webspresso 0.0.97 → 0.0.99

package/plugins/admin-panel/modules/dashboard.js

@@ -135,6 +135,176 @@ function registerDashboardWidgets(options) {
       return actions.slice(0, 5); // Max 5 quick actions
     },
   });
+
+  // Database Storage & Health widget
+  registry.registerWidget('database-storage', {
+    title: 'Database Storage & Health',
+    size: 'full',
+    order: 15,
+    dataLoader: async ({ db }) => {
+      return await collectDatabaseStorageStats(db);
+    },
+  });
+}
+
+/**
+ * Collect database storage and health statistics
+ * @param {Object} db - Database instance
+ * @returns {Promise<Object>}
+ */
+async function collectDatabaseStorageStats(db) {
+  if (!db || !db.knex) {
+    return {
+      engine: 'Unknown',
+      totalTables: 0,
+      totalRows: 0,
+      overallHealth: 'healthy',
+      tables: [],
+      sqliteInfo: null,
+    };
+  }
+
+  const clientName = String(db.knex.client?.config?.client || 'unknown').toLowerCase();
+  const isSqlite = clientName.includes('sqlite');
+  const isPostgres = clientName.includes('pg') || clientName.includes('postgres');
+  const isMysql = clientName.includes('mysql');
+
+  const { getAllModels } = require('../../../core/orm/model');
+  const allModels = db.getAllModels ? db.getAllModels() : Array.from(getAllModels().values());
+  const modelList = Array.isArray(allModels) ? allModels : Array.from(allModels.values());
+  const modelByTable = new Map();
+  for (const m of modelList) {
+    if (m.table) modelByTable.set(m.table, m);
+  }
+
+  // 1. Discover table names
+  const tableNamesSet = new Set();
+
+  try {
+    if (isSqlite) {
+      const res = await db.knex.raw("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%';");
+      const rows = Array.isArray(res) ? res : (res?.rows || []);
+      for (const r of rows) {
+        if (r && r.name) tableNamesSet.add(r.name);
+      }
+    } else if (isPostgres) {
+      const res = await db.knex.raw("SELECT table_name as name FROM information_schema.tables WHERE table_schema='public';");
+      const rows = res?.rows || (Array.isArray(res) ? res : []);
+      for (const r of rows) {
+        if (r && r.name) tableNamesSet.add(r.name);
+      }
+    } else if (isMysql) {
+      const res = await db.knex.raw('SHOW TABLES;');
+      const rows = Array.isArray(res) && Array.isArray(res[0]) ? res[0] : (Array.isArray(res) ? res : []);
+      for (const r of rows) {
+        const val = Object.values(r || {})[0];
+        if (val) tableNamesSet.add(val);
+      }
+    }
+  } catch (e) {
+    // If raw query fails, fall back to known tables
+  }
+
+  // Always include model tables and known system tables
+  for (const m of modelList) {
+    if (m.table) tableNamesSet.add(m.table);
+  }
+  const knownSystemTables = [
+    'admin_users',
+    'admin_activity_logs',
+    'audit_logs',
+    'email_logs',
+    'webspresso_jobs',
+    'analytics_page_views',
+    'analytics_sessions',
+    'knex_migrations',
+  ];
+  for (const t of knownSystemTables) {
+    tableNamesSet.add(t);
+  }
+
+  const tables = [];
+  let totalRows = 0;
+  let hasAttention = false;
+
+  for (const table of tableNamesSet) {
+    try {
+      const exists = await db.knex.schema.hasTable(table);
+      if (!exists) continue;
+
+      const countRes = await db.knex(table).count('* as count').first();
+      const countVal = countRes ? (countRes.count ?? countRes['count(*)'] ?? countRes['COUNT(*)'] ?? 0) : 0;
+      const count = parseInt(countVal, 10) || 0;
+      totalRows += count;
+
+      let category = 'system';
+      const model = modelByTable.get(table);
+      if (model) {
+        category = 'orm';
+      } else if (table === 'audit_logs' || table === 'email_logs' || table === 'admin_activity_logs') {
+        category = 'logs';
+      } else if (table.startsWith('analytics_')) {
+        category = 'analytics';
+      } else if (table.includes('jobs') || table.includes('queue')) {
+        category = 'queue';
+      }
+
+      // Attention flag if logs or queue tables exceed 25,000 rows
+      const isHighVolume = (category === 'logs' || category === 'analytics' || category === 'queue') && count > 25000;
+      if (isHighVolume) hasAttention = true;
+
+      tables.push({
+        table,
+        count,
+        category,
+        modelName: model ? model.name : null,
+        modelLabel: model?.admin?.label || (model ? model.name : null),
+        modelIcon: model?.admin?.icon || null,
+        isHighVolume,
+      });
+    } catch (e) {
+      // Table query error, ignore
+    }
+  }
+
+  // Sort tables by row count descending
+  tables.sort((a, b) => b.count - a.count);
+
+  // SQLite storage stats if available
+  let sqliteInfo = null;
+  if (isSqlite) {
+    try {
+      const pageCountRes = await db.knex.raw('PRAGMA page_count;');
+      const pageSizeRes = await db.knex.raw('PRAGMA page_size;');
+      const freelistRes = await db.knex.raw('PRAGMA freelist_count;');
+
+      const pageCount = (pageCountRes[0]?.page_count ?? pageCountRes[0]?.[0]) || 0;
+      const pageSize = (pageSizeRes[0]?.page_size ?? pageSizeRes[0]?.[0]) || 4096;
+      const freelistCount = (freelistRes[0]?.freelist_count ?? freelistRes[0]?.[0]) || 0;
+
+      const sizeBytes = pageCount * pageSize;
+      const freeBytes = freelistCount * pageSize;
+      const fragmentation = pageCount > 0 ? ((freelistCount / pageCount) * 100).toFixed(1) : 0;
+
+      sqliteInfo = {
+        pageCount,
+        pageSize,
+        freelistCount,
+        sizeBytes,
+        freeBytes,
+        fragmentation: Number(fragmentation),
+      };
+    } catch (e) {}
+  }
+
+  return {
+    engine: isSqlite ? 'SQLite' : isPostgres ? 'PostgreSQL' : isMysql ? 'MySQL' : clientName,
+    totalTables: tables.length,
+    totalRows,
+    overallHealth: hasAttention ? 'attention' : 'healthy',
+    tables,
+    sqliteInfo,
+  };
 }
 
