webspresso 0.0.98 → 0.0.100

package/plugins/audit-log/api-handlers.js

@@ -21,12 +21,34 @@ function createAuditLogHandlers(options) {
     if (query.action) {
       qb.where('action', String(query.action));
     }
+    const recordId = query.recordId || query.resource_id || query.resourceId;
+    if (recordId !== undefined && recordId !== null && String(recordId).trim() !== '') {
+      qb.where('resource_id', String(recordId));
+    }
+    const actorId = query.actorId || query.actor_id;
+    if (actorId !== undefined && actorId !== null && String(actorId).trim() !== '') {
+      qb.where('actor_id', Number(actorId));
+    }
+    const actorEmail = query.actorEmail || query.actor_email;
+    if (actorEmail) {
+      qb.where('actor_email', 'like', `%${String(actorEmail).trim()}%`);
+    }
     if (query.from) {
       qb.where('created_at', '>=', String(query.from));
     }
     if (query.to) {
       qb.where('created_at', '<=', String(query.to));
     }
+    const searchTerm = query.search || query.q;
+    if (searchTerm && String(searchTerm).trim() !== '') {
+      const term = `%${String(searchTerm).trim()}%`;
+      qb.where((sub) => {
+        sub.where('actor_email', 'like', term)
+          .orWhere('path', 'like', term)
+          .orWhere('resource_id', 'like', term)
+          .orWhere('resource_model', 'like', term);
+      });
+    }
   }
 
   async function listHandler(req, res) {
@@ -53,6 +75,79 @@ function createAuditLogHandlers(options) {
     }
   }
 
+  /**
+   * Dedicated Record Timeline Handler
+   * GET /audit-logs/timeline/:model/:id or GET /audit-logs/timeline?model=Post&id=1
+   */
+  async function timelineHandler(req, res) {
+    try {
+      const model = req.params?.model || req.query?.model;
+      const recordId = req.params?.id || req.query?.id || req.query?.recordId || req.query?.resource_id;
+
+      if (!model || recordId === undefined) {
+        return res.status(400).json({ error: 'model and id are required to fetch timeline' });
+      }
+
+      const rows = await knex(tableName)
+        .where({
+          resource_model: String(model),
+          resource_id: String(recordId),
+        })
+        .orderBy('created_at', 'asc');
+
+      const totalChanges = rows.length;
+      const createdEvent = rows.find((r) => r.action === 'create') || null;
+      const lastModifiedEvent = rows.length > 0 ? rows[rows.length - 1] : null;
+
+      const events = rows.map((r, index) => {
+        let parsedMetadata = r.metadata;
+        if (typeof parsedMetadata === 'string') {
+          try {
+            parsedMetadata = JSON.parse(parsedMetadata);
+          } catch {}
+        }
+
+        const changedFields = Array.isArray(parsedMetadata?.changedFields)
+          ? parsedMetadata.changedFields
+          : [];
+
+        return {
+          id: r.id,
+          action: r.action,
+          createdAt: r.created_at,
+          actor: {
+            id: r.actor_id,
+            email: r.actor_email,
+          },
+          resourceModel: r.resource_model,
+          resourceId: r.resource_id,
+          httpMethod: r.http_method,
+          path: r.path,
+          ip: r.ip,
+          userAgent: r.user_agent,
+          changedFields,
+          metadata: parsedMetadata,
+          index: index + 1,
+        };
+      });
+
+      res.json({
+        model: String(model),
+        recordId: String(recordId),
+        summary: {
+          totalChanges,
+          createdAt: createdEvent?.created_at || (events[0] ? events[0].createdAt : null),
+          createdBy: createdEvent?.actor_email || (events[0] ? events[0].actor?.email : null),
+          lastModifiedAt: lastModifiedEvent?.created_at || null,
+          lastModifiedBy: lastModifiedEvent?.actor_email || null,
+        },
+        timeline: events,
+      });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  }
+
   async function purgeHandler(req, res) {
     try {
       const body = req.body || {};
@@ -89,8 +184,10 @@ function createAuditLogHandlers(options) {
    * @param {Object} [filters]
    * @param {string} [filters.model]
    * @param {string} [filters.action]
+   * @param {string} [filters.recordId]
    * @param {string} [filters.from]
    * @param {string} [filters.to]
+   * @param {string} [filters.search]
    * @param {number} [filters.limit=100]
    * @param {number} [filters.offset=0]
    */
@@ -105,10 +202,27 @@ function createAuditLogHandlers(options) {
       .limit(limit);
   }
 
