@geekity/cms 0.3.0 → 0.5.0

package/dist/comments/submission.js

@@ -0,0 +1,280 @@
+import { CSRF_FIELD } from '../admin/session.js';
+import { ADDRESS_SALT_FILE, FORM_LOADED_FIELD, FORM_TRAP_FIELD, formTimingRefusal, trapped, } from '../forms/protection.js';
+import { renderCommentMarkdown } from './markdown.js';
+import { intakeComment } from './records.js';
+/**
+ * What happens between somebody pressing Post and a proposed comment.
+ *
+ * Three defences run before anything is proposed, in the order that costs least
+ * and gives away least — the honeypot, the age of the form and the per-address
+ * rate limit. The first two are `forms/protection.ts`, shared with the contact
+ * form (TASK-56) so the two public forms cannot drift into different rules; the
+ * third is the same limiter the login form uses, over the commenter's address,
+ * so one machine cannot post a hundred comments while a moderator sleeps.
+ *
+ * What survives all three is handed to {@link intakeComment}, which is where
+ * every comment on this site is written whatever proposed it: the checker, the
+ * verdict-to-status rule, the file, the index and the notice all live there, so
+ * a form submission and a webmention cannot be treated by two sets of rules.
+ *
+ * The {@link CommentChecker} interface stays here because this is where it
+ * reads: it is the one seam a third-party service plugs into, everything
+ * Akismet's API asks for is on the submission it is handed, and its four
+ * answers are the four the intake understands. Nothing else in the CMS has to
+ * know such a service exists.
+ */
+// Re-exported where they have always been, so a site that imported them from
+// the package, and the modules in here that did, are unaffected by the move.
+export { hashClientAddress, MAXIMUM_FORM_AGE_SECONDS, MINIMUM_SUBMIT_SECONDS, } from '../forms/protection.js';
+/** Where the salt that hides commenters' addresses lives, under `dataDir`. */
+export const COMMENT_SALT_FILE = ADDRESS_SALT_FILE;
+/** The fields the comment form submits. */
+export const COMMENT_FIELDS = {
+    /** The post being commented on, as its slug. */
+    post: 'post',
+    /** The commenter's name. Required. */
+    name: 'name',
+    /** Their email. Optional, and never shown. */
+    email: 'email',
+    /** Their website. Optional. */
+    url: 'url',
+    /** The comment itself, as Markdown. Required. */
+    body: 'body',
+    /** The comment being answered, or empty for one answering the post. */
+    inReplyTo: 'in_reply_to',
+    /** The honeypot, which every public form here spells the same way. */
+    trap: FORM_TRAP_FIELD,
+    /** When the form was rendered, in epoch milliseconds. */
+    loaded: FORM_LOADED_FIELD,
+    /**
+     * The CSRF token, which only the signed-in form carries (TASK-103).
+     *
+     * Spelled exactly as every admin form spells it, because it is the same
+     * per-session token and is checked by the same comparison.
+     */
+    csrf: CSRF_FIELD,
+    /**
+     * "Tell me when somebody answers this."
+     *
+     * A checkbox, so any non-empty value is a yes. It only ever means anything
+     * alongside an email address, and the form only offers it when the site can
+     * actually send mail (TASK-55).
+     */
+    notify: 'notify',
+};
+/** How many comments one address may post before it has to wait. */
+export const COMMENT_RATE_LIMIT = 5;
+/** How long that window is, and how long the first wait after it lasts. */
+export const COMMENT_RATE_WINDOW_SECONDS = 600;
+/** The longest a name may be. */
+export const MAXIMUM_NAME_LENGTH = 80;
+/** The longest an email or a website may be. */
+export const MAXIMUM_URL_LENGTH = 500;
+/** The longest a comment may be, in characters. */
+export const MAXIMUM_BODY_LENGTH = 10_000;
+/**
+ * What is wrong with a submitted comment, as a person would be told it.
+ *
+ * Only the things a person can fix. The honeypot, the form's age and the rate
+ * