webspresso 0.0.95 → 0.0.97

package/index.d.ts

@@ -222,6 +222,11 @@ export function createMediaServices(options?: {
   publicBasePath?: string;
 }): Record<string, ServiceDefinition>;
 
+export function createFileManagerServices(options?: {
+  baseDir?: string;
+  publicBasePath?: string;
+}): Record<string, ServiceDefinition>;
+
 export function createSystemServices(options?: {
   db?: unknown;
   serviceRegistry?: unknown;
@@ -706,6 +711,7 @@ export type Zdb = Record<string, any> & {
 };
 
 export const zdb: Zdb;
+export const z: typeof import('zod').z;
 
 export function createSchemaHelpers(z: typeof import('zod').z): Zdb;
 
@@ -1677,4 +1683,304 @@ export class McpServer {
 export function mcpPlugin(options?: McpPluginOptions): WebspressoPlugin;
 export function createMcpServer(options?: McpPluginOptions): McpServer;
 
+// --- File Manager Plugin ---
+
+export interface FileManagerPluginOptions {
+  baseDir?: string;
+  publicBasePath?: string;
+  apiPrefix?: string;
+  pageTitle?: string;
+  menuLabel?: string;
+  menuOrder?: number;
+  maxUploadBytes?: number;
+  allowedExtensions?: string[] | null;
+  allowedMimeTypes?: string[] | null;
+  includePage?: boolean;
+}
+
+export function fileManagerPlugin(options?: FileManagerPluginOptions): WebspressoPlugin;
+
+// --- XLSX Plugin & Toolkit ---
+
+export interface XlsxColumn {
+  header?: string;
+  key: string;
+  width?: number;
+  style?: Record<string, unknown>;
+}
+
+export interface XlsxHeaderStyle {
+  fill?: string;
+  bg?: string;
+  color?: string;
+  textColor?: string;
+  fontName?: string;
+  fontSize?: number;
+  bold?: boolean;
+  align?: 'left' | 'center' | 'right';
+  height?: number;
+}
+
+export interface XlsxSheetConfig {
+  name?: string;
+  columns?: XlsxColumn[];
+  rows?: Record<string, unknown>[];
+  data?: Record<string, unknown>[];
+  autoWidth?: boolean;
+  striped?: boolean;
+  headerStyle?: XlsxHeaderStyle;
+  views?: Array<Record<string, unknown>>;
+}
+
+export interface XlsxGenerateOptions {
+  creator?: string;
+  title?: string;
+  created?: Date;
+  sanitizeFormulas?: boolean;
+  headerStyle?: XlsxHeaderStyle;
+  sheets?: XlsxSheetConfig[] | XlsxSheetConfig;
+  name?: string;
+  columns?: XlsxColumn[];
+  rows?: Record<string, unknown>[];
+  data?: Record<string, unknown>[];
+}
+
+export interface XlsxParseOptions {
+  sheet?: string | number;
+  headerRow?: number;
+  dataStartRow?: number;
+  raw?: boolean;
+  transformRow?: (row: Record<string, unknown>, index: number) => Record<string, unknown>;
+}
+
+export interface XlsxModelExportOptions {
+  sheetName?: string;
+  name?: string;
+  creator?: string;
+  title?: string;
+  columns?: XlsxColumn[];
+  headerStyle?: XlsxHeaderStyle;
+}
+
+export interface XlsxPluginOptions {
+  enabled?: boolean;
+  sanitizeFormulas?: boolean;
+  headerStyle?: XlsxHeaderStyle;
+  db?: unknown;
+}
+
+export interface XlsxToolkit {
+  MIME_TYPE: string;
+  generate(options: XlsxGenerateOptions): Promise<Buffer>;
+  parse(input: Buffer | import('stream').Readable, options?: XlsxParseOptions): Promise<Record<string, unknown>[] | Record<string, Record<string, unknown>[]>>;
+  fromModel(repository: unknown, filterOrQuery?: unknown, options?: XlsxModelExportOptions): Promise<Buffer>;
+  createStreamWriter(outputStream: import('stream').Writable, options?: Record<string, unknown>): unknown;
+  sanitizeFormula(value: unknown): unknown;
+  applyHeaderStyle(worksheet: unknown, style?: XlsxHeaderStyle): void;
+  applyAutoWidths(worksheet: unknown, columns: XlsxColumn[], rows: Record<string, unknown>[]): void;
+  hexToArgb(hex: string): string;
+  createMiddleware(globalOptions?: XlsxPluginOptions): import('express').RequestHandler;
+  createServices(options?: Record<string, unknown>): Record<string, unknown>;