 /**
@@ -299,6 +469,118 @@ const WidgetRenderers = {
     },
   },
 
+  // Database Storage & Health Widget
+  'database-storage': {
+    render: (data) => {
+      if (!data) return m('div.text-gray-500.dark:text-slate-400', 'No data');
+      const totalRows = data.totalRows || 0;
+      const tables = data.tables || [];
+      const isAttention = data.overallHealth === 'attention';
+
+      function formatStorageBytes(bytes) {
+        if (!bytes || bytes <= 0) return '0 B';
+        const k = 1024;
+        const sizes = ['B', 'KB', 'MB', 'GB', 'TB'];
+        const i = Math.floor(Math.log(bytes) / Math.log(k));
+        return parseFloat((bytes / Math.pow(k, i)).toFixed(1)) + ' ' + sizes[i];
+      }
+
+      const categoryStyles = {
+        orm: { bg: 'bg-blue-100 dark:bg-blue-950/60', text: 'text-blue-700 dark:text-blue-300', bar: 'bg-blue-600' },
+        logs: { bg: 'bg-amber-100 dark:bg-amber-950/60', text: 'text-amber-800 dark:text-amber-300', bar: 'bg-amber-500' },
+        analytics: { bg: 'bg-purple-100 dark:bg-purple-950/60', text: 'text-purple-700 dark:text-purple-300', bar: 'bg-purple-600' },
+        queue: { bg: 'bg-rose-100 dark:bg-rose-950/60', text: 'text-rose-700 dark:text-rose-300', bar: 'bg-rose-500' },
+        system: { bg: 'bg-gray-100 dark:bg-slate-800', text: 'text-gray-700 dark:text-slate-300', bar: 'bg-gray-500' },
+      };
+
+      return m('div.space-y-4', [
+        // 4 Metric Tiles
+        m('div.grid.grid-cols-2.sm:grid-cols-4.gap-3', [
+          m('div.p-3.bg-gray-50.dark:bg-slate-900.rounded-xl.border.border-gray-200.dark:border-slate-800', [
+            m('p.text-xs.font-medium.text-gray-500.dark:text-slate-400', 'Database Engine'),
+            m('p.text-lg.font-bold.text-gray-900.dark:text-slate-100.mt-1', data.engine || 'SQL'),
+            data.sqliteInfo && data.sqliteInfo.sizeBytes > 0
+              ? m('p.text-xs.text-blue-600.dark:text-blue-400.mt-0.5', formatStorageBytes(data.sqliteInfo.sizeBytes))
+              : null,
+          ]),
+          m('div.p-3.bg-gray-50.dark:bg-slate-900.rounded-xl.border.border-gray-200.dark:border-slate-800', [
+            m('p.text-xs.font-medium.text-gray-500.dark:text-slate-400', 'Total Tables'),
+            m('p.text-lg.font-bold.text-gray-900.dark:text-slate-100.mt-1', data.totalTables || 0),
+            m('p.text-xs.text-gray-400.dark:text-slate-500.mt-0.5', 'Active in schema'),
+          ]),
+          m('div.p-3.bg-gray-50.dark:bg-slate-900.rounded-xl.border.border-gray-200.dark:border-slate-800', [
+            m('p.text-xs.font-medium.text-gray-500.dark:text-slate-400', 'Total Records'),
+            m('p.text-lg.font-bold.text-gray-900.dark:text-slate-100.mt-1', totalRows.toLocaleString()),
+            m('p.text-xs.text-gray-400.dark:text-slate-500.mt-0.5', 'Across all tables'),
+          ]),
+          m('div.p-3.rounded-xl.border', {
+            class: isAttention
+              ? 'bg-amber-50.border-amber-200.dark:bg-amber-950/40.dark:border-amber-800/80'
+              : 'bg-emerald-50.border-emerald-200.dark:bg-emerald-950/40.dark:border-emerald-800/80'
+          }, [
+            m('p.text-xs.font-medium', {
+              class: isAttention ? 'text-amber-700 dark:text-amber-300' : 'text-emerald-700 dark:text-emerald-300'
+            }, 'Storage Health'),
+            m('div.flex.items-center.gap-1.5.mt-1', [
+              m('span.w-2.5.h-2.5.rounded-full', {
