webspresso 0.0.90 → 0.0.93

package/plugins/queue/index.js

@@ -0,0 +1,108 @@
+/**
+ * Webspresso Background Job Queue Plugin
+ * @module plugins/queue
+ */
+
+'use strict';
+
+const path = require('path');
+const fs = require('fs');
+const {
+  createQueueManager,
+  MemoryQueueAdapter,
+  DatabaseQueueAdapter,
+  RedisQueueAdapter,
+} = require('../../core/queue');
+
+/**
+ * @param {Object} [options]
+ * @param {'memory'|'database'|'redis'|Object} [options.adapter='memory'] - Queue backend adapter or name
+ * @param {Object} [options.db] - Knex/ORM database instance for database adapter
+ * @param {Object} [options.redisClient] - Redis client instance for redis adapter
+ * @param {string} [options.tableName='webspresso_jobs'] - Database queue table name
+ * @param {number} [options.concurrency=2] - Worker concurrency
+ * @param {number} [options.pollInterval=500] - Idle poll interval in ms
+ * @param {string} [options.jobsDir] - Path to jobs directory (defaults to <cwd>/jobs)
+ * @param {boolean} [options.autoStart=true] - Auto start processing
+ * @returns {Object} Plugin definition
+ */
+function queuePlugin(options = {}) {
+  const concurrency = options.concurrency || 2;
+  const pollInterval = options.pollInterval || 500;
+  const autoStart = options.autoStart !== false;
+  const jobsDir = options.jobsDir || path.join(process.cwd(), 'jobs');
+
+  let queueManager = null;
+
+  return {
+    name: 'queue',
+    version: '1.0.0',
+    description: 'Background Job Queue Engine with Memory, DB, and Redis adapters',
+
+    register(ctx) {
+      const { app, db } = ctx;
+
+      let adapter = options.adapter;
+
+      if (!adapter || adapter === 'memory') {
+        adapter = new MemoryQueueAdapter();
+      } else if (adapter === 'database' || adapter === 'db') {
+        const knexInstance = options.db?.knex || db?.knex || options.knex;
+        if (!knexInstance) {
+          throw new Error('[queuePlugin] Database queue adapter requires a valid database/knex instance.');
+        }
+        adapter = new DatabaseQueueAdapter({
+          knex: knexInstance,
+          tableName: options.tableName || 'webspresso_jobs',
+        });
+      } else if (adapter === 'redis') {
+        const client = options.redisClient || options.redis;
+        if (!client) {
+          throw new Error('[queuePlugin] Redis queue adapter requires a valid redisClient in options.');
+        }
+        adapter = new RedisQueueAdapter({
+          client,
+          prefix: options.prefix,
+        });
+      }
+
+      queueManager = createQueueManager({
+        adapter,
+        concurrency,
+        pollInterval,
+        jobsDir,
+        autoStart,
+      });
+
+      // Expose to ctx & app
+      ctx.queue = queueManager;
+      if (app) {
+        app.queue = queueManager;
+        app.set('webspresso.queue', queueManager);
+
+        // Attach req.queue middleware
+        app.use((req, res, next) => {
+          req.queue = queueManager;
+          next();
+        });
+      }
+
+      this.queue = queueManager;
+    },
+
+    onRoutesReady(ctx) {
+      if (jobsDir && fs.existsSync(jobsDir)) {
+        queueManager.loadJobsFromDirectory(jobsDir);
+      }
+    },
+
+    async dispose() {
+      if (queueManager) {
+        await queueManager.drain(5000);
+      }
+    },
+  };
+}
+
+module.exports = queuePlugin;
+module.exports.queuePlugin = queuePlugin;

