webspresso 0.0.94 → 0.0.96

package/plugins/polar/src/rate-limit.js

@@ -1,36 +1,86 @@
 'use strict';
 
-const DEFAULT_RATE_LIMITS = {
-  webhook: {
-    limit: 120,
-    windowMs: 60_000,
-    message: { error: 'Too many webhook requests' },
-  },
-  checkout: {
-    limit: 5,
-    windowMs: 60_000,
-    message: { error: 'Too many checkout attempts. Please try again later.' },
-    keyGenerator: (req) => `polar:checkout:${req.user?.id ?? req.ip}`,
-  },
-  portal: {
-    limit: 10,
-    windowMs: 60_000,
-    message: { error: 'Too many portal requests. Please try again later.' },
-    keyGenerator: (req) => `polar:portal:${req.user?.id ?? req.ip}`,
-  },
-  status: {
-    limit: 60,
-    windowMs: 60_000,
-    message: { error: 'Too many billing status requests' },
-    keyGenerator: (req) => `polar:status:${req.user?.id ?? req.ip}`,
-  },
-};
+const { loadPeer } = require('../../rate-limit/index.js');
+
+const DEFAULT_IPV6_SUBNET = 56;
+
+/**
+ * @param {Function} ipKeyGenerator
+ * @param {string} prefix
+ */
+function polarIpKey(ipKeyGenerator, prefix) {
+  return (req) => `${prefix}:${ipKeyGenerator(req.ip, DEFAULT_IPV6_SUBNET)}`;
+}
+
+/**
+ * Prefer authenticated user id; fall back to IPv6-safe IP key (express-rate-limit v8).
+ * @param {Function} ipKeyGenerator
+ * @param {string} prefix
+ */
+function polarUserOrIpKey(ipKeyGenerator, prefix) {
+  const ipKey = polarIpKey(ipKeyGenerator, prefix);
+  return (req) => (req.user?.id != null ? `${prefix}:${req.user.id}` : ipKey(req));
+}
+
+/**
+ * @param {Function} ipKeyGenerator
+ */
+function buildDefaultRateLimits(ipKeyGenerator) {
+  return {
+    webhook: {
+      limit: 120,
+      windowMs: 60_000,
+      message: { error: 'Too many webhook requests' },
+      keyGenerator: polarIpKey(ipKeyGenerator, 'polar:webhook'),
+    },
+    checkout: {
+      limit: 5,
+      windowMs: 60_000,
+      message: { error: 'Too many checkout attempts. Please try again later.' },
+      keyGenerator: polarUserOrIpKey(ipKeyGenerator, 'polar:checkout'),
+    },
+    portal: {
+      limit: 10,
+      windowMs: 60_000,
+      message: { error: 'Too many portal requests. Please try again later.' },
+      keyGenerator: polarUserOrIpKey(ipKeyGenerator, 'polar:portal'),
+    },
+    status: {
+      limit: 60,
+      windowMs: 60_000,
+      message: { error: 'Too many billing status requests' },
+      keyGenerator: polarUserOrIpKey(ipKeyGenerator, 'polar:status'),
+    },
+  };
+}
+
+/** @type {ReturnType<typeof buildDefaultRateLimits>|null} */
+let cachedDefaults = null;
+
+function loadIpKeyGenerator() {
+  try {
+    const { ipKeyGenerator } = loadPeer();
+    return ipKeyGenerator;
+  } catch {
+    return null;
+  }
+}
+
+function getDefaultRateLimits() {
+  const ipKeyGenerator = loadIpKeyGenerator();
+  if (!ipKeyGenerator) {
+    return null;
+  }
+  if (!cachedDefaults) {
+    cachedDefaults = buildDefaultRateLimits(ipKeyGenerator);
+  }
+  return cachedDefaults;
+}
 
 /**
  * Build per-route limiter middleware from rateLimitPlugin factory.
  * @param {Object} ctx - plugin onRoutesReady context
  * @param {import('./config').PolarConfig} config
- * @returns {{ webhook?: Function, checkout?: Function, portal?: Function, status?: Function }}
  */
 function resolvePolarRateLimiters(ctx, config) {
   const rlOpt = config.rateLimit;
@@ -48,6 +98,14 @@ function resolvePolarRateLimiters(ctx, config) {
     return {};
   }
 
+  const defaults = getDefaultRateLimits();
+  if (!defaults) {
+    console.warn(
+      '[polar] rateLimit is enabled but express-rate-limit >= 8 is not installed — skipping polar rate limiters'
+    );
+    return {};
+  }
+
   const overrides = rlOpt === true ? {} : (rlOpt || {});
   const routes = ['webhook', 'checkout', 'portal', 'status'];
   const out = {};
@@ -55,7 +113,7 @@ function resolvePolarRateLimiters(ctx, config) {
   for (const route of routes) {
     if (overrides[route] === false) continue;
     const opts = {
-      ...DEFAULT_RATE_LIMITS[route],
+      ...defaults[route],
       ...(typeof overrides[route] === 'object' ? overrides[route] : {}),
     };
     out[route] = factory(opts);
@@ -65,6 +123,16 @@ function resolvePolarRateLimiters(ctx, config) {
 }
 
 module.exports = {
-  DEFAULT_RATE_LIMITS,
+  loadIpKeyGenerator,
+  polarIpKey,
+  polarUserOrIpKey,
+  buildDefaultRateLimits,
+  getDefaultRateLimits,
   resolvePolarRateLimiters,
+  /** @deprecated use getDefaultRateLimits() */
+  get DEFAULT_RATE_LIMITS() {
+    return getDefaultRateLimits() || buildDefaultRateLimits(
+      loadIpKeyGenerator() || ((ip) => String(ip))
+    );
+  },
 };

package/plugins/polar/src/routes.js

@@ -5,6 +5,7 @@ const { getPolarCheckoutUrl } = require('./checkout');
 const { getPolarPortalUrl } = require('./portal');
 const { syncPolarBillingForUser } = require('./sync');
 const { userHasProTier } = require('./user-resolver');
+const { userIsPaid } = require('./billing-hooks');
 
 function resolveKnex(db) {
   return db?.knex || (typeof db?.raw === 'function' ? db : null);
@@ -81,12 +82,12 @@ function createCheckoutHandler(config) {
       if (knex) {
         const dbUser = await knex(config.userTable).where(f.id, req.user[f.id] || req.user.id).first();
         if (dbUser) user = dbUser;
-        if (config.accessToken) {
+        if (config.accessToken && config.syncBeforeCheckout) {
           user = await syncPolarBillingForUser(user, knex, config);
         }
       }
 
-      if (userHasProTier(user, config)) {
+      if (await userIsPaid(user, knex, config)) {
         const alreadyUrl = config.urls.alreadySubscribed.startsWith('http')
           ? config.urls.alreadySubscribed
           : config.urls.alreadySubscribed;

package/plugins/polar/src/urls.js

@@ -92,6 +92,7 @@ function extractCheckoutUrlFromResponse(data, sandbox = false) {
 }
 
 function polarCspDirectives(opts = {}) {
+  const self = "'self'";
   const domains = opts.domains || [
     'https://buy.polar.sh',
     'https://sandbox-buy.polar.sh',
@@ -101,8 +102,30 @@ function polarCspDirectives(opts = {}) {
     'https://sandbox-api.polar.sh',
   ];
   return {
-    formAction: domains,
-    connectSrc: domains,
+    formAction: [self, ...domains],
+    connectSrc: [self, ...domains],
+  };
+}
+
+/**
+ * Union Polar CSP sources into an existing Helmet/plugin CSP config (does not replace).
+ * @param {Object} [existing]
+ * @param {Object} [opts] - passed to polarCspDirectives
+ */
+function mergePolarCspDirectives(existing = {}, opts = {}) {
+  const polar = polarCspDirectives(opts);
+  const mergeList = (key) => {
+    const base = existing[key];
+    const items = [
+      ...(Array.isArray(base) ? base : base ? [base] : []),
+      ...polar[key],
+    ];
+    return [...new Set(items)];
+  };
+  return {
+    ...existing,
+    formAction: mergeList('formAction'),
+    connectSrc: mergeList('connectSrc'),
   };
 }
 
@@ -114,4 +137,5 @@ module.exports = {
   isValidPortalRedirectUrl,
   extractCheckoutUrlFromResponse,
   polarCspDirectives,
+  mergePolarCspDirectives,
 };

package/plugins/polar/src/user-resolver.js

@@ -113,7 +113,11 @@ async function resolveUserFromPolarData(data, knex, config) {
   const table = config.userTable;
 
   if (metadata.user_id) {
-    const user = await knex(table).where(f.id, Number(metadata.user_id)).first();
+    const uid = String(metadata.user_id).trim();
+    let user = await knex(table).where(f.id, uid).first();
+    if (!user && /^\d+$/.test(uid)) {
+      user = await knex(table).where(f.id, Number(uid)).first();
+    }
     if (user) return user;
   }
 

package/plugins/rate-limit/index.js

@@ -175,4 +175,8 @@ function rateLimitPlugin(options = {}) {
   return plugin;
 }
 
-module.exports = { rateLimitPlugin };
+module.exports = {
+  rateLimitPlugin,
+  loadPeer,
+  resolveLimiterConfig,
+};

package/plugins/xlsx/engine.js

@@ -0,0 +1,397 @@
+'use strict';
+
+/**
+ * Webspresso XLSX Core Engine
+ * High-performance Excel spreadsheet generator, parser, and ORM exporter
+ * @module plugins/xlsx/engine
+ */
+
+const ExcelJS = require('exceljs');
+const { PassThrough } = require('stream');
+
+/**
+ * Common formula injection trigger characters
+ * @type {RegExp}
+ */
+const FORMULA_INJECTION_REGEX = /^([=+\-@\t\r])/;
+
+/**
+ * Neutralizes Excel formula injection by escaping dangerous prefixes
+ * @param {*} value
+ * @returns {*}
+ */
+function sanitizeFormula(value) {
+  if (typeof value === 'string' && FORMULA_INJECTION_REGEX.test(value)) {
+    return `'${value}`;
+  }
+  return value;
+}
+
+/**
+ * Converts a 6-character hex color (e.g. '4F46E5' or '#4F46E5') to ARGB
+ * @param {string} hex
+ * @returns {string}
+ */
+function hexToArgb(hex) {
+  if (!hex || typeof hex !== 'string') return 'FF4F46E5';
+  let clean = hex.replace(/^#/, '').trim();
+  if (clean.length === 3) {
+    clean = clean.split('').map((c) => c + c).join('');
+  }
+  if (clean.length === 6) {
+    return `FF${clean.toUpperCase()}`;
+  }
+  if (clean.length === 8) {
+    return clean.toUpperCase();
+  }
+  return 'FF4F46E5';
+}
+
+/**
+ * Automatically calculates optimal column widths based on headers and sample rows
+ * @param {ExcelJS.Worksheet} worksheet
+ * @param {Array<Object>} columns
+ * @param {Array<Object>} rows
+ */
+function applyAutoWidths(worksheet, columns, rows) {
+  if (!columns || !Array.isArray(columns)) return;
+
+  columns.forEach((col, index) => {
+    const colIndex = index + 1;
+    let maxLength = col.header ? String(col.header).length : 10;
+
+    // Sample up to first 100 rows for performance
+    const sampleLimit = Math.min(rows.length, 100);
+    for (let i = 0; i < sampleLimit; i++) {
+      const val = rows[i] ? rows[i][col.key] : '';
+      if (val !== null && val !== undefined) {
+        const strVal = val instanceof Date ? 'YYYY-MM-DD HH:mm:ss' : String(val);
+        if (strVal.length > maxLength) {
+          maxLength = strVal.length;
+        }
+      }
+    }
+
+    const column = worksheet.getColumn(colIndex);
+    column.width = Math.min(Math.max(maxLength + 4, 12), 60);
+  });
+}
+
+/**
+ * Applies styled headers to a worksheet
+ * @param {ExcelJS.Worksheet} worksheet
+ * @param {Object} [style]
+ */
+function applyHeaderStyle(worksheet, style = {}) {
+  const headerRow = worksheet.getRow(1);
+  const bgColor = hexToArgb(style.bg || style.fill || '4F46E5');
+  const textColor = hexToArgb(style.color || style.textColor || 'FFFFFF');
+
+  headerRow.height = style.height || 26;
+  headerRow.eachCell((cell) => {
+    cell.font = {
+      name: style.fontName || 'Segoe UI',
+      size: style.fontSize || 11,
+      bold: style.bold !== false,
+      color: { argb: textColor },
+    };
+    cell.fill = {
+      type: 'pattern',
+      pattern: 'solid',
+      fgColor: { argb: bgColor },
+    };
+    cell.alignment = {
+      vertical: 'middle',
+      horizontal: style.align || 'left',
+      wrapText: false,
+    };
+    cell.border = {
+      top: { style: 'thin', color: { argb: 'FFE5E7EB' } },
+      left: { style: 'thin', color: { argb: 'FFE5E7EB' } },
+      bottom: { style: 'medium', color: { argb: 'FF3730A3' } },
+      right: { style: 'thin', color: { argb: 'FFE5E7EB' } },
+    };
+  });
+}
+
+/**
+ * Generates an Excel XLSX workbook buffer from declarative options
+ * @param {Object} options
+ * @param {string} [options.creator='Webspresso']
+ * @param {string} [options.title]
+ * @param {Date} [options.created]
+ * @param {boolean} [options.sanitizeFormulas=true]
+ * @param {Array<Object>|Object} options.sheets - Sheet configuration(s)
+ * @returns {Promise<Buffer>}
+ */
+async function generate(options = {}) {
+  const workbook = new ExcelJS.Workbook();
+  workbook.creator = options.creator || 'Webspresso';
+  workbook.created = options.created || new Date();
+  if (options.title) workbook.title = options.title;
+
+  const sanitize = options.sanitizeFormulas !== false;
+
+  // Normalize sheets: can be single object or array
+  const rawSheets = options.sheets
+    ? Array.isArray(options.sheets) ? options.sheets : [options.sheets]
+    : [{ name: options.name || 'Sheet1', columns: options.columns, rows: options.rows || options.data || [] }];
+
+  for (let idx = 0; idx < rawSheets.length; idx++) {
+    const sheetConfig = rawSheets[idx];
+    const sheetName = sheetConfig.name || `Sheet${idx + 1}`;
+    const worksheet = workbook.addWorksheet(sheetName, {
+      views: sheetConfig.views || [{ state: 'frozen', xSplit: 0, ySplit: 1 }],
+    });
+
+    const rows = Array.isArray(sheetConfig.rows)
+      ? sheetConfig.rows
+      : Array.isArray(sheetConfig.data)
+        ? sheetConfig.data
+        : [];
+
+    // Derive columns if not explicitly provided
+    let columns = sheetConfig.columns;
+    if (!columns && rows.length > 0 && typeof rows[0] === 'object' && rows[0] !== null) {
+      columns = Object.keys(rows[0]).map((key) => ({
+        header: key,
+        key,
+      }));
+    }
+
+    if (columns && Array.isArray(columns)) {
+      worksheet.columns = columns.map((col) => ({
+        header: col.header || col.name || col.key,
+        key: col.key,
+        width: col.width || 15,
+        style: col.style || {},
+      }));
+
+      // Apply auto-widths if requested (default: true)
+      if (sheetConfig.autoWidth !== false) {
+        applyAutoWidths(worksheet, columns, rows);
+      }
+
+      // Add rows
+      for (const row of rows) {
+        const rowData = {};
+        for (const col of columns) {
+          let val = row ? row[col.key] : '';
+          if (sanitize) {
+            val = sanitizeFormula(val);
+          }
+          rowData[col.key] = val !== undefined ? val : null;
+        }
+        worksheet.addRow(rowData);
+      }
+
+      // Format headers
+      applyHeaderStyle(worksheet, sheetConfig.headerStyle || options.headerStyle);
+
+      // Apply zebra striping or row borders if enabled
+      if (sheetConfig.striped !== false) {
+        worksheet.eachRow((row, rowNumber) => {
+          if (rowNumber === 1) return;
+          row.alignment = { vertical: 'middle' };
+          if (rowNumber % 2 === 0) {
+            row.eachCell((cell) => {
+              if (!cell.fill || cell.fill.type !== 'pattern') {
+                cell.fill = {
+                  type: 'pattern',
+                  pattern: 'solid',
+                  fgColor: { argb: 'FFF9FAFB' },
+                };
+              }
+            });
+          }
+        });
+      }
+    }
+  }
+
+  const buffer = await workbook.xlsx.writeBuffer();
+  return Buffer.from(buffer);
+}
+
+/**
+ * Parses an XLSX buffer or stream into JSON objects
+ * @param {Buffer|import('stream').Readable} input
+ * @param {Object} [options]
+ * @param {string|number} [options.sheet] - Sheet name or 1-based index
+ * @param {number} [options.headerRow=1] - Row index of headers
+ * @param {number} [options.dataStartRow=2] - Row index where data begins
+ * @param {boolean} [options.raw=false] - Return raw cell values without formatting
+ * @param {Function} [options.transformRow] - Custom row transformer
+ * @returns {Promise<Array<Object>|Object.<string, Array<Object>>>}
+ */
+async function parse(input, options = {}) {
+  const workbook = new ExcelJS.Workbook();
+
+  if (Buffer.isBuffer(input)) {
+    await workbook.xlsx.load(input);
+  } else if (input && typeof input.pipe === 'function') {
+    await workbook.xlsx.read(input);
+  } else {
+    throw new Error('parseXlsx requires a valid Buffer or Readable Stream');
+  }
+
+  const headerRowIdx = options.headerRow || 1;
+  const dataStartRowIdx = options.dataStartRow || headerRowIdx + 1;
+  const transformRow = typeof options.transformRow === 'function' ? options.transformRow : null;
+
+  function parseWorksheet(ws) {
+    const headers = [];
+    const headerRow = ws.getRow(headerRowIdx);
+
+    headerRow.eachCell({ includeEmpty: false }, (cell, colNumber) => {
+      let val = cell.value;
+      if (typeof val === 'object' && val !== null) {
+        val = val.text || val.result || String(val);
+      }
+      const headerName = String(val || `col_${colNumber}`).trim();
+      headers[colNumber] = headerName;
+    });
+
+    const rows = [];
+    const rowCount = ws.rowCount;
+
+    for (let r = dataStartRowIdx; r <= rowCount; r++) {
+      const row = ws.getRow(r);
+      if (!row || !row.hasValues) continue;
+
+      const rowObj = {};
+      let hasData = false;
+
+      headers.forEach((header, colNum) => {
+        if (!header) return;
+        const cell = row.getCell(colNum);
+        let cellVal = cell.value;
+
+        if (cellVal && typeof cellVal === 'object') {
+          if (cellVal instanceof Date) {
+            // Keep Date instance or format
+          } else if (cellVal.text !== undefined) {
+            cellVal = cellVal.text;
+          } else if (cellVal.result !== undefined) {
+            cellVal = cellVal.result;
+          }
+        }
+
+        if (cellVal !== null && cellVal !== undefined && cellVal !== '') {
+          hasData = true;
+        }
+
