webspresso 0.0.98 → 0.0.99

package/plugins/audit-log/api-handlers.js

@@ -21,12 +21,34 @@ function createAuditLogHandlers(options) {
     if (query.action) {
       qb.where('action', String(query.action));
     }
+    const recordId = query.recordId || query.resource_id || query.resourceId;
+    if (recordId !== undefined && recordId !== null && String(recordId).trim() !== '') {
+      qb.where('resource_id', String(recordId));
+    }
+    const actorId = query.actorId || query.actor_id;
+    if (actorId !== undefined && actorId !== null && String(actorId).trim() !== '') {
+      qb.where('actor_id', Number(actorId));
+    }
+    const actorEmail = query.actorEmail || query.actor_email;
+    if (actorEmail) {
+      qb.where('actor_email', 'like', `%${String(actorEmail).trim()}%`);
+    }
     if (query.from) {
       qb.where('created_at', '>=', String(query.from));
     }
     if (query.to) {
       qb.where('created_at', '<=', String(query.to));
     }
+    const searchTerm = query.search || query.q;
+    if (searchTerm && String(searchTerm).trim() !== '') {
+      const term = `%${String(searchTerm).trim()}%`;
+      qb.where((sub) => {
+        sub.where('actor_email', 'like', term)
+          .orWhere('path', 'like', term)
+          .orWhere('resource_id', 'like', term)
+          .orWhere('resource_model', 'like', term);
+      });
+    }
   }
 
   async function listHandler(req, res) {
@@ -53,6 +75,79 @@ function createAuditLogHandlers(options) {
     }
   }
 
+  /**
+   * Dedicated Record Timeline Handler
+   * GET /audit-logs/timeline/:model/:id or GET /audit-logs/timeline?model=Post&id=1
+   */
+  async function timelineHandler(req, res) {
+    try {
+      const model = req.params?.model || req.query?.model;
+      const recordId = req.params?.id || req.query?.id || req.query?.recordId || req.query?.resource_id;
+
+      if (!model || recordId === undefined) {
+        return res.status(400).json({ error: 'model and id are required to fetch timeline' });
+      }
+
+      const rows = await knex(tableName)
+        .where({
+          resource_model: String(model),
+          resource_id: String(recordId),
+        })
+        .orderBy('created_at', 'asc');
+
+      const totalChanges = rows.length;
+      const createdEvent = rows.find((r) => r.action === 'create') || null;
+      const lastModifiedEvent = rows.length > 0 ? rows[rows.length - 1] : null;
+
+      const events = rows.map((r, index) => {
+        let parsedMetadata = r.metadata;
+        if (typeof parsedMetadata === 'string') {
+          try {
+            parsedMetadata = JSON.parse(parsedMetadata);
+          } catch {}
+        }
+
+        const changedFields = Array.isArray(parsedMetadata?.changedFields)
+          ? parsedMetadata.changedFields
+          : [];
+
+        return {
+          id: r.id,
+          action: r.action,
+          createdAt: r.created_at,
+          actor: {
+            id: r.actor_id,
+            email: r.actor_email,
+          },
+          resourceModel: r.resource_model,
+          resourceId: r.resource_id,
+          httpMethod: r.http_method,
+          path: r.path,
+          ip: r.ip,
+          userAgent: r.user_agent,
+          changedFields,
+          metadata: parsedMetadata,
+          index: index + 1,
+        };
+      });
+
+      res.json({
+        model: String(model),
+        recordId: String(recordId),
+        summary: {
+          totalChanges,
+          createdAt: createdEvent?.created_at || (events[0] ? events[0].createdAt : null),
+          createdBy: createdEvent?.actor_email || (events[0] ? events[0].actor?.email : null),
+          lastModifiedAt: lastModifiedEvent?.created_at || null,
+          lastModifiedBy: lastModifiedEvent?.actor_email || null,
+        },
+        timeline: events,
+      });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  }
+
   async function purgeHandler(req, res) {
     try {
       const body = req.body || {};
@@ -89,8 +184,10 @@ function createAuditLogHandlers(options) {
    * @param {Object} [filters]
    * @param {string} [filters.model]
    * @param {string} [filters.action]
+   * @param {string} [filters.recordId]
    * @param {string} [filters.from]
    * @param {string} [filters.to]
+   * @param {string} [filters.search]
    * @param {number} [filters.limit=100]
    * @param {number} [filters.offset=0]
    */
@@ -105,10 +202,27 @@ function createAuditLogHandlers(options) {
       .limit(limit);
   }
 
+  /**
+   * Programmatic query for single record timeline
+   * @param {string} model
+   * @param {string|number} recordId
+   */
+  async function queryTimeline(model, recordId) {
+    if (!model || recordId === undefined) return [];
+    return knex(tableName)
+      .where({
+        resource_model: String(model),
+        resource_id: String(recordId),
+      })
+      .orderBy('created_at', 'asc');
+  }
+
   return {
     listHandler,
+    timelineHandler,
     purgeHandler,
     queryLogs,
+    queryTimeline,
   };
 }
 

package/plugins/audit-log/index.js

@@ -36,6 +36,7 @@ function auditLogPlugin(options = {}) {
     tableName = 'audit_logs',
     includeDefaultPage = true,
     apiPrefix = '/audit-logs',
+    registerRecordAction = true,
   } = options;
 
   const pageTitle = title || adminTitle || customPageTitle || 'Audit log';
@@ -152,6 +153,8 @@ function auditLogPlugin(options = {}) {
         return { ...retentionConfig };
       },
       queryLogs: (filters) => handlers.queryLogs(filters),
+      queryTimeline: (model, recordId) => handlers.queryTimeline(model, recordId),
+      getRecordTimeline: (model, recordId) => handlers.queryTimeline(model, recordId),
       getMigrationTemplate: (name) => generateAuditLogsMigration(name || tableName),
     },
 
@@ -211,10 +214,31 @@ function auditLogPlugin(options = {}) {
           prefix: apiPrefix,
           routes: [
             { method: 'get', path: '', handler: handlers.listHandler },
+            { method: 'get', path: '/timeline', handler: handlers.timelineHandler },
+            { method: 'get', path: '/timeline/:model/:id', handler: handlers.timelineHandler },
             { method: 'post', path: '/purge', handler: handlers.purgeHandler },
           ],
         },
       });
+
+      if (registerRecordAction && typeof adminApi.registerAction === 'function') {
+        adminApi.registerAction('audit-timeline', {
+          id: 'audit-timeline',
+          label: 'Zaman Tüneli',
+          icon: 'clock',
+          color: 'blue',
+          models: '*',
+          handler: async (record, model) => {
+            const primaryKey = model?.primaryKey || 'id';
+            const id = record ? record[primaryKey] : null;
+            const modelName = model?.name || (typeof model === 'string' ? model : '');
+            return {
+              redirect: `/audit-log?model=${encodeURIComponent(modelName)}&recordId=${encodeURIComponent(id)}`,
+              message: `Zaman tüneli: ${modelName} #${id}`,
+            };
+          },
+        });
+      }
     },
   };
 }

package/plugins/file-manager/admin-component.js

@@ -569,30 +569,46 @@ function generateFileManagerComponent(options = {}) {
     var onSelect = opts.onSelect;
     var accept = opts.accept || '';
 
+    var existing = document.getElementById('file-manager-picker-modal-root');
+    if (existing && existing.parentNode) {
+      m.mount(existing, null);
+      existing.parentNode.removeChild(existing);
+    }
+
     var modalContainer = document.createElement('div');
     modalContainer.id = 'file-manager-picker-modal-root';
     document.body.appendChild(modalContainer);
 
     function cleanup() {
+      document.removeEventListener('keydown', onKeyDown);
       if (modalContainer && modalContainer.parentNode) {
         m.mount(modalContainer, null);
         modalContainer.parentNode.removeChild(modalContainer);
       }
     }
 
+    function onKeyDown(e) {
+      if (e.key === 'Escape') cleanup();
+    }
+    document.addEventListener('keydown', onKeyDown);
+
     var PickerModalComponent = {
       view: function() {
-        return m('div.fixed.inset-0.bg-black/60.flex.items-center.justify-center.z-[9999].p-4.backdrop-blur-sm', [
+        return m('div.fixed.inset-0.bg-black/60.flex.items-center.justify-center.z-[9999].p-4.backdrop-blur-sm', {
+          onclick: function(e) {
+            if (e.target === e.currentTarget) cleanup();
+          }
+        }, [
           m('div.bg-white.dark:bg-slate-900.rounded-2xl.shadow-2xl.max-w-4xl.w-full.max-h-[90vh].flex.flex-col.overflow-hidden.border.border-gray-200.dark:border-slate-700', [
             m('div.flex.items-center.justify-between.p-4.border-b.border-gray-200.dark:border-slate-700.bg-gray-50.dark:bg-slate-800', [
-              m('h2.text-base.font-bold.text-gray-900.dark:text-slate-100', opts.title || '📁 Ortam Kütüphanesinden Dosya Seç'),
+              m('h2.text-base.font-bold.text-gray-900.dark:text-slate-100', opts.title || 'Choose from Media Library'),
               m('button.text-gray-400.hover:text-gray-600.dark:hover:text-slate-200.text-xl', {
                 onclick: cleanup
               }, '✕')
             ]),
             m('div.p-4.overflow-y-auto.flex-1', [
-              m(FileManagerView(true, function(selectedUrl) {
-                if (onSelect) onSelect(selectedUrl);
+              m(FileManagerView(true, function(selectedUrl, item) {
+                if (onSelect) onSelect(selectedUrl, item);
                 cleanup();
               }, accept))
             ])

package/plugins/file-manager/index.js

@@ -92,6 +92,26 @@ function fileManagerPlugin(options = {}) {
         return;
       }
 
+      const componentCode = generateFileManagerComponent({
+        apiPrefix,
+        publicBasePath,
+      });
+
+      // Always configure fileManager in admin settings and register client component
+      // so window.__openFileManagerPicker is available across all admin pages (models, records, rich-text)
+      if (typeof adminApi.getRegistry === 'function') {
+        const registry = adminApi.getRegistry();
+        registry.configure({
+          fileManager: {
+            enabled: true,
+            apiPrefix,
+            publicBasePath,
+            pageTitle,
+          },
+        });
+        registry.registerClientComponent('files', componentCode);
+      }
+
       adminApi.registerModule({
         id: 'files',
         pages: includePage
@@ -100,10 +120,7 @@ function fileManagerPlugin(options = {}) {
               title: pageTitle,
               path: '/files',
               icon: 'folder',
-              component: generateFileManagerComponent({
-                apiPrefix,
-                publicBasePath,
-              }),
+              component: componentCode,
             }]
           : [],
 

package/plugins/index.js

@@ -53,6 +53,12 @@ module.exports = {
   get xlsx() { return require('./xlsx').xlsx; },
   get csvPlugin() { return require('./csv').csvPlugin; },
   get csv() { return require('./csv').csv; },
+  get oauthPlugin() { return require('./oauth'); },
+  get OAuthClient() { return require('./oauth').OAuthClient; },
+  get OAuthError() { return require('./oauth').OAuthError; },
+  get createOAuthClient() { return require('./oauth').createOAuthClient; },
+  get apiKeyPlugin() { return require('./api-key').apiKeyPlugin; },
+  get createApiKeyMiddleware() { return require('./api-key').createApiKeyMiddleware; },
 };
 
 

package/plugins/oauth/index.js

@@ -0,0 +1,338 @@
+/**
+ * OAuth 2.0 & Social Login Plugin for Webspresso
+ * Zero external dependencies: powered by native node:crypto and global fetch
+ * RFC 6749 (OAuth 2.0), RFC 7636 (PKCE), signed anti-CSRF state tokens, and dual auth integration
+ * @module plugins/oauth
+ */
+
+const { OAuthClient, OAuthError, createOAuthClient } = require('../../core/auth/oauth');
+
+/**
+ * Resolve effective redirect URI for a provider
+ * Uses configured redirectUri or derives dynamically from request headers/host
+ * 
+ * @param {import('express').Request} req
+ * @param {string} providerName
+ * @param {Object} providerConfig
+ * @param {string} pathPrefix
+ * @returns {string}
+ */
+function resolveRedirectUri(req, providerName, providerConfig, pathPrefix) {
+  if (providerConfig.redirectUri) {
+    return providerConfig.redirectUri;
+  }
+
+  const proto = req.headers['x-forwarded-proto'] || (req.connection?.encrypted ? 'https' : req.protocol) || 'http';
+  const host = req.headers['x-forwarded-host'] || req.headers.host;
+  const cleanPrefix = pathPrefix.startsWith('/') ? pathPrefix : `/${pathPrefix}`;
+  return `${proto}://${host}${cleanPrefix}/${providerName}/callback`;
+}
+
+/**
+ * Webspresso OAuth Plugin Factory
+ * 
+ * @param {Object} [options]
+ * @param {OAuthClient} [options.client] - Optional pre-instantiated OAuthClient instance
+ * @param {Record<string, Object>} [options.providers] - Provider configurations (google, github, etc.)
+ * @param {string} [options.secret] - State token signing secret
+ * @param {string} [options.pathPrefix='/auth'] - Base path prefix for OAuth routes
+ * @param {boolean} [options.routes=true] - Mount automatic /:provider and /:provider/callback routes
+ * @param {boolean} [options.pkce=true] - Enable RFC 7636 PKCE
+ * @param {number} [options.stateTtlMs=600000] - State TTL in milliseconds (default 10 mins)
+ * @param {string} [options.defaultReturnTo='/'] - Default redirect URL after successful login
+ * @param {string} [options.failureRedirect='/login'] - Default redirect URL on failure
+ * @param {Function} [options.findOrCreateUser] - (params: { provider, profile, tokens, stateData, req, res, db }) => Promise<User>
+ * @param {Function} [options.onSuccess] - (params: { provider, user, profile, tokens, stateData, req, res, client }) => Promise<void|any>
+ * @param {Function} [options.onError] - (params: { error, provider, req, res, client }) => Promise<void|any>
+ * @param {Object} [options.db] - Optional Database instance
+ * @returns {Object} Webspresso Plugin Definition
+ */
+function oauthPlugin(options = {}) {
+  const {
+    pathPrefix = '/auth',
+    routes: mountRoutes = true,
+    pkce = true,
+    defaultReturnTo = '/',
+    failureRedirect = '/login',
+    stateTtlMs = 10 * 60 * 1000,
+    providers = {},
+    secret,
+  } = options;
+
+  const client = options.client || createOAuthClient({
+    secret: secret || process.env.OAUTH_SECRET || process.env.SESSION_SECRET || 'webspresso-oauth-secret',
+    stateTtlMs,
+    providers,
+  });
+
+  /**
+   * Handle OAuth failure response
+   */
+  async function handleFailure(err, providerName, req, res, next) {
+    if (typeof options.onError === 'function') {
+      try {
+        const hookResult = await options.onError({
+          error: err,
+          provider: providerName,
+          req,
+          res,
+          client,
+        });
+        if (res.headersSent || hookResult === false) {
+          return;
+        }
+      } catch (hookErr) {
+        console.error('[oauthPlugin] onError hook error:', hookErr);
+      }
+    }
+
+    const acceptsJson = req.xhr || (req.headers.accept && req.headers.accept.includes('application/json')) || req.query.format === 'json';
+    if (acceptsJson) {
+      return res.status(400).json({
+        error: err.code || 'OAUTH_ERROR',
+        message: err.message,
+        details: err.details || null,
+      });
+    }
+
+    const failureBase = options.failureRedirect || failureRedirect;
+    const url = new URL(failureBase, 'http://localhost');
+    url.searchParams.set('error', err.code || 'oauth_failed');
+    url.searchParams.set('message', err.message);
+
+    const redirectTarget = `${url.pathname}${url.search}`;
+    return res.redirect(redirectTarget);
+  }
+
+  /**