package/plugins/realtime/index.js

@@ -0,0 +1,150 @@
+/**
+ * Webspresso Realtime Plugin
+ * Realtime plugin for Webspresso applications
+ * @module plugins/realtime
+ */
+
+const {
+  createRealtime,
+  RealtimeClient,
+  RealtimeSubscription,
+  SubscriptionRegistry,
+  createSubscriptionKey,
+  AuthManager,
+  ReconnectManager,
+  RealtimeError,
+  normalizeRealtimeError,
+  sanitizeErrorMessage,
+  EventEmitter,
+  DEFAULT_CAPABILITIES,
+
+  // Adapters
+  websocket,
+  createWebSocketAdapter,
+  WebSocketAdapter,
+  resolveWebSocketUrl,
+
+  sse,
+  createSseAdapter,
+  SseAdapter,
+  resolveSseUrl,
+
+  socketIo,
+  createSocketIoAdapter,
+  SocketIoAdapter,
+
+  redis,
+  createRedisAdapter,
+  RedisAdapter,
+} = require('../../core/realtime');
+
+/**
+ * Webspresso Realtime Plugin Factory
+ * 
+ * @param {Object} options
+ * @returns {Object} Webspresso plugin definition
+ */
+function realtimePlugin(options = {}) {
+  let clientInstance = null;
+
+  return {
+    name: 'realtime',
+    version: '1.0.0',
+    description: 'Framework-agnostic, plugin-based realtime layer for Webspresso',
+    _options: options,
+
+    api: {
+      getClient: () => clientInstance,
+    },
+
+    setup(app) {
+      if (!clientInstance) {
+        clientInstance = createRealtime(options);
+      }
+
+      if (app) {
+        app.realtime = clientInstance;
+      }
+
+      return () => {
+        if (clientInstance) {
+          clientInstance.destroy();
+        }
+      };
+    },
+
+    register(ctx) {
+      if (!clientInstance) {
+        clientInstance = createRealtime(options);
+      }
+
+      if (ctx.app) {
+        ctx.app.realtime = clientInstance;
+      }
+
+      if (typeof ctx.onDispose === 'function') {
+        ctx.onDispose(() => {
+          if (clientInstance) {
+            clientInstance.destroy();
+          }
+        });
+      }
+    },
+
+    browserReady(app) {
+      if (clientInstance) {
+        clientInstance.browserReady();
+      }
+    },
+
+    destroy(app) {
+      if (clientInstance) {
+        clientInstance.destroy();
+        clientInstance = null;
+      }
+    },
+  };
+}
+
+function realtime(options = {}) {
+  const client = createRealtime(options);
+  client.plugin = realtimePlugin(options);
+  return client;
+}
+
+module.exports = {
+  realtimePlugin,
+  realtime,
+  createRealtime,
+  RealtimeClient,
+  RealtimeSubscription,
+  SubscriptionRegistry,
+  createSubscriptionKey,
+  AuthManager,
+  ReconnectManager,
+  RealtimeError,
+  normalizeRealtimeError,
+  sanitizeErrorMessage,
+  EventEmitter,
+  DEFAULT_CAPABILITIES,
+
+  // Adapters
+  websocket,
+  createWebSocketAdapter,
+  WebSocketAdapter,
+  resolveWebSocketUrl,
+
+  sse,
+  createSseAdapter,
+  SseAdapter,
+  resolveSseUrl,
+
+  socketIo,
+  createSocketIoAdapter,
+  SocketIoAdapter,
+
+  redis,
+  createRedisAdapter,
+  RedisAdapter,
+};
+

package/plugins/recaptcha/index.js

@@ -107,6 +107,17 @@ function recaptchaPlugin(options = {}) {
     },
 
     register(ctx) {
+      if (ctx.middlewares) {
+        ctx.middlewares.recaptcha = (mwOpts = {}) =>
+          createRecaptchaMiddleware({
+            secret: resolveSecret(),
+            bodyField: mwOpts.bodyField,
+            version: mwOpts.version || version,
+            minScore: mwOpts.minScore ?? minScore,
+            expectedAction: mwOpts.expectedAction ?? expectedAction,
+          });
+      }
+
       ctx.addHelper('recaptchaScript', () =>
         version === 'v3' ? recaptchaScriptTag(siteKey) : recaptchaScriptTag()
       );

package/plugins/redirect/index.js

@@ -12,7 +12,15 @@ const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
 function isExternalTarget(to) {
   if (!to || typeof to !== 'string') return false;
   const t = to.trim();
-  return /^https?:\/\//i.test(t) || t.startsWith('//');
+  // Protocol-relative (//, \\, /\, \/) or URL schemes (http:, https:, javascript:, data:, vbscript:, etc.)
+  return (
+    /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(t) ||
+    t.startsWith('//') ||
+    t.startsWith('\\\\') ||
+    t.startsWith('/\\') ||
+    t.startsWith('\\/') ||
+    t.startsWith('\\')
+  );
 }
 
