@bygghammar/cms-platform 0.94.0 → 0.96.0

package/CHANGELOG.md

@@ -8,6 +8,152 @@ matches `package.json` exactly. See
 Versions 0.1.0 through 0.78.0 predate this repository and were reconstructed
 from the published npm tarballs.
 
+## 0.96.0
+
+Security release. No migration, and no export was added or removed.
+
+- **Rich text is sanitized by a parser, not by patterns** (`./html/sanitize-html`).
+  The old sanitizer copied the text between the tags it recognised through as
+  written, so an unterminated tag at the end of a fragment (for example an image
+  tag with an event handler and no closing `>`) survived, and in server
+  rendering the markup after the fragment completed it into a live element.
+  Markup is now read the way a browser's HTML tokenizer reads it (every quoting
+  form, comments, DOCTYPE, CDATA, raw-text elements, a tag cut off by the end of
+  the input) and the output is written from scratch: allowlisted elements and
+  attributes only, attributes decoded once and escaped once, and every `<` and
+  `>` in text escaped. The editor's allowlist, URL rules and booking-link
+  `&amp;` handling are unchanged.
+  - Tightened: a `data:` image is accepted only in an image's `src`, never as a
+    link target. `svg`, `math`, `template`, `textarea`, `title`, `xmp`,
+    `noembed`, `noframes` and `plaintext` are dropped together with their
+    content.
+  - `htmlToText` now returns plain text, with entities decoded.
+- **The builder and its preview only talk to each other**
+  (`./site/routes/preview-page`, the page builder). The public preview route
+  used to render blocks posted by any window that put a marker string in its
+  message, and both ends posted to `"*"`. Now:
+  - the preview accepts the builder's messages only from its parent frame,
+    from its own origin or an origin the host lists, in one builder session
+    with increasing sequence numbers, shape-checked and at most 4 MB;
+  - the builder accepts the preview's messages only from its own iframe, and
+    every message names its target origin.
+  - **Host change, only for a builder on another origin:** list that origin in
+    the preview page deps as `trustedEditorOrigins`. A builder on the site's own
+    origin (Voyara's) needs no configuration.
+- **One outbound request policy** for every address staff or configuration
+  chooses: media import, form webhooks and popup opt-in webhooks. Each of these
+  was a server-side request forgery primitive. Every request now:
+  - allows only the schemes its policy names (webhooks: https only), with no
+    credentials in the URL, no local or single-label host names and no
+    privileged ports other than 80 and 443;
+  - looks the host up and goes ahead only if every address it resolves to is
+    public (IPv4 and IPv6 special-purpose ranges, including mapped, NAT64 and
+    6to4 forms), then connects to the address it checked (pinned, so a DNS
+    answer that changes in between cannot redirect it), with TLS still verified
+    for the host name;
+  - follows redirects itself, checking and pinning every hop, up to a cap;
+  - runs under one deadline for the whole request, which also holds when a
+    lookup, connection or response body ignores cancellation (Node's DNS
+    lookup cannot be cancelled), and reads at most a fixed number of bytes,
+    streaming, whatever `Content-Length` says;
+  - reports failures by category, with messages that carry no address, query
+    string or response body.
+- **What each path does with that policy:**
+  - **Media import:** a downloaded file is stored as what its first bytes say
+    it is (JPEG, PNG, GIF, WebP, AVIF, MP4, MOV, M4V, WebM, MP3, WAV, Ogg or
+    PDF), with that extension, never as the server's content type or the URL's
+    extension. SVG and HTML are refused. Public redirects to other sites are
+    still followed, carrying only plain request headers.
+  - **Form and popup webhooks never follow a redirect to another site.** A
+    signed body, its signature, timestamp, event id and idempotency key reach
+    only the configured origin (a redirect within that origin is followed;
+    popup webhooks report the refusal as `blocked-endpoint`). When a redirect
+    turns a request into a GET, entity and signature headers are dropped.
+    **Receivers that redirect to another host must be configured with their
+    final address.**
+  - **Form webhooks** are checked when the form is saved, report a failure by
+    status only (the receiver's reply is never copied into it), and are never
+    sent unsigned when signing fails.
+- **Addresses in records keep the origin only.** Webhook delivery records,
+  errors and the form audit trail show a webhook as its origin plus a fixed
+  `/[redacted]` marker, never its path, query string or credentials, because
