webspresso 0.0.96 → 0.0.98

package/plugins/admin-panel/client/parts/10-export-registry.js

@@ -8,4 +8,27 @@ window.__ADMIN_COMPONENTS__ = {
   RecordForm,
   api,
   state,
+  notify: typeof window !== 'undefined' ? window.notify : undefined,
+  confirmModal: typeof window !== 'undefined' ? window.confirmModal : undefined,
+  toastState: typeof window !== 'undefined' ? window.toastState : undefined,
+  confirmState: typeof window !== 'undefined' ? window.confirmState : undefined,
+  AdminUI: typeof window !== 'undefined' ? window.AdminUI : undefined,
+  Admin: typeof window !== 'undefined' ? window.Admin : undefined,
+  ToastContainer: typeof window !== 'undefined' ? window.ToastContainer : undefined,
+  ConfirmModalContainer: typeof window !== 'undefined' ? window.ConfirmModalContainer : undefined,
 };
+
+if (typeof window !== 'undefined') {
+  window.Admin = window.Admin || {};
+  window.Admin.api = api;
+  window.Admin.state = state;
+  if (typeof window.AdminUI !== 'undefined') {
+    window.Admin.ui = window.AdminUI;
+  }
+  if (typeof window.notify !== 'undefined') {
+    window.Admin.toast = window.notify;
+  }
+  if (typeof window.confirmModal !== 'undefined') {
+    window.Admin.confirm = window.confirmModal;
+  }
+}

package/plugins/admin-panel/core/admin-module.js

@@ -193,19 +193,22 @@ function registerModule(config, deps) {
     menuList = menuList.concat(dirMenuItems);
   }
 
+  const moduleTitle = config.title;
+
   for (const p of pagesList) {
     if (p.menu && !menuList.some(m => m.id === p.id)) {
+      const pageLabel = p.title || moduleTitle || p.id;
       if (p.menu === true) {
         menuList.push({
           id: p.id,
-          label: p.title,
+          label: pageLabel,
           path: p.path,
           icon: p.icon,
         });
       } else if (typeof p.menu === 'object') {
         menuList.push({
           id: p.id,
-          label: p.title,
+          label: pageLabel,
           path: p.path,
           icon: p.icon,
           ...p.menu,
@@ -215,7 +218,7 @@ function registerModule(config, deps) {
   }
 
   if (pagesList.length > 0) {
-    registerPages(config.id, pagesList, { registry, adminPath, ctx, optionalAuth, serveAdminPanel });
+    registerPages(config.id, pagesList, { registry, adminPath, ctx, optionalAuth, serveAdminPanel }, moduleTitle);
   }
 
   if (menuList.length > 0) {
@@ -246,7 +249,7 @@ function registerPageDir(dirPath, deps) {
   }
 }
 
-function registerPages(moduleId, pages, deps) {
+function registerPages(moduleId, pages, deps, moduleTitle) {
   if (!Array.isArray(pages)) {
     throw new Error(`Module "${moduleId}": pages must be an array`);
   }
@@ -257,8 +260,9 @@ function registerPages(moduleId, pages, deps) {
     const pageId = page.id || moduleId;
 
     let htmlContent = page.html || null;
+    let resolvedHtmlPath = null;
     if (page.htmlFile) {
-      const resolvedHtmlPath = path.resolve(page.htmlFile);
+      resolvedHtmlPath = path.resolve(page.htmlFile);
       if (!fs.existsSync(resolvedHtmlPath)) {
         throw new Error(`Module "${moduleId}", page "${pageId}": htmlFile not found at ${page.htmlFile}`);
       }
@@ -266,7 +270,8 @@ function registerPages(moduleId, pages, deps) {
     }
 
     registry.registerPage(pageId, {
-      title: page.title,
+      title: page.title || moduleTitle,
+      documentTitle: page.documentTitle,
       path: page.path,
       icon: page.icon,
       description: page.description,
@@ -275,6 +280,7 @@ function registerPages(moduleId, pages, deps) {
       iframe: page.iframe,
       url: page.url || page.iframeUrl || undefined,
       html: htmlContent || undefined,
+      htmlFile: resolvedHtmlPath || (page.htmlFile ? path.resolve(page.htmlFile) : undefined),
     });
 