 /**

package/plugins/rest-resources/index.js

@@ -7,6 +7,7 @@ const { attachDbMiddleware } = require('../../src/app-context');
 const { getAllModels } = require('../../core/orm/model');
 const { omit } = require('../../core/orm/utils');
 const { trimUrlPathSlashes } = require('../../core/url-path-normalize');
+const { validateQueryComplexity } = require('../../core/orm/complexity');
 
 const RESERVED_QUERY_KEYS = new Set(['page', 'perPage', 'sort', 'order', 'include', 'trashed']);
 
@@ -167,22 +168,276 @@ function applySoftDeleteScope(query, countQuery, model, trashed) {
   return { query, countQuery };
 }
 
+/**
+ * Parse sort parameters into an array of { column, direction }
+ * @param {import('../../core/orm/types').ModelDefinition} model
+ * @param {*} rawSort
+ * @param {*} rawOrder
+ * @returns {Array<{ column: string, direction: 'asc'|'desc' }>}
+ */
+function parseSortParams(model, rawSort, rawOrder) {
+  const result = [];
+  const seen = new Set();
+
+  function addSort(col, dir) {
+    if (!col || typeof col !== 'string') return;
+    const cleanCol = col.trim();
+    if (!model.columns.has(cleanCol) || seen.has(cleanCol)) return;
+    seen.add(cleanCol);
+    const cleanDir = String(dir || 'asc').toLowerCase() === 'desc' ? 'desc' : 'asc';
+    result.push({ column: cleanCol, direction: cleanDir });
+  }
+
+  if (Array.isArray(rawSort)) {
+    for (const item of rawSort) {
+      if (typeof item === 'string') {
+        const tokens = item.split(',').map((s) => s.trim()).filter(Boolean);
+        for (const token of tokens) {
+          if (token.startsWith('-')) {
+            addSort(token.slice(1), 'desc');
+          } else if (token.startsWith('+')) {
+            addSort(token.slice(1), 'asc');
+          } else if (token.includes(':')) {
+            const [c, d] = token.split(':');
+            addSort(c, d);
+          } else {
+            addSort(token, rawOrder || 'asc');
+          }
+        }
+      }
+    }
+  } else if (typeof rawSort === 'string' && rawSort.trim() !== '') {
+    const tokens = rawSort.split(',').map((s) => s.trim()).filter(Boolean);
+    for (const token of tokens) {
+      if (token.startsWith('-')) {
+        addSort(token.slice(1), 'desc');
+      } else if (token.startsWith('+')) {
+        addSort(token.slice(1), 'asc');
+      } else if (token.includes(':')) {
+        const [c, d] = token.split(':');
+        addSort(c, d);
+      } else if (tokens.length === 1 && rawOrder) {
+        addSort(token, rawOrder);
+      } else {
+        addSort(token, 'asc');
+      }
+    }
+  }
+
+  if (result.length === 0) {
+    result.push({
+      column: model.primaryKey,
+      direction: String(rawOrder || 'desc').toLowerCase() === 'asc' ? 'asc' : 'desc',
+    });
+  }
+
+  return result;
+}
+
 function applyColumnFilters(query, countQuery, model, req) {
   let q = query;
   let c = countQuery;
+
+  function applyCondition(col, op, rawVal) {
+    if (!model.columns.has(col)) return;
+    const meta = model.columns.get(col);
+    const colType = meta?.type;
+
+    let operator = String(op || 'eq').toLowerCase();
+    let val = rawVal;
+
+    // Normalize booleans
+    if (colType === 'boolean' && typeof val === 'string') {
+      if (val === 'true' || val === '1') val = true;
+      else if (val === 'false' || val === '0') val = false;
+    }
+
+    switch (operator) {
+      case 'eq':
+      case '=':
+        if (val !== undefined && val !== '') {
+          q = q.where(col, '=', val);
+          c = c.where(col, '=', val);
+        }
+        break;
+
+      case 'ne':
+      case '!=':
+      case '<>':
+        if (val !== undefined && val !== '') {
+          q = q.where(col, '!=', val);
+          c = c.where(col, '!=', val);
+        }
+        break;
+
+      case 'gt':
+      case '>':
+        if (val !== undefined && val !== '') {
+          q = q.where(col, '>', val);
+          c = c.where(col, '>', val);
+        }
+        break;
+
+      case 'gte':
+      case '>=':
+        if (val !== undefined && val !== '') {
+          q = q.where(col, '>=', val);
+          c = c.where(col, '>=', val);
+        }
+        break;
+
+      case 'lt':
+      case '<':
+        if (val !== undefined && val !== '') {
+          q = q.where(col, '<', val);
+          c = c.where(col, '<', val);
+        }
+        break;
+
+      case 'lte':
+      case '<=':
+        if (val !== undefined && val !== '') {
+          q = q.where(col, '<=', val);
+          c = c.where(col, '<=', val);
