webspresso 0.0.96 → 0.0.98

package/plugins/email/purge.js

@@ -3,24 +3,74 @@
  * @module plugins/email/purge
  */
 
+'use strict';
+
 /**
  * @param {import('knex').Knex} knex
- * @param {Object} options
+ * @param {Object} [options={}]
  * @param {string} [options.tableName='email_logs']
- * @param {Date|string} options.olderThan
- * @returns {Promise<number>}
+ * @param {Date|string|number} [options.olderThan] - Rows with created_at strictly before this are removed
+ * @param {number} [options.days] - Number of days of email logs to keep
+ * @param {number} [options.retentionDays=90] - Alias for days
+ * @returns {Promise<number>} Deleted row count
  */
-async function purgeEmailLogs(knex, options) {
+async function purgeEmailLogs(knex, options = {}) {
+  if (!knex) {
+    throw new Error('purgeEmailLogs requires a database (knex) instance');
+  }
+
   const tableName = options.tableName || 'email_logs';
-  const olderThan = options.olderThan instanceof Date
-    ? options.olderThan
-    : new Date(options.olderThan);
 
-  if (Number.isNaN(olderThan.getTime())) {
-    throw new Error('purgeEmailLogs: invalid olderThan date');
+  let olderThan;
+  if (options.olderThan !== undefined) {
+    olderThan = options.olderThan instanceof Date
+      ? options.olderThan
+      : new Date(options.olderThan);
+
+    if (Number.isNaN(olderThan.getTime())) {
+      throw new Error('purgeEmailLogs: invalid olderThan date');
+    }
+  } else {
+    const rawDays = options.days !== undefined ? options.days : (options.retentionDays !== undefined ? options.retentionDays : 90);
+    const days = typeof rawDays === 'number' ? rawDays : Number(rawDays);
+    if (Number.isNaN(days) || days <= 0) {
+      throw new Error('purgeEmailLogs: days must be a positive number');
+    }
+    olderThan = new Date(Date.now() - days * 24 * 60 * 60 * 1000);
+  }
+
+  let hasTable = true;
+  if (knex.schema && typeof knex.schema.hasTable === 'function') {
+    try {
+      hasTable = await knex.schema.hasTable(tableName);
+    } catch {
+      hasTable = false;
+    }
+  }
+
+  if (!hasTable) {
+    return 0;
+  }
+
+  const client = knex?.client?.config?.client;
+  const isSqlite = client === 'sqlite3' || client === 'better-sqlite3';
+
+  let query = knex(tableName);
+  if (isSqlite) {
+    const iso = olderThan.toISOString();
+    const cutoffMs = olderThan.getTime();
+    query = query.where((builder) => {
+      builder.whereRaw(
+        "((typeof(created_at) = 'integer' and created_at < ?) or (typeof(created_at) = 'text' and created_at < ?))",
+        [cutoffMs, iso]
+      );
+    });
+  } else {
+    query = query.where('created_at', '<', olderThan);
   }
 
-  return knex(tableName).where('created_at', '<', olderThan).delete();
+  const deleted = await query.delete();
+  return Number(deleted) || 0;
 }
 
 module.exports = {

package/plugins/file-manager/core.js

@@ -217,7 +217,7 @@ function buildBreadcrumbs(relPath) {
   const breadcrumbs = [{ name: 'Root', path: '' }];
   if (!relPath) return breadcrumbs;
 
-  const segments = relPath.replace(/\\/g, '/').replace(/^\/+|\/+$/g, '').split('/').filter(Boolean);
+  const segments = relPath.replace(/\\/g, '/').split('/').filter(Boolean);
   let current = '';
 
   for (const seg of segments) {

package/plugins/file-manager/security.js

@@ -4,6 +4,7 @@
  * @module plugins/file-manager/security
  */
 
+const sanitizeHtml = require('sanitize-html');
 const { SecurityError, ValidationError } = require('../../core/errors');
 
 /**
@@ -164,6 +165,37 @@ function validateMagicBytes(buffer, ext) {
   return true;
 }
 