+}
+
+export const xlsx: XlsxToolkit;
+export function xlsxPlugin(options?: XlsxPluginOptions): WebspressoPlugin;
+
+// --- CSV Plugin & Toolkit ---
+
+export interface CsvColumn {
+  header?: string;
+  key: string;
+}
+
+export interface CsvGenerateOptions {
+  rows?: Record<string, unknown>[];
+  data?: Record<string, unknown>[];
+  columns?: (CsvColumn | string)[];
+  delimiter?: string;
+  eol?: string;
+  header?: boolean;
+  bom?: boolean;
+  sanitizeFormulas?: boolean;
+  asBuffer?: boolean;
+}
+
+export interface CsvParseOptions {
+  delimiter?: string;
+  columns?: boolean | string[];
+  skip_empty_lines?: boolean;
+  trim?: boolean;
+  relax_column_count?: boolean;
+  transformRow?: (row: Record<string, unknown>, index: number) => Record<string, unknown>;
+  [key: string]: unknown;
+}
+
+export interface CsvModelExportOptions {
+  columns?: (CsvColumn | string)[];
+  delimiter?: string;
+  eol?: string;
+  bom?: boolean;
+  sanitizeFormulas?: boolean;
+  asBuffer?: boolean;
+}
+
+export interface CsvPluginOptions {
+  enabled?: boolean;
+  delimiter?: string;
+  bom?: boolean;
+  sanitizeFormulas?: boolean;
+  db?: unknown;
+}
+
+export interface CsvStreamWriter {
+  writeHeader(columns?: (CsvColumn | string)[]): void;
+  writeRow(row: Record<string, unknown>): void;
+  writeRows(rows: Record<string, unknown>[]): void;
+  end(): void;
+  stream: import('stream').Writable;
+}
+
+export interface CsvToolkit {
+  MIME_TYPE: string;
+  UTF8_BOM: string;
+  generate(options?: CsvGenerateOptions): Buffer | string;
+  parse(input: Buffer | string | import('stream').Readable, options?: CsvParseOptions): Promise<Record<string, unknown>[]>;
+  fromModel(repository: unknown, filterOrQuery?: unknown, options?: CsvModelExportOptions): Promise<Buffer>;
+  createStreamWriter(outputStream: import('stream').Writable, options?: Record<string, unknown>): CsvStreamWriter;
+  sanitizeFormula(value: unknown): unknown;
+  escapeCsvField(value: unknown, options?: Record<string, unknown>): string;
+  createMiddleware(globalOptions?: CsvPluginOptions): import('express').RequestHandler;
+  createServices(options?: Record<string, unknown>): Record<string, unknown>;
+}
+
+export const csv: CsvToolkit;
+export function csvPlugin(options?: CsvPluginOptions): WebspressoPlugin;
+
+// --- Discovery, Pages, API & Modules ---
+
+export interface PageContext<TParams = Record<string, string>, TQuery = Record<string, string>> {
+  req: import('express').Request;
+  res: import('express').Response;
+  params: TParams;
+  query: TQuery;
+  service: <TInput = unknown, TOutput = unknown>(name: string, input?: TInput, opts?: unknown) => Promise<TOutput>;
+  module: string | null;
+  config: Record<string, unknown>;
+  logger: Console;
+  redirect: (url: string, status?: number) => { __redirected: boolean };
+  error: (status?: number, message?: string) => never;
+  fsy: Record<string, unknown>;
+  locale: string;
+  t: (key: string, params?: Record<string, unknown>) => string;
+  db: unknown;
+}
+
+export interface DefinePageOptions<TData = any, TParams = Record<string, string>, TQuery = Record<string, string>> {
+  middleware?: (string | import('express').RequestHandler | [string, Record<string, unknown>])[];
+  load?: (ctx: PageContext<TParams, TQuery>) => Promise<TData> | TData;
+  head?: (data: TData, ctx: PageContext<TParams, TQuery>) => Record<string, unknown>;
+  render?: (data: TData, ctx: PageContext<TParams, TQuery>) => string | Promise<string>;
+  layout?: string | boolean;
+  hooks?: Record<string, unknown>;
+  meta?: Record<string, unknown>;
+  [key: string]: unknown;
+}
+
+export function definePage<TData = any, TParams = Record<string, string>, TQuery = Record<string, string>>(
+  config: DefinePageOptions<TData, TParams, TQuery> | ((ctx: PageContext<TParams, TQuery>) => Promise<TData> | TData)
+): DefinePageOptions<TData, TParams, TQuery>;
+
+export interface ApiContext<TBody = any, TParams = Record<string, string>, TQuery = Record<string, string>> {
+  req: import('express').Request;
+  res: import('express').Response;
+  params: TParams;
+  query: TQuery;
+  body: TBody;
+  input: { body?: TBody; params?: TParams; query?: TQuery; headers?: Record<string, string> };
+  service: <TInput = unknown, TOutput = unknown>(name: string, input?: TInput, opts?: unknown) => Promise<TOutput>;
+  module: string | null;
+  config: Record<string, unknown>;
+  logger: Console;
+  db: unknown;
+}
+
+export interface DefineApiOptions<TResult = any, TBody = any, TParams = Record<string, string>, TQuery = Record<string, string>> {
+  description?: string;
+  tags?: string[];
+  middleware?: (string | import('express').RequestHandler | [string, Record<string, unknown>])[];
+  schema?: {
+    params?: unknown;
+    query?: unknown;
+    body?: unknown;
+    headers?: unknown;
+  } | ((helpers: { z: typeof import('zod').z }) => Record<string, unknown>);
+  response?: Record<number | string, unknown>;
+  handler: (req: import('express').Request, ctx: ApiContext<TBody, TParams, TQuery>) => Promise<TResult> | TResult;
+  [key: string]: unknown;
+}
+
+export function defineApi<TResult = any, TBody = any, TParams = Record<string, string>, TQuery = Record<string, string>>(
+  config: DefineApiOptions<TResult, TBody, TParams, TQuery> | ((req: import('express').Request, ctx: ApiContext<TBody, TParams, TQuery>) => Promise<TResult> | TResult)
+): DefineApiOptions<TResult, TBody, TParams, TQuery>;
+
+export interface DefineModuleOptions {
+  name: string;
+  version?: string;
+  description?: string;
+  imports?: string[];
+  dependencies?: string[];
+  pages?: boolean | { dir?: string; prefix?: string };
+  api?: boolean | { dir?: string; prefix?: string };
+  services?: Record<string, unknown> | boolean | { dir?: string };
+  middlewares?: Record<string, import('express').RequestHandler> | boolean | { dir?: string };
+  exports?: Record<string, unknown>;
+  apiExports?: Record<string, unknown>;
+  onInit?: (ctx: unknown) => void | Promise<void>;
+  onDestroy?: (ctx: unknown) => void | Promise<void>;
+  [key: string]: unknown;
+}
+
+export function defineModule(config: DefineModuleOptions): (userOptions?: Record<string, unknown>) => WebspressoPlugin;
+
+export interface RouteDescriptor {
+  type: 'page' | 'api';
+  method: string;
+  path: string;
+  file: string;
+  source?: string;
+  module?: string | null;
+  description?: string;
+  tags?: string[];
+  moduleConfig?: unknown;
+}
+
+export class RouteTable {
+  routes: ReadonlyArray<RouteDescriptor>;
+  constructor(routes?: RouteDescriptor[]);
+  list(): Array<{ method: string; path: string; type: string; module: string | null; source: string; description?: string; tags?: string[] }>;
+  get(method: string, path: string): RouteDescriptor | undefined;
+  has(method: string, path: string): boolean;
+  get size(): number;
+}
+
+export function scanRoutes(options?: {
+  rootDir?: string;
+  pages?: boolean | { dir?: string; prefix?: string };
+  api?: boolean | { dir?: string; prefix?: string };
+  modules?: boolean | { dir?: string };
+}): RouteDescriptor[];
+
+export function parseFileRoute(
+  relativePath: string,
+  options?: { type?: 'page' | 'api'; prefix?: string }
+): { path: string; method: string; isValid: boolean; isPrivate: boolean; originalMethodPart?: string };
+
+export function compileRouteTable(
+  descriptors?: RouteDescriptor[],
+  options?: { explicitRoutes?: Array<{ method?: string; path: string }>; isDev?: boolean }
+): RouteTable;
+
+
+
+
 

