webspresso 0.0.97 → 0.0.99

package/bin/commands/typegen.js

@@ -0,0 +1,106 @@
+'use strict';
+
+/**
+ * Webspresso CLI - typegen / types Command
+ * Generate TypeScript type definitions and IDE auto-complete for models, services, and routes
+ * @module bin/commands/typegen
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { generateTypes } = require('../../src/dev/typegen');
+
+function registerCommand(program) {
+  program
+    .command('typegen')
+    .alias('types')
+    .alias('generate:types')
+    .description('Generate TypeScript type definitions and IDE auto-complete for models, services, and routes')
+    .option('-o, --out <file>', 'Output declaration file path (default: .webspresso/types.d.ts)')
+    .option('-r, --root <dir>', 'Root directory of the project', process.cwd())
+    .option('--models <dir>', 'Models directory relative to root')
+    .option('--services <dir>', 'Services directory relative to root')
+    .option('--pages <dir>', 'Pages directory relative to root', 'pages')
+    .option('--no-env-file', 'Skip generating webspresso-env.d.ts at project root')
+    .option('-w, --watch', 'Watch models, services, and pages directories for changes')
+    .option('-s, --silent', 'Suppress console output', false)
+    .action((options) => {
+      const rootDir = path.resolve(options.root || process.cwd());
+
+      const runOnce = () => {
+        const startTime = Date.now();
+        const result = generateTypes({
+          rootDir,
+          modelsDir: options.models,
+          servicesDir: options.services,
+          pagesDir: options.pages,
+          outFile: options.out,
+          createEnvFile: options.envFile !== false,
+          silent: true,
+        });
+
+        const elapsed = Date.now() - startTime;
+        if (!options.silent) {
+          const relOut = path.relative(rootDir, result.outFile);
+          console.log(`\n⚡ [Webspresso TypeGen] Completed in ${elapsed}ms`);
+          console.log(`   ✓ Models:   ${result.modelsCount}`);
+          console.log(`   ✓ Services: ${result.servicesCount}`);
+          console.log(`   ✓ Routes:   ${result.routesCount}`);
+          console.log(`   → Output:   ${relOut}`);
+          if (result.envFile) {
+            console.log(`   → Env Ref:  ${path.relative(rootDir, result.envFile)}`);
+          }
+          console.log('');
+        }
+        return result;
+      };
+
+      runOnce();
+
+      // Watch mode
+      if (options.watch) {
+        if (!options.silent) {
+          console.log('👀 Watching models, services, and pages for changes... (Press Ctrl+C to stop)\n');
+        }
+
+        const watchDirs = [
+          options.models || 'models',
+          options.models || 'src/models',
+          options.services || 'services',
+          options.services || 'src/services',
+          options.pages || 'pages',
+          options.pages || 'src/pages',
+        ]
+          .map((d) => path.resolve(rootDir, d))
+          .filter((d) => fs.existsSync(d));
+
+        const uniqueDirs = Array.from(new Set(watchDirs));
+        let debounceTimer = null;
+
+        for (const dir of uniqueDirs) {
+          try {
+            fs.watch(dir, { recursive: true }, (eventType, filename) => {
+              if (
+                filename &&
+                (filename.endsWith('.js') || filename.endsWith('.ts') || filename.endsWith('.njk'))
+              ) {
+                if (debounceTimer) clearTimeout(debounceTimer);
+                debounceTimer = setTimeout(() => {
+                  if (!options.silent) {
+                    console.log(`🔄 Detected change in ${filename}, regenerating types...`);
+                  }
+                  runOnce();
+                }, 150);
+              }
+            });
+          } catch {
+            // Watch unsupported on platform or directory
+          }
+        }
+      }
+    });
+}
+
+module.exports = {
+  registerCommand,
+};

