webspresso 0.0.91 → 0.0.94

package/plugins/data-exchange/import.js

@@ -10,13 +10,18 @@ const { buildHeaderMapping, dataRowsToObjects } = require('./parse-table');
 
 function allowedImportColumns(model) {
   const hidden = new Set(model.hidden || []);
-  if (model.columns && model.columns.size > 0) {
-    return Array.from(model.columns.keys()).filter((c) => !hidden.has(c));
+  const cols = new Set();
+  if (model.columns && typeof model.columns.keys === 'function') {
+    for (const c of model.columns.keys()) {
+      if (!hidden.has(c)) cols.add(c);
+    }
   }
   if (model.schema && model.schema.shape) {
-    return Object.keys(model.schema.shape).filter((c) => !hidden.has(c));
+    for (const c of Object.keys(model.schema.shape)) {
+      if (!hidden.has(c)) cols.add(c);
+    }
   }
-  return [];
+  return Array.from(cols);
 }
 
 /**
@@ -35,12 +40,12 @@ function coerceCell(raw, meta, column) {
   }
 
   if (!meta || !meta.type) {
-    if (raw === 'true' || raw === '1' || raw === 'yes') return true;
-    if (raw === 'false' || raw === '0' || raw === 'no') return false;
     if (typeof raw === 'string' && /^-?\d+(\.\d+)?$/.test(raw)) {
       const num = Number(raw);
       if (!Number.isNaN(num)) return num;
     }
+    if (raw === 'true' || raw === 'yes') return true;
+    if (raw === 'false' || raw === 'no') return false;
     return raw;
   }
 
@@ -66,6 +71,14 @@ function coerceCell(raw, meta, column) {
       if (s === 'false' || s === '0' || s === 'no') return false;
       throw new Error(`Invalid boolean for ${column}`);
     }
+    case 'date':
+    case 'datetime':
+    case 'timestamp': {
+      if (raw instanceof Date) return raw;
+      const d = new Date(raw);
+      if (Number.isNaN(d.getTime())) throw new Error(`Invalid date for ${column}`);
+      return raw;
+    }
     case 'json': {
       if (typeof raw === 'object') return raw;
       try {
@@ -84,7 +97,7 @@ function buildPayloadForRow(model, data, mode) {
   const payload = {};
   for (const [col, raw] of Object.entries(data)) {
     if (!allowed.has(col)) continue;
-    const meta = model.columns.get(col);
+    const meta = model.columns?.get ? model.columns.get(col) : undefined;
     let v;
     try {
       v = coerceCell(raw, meta, col);
@@ -95,14 +108,14 @@ function buildPayloadForRow(model, data, mode) {
     payload[col] = v;
   }
 
-  const pk = model.primaryKey;
-  const pkMeta = model.columns.get(pk);
-  if (
-    mode === 'insert' &&
-    pkMeta?.autoIncrement &&
-    (payload[pk] === undefined || payload[pk] === null || payload[pk] === '')
-  ) {
-    delete payload[pk];
+  const pk = model.primaryKey || 'id';
+  const pkMeta = model.columns?.get ? model.columns.get(pk) : undefined;
+  if (mode === 'insert') {
+    // In insert mode, remove auto-increment / auto-generated primary key
+    // so new records are created without unique constraint collision
+    if (pkMeta?.autoIncrement || pkMeta?.auto === 'create' || payload[pk] === undefined || payload[pk] === null || payload[pk] === '') {
+      delete payload[pk];
+    }
   }
 
   return payload;
@@ -139,15 +152,26 @@ async function parseXlsxToRows(buffer) {
 }
 
 function cellValueToPlain(cell) {
+  if (!cell) return '';
   const v = cell.value;
   if (v === null || v === undefined) return '';
   if (v instanceof Date) return v.toISOString();
-  if (typeof v === 'object' && v !== null) {
+  if (typeof v === 'object') {
+    if (v.error) return '';
     if ('text' in v && typeof v.text === 'string') return v.text;
     if ('richText' in v && Array.isArray(v.richText)) {
-      return v.richText.map((t) => t.text || '').join('');
+      return v.richText.map((t) => (t && t.text) ? t.text : '').join('');
+    }
+    if ('result' in v && v.result !== undefined) {
+      return cellValueToPlain({ value: v.result });
+    }
+    if ('hyperlink' in v) {
+      return v.text || v.hyperlink || '';
     }
-    if ('result' in v && v.result !== undefined) return v.result;
+    if (typeof v.toString === 'function' && v.toString !== Object.prototype.toString) {
+      return v.toString();
+    }
+    return '';
   }
   return v;
 }
@@ -191,7 +215,8 @@ function createImportHandler(opts) {
         let upsertKey = req.query.upsertKey || req.body?.upsertKey || model.primaryKey;
         upsertKey = String(upsertKey);
 