package/index.js

@@ -52,6 +52,15 @@ const {
   resetPluginManager
 } = require('./src/plugin-manager');
 
+// Discovery, Pages, API, Modules & Routing primitives
+const { definePage } = require('./src/pages/define-page');
+const { defineApi } = require('./src/api/define-api');
+const { defineModule } = require('./src/modules/define-module');
+const { scanRoutes } = require('./src/discovery/scan-routes');
+const { parseFileRoute } = require('./src/discovery/file-route-parser');
+const { compileRouteTable, RouteTable } = require('./src/routing/route-table');
+const { mountDiscoveredRoutes } = require('./src/routing/mount-discovered-routes');
+
 // ORM exports (lazy loaded)
 const orm = require('./core/orm');
 
@@ -90,6 +99,11 @@ const {
   mcpPlugin,
   createMcpServer,
   McpServer,
+  fileManagerPlugin,
+  xlsxPlugin,
+  xlsx,
+  csvPlugin,
+  csv,
 } = require('./plugins');
 
 const content = require('./core/content');
@@ -127,6 +141,7 @@ module.exports = {
   createAuthServices: require('./src/services').createAuthServices,
   createMailServices: require('./src/services').createMailServices,
   createMediaServices: require('./src/services').createMediaServices,
+  createFileManagerServices: require('./src/services').createFileManagerServices,
   createSystemServices: require('./src/services').createSystemServices,
   createExchangeServices: require('./src/services').createExchangeServices,
   validateServiceInput: require('./src/services').validateServiceInput,
@@ -205,8 +220,9 @@ module.exports = {
   /** Event bus / plugin shell / view resolver / flows (`kernel.createApp` is distinct from SSR `createApp`) */
   kernel,
 
-  // Direct zdb export (for convenience)
+  // Direct zdb & z export (for convenience)
   zdb: orm.zdb,
+  z: require('./core/validation').z,
 
   // Plugins
   schemaExplorerPlugin,
@@ -243,6 +259,24 @@ module.exports = {
   mcpPlugin,
   createMcpServer,
   McpServer,
+  fileManagerPlugin,
+  xlsxPlugin,
+  xlsx,
+  csvPlugin,
+  csv,
+
+  // Discovery, Pages, API, Modules & Routing primitives
+  definePage,
+  page: definePage,
+  defineApi,
+  api: defineApi,
+  defineModule,
+  module: defineModule,
+  scanRoutes,
+  parseFileRoute,
+  compileRouteTable,
+  RouteTable,
+  mountDiscoveredRoutes,
 
