webspresso 0.0.97 → 0.0.99

package/plugins/admin-panel/index.js

@@ -43,6 +43,8 @@ function adminPanelPlugin(options = {}) {
   const {
     path: adminPath = '/_admin',
     enabled = true,
+    title,
+    titleTemplate,
     sessionSecret,
     db,
     auth,
@@ -52,6 +54,7 @@ function adminPanelPlugin(options = {}) {
     uploadUrl: uploadUrlOption,
     richTextSanitize = true,
     dataExchange: dataExchangeOption = true,
+    loginRateLimit,
   } = options;
 
   const adminUsersConfig = typeof adminUsersOption === 'object' ? adminUsersOption : { enabled: adminUsersOption !== false };
@@ -63,6 +66,12 @@ function adminPanelPlugin(options = {}) {
 
   // Create fresh registry for this plugin instance
   const registry = new AdminRegistry();
+  if (title) {
+    registry.setTitle(title);
+  }
+  if (titleTemplate) {
+    registry.setTitleTemplate(titleTemplate);
+  }
 
   // Dependencies are now in main package
   const session = require('express-session');
@@ -144,8 +153,40 @@ function adminPanelPlugin(options = {}) {
       registerStyle(style) {
         return registry.registerStyle(style);
       },
+      registerHook(hookName, callback) {
+        return registry.registerHook(hookName, callback);
+      },
+      runHooks(hookName, context) {
+        return registry.runHooks(hookName, context);
+      },
+      registerAction(id, config) {
+        return registry.registerAction(id, config);
+      },
+      registerBulkAction(id, config) {
+        return registry.registerBulkAction(id, config);
+      },
+      setTitle(title) {
+        registry.setTitle(title);
+        return this;
+      },
+      getTitle() {
+        return registry.getTitle();
+      },
+      setTitleTemplate(template) {
+        registry.setTitleTemplate(template);
+        return this;
+      },
+      getTitleTemplate() {
+        return registry.getTitleTemplate();
+      },
+      resetLoginAttempts(ip) {
+        if (this._apiHandlers && typeof this._apiHandlers.resetLoginAttempts === 'function') {
+          return this._apiHandlers.resetLoginAttempts(ip);
+        }
+      },
 
       _ctx: null,
+      _apiHandlers: null,
     },
 
     /**
@@ -275,15 +316,68 @@ function adminPanelPlugin(options = {}) {
         });
       }
 
+      // Auto-register model-level declared actions and bulkActions
+      const { getAllModels: getFrameworkModels } = require('../../core/orm/model');
+      const modelMap = new Map();
+      if (getFrameworkModels) {
+        for (const [name, model] of getFrameworkModels()) {
+          modelMap.set(name, model);
+        }
+      }
+      if (db.getAllModels) {
+        const dbModels = db.getAllModels();
+        const list = Array.isArray(dbModels) ? dbModels : Array.from(dbModels.values());
+        for (const model of list) {
+          modelMap.set(model.name, model);
+        }
+      }
+      const appModelList = Array.from(modelMap.values());
+      for (const model of appModelList) {
+        if (model.admin?.actions && Array.isArray(model.admin.actions)) {
+          for (const act of model.admin.actions) {
+            if (act.id && act.label && act.handler && !registry.actions.has(act.id)) {
+              registry.registerAction(act.id, {
+                models: [model.name],
+                ...act,
+              });
+            }
+          }
+        }
+        if (model.admin?.bulkActions && Array.isArray(model.admin.bulkActions)) {
+          for (const bAct of model.admin.bulkActions) {
+            if (bAct.id && bAct.label && bAct.handler && !registry.bulkActions.has(bAct.id)) {
+              registry.registerBulkAction(bAct.id, {
+                models: [model.name],
+                ...bAct,
+              });
+            }
+          }
+        }
+        if (model.admin?.hooks && typeof model.admin.hooks === 'object') {
+          for (const [hookName, fn] of Object.entries(model.admin.hooks)) {
+            if (typeof fn === 'function') {
+              registry.registerHook(hookName, async (ctx) => {
+                if (!ctx.model || ctx.model === model.name) {
+                  await fn(ctx);
+                }
+              });
+            }
+          }
+        }
+      }
+
       // Create API handlers
       const apiHandlers = createApiHandlers({
         path: adminPath,
         db,
+        registry,
         AdminUser,
         hashPassword: (password, rounds) => bcrypt.hash(password, process.env.NODE_ENV === 'test' ? 4 : (rounds || 10)),
         comparePassword: (password, hash) => bcrypt.compare(password, hash),
         richTextSanitize,
+        loginRateLimit,
       });
+      this.api._apiHandlers = apiHandlers;
 