+const SVG_SANITIZE_OPTIONS = {
+  allowedTags: [
+    'svg', 'g', 'path', 'circle', 'rect', 'line', 'polyline', 'polygon',
+    'ellipse', 'text', 'tspan', 'defs', 'clipPath', 'mask', 'pattern',
+    'image', 'linearGradient', 'radialGradient', 'stop', 'use', 'symbol',
+    'title', 'desc', 'a',
+  ],
+  allowedAttributes: {
+    '*': [
+      'id', 'class', 'style', 'xml:space', 'xmlns', 'xmlns:xlink', 'xmlns:svg',
+      'version', 'viewbox', 'viewBox', 'width', 'height', 'x', 'y', 'dx', 'dy',
+      'x1', 'y1', 'x2', 'y2', 'cx', 'cy', 'r', 'rx', 'ry', 'd', 'points',
+      'fill', 'stroke', 'stroke-width', 'stroke-linecap', 'stroke-linejoin',
+      'stroke-miterlimit', 'stroke-dasharray', 'stroke-dashoffset', 'opacity',
+      'fill-opacity', 'stroke-opacity', 'fill-rule', 'clip-rule',
+      'transform', 'font-family', 'font-size', 'font-weight', 'text-anchor',
+      'clip-path', 'mask', 'gradientUnits', 'gradientTransform', 'offset',
+      'stop-color', 'stop-opacity', 'href', 'xlink:href', 'preserveAspectRatio',
+    ],
+  },
+  allowedSchemes: ['http', 'https'],
+  allowedSchemesByTag: {
+    a: ['http', 'https', 'mailto'],
+    image: ['http', 'https', 'data'],
+    use: ['#'],
+  },
+  allowProtocolRelative: false,
+  selfClosing: ['rect', 'circle', 'line', 'polyline', 'polygon', 'path', 'stop', 'use', 'image', 'ellipse'],
+  disallowedTagsMode: 'discard',
+};
+
 /**
  * Sanitize SVG content against Stored XSS attacks.
  * Strips <script>, <foreignObject>, <iframe>, <embed>, <object> and on* event handlers.
@@ -172,29 +204,7 @@ function validateMagicBytes(buffer, ext) {
  */
 function sanitizeSvgContent(content) {
   const str = Buffer.isBuffer(content) ? content.toString('utf8') : String(content);
-
-  // Quick check: if no dangerous keywords, return original buffer directly for maximum speed
-  if (!/<(script|foreignobject|iframe|embed|object|meta|link|style)/i.test(str) &&
-      !/\s+on[a-z]+\s*=/i.test(str) &&
-      !/javascript:/i.test(str) &&
-      !/data:text\/html/i.test(str)) {
-    return Buffer.isBuffer(content) ? content : Buffer.from(str, 'utf8');
-  }
-
-  let sanitized = str
-    // Remove script tags and content
-    .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script\s*>/gi, '')
-    // Remove dangerous containers
-    .replace(/<foreignObject\b[^<]*(?:(?!<\/foreignObject>)<[^<]*)*<\/foreignObject\s*>/gi, '')
-    .replace(/<iframe\b[^<]*(?:(?!<\/iframe>)<[^<]*)*<\/iframe\s*>/gi, '')
-    .replace(/<embed\b[^>]*>/gi, '')
-    .replace(/<object\b[^<]*(?:(?!<\/object>)<[^<]*)*<\/object\s*>/gi, '')
-    // Remove inline event handlers (onload, onclick, onerror, onmouseover, etc.)
-    .replace(/\s+on[a-zA-Z]+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, '')
-    // Remove javascript: and data:text/html URIs in href and xlink:href
-    .replace(/(?:href|xlink:href)\s*=\s*(?:"\s*javascript:[^"]*"|'\s*javascript:[^']*')/gi, 'href=""')
-    .replace(/(?:href|xlink:href)\s*=\s*(?:"\s*data:text\/html[^"]*"|'\s*data:text\/html[^']*')/gi, 'href=""');
-
+  const sanitized = sanitizeHtml(str, SVG_SANITIZE_OPTIONS);
   return Buffer.from(sanitized, 'utf8');
 }
 