+  receivers put keys in paths as well as in query strings. Settings whose name
+  says they are a secret are recorded as changed, never with a value.
+
+## 0.95.0
+
+- **Pages can be link-only, and unpublished from the page itself.** Listing is
+  a second property beside publication, and neither changes the other:
+  - **Make link-only / Show on website** (`setPageListingCore`). A link-only
+    page stays online at its address but is left out of menus, the footer and
+    the sitemap, and gets `noindex`. No publication, version, schedule or
+    status is written, so "Show on website" cannot publish an offline page,
+    and saving, publishing and scheduled replacements keep a page link-only.
+    Link-only is not access control.
+  - **Unpublish** (the existing `cms_set_page_status`) is also offered in the
+    builder header. Both actions are in the page builder and the pages list,
+    and ask for confirmation with the consequences spelled out in full.
+  - **Protected pages.** A host passes `protectedPageKeys` in the page deps
+    (Voyara: the start page and the contact page). The server refuses to
+    unpublish, end-date, trash or unlist them. This is an application
+    safeguard; direct database access is not blocked by it.
+  - Offline states read `Offline`, `Scheduled to go offline` and
+    `Offline after expiry` (previously "Hidden…"), so they cannot be confused
+    with link-only.
+  - A copy of a link-only page starts link-only. A same-key retry completes a
+    copy whose listing write failed, with the original decision, and never
+    changes a finished copy: the decision is applied only if the database
+    recorded it before the copy existed. Booking exceptions are never copied.
+- **A site-wide booking switch, with exception pages.** One switch
+  (`setBookingEnabledCore`, Booking card: `./backoffice/BookingSettingsCard`)
+  hides every link to a host starting with `booking` (`isBookingHref`) in page
+  content, the menu, the footer and popups, plus a header CTA the host marks
+  `booking: true`. Pages marked as exceptions keep the booking links in their
+  own content. Stored content is never changed: hosts remove booking from data
+  before it leaves the server (`stripBookingDeep`, `withoutBookingPopups`),
+  and the page renderer can apply the same removal to whatever the browser
+  cache holds.
+- **One public policy for publication, listing and booking**
+  (`loadPublicPolicyCore`, `./cms/page-visibility`). It is read in one
+  snapshot and cached with the published-page cache. A read begun before an
+  invalidation can no longer refill the cache with the old answer. A failed
+  read throws and is not cached, and hosts fail closed.
+  - Hosts send the chrome only the hidden addresses the menu and footer link
+    to (`routeAliasMap` from `./site/route-aliases`; `restrictToLinks` and
+    `savedLinkHrefs` from `./navigation/visibility`) and provide them through
+    `LinkVisibilityProvider` (`./site/link-visibility`). The saved menu is
+    never changed.
+  - The public page route takes a per-page `pagePolicy`: an offline page
+    answers 404 even when the browser has it cached, a cached "not found" is
+    re-read once the page is live, and a non-indexable page gets `noindex`.
+    `PageRenderer` accepts an optional `transform` and `variant`, so the
+    current policy decides over a warm page cache.
+- **Popups follow the booking switch without losing anything else.** The
+  popup module is no longer remounted when the policy changes. While booking
+  is hidden, booking popups are kept paused, with their booking links and
+  actions taken out, so an open one stays readable and closes normally. The
+  restriction applies at once from what is already loaded, without waiting for
+  a refresh, and a slow, failed or late refresh cannot bring booking back.
+  An open newsletter form keeps its field, text and focus, its trigger timers,
+  counts and analytics.
+- **Storage: no migration.** One `site_settings` row per decision
+  (`page.listing.<uuid>`, `booking`, `booking.exception.<uuid>`, and a
+  short-lived `duplicate.intent.<key>` during a duplication). Every write is a
+  compare-and-swap on `updated_at` (`VisibilityConflictError`). None of these
+  keys can be reached by the generic settings save or reset.
+- **New exports:**
+  - `./cms/page-visibility`;
+  - `./cms/booking-links`;
+  - `./server/page-visibility-core`;
+  - `./navigation/visibility`;
+  - `./site/link-visibility`;
+  - `./site/route-aliases`;
+  - `./backoffice/BookingSettingsCard`.
+
+  The new host wiring is optional (`pages.fns.setPageListing`, `booking.fns`,
+  `useLinkVisibility`); without it the new actions and the Booking card are
+  not shown. See `docs/PAGES.md`.
+
 ## 0.94.0
 