       const extensionHandlers = createExtensionApiHandlers({
         registry,
@@ -330,7 +424,9 @@ function adminPanelPlugin(options = {}) {
       ctx.addRoute('get', `${adminPath}/api/extensions/widgets/:widgetId/data`, requireAuth, extensionHandlers.widgetDataHandler);
       ctx.addRoute('get', `${adminPath}/api/extensions/dashboard/stats`, requireAuth, extensionHandlers.dashboardStatsHandler);
       ctx.addRoute('post', `${adminPath}/api/extensions/actions/:actionId/:model/:id`, requireAuth, extensionHandlers.actionHandler);
+      ctx.addRoute('post', `${adminPath}/api/actions/:actionId/:model/:id`, requireAuth, extensionHandlers.actionHandler);
       ctx.addRoute('post', `${adminPath}/api/extensions/bulk-actions/:actionId/:model`, requireAuth, extensionHandlers.bulkActionHandler);
+      ctx.addRoute('post', `${adminPath}/api/bulk-actions/:actionId/:model`, requireAuth, extensionHandlers.bulkActionHandler);
       ctx.addRoute('get', `${adminPath}/api/extensions/bulk-fields/:model`, requireAuth, extensionHandlers.bulkFieldsHandler);
       ctx.addRoute('post', `${adminPath}/api/extensions/bulk-update/:model`, requireAuth, extensionHandlers.bulkUpdateFieldHandler);
       ctx.addRoute('get', `${adminPath}/api/extensions/export/:model`, requireAuth, extensionHandlers.exportHandler);

package/plugins/admin-panel/lib/login-rate-limiter.js

@@ -0,0 +1,119 @@
+'use strict';
+
+/**
+ * In-memory brute-force rate limiter for admin login.
+ * Zero external dependencies.
+ */
+class LoginRateLimiter {
+  constructor(options = {}) {
+    if (options === false) {
+      this.enabled = false;
+      this.maxAttempts = 5;
+      this.windowMs = 15 * 60 * 1000;
+    } else {
+      const opts = typeof options === 'object' && options !== null ? options : {};
+      this.enabled = opts.enabled !== false;
+      this.maxAttempts = typeof opts.maxAttempts === 'number' && opts.maxAttempts > 0 ? opts.maxAttempts : 5;
+      this.windowMs = typeof opts.windowMs === 'number' && opts.windowMs > 0 ? opts.windowMs : (15 * 60 * 1000);
+    }
+    this.attempts = new Map();
+  }
+
+  getClientIp(req) {
+    if (!req) return '127.0.0.1';
+    if (req.ip) return String(req.ip);
+    if (req.headers && req.headers['x-forwarded-for']) {
+      const forwarded = String(req.headers['x-forwarded-for']).split(',')[0].trim();
+      if (forwarded) return forwarded;
+    }
+    if (req.connection && req.connection.remoteAddress) {
+      return String(req.connection.remoteAddress);
+    }
+    if (req.socket && req.socket.remoteAddress) {
+      return String(req.socket.remoteAddress);
+    }
+    return '127.0.0.1';
+  }
+
+  isBlocked(req) {
+    if (!this.enabled) return { blocked: false, remaining: Infinity, count: 0 };
+    const ip = this.getClientIp(req);
+    const now = Date.now();
+    const entry = this.attempts.get(ip);
+    if (!entry) return { blocked: false, remaining: this.maxAttempts, count: 0 };
+
+    if (now >= entry.resetAt) {
+      this.attempts.delete(ip);
+      return { blocked: false, remaining: this.maxAttempts, count: 0 };
+    }
+
+    if (entry.count >= this.maxAttempts) {
+      const remainingMs = Math.max(0, entry.resetAt - now);
+      const waitMinutes = Math.max(1, Math.ceil(remainingMs / 60000));
+      const retryAfter = Math.max(1, Math.ceil(remainingMs / 1000));
+      return {
+        blocked: true,
+        remaining: 0,
+        count: entry.count,
+        waitMinutes,
+        retryAfter,
+        message: `Too many failed login attempts. Please try again in ${waitMinutes} ${waitMinutes === 1 ? 'minute' : 'minutes'}.`,
+      };
+    }
+
+    return {
+      blocked: false,
+      remaining: Math.max(0, this.maxAttempts - entry.count),
+      count: entry.count,
+    };
+  }
+
+  recordFailure(req) {
+    if (!this.enabled) return { blocked: false, remaining: Infinity, count: 0 };
+    const ip = this.getClientIp(req);
+    const now = Date.now();
+    const entry = this.attempts.get(ip);
+
+    if (!entry || now >= entry.resetAt) {
+      this.attempts.set(ip, {
+        count: 1,
+        resetAt: now + this.windowMs,
+      });
+    } else {
+      entry.count += 1;
+    }
+
+    if (this.attempts.size > 500) {
+      this.cleanup();
+    }
+
+    return this.isBlocked(req);
+  }
+
+  recordSuccess(req) {
+    if (!this.enabled) return;
+    const ip = this.getClientIp(req);
+    this.attempts.delete(ip);
+  }
+
+  reset(ip) {
+    if (ip) {
+      this.attempts.delete(ip);
+    } else {
+      this.attempts.clear();
+    }
+  }
+
+  cleanup() {
+    const now = Date.now();
+    for (const [ip, entry] of this.attempts.entries()) {
+      if (now >= entry.resetAt) {
+        this.attempts.delete(ip);
+      }
+    }
+  }
+}
+
+module.exports = {
+  LoginRateLimiter,
+};