package/plugins/index.js

@@ -3,94 +3,56 @@
  * Export all built-in plugins
  */
 
-const sitemapPlugin = require('./sitemap');
-const analyticsPlugin = require('./analytics');
-const dashboardPlugin = require('./dashboard/index');
-const schemaExplorerPlugin = require('./schema-explorer');
-const adminPanelPlugin = require('./admin-panel');
-const seoCheckerPlugin = require('./seo-checker');
-const siteAnalyticsPlugin = require('./site-analytics');
-const auditLogPlugin = require('./audit-log');
-const recaptchaPlugin = require('./recaptcha');
-const swaggerPlugin = require('./swagger');
-const healthCheckPlugin = require('./health-check');
-const restResourcePlugin = require('./rest-resources');
-const ormCacheAdminPlugin = require('./orm-cache-admin');
-const { uploadPlugin, createLocalFileProvider } = require('./upload');
-/** Register after adminPanelPlugin (same db + adminPath) for session and routes. */
-const { dataExchangePlugin } = require('./data-exchange');
-const { redirectPlugin } = require('./redirect');
-const { rateLimitPlugin } = require('./rate-limit');
-const emailPlugin = require('./email');
-const contentPlugin = require('./content');
-const csrfPlugin = require('./csrf');
-const corsPlugin = require('./cors');
-const { basicAuthPlugin, createBasicAuthMiddleware } = require('./basic-auth');
-const {
-  realtimePlugin,
-  realtime,
-  createRealtime,
-  websocket,
-  createWebSocketAdapter,
-  sse,
-  createSseAdapter,
-  socketIo,
-  createSocketIoAdapter,
-  redis,
-  createRedisAdapter,
-} = require('./realtime');
-const { mcpPlugin, createMcpServer, McpServer } = require('./mcp');
-const polarPlugin = require('./polar');
-const fileManagerPlugin = require('./file-manager');
-const { xlsxPlugin, xlsx } = require('./xlsx');
-const { csvPlugin, csv } = require('./csv');
-
 module.exports = {
-  sitemapPlugin,
-  analyticsPlugin,
-  dashboardPlugin,
-  schemaExplorerPlugin,
-  adminPanelPlugin,
-  seoCheckerPlugin,
-  siteAnalyticsPlugin,
-  auditLogPlugin,
-  recaptchaPlugin,
-  swaggerPlugin,
-  healthCheckPlugin,
-  restResourcePlugin,
-  ormCacheAdminPlugin,
-  uploadPlugin,
-  createLocalFileProvider,
-  dataExchangePlugin,
-  redirectPlugin,
-  rateLimitPlugin,
-  emailPlugin,
-  contentPlugin,
-  csrfPlugin,
-  corsPlugin,
-  basicAuthPlugin,
-  createBasicAuthMiddleware,
-  realtimePlugin,
-  realtime,
-  createRealtime,
-  websocket,
-  createWebSocketAdapter,
-  sse,
-  createSseAdapter,
-  socketIo,
-  createSocketIoAdapter,
-  redis,
-  createRedisAdapter,
-  queuePlugin: require('./queue'),
-  mcpPlugin,
-  createMcpServer,
-  McpServer,
-  polarPlugin,
-  fileManagerPlugin,
-  xlsxPlugin,
-  xlsx,
-  csvPlugin,
-  csv,
+  get sitemapPlugin() { return require('./sitemap'); },
+  get analyticsPlugin() { return require('./analytics'); },
+  get dashboardPlugin() { return require('./dashboard/index'); },
+  get devToolbarPlugin() { return require('./dashboard/index').devToolbarPlugin; },
+  get devtoolsPlugin() { return require('./dashboard/index').devtoolsPlugin; },
+  get schemaExplorerPlugin() { return require('./schema-explorer'); },
+  get adminPanelPlugin() { return require('./admin-panel'); },
+  get seoCheckerPlugin() { return require('./seo-checker'); },
+  get siteAnalyticsPlugin() { return require('./site-analytics'); },
+  get auditLogPlugin() { return require('./audit-log'); },
+  get recaptchaPlugin() { return require('./recaptcha'); },
+  get swaggerPlugin() { return require('./swagger'); },
+  get openapiPlugin() { return require('./swagger'); },
+  get apiDocsPlugin() { return require('./swagger'); },
+  get healthCheckPlugin() { return require('./health-check'); },
+  get restResourcePlugin() { return require('./rest-resources'); },
+  get ormCacheAdminPlugin() { return require('./orm-cache-admin'); },
+  get uploadPlugin() { return require('./upload').uploadPlugin; },
+  get createLocalFileProvider() { return require('./upload').createLocalFileProvider; },
+  get dataExchangePlugin() { return require('./data-exchange').dataExchangePlugin; },
+  get redirectPlugin() { return require('./redirect').redirectPlugin; },
+  get rateLimitPlugin() { return require('./rate-limit').rateLimitPlugin; },
+  get emailPlugin() { return require('./email'); },
+  get contentPlugin() { return require('./content'); },
+  get csrfPlugin() { return require('./csrf'); },
+  get corsPlugin() { return require('./cors'); },
+  get basicAuthPlugin() { return require('./basic-auth').basicAuthPlugin; },
+  get createBasicAuthMiddleware() { return require('./basic-auth').createBasicAuthMiddleware; },
+  get realtimePlugin() { return require('./realtime').realtimePlugin; },
+  get realtime() { return require('./realtime').realtime; },
+  get createRealtime() { return require('./realtime').createRealtime; },
+  get websocket() { return require('./realtime').websocket; },
+  get createWebSocketAdapter() { return require('./realtime').createWebSocketAdapter; },
+  get sse() { return require('./realtime').sse; },
+  get createSseAdapter() { return require('./realtime').createSseAdapter; },
+  get socketIo() { return require('./realtime').socketIo; },
+  get createSocketIoAdapter() { return require('./realtime').createSocketIoAdapter; },
+  get redis() { return require('./realtime').redis; },
+  get createRedisAdapter() { return require('./realtime').createRedisAdapter; },
+  get queuePlugin() { return require('./queue'); },
+  get mcpPlugin() { return require('./mcp').mcpPlugin; },
+  get createMcpServer() { return require('./mcp').createMcpServer; },
+  get McpServer() { return require('./mcp').McpServer; },
+  get polarPlugin() { return require('./polar'); },
+  get fileManagerPlugin() { return require('./file-manager'); },
+  get xlsxPlugin() { return require('./xlsx').xlsxPlugin; },
+  get xlsx() { return require('./xlsx').xlsx; },
+  get csvPlugin() { return require('./csv').csvPlugin; },
+  get csv() { return require('./csv').csv; },
 };
 