+        }
+        break;
+
+      case 'in': {
+        const arr = Array.isArray(val)
+          ? val
+          : (typeof val === 'string' ? val.split(',').map(s => s.trim()).filter(Boolean) : [val]);
+        if (arr.length > 0) {
+          q = q.whereIn(col, arr);
+          c = c.whereIn(col, arr);
+        }
+        break;
+      }
+
+      case 'nin':
+      case 'notin': {
+        const arr = Array.isArray(val)
+          ? val
+          : (typeof val === 'string' ? val.split(',').map(s => s.trim()).filter(Boolean) : [val]);
+        if (arr.length > 0) {
+          q = q.whereNotIn(col, arr);
+          c = c.whereNotIn(col, arr);
+        }
+        break;
+      }
+
+      case 'like':
+        if (val !== undefined && val !== '') {
+          q = q.where(col, 'like', String(val));
+          c = c.where(col, 'like', String(val));
+        }
+        break;
+
+      case 'ilike':
+        if (val !== undefined && val !== '') {
+          q = q.where(col, 'ilike', String(val));
+          c = c.where(col, 'ilike', String(val));
+        }
+        break;
+
+      case 'contains':
+        if (val !== undefined && val !== '') {
+          q = q.where(col, 'like', `%${String(val)}%`);
+          c = c.where(col, 'like', `%${String(val)}%`);
+        }
+        break;
+
+      case 'startswith':
+        if (val !== undefined && val !== '') {
+          q = q.where(col, 'like', `${String(val)}%`);
+          c = c.where(col, 'like', `${String(val)}%`);
+        }
+        break;
+
+      case 'endswith':
+        if (val !== undefined && val !== '') {
+          q = q.where(col, 'like', `%${String(val)}`);
+          c = c.where(col, 'like', `%${String(val)}`);
+        }
+        break;
+
+      case 'isnull':
+      case 'is_null': {
+        const isTrue = val === true || val === 'true' || val === '1' || val === 1 || val === '';
+        if (isTrue) {
+          q = q.whereNull(col);
+          c = c.whereNull(col);
+        }
+        break;
+      }
+
+      case 'isnotnull':
+      case 'is_not_null': {
+        const isTrue = val === true || val === 'true' || val === '1' || val === 1 || val === '';
+        if (isTrue) {
+          q = q.whereNotNull(col);
+          c = c.whereNotNull(col);
+        }
+        break;
+      }
+
+      case 'between': {
+        let parts = [];
+        if (Array.isArray(val)) {
+          parts = val;
+        } else if (typeof val === 'string') {
+          parts = val.split(',').map(s => s.trim());
+        }
+        if (parts.length === 2 && parts[0] !== '' && parts[1] !== '') {
+          q = q.where(col, '>=', parts[0]).where(col, '<=', parts[1]);
+          c = c.where(col, '>=', parts[0]).where(col, '<=', parts[1]);
+        }
+        break;
+      }
+
+      default:
+        if (val !== undefined && val !== '') {
+          q = q.where(col, '=', val);
+          c = c.where(col, '=', val);
+        }
+        break;
+    }
+  }
+
+  // 1. Process dedicated filter object ?filter[col]=... or ?filter[col][op]=...
+  if (req.query.filter && typeof req.query.filter === 'object') {
+    for (const [col, colFilter] of Object.entries(req.query.filter)) {
+      if (!model.columns.has(col)) continue;
+      if (colFilter && typeof colFilter === 'object' && !Array.isArray(colFilter)) {
+        if (colFilter.op !== undefined && colFilter.value !== undefined) {
+          applyCondition(col, colFilter.op, colFilter.value);
+        } else {
+          for (const [op, val] of Object.entries(colFilter)) {
+            applyCondition(col, op, val);
+          }
+        }
+      } else if (colFilter !== undefined && colFilter !== '') {
+        applyCondition(col, 'eq', colFilter);
+      }
+    }
+  }
+
+  // 2. Process top-level query parameters ?price[gte]=100 or ?status=active
   for (const [key, value] of Object.entries(req.query)) {
-    if (RESERVED_QUERY_KEYS.has(key)) {
+    if (RESERVED_QUERY_KEYS.has(key) || key === 'filter') {
       continue;
     }
     if (!model.columns.has(key)) {
       continue;
     }
-    if (value === undefined || value === '') {
-      continue;
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+      for (const [op, val] of Object.entries(value)) {
+        applyCondition(key, op, val);
+      }
+    } else if (value !== undefined && value !== '') {
+      applyCondition(key, 'eq', value);
     }
-    q = q.where(key, value);
-    c = c.where(key, value);
   }
+
   return { query: q, countQuery: c };
 }
 