 - **The version screen shows what is actually deployed and installed.**

package/docs/PAGES.md

@@ -92,11 +92,15 @@ show the state the rule produces — `publicationStateAt` over the page's own
 
 | State | Badge | Means |
 | --- | --- | --- |
-| `draft` | Hidden | Nothing open, nothing scheduled |
-| `scheduled` | Scheduled to publish | Hidden now; a window opens later |
+| `draft` | Offline | Nothing open, nothing scheduled |
+| `scheduled` | Scheduled to publish | Offline now; a window opens later |
 | `published` | Published | A visitor can open it right now |
-| `ending` | Scheduled to hide | Public, with an end date already set |
-| `expired` | Hidden after expiry | Was public; the window has closed |
+| `ending` | Scheduled to go offline | Public, with an end date already set |
+| `expired` | Offline after expiry | Was public; the window has closed |
+
+(These read "Hidden", "Scheduled to hide" and "Hidden after expiry" until
+listing was added: a link-only page is *online* but unlisted, and the two must
+not share a word. See [Listing, link-only pages and booking](#listing-link-only-pages-and-booking).)
 
 `pages.status` is still shown, labelled **Editorial** so it cannot be mistaken
 for the other one, and the action offered follows the publication state rather
@@ -508,3 +512,67 @@ A host that has not registered them keeps working — the Pages list hides the t
 actions rather than offering a button that throws. Authorization is the existing
 one: both go through the same staff guard as every other page mutation, and
 `tests/page-publish-duplicate.test.ts` pins a non-staff caller being refused.
+
+## Listing, link-only pages and booking
+
+Listing is a second property beside publication, and the two never touch:
+
+| Publication | Listing | Shown as | A visitor gets |
+| --- | --- | --- | --- |
+| live | listed | `Published` | The page; it is in menus, footer and sitemap |
+| live | link-only | `Published` + `Link only` | The page by its address only; left out of menus, footer and sitemap; `noindex` |
+| not live | either | `Offline` (+ `Link only once published`) | 404 |
+
+- **Make link-only / Show on website** change listing only (`setPageListingCore`).
+  No publication, version, schedule or `pages.status` is written, so "Show on
+  website" cannot publish an offline page, and saving, publishing and scheduled
+  replacements keep a page link-only. Link-only is not access control: the
+  address can be shared or found, and `noindex` asks crawlers, it does not
+  remove existing results.
+- **Unpublish** is the existing `cms_set_page_status(draft)` with its
+  schedule-aware warnings, now also offered in the builder header.
+- **Protected pages.** A host passes `protectedPageKeys` in the page deps (Voyara:
+  the start page and the contact page). The cores refuse to unpublish, end-date,
+  trash or unlist them. An application safeguard: direct database access is not
+  blocked by it.
+- **Booking.** One switch hides every link whose address is `https:` (or
+  protocol-relative) with a host starting `booking` (`isBookingHref`), plus the
+  header CTA when the host marks it `booking: true`. Exception pages keep the
+  booking links in their own content. Removal (`stripBookingDeep`,
+  `withoutBookingPopups`) is for the host to apply to data before it leaves the
+  server; stored content is never changed.
+
+### Storage
+
+No migration: one `site_settings` row per decision, keyed by page id —
+`page.listing.<uuid>`, `booking`, `booking.exception.<uuid>`. Every write is a
+compare-and-swap on `updated_at` (`VisibilityConflictError` when someone else
+changed the row first). None is an `OVERRIDABLE_SETTING_KEYS` key, so the generic
+settings save and reset cannot reach them.
+
+### The public policy
+
+`loadPublicPolicyCore` reads publication, listing, booking and exceptions for
+every page in one snapshot, cached with the published-page cache (cleared on
+every page and visibility write, capped at the next publication boundary). A
+failed read throws and is not cached; hosts fail closed (`known: false`: booking
+hidden, nothing indexable, nothing reported offline).