+  /**
+   * Programmatic query for single record timeline
+   * @param {string} model
+   * @param {string|number} recordId
+   */
+  async function queryTimeline(model, recordId) {
+    if (!model || recordId === undefined) return [];
+    return knex(tableName)
+      .where({
+        resource_model: String(model),
+        resource_id: String(recordId),
+      })
+      .orderBy('created_at', 'asc');
+  }
+
   return {
     listHandler,
+    timelineHandler,
     purgeHandler,
     queryLogs,
+    queryTimeline,
   };
 }
 

package/plugins/audit-log/index.js

@@ -36,6 +36,7 @@ function auditLogPlugin(options = {}) {
     tableName = 'audit_logs',
     includeDefaultPage = true,
     apiPrefix = '/audit-logs',
+    registerRecordAction = true,
   } = options;
 
   const pageTitle = title || adminTitle || customPageTitle || 'Audit log';
@@ -152,6 +153,8 @@ function auditLogPlugin(options = {}) {
         return { ...retentionConfig };
       },
       queryLogs: (filters) => handlers.queryLogs(filters),
+      queryTimeline: (model, recordId) => handlers.queryTimeline(model, recordId),
+      getRecordTimeline: (model, recordId) => handlers.queryTimeline(model, recordId),
       getMigrationTemplate: (name) => generateAuditLogsMigration(name || tableName),
     },
 
@@ -211,10 +214,31 @@ function auditLogPlugin(options = {}) {
           prefix: apiPrefix,
           routes: [
             { method: 'get', path: '', handler: handlers.listHandler },
+            { method: 'get', path: '/timeline', handler: handlers.timelineHandler },
+            { method: 'get', path: '/timeline/:model/:id', handler: handlers.timelineHandler },
             { method: 'post', path: '/purge', handler: handlers.purgeHandler },
           ],
         },
       });
+
+      if (registerRecordAction && typeof adminApi.registerAction === 'function') {
+        adminApi.registerAction('audit-timeline', {
+          id: 'audit-timeline',
+          label: 'Timeline',
+          icon: 'clock',
+          color: 'blue',
+          models: '*',
+          handler: async (record, model) => {
+            const primaryKey = model?.primaryKey || 'id';
+            const id = record ? record[primaryKey] : null;
+            const modelName = model?.name || (typeof model === 'string' ? model : '');
+            return {
+              redirect: `/audit-log?model=${encodeURIComponent(modelName)}&recordId=${encodeURIComponent(id)}`,
+              message: `Timeline: ${modelName} #${id}`,
+            };
+          },
+        });
+      }
     },
   };
 }

package/plugins/content/client/inline-edit.js

@@ -249,54 +249,10 @@
       return;
     }
     if (typeof window.DOMPurify !== 'undefined' && typeof window.DOMPurify.sanitize === 'function') {
-      el.innerHTML = window.DOMPurify.sanitize(htmlStr);
+      el.innerHTML = window.DOMPurify.sanitize(String(htmlStr));
       return;
     }
-    try {
-      var template = document.createElement('template');
-      template.innerHTML = htmlStr;
-      var content = template.content;
-      var allowedTags = {
-        p: 1, br: 1, b: 1, i: 1, strong: 1, em: 1, u: 1, s: 1, strike: 1,
-        h1: 1, h2: 1, h3: 1, h4: 1, h5: 1, h6: 1, ul: 1, ol: 1, li: 1,
-        blockquote: 1, pre: 1, code: 1, a: 1, span: 1, div: 1, hr: 1,
-        table: 1, thead: 1, tbody: 1, tr: 1, th: 1, td: 1, img: 1
-      };
-      var allowedAttrs = {
-        href: 1, title: 1, target: 1, rel: 1, class: 1, id: 1, src: 1, alt: 1, width: 1, height: 1
-      };
-      var allNodes = content.querySelectorAll('*');
-      for (var i = allNodes.length - 1; i >= 0; i--) {
-        var node = allNodes[i];
-        var tag = node.tagName.toLowerCase();
-        if (!allowedTags[tag]) {
-          if (node.parentNode) {
-            node.parentNode.removeChild(node);
-          } else if (typeof node.remove === 'function') {
-            node.remove();
-          }
-          continue;
-        }
-        var attrs = Array.prototype.slice.call(node.attributes);
-        for (var j = 0; j < attrs.length; j++) {
-          var attrName = attrs[j].name.toLowerCase();
-          var attrVal = (attrs[j].value || '').toLowerCase().replace(/[\x00-\x20\s]+/g, '').trim();
-          if (attrName.indexOf('on') === 0 || !allowedAttrs[attrName]) {
-            node.removeAttribute(attrs[j].name);
-          } else if ((attrName === 'href' || attrName === 'src' || attrName === 'action' || attrName === 'formaction' || attrName === 'xlink:href') &&
-                     /^(?:javascript|data|vbscript):/i.test(attrVal)) {
-            node.removeAttribute(attrs[j].name);
-          } else if (tag === 'a' && node.getAttribute('target') === '_blank') {
-            node.setAttribute('rel', 'noopener noreferrer');
-          }
-        }
-      }
-
-      el.textContent = '';
-      el.appendChild(content.cloneNode(true));
-    } catch (e) {
-      el.textContent = htmlStr;
-    }
+    el.textContent = String(htmlStr);
   }
 
