webspresso 0.0.95 → 0.0.97

package/plugins/file-manager/index.js

@@ -0,0 +1,139 @@
+/**
+ * Webspresso File Manager Plugin
+ * Filesystem-first media library, directory browser and asset picker for Admin Panel.
+ * @module plugins/file-manager
+ */
+
+const path = require('path');
+const { createFileManagerApiHandlers } = require('./api-handlers');
+const { generateFileManagerComponent } = require('./admin-component');
+const { createFileManagerServices } = require('../../src/services/builtins/file-manager');
+const core = require('./core');
+const security = require('./security');
+
+/**
+ * @param {Object} [options]
+ * @param {string} [options.baseDir='./public/uploads'] - Filesystem directory to manage
+ * @param {string} [options.publicBasePath='/uploads'] - URL prefix for stored files
+ * @param {string} [options.apiPrefix='/files'] - API subpath under Admin API
+ * @param {string} [options.pageTitle='Dosya Yöneticisi'] - Title of admin page
+ * @param {string} [options.menuLabel='Dosya Yöneticisi'] - Sidebar menu label
+ * @param {number} [options.menuOrder=50] - Sidebar menu ordering
+ * @param {number} [options.maxUploadBytes=10485760] - Max upload size in bytes (10MB default)
+ * @param {number|null} [options.maxTotalStorageBytes] - Storage quota limit in bytes (optional)
+ * @param {string[]|null} [options.allowedExtensions] - Whitelist of allowed extensions
+ * @param {string[]|null} [options.allowedMimeTypes] - Whitelist of allowed MIME types
+ * @param {Record<string, string[]>|null} [options.permissions] - RBAC permissions map
+ * @param {Object} [options.security] - Security configurations
+ * @param {boolean} [options.security.validateMagicBytes=true] - Validate file signatures
+ * @param {boolean} [options.security.sanitizeSvg=true] - Sanitize SVG XSS payloads
+ * @param {boolean} [options.includePage=true] - Whether to register admin menu item & page
+ */
+function fileManagerPlugin(options = {}) {
+  const {
+    baseDir = path.join(process.cwd(), 'public', 'uploads'),
+    publicBasePath = '/uploads',
+    apiPrefix = '/files',
+    pageTitle = 'Dosya Yöneticisi',
+    menuLabel = 'Dosya Yöneticisi',
+    menuOrder = 50,
+    maxUploadBytes = 10 * 1024 * 1024,
+    maxTotalStorageBytes = null,
+    allowedExtensions = null,
+    allowedMimeTypes = null,
+    permissions = null,
+    security: securityOpts = { validateMagicBytes: true, sanitizeSvg: true },
+    includePage = true,
+  } = options;
+
+  const resolvedBaseDir = path.resolve(baseDir);
+
+  const handlers = createFileManagerApiHandlers({
+    baseDir: resolvedBaseDir,
+    publicBasePath,
+    maxUploadBytes,
+    maxTotalStorageBytes,
+    allowedExtensions,
+    allowedMimeTypes,
+    permissions,
+    security: securityOpts,
+  });
+
+  return {
+    name: 'file-manager',
+    version: '1.0.0',
+    description: 'Filesystem-first media library, directory explorer & asset picker',
+    dependencies: { 'admin-panel': '*' },
+
+    api: {
+      ...core,
+      security,
+    },
+
+    register(ctx) {
+      // Register built-in services in app service registry if available
+      if (ctx.app && ctx.app.serviceRegistry) {
+        const services = createFileManagerServices({
+          baseDir: resolvedBaseDir,
+          publicBasePath,
+        });
+        for (const [name, def] of Object.entries(services)) {
+          if (!ctx.app.serviceRegistry.has(name)) {
+            ctx.app.serviceRegistry.register(name, def);
+          }
+        }
+      }
+    },
+
+    onRoutesReady(ctx) {
+      const adminApi = ctx.usePlugin('admin-panel');
+      if (!adminApi) {
+        console.warn('[file-manager] admin-panel plugin not found, skipping Admin UI registration');
+        return;
+      }
+
+      adminApi.registerModule({
+        id: 'files',
+        pages: includePage
+          ? [{
+              id: 'files',
+              title: pageTitle,
+              path: '/files',
+              icon: 'folder',
+              component: generateFileManagerComponent({
+                apiPrefix,
+                publicBasePath,
+              }),
+            }]
+          : [],
+
+        menu: includePage
+          ? [{
+              id: 'files',
+              label: menuLabel,
+              path: '/files',
+              icon: 'folder',
+              order: menuOrder,
+            }]
+          : [],
+
+        api: {
+          prefix: apiPrefix,
+          routes: [
+            { method: 'get', path: '', handler: handlers.list },
+            { method: 'post', path: '/mkdir', handler: handlers.mkdir },
+            { method: 'post', path: '/rename', handler: handlers.rename },
+            { method: 'post', path: '/move', handler: handlers.move },
+            { method: 'post', path: '/delete', handler: handlers.delete },
+            { method: 'post', path: '/upload', handler: handlers.upload },
+          ],
+        },
+      });
+    },
+  };
+}
+
+module.exports = fileManagerPlugin;
+module.exports.fileManagerPlugin = fileManagerPlugin;
+module.exports.core = core;
+module.exports.security = security;