+
+Hosts turn the snapshot into what the chrome needs with `routeAliasMap`,
+`restrictToLinks` and `savedLinkHrefs` — only the hidden addresses the menu and
+footer actually link to are sent to the browser — and provide it through
+`LinkVisibilityProvider`. The header and footer leave those links out; the
+saved menu is never changed, and the navigation editor says why an item is not
+shown. The public page route takes a per-page `pagePolicy` query and adds
+`noindex` for a page that is not indexable.
+
+### Host wiring
+
+```ts
+pages: { fns: { setPageStatus?, setPageListing?, ... } }
+booking?: { fns: { getBookingSettings, setBookingEnabled, setBookingException } }
+useLinkVisibility?: () => LinkVisibilityPolicy | undefined
+```
+
+All optional: without them the actions, the Booking card and the editor's
+explanation are simply not shown.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bygghammar/cms-platform",
-  "version": "0.94.0",
+  "version": "0.96.0",
   "description": "Shared CMS platform: blocks, block types, i18n core, UI primitives and design-token contract used by every Bygghammar/Voyara site.",
   "type": "module",
   "sideEffects": [
@@ -49,6 +49,7 @@
     "./trips": "./src/trips/index.ts",
     "./trips/TripSectionEditor": "./src/trips/TripSectionEditor.tsx",
     "./navigation": "./src/navigation/index.ts",
+    "./navigation/visibility": "./src/navigation/visibility.ts",
     "./forms/FormRenderer": "./src/forms/FormRenderer.tsx",
     "./forms/success": "./src/forms/success-listeners.ts",
     "./forms/submission-result": "./src/forms/submission-result.ts",
@@ -124,6 +125,7 @@
     "./config/site-config": "./src/config/site-config.ts",
     "./server/site-settings-core": "./src/server/site-settings-core.ts",
     "./backoffice/SiteSettingsView": "./src/backoffice/SiteSettingsView.tsx",
+    "./backoffice/BookingSettingsCard": "./src/backoffice/BookingSettingsCard.tsx",
     "./backoffice/SitemapView": "./src/backoffice/SitemapView.tsx",
     "./backoffice/UsersView": "./src/backoffice/UsersView.tsx",
     "./backoffice/RolesView": "./src/backoffice/RolesView.tsx",
@@ -154,6 +156,7 @@
     "./server/media-library-core": "./src/server/media-library-core.ts",
     "./server/admin-core": "./src/server/admin-core.ts",
     "./server/pages-core": "./src/server/pages-core.ts",
+    "./server/page-visibility-core": "./src/server/page-visibility-core.ts",
     "./server/edit-locks-core": "./src/server/edit-locks-core.ts",
     "./server/edit-lock-adapter": "./src/server/edit-lock-adapter.ts",
     "./server/edit-lock-supabase-adapter": "./src/server/edit-lock-supabase-adapter.ts",
@@ -205,6 +208,8 @@
     "./media/use-media-upload": "./src/media/use-media-upload.ts",
     "./cms/page-draft-store": "./src/cms/page-draft-store.ts",
     "./cms/page-publication": "./src/cms/page-publication.ts",
+    "./cms/page-visibility": "./src/cms/page-visibility.ts",
+    "./cms/booking-links": "./src/cms/booking-links.ts",
     "./site/routes": "./src/site/routes.ts",
     "./site/PageRenderer": "./src/site/PageRenderer.tsx",
     "./server/env": "./src/server/env.ts",
@@ -232,6 +237,8 @@
     "./site/host": "./src/site/host.ts",
     "./site/locale-domains": "./src/site/locale-domains.ts",
     "./site/route-index": "./src/site/route-index.ts",
+    "./site/route-aliases": "./src/site/route-aliases.ts",
+    "./site/link-visibility": "./src/site/link-visibility.tsx",
     "./site/SiteHeader": "./src/site/SiteHeader.tsx",
     "./site/SiteFooter": "./src/site/SiteFooter.tsx",
     "./server/schemas": "./src/server/schemas.ts",

package/src/admin/describe-log.ts

@@ -34,6 +34,9 @@ export const ACTION_LABELS: Record<string, string> = {
   "page.delete": "Deleted page",
   "page.publish": "Published page",
   "page.unpublish": "Unpublished page",
+  "page.listing": "Changed whether a page is listed",
+  "booking.settings": "Switched booking on or off",
+  "booking.exception": "Changed which pages keep booking links",
   "page.version.create": "Saved page version",
   "page.version.restore": "Restored page version",
   "template.create": "Created block template",

