webspresso 0.0.96 → 0.0.98

package/plugins/audit-log/index.js

@@ -16,33 +16,141 @@ const { purgeAuditLogs } = require('./purge');
  * @param {string} [options.tableName='audit_logs']
  * @param {boolean} [options.includeDefaultPage=true] - Register Mithril list page + menu
  * @param {string} [options.apiPrefix='/audit-logs'] - GET list under admin API
+ * @param {Object|boolean} [options.retention] - Retention policy configuration (set false to disable)
+ * @param {number} [options.retention.days=90] - Days to retain audit logs
+ * @param {number} [options.retention.intervalMs=86400000] - Auto-cleanup timer frequency (24h)
+ * @param {boolean} [options.retention.runOnStart=true] - Run initial purge shortly after startup
+ * @param {number} [options.retentionDays=90] - Shorthand for retention.days
+ * @param {number} [options.cleanupIntervalMs=86400000] - Shorthand for retention.intervalMs
+ * @param {boolean} [options.autoCleanup=true] - Enable automatic background cleanup
+ * @param {boolean} [options.cleanupOnStart=true] - Run initial purge on start
+ * @param {number} [options.cleanupStartDelayMs] - Delay in ms before start purge
  */
 function auditLogPlugin(options = {}) {
   const {
     db,
+    title,
+    adminTitle,
+    pageTitle: customPageTitle,
     adminPath: adminPathOpt,
     tableName = 'audit_logs',
     includeDefaultPage = true,
     apiPrefix = '/audit-logs',
   } = options;
 
+  const pageTitle = title || adminTitle || customPageTitle || 'Audit log';
+
   if (!db) {
     throw new Error('audit-log plugin requires a database instance. Pass `db` in options.');
   }
 
   const knex = db.knex || db;
 
+  // Retention configuration
+  const retentionOption = options.retention;
+  const isRetentionDisabled =
+    retentionOption === false ||
+    (typeof retentionOption === 'object' && retentionOption.enabled === false) ||
+    options.retentionDays === null ||
+    options.retentionDays === 0;
+
+  const autoCleanupEnabled =
+    !isRetentionDisabled &&
+    options.autoCleanup !== false &&
+    (typeof retentionOption !== 'object' || retentionOption.autoCleanup !== false);
+
+  const retentionConfig = {
+    enabled: !isRetentionDisabled,
+    autoCleanup: autoCleanupEnabled,
+    days: (typeof options.retentionDays === 'number' && options.retentionDays > 0)
+      ? options.retentionDays
+      : (typeof retentionOption === 'object' && retentionOption?.days ? retentionOption.days : 90),
+    intervalMs: (typeof options.cleanupIntervalMs === 'number' && options.cleanupIntervalMs > 0)
+      ? options.cleanupIntervalMs
+      : (typeof retentionOption === 'object' && retentionOption?.intervalMs ? retentionOption.intervalMs : 24 * 60 * 60 * 1000),
+    runOnStart: (typeof retentionOption === 'object' && retentionOption?.runOnStart !== undefined)
+      ? !!retentionOption.runOnStart
+      : (options.cleanupOnStart !== undefined ? !!options.cleanupOnStart : true),
+  };
+
+  let cleanupInterval = null;
+  let cleanupStartTimeout = null;
+
+  async function runCleanup() {
+    try {
+      return await purgeAuditLogs(knex, {
+        tableName,
+        days: retentionConfig.days,
+      });
+    } catch (err) {
+      if (process.env.NODE_ENV !== 'test') {
+        console.warn('[audit-log] Failed to run retention cleanup:', err.message);
+      }
+    }
+  }
+
+  function startCleanup(customIntervalMs) {
+    stopCleanup();
+    if (!retentionConfig.enabled) return;
+    if (typeof customIntervalMs === 'number' && customIntervalMs > 0) {
+      retentionConfig.intervalMs = customIntervalMs;
+    }
+
+    if (retentionConfig.runOnStart) {
+      const delayMs = typeof options.cleanupStartDelayMs === 'number'
+        ? options.cleanupStartDelayMs
+        : (process.env.NODE_ENV === 'test' ? 50 : 5000);
+      cleanupStartTimeout = setTimeout(() => {
+        runCleanup();
+      }, delayMs);
+      if (cleanupStartTimeout && cleanupStartTimeout.unref) {
+        cleanupStartTimeout.unref();
+      }
+    }
+
+    cleanupInterval = setInterval(() => {
+      runCleanup();
+    }, retentionConfig.intervalMs);
+    if (cleanupInterval && cleanupInterval.unref) {
+      cleanupInterval.unref();
+    }
+  }
+
+  function stopCleanup() {
+    if (cleanupStartTimeout) {
+      clearTimeout(cleanupStartTimeout);
+      cleanupStartTimeout = null;
+    }
+    if (cleanupInterval) {
+      clearInterval(cleanupInterval);
+      cleanupInterval = null;
+    }
+  }
+
   const handlers = createAuditLogHandlers({ knex, tableName });
 
