null || payload[pk] === '')
-  ) {
-    delete payload[pk];
+  const pk = model.primaryKey || 'id';
+  const pkMeta = model.columns?.get ? model.columns.get(pk) : undefined;
+  if (mode === 'insert') {
+    // In insert mode, remove auto-increment / auto-generated primary key
+    // so new records are created without unique constraint collision
+    if (pkMeta?.autoIncrement || pkMeta?.auto === 'create' || payload[pk] === undefined || payload[pk] === null || payload[pk] === '') {
+      delete payload[pk];
+    }
   }
 
   return payload;
@@ -125,15 +152,26 @@ async function parseXlsxToRows(buffer) {
 }
 
 function cellValueToPlain(cell) {
+  if (!cell) return '';
   const v = cell.value;
   if (v === null || v === undefined) return '';
   if (v instanceof Date) return v.toISOString();
-  if (typeof v === 'object' && v !== null) {
+  if (typeof v === 'object') {
+    if (v.error) return '';
     if ('text' in v && typeof v.text === 'string') return v.text;
     if ('richText' in v && Array.isArray(v.richText)) {
-      return v.richText.map((t) => t.text || '').join('');
+      return v.richText.map((t) => (t && t.text) ? t.text : '').join('');
+    }
+    if ('result' in v && v.result !== undefined) {
+      return cellValueToPlain({ value: v.result });
+    }
+    if ('hyperlink' in v) {
+      return v.text || v.hyperlink || '';
+    }
+    if (typeof v.toString === 'function' && v.toString !== Object.prototype.toString) {
+      return v.toString();
     }
-    if ('result' in v && v.result !== undefined) return v.result;
+    return '';
   }
   return v;
 }
@@ -177,7 +215,8 @@ function createImportHandler(opts) {
         let upsertKey = req.query.upsertKey || req.body?.upsertKey || model.primaryKey;
         upsertKey = String(upsertKey);
 
-        if (!model.columns.has(upsertKey)) {
+        const allowedCols = allowedImportColumns(model);
+        if (!allowedCols.includes(upsertKey)) {
           return res.status(400).json({ error: `upsertKey "${upsertKey}" is not a column` });
         }
         if (model.hidden?.includes(upsertKey)) {
@@ -236,7 +275,7 @@ function createImportHandler(opts) {
               continue;
             }
 
-            const keyMeta = model.columns.get(upsertKey);
+            const keyMeta = model.columns?.get ? model.columns.get(upsertKey) : undefined;
             let keyVal;
             try {
               keyVal = coerceCell(data[upsertKey], keyMeta, upsertKey);

package/plugins/data-exchange/index.js

@@ -33,8 +33,23 @@ function dataExchangePlugin(options = {}) {
     description: 'Admin spreadsheet import (CSV/XLSX) and Excel export',
     enabled,
 
+    register(ctx) {
+      if (!enabled) return;
+      const db = dbOption ?? ctx.db ?? ctx.app?.get?.('db') ?? null;
+      if (ctx.app && ctx.app.serviceRegistry) {
+        const { createExchangeServices } = require('../../src/services/builtins/exchange');
+        const exchangeServices = createExchangeServices({ db });
+        for (const [name, def] of Object.entries(exchangeServices)) {
+          if (!ctx.app.serviceRegistry.has(name)) {
+            ctx.app.serviceRegistry.register(name, def);
+          }
+        }
+      }
+    },
+
     onRoutesReady(ctx) {
       if (!enabled) return;
+      if (ctx.app && ctx.app._dataExchangeRoutesRegistered) return;
 
       const db = dbOption ?? ctx.db;
       if (!db) {
@@ -73,6 +88,10 @@ function dataExchangePlugin(options = {}) {
           },
         });
       }
+
+      if (ctx.app) {
+        ctx.app._dataExchangeRoutesRegistered = true;
+      }
     },
   };
 }