     if (page.componentFile) {
@@ -284,7 +290,7 @@ function registerPages(moduleId, pages, deps) {
       }
       const rawCode = fs.readFileSync(resolvedPath, 'utf8');
       const formattedCode = formatClientComponent(pageId, rawCode);
-      registry.registerClientComponent(pageId, formattedCode);
+      registry.registerClientComponent(pageId, formattedCode, resolvedPath);
     } else if (page.component) {
       const formattedCode = formatClientComponent(pageId, page.component);
       registry.registerClientComponent(pageId, formattedCode);

package/plugins/admin-panel/core/api-extensions.js

@@ -24,6 +24,10 @@ let npmVersionCache = {
 };
 
 function fetchLatestNpmVersion(force = false) {
+  if ((process.env.NODE_ENV === 'test' || process.env.VITEST) && !force) {
+    return Promise.resolve(npmVersionCache.latestVersion || getWebspressoVersion());
+  }
+
   const now = Date.now();
   if (!force && npmVersionCache.latestVersion && (now - npmVersionCache.checkedAt < 30 * 60 * 1000)) {
     return Promise.resolve(npmVersionCache.latestVersion);
@@ -336,12 +340,24 @@ function createExtensionApiHandlers(options) {
       }
 
       // Execute action
-      const result = await action.handler(record, modelName, {
+      const context = {
         db,
         req,
         user: req.session?.adminUser,
         body: req.body,
+        model: modelName,
+        modelName,
+        name: modelName,
+      };
+      const modelArg = Object.assign(new String(modelName), context, {
+        name: modelName,
+        modelName,
+        model: modelName,
+        valueOf: () => modelName,
+        toString: () => modelName,
+        [Symbol.toPrimitive]: () => modelName,
       });
+      const result = await action.handler(record, modelArg, context);
 
       res.json({ success: true, result });
     } catch (error) {
@@ -414,12 +430,24 @@ function createExtensionApiHandlers(options) {
       }
 
       // Execute action
-      const result = await action.handler(records, modelName, {
+      const context = {
         db,
         req,
         user: req.session?.adminUser,
         body: req.body,
+        model: modelName,
+        modelName,
+        name: modelName,
+      };
+      const modelArg = Object.assign(new String(modelName), context, {
+        name: modelName,
+        modelName,
+        model: modelName,
+        valueOf: () => modelName,
+        toString: () => modelName,
+        [Symbol.toPrimitive]: () => modelName,
       });
+      const result = await action.handler(records, modelArg, context);
 
       res.json({ success: true, result, affected: records.length });
     } catch (error) {
@@ -671,6 +699,10 @@ function createExtensionApiHandlers(options) {
         }
       }
 
+      if (registry && typeof registry.runHooks === 'function') {
+        await registry.runHooks('onDashboardLoad', { stats, req, user: req.session?.adminUser, db });
+      }
+
       res.json({ stats });
     } catch (error) {
       res.status(500).json({ error: error.message });

package/plugins/admin-panel/core/registry.js

@@ -4,6 +4,8 @@
  * @module plugins/admin-panel/core/registry
  */
 
+const fs = require('fs');
+
 /**
  * Extension types
  */
@@ -46,6 +48,7 @@ class AdminRegistry {
 
     // Client components: JS code strings for custom page rendering
     this.clientComponents = new Map();
+    this.clientComponentFiles = new Map();
 