package/src/backoffice/BookingSettingsCard.tsx

@@ -0,0 +1,252 @@
+/**
+ * Site settings → Booking: one switch for every booking link on the public
+ * site, and the pages that keep theirs while it is off.
+ *
+ * What it does is said on the card, because the switch is easy to misread in
+ * both directions: it hides links and the header button, it does not close the
+ * booking site, and an address somebody already has still works.
+ */
+import { useState, type ReactNode } from "react";
+import { toast } from "sonner";
+import { Plus, Trash2 } from "lucide-react";
+
+import { ConfirmDialog } from "./media/ConfirmDialog";
+
+export type BookingSettingsData = {
+  enabled: boolean;
+  version: string | null;
+  exceptions: Array<{
+    pageId: string;
+    key: string | null;
+    name: string | null;
+    missing: boolean;
+    version: string | null;
+  }>;
+  /** Versions of every stored exception row, removed ones included. */
+  rowVersions?: Record<string, string | null>;
+};
+
+export type BookingSettingsDeps = {
+  /** Undefined while loading. */
+  settings: BookingSettingsData | undefined;
+  /** A failed read: the card says so and offers nothing it cannot back up. */
+  error: Error | null;
+  /** Pages an exception can be added for. */
+  pages: Array<{ id: string; key: string; name: string }> | undefined;
+  /** Public path of a page key, for the list. */
+  pathFor: (key: string) => string;
+  setEnabled: (input: { enabled: boolean; expectedVersion: string | null }) => Promise<unknown>;
+  setException: (input: {
+    pageId: string;
+    exception: boolean;
+    expectedVersion: string | null;
+  }) => Promise<unknown>;
+  refresh: () => void;
+};
+
+const cardClass = "border border-ink/10 bg-white p-6";
+
+export function BookingSettingsCard({ deps }: { deps: BookingSettingsDeps }): ReactNode {
+  const { settings, error, pages, pathFor } = deps;
+  const [confirming, setConfirming] = useState<boolean | null>(null);
+  const [adding, setAdding] = useState("");
+  const [busy, setBusy] = useState(false);
+
+  const run = async (action: () => Promise<unknown>, done: string) => {
+    setBusy(true);
+    try {
+      await action();
+      toast.success(done);
+    } catch (e) {
+      toast.error(e instanceof Error ? e.message : "Failed to save");
+    } finally {
+      setBusy(false);
+      // Success or conflict alike: show what is stored now.
+      deps.refresh();
+    }
+  };
+
+  const exceptionIds = new Set((settings?.exceptions ?? []).map((row) => row.pageId));
+  const candidates = (pages ?? [])
+    .filter((page) => !exceptionIds.has(page.id.toLowerCase()))
+    .sort((a, b) => a.name.localeCompare(b.name));
+
+  return (
+    <section className={`mt-6 ${cardClass}`} aria-labelledby="booking-settings-title">
+      <h2 id="booking-settings-title" className="font-serif text-xl text-ink">
+        Booking
+      </h2>
+      <p className="mt-2 max-w-2xl text-sm text-ink/60">
+        Booking links are links and buttons whose address starts with{" "}
+        <code className="font-mono text-xs">https://booking</code>, for example{" "}
+        <code className="font-mono text-xs">https://booking.voyara.se</code>. Hiding booking removes
+        them from every page, together with the booking button in the menu. The booking site itself
+        keeps working, and an address someone already has still opens.
+      </p>
+
+      {error ? (
+        <p role="alert" className="mt-4 text-sm text-red-700">
+          The booking setting could not be read: {error.message}. Nothing is shown here until it
+          can be, so nothing is changed by mistake.
+        </p>
+      ) : !settings ? (
+        <p className="mt-4 text-sm text-ink/50">Loading…</p>
+      ) : (
+        <>
+          <div className="mt-5 flex flex-wrap items-center gap-4">
+            <p className="text-sm text-ink" aria-live="polite">
+              {settings.enabled ? (
+                <>
+                  Booking is <strong>shown</strong> on the website.
+                </>
+              ) : (
+                <>
+                  Booking is <strong>hidden</strong> on the website.
+                </>
+              )}
+            </p>
+            <button
+              type="button"
+              disabled={busy}
+              onClick={() => setConfirming(!settings.enabled)}
+              className={[
+                "inline-flex items-center gap-2 px-4 py-2 text-xs uppercase tracking-[0.18em] disabled:opacity-40",
+                settings.enabled
+                  ? "border border-red-300 text-red-700 hover:border-red-600"
+                  : "bg-ink text-paper hover:bg-ink/85",
+              ].join(" ")}
+            >
+              {settings.enabled ? "Hide booking" : "Show booking"}
+            </button>
+          </div>
+
+          <div className="mt-8 border-t border-ink/10 pt-5">
+            <h3 className="text-xs uppercase tracking-wider text-ink/60">
+              Pages that keep their booking links
+            </h3>
+            <p className="mt-2 max-w-2xl text-sm text-ink/60">
+              While booking is hidden, these pages still show the booking links in their own
+              content — for example a link-only page for one group. The booking button in the menu
+              stays hidden on them too.
+            </p>
+            <ul className="mt-4 divide-y divide-ink/10 border border-ink/10">
+              {settings.exceptions.length === 0 ? (