package/bin/commands/upload-prune.js

@@ -0,0 +1,79 @@
+/**
+ * Prune unreferenced / orphaned uploaded files (CLI)
+ */
+
+'use strict';
+
+const path = require('path');
+const { loadDbConfig, createDbInstance } = require('../utils/db');
+const { pruneOrphanedUploads } = require('../../plugins/upload/orphan-pruner');
+
+function registerCommand(program) {
+  program
+    .command('upload:prune')
+    .description('Scan and delete orphaned files in the uploads directory not referenced by any database model')
+    .option('--dir <path>', 'Custom uploads directory path (default: public/uploads)')
+    .option('--url-base <path>', 'Public URL base path (default: /uploads)', '/uploads')
+    .option('--dry-run', 'Scan and list orphaned files without deleting them', false)
+    .option('-e, --env <environment>', 'Environment (development, production)', 'development')
+    .option('-c, --config <path>', 'Path to database config file')
+    .action(async (options) => {
+      const { config, path: configPath } = loadDbConfig(options.config);
+      console.log(`\n📦 Using config: ${configPath}`);
+      console.log(`   Environment: ${options.env}\n`);
+
+      const knex = await createDbInstance(config, options.env);
+      const db = { knex };
+
+      try {
+        const destDir = options.dir
+          ? path.resolve(process.cwd(), options.dir)
+          : path.resolve(process.cwd(), 'public', 'uploads');
+
+        console.log(`🔍 Scanning directory: ${destDir}`);
+        console.log(`   Public URL base: ${options.urlBase}`);
+        if (options.dryRun) {
+          console.log(`   Mode: DRY RUN (no files will be deleted)\n`);
+        } else {
+          console.log(`   Mode: PRUNE & DELETE\n`);
+        }
+
+        const result = await pruneOrphanedUploads({
+          db,
+          destDir,
+          publicBasePath: options.urlBase,
+          dryRun: options.dryRun,
+        });
+
+        console.log(`📊 Scan Summary:`);
+        console.log(`   Total files on disk: ${result.totalFiles} (${result.totalBytesFormatted})`);
+        console.log(`   Referenced by DB:   ${result.referencedCount}`);
+        console.log(`   Orphaned files:     ${result.orphanedCount} (${result.orphanedBytesFormatted})\n`);
+
+        if (result.orphanedCount === 0) {
+          console.log(`✅ No orphaned files found. Storage is clean!\n`);
+          return;
+        }
+
+        if (options.dryRun) {
+          console.log(`ℹ️ [DRY RUN] The following ${result.orphanedCount} file(s) would be deleted:`);
+          for (const file of result.orphanedFiles.slice(0, 20)) {
+            console.log(`   - ${file.relativePath} (${file.publicUrl})`);
+          }
+          if (result.orphanedFiles.length > 20) {
+            console.log(`   ... and ${result.orphanedFiles.length - 20} more file(s)`);
+          }
+          console.log(`\n💡 To permanently delete these files, run without --dry-run.\n`);
+        } else {
+          console.log(`🗑️ Successfully deleted ${result.deletedCount} orphaned file(s) (${result.deletedBytesFormatted} reclaimed).\n`);
+        }
+      } catch (err) {
+        console.error('❌ upload:prune failed:', err.message);
+        process.exit(1);
+      } finally {
+        await knex.destroy();
+      }
+    });
+}
+
+module.exports = { registerCommand };

package/bin/webspresso.js

@@ -18,7 +18,9 @@ const { registerCommand: registerPage } = require('./commands/page');
 const { registerCommand: registerApi } = require('./commands/api');
 const { registerCommand: registerDev } = require('./commands/dev');
 const { registerCommand: registerStart } = require('./commands/start');
+const { registerCommand: registerBuild } = require('./commands/build');
 const { registerCommand: registerAddTailwind } = require('./commands/add-tailwind');
+const { registerCommand: registerAddEsbuild } = require('./commands/add-esbuild');
 const { registerCommand: registerDbMigrate } = require('./commands/db-migrate');
 const { registerCommand: registerDbRollback } = require('./commands/db-rollback');
 const { registerCommand: registerDbStatus } = require('./commands/db-status');
@@ -29,6 +31,10 @@ const { registerCommand: registerAdminSetup } = require('./commands/admin-setup'
 const { registerCommand: registerAdminPassword } = require('./commands/admin-password');
 const { registerCommand: registerFaviconGenerate } = require('./commands/favicon-generate');
 const { registerCommand: registerAuditPrune } = require('./commands/audit-prune');
+const { registerCommand: registerAnalyticsPrune } = require('./commands/analytics-prune');
+const { registerCommand: registerEmailPrune } = require('./commands/email-prune');
+const { registerCommand: registerQueuePrune } = require('./commands/queue-prune');
+const { registerCommand: registerUploadPrune } = require('./commands/upload-prune');
 const { registerCommand: registerDoctor } = require('./commands/doctor');
 const { registerCommand: registerUpgrade } = require('./commands/upgrade');
 const { registerCommand: registerOrmMap } = require('./commands/orm-map');
@@ -36,13 +42,20 @@ const { registerCommand: registerService } = require('./commands/service');
 const { registerCommand: registerMcp } = require('./commands/mcp');
 const { registerCommand: registerPolarMigrate } = require('./commands/polar-migrate');
 const { registerCommand: registerAgentsInit } = require('./commands/agents-init');
+const { registerCommand: registerRoutes } = require('./commands/routes');
+const { registerCommand: registerMakeModel } = require('./commands/make-model');
+const { registerCommand: registerMakeJob } = require('./commands/make-job');
+const { registerCommand: registerOpenapi } = require('./commands/openapi');
+const { registerCommand: registerTypegen } = require('./commands/typegen');
 