   // Schema-driven CMS core (framework-agnostic)
   content,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.95",
+  "version": "0.0.97",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",
@@ -38,10 +38,27 @@
   },
   "scripts": {
     "test": "vitest run",
+    "test:unit": "vitest run tests/unit/",
+    "test:integration": "vitest run tests/integration/",
     "test:security": "vitest run tests/security/",
-    "security": "npm run test:security && npm audit",
+    "test:orm": "vitest run tests/**/orm* tests/**/database*",
+    "test:auth": "vitest run tests/**/auth* tests/unit/server-auth-branches.test.js",
+    "test:admin": "vitest run tests/**/admin*",
+    "test:services": "vitest run tests/**/service*",
+    "test:plugins": "vitest run tests/**/plugin* tests/unit/*plugin*.test.js",
+    "test:core": "vitest run tests/unit/core* tests/unit/server* tests/unit/routing* tests/unit/template*",
+    "test:branches": "vitest run tests/unit/*branches.test.js",
+    "test:fast": "vitest run tests/unit/*branches.test.js tests/unit/auth.test.js tests/unit/services.test.js tests/unit/server.test.js",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
+    "test:coverage:branches": "vitest run tests/unit/*branches.test.js --coverage",
+    "test:coverage:unit": "vitest run tests/unit/ --coverage",
+    "test:coverage:core": "vitest run tests/unit/core* tests/unit/server* tests/unit/routing* tests/unit/template* --coverage",
+    "test:coverage:auth": "vitest run tests/**/auth* tests/unit/server-auth-branches.test.js --coverage",
+    "test:coverage:orm": "vitest run tests/**/orm* tests/**/database* --coverage",
+    "test:coverage:services": "vitest run tests/**/service* --coverage",
+    "test:coverage:plugins": "vitest run tests/**/plugin* tests/unit/*plugin*.test.js --coverage",
+    "test:coverage:fast": "vitest run tests/unit/*branches.test.js tests/unit/auth.test.js tests/unit/services.test.js tests/unit/server.test.js --coverage",
     "test:e2e": "playwright test",
     "test:e2e:ui": "playwright test --ui",
     "test:e2e:debug": "playwright test --debug",
@@ -80,10 +97,12 @@
     "index.d.ts",
     "bin/",
     "src/",
-    "utils/",
     "core/",
     "plugins/",
-    "templates/",
+    ".agents/",
+    "AGENTS.md",
+    "CLAUDE.md",
+    ".cursorrules",
     "views/partials/webspresso-client-runtime.njk"
   ],
   "dependencies": {
@@ -94,7 +113,7 @@
     "commander": "^11.1.0",
     "connect-timeout": "^1.9.1",
     "cookie-parser": "^1.4.7",
-    "csv-parse": "^5.6.0",
+    "csv-parse": "^7.0.2",
     "dayjs": "^1.11.19",
     "exceljs": "^4.4.0",
     "express": "^5.2.1",
@@ -103,11 +122,11 @@
     "inquirer": "^8.2.6",
     "knex": "^3.1.0",
     "mjml": "^5.4.0",
-    "multer": "^2.1.1",
-    "nodemailer": "^9.0.3",
+    "multer": "^2.4.0",
+    "nodemailer": "^10.0.10",
     "nunjucks": "^3.2.4",
-    "sanitize-html": "^2.17.3",
-    "sharp": "^0.35.3",
+    "sanitize-html": "^2.17.7",
+    "sharp": "^0.35.4",
     "swup": "^4.8.3",
     "yaml": "^2.8.3",
     "zod": "^3.23.0",
@@ -142,11 +161,11 @@
     }
   },
   "devDependencies": {
-    "@faker-js/faker": "^9.9.0",
+    "@faker-js/faker": "^10.6.0",
     "@playwright/test": "^1.48.0",
     "@types/express": "^4.17.21",
     "@types/node": "^20.14.0",
-    "@vitest/coverage-v8": "^3.0.0",
+    "@vitest/coverage-v8": "^4.1.11",
     "better-sqlite3": "^11.10.0",
     "chokidar": "^3.5.3",
     "docboot": "^0.3.0",
@@ -155,16 +174,19 @@
     "release-it": "^20.2.1",
     "supertest": "^6.3.4",
     "typescript": "~5.6.3",
-    "vitest": "^3.0.0"
+    "vitest": "^4.1.11",
+    "vitest-doctor": "^0.3.0"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   },
   "overrides": {
     "basic-ftp": "^5.3.0",
     "tar": "^7.5.11",
     "undici": "^6.24.0",
-    "uuid": "^11.1.1"
+    "uuid": "^11.1.1",
+    "js-yaml": "^5.4.2",
+    "qs": "^6.16.0"
   },
   "allowScripts": {
     "better-sqlite3@11.10.0": true