-        if (!model.columns.has(upsertKey)) {
+        const allowedCols = allowedImportColumns(model);
+        if (!allowedCols.includes(upsertKey)) {
           return res.status(400).json({ error: `upsertKey "${upsertKey}" is not a column` });
         }
         if (model.hidden?.includes(upsertKey)) {
@@ -226,6 +251,13 @@ function createImportHandler(opts) {
           return res.status(400).json({ error: `Too many data rows (${objects.length}). Limit is ${maxRows}.` });
         }
 
+        const isAtomic =
+          req.query.atomic === 'true' ||
+          req.query.atomic === '1' ||
+          req.body?.atomic === 'true' ||
+          req.body?.atomic === true ||
+          opts?.atomic === true;
+
         const repo = db.getRepository(model.name);
         const summary = {
           success: true,
@@ -235,52 +267,82 @@ function createImportHandler(opts) {
           errors: [],
         };
 
-        for (const { rowNumber, data } of objects) {
-          try {
-            const payload = buildPayloadForRow(model, data, mode);
-            if (Object.keys(payload).length === 0) {
-              summary.failed++;
-              summary.errors.push({ row: rowNumber, message: 'No mappable columns' });
-              continue;
-            }
+        const runRowProcessing = async (targetRepo) => {
+          for (const { rowNumber, data } of objects) {
+            try {
+              const payload = buildPayloadForRow(model, data, mode);
+              if (Object.keys(payload).length === 0) {
+                summary.failed++;
+                const errMsg = 'No mappable columns';
+                summary.errors.push({ row: rowNumber, message: errMsg });
+                if (isAtomic) {
+                  throw new Error(`Row ${rowNumber}: ${errMsg}`);
+                }
+                continue;
+              }
 
-            if (mode === 'insert') {
-              await repo.create(payload);
-              summary.created++;
-              continue;
-            }
+              if (mode === 'insert') {
+                await targetRepo.create(payload);
+                summary.created++;
+                continue;
+              }
 
-            const keyMeta = model.columns.get(upsertKey);
-            let keyVal;
-            try {
-              keyVal = coerceCell(data[upsertKey], keyMeta, upsertKey);
+              const keyMeta = model.columns?.get ? model.columns.get(upsertKey) : undefined;
+              let keyVal;
+              try {
+                keyVal = coerceCell(data[upsertKey], keyMeta, upsertKey);
+              } catch (e) {
+                summary.failed++;
+                summary.errors.push({ row: rowNumber, message: e.message || 'Bad upsert key' });
+                if (isAtomic) throw e;
+                continue;
+              }
+
+              if (keyVal === undefined || keyVal === null) {
+                const insertPayload = { ...payload };
+                delete insertPayload[upsertKey];
+                await targetRepo.create(insertPayload);
+                summary.created++;
+                continue;
+              }
+
+              const existing = await targetRepo.findOne({ [upsertKey]: keyVal });
+              if (existing) {
+                const id = existing[model.primaryKey];
+                await targetRepo.update(id, payload);
+                summary.updated++;
+              } else {
+                await targetRepo.create({ ...payload, [upsertKey]: keyVal });
+                summary.created++;
+              }
             } catch (e) {
               summary.failed++;
-              summary.errors.push({ row: rowNumber, message: e.message || 'Bad upsert key' });
-              continue;
-            }
-
-            if (keyVal === undefined || keyVal === null) {
-              const insertPayload = { ...payload };
-              delete insertPayload[upsertKey];
-              await repo.create(insertPayload);
-              summary.created++;
-              continue;
+              summary.errors.push({ row: rowNumber, message: e.message || String(e) });
+              if (isAtomic) {
+                throw e;
+              }
             }
+          }
+        };
 
-            const existing = await repo.findOne({ [upsertKey]: keyVal });
-            if (existing) {
-              const id = existing[model.primaryKey];
-              await repo.update(id, payload);
-              summary.updated++;
-            } else {
-              await repo.create({ ...payload, [upsertKey]: keyVal });
-              summary.created++;
-            }
-          } catch (e) {
-            summary.failed++;
-            summary.errors.push({ row: rowNumber, message: e.message || String(e) });
+        if (isAtomic && typeof db.transaction === 'function') {
+          try {
+            await db.transaction(async (trxContext) => {
+              const trxRepo = trxContext.getRepository ? trxContext.getRepository(model.name) : repo;
+              await runRowProcessing(trxRepo);
+            });
+          } catch (txErr) {
+            return res.status(400).json({
+              success: false,
+              created: 0,
+              updated: 0,
+              failed: objects.length,
+              error: `Atomic import rolled back: ${txErr.message}`,
+              errors: summary.errors,
+            });
           }
+        } else {
+          await runRowProcessing(repo);
         }
 