+        rowObj[header] = cellVal !== undefined ? cellVal : null;
+      });
+
+      if (hasData) {
+        rows.push(transformRow ? transformRow(rowObj, rows.length) : rowObj);
+      }
+    }
+
+    return rows;
+  }
+
+  // If specific sheet requested
+  if (options.sheet !== undefined) {
+    let ws;
+    if (typeof options.sheet === 'number') {
+      ws = workbook.getWorksheet(options.sheet);
+    } else {
+      ws = workbook.getWorksheet(String(options.sheet));
+    }
+
+    if (!ws) {
+      throw new Error(`Worksheet "${options.sheet}" not found in XLSX workbook`);
+    }
+
+    return parseWorksheet(ws);
+  }
+
+  // If only 1 sheet exists, return array directly for convenience
+  if (workbook.worksheets.length === 1) {
+    return parseWorksheet(workbook.worksheets[0]);
+  }
+
+  // Multiple sheets: return dictionary keyed by sheet name
+  const result = {};
+  for (const ws of workbook.worksheets) {
+    result[ws.name] = parseWorksheet(ws);
+  }
+  return result;
+}
+
+/**
+ * Automatically exports records from an ORM Repository into an Excel workbook buffer
+ * @param {Object} repository - Model repository from db.getRepository('Model')
+ * @param {Object} [filterOrQuery={}] - Query filters
+ * @param {Object} [options={}] - Export options
+ * @returns {Promise<Buffer>}
+ */
+async function fromModel(repository, filterOrQuery = {}, options = {}) {
+  if (!repository || (typeof repository.find !== 'function' && typeof repository.query !== 'function')) {
+    throw new Error('fromModel requires a valid Webspresso Model Repository');
+  }
+
+  let records;
+  if (typeof filterOrQuery === 'function') {
+    if (typeof repository.query !== 'function') {
+      throw new Error('fromModel query callback requires a repository with query() method');
+    }
+    records = await filterOrQuery(repository.query());
+  } else {
+    records = typeof repository.find === 'function' ? await repository.find(filterOrQuery) : [];
+  }
+
+  const modelName = repository.model?.name || 'Records';
+  const sheetName = options.sheetName || options.name || modelName;
+
+  let columns = options.columns;
+  if (!columns && repository.model?.schema?.shape) {
+    const hidden = new Set(repository.model.hidden || []);
+    columns = Object.keys(repository.model.schema.shape)
+      .filter((col) => !hidden.has(col))
+      .map((col) => ({
+        header: col.charAt(0).toUpperCase() + col.slice(1).replace(/_/g, ' '),
+        key: col,
+      }));
+  }
+
+  return generate({
+    creator: options.creator || 'Webspresso ORM',
+    title: options.title || `${modelName} Export`,
+    sheets: [
+      {
+        name: sheetName,
+        columns,
+        rows: records,
+        headerStyle: options.headerStyle,
+      },
+    ],
+  });
+}
+
+/**
+ * Creates a high-performance streaming workbook writer for massive datasets
+ * @param {import('stream').Writable} outputStream
+ * @param {Object} [options]
+ * @returns {ExcelJS.stream.xlsx.WorkbookWriter}
+ */
+function createStreamWriter(outputStream, options = {}) {
+  return new ExcelJS.stream.xlsx.WorkbookWriter({
+    stream: outputStream,
+    useStyles: options.useStyles !== false,
+    useSharedStrings: options.useSharedStrings || false,
+  });
+}
+
+module.exports = {
+  generate,
+  parse,
+  fromModel,
+  createStreamWriter,
+  sanitizeFormula,
+  applyHeaderStyle,
+  applyAutoWidths,
+  hexToArgb,
+};