+                <li className="px-4 py-3 text-sm text-ink/50">No pages.</li>
+              ) : (
+                settings.exceptions.map((row) => (
+                  <li
+                    key={row.pageId}
+                    className="flex flex-wrap items-center justify-between gap-3 px-4 py-3 text-sm"
+                  >
+                    <span className="min-w-0">
+                      <span className="text-ink">{row.name ?? "Page no longer exists"}</span>
+                      {row.key ? (
+                        <span className="ml-2 break-all font-mono text-xs text-ink/50">
+                          {pathFor(row.key)}
+                        </span>
+                      ) : null}
+                      {row.missing ? (
+                        <span className="ml-2 text-xs text-ink/50">
+                          (in the trash or deleted — has no effect)
+                        </span>
+                      ) : null}
+                    </span>
+                    <button
+                      type="button"
+                      disabled={busy}
+                      onClick={() =>
+                        run(
+                          () =>
+                            deps.setException({
+                              pageId: row.pageId,
+                              exception: false,
+                              expectedVersion: row.version,
+                            }),
+                          `Removed ${row.name ?? "the page"}`,
+                        )
+                      }
+                      className="inline-flex items-center gap-1 text-xs text-red-700 hover:underline disabled:opacity-40"
+                    >
+                      <Trash2 className="size-3.5" aria-hidden="true" /> Remove
+                      <span className="sr-only"> {row.name ?? "page"} from the list</span>
+                    </button>
+                  </li>
+                ))
+              )}
+            </ul>
+            <div className="mt-4 flex flex-wrap items-end gap-3">
+              <label className="block min-w-0 flex-1 sm:max-w-sm">
+                <span className="mb-1 block text-xs uppercase tracking-wider text-ink/60">
+                  Add a page
+                </span>
+                <select
+                  value={adding}
+                  onChange={(e) => setAdding(e.target.value)}
+                  disabled={busy || !pages}
+                  className="w-full border border-ink/15 bg-white px-3 py-2 text-sm text-ink"
+                >
+                  <option value="">Choose a page…</option>
+                  {candidates.map((page) => (
+                    <option key={page.id} value={page.id}>
+                      {page.name} — {pathFor(page.key)}
+                    </option>
+                  ))}
+                </select>
+              </label>
+              <button
+                type="button"
+                disabled={busy || !adding}
+                onClick={() => {
+                  const page = candidates.find((p) => p.id === adding);
+                  // An exception removed earlier leaves its row behind; send its version.
+                  const previous = settings.rowVersions?.[adding.toLowerCase()] ?? null;
+                  void run(
+                    () =>
+                      deps.setException({
+                        pageId: adding,
+                        exception: true,
+                        expectedVersion: previous,
+                      }),
+                    `${page?.name ?? "The page"} keeps its booking links`,
+                  ).then(() => setAdding(""));
+                }}
+                className="inline-flex items-center gap-2 border border-ink/20 px-4 py-2 text-xs uppercase tracking-[0.18em] hover:border-ink disabled:opacity-40"
+              >
+                <Plus className="size-4" aria-hidden="true" /> Add
+              </button>
+            </div>
+          </div>
+        </>
+      )}
+
+      {confirming !== null && settings ? (
+        <ConfirmDialog
+          title={confirming ? "Show booking on the website?" : "Hide booking on the website?"}
+          description={
+            confirming
+              ? "Booking links and the booking button in the menu appear again on every page."
+              : "Every link and button that goes to a booking site is removed from the public website, on every page, together with the booking button in the menu."
+          }
+          consequences={
+            confirming
+              ? ["The booking button in the menu also needs its booking page to be published and listed."]
+              : [
+                  "Pages in the list below keep the booking links in their own content.",
+                  "The booking site itself is not closed: anyone who already has a booking address can still use it.",
+                ]
+          }
+          confirmLabel={confirming ? "Show booking" : "Hide booking"}
+          danger={!confirming}
+          busy={busy}
+          onConfirm={() =>
+            void run(
+              () => deps.setEnabled({ enabled: confirming, expectedVersion: settings.version }),
+              confirming ? "Booking is shown on the website" : "Booking is hidden on the website",
+            ).then(() => setConfirming(null))
+          }
+          onCancel={() => setConfirming(null)}
+        />
+      ) : null}
+    </section>
+  );
+}