+                class: isAttention ? 'bg-amber-500 animate-pulse' : 'bg-emerald-500'
+              }),
+              m('p.text-lg.font-bold', {
+                class: isAttention ? 'text-amber-800 dark:text-amber-200' : 'text-emerald-800 dark:text-emerald-200'
+              }, isAttention ? 'Attention' : 'Healthy'),
+            ]),
+            m('p.text-xs.mt-0.5', {
+              class: isAttention ? 'text-amber-600 dark:text-amber-400' : 'text-emerald-600 dark:text-emerald-400'
+            }, isAttention ? 'High row count in logs' : 'No table bloat detected'),
+          ]),
+        ]),
+
+        // Table Breakdown List with Progress Bars
+        m('div.bg-gray-50.dark:bg-slate-900.rounded-xl.border.border-gray-200.dark:border-slate-800.p-4', [
+          m('div.flex.items-center.justify-between.mb-3', [
+            m('h4.text-xs.font-bold.uppercase.tracking-wider.text-gray-500.dark:text-slate-400', 'Top Tables by Row Count'),
+            m('span.text-xs.text-gray-400.dark:text-slate-500', tables.length + ' tables'),
+          ]),
+          tables.length === 0
+            ? m('p.text-xs.text-gray-400.text-center.py-4', 'No tables detected')
+            : m('div.space-y-2.5', tables.slice(0, 8).map(t => {
+                const pct = totalRows > 0 ? ((t.count / totalRows) * 100).toFixed(1) : 0;
+                const style = categoryStyles[t.category] || categoryStyles.system;
+
+                return m('div.flex.flex-col.gap-1', [
+                  m('div.flex.items-center.justify-between.text-xs', [
+                    m('div.flex.items-center.gap-2', [
+                      t.modelName
+                        ? m('a.font-semibold.text-blue-600.dark:text-blue-400.hover:underline', {
+                            href: '/models/' + t.modelName,
+                            onclick: (e) => { e.preventDefault(); m.route.set('/models/' + t.modelName); }
+                          }, (t.modelIcon ? t.modelIcon + ' ' : '') + t.table)
+                        : m('span.font-medium.text-gray-800.dark:text-slate-200', t.table),
+                      m('span.px-1.5.py-0.5.rounded.text-[10px].font-medium', {
+                        class: style.bg + ' ' + style.text
+                      }, t.category.toUpperCase()),
+                      t.isHighVolume
+                        ? m('span.text-[10px].text-amber-600.dark:text-amber-400.font-medium', '⚠️ High volume')
+                        : null,
+                    ]),
+                    m('div.flex.items-center.gap-2', [
+                      m('span.font-semibold.text-gray-900.dark:text-slate-100', t.count.toLocaleString() + ' rows'),
+                      m('span.text-gray-400.dark:text-slate-500.w-10.text-right', pct + '%'),
+                    ])
+                  ]),
+                  m('div.w-full.bg-gray-200.dark:bg-slate-700.rounded-full.h-1.5.overflow-hidden', [
+                    m('div.h-1.5.rounded-full.transition-all', {
+                      class: style.bar,
+                      style: { width: Math.max(1, Math.min(100, Number(pct))) + '%' }
+                    })
+                  ])
+                ]);
+              }))
+        ])
+      ]);
+    }
+  },
+
   // Default renderer
   default: {
     render: (data) => {
@@ -473,4 +755,5 @@ const Dashboard = {
 module.exports = {
   registerDashboardWidgets,
   generateDashboardComponent,
+  collectDatabaseStorageStats,
 };