   return {
     name: 'audit-log',
     version: '1.0.0',
-    description: 'Audit trail for admin panel model CRUD API',
+    description: 'Audit trail for admin panel model CRUD API with retention cleanup',
     dependencies: { 'admin-panel': '*' },
 
     api: {
+      purge(opts = {}) {
+        return purgeAuditLogs(knex, {
+          tableName,
+          days: opts.days !== undefined ? opts.days : (opts.retentionDays !== undefined ? opts.retentionDays : retentionConfig.days),
+          olderThan: opts.olderThan,
+          ...opts,
+        });
+      },
       purgeAuditLogs: (kx, opts = {}) =>
-        purgeAuditLogs(kx || knex, { tableName: opts.tableName || tableName, olderThan: opts.olderThan }),
+        purgeAuditLogs(kx || knex, { tableName: opts.tableName || tableName, olderThan: opts.olderThan, days: opts.days, retentionDays: opts.retentionDays }),
+      startCleanup,
+      stopCleanup,
+      getRetentionConfig() {
+        return { ...retentionConfig };
+      },
       queryLogs: (filters) => handlers.queryLogs(filters),
       getMigrationTemplate: (name) => generateAuditLogsMigration(name || tableName),
     },
@@ -50,6 +158,22 @@ function auditLogPlugin(options = {}) {
     register(ctx) {
       const adminPath = adminPathOpt || '/_admin';
       ctx.app.use(createAuditMiddleware({ knex, adminPath, tableName }));
+
+      if (retentionConfig.enabled && autoCleanupEnabled) {
+        startCleanup();
+      }
+
+      return () => {
+        stopCleanup();
+      };
+    },
+
+    dispose() {
+      stopCleanup();
+    },
+
+    shutdown() {
+      stopCleanup();
     },
 
     onRoutesReady(ctx) {
@@ -61,11 +185,12 @@ function auditLogPlugin(options = {}) {
 
       adminApi.registerModule({
         id: 'audit-log',
+        title: pageTitle,
 
         pages: includeDefaultPage
           ? [{
             id: 'audit-log',
-            title: 'Audit log',
+            title: pageTitle,
             path: '/audit-log',
             icon: 'database',
             component: generateAuditLogComponent({ apiPrefix }),
@@ -86,6 +211,7 @@ function auditLogPlugin(options = {}) {
           prefix: apiPrefix,
           routes: [
             { method: 'get', path: '', handler: handlers.listHandler },
+            { method: 'post', path: '/purge', handler: handlers.purgeHandler },
           ],
         },
       });