package/plugins/admin-panel/modules/admin-users.js

@@ -497,7 +497,16 @@ const AdminUsersPage = {
     };
 
     vnode.state.deleteAdmin = async function(admin) {
-      if (!confirm('Are you sure you want to delete administrator "' + (admin.name || admin.email) + '"? This action cannot be undone.')) {
+      var confirmed = typeof confirmAction === 'function'
+        ? await confirmAction({
+            title: 'Delete Administrator',
+            message: 'Are you sure you want to delete administrator "' + (admin.name || admin.email) + '"? This action cannot be undone.',
+            danger: true,
+            confirmText: 'Delete'
+          })
+        : confirm('Are you sure you want to delete administrator "' + (admin.name || admin.email) + '"? This action cannot be undone.');
+
+      if (!confirmed) {
         return;
       }
       vnode.state.loading = true;
@@ -506,9 +515,15 @@ const AdminUsersPage = {
       try {
         await api.delete('/admins/' + encodeURIComponent(admin.id));
         vnode.state.success = 'Administrator deleted successfully';
+        if (typeof notifySuccess === 'function') {
+          notifySuccess('Administrator deleted successfully');
+        }
         await vnode.state.loadAdmins();
       } catch (err) {
         vnode.state.error = err.message || 'Failed to delete administrator';
+        if (typeof notifyError === 'function') {
+          notifyError(vnode.state.error);
+        }
         vnode.state.loading = false;
         m.redraw();
       }

package/plugins/admin-panel/modules/bulk-actions.js

@@ -22,12 +22,15 @@ function registerDefaultBulkActions(options) {
     confirm: true,
     confirmMessage: 'Restore the selected records?',
     handler: async (records, modelName, { db }) => {
+      const targetModel = typeof modelName === 'object' && modelName !== null
+        ? (modelName.name || modelName.modelName || modelName.model || String(modelName))
+        : String(modelName);
       const { getModel } = require('../../../core/orm/model');
-      const model = db.getModel ? db.getModel(modelName) : getModel(modelName);
+      const model = db.getModel ? db.getModel(targetModel) : getModel(targetModel);
       if (!model?.scopes?.softDelete) {
         return { message: 'Model does not support restore', error: true };
       }
-      const repo = db.getRepository(modelName);
+      const repo = db.getRepository(targetModel);
       let restored = 0;
       for (const record of records) {
         try {
@@ -48,9 +51,11 @@ function registerDefaultBulkActions(options) {
     color: 'red',
     models: '*',
     confirm: true,
-    confirmMessage: 'Are you sure you want to delete the selected records? This action cannot be undone.',
     handler: async (records, model, { db }) => {
-      const repo = db.getRepository(model);
+      const targetModel = typeof model === 'object' && model !== null
+        ? (model.name || model.modelName || model.model || String(model))
+        : String(model);
+      const repo = db.getRepository(targetModel);
       let deleted = 0;
       
       for (const record of records) {
@@ -131,7 +136,10 @@ function createFieldUpdateBulkAction(modelName, field, value, options = {}) {
     confirm,
     confirmMessage,
     handler: async (records, model, { db }) => {
-      const repo = db.getRepository(model);
+      const targetModel = typeof model === 'object' && model !== null
+        ? (model.name || model.modelName || model.model || String(model))
+        : String(model);
+      const repo = db.getRepository(targetModel);
       let updated = 0;
 
       for (const record of records) {