package/plugins/admin-panel/modules/menu.js

@@ -10,32 +10,68 @@
  * @param {Object} options.registry - Admin registry
  * @param {Object} options.db - Database instance
  */
-function registerModelMenuItems(options) {
-  const { registry, db } = options;
+function registerModelMenuItems(options, maybeModels) {
+  let registry = options?.registry;
+  let db = options?.db;
+  let models = options?.models;
+
+  if (!registry && options && typeof options.registerMenuItem === 'function') {
+    registry = options;
+  }
+  if (Array.isArray(maybeModels)) {
+    models = maybeModels;
+  }
+
   const { getAllModels } = require('../../../core/orm/model');
 
-  // Get all admin-enabled models
-  const allModels = db.getAllModels ? db.getAllModels() : Array.from(getAllModels().values());
-  const modelList = Array.isArray(allModels) ? allModels : Array.from(allModels.values());
+  let modelList;
+  if (Array.isArray(models)) {
+    modelList = models;
+  } else if (db && typeof db.getAllModels === 'function') {
+    const res = db.getAllModels();
+    modelList = Array.isArray(res) ? res : Array.from(res.values());
+  } else if (getAllModels) {
+    modelList = Array.from(getAllModels().values());
+  } else {
+    modelList = [];
+  }
 
   // Create "Content" menu group for models
-  registry.registerMenuGroup('content', {
-    label: 'Content',
-    icon: 'database',
-    order: 0,
-  });
+  if (registry && typeof registry.registerMenuGroup === 'function') {
+    registry.registerMenuGroup('content', {
+      label: 'Content',
+      icon: 'database',
+      order: 0,
+    });
+  }
 