package/plugins/data-exchange/parse-table.js

@@ -15,18 +15,27 @@ function normalizeHeaderCell(h) {
  * @returns {(string|null)[]} index → model column or null if unknown
  */
 function buildHeaderMapping(headerRow, allowedKeys) {
-  const lowerToKey = new Map();
+  const exactLowerToKey = new Map();
+  const strippedToKey = new Map();
   for (const k of allowedKeys) {
-    lowerToKey.set(String(k).toLowerCase().replace(/\s+/g, '_'), k);
+    const kStr = String(k);
+    exactLowerToKey.set(kStr.toLowerCase().replace(/\s+/g, '_'), k);
+    strippedToKey.set(kStr.toLowerCase().replace(/[_\s-]+/g, ''), k);
   }
   const mapping = [];
   for (let i = 0; i < headerRow.length; i++) {
-    const norm = normalizeHeaderCell(headerRow[i]).toLowerCase().replace(/\s+/g, '_');
-    if (!norm) {
+    const raw = normalizeHeaderCell(headerRow[i]);
+    if (!raw) {
       mapping.push(null);
       continue;
     }
-    mapping.push(lowerToKey.get(norm) ?? null);
+    const norm = raw.toLowerCase().replace(/\s+/g, '_');
+    let matched = exactLowerToKey.get(norm);
+    if (!matched) {
+      const stripped = raw.toLowerCase().replace(/[_\s-]+/g, '');
+      matched = strippedToKey.get(stripped);
+    }
+    mapping.push(matched ?? null);
   }
   return mapping;
 }

package/plugins/data-exchange/record-selection.js

@@ -70,6 +70,8 @@ async function resolveExportRecords(db, modelName, req) {
         if (record) records.push(record);
       }
     }
+  } else if (Array.isArray(idList) && idList.length === 0) {
+    records = [];
   } else {
     records = await repo.findAll();
   }

package/plugins/email/index.js

@@ -106,7 +106,20 @@ function emailPlugin(options = {}) {
     },
 
     register(ctx) {
-      // noop — templates loaded at plugin init; register available for future hot-reload
+      if (ctx.app && ctx.app.serviceRegistry) {
+        const { createMailServices } = require('../../src/services/builtins/mail');
+        const mailServices = createMailServices({
+          emailService,
+          registry,
+          db,
+          tableName,
+        });
+        for (const [name, def] of Object.entries(mailServices)) {
+          if (!ctx.app.serviceRegistry.has(name)) {
+            ctx.app.serviceRegistry.register(name, def);
+          }
+        }
+      }
     },
 
     onRoutesReady(ctx) {

package/plugins/index.js

@@ -25,6 +25,21 @@ const emailPlugin = require('./email');
 const contentPlugin = require('./content');
 const csrfPlugin = require('./csrf');
 const corsPlugin = require('./cors');
+const { basicAuthPlugin, createBasicAuthMiddleware } = require('./basic-auth');
+const {
+  realtimePlugin,
+  realtime,
+  createRealtime,
+  websocket,
+  createWebSocketAdapter,
+  sse,
+  createSseAdapter,
+  socketIo,
+  createSocketIoAdapter,
+  redis,
+  createRedisAdapter,
+} = require('./realtime');
+const { mcpPlugin, createMcpServer, McpServer } = require('./mcp');
 
 module.exports = {
   sitemapPlugin,
@@ -49,5 +64,23 @@ module.exports = {
   contentPlugin,
   csrfPlugin,
   corsPlugin,
+  basicAuthPlugin,
+  createBasicAuthMiddleware,
+  realtimePlugin,
+  realtime,
+  createRealtime,
+  websocket,
+  createWebSocketAdapter,
+  sse,
+  createSseAdapter,
+  socketIo,
+  createSocketIoAdapter,
+  redis,
+  createRedisAdapter,
+  queuePlugin: require('./queue'),
+  mcpPlugin,
+  createMcpServer,
+  McpServer,
 };
 
+