   function updateDomFields(entryId, data) {

package/plugins/cors.js

@@ -76,7 +76,18 @@ function createCorsMiddleware(options = {}) {
       return config.origin(reqOrigin, callback);
     }
     if (config.origin === true) {
-      return callback(null, reqOrigin);
+      if (!reqOrigin || reqOrigin === 'null') {
+        return callback(null, false);
+      }
+      try {
+        const u = new URL(reqOrigin);
+        if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+          return callback(null, false);
+        }
+        return callback(null, u.origin);
+      } catch {
+        return callback(null, false);
+      }
     }
     return callback(null, false);
   }
@@ -101,7 +112,7 @@ function createCorsMiddleware(options = {}) {
         return next(err);
       }
 
-      if (allowedOrigin && allowedOrigin !== '*') {
+      if (allowedOrigin && allowedOrigin !== '*' && allowedOrigin !== 'null') {
         res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
         res.setHeader('Vary', 'Origin');
         if (config.credentials) {

package/plugins/email/auth-bridge.js

@@ -26,6 +26,13 @@ const DEFAULT_AUTH_EMAILS = {
     template: 'auth-welcome',
     subject: 'Welcome',
   },
+  magicLink: {
+    enabled: true,
+    template: 'auth-magic-link',
+    subject: 'Your sign-in link',
+    path: '/auth/magic-link/verify',
+    tokenTtlMs: 15 * 60 * 1000,
+  },
   registerRoutes: true,
   routePrefix: '/api/auth',
 };
@@ -46,6 +53,7 @@ function wireAuthEmails(authManager, emailService, registry, config, db) {
     passwordReset: { ...DEFAULT_AUTH_EMAILS.passwordReset, ...config.passwordReset },
     emailVerification: { ...DEFAULT_AUTH_EMAILS.emailVerification, ...config.emailVerification },
     welcome: { ...DEFAULT_AUTH_EMAILS.welcome, ...config.welcome },
+    magicLink: { ...DEFAULT_AUTH_EMAILS.magicLink, ...config.magicLink },
   };
 
   registerBundledAuthTemplates(registry);
@@ -111,6 +119,23 @@ function wireAuthEmails(authManager, emailService, registry, config, db) {
     };
   }
 
+  if (merged.magicLink?.enabled) {
+    authManager.notifications.magicLink = async (user, { token, magicLinkUrl, expiresMinutes }) => {
+      const url = magicLinkUrl || buildUrl(merged.magicLink.path, token);
+      await emailService.sendTemplate(merged.magicLink.template, {
+        to: user[identifierField],
+        subject: merged.magicLink.subject,
+        data: {
+          name: userDisplayName(user),
+          token,
+          magicLinkUrl: url,
+          expiresMinutes: expiresMinutes || 15,
+          email: user[identifierField],
+        },
+      });
+    };
+  }
+
   return merged;
 }
 