     // Custom scripts & styles for Admin Panel SSR rendering
     this.scripts = [];
@@ -59,6 +62,8 @@ class AdminRegistry {
       afterUpdate: [],
       beforeDelete: [],
       afterDelete: [],
+      beforeRestore: [],
+      afterRestore: [],
       onRecordView: [],
       onDashboardLoad: [],
     };
@@ -66,6 +71,7 @@ class AdminRegistry {
     // Settings
     this.settings = {
       title: 'Admin Panel',
+      titleTemplate: '%s | %b',
       logo: null,
       primaryColor: '#3B82F6',
       perPage: 20,
@@ -335,17 +341,41 @@ class AdminRegistry {
    * @param {string} pageId - Page ID (must match a registered page)
    * @param {string} jsCode - JavaScript code string that defines the component.
    *   The code should assign a Mithril component to window.__customPages[pageId].
+   * @param {string} [filePath=null] - Absolute file path for dev mode live reloading
    */
-  registerClientComponent(pageId, jsCode) {
+  registerClientComponent(pageId, jsCode, filePath = null) {
     this.clientComponents.set(pageId, jsCode);
+    if (filePath) {
+      this.clientComponentFiles.set(pageId, filePath);
+    }
     return this;
   }
 
   /**
-   * Get all client component code strings concatenated
+   * Get all client component code strings concatenated.
+   * In development mode (NODE_ENV !== 'production'), dynamically re-reads modified
+   * component files from disk to eliminate manual server restarts.
    */
   getClientComponents() {
-    return Array.from(this.clientComponents.values()).join('\n');
+    const isDev = process.env.NODE_ENV !== 'production';
+    const parts = [];
+    for (const [pageId, code] of this.clientComponents.entries()) {
+      const filePath = this.clientComponentFiles.get(pageId);
+      if (isDev && filePath) {
+        try {
+          if (fs.existsSync(filePath)) {
+            const raw = fs.readFileSync(filePath, 'utf8');
+            const { formatClientComponent } = require('./admin-module');
+            parts.push(formatClientComponent(pageId, raw));
+            continue;
+          }
+        } catch (e) {
+          console.error(`[Admin Panel] Failed to reload component for "${pageId}":`, e);
+        }
+      }
+      parts.push(code || '');
+    }
+    return parts.filter(Boolean).join('\n');
   }
 
   /**
@@ -382,6 +412,44 @@ class AdminRegistry {
     return this;
   }
 
+  /**
+   * Set base admin panel title
+   * @param {string} title - Base title (e.g., 'Acme Admin')
+   */
+  setTitle(title) {
+    if (typeof title === 'string') {
+      this.settings.title = title;
+    }
+    return this;
+  }
+
+  /**
+   * Get base admin panel title
+   * @returns {string}
+   */
+  getTitle() {
+    return this.settings.title;
+  }
+
+  /**
+   * Set admin page title template
+   * @param {string} template - Title template (e.g., '%s | %b', '%s — %b', '%s')
+   */
+  setTitleTemplate(template) {
+    if (typeof template === 'string') {
+      this.settings.titleTemplate = template;
+    }
+    return this;
+  }
+
+  /**
+   * Get admin page title template
+   * @returns {string}
+   */
+  getTitleTemplate() {
+    return this.settings.titleTemplate;
+  }
+
   /**
    * Enable user management
    * @param {Object} config - User management configuration
@@ -471,19 +539,30 @@ class AdminRegistry {
   toClientConfig() {
     return {
       settings: this.settings,
-      pages: this.getPages().map(p => ({
-        id: p.id,
-        title: p.title,
-        path: p.path,
-        icon: p.icon,
-        description: p.description,
-        permission: p.permission,
-        layout: p.layout !== undefined ? p.layout : true,
-        iframe: p.iframe,
-        url: p.url || p.iframeUrl,
-        html: p.html,
-        hasClientComponent: this.clientComponents.has(p.id),
-      })),
+      pages: this.getPages().map(p => {
+        let html = p.html;
+        if (p.htmlFile && process.env.NODE_ENV !== 'production') {
+          try {
+            if (fs.existsSync(p.htmlFile)) {
+              html = fs.readFileSync(p.htmlFile, 'utf8');
+            }
+          } catch (e) {}
+        }
+        return {
+          id: p.id,
+          title: p.title,
+          documentTitle: p.documentTitle,
+          path: p.path,
+          icon: p.icon,
+          description: p.description,
+          permission: p.permission,
+          layout: p.layout !== undefined ? p.layout : true,
+          iframe: p.iframe,
+          url: p.url || p.iframeUrl,
+          html,
+          hasClientComponent: this.clientComponents.has(p.id),
+        };
+      }),
 