package/src/backoffice/NavigationView.tsx

@@ -7,6 +7,11 @@ import { EDIT_LOCK_TYPES } from "../cms/edit-lock";
 import type { SiteTypography, TypographySlot } from "../config/typography";
 import { EditLockBanner, EditLockFence, useEditLock } from "./EditLock";
 import { TypographyPanel } from "./TypographyPanel";
+import {
+  HIDDEN_LINK_REASONS,
+  hiddenSavedLinks,
+  type LinkVisibilityPolicy,
+} from "../navigation/visibility";
 
 /** The two site-wide content sections this screen edits. */
 export type NavigationSectionKey = "nav" | "footer";
@@ -19,6 +24,12 @@ const TYPOGRAPHY_SLOT: Record<NavigationSectionKey, TypographySlot> = {
 
 /** Host-provided data and actions for the navigation & footer screen. */
 export type NavigationDeps = {
+  /**
+   * The link policy the public site applies right now. With it, the editor
+   * lists saved items the site is not showing and says why; without it,
+   * nothing is said. The saved menu is never changed either way.
+   */
+  linkPolicy?: LinkVisibilityPolicy;
   /** Saved overrides keyed by section, as stored in the CMS. */
   overrides: Record<string, unknown> | undefined;
   /** Resolved live site content (defaults merged with overrides). */
@@ -77,6 +88,11 @@ function Editor({
   }, [overrides, site, sectionKey]);
 
   const [draft, setDraft] = useState<unknown>(current);
+  // About what is saved, not the unsaved draft: this is what visitors get now.
+  const notShown = useMemo(
+    () => (deps.linkPolicy ? hiddenSavedLinks(sectionKey, current, deps.linkPolicy) : []),
+    [deps.linkPolicy, sectionKey, current],
+  );
   const [busy, setBusy] = useState(false);
   const [dirty, setDirty] = useState(false);
 
@@ -127,6 +143,28 @@ function Editor({
 
       <div className="p-6">
         <EditLockBanner lock={lock} className="mb-6" />
+        {notShown.length > 0 ? (
+          <div
+            role="status"
+            className="mb-6 border border-brass/50 bg-brass/10 px-4 py-3 text-sm text-ink"
+          >
+            <p className="font-medium">
+              {notShown.length === 1
+                ? "1 saved link is not shown on the site right now."
+                : `${notShown.length} saved links are not shown on the site right now.`}{" "}
+              They stay saved and come back by themselves.
+            </p>
+            <ul className="mt-2 space-y-1">
+              {notShown.map((item, index) => (
+                <li key={`${item.href}-${index}`} className="break-words">
+                  <span className="text-ink">{item.label}</span>{" "}
+                  <span className="font-mono text-xs text-ink/60">{item.href}</span> —{" "}
+                  <span className="text-ink/70">{HIDDEN_LINK_REASONS[item.reason]}</span>
+                </li>
+              ))}
+            </ul>
+          </div>
+        ) : null}
 
         <EditLockFence lock={lock}>
           <SectionForm