+   * Handle OAuth success response
+   */
+  async function handleSuccess(result, req, res, next) {
+    const { provider, user: profile, tokens, stateData } = result;
+
+    let appUser = null;
+    const db = req.db || options.db;
+    if (typeof options.findOrCreateUser === 'function') {
+      appUser = await options.findOrCreateUser({
+        provider,
+        profile,
+        tokens,
+        stateData,
+        req,
+        res,
+        db,
+      });
+    }
+
+    const effectiveUser = appUser || profile;
+
+    if (typeof options.onSuccess === 'function') {
+      const hookResult = await options.onSuccess({
+        provider,
+        user: effectiveUser,
+        profile,
+        tokens,
+        stateData,
+        req,
+        res,
+        client,
+      });
+
+      if (res.headersSent || hookResult === false) {
+        return;
+      }
+    }
+
+    // Default Session / Dual-auth login integration
+    if (effectiveUser) {
+      req.user = effectiveUser;
+      if (req.auth && typeof req.auth.login === 'function') {
+        try {
+          await req.auth.login(effectiveUser);
+        } catch (authErr) {
+          console.warn('[oauthPlugin] req.auth.login failed:', authErr.message);
+        }
+      }
+    }
+
+    // JSON response for API/mobile clients
+    const acceptsJson = req.xhr || (req.headers.accept && req.headers.accept.includes('application/json')) || req.query.format === 'json';
+    if (acceptsJson) {
+      let jwtToken = undefined;
+      if (req.auth && typeof req.auth.generateUserToken === 'function' && effectiveUser) {
+        try {
+          jwtToken = req.auth.generateUserToken(effectiveUser);
+        } catch {}
+      }
+
+      return res.json({
+        success: true,
+        provider,
+        user: effectiveUser,
+        token: jwtToken,
+        tokens,
+      });
+    }
+
+    const targetUrl = stateData?.returnTo || defaultReturnTo;
+    return res.redirect(targetUrl);
+  }
+
+  return {
+    name: 'oauth',
+    version: '1.0.0',
+    description: 'Zero-dependency OAuth 2.0 & Social Login plugin for Webspresso',
+
+    api: {
+      client,
+      getProvider: (name) => client.getProvider(name),
+      getProviderNames: () => client.getProviderNames(),
+      getAuthorizationUrl: (provider, opts) => client.getAuthorizationUrl(provider, opts),
+      exchangeCode: (provider, params) => client.exchangeCode(provider, params),
+      fetchUserProfile: (provider, tokens) => client.fetchUserProfile(provider, tokens),
+      handleCallback: (provider, params) => client.handleCallback(provider, params),
+    },
+
+    register(ctx) {
+      // 1. Attach req.oauth and helper methods to every incoming request
+      ctx.app.use((req, res, next) => {
+        req.oauth = client;
+
+        req.getOAuthAuthorizationUrl = (providerName, opts = {}) => {
+          const providerConfig = client.getProvider(providerName);
+          const redirectUri = opts.redirectUri || resolveRedirectUri(req, providerName, providerConfig, pathPrefix);
+          return client.getAuthorizationUrl(providerName, {
+            redirectUri,
+            pkce,
+            ...opts,
+          });
+        };
+
+        req.handleOAuthCallback = (providerName, params = {}) => {
+          const providerConfig = client.getProvider(providerName);
+          const redirectUri = params.redirectUri || resolveRedirectUri(req, providerName, providerConfig, pathPrefix);
+          return client.handleCallback(providerName, {
+            redirectUri,
+            ...params,
+          });
+        };
+
+        next();
+      });
+
+      // 2. Register named route middleware: middleware: ['oauth']
+      if (ctx.middlewares) {
+        ctx.middlewares.oauth = (providerName) => async (req, res, next) => {
+          req.oauthProvider = providerName;
+          next();
+        };
+      }
+
+      // 3. Register template helper: fsy.oauthUrl('google', { returnTo: '/profile' })
+      ctx.addHelper('oauthUrl', (providerName, helperOpts = {}) => {
+        const cleanPrefix = pathPrefix.startsWith('/') ? pathPrefix : `/${pathPrefix}`;
+        const base = `${cleanPrefix}/${providerName}`;
+        const params = new URLSearchParams();
+        if (helperOpts.returnTo) params.set('returnTo', helperOpts.returnTo);
+        if (helperOpts.scope) {