 registerNew(program);
 registerPage(program);
 registerApi(program);
 registerDev(program);
 registerStart(program);
+registerBuild(program);
 registerAddTailwind(program);
+registerAddEsbuild(program);
 registerDbMigrate(program);
 registerDbRollback(program);
 registerDbStatus(program);
@@ -53,6 +66,10 @@ registerAdminSetup(program);
 registerAdminPassword(program);
 registerFaviconGenerate(program);
 registerAuditPrune(program);
+registerAnalyticsPrune(program);
+registerEmailPrune(program);
+registerQueuePrune(program);
+registerUploadPrune(program);
 registerDoctor(program);
 registerUpgrade(program);
 registerOrmMap(program);
@@ -60,6 +77,11 @@ registerService(program);
 registerMcp(program);
 registerPolarMigrate(program);
 registerAgentsInit(program);
+registerRoutes(program);
+registerMakeModel(program);
+registerMakeJob(program);
+registerOpenapi(program);
+registerTypegen(program);
 
 // Parse arguments
 program.parse();

package/core/applySchema.js

@@ -3,6 +3,12 @@
  * Parses and validates request input against compiled schemas
  */
 
+const EMPTY_INPUT = Object.freeze({
+  body: undefined,
+  params: undefined,
+  query: undefined,
+});
+
 /**
  * Apply compiled schema to request
  * Parses body, params, and query against their respective schemas
@@ -14,18 +20,19 @@
  * @throws {ZodError} If validation fails
  */
 function applySchema(req, compiledSchema) {
+  // No schema means no validation
+  if (!compiledSchema) {
+    req.input = EMPTY_INPUT;
+    return;
+  }
+
   // Initialize req.input
   req.input = {
     body: undefined,
     params: undefined,
-    query: undefined
+    query: undefined,
   };
 
-  // No schema means no validation
-  if (!compiledSchema) {
-    return;
-  }
-
   // Parse body if schema exists
   if (compiledSchema.body) {
     req.input.body = compiledSchema.body.parse(req.body);

package/core/auth/hash.js

@@ -4,12 +4,18 @@
  * @module core/auth/hash
  */
 
-let bcrypt;
-try {
-  bcrypt = require('bcrypt');
-} catch {
-  // bcrypt is optional, will throw if used without installation
-  bcrypt = null;
+let bcrypt = null;
+let bcryptChecked = false;
+function getBcrypt() {
+  if (!bcryptChecked) {
+    bcryptChecked = true;
+    try {
+      bcrypt = require('bcrypt');
+    } catch {
+      bcrypt = null;
+    }
+  }
+  return bcrypt;
 }
 
 /**
@@ -25,7 +31,8 @@ const DEFAULT_ROUNDS = process.env.NODE_ENV === 'test' ? 1 : 12;
  * @returns {Promise<string>} Hashed password
  */
 async function hash(password, rounds = DEFAULT_ROUNDS) {
-  if (!bcrypt) {
+  const b = getBcrypt();
+  if (!b) {
     throw new Error('bcrypt is required for password hashing. Install it with: npm install bcrypt');
   }
   
@@ -33,7 +40,7 @@ async function hash(password, rounds = DEFAULT_ROUNDS) {
     throw new Error('Password must be a non-empty string');
   }
   
-  return bcrypt.hash(password, rounds);
+  return b.hash(password, rounds);
 }
 
 /**
@@ -43,7 +50,8 @@ async function hash(password, rounds = DEFAULT_ROUNDS) {
  * @returns {Promise<boolean>} True if password matches
  */
 async function verify(password, hashedPassword) {
-  if (!bcrypt) {
+  const b = getBcrypt();
+  if (!b) {
     throw new Error('bcrypt is required for password verification. Install it with: npm install bcrypt');
   }
   