package/plugins/file-manager/security.js

@@ -0,0 +1,217 @@
+/**
+ * File Manager Security Subsystem — Magic byte verification, dangerous extension blocking & SVG sanitization.
+ * Zero external dependencies, ultra-high performance O(1) buffer checks.
+ * @module plugins/file-manager/security
+ */
+
+const sanitizeHtml = require('sanitize-html');
+const { SecurityError, ValidationError } = require('../../core/errors');
+
+/**
+ * Universal list of dangerous/executable extensions (lowercase without dot)
+ */
+const DANGEROUS_EXTENSIONS = new Set([
+  // Scripts & Executables
+  'php', 'phtml', 'php3', 'php4', 'php5', 'php7', 'php8', 'phps', 'phar',
+  'exe', 'dll', 'so', 'dylib', 'bin', 'elf',
+  'sh', 'bash', 'zsh', 'csh', 'ksh', 'fish', 'bat', 'cmd', 'ps1', 'psm1',
+  'vbs', 'vbe', 'wsf', 'wsh', 'scr', 'cpl', 'msc', 'hta',
+  'jar', 'war', 'ear', 'class',
+  'jsp', 'jspx', 'jsw', 'jsv', 'jspf',
+  'asp', 'aspx', 'axd', 'asx', 'ashx', 'asmx',
+  'cgi', 'pl', 'pm', 'py', 'pyc', 'pyo', 'rb',
+  // System & Config files
+  'htaccess', 'htpasswd', 'ini', 'env', 'config', 'conf', 'passwd', 'shadow',
+]);
+
+/**
+ * Known magic numbers table for high-speed signature verification.
+ * Only validates when extension matches known binary format.
+ */
+const MAGIC_NUMBERS = {
+  // JPEG / JPG
+  jpg: (buf) => buf.length >= 3 && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff,
+  jpeg: (buf) => buf.length >= 3 && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff,
+
+  // PNG
+  png: (buf) =>
+    buf.length >= 8 &&
+    buf[0] === 0x89 &&
+    buf[1] === 0x50 &&
+    buf[2] === 0x4e &&
+    buf[3] === 0x47 &&
+    buf[4] === 0x0d &&
+    buf[5] === 0x0a &&
+    buf[6] === 0x1a &&
+    buf[7] === 0x0a,
+
+  // GIF
+  gif: (buf) =>
+    buf.length >= 6 &&
+    buf[0] === 0x47 &&
+    buf[1] === 0x49 &&
+    buf[2] === 0x46 &&
+    buf[3] === 0x38 &&
+    (buf[4] === 0x37 || buf[4] === 0x39) &&
+    buf[5] === 0x61,
+
+  // WebP: RIFF at 0..3 and WEBP at 8..11
+  webp: (buf) =>
+    buf.length >= 12 &&
+    buf[0] === 0x52 &&
+    buf[1] === 0x49 &&
+    buf[2] === 0x46 &&
+    buf[3] === 0x46 &&
+    buf[8] === 0x57 &&
+    buf[9] === 0x45 &&
+    buf[10] === 0x42 &&
+    buf[11] === 0x50,
+
+  // PDF: %PDF-
+  pdf: (buf) =>
+    buf.length >= 5 &&
+    buf[0] === 0x25 &&
+    buf[1] === 0x50 &&
+    buf[2] === 0x44 &&
+    buf[3] === 0x46 &&
+    buf[4] === 0x2d,
+
+  // ZIP (and DOCX/XLSX/PPTX)
+  zip: (buf) =>
+    buf.length >= 4 &&
+    buf[0] === 0x50 &&
+    buf[1] === 0x4b &&
+    (buf[2] === 0x03 || buf[2] === 0x05 || buf[2] === 0x07) &&
+    (buf[3] === 0x04 || buf[3] === 0x06 || buf[3] === 0x08),
+  docx: (buf) => MAGIC_NUMBERS.zip(buf),
+  xlsx: (buf) => MAGIC_NUMBERS.zip(buf),
+  pptx: (buf) => MAGIC_NUMBERS.zip(buf),
+
+  // MP3: ID3 or frame sync 0xFFE / 0xFFF
+  mp3: (buf) =>
+    (buf.length >= 3 && buf[0] === 0x49 && buf[1] === 0x44 && buf[2] === 0x33) ||
+    (buf.length >= 2 && buf[0] === 0xff && (buf[1] & 0xe0) === 0xe0),
+
+  // MP4: ....ftyp at bytes 4..7
+  mp4: (buf) =>
+    buf.length >= 8 &&
+    buf[4] === 0x66 &&
+    buf[5] === 0x74 &&
+    buf[6] === 0x79 &&
+    buf[7] === 0x70,
+};
+
+/**
+ * Validate that a filename contains no dangerous extensions or double-extension tricks.
+ * @param {string} filename
+ * @returns {string} Clean lowercase extension
+ */
+function validateSafeExtension(filename) {
+  if (!filename || typeof filename !== 'string') {
+    throw new ValidationError('Filename is required');
+  }
+
+  const cleanName = filename.toLowerCase().trim();