package/plugins/admin-panel/app.js

@@ -248,9 +248,10 @@ function wrapCustomPageWithLayout(page, rawComp) {
   return {
     oninit: function(vnode) {
       try {
-        vnode.state.instance = typeof rawComp === 'function' ? rawComp.call(this, vnode) : rawComp;
-        if (vnode.state.instance && typeof vnode.state.instance.oninit === 'function') {
-          return vnode.state.instance.oninit.call(this, vnode);
+        const instance = typeof rawComp === 'function' ? rawComp.call(rawComp, vnode) : rawComp;
+        vnode.state.instance = instance;
+        if (instance && typeof instance.oninit === 'function') {
+          return instance.oninit.call(instance, vnode);
         }
       } catch (err) {
         console.error('[Admin Panel] Error in oninit for custom page "' + page.id + '":', err);
@@ -260,7 +261,7 @@ function wrapCustomPageWithLayout(page, rawComp) {
     oncreate: function(vnode) {
       try {
         const comp = vnode.state.instance || rawComp;
-        if (comp && typeof comp.oncreate === 'function') return comp.oncreate.call(this, vnode);
+        if (comp && typeof comp.oncreate === 'function') return comp.oncreate.call(comp, vnode);
       } catch (err) {
         console.error('[Admin Panel] Error in oncreate for custom page "' + page.id + '":', err);
       }
@@ -268,7 +269,7 @@ function wrapCustomPageWithLayout(page, rawComp) {
     onupdate: function(vnode) {
       try {
         const comp = vnode.state.instance || rawComp;
-        if (comp && typeof comp.onupdate === 'function') return comp.onupdate.call(this, vnode);
+        if (comp && typeof comp.onupdate === 'function') return comp.onupdate.call(comp, vnode);
       } catch (err) {
         console.error('[Admin Panel] Error in onupdate for custom page "' + page.id + '":', err);
       }
@@ -276,7 +277,7 @@ function wrapCustomPageWithLayout(page, rawComp) {
     onbeforeremove: function(vnode) {
       try {
         const comp = vnode.state.instance || rawComp;
-        if (comp && typeof comp.onbeforeremove === 'function') return comp.onbeforeremove.call(this, vnode);
+        if (comp && typeof comp.onbeforeremove === 'function') return comp.onbeforeremove.call(comp, vnode);
       } catch (err) {
         console.error('[Admin Panel] Error in onbeforeremove for custom page "' + page.id + '":', err);
       }
@@ -284,7 +285,7 @@ function wrapCustomPageWithLayout(page, rawComp) {
     onremove: function(vnode) {
       try {
         const comp = vnode.state.instance || rawComp;
-        if (comp && typeof comp.onremove === 'function') return comp.onremove.call(this, vnode);
+        if (comp && typeof comp.onremove === 'function') return comp.onremove.call(comp, vnode);
       } catch (err) {
         console.error('[Admin Panel] Error in onremove for custom page "' + page.id + '":', err);
       }
@@ -305,9 +306,9 @@ function wrapCustomPageWithLayout(page, rawComp) {
       var content;
       try {
         if (comp && typeof comp.view === 'function') {
-          content = comp.view.call(this, vnode);
+          content = comp.view.call(comp, vnode);
         } else if (typeof comp === 'function') {
-          content = comp.call(this, vnode);
+          content = comp.call(comp, vnode);
         } else {
           content = comp;
         }

package/plugins/admin-panel/client/parts/05-rich-text-file-helpers.js

@@ -305,7 +305,28 @@ const FileUploadField = {
         }),
         m('div', [
           m('p.text-gray-600.dark:text-slate-400.mb-2', displayUrl ? 'Drag and drop to replace, or' : 'Drag and drop a file here, or'),
-          m('label.text-blue-600.hover:text-blue-800.dark:text-blue-400.cursor-pointer', { for: 'file-input-' + col.name }, displayUrl ? 'choose another file' : 'browse'),
+          m('div.flex.items-center.justify-center.gap-3.flex-wrap', [
+            m('label.text-blue-600.hover:text-blue-800.dark:text-blue-400.cursor-pointer.font-medium', { for: 'file-input-' + col.name }, displayUrl ? 'choose another file' : 'browse'),
+            typeof window !== 'undefined' && window.__openFileManagerPicker
+              ? m('button.text-indigo-600.hover:text-indigo-800.dark:text-indigo-400.cursor-pointer.font-medium.flex.items-center.gap-1', {
+                  type: 'button',
+                  onclick: function(e) {
+                    e.preventDefault();
+                    e.stopPropagation();
+                    window.__openFileManagerPicker({
+                      accept: accept,
+                      title: '📁 Ortam Kütüphanesinden Seç',
+                      onSelect: function(pickedUrl) {
+                        if (onChange) onChange(pickedUrl);
+                      }
+                    });
+                  }
+                }, [
+                  m('span', '•'),
+                  m('span', 'Kütüphaneden Seç')
+                ])
+              : null
+          ])
         ]),
       ]),
       m('input[type=hidden]', { name: col.name, value: typeof value === 'string' ? value : '' }),