       widgets: this.getWidgets().map(w => ({
         id: w.id,
@@ -527,6 +606,7 @@ class AdminRegistry {
     this.menuGroups.clear();
     this.fieldRenderers.clear();
     this.clientComponents.clear();
+    this.clientComponentFiles.clear();
     this.scripts = [];
     this.styles = [];
     Object.keys(this.hooks).forEach(k => this.hooks[k] = []);

package/plugins/admin-panel/index.js

@@ -43,6 +43,8 @@ function adminPanelPlugin(options = {}) {
   const {
     path: adminPath = '/_admin',
     enabled = true,
+    title,
+    titleTemplate,
     sessionSecret,
     db,
     auth,
@@ -52,6 +54,7 @@ function adminPanelPlugin(options = {}) {
     uploadUrl: uploadUrlOption,
     richTextSanitize = true,
     dataExchange: dataExchangeOption = true,
+    loginRateLimit,
   } = options;
 
   const adminUsersConfig = typeof adminUsersOption === 'object' ? adminUsersOption : { enabled: adminUsersOption !== false };
@@ -63,6 +66,12 @@ function adminPanelPlugin(options = {}) {
 
   // Create fresh registry for this plugin instance
   const registry = new AdminRegistry();
+  if (title) {
+    registry.setTitle(title);
+  }
+  if (titleTemplate) {
+    registry.setTitleTemplate(titleTemplate);
+  }
 
   // Dependencies are now in main package
   const session = require('express-session');
@@ -144,8 +153,40 @@ function adminPanelPlugin(options = {}) {
       registerStyle(style) {
         return registry.registerStyle(style);
       },
+      registerHook(hookName, callback) {
+        return registry.registerHook(hookName, callback);
+      },
+      runHooks(hookName, context) {
+        return registry.runHooks(hookName, context);
+      },
+      registerAction(id, config) {
+        return registry.registerAction(id, config);
+      },
+      registerBulkAction(id, config) {
+        return registry.registerBulkAction(id, config);
+      },
+      setTitle(title) {
+        registry.setTitle(title);
+        return this;
+      },
+      getTitle() {
+        return registry.getTitle();
+      },
+      setTitleTemplate(template) {
+        registry.setTitleTemplate(template);
+        return this;
+      },
+      getTitleTemplate() {
+        return registry.getTitleTemplate();
+      },
+      resetLoginAttempts(ip) {
+        if (this._apiHandlers && typeof this._apiHandlers.resetLoginAttempts === 'function') {
+          return this._apiHandlers.resetLoginAttempts(ip);
+        }
+      },
 
       _ctx: null,
+      _apiHandlers: null,
     },
 
     /**
@@ -275,15 +316,68 @@ function adminPanelPlugin(options = {}) {
         });
       }
 
+      // Auto-register model-level declared actions and bulkActions
+      const { getAllModels: getFrameworkModels } = require('../../core/orm/model');
+      const modelMap = new Map();
+      if (getFrameworkModels) {
+        for (const [name, model] of getFrameworkModels()) {
+          modelMap.set(name, model);
+        }
+      }
+      if (db.getAllModels) {
+        const dbModels = db.getAllModels();
+        const list = Array.isArray(dbModels) ? dbModels : Array.from(dbModels.values());
+        for (const model of list) {
+          modelMap.set(model.name, model);
+        }
+      }
+      const appModelList = Array.from(modelMap.values());
+      for (const model of appModelList) {
+        if (model.admin?.actions && Array.isArray(model.admin.actions)) {
+          for (const act of model.admin.actions) {
+            if (act.id && act.label && act.handler && !registry.actions.has(act.id)) {
+              registry.registerAction(act.id, {
+                models: [model.name],
+                ...act,
+              });
+            }
+          }
+        }
+        if (model.admin?.bulkActions && Array.isArray(model.admin.bulkActions)) {
+          for (const bAct of model.admin.bulkActions) {
+            if (bAct.id && bAct.label && bAct.handler && !registry.bulkActions.has(bAct.id)) {
+              registry.registerBulkAction(bAct.id, {
+                models: [model.name],
+                ...bAct,
+              });
+            }
+          }
+        }
+        if (model.admin?.hooks && typeof model.admin.hooks === 'object') {
+          for (const [hookName, fn] of Object.entries(model.admin.hooks)) {
+            if (typeof fn === 'function') {
+              registry.registerHook(hookName, async (ctx) => {
+                if (!ctx.model || ctx.model === model.name) {
+                  await fn(ctx);
+                }
+              });
+            }
+          }
+        }
+      }
+
       // Create API handlers
       const apiHandlers = createApiHandlers({
         path: adminPath,
         db,
+        registry,
         AdminUser,
         hashPassword: (password, rounds) => bcrypt.hash(password, process.env.NODE_ENV === 'test' ? 4 : (rounds || 10)),
         comparePassword: (password, hash) => bcrypt.compare(password, hash),
         richTextSanitize,
+        loginRateLimit,
       });
+      this.api._apiHandlers = apiHandlers;
 
       const extensionHandlers = createExtensionApiHandlers({
         registry,
@@ -330,7 +424,9 @@ function adminPanelPlugin(options = {}) {
       ctx.addRoute('get', `${adminPath}/api/extensions/widgets/:widgetId/data`, requireAuth, extensionHandlers.widgetDataHandler);
       ctx.addRoute('get', `${adminPath}/api/extensions/dashboard/stats`, requireAuth, extensionHandlers.dashboardStatsHandler);
       ctx.addRoute('post', `${adminPath}/api/extensions/actions/:actionId/:model/:id`, requireAuth, extensionHandlers.actionHandler);
+      ctx.addRoute('post', `${adminPath}/api/actions/:actionId/:model/:id`, requireAuth, extensionHandlers.actionHandler);
       ctx.addRoute('post', `${adminPath}/api/extensions/bulk-actions/:actionId/:model`, requireAuth, extensionHandlers.bulkActionHandler);
+      ctx.addRoute('post', `${adminPath}/api/bulk-actions/:actionId/:model`, requireAuth, extensionHandlers.bulkActionHandler);
       ctx.addRoute('get', `${adminPath}/api/extensions/bulk-fields/:model`, requireAuth, extensionHandlers.bulkFieldsHandler);
       ctx.addRoute('post', `${adminPath}/api/extensions/bulk-update/:model`, requireAuth, extensionHandlers.bulkUpdateFieldHandler);
       ctx.addRoute('get', `${adminPath}/api/extensions/export/:model`, requireAuth, extensionHandlers.exportHandler);

package/plugins/admin-panel/lib/login-rate-limiter.js

@@ -0,0 +1,119 @@
+'use strict';
+
+/**
+ * In-memory brute-force rate limiter for admin login.
+ * Zero external dependencies.
+ */
+class LoginRateLimiter {
+  constructor(options = {}) {
+    if (options === false) {
+      this.enabled = false;
+      this.maxAttempts = 5;
+      this.windowMs = 15 * 60 * 1000;
+    } else {
+      const opts = typeof options === 'object' && options !== null ? options : {};
+      this.enabled = opts.enabled !== false;
+      this.maxAttempts = typeof opts.maxAttempts === 'number' && opts.maxAttempts > 0 ? opts.maxAttempts : 5;
+      this.windowMs = typeof opts.windowMs === 'number' && opts.windowMs > 0 ? opts.windowMs : (15 * 60 * 1000);
+    }
+    this.attempts = new Map();
+  }
+
+  getClientIp(req) {
+    if (!req) return '127.0.0.1';
+    if (req.ip) return String(req.ip);
+    if (req.headers && req.headers['x-forwarded-for']) {
+      const forwarded = String(req.headers['x-forwarded-for']).split(',')[0].trim();
+      if (forwarded) return forwarded;
+    }
+    if (req.connection && req.connection.remoteAddress) {
+      return String(req.connection.remoteAddress);
+    }
+    if (req.socket && req.socket.remoteAddress) {
+      return String(req.socket.remoteAddress);
+    }
+    return '127.0.0.1';
+  }
+
+  isBlocked(req) {
+    if (!this.enabled) return { blocked: false, remaining: Infinity, count: 0 };
+    const ip = this.getClientIp(req);
+    const now = Date.now();
+    const entry = this.attempts.get(ip);
+    if (!entry) return { blocked: false, remaining: this.maxAttempts, count: 0 };
+
+    if (now >= entry.resetAt) {
+      this.attempts.delete(ip);
+      return { blocked: false, remaining: this.maxAttempts, count: 0 };
+    }
+
+    if (entry.count >= this.maxAttempts) {
+      const remainingMs = Math.max(0, entry.resetAt - now);
+      const waitMinutes = Math.max(1, Math.ceil(remainingMs / 60000));
+      const retryAfter = Math.max(1, Math.ceil(remainingMs / 1000));
+      return {
+        blocked: true,
+        remaining: 0,
+        count: entry.count,
+        waitMinutes,
+        retryAfter,
+        message: `Too many failed login attempts. Please try again in ${waitMinutes} ${waitMinutes === 1 ? 'minute' : 'minutes'}.`,
+      };
+    }
+
+    return {
+      blocked: false,
+      remaining: Math.max(0, this.maxAttempts - entry.count),
+      count: entry.count,
+    };
+  }
+
+  recordFailure(req) {
+    if (!this.enabled) return { blocked: false, remaining: Infinity, count: 0 };
+    const ip = this.getClientIp(req);
+    const now = Date.now();
+    const entry = this.attempts.get(ip);
+
+    if (!entry || now >= entry.resetAt) {
+      this.attempts.set(ip, {
+        count: 1,
+        resetAt: now + this.windowMs,
+      });
+    } else {
+      entry.count += 1;
+    }
+
+    if (this.attempts.size > 500) {
+      this.cleanup();
+    }
+
+    return this.isBlocked(req);
+  }
+
+  recordSuccess(req) {
+    if (!this.enabled) return;
+    const ip = this.getClientIp(req);
+    this.attempts.delete(ip);
+  }
+
+  reset(ip) {
+    if (ip) {
+      this.attempts.delete(ip);
+    } else {
+      this.attempts.clear();
+    }
+  }
+
+  cleanup() {
+    const now = Date.now();
+    for (const [ip, entry] of this.attempts.entries()) {
+      if (now >= entry.resetAt) {
+        this.attempts.delete(ip);
+      }
+    }
+  }
+}
+
+module.exports = {
+  LoginRateLimiter,
+};

package/plugins/admin-panel/modules/admin-users.js

@@ -497,7 +497,16 @@ const AdminUsersPage = {
     };
 
     vnode.state.deleteAdmin = async function(admin) {
-      if (!confirm('Are you sure you want to delete administrator "' + (admin.name || admin.email) + '"? This action cannot be undone.')) {
+      var confirmed = typeof confirmAction === 'function'
+        ? await confirmAction({
+            title: 'Delete Administrator',
+            message: 'Are you sure you want to delete administrator "' + (admin.name || admin.email) + '"? This action cannot be undone.',
+            danger: true,
+            confirmText: 'Delete'
+          })
+        : confirm('Are you sure you want to delete administrator "' + (admin.name || admin.email) + '"? This action cannot be undone.');
+
+      if (!confirmed) {
         return;
       }
       vnode.state.loading = true;
@@ -506,9 +515,15 @@ const AdminUsersPage = {
       try {
         await api.delete('/admins/' + encodeURIComponent(admin.id));
         vnode.state.success = 'Administrator deleted successfully';
+        if (typeof notifySuccess === 'function') {
+          notifySuccess('Administrator deleted successfully');
+        }
         await vnode.state.loadAdmins();
       } catch (err) {
         vnode.state.error = err.message || 'Failed to delete administrator';
+        if (typeof notifyError === 'function') {
+          notifyError(vnode.state.error);
+        }
         vnode.state.loading = false;
         m.redraw();
       }