+  const parts = cleanName.split('.').filter(Boolean);
+
+  if (parts.length === 0) {
+    throw new ValidationError('Filename must have a valid extension');
+  }
+
+  // Check all dotted segments against dangerous extensions to block double extensions (e.g. payload.php.jpg)
+  for (let i = 1; i < parts.length; i++) {
+    const segment = parts[i];
+    if (DANGEROUS_EXTENSIONS.has(segment)) {
+      throw new SecurityError(
+        `Dangerous extension or double-extension detected: .${segment}`,
+        400
+      );
+    }
+  }
+
+  const finalExt = parts[parts.length - 1];
+  if (DANGEROUS_EXTENSIONS.has(finalExt)) {
+    throw new SecurityError(`File type .${finalExt} is forbidden for upload`, 403);
+  }
+
+  return finalExt;
+}
+
+/**
+ * Verify that the buffer's magic bytes match the claimed extension.
+ * O(1) time complexity, minimal memory overhead.
+ * @param {Buffer} buffer
+ * @param {string} ext
+ * @returns {boolean}
+ */
+function validateMagicBytes(buffer, ext) {
+  if (!buffer || !Buffer.isBuffer(buffer)) {
+    throw new ValidationError('Valid buffer is required for magic byte check');
+  }
+
+  const cleanExt = (ext || '').replace(/^\./, '').toLowerCase();
+  const validator = MAGIC_NUMBERS[cleanExt];
+
+  if (validator) {
+    const isValid = validator(buffer);
+    if (!isValid) {
+      throw new SecurityError(
+        `File signature mismatch: file content does not match expected .${cleanExt} format`,
+        400
+      );
+    }
+  }
+
+  return true;
+}
+
+const SVG_SANITIZE_OPTIONS = {
+  allowedTags: [
+    'svg', 'g', 'path', 'circle', 'rect', 'line', 'polyline', 'polygon',
+    'ellipse', 'text', 'tspan', 'defs', 'clipPath', 'mask', 'pattern',
+    'image', 'linearGradient', 'radialGradient', 'stop', 'use', 'symbol',
+    'title', 'desc', 'a',
+  ],
+  allowedAttributes: {
+    '*': [
+      'id', 'class', 'style', 'xml:space', 'xmlns', 'xmlns:xlink', 'xmlns:svg',
+      'version', 'viewbox', 'viewBox', 'width', 'height', 'x', 'y', 'dx', 'dy',
+      'x1', 'y1', 'x2', 'y2', 'cx', 'cy', 'r', 'rx', 'ry', 'd', 'points',
+      'fill', 'stroke', 'stroke-width', 'stroke-linecap', 'stroke-linejoin',
+      'stroke-miterlimit', 'stroke-dasharray', 'stroke-dashoffset', 'opacity',
+      'fill-opacity', 'stroke-opacity', 'fill-rule', 'clip-rule',
+      'transform', 'font-family', 'font-size', 'font-weight', 'text-anchor',
+      'clip-path', 'mask', 'gradientUnits', 'gradientTransform', 'offset',
+      'stop-color', 'stop-opacity', 'href', 'xlink:href', 'preserveAspectRatio',
+    ],
+  },
+  allowedSchemes: ['http', 'https'],
+  allowedSchemesByTag: {
+    a: ['http', 'https', 'mailto'],
+    image: ['http', 'https', 'data'],
+    use: ['#'],
+  },
+  allowProtocolRelative: false,
+  selfClosing: ['rect', 'circle', 'line', 'polyline', 'polygon', 'path', 'stop', 'use', 'image', 'ellipse'],
+  disallowedTagsMode: 'discard',
+};
+
+/**
+ * Sanitize SVG content against Stored XSS attacks.
+ * Strips <script>, <foreignObject>, <iframe>, <embed>, <object> and on* event handlers.
+ * @param {Buffer|string} content
+ * @returns {Buffer} Sanitized SVG buffer
+ */
+function sanitizeSvgContent(content) {
+  const str = Buffer.isBuffer(content) ? content.toString('utf8') : String(content);
+  const sanitized = sanitizeHtml(str, SVG_SANITIZE_OPTIONS);
+  return Buffer.from(sanitized, 'utf8');
+}
+
+module.exports = {
+  DANGEROUS_EXTENSIONS,
+  MAGIC_NUMBERS,
+  validateSafeExtension,
+  validateMagicBytes,
+  sanitizeSvgContent,
+};

package/plugins/index.js

@@ -3,86 +3,52 @@
  * Export all built-in plugins
  */
 
-const sitemapPlugin = require('./sitemap');
-const analyticsPlugin = require('./analytics');
-const dashboardPlugin = require('./dashboard/index');
-const schemaExplorerPlugin = require('./schema-explorer');
-const adminPanelPlugin = require('./admin-panel');
-const seoCheckerPlugin = require('./seo-checker');
-const siteAnalyticsPlugin = require('./site-analytics');
-const auditLogPlugin = require('./audit-log');
-const recaptchaPlugin = require('./recaptcha');
-const swaggerPlugin = require('./swagger');
-const healthCheckPlugin = require('./health-check');
-const restResourcePlugin = require('./rest-resources');
-const ormCacheAdminPlugin = require('./orm-cache-admin');
-const { uploadPlugin, createLocalFileProvider } = require('./upload');
-/** Register after adminPanelPlugin (same db + adminPath) for session and routes. */
-const { dataExchangePlugin } = require('./data-exchange');
-const { redirectPlugin } = require('./redirect');
-const { rateLimitPlugin } = require('./rate-limit');
-const emailPlugin = require('./email');
-const contentPlugin = require('./content');
-const csrfPlugin = require('./csrf');
-const corsPlugin = require('./cors');
-const { basicAuthPlugin, createBasicAuthMiddleware } = require('./basic-auth');
-const {
-  realtimePlugin,
-  realtime,
-  createRealtime,
-  websocket,
-  createWebSocketAdapter,
-  sse,
-  createSseAdapter,
-  socketIo,
-  createSocketIoAdapter,
-  redis,
-  createRedisAdapter,
-} = require('./realtime');
-const { mcpPlugin, createMcpServer, McpServer } = require('./mcp');
-const polarPlugin = require('./polar');
-
 module.exports = {
-  sitemapPlugin,
-  analyticsPlugin,
-  dashboardPlugin,
-  schemaExplorerPlugin,
-  adminPanelPlugin,
-  seoCheckerPlugin,
-  siteAnalyticsPlugin,
-  auditLogPlugin,
-  recaptchaPlugin,
-  swaggerPlugin,
-  healthCheckPlugin,
-  restResourcePlugin,
-  ormCacheAdminPlugin,
-  uploadPlugin,
-  createLocalFileProvider,
-  dataExchangePlugin,
-  redirectPlugin,
-  rateLimitPlugin,
-  emailPlugin,
-  contentPlugin,
-  csrfPlugin,
-  corsPlugin,
-  basicAuthPlugin,
-  createBasicAuthMiddleware,
-  realtimePlugin,
-  realtime,
-  createRealtime,
-  websocket,
-  createWebSocketAdapter,
-  sse,
-  createSseAdapter,
-  socketIo,
-  createSocketIoAdapter,
-  redis,
-  createRedisAdapter,
-  queuePlugin: require('./queue'),
-  mcpPlugin,
-  createMcpServer,
-  McpServer,
-  polarPlugin,
+  get sitemapPlugin() { return require('./sitemap'); },
+  get analyticsPlugin() { return require('./analytics'); },
+  get dashboardPlugin() { return require('./dashboard/index'); },
+  get schemaExplorerPlugin() { return require('./schema-explorer'); },