         summary.success = summary.failed === 0;

package/plugins/data-exchange/index.js

@@ -49,6 +49,7 @@ function dataExchangePlugin(options = {}) {
 
     onRoutesReady(ctx) {
       if (!enabled) return;
+      if (ctx.app && ctx.app._dataExchangeRoutesRegistered) return;
 
       const db = dbOption ?? ctx.db;
       if (!db) {
@@ -87,6 +88,10 @@ function dataExchangePlugin(options = {}) {
           },
         });
       }
+
+      if (ctx.app) {
+        ctx.app._dataExchangeRoutesRegistered = true;
+      }
     },
   };
 }

package/plugins/data-exchange/parse-table.js

@@ -15,18 +15,27 @@ function normalizeHeaderCell(h) {
  * @returns {(string|null)[]} index → model column or null if unknown
  */
 function buildHeaderMapping(headerRow, allowedKeys) {
-  const lowerToKey = new Map();
+  const exactLowerToKey = new Map();
+  const strippedToKey = new Map();
   for (const k of allowedKeys) {
-    lowerToKey.set(String(k).toLowerCase().replace(/\s+/g, '_'), k);
+    const kStr = String(k);
+    exactLowerToKey.set(kStr.toLowerCase().replace(/\s+/g, '_'), k);
+    strippedToKey.set(kStr.toLowerCase().replace(/[_\s-]+/g, ''), k);
   }
   const mapping = [];
   for (let i = 0; i < headerRow.length; i++) {
-    const norm = normalizeHeaderCell(headerRow[i]).toLowerCase().replace(/\s+/g, '_');
-    if (!norm) {
+    const raw = normalizeHeaderCell(headerRow[i]);
+    if (!raw) {
       mapping.push(null);
       continue;
     }
-    mapping.push(lowerToKey.get(norm) ?? null);
+    const norm = raw.toLowerCase().replace(/\s+/g, '_');
+    let matched = exactLowerToKey.get(norm);
+    if (!matched) {
+      const stripped = raw.toLowerCase().replace(/[_\s-]+/g, '');
+      matched = strippedToKey.get(stripped);
+    }
+    mapping.push(matched ?? null);
   }
   return mapping;
 }

package/plugins/data-exchange/record-selection.js

@@ -70,6 +70,8 @@ async function resolveExportRecords(db, modelName, req) {
         if (record) records.push(record);
       }
     }
+  } else if (Array.isArray(idList) && idList.length === 0) {
+    records = [];
   } else {
     records = await repo.findAll();
   }

package/plugins/index.js

@@ -39,6 +39,8 @@ const {
   redis,
   createRedisAdapter,
 } = require('./realtime');
+const { mcpPlugin, createMcpServer, McpServer } = require('./mcp');
+const polarPlugin = require('./polar');
 
 module.exports = {
   sitemapPlugin,
@@ -77,6 +79,10 @@ module.exports = {
   redis,
   createRedisAdapter,
   queuePlugin: require('./queue'),
+  mcpPlugin,
+  createMcpServer,
+  McpServer,
+  polarPlugin,
 };
 
 