package/plugins/admin-panel/core/api-extensions.js

@@ -24,6 +24,10 @@ let npmVersionCache = {
 };
 
 function fetchLatestNpmVersion(force = false) {
+  if ((process.env.NODE_ENV === 'test' || process.env.VITEST) && !force) {
+    return Promise.resolve(npmVersionCache.latestVersion || getWebspressoVersion());
+  }
+
   const now = Date.now();
   if (!force && npmVersionCache.latestVersion && (now - npmVersionCache.checkedAt < 30 * 60 * 1000)) {
     return Promise.resolve(npmVersionCache.latestVersion);

package/plugins/basic-auth/index.js

@@ -117,7 +117,9 @@ function sendUnauthorized(req, res, config) {
 
   if (config.challenge !== false) {
     const realm = String(config.realm || 'Restricted Area')
-      .split(/[\r\n]/)[0]
+      .split(/[\r\n\0]/)[0]
+      .replace(/[\t]/g, ' ')
+      .replace(/\\/g, '\\\\')
       .replace(/"/g, '\\"');
     res.setHeader('WWW-Authenticate', `Basic realm="${realm}"`);
   }

package/plugins/content/client/inline-edit.js

@@ -248,9 +248,14 @@
       el.textContent = '';
       return;
     }
+    if (typeof window.DOMPurify !== 'undefined' && typeof window.DOMPurify.sanitize === 'function') {
+      el.innerHTML = window.DOMPurify.sanitize(htmlStr);
+      return;
+    }
     try {
-      var parser = new DOMParser();
-      var doc = parser.parseFromString(htmlStr, 'text/html');
+      var template = document.createElement('template');
+      template.innerHTML = htmlStr;
+      var content = template.content;
       var allowedTags = {
         p: 1, br: 1, b: 1, i: 1, strong: 1, em: 1, u: 1, s: 1, strike: 1,
         h1: 1, h2: 1, h3: 1, h4: 1, h5: 1, h6: 1, ul: 1, ol: 1, li: 1,
@@ -260,14 +265,14 @@
       var allowedAttrs = {
         href: 1, title: 1, target: 1, rel: 1, class: 1, id: 1, src: 1, alt: 1, width: 1, height: 1
       };
-      var allNodes = doc.body.querySelectorAll('*');
+      var allNodes = content.querySelectorAll('*');
       for (var i = allNodes.length - 1; i >= 0; i--) {
         var node = allNodes[i];
         var tag = node.tagName.toLowerCase();
         if (!allowedTags[tag]) {
           if (node.parentNode) {
             node.parentNode.removeChild(node);
-          } else {
+          } else if (typeof node.remove === 'function') {
             node.remove();
           }
           continue;
@@ -275,7 +280,7 @@
         var attrs = Array.prototype.slice.call(node.attributes);
         for (var j = 0; j < attrs.length; j++) {
           var attrName = attrs[j].name.toLowerCase();
-          var attrVal = attrs[j].value.toLowerCase().replace(/[\x00-\x20\s]+/g, '').trim();
+          var attrVal = (attrs[j].value || '').toLowerCase().replace(/[\x00-\x20\s]+/g, '').trim();
           if (attrName.indexOf('on') === 0 || !allowedAttrs[attrName]) {
             node.removeAttribute(attrs[j].name);
           } else if ((attrName === 'href' || attrName === 'src' || attrName === 'action' || attrName === 'formaction' || attrName === 'xlink:href') &&
@@ -287,13 +292,8 @@
         }
       }
 
-      // Transfer DOM nodes directly to target element
-      while (el.firstChild) {
-        el.removeChild(el.firstChild);
-      }
-      while (doc.body.firstChild) {
-        el.appendChild(doc.body.firstChild);
-      }
+      el.textContent = '';
+      el.appendChild(content.cloneNode(true));
     } catch (e) {
       el.textContent = htmlStr;
     }