@@ -52,7 +60,7 @@ async function verify(password, hashedPassword) {
   }
   
   try {
-    return await bcrypt.compare(password, hashedPassword);
+    return await b.compare(password, hashedPassword);
   } catch {
     return false;
   }
@@ -65,7 +73,8 @@ async function verify(password, hashedPassword) {
  * @returns {boolean} True if rehash is needed
  */
 function needsRehash(hashedPassword, rounds = DEFAULT_ROUNDS) {
-  if (!bcrypt) {
+  const b = getBcrypt();
+  if (!b) {
     throw new Error('bcrypt is required. Install it with: npm install bcrypt');
   }
   
@@ -74,7 +83,7 @@ function needsRehash(hashedPassword, rounds = DEFAULT_ROUNDS) {
   }
   
   try {
-    const hashRounds = bcrypt.getRounds(hashedPassword);
+    const hashRounds = b.getRounds(hashedPassword);
     return hashRounds < rounds;
   } catch {
     return true;

package/core/auth/index.js

@@ -15,6 +15,37 @@ const {
   dropAuthTokensTable,
   createKnexAuthTokensAdapter,
 } = require('./tokens');
+const {
+  OAuthClient,
+  OAuthError,
+  createOAuthClient,
+  generatePKCE,
+  createSignedState,
+  verifySignedState,
+  DEFAULT_PROVIDERS,
+} = require('./oauth');
+const totp = require('./totp');
+const {
+  base32Encode,
+  base32Decode,
+  generateTotpSecret,
+  generateHotp,
+  verifyHotp,
+  generateTotp,
+  verifyTotp,
+  generateTotpUri,
+  generateTotpQrSvg,
+  generateTotpQrDataUri,
+  generateRecoveryCodes,
+  hashRecoveryCode,
+  verifyRecoveryCode,
+  createTotpSetup,
+} = totp;
+const {
+  createQrMatrix,
+  generateQrSvg,
+  generateQrDataUri,
+} = require('./qrcode');
 
 /**
  * Create authentication instance
@@ -195,6 +226,35 @@ module.exports = {
   createKnexAuthTokensAdapter,
   TOKEN_TYPES,
   
+  // OAuth 2.0 & Social Login
+  OAuthClient,
+  OAuthError,
+  createOAuthClient,
+  generatePKCE,
+  createSignedState,
+  verifySignedState,
+  DEFAULT_PROVIDERS,
+
+  // 2FA / TOTP (RFC 6238, RFC 4226, RFC 4648)
+  totp,
+  base32Encode,
+  base32Decode,
+  generateTotpSecret,
+  generateHotp,
+  verifyHotp,
+  generateTotp,
+  verifyTotp,
+  generateTotpUri,
+  generateTotpQrSvg,
+  generateTotpQrDataUri,
+  generateRecoveryCodes,
+  hashRecoveryCode,
+  verifyRecoveryCode,
+  createTotpSetup,
+  createQrMatrix,
+  generateQrSvg,
+  generateQrDataUri,
+
   // Config
   DEFAULT_CONFIG,
 };

package/core/auth/manager.js

@@ -60,6 +60,7 @@ const DEFAULT_CONFIG = {
     logout: '/logout',
     home: '/',
     redirectAfterLogin: '/dashboard',
+    twoFactor: '/2fa',
   },
 };
 
@@ -107,6 +108,10 @@ class AuthManager {
       welcome: config.notifications?.welcome || null,
     };
 
+    // TOTP & 2FA initialization
+    this.totp = require('./totp');
+    this.twoFactor = config.twoFactor || { enabled: false };
+
     if (config.jwt) {
       const jwtSecret = typeof config.jwt === 'object' && config.jwt.secret
         ? config.jwt.secret
@@ -329,6 +334,9 @@ class AuthManager {
           }
         }
         
+        // Clear 2FA session state
+        this.clear2Fa();
+
         // Clear user
         req.user = null;
         
@@ -377,6 +385,119 @@ class AuthManager {
         return req.user?.id || null;
       },
 