+  get adminPanelPlugin() { return require('./admin-panel'); },
+  get seoCheckerPlugin() { return require('./seo-checker'); },
+  get siteAnalyticsPlugin() { return require('./site-analytics'); },
+  get auditLogPlugin() { return require('./audit-log'); },
+  get recaptchaPlugin() { return require('./recaptcha'); },
+  get swaggerPlugin() { return require('./swagger'); },
+  get healthCheckPlugin() { return require('./health-check'); },
+  get restResourcePlugin() { return require('./rest-resources'); },
+  get ormCacheAdminPlugin() { return require('./orm-cache-admin'); },
+  get uploadPlugin() { return require('./upload').uploadPlugin; },
+  get createLocalFileProvider() { return require('./upload').createLocalFileProvider; },
+  get dataExchangePlugin() { return require('./data-exchange').dataExchangePlugin; },
+  get redirectPlugin() { return require('./redirect').redirectPlugin; },
+  get rateLimitPlugin() { return require('./rate-limit').rateLimitPlugin; },
+  get emailPlugin() { return require('./email'); },
+  get contentPlugin() { return require('./content'); },
+  get csrfPlugin() { return require('./csrf'); },
+  get corsPlugin() { return require('./cors'); },
+  get basicAuthPlugin() { return require('./basic-auth').basicAuthPlugin; },
+  get createBasicAuthMiddleware() { return require('./basic-auth').createBasicAuthMiddleware; },
+  get realtimePlugin() { return require('./realtime').realtimePlugin; },
+  get realtime() { return require('./realtime').realtime; },
+  get createRealtime() { return require('./realtime').createRealtime; },
+  get websocket() { return require('./realtime').websocket; },
+  get createWebSocketAdapter() { return require('./realtime').createWebSocketAdapter; },
+  get sse() { return require('./realtime').sse; },
+  get createSseAdapter() { return require('./realtime').createSseAdapter; },
+  get socketIo() { return require('./realtime').socketIo; },
+  get createSocketIoAdapter() { return require('./realtime').createSocketIoAdapter; },
+  get redis() { return require('./realtime').redis; },
+  get createRedisAdapter() { return require('./realtime').createRedisAdapter; },
+  get queuePlugin() { return require('./queue'); },
+  get mcpPlugin() { return require('./mcp').mcpPlugin; },
+  get createMcpServer() { return require('./mcp').createMcpServer; },
+  get McpServer() { return require('./mcp').McpServer; },
+  get polarPlugin() { return require('./polar'); },
+  get fileManagerPlugin() { return require('./file-manager'); },
+  get xlsxPlugin() { return require('./xlsx').xlsxPlugin; },
+  get xlsx() { return require('./xlsx').xlsx; },
+  get csvPlugin() { return require('./csv').csvPlugin; },
+  get csv() { return require('./csv').csv; },
 };
 