package/plugins/mcp/auth.js

@@ -0,0 +1,104 @@
+/**
+ * Webspresso MCP Authentication & Security
+ * Provides token validation and localhost IP restrictions for HTTP/SSE transports
+ * @module plugins/mcp/auth
+ */
+
+const crypto = require('crypto');
+
+/**
+ * Constant-time string comparison to avoid timing attacks
+ * @param {string} a
+ * @param {string} b
+ * @returns {boolean}
+ */
+function safeEqual(a, b) {
+  if (typeof a !== 'string' || typeof b !== 'string') return false;
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return crypto.timingSafeEqual(bufA, bufB);
+}
+
+/**
+ * Check if incoming request is from localhost
+ * @param {import('express').Request} req
+ * @returns {boolean}
+ */
+function isLocalhost(req) {
+  const ip = req.ip || req.connection?.remoteAddress || '';
+  return (
+    ip === '127.0.0.1' ||
+    ip === '::1' ||
+    ip === '::ffff:127.0.0.1' ||
+    ip.endsWith('127.0.0.1') ||
+    req.hostname === 'localhost'
+  );
+}
+
+/**
+ * Creates authentication middleware for MCP HTTP/SSE endpoints
+ * @param {Object} [options={}]
+ * @param {string} [options.token] - Pre-shared secret token
+ * @param {boolean} [options.localhostOnly=false] - Only allow localhost connections
+ * @param {function(import('express').Request): (boolean|Promise<boolean>)} [options.verify] - Custom verify function
+ * @returns {import('express').RequestHandler}
+ */
+function createMcpAuthMiddleware(options = {}) {
+  const { token, localhostOnly = false, verify } = options;
+
+  return async function mcpAuthMiddleware(req, res, next) {
+    // 1. Localhost check
+    if (localhostOnly && !isLocalhost(req)) {
+      return res.status(403).json({
+        jsonrpc: '2.0',
+        error: { code: -32000, message: 'Forbidden: MCP server only allows localhost connections' },
+      });
+    }
+
+    // 2. Custom verification
+    if (typeof verify === 'function') {
+      try {
+        const ok = await verify(req);
+        if (!ok) {
+          return res.status(401).json({
+            jsonrpc: '2.0',
+            error: { code: -32000, message: 'Unauthorized: Custom MCP verification failed' },
+          });
+        }
+        return next();
+      } catch (err) {
+        return res.status(401).json({
+          jsonrpc: '2.0',
+          error: { code: -32000, message: `Unauthorized: ${err.message}` },
+        });
+      }
+    }
+
+    // 3. Pre-shared token check
+    if (token) {
+      let clientToken = '';
+      const authHeader = req.headers.authorization;
+      if (authHeader && authHeader.startsWith('Bearer ')) {
+        clientToken = authHeader.slice('Bearer '.length).trim();
+      } else if (req.query && req.query.token) {
+        clientToken = String(req.query.token).trim();
+      }
+
+      if (!clientToken || !safeEqual(clientToken, token)) {
+        return res.status(401).json({
+          jsonrpc: '2.0',
+          error: { code: -32000, message: 'Unauthorized: Invalid or missing MCP bearer token' },
+        });
+      }
+    }
+
+    next();
+  };
+}
+
+module.exports = {
+  createMcpAuthMiddleware,
+  isLocalhost,
+  safeEqual,
+};

package/plugins/mcp/discovery.js

@@ -0,0 +1,88 @@
+/**
+ * Webspresso MCP File-Based Auto-Discovery
+ * Discovers custom MCP tools, resources, and prompts from project `mcp/` directory
+ * @module plugins/mcp/discovery
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * Scan a directory for JS files and require them
+ * @param {string} dirPath
+ * @returns {Array<Object>}
+ */
+function scanModuleDir(dirPath) {
+  if (!fs.existsSync(dirPath)) return [];
+  const entries = fs.readdirSync(dirPath, { withFileTypes: true });
+  const items = [];
+
+  for (const entry of entries) {
+    if (entry.isFile() && (entry.name.endsWith('.js') || entry.name.endsWith('.cjs'))) {
+      if (entry.name.startsWith('_') || entry.name.startsWith('.')) continue;
+      const fullPath = path.join(dirPath, entry.name);
+      try {
+        const mod = require(fullPath);
+        if (mod && typeof mod === 'object') {
+          // If mod doesn't have a name, default to filename without extension
+          if (!mod.name && !mod.uri) {
+            const baseName = path.basename(entry.name, path.extname(entry.name));
+            mod.name = baseName;
+          }
+          items.push(mod);
+        }
+      } catch (err) {
+        console.warn(`[mcp-discovery] Failed to load module at ${fullPath}:`, err.message);
+      }
+    }
+  }
+
+  return items;
+}
+
+/**
+ * Discovers custom MCP components from the filesystem and registers them to the server
+ * @param {import('./server').McpServer} server
+ * @param {string} [rootDir=process.cwd()]
+ * @param {string} [mcpDirName='mcp']
+ */
+function discoverMcpDirectory(server, rootDir = process.cwd(), mcpDirName = 'mcp') {
+  const mcpRoot = path.resolve(rootDir, mcpDirName);
+  if (!fs.existsSync(mcpRoot)) return;
+
+  // 1. Discover custom tools: mcp/tools/
+  const toolsDir = path.join(mcpRoot, 'tools');
+  const customTools = scanModuleDir(toolsDir);
+  for (const tool of customTools) {
+    if (typeof tool.handler === 'function') {
+      server.registerTool(tool);
+    }
+  }
+
+  // 2. Discover custom resources: mcp/resources/
+  const resourcesDir = path.join(mcpRoot, 'resources');
+  const customResources = scanModuleDir(resourcesDir);
+  for (const res of customResources) {
+    if (typeof res.handler === 'function') {
+      if (res.uriTemplate) {
+        server.registerResourceTemplate(res);
+      } else if (res.uri) {
+        server.registerResource(res);
+      }
+    }
+  }
+
+  // 3. Discover custom prompts: mcp/prompts/
+  const promptsDir = path.join(mcpRoot, 'prompts');
+  const customPrompts = scanModuleDir(promptsDir);
+  for (const prompt of customPrompts) {
+    if (typeof prompt.handler === 'function') {
+      server.registerPrompt(prompt);
+    }
+  }
+}
+
+module.exports = {
+  discoverMcpDirectory,
+  scanModuleDir,
+};