@@ -235,21 +490,29 @@ function restResourcePlugin(options = {}) {
           ...chain(async (req, res) => {
             try {
               const repo = db.getRepository(model.name);
+              const complexity = validateQueryComplexity(model, {
+                perPage: req.query.perPage,
+                includes: parseIncludeParam(model, req.query.include),
+                strict: false,
+              });
               const page = Math.max(1, parseInt(req.query.page, 10) || 1);
-              const perPage = Math.min(100, Math.max(1, parseInt(req.query.perPage, 10) || 15));
+              const perPage = complexity.perPage;
               const offset = (page - 1) * perPage;
-              const include = parseIncludeParam(model, req.query.include);
+              const include = complexity.includes;
 
               let query = repo.query();
               let countQuery = repo.query();
               ({ query, countQuery } = applySoftDeleteScope(query, countQuery, model, req.query.trashed));
               ({ query, countQuery } = applyColumnFilters(query, countQuery, model, req));
 
-              const sortCol = req.query.sort && model.columns.has(req.query.sort) ? req.query.sort : model.primaryKey;
-              const order = String(req.query.order || 'desc').toLowerCase() === 'asc' ? 'asc' : 'desc';
+              const sortEntries = parseSortParams(model, req.query.sort, req.query.order);
 
               const total = await countQuery.count();
-              let listQ = query.orderBy(sortCol, order).offset(offset).limit(perPage);
+              let listQ = query;
+              for (const s of sortEntries) {
+                listQ = listQ.orderBy(s.column, s.direction);
+              }
+              listQ = listQ.offset(offset).limit(perPage);
               if (include.length > 0) {
                 listQ = listQ.with(...include);
               }
@@ -276,7 +539,11 @@ function restResourcePlugin(options = {}) {
           ...chain(async (req, res) => {
             try {
               const repo = db.getRepository(model.name);
-              const include = parseIncludeParam(model, req.query.include);
+              const complexity = validateQueryComplexity(model, {
+                includes: parseIncludeParam(model, req.query.include),
+                strict: false,
+              });
+              const include = complexity.includes;
               const record = await repo.findById(req.params.id, { with: include });
 
               if (!record) {
@@ -346,6 +613,8 @@ function restResourcePlugin(options = {}) {
 module.exports = restResourcePlugin;
 module.exports.pluralizeSegment = pluralizeSegment;
 module.exports.parseIncludeParam = parseIncludeParam;
+module.exports.parseSortParams = parseSortParams;
+module.exports.applyColumnFilters = applyColumnFilters;
 module.exports.sanitizeRecordTree = sanitizeRecordTree;
 module.exports.pickWritableColumns = pickWritableColumns;
 module.exports.resolveExposedModels = resolveExposedModels;

package/plugins/upload/index.js

@@ -126,6 +126,22 @@ function uploadPlugin(options = {}) {
     version: '1.0.0',
     description: 'Multipart file uploads with pluggable storage',
 
+    register(ctx) {
+      if (ctx.app && ctx.app.serviceRegistry) {
+        const { createMediaServices } = require('../../src/services/builtins/media');
+        const mediaServices = createMediaServices({
+          provider,
+          destDir: local?.destDir,
+          publicBasePath: local?.publicBasePath,
+        });
+        for (const [name, def] of Object.entries(mediaServices)) {
+          if (!ctx.app.serviceRegistry.has(name)) {
+            ctx.app.serviceRegistry.register(name, def);
+          }
+        }
+      }
+    },
+
     onRoutesReady(ctx) {
       const { app } = ctx;
       app.set('webspresso.uploadPath', normalizedPath);