 

package/plugins/mcp/transports/sse.js

@@ -18,8 +18,10 @@ const { createJsonRpcError, ERROR_CODES } = require('../server');
  */
 function mountSseTransport(options) {
   const { app, server, path: basePath = '/_mcp', authMiddleware } = options;
-
-  const normalizedBase = basePath.replace(/\/+$/, '');
+  let normalizedBase = String(basePath || '/_mcp');
+  while (normalizedBase.length > 1 && normalizedBase.endsWith('/')) {
+    normalizedBase = normalizedBase.slice(0, -1);
+  }
   const sessions = new Map();
 
   const middlewareChain = authMiddleware ? [authMiddleware] : [];

package/plugins/site-analytics/admin-component.js

@@ -203,12 +203,12 @@ var AnalyticsPage = {
     vnode.state.chartLoaded = false;
     vnode.state._stopPoll = null;
     vnode.state.chartDataVersion = 0;
-    this.loadData(vnode);
-    this.loadChartJs(vnode);
+    AnalyticsPage.loadData(vnode);
+    AnalyticsPage.loadChartJs(vnode);
     if (typeof runAdminAutoRefresh === 'function') {
       vnode.state._stopPoll = runAdminAutoRefresh(function() {
-        this.loadData(vnode);
-      }.bind(this));
+        AnalyticsPage.loadData(vnode);
+      });
     }
   },
 
@@ -270,12 +270,11 @@ var AnalyticsPage = {
   setDays: function(vnode, d) {
     vnode.state.days = d;
     if (chartInstance) { chartInstance.destroy(); chartInstance = null; }
-    this.loadData(vnode);
+    AnalyticsPage.loadData(vnode);
   },
 
   view: function(vnode) {
     var s = vnode.state;
-    var self = this;
 
     return m(Layout, [
       m(Breadcrumb, { items: [{ label: 'Analytics', href: '/analytics' }] }),
@@ -294,7 +293,7 @@ var AnalyticsPage = {
             ? m(RefreshIconButton, {
                 title: 'Refresh analytics',
                 spinning: s.loading,
-                onclick: function() { self.loadData(vnode); },
+                onclick: function() { AnalyticsPage.loadData(vnode); },
               })
             : null,
           // Day filter
@@ -303,7 +302,7 @@ var AnalyticsPage = {
               class: s.days === d
                 ? 'bg-white text-gray-900 shadow-sm dark:bg-slate-700 dark:text-slate-100'
                 : 'text-gray-500 hover:text-gray-700 dark:text-slate-400 dark:hover:text-slate-200',
-              onclick: function() { self.setDays(vnode, d); },
+              onclick: function() { AnalyticsPage.setDays(vnode, d); },
             }, 'Last ' + d + ' days');
           })),
         ]),