AppMint

AppMint is a modular suite that lets you build — without writing code — four types of internal applications activatable to end users from a 5-tab App Configurator (Type & info / Backend / Form / Extra fields / Summary).

**DB CRUD** — point to a saved PostgreSQL or MariaDB connection, pick schema and table, configure columns (label, widget text/textarea/number/checkbox/date/datetime/select/fk), search, filters, sort, FK with dynamic label. The result is a full-CRUD app with auto-generated UI that works on real data (no duplication).

**Script runner** — executes `.py` `.sh` `.bat` `.cmd` `.ps1` `.exe` `.jar` `.sql` files with parameter form, live stdout/stderr streaming (SSE), complete DB audit, rotating log files. "1 user = 1 process" pattern with explicit Kill button and `max_runtime_seconds` watchdog. Admin process console for kill and replay.

**REST caller** — calls external HTTP endpoints with `none` / `bearer` / `basic` / `api-key-header` auth, dynamic parameters from user form, response shown in the UI.

**SQL caller** — executes parametric read-only SQL templates on a saved connection.

Each generated app appears in a dynamic sidebar grouped by `category`, managed with Django-style permissions (user_apps + group_apps with read/create/update/delete/run, OR union between user and groups). 2-column form layout with `col_span` and "attach to previous", JavaScript IF rules in the browser (visible/required/readonly/secret/label) for dynamic UX without server round-trips.

**Configurable buttons** — instead of the classic auto-rendered "Run", the app exposes custom buttons with multiple actions: `run_main`, `script_runner`, `rest_call`, `sql_query`, `open_link`, `open_app` (cross-app deep-link), `reset_form`, `custom_js`. Each button has a JSON config with `{{key}}` placeholders for form values.

**External REST API** `/api/v1/*` authenticated with `X-API-Key` header (per-user key, SHA-256 hash in DB) — exposes meta, list, run for each generated app. **MCP server** stdio with LSP framing, integrable into `DexAssistant/servers.json` to expose CRUD and run as MCP tools.

**Persistence**: SQLite (admin DB + sessions) for AppMint metadata (users, groups, apps, permissions, connections). PG passwords are encrypted at-rest with AES-256-GCM (key from env or auto-generated `<DATA_DIR>/.secret-key`). Centralized data folder via `ADMIN_DB_DIR` (recommended outside the project for backup/portability).

**Security**: bcrypt cost 12 on user passwords, force-change password at first login, signed sessions persisted on SQLite (HttpOnly + SameSite=Lax + Secure in production), regex validation `^[A-Za-z_][A-Za-z0-9_$]*$` on all SQL identifiers before interpolation, `$N` parameters everywhere, `ORDER BY` validated against the known column list, `requireLogin/requireAdmin/requireAppPermission` middleware.

**Native HTTPS** optional (cert/key from `.env` with `npm run cert:self-signed` script) or reverse proxy with Caddy/Nginx/IIS in front of the Node service. IT/EN multi-language, dark/light theme persisted in localStorage. Stack: Node.js >= 18, Express, better-sqlite3, pg + mysql2/promise, bcryptjs, AES-256-GCM. Deploy as Windows service with NSSM via the included `deploy-service.bat` / `undeploy-service.bat` scripts.