   // Register menu items for each model
   for (const model of modelList) {
     if (model.admin?.enabled) {
-      registry.registerMenuItem({
-        id: `model-${model.name}`,
-        label: model.admin.label || model.name,
-        path: `/models/${model.name}`,
-        icon: model.admin.icon || 'table',
-        group: 'content',
-        order: model.admin.menuOrder || 10,
-      });
+      let group = 'content';
+      if (model.admin.group) {
+        group = String(model.admin.group).toLowerCase().trim().replace(/\s+/g, '-');
+        const hasGroup = registry.menuGroups && typeof registry.menuGroups.has === 'function'
+          ? registry.menuGroups.has(group)
+          : false;
+        if (!hasGroup && registry && typeof registry.registerMenuGroup === 'function') {
+          registry.registerMenuGroup(group, {
+            label: model.admin.group,
+            icon: 'database',
+            order: model.admin.groupOrder || 50,
+          });
+        }
+      }
+      if (registry && typeof registry.registerMenuItem === 'function') {
+        registry.registerMenuItem({
+          id: `model-${model.name}`,
+          label: model.admin.label || model.name,
+          path: `/models/${model.name}`,
+          icon: model.admin.icon || 'table',
+          group,
+          order: model.admin.menuOrder || 10,
+        });
+      }
     }
   }
 }
@@ -481,6 +517,8 @@ const Layout = {
       m(Sidebar),
       m('main.lg:ml-64.p-6.pt-20.lg:pt-6', vnode.children),
       m(VersionUpdateToast),
+      typeof ToastContainer !== 'undefined' ? m(ToastContainer) : null,
+      typeof ConfirmModalContainer !== 'undefined' ? m(ConfirmModalContainer) : null,
     ]);
   },
 };

package/plugins/admin-panel/modules/user-management.js

@@ -191,7 +191,10 @@ function registerUserManagement(options) {
     models: modelName,
     visible: (record) => !record[fieldMap.active],
     handler: async (record, model, { db }) => {
-      const repo = db.getRepository(model);
+      const targetModel = typeof model === 'object' && model !== null
+        ? (model.name || model.modelName || model.model || String(model))
+        : String(model);
+      const repo = db.getRepository(targetModel);
       await repo.update(record.id, { [fieldMap.active]: true });
       return { message: 'User activated' };
     },
@@ -204,7 +207,10 @@ function registerUserManagement(options) {
     models: modelName,
     visible: (record) => record[fieldMap.active],
     handler: async (record, model, { db }) => {
-      const repo = db.getRepository(model);
+      const targetModel = typeof model === 'object' && model !== null
+        ? (model.name || model.modelName || model.model || String(model))
+        : String(model);
+      const repo = db.getRepository(targetModel);
       await repo.update(record.id, { [fieldMap.active]: false });
       return { message: 'User deactivated' };
     },
@@ -218,7 +224,10 @@ function registerUserManagement(options) {
     confirm: true,
     confirmMessage: 'This will generate a new random password. Continue?',
     handler: async (record, model, { db }) => {
-      const repo = db.getRepository(model);
+      const targetModel = typeof model === 'object' && model !== null
+        ? (model.name || model.modelName || model.model || String(model))
+        : String(model);
+      const repo = db.getRepository(targetModel);
       // Generate random password
       const newPassword = generateRandomPassword(12);
       const hashedPassword = await hash(newPassword);
@@ -234,7 +243,10 @@ function registerUserManagement(options) {
     color: 'green',
     models: modelName,
     handler: async (records, model, { db }) => {
-      const repo = db.getRepository(model);
+      const targetModel = typeof model === 'object' && model !== null
+        ? (model.name || model.modelName || model.model || String(model))
+        : String(model);
+      const repo = db.getRepository(targetModel);
       for (const record of records) {
         await repo.update(record.id, { [fieldMap.active]: true });
       }
@@ -248,7 +260,10 @@ function registerUserManagement(options) {
     color: 'red',
     models: modelName,
     handler: async (records, model, { db }) => {
-      const repo = db.getRepository(model);
+      const targetModel = typeof model === 'object' && model !== null
+        ? (model.name || model.modelName || model.model || String(model))
+        : String(model);
+      const repo = db.getRepository(targetModel);
       for (const record of records) {
         await repo.update(record.id, { [fieldMap.active]: false });
       }
@@ -264,7 +279,10 @@ function registerUserManagement(options) {
     confirm: true,
     confirmMessage: 'Are you sure you want to delete the selected users? This cannot be undone.',
     handler: async (records, model, { db }) => {
-      const repo = db.getRepository(model);
+      const targetModel = typeof model === 'object' && model !== null
+        ? (model.name || model.modelName || model.model || String(model))
+        : String(model);
+      const repo = db.getRepository(targetModel);
       for (const record of records) {
         await repo.delete(record.id);
       }