 

package/plugins/mcp/transports/sse.js

@@ -18,8 +18,10 @@ const { createJsonRpcError, ERROR_CODES } = require('../server');
  */
 function mountSseTransport(options) {
   const { app, server, path: basePath = '/_mcp', authMiddleware } = options;
-
-  const normalizedBase = basePath.replace(/\/+$/, '');
+  let normalizedBase = String(basePath || '/_mcp');
+  while (normalizedBase.length > 1 && normalizedBase.endsWith('/')) {
+    normalizedBase = normalizedBase.slice(0, -1);
+  }
   const sessions = new Map();
 
   const middlewareChain = authMiddleware ? [authMiddleware] : [];

package/plugins/orm-cache-admin/index.js

@@ -11,7 +11,8 @@ const { generateOrmCacheAdminComponent } = require('./admin-component');
  * @param {import('../../core/orm/types').DatabaseInstance} options.db - From createDatabase({ cache: true })
  */
 function ormCacheAdminPlugin(options = {}) {
-  const { db } = options;
+  const { db, title, adminTitle } = options;
+  const pageTitle = title || adminTitle || 'ORM Cache';
 
   if (!db) {
     throw new Error('orm-cache-admin plugin requires `db` (database instance from createDatabase)');
@@ -41,9 +42,10 @@ function ormCacheAdminPlugin(options = {}) {
 
       adminApi.registerModule({
         id: 'orm-cache',
+        title: pageTitle,
         pages: [{
           id: 'orm-cache',
-          title: 'ORM Cache',
+          title: pageTitle,
           path: '/orm-cache',
           icon: 'database',
           component: generateOrmCacheAdminComponent(),

package/plugins/queue/index.js

@@ -72,6 +72,12 @@ function queuePlugin(options = {}) {
         pollInterval,
         jobsDir,
         autoStart,
+        retention: options.retention,
+        retentionDays: options.retentionDays,
+        retentionStatuses: options.retentionStatuses,
+        cleanupIntervalMs: options.cleanupIntervalMs,
+        autoCleanup: options.autoCleanup,
+        cleanupOnStart: options.cleanupOnStart,
       });
 
       // Expose to ctx & app
@@ -90,6 +96,11 @@ function queuePlugin(options = {}) {
       this.queue = queueManager;
     },
 
+    api: {
+      getQueueManager: () => queueManager,
+      clean: (opts) => queueManager?.clean(opts),
+    },
+
     onRoutesReady(ctx) {
       if (jobsDir && fs.existsSync(jobsDir)) {
         queueManager.loadJobsFromDirectory(jobsDir);