package/plugins/audit-log/purge.js

@@ -3,24 +3,74 @@
  * @module plugins/audit-log/purge
  */
 
+'use strict';
+
 /**
  * @param {import('knex').Knex} knex
- * @param {Object} options
+ * @param {Object} [options={}]
  * @param {string} [options.tableName='audit_logs']
- * @param {Date|string} options.olderThan - Rows with created_at strictly before this are removed
- * @returns {Promise<number>} Deleted row count (driver-dependent; 0 if unknown)
+ * @param {Date|string|number} [options.olderThan] - Rows with created_at strictly before this are removed
+ * @param {number} [options.days] - Number of days of audit logs to keep
+ * @param {number} [options.retentionDays=90] - Alias for days
+ * @returns {Promise<number>} Deleted row count
  */
-async function purgeAuditLogs(knex, options) {
+async function purgeAuditLogs(knex, options = {}) {
+  if (!knex) {
+    throw new Error('purgeAuditLogs requires a database (knex) instance');
+  }
+
   const tableName = options.tableName || 'audit_logs';
-  const olderThan = options.olderThan instanceof Date
-    ? options.olderThan
-    : new Date(options.olderThan);
 
-  if (Number.isNaN(olderThan.getTime())) {
-    throw new Error('purgeAuditLogs: invalid olderThan date');
+  let olderThan;
+  if (options.olderThan !== undefined) {
+    olderThan = options.olderThan instanceof Date
+      ? options.olderThan
+      : new Date(options.olderThan);
+
+    if (Number.isNaN(olderThan.getTime())) {
+      throw new Error('purgeAuditLogs: invalid olderThan date');
+    }
+  } else {
+    const rawDays = options.days !== undefined ? options.days : (options.retentionDays !== undefined ? options.retentionDays : 90);
+    const days = typeof rawDays === 'number' ? rawDays : Number(rawDays);
+    if (Number.isNaN(days) || days <= 0) {
+      throw new Error('purgeAuditLogs: days must be a positive number');
+    }
+    olderThan = new Date(Date.now() - days * 24 * 60 * 60 * 1000);
+  }
+
+  let hasTable = true;
+  if (knex.schema && typeof knex.schema.hasTable === 'function') {
+    try {
+      hasTable = await knex.schema.hasTable(tableName);
+    } catch {
+      hasTable = false;
+    }
+  }
+
+  if (!hasTable) {
+    return 0;
+  }
+
+  const client = knex?.client?.config?.client;
+  const isSqlite = client === 'sqlite3' || client === 'better-sqlite3';
+
+  let query = knex(tableName);
+  if (isSqlite) {
+    const iso = olderThan.toISOString();
+    const cutoffMs = olderThan.getTime();
+    query = query.where((builder) => {
+      builder.whereRaw(
+        "((typeof(created_at) = 'integer' and created_at < ?) or (typeof(created_at) = 'text' and created_at < ?))",
+        [cutoffMs, iso]
+      );
+    });
+  } else {
+    query = query.where('created_at', '<', olderThan);
   }
 
-  return knex(tableName).where('created_at', '<', olderThan).delete();
+  const deleted = await query.delete();
+  return Number(deleted) || 0;
 }
 
 module.exports = {

package/plugins/basic-auth/index.js

@@ -117,7 +117,9 @@ function sendUnauthorized(req, res, config) {
 
   if (config.challenge !== false) {
     const realm = String(config.realm || 'Restricted Area')
-      .split(/[\r\n]/)[0]
+      .split(/[\r\n\0]/)[0]
+      .replace(/[\t]/g, ' ')
+      .replace(/\\/g, '\\\\')
       .replace(/"/g, '\\"');
     res.setHeader('WWW-Authenticate', `Basic realm="${realm}"`);
   }