@@ -193,6 +218,41 @@ function registerAuthEmailRoutes(options) {
     }
   }
 
+  async function magicLinkRequestHandler(req, res) {
+    try {
+      const email = req.body?.email || req.body?.identifier;
+      if (email) {
+        await authManager.requestMagicLink(String(email), {
+          tokenTtlMs: authEmailsConfig.magicLink?.tokenTtlMs,
+          path: authEmailsConfig.magicLink?.path,
+          buildMagicLinkUrl: (token) => {
+            const pathSeg = authEmailsConfig.magicLink?.path || '/auth/magic-link/verify';
+            return `${base}${pathSeg}?token=${encodeURIComponent(token)}`;
+          },
+        });
+      }
+      res.json({ ok: true, message: 'If the account exists, a sign-in link has been sent.' });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  }
+
+  async function magicLinkVerifyHandler(req, res) {
+    try {
+      const token = req.body?.token || req.query?.token;
+      if (!token) {
+        return res.status(400).json({ error: 'token is required' });
+      }
+      const { user } = await authManager.verifyMagicLink(String(token));
+      if (req.auth && typeof req.auth.login === 'function') {
+        await req.auth.login(user);
+      }
+      res.json({ ok: true, user });
+    } catch (err) {
+      res.status(err.status || 400).json({ error: err.message, code: err.code });
+    }
+  }
+
   const forgotMw = guest ? [guest, forgotPasswordHandler] : [forgotPasswordHandler];
   const resetMw = guest ? [guest, resetPasswordHandler] : [resetPasswordHandler];
   const resendMw = authMw ? [authMw, resendVerificationHandler] : [resendVerificationHandler];
@@ -201,6 +261,12 @@ function registerAuthEmailRoutes(options) {
   ctx.addRoute('post', `${prefix}/reset-password`, ...resetMw);
   ctx.addRoute('post', `${prefix}/verify-email`, verifyEmailHandler);
   ctx.addRoute('post', `${prefix}/resend-verification`, ...resendMw);
+
+  if (authEmailsConfig.magicLink?.enabled) {
+    const magicMw = guest ? [guest, magicLinkRequestHandler] : [magicLinkRequestHandler];
+    ctx.addRoute('post', `${prefix}/magic-link`, ...magicMw);
+    ctx.addRoute('post', `${prefix}/magic-link/verify`, magicLinkVerifyHandler);
+  }
 }
 
 module.exports = {

package/plugins/email/bundled-templates.js

@@ -47,6 +47,21 @@ const BUNDLED_AUTH_TEMPLATES = {
       </mj-column>
     </mj-section>
   </mj-body>
+</mjml>`,
+  },
+  'auth-magic-link': {
+    mjml: `<mjml>
+  <mj-body background-color="#f4f4f5">
+    <mj-section background-color="#ffffff" padding="32px 24px">
+      <mj-column>
+        <mj-text font-size="20px" font-weight="600" color="#18181b">Your sign-in link</mj-text>
+        <mj-text color="#52525b">Hi {{name}},</mj-text>
+        <mj-text color="#52525b">Click the button below to securely sign in to your account. This link will expire in {{expiresMinutes}} minutes.</mj-text>
+        <mj-button background-color="#4f46e5" href="{{magicLinkUrl}}">Sign In</mj-button>
+        <mj-text color="#71717a" font-size="12px">If you did not request this link, you can safely ignore this email.</mj-text>
+      </mj-column>
+    </mj-section>
+  </mj-body>
 </mjml>`,
   },
 };

package/plugins/email/templates/auth-magic-link.mjml

@@ -0,0 +1,13 @@
+<mjml>
+  <mj-body background-color="#f4f4f5">
+    <mj-section background-color="#ffffff" padding="32px 24px">
+      <mj-column>
+        <mj-text font-size="20px" font-weight="600" color="#18181b">Your sign-in link</mj-text>
+        <mj-text color="#52525b">Hi {{name}},</mj-text>
+        <mj-text color="#52525b">Click the button below to securely sign in to your account. This link will expire in {{expiresMinutes}} minutes.</mj-text>
+        <mj-button background-color="#4f46e5" href="{{magicLinkUrl}}">Sign In</mj-button>
+        <mj-text color="#71717a" font-size="12px">If you did not request this link, you can safely ignore this email.</mj-text>
+      </mj-column>
+    </mj-section>
+  </mj-body>
+</mjml>