package/plugins/api-key/crypto.js

@@ -0,0 +1,101 @@
+/**
+ * API Key Plugin — Cryptographic Utilities
+ * Zero external dependencies (uses native Node.js crypto)
+ * @module plugins/api-key/crypto
+ */
+
+'use strict';
+
+const crypto = require('crypto');
+
+/**
+ * Compare two strings in constant time to prevent timing attacks.
+ * Uses dummy buffer comparison if lengths differ to avoid leaking length via response timing.
+ * 
+ * @param {string} a
+ * @param {string} b
+ * @returns {boolean}
+ */
+function safeCompare(a, b) {
+  if (typeof a !== 'string' || typeof b !== 'string') {
+    return false;
+  }
+
+  const bufA = Buffer.from(a, 'utf8');
+  const bufB = Buffer.from(b, 'utf8');
+
+  if (bufA.length !== bufB.length) {
+    // Perform dummy timing-safe comparison with itself to preserve constant execution time
+    crypto.timingSafeEqual(bufA, bufA);
+    return false;
+  }
+
+  return crypto.timingSafeEqual(bufA, bufB);
+}
+
+/**
+ * Hash a raw API key using SHA-256
+ * 
+ * @param {string} rawKey
+ * @returns {string} Hex-encoded SHA-256 hash (64 characters)
+ */
+function hashKey(rawKey) {
+  if (typeof rawKey !== 'string' || rawKey.length === 0) {
+    return '';
+  }
+  return crypto.createHash('sha256').update(rawKey, 'utf8').digest('hex');
+}
+
+/**
+ * Mask an API key for safe UI display and logs.
+ * Shows prefix + '...' + last 4 characters.
+ * 
+ * @param {string} rawKey
+ * @param {string} [prefix='wsp_live_']
+ * @returns {string}
+ */
+function maskKey(rawKey, prefix = 'wsp_live_') {
+  if (!rawKey || typeof rawKey !== 'string') {
+    return '****';
+  }
+
+  if (rawKey.length <= 8) {
+    return '****';
+  }
+
+  const last4 = rawKey.slice(-4);
+  const effectivePrefix = rawKey.startsWith(prefix) ? prefix : rawKey.slice(0, Math.min(prefix.length, 9));
+  return `${effectivePrefix}...${last4}`;
+}
+
+/**
+ * Generate a cryptographically secure API key
+ * 
+ * @param {Object} [options]
+ * @param {string} [options.prefix='wsp_live_'] - Prefix for the key
+ * @param {number} [options.byteLength=24] - Number of random bytes (produces 32 base64url chars)
+ * @returns {{ key: string, hash: string, hint: string, prefix: string }}
+ */
+function generateKey(options = {}) {
+  const prefix = typeof options.prefix === 'string' ? options.prefix : 'wsp_live_';
+  const byteLength = typeof options.byteLength === 'number' && options.byteLength > 0 ? options.byteLength : 24;
+
+  const randomPart = crypto.randomBytes(byteLength).toString('base64url');
+  const key = `${prefix}${randomPart}`;
+  const hash = hashKey(key);
+  const hint = maskKey(key, prefix);
+
+  return {
+    key,
+    hash,
+    hint,
+    prefix,
+  };
+}
+
+module.exports = {
+  safeCompare,
+  hashKey,
+  maskKey,
+  generateKey,
+};