package/plugins/content/client/inline-edit.js

@@ -248,9 +248,14 @@
       el.textContent = '';
       return;
     }
+    if (typeof window.DOMPurify !== 'undefined' && typeof window.DOMPurify.sanitize === 'function') {
+      el.innerHTML = window.DOMPurify.sanitize(htmlStr);
+      return;
+    }
     try {
-      var parser = new DOMParser();
-      var doc = parser.parseFromString(htmlStr, 'text/html');
+      var template = document.createElement('template');
+      template.innerHTML = htmlStr;
+      var content = template.content;
       var allowedTags = {
         p: 1, br: 1, b: 1, i: 1, strong: 1, em: 1, u: 1, s: 1, strike: 1,
         h1: 1, h2: 1, h3: 1, h4: 1, h5: 1, h6: 1, ul: 1, ol: 1, li: 1,
@@ -260,14 +265,14 @@
       var allowedAttrs = {
         href: 1, title: 1, target: 1, rel: 1, class: 1, id: 1, src: 1, alt: 1, width: 1, height: 1
       };
-      var allNodes = doc.body.querySelectorAll('*');
+      var allNodes = content.querySelectorAll('*');
       for (var i = allNodes.length - 1; i >= 0; i--) {
         var node = allNodes[i];
         var tag = node.tagName.toLowerCase();
         if (!allowedTags[tag]) {
           if (node.parentNode) {
             node.parentNode.removeChild(node);
-          } else {
+          } else if (typeof node.remove === 'function') {
             node.remove();
           }
           continue;
@@ -275,7 +280,7 @@
         var attrs = Array.prototype.slice.call(node.attributes);
         for (var j = 0; j < attrs.length; j++) {
           var attrName = attrs[j].name.toLowerCase();
-          var attrVal = attrs[j].value.toLowerCase().replace(/[\x00-\x20\s]+/g, '').trim();
+          var attrVal = (attrs[j].value || '').toLowerCase().replace(/[\x00-\x20\s]+/g, '').trim();
           if (attrName.indexOf('on') === 0 || !allowedAttrs[attrName]) {
             node.removeAttribute(attrs[j].name);
           } else if ((attrName === 'href' || attrName === 'src' || attrName === 'action' || attrName === 'formaction' || attrName === 'xlink:href') &&
@@ -287,13 +292,8 @@
         }
       }
 
-      // Transfer DOM nodes directly to target element
-      while (el.firstChild) {
-        el.removeChild(el.firstChild);
-      }
-      while (doc.body.firstChild) {
-        el.appendChild(doc.body.firstChild);
-      }
+      el.textContent = '';
+      el.appendChild(content.cloneNode(true));
     } catch (e) {
       el.textContent = htmlStr;
     }

package/plugins/cors.js

@@ -101,15 +101,14 @@ function createCorsMiddleware(options = {}) {
         return next(err);
       }
 
-      if (allowedOrigin) {
+      if (allowedOrigin && allowedOrigin !== '*') {
         res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
-        if (allowedOrigin !== '*') {
-          res.setHeader('Vary', 'Origin');
+        res.setHeader('Vary', 'Origin');
+        if (config.credentials) {
+          res.setHeader('Access-Control-Allow-Credentials', 'true');
         }
-      }
-
-      if (config.credentials && allowedOrigin && allowedOrigin !== '*') {
-        res.setHeader('Access-Control-Allow-Credentials', 'true');
+      } else if (allowedOrigin === '*' && !config.credentials) {
+        res.setHeader('Access-Control-Allow-Origin', '*');
       }
 
       if (exposedHeadersStr) {

package/plugins/dashboard/app.js

@@ -10,6 +10,8 @@ const state = {
   filter: 'all',
   search: '',
   routes: window.__DASHBOARD_DATA__.routes || [],
+  models: window.__DASHBOARD_DATA__.models || [],
+  services: window.__DASHBOARD_DATA__.services || [],
   plugins: window.__DASHBOARD_DATA__.plugins || [],
   config: window.__DASHBOARD_DATA__.config || {}
 };
@@ -29,18 +31,27 @@ const Icons = {
 // Components
 const Header = {
   view: () => m('.header', [
-    m('h1', [
-      Icons.logo(),
-      'Webspresso Dashboard'
+    m('div', [
+      m('h1', [
+        Icons.logo(),
+        'Webspresso Dashboard'
+      ]),
+      m('span.dev-badge', 'development')
     ]),
-    m('span.dev-badge', 'development')
+    m('.header-actions', [
+      m('a.action-link', { href: '/_admin', target: '_blank', rel: 'noopener' }, '⚙️ Admin Panel ↗'),
+      m('a.action-link', { href: '/_swagger', target: '_blank', rel: 'noopener' }, '📖 API Docs ↗'),
+      m('a.action-link', { href: '/_schema', target: '_blank', rel: 'noopener' }, '🗂️ Schema Explorer ↗')
+    ])
   ])
 };
 