+          params.set('scope', Array.isArray(helperOpts.scope) ? helperOpts.scope.join(' ') : helperOpts.scope);
+        }
+        const qs = params.toString();
+        return qs ? `${base}?${qs}` : base;
+      });
+    },
+
+    onRoutesReady(ctx) {
+      if (!mountRoutes) return;
+
+      const cleanPrefix = pathPrefix.startsWith('/') ? pathPrefix : `/${pathPrefix}`;
+
+      // Initiation Route: GET /auth/:provider
+      ctx.addRoute('get', `${cleanPrefix}/:provider`, async (req, res, next) => {
+        const providerName = req.params.provider;
+        if (!client.getProviderNames().includes(providerName)) {
+          return next();
+        }
+
+        try {
+          const providerConfig = client.getProvider(providerName);
+          const redirectUri = resolveRedirectUri(req, providerName, providerConfig, pathPrefix);
+
+          const returnTo = req.query.returnTo || req.query.redirect || defaultReturnTo;
+          const extraState = req.query.state ? { customState: req.query.state } : {};
+          const stateData = {
+            returnTo,
+            ...extraState,
+          };
+
+          const scopes = req.query.scope ? req.query.scope.split(/[\s,]+/) : undefined;
+
+          const { url } = client.getAuthorizationUrl(providerName, {
+            redirectUri,
+            scopes,
+            stateData,
+            pkce,
+          });
+
+          return res.redirect(url);
+        } catch (err) {
+          return handleFailure(err, providerName, req, res, next);
+        }
+      });
+
+      // Callback Route: GET /auth/:provider/callback
+      ctx.addRoute('get', `${cleanPrefix}/:provider/callback`, async (req, res, next) => {
+        const providerName = req.params.provider;
+        if (!client.getProviderNames().includes(providerName)) {
+          return next();
+        }
+
+        // Provider reported error (e.g. user cancelled)
+        if (req.query.error) {
+          const errorMsg = req.query.error_description || req.query.error;
+          const oauthErr = new OAuthError(
+            `OAuth error from ${providerName}: ${errorMsg}`,
+            req.query.error,
+            req.query
+          );
+          return handleFailure(oauthErr, providerName, req, res, next);
+        }
+
+        const { code, state } = req.query;
+        if (!code || !state) {
+          const missingErr = new OAuthError(
+            'Missing OAuth authorization code or state parameter',
+            'INVALID_CALLBACK'
+          );
+          return handleFailure(missingErr, providerName, req, res, next);
+        }
+
+        try {
+          const providerConfig = client.getProvider(providerName);
+          const redirectUri = resolveRedirectUri(req, providerName, providerConfig, pathPrefix);
+
+          const result = await client.handleCallback(providerName, {
+            code,
+            state,
+            redirectUri,
+          });
+
+          return handleSuccess(result, req, res, next);
+        } catch (err) {
+          return handleFailure(err, providerName, req, res, next);
+        }
+      });
+    },
+  };
+}
+
+oauthPlugin.oauthPlugin = oauthPlugin;
+oauthPlugin.OAuthClient = OAuthClient;
+oauthPlugin.OAuthError = OAuthError;
+oauthPlugin.createOAuthClient = createOAuthClient;
+
+module.exports = oauthPlugin;
+module.exports.oauthPlugin = oauthPlugin;
+module.exports.OAuthClient = OAuthClient;
+module.exports.OAuthError = OAuthError;
+module.exports.createOAuthClient = createOAuthClient;

package/plugins/queue/index.js

@@ -99,6 +99,10 @@ function queuePlugin(options = {}) {
     api: {
       getQueueManager: () => queueManager,
       clean: (opts) => queueManager?.clean(opts),
+      schedule: (expr, name, data, opts) => queueManager?.schedule(expr, name, data, opts),
+      cron: (expr, name, data, opts) => queueManager?.cron(expr, name, data, opts),
+      unschedule: (idOrName) => queueManager?.unschedule(idOrName),
+      getSchedules: () => queueManager?.getSchedules() || [],
     },
 
     onRoutesReady(ctx) {

package/src/api/api-loader.js

@@ -198,6 +198,7 @@ function createApiHandler(descriptor, context) {
         config: appOptions,
         logger: console,
         db,
+        sse: (sourceOrOptions, maybeOptions) => res.sse(sourceOrOptions, maybeOptions),
       };
 
       req.ctx = apiCtx;