+      /**
+       * TOTP helper utilities (RFC 6238 / RFC 4226)
+       */
+      totp: self.totp,
+
+      /**
+       * Check if two-factor authentication has been verified in current session/request
+       * @returns {boolean}
+       */
+      is2FaVerified() {
+        if (req.session?.twoFactorVerified) return true;
+        if (req.jwtPayload?.twoFactorVerified) return true;
+        return false;
+      },
+
+      /**
+       * Check if two-factor authentication is pending verification
+       * @returns {boolean}
+       */
+      is2FaPending() {
+        return Boolean(req.session?.twoFactorPending);
+      },
+
+      /**
+       * Mark two-factor authentication as verified
+       * @param {boolean} [verified=true]
+       */
+      set2FaVerified(verified = true) {
+        if (req.session) {
+          req.session.twoFactorVerified = Boolean(verified);
+          if (verified) {
+            delete req.session.twoFactorPending;
+            delete req.session.twoFactorUserId;
+          }
+        }
+      },
+
+      /**
+       * Mark two-factor authentication as pending verification for a user
+       * @param {Object} [user] - User object or user ID
+       */
+      set2FaPending(user) {
+        if (req.session) {
+          req.session.twoFactorPending = true;
+          req.session.twoFactorVerified = false;
+          if (user?.id) {
+            req.session.twoFactorUserId = user.id;
+          } else if (typeof user === 'string' || typeof user === 'number') {
+            req.session.twoFactorUserId = user;
+          }
+        }
+      },
+
+      /**
+       * Clear two-factor authentication status from session
+       */
+      clear2Fa() {
+        if (req.session) {
+          delete req.session.twoFactorVerified;
+          delete req.session.twoFactorPending;
+          delete req.session.twoFactorUserId;
+        }
+      },
+
+      /**
+       * Verify submitted TOTP token or recovery code
+       * Automatically marks 2FA as verified upon success
+       * @param {string} tokenOrCode - Submitted 6-digit TOTP code or recovery code
+       * @param {Object|string} secretOrUser - Secret string or user object with totp_secret / recovery_codes
+       * @param {Object} [options]
+       * @returns {{ success: boolean, type?: 'totp'|'recovery_code', delta?: number, remainingHashedCodes?: string[], matchedIndex?: number }}
+       */
+      verify2Fa(tokenOrCode, secretOrUser, options = {}) {
+        if (!tokenOrCode) {
+          return { success: false };
+        }
+
+        let secret = null;
+        let recoveryCodes = null;
+
+        if (typeof secretOrUser === 'string') {
+          secret = secretOrUser;
+        } else if (secretOrUser && typeof secretOrUser === 'object') {
+          secret = secretOrUser.totp_secret || secretOrUser.totpSecret || secretOrUser.two_factor_secret || secretOrUser.twoFactorSecret;
+          recoveryCodes = secretOrUser.recovery_codes || secretOrUser.recoveryCodes || secretOrUser.two_factor_recovery_codes;
+        }
+
+        // Try TOTP code first
+        if (secret) {
+          const totpResult = self.totp.verifyTotp(tokenOrCode, secret, { ...options, detailed: true });
+          if (totpResult.valid) {
+            this.set2FaVerified(true);
+            return { success: true, type: 'totp', delta: totpResult.delta };
+          }
+        }
+
+        // Try recovery codes if provided
+        if (recoveryCodes && Array.isArray(recoveryCodes) && recoveryCodes.length > 0) {
+          const recResult = self.totp.verifyRecoveryCode(tokenOrCode, recoveryCodes);
+          if (recResult.valid) {
+            this.set2FaVerified(true);
+            return {
+              success: true,
+              type: 'recovery_code',
+              matchedIndex: recResult.matchedIndex,
+              remainingHashedCodes: recResult.remainingHashedCodes,
+            };
+          }
+        }
+
+        return { success: false };
+      },
+
       /**
        * Check if user can perform action (policy check)
        * @param {string} action - Action name
@@ -801,6 +922,19 @@ class AuthManager {
     }
     return this._authMiddleware.requireJwt(options);
   }
+
+  /**
+   * Get require2Fa guard middleware for Express routes
+   * @param {Object} [options]
+   * @returns {Function} Express middleware
+   */
+  require2Fa(options = {}) {
+    if (!this._authMiddleware) {
+      const { createAuthMiddleware } = require('./middleware');
+      this._authMiddleware = createAuthMiddleware(this);
+    }
+    return this._authMiddleware.require2Fa(options);
+  }
 }
 
 module.exports = {