 const Tabs = {
   view: () => m('.tabs', [
-    ['routes', 'Routes'],
-    ['plugins', 'Plugins'],
+    ['routes', 'Routes (' + state.routes.length + ')'],
+    ['models', 'Models (' + state.models.length + ')'],
+    ['services', 'Services (' + state.services.length + ')'],
+    ['plugins', 'Plugins (' + state.plugins.length + ')'],
     ['config', 'Config']
   ].map(([id, label]) => 
     m('button.tab', {
@@ -72,32 +83,36 @@ const FilterBar = {
 };
 
 const MethodBadge = {
-  view: (vnode) => m('span.method-badge.method-' + vnode.attrs.method, 
-    vnode.attrs.method.toUpperCase()
+  view: (vnode) => m('span.method-badge.method-' + (vnode.attrs.method || 'get').toLowerCase(), 
+    (vnode.attrs.method || 'GET').toUpperCase()
   )
 };
 
 const TypeBadge = {
-  view: (vnode) => m('span.type-badge.type-' + vnode.attrs.type, 
-    vnode.attrs.type.toUpperCase()
-  )
+  view: (vnode) => {
+    const rawType = vnode.attrs.type || 'page';
+    const label = rawType === 'page' ? 'SSR' : rawType.toUpperCase();
+    return m('span.type-badge.type-' + (rawType === 'page' ? 'ssr' : rawType), label);
+  }
 };
 
 const RoutesTable = {
   view: () => {
     let routes = state.routes;
     
-    // Apply filter
-    if (state.filter !== 'all') {
-      routes = routes.filter(r => r.type === state.filter);
+    // Apply filter: SSR matches both 'ssr' and 'page'
+    if (state.filter === 'ssr') {
+      routes = routes.filter(r => r.type === 'ssr' || r.type === 'page');
+    } else if (state.filter === 'api') {
+      routes = routes.filter(r => r.type === 'api');
     }
     
-    // Apply search
+    // Apply search: checks path or pattern or file
     if (state.search) {
       const search = state.search.toLowerCase();
       routes = routes.filter(r => 
-        r.pattern.toLowerCase().includes(search) ||
-        r.file.toLowerCase().includes(search)
+        ((r.path || r.pattern || '')).toLowerCase().includes(search) ||
+        ((r.file || '')).toLowerCase().includes(search)
       );
     }
     
@@ -121,17 +136,18 @@ const RoutesTable = {
           ])
         ),
         m('tbody',
-          routes.map(route =>
-            m('tr', [
+          routes.map(route => {
+            const displayPath = route.path || route.pattern || '/';
+            return m('tr', [
               m('td', m(MethodBadge, { method: route.method })),
               m('td', [
-                m('span.code', route.pattern),
+                m('span.code', displayPath),
                 route.isDynamic ? m('span.dynamic-indicator', '⚡ dynamic') : null
               ]),
-              m('td', m('span.file-path', route.file)),
+              m('td', m('span.file-path', route.file || 'custom')),
               m('td', m(TypeBadge, { type: route.type }))
-            ])
-          )
+            ]);
+          })
         )
       ])
     );
@@ -140,7 +156,7 @@ const RoutesTable = {
 
 const StatsGrid = {
   view: () => {
-    const ssrCount = state.routes.filter(r => r.type === 'ssr').length;
+    const ssrCount = state.routes.filter(r => r.type === 'ssr' || r.type === 'page').length;
     const apiCount = state.routes.filter(r => r.type === 'api').length;
     const dynamicCount = state.routes.filter(r => r.isDynamic).length;
     
@@ -173,6 +189,116 @@ const RoutesView = {
   ])
 };
 
+const ModelsView = {
+  view: () => {
+    const models = state.models || [];
+    if (models.length === 0) {
+      return m('.table-container',
+        m('.empty-state', [
+          Icons.empty(),
+          m('p', 'No ORM models registered in core/orm')
+        ])
+      );
+    }
+
+    return m('div', [
+      m('.stats-grid', [
+        m('.card', [
+          m('.card-title', 'Total Models'),
+          m('.card-value', models.length)
+        ]),
+        m('.card', [
+          m('.card-title', 'Cached Models'),
+          m('.card-value', models.filter(m => Boolean(m.cache)).length)
+        ]),
+        m('.card', [
+          m('.card-title', 'Soft-Delete Enabled'),
+          m('.card-value', models.filter(m => Boolean(m.softDelete)).length)
+        ])
+      ]),
+      m('.table-container',
+        m('table', [
+          m('thead',
+            m('tr', [
+              m('th', 'Model'),
+              m('th', 'Table'),
+              m('th', 'Primary Key'),
+              m('th', 'Columns'),
+              m('th', 'Soft Delete'),
+              m('th', 'Cache')
+            ])
+          ),
+          m('tbody',
+            models.map(mod =>
+              m('tr', [
+                m('td', m('strong', mod.name)),
+                m('td', m('span.code-badge', mod.table)),
+                m('td', m('span.badge.badge-blue', mod.primaryKey || 'id')),
+                m('td', (mod.columnCount || 0) + ' columns'),
+                m('td', mod.softDelete ? m('span.badge.badge-green', 'Enabled') : m('span.badge.badge-gray', 'Disabled')),
+                m('td', mod.cache ? m('span.badge.badge-purple', String(mod.cache)) : m('span.badge.badge-gray', 'None'))
+              ])
+            )
+          )
+        ])
+      )
+    ]);
+  }
+};
+
+const ServicesView = {
+  view: () => {
+    const services = state.services || [];
+    if (services.length === 0) {
+      return m('.table-container',
+        m('.empty-state', [
+          Icons.empty(),
+          m('p', 'No services registered in services/ or ServiceRegistry')
+        ])
+      );
+    }
+
+    return m('div', [
+      m('.stats-grid', [
+        m('.card', [
+          m('.card-title', 'Total Services'),
+          m('.card-value', services.length)
+        ]),
+        m('.card', [
+          m('.card-title', 'ACID Transactions'),
+          m('.card-value', services.filter(s => s.transaction).length)
+        ]),
+        m('.card', [
+          m('.card-title', 'Auth Protected'),
+          m('.card-value', services.filter(s => s.auth).length)
+        ])
+      ]),
+      m('.table-container',
+        m('table', [
+          m('thead',
+            m('tr', [
+              m('th', 'Service Name'),
+              m('th', 'Transaction (ACID)'),
+              m('th', 'Auth Guard'),
+              m('th', 'Schema Validation')
+            ])
+          ),
+          m('tbody',
+            services.map(srv =>
+              m('tr', [
+                m('td', m('span.code-badge', srv.name)),
+                m('td', srv.transaction ? m('span.badge.badge-green', 'Active') : m('span.badge.badge-gray', 'No')),
+                m('td', srv.auth ? m('span.badge.badge-orange', String(srv.auth)) : m('span.badge.badge-gray', 'Public')),
+                m('td', srv.hasSchema ? m('span.badge.badge-blue', 'Zod Schema') : m('span.badge.badge-gray', 'None'))
+              ])
+            )
+          )
+        ])
+      )
+    ]);
+  }
+};
+
 const PluginsView = {
   view: () => {
     if (state.plugins.length === 0) {
@@ -254,6 +380,8 @@ const App = {
     m(Header),
     m(Tabs),
     state.activeTab === 'routes' ? m(RoutesView) : null,
+    state.activeTab === 'models' ? m(ModelsView) : null,
+    state.activeTab === 'services' ? m(ServicesView) : null,
     state.activeTab === 'plugins' ? m(PluginsView) : null,
     state.activeTab === 'config' ? m(ConfigView) : null
   ])
@@ -262,6 +390,3 @@ const App = {
 // Mount app
 m.mount(document.getElementById('app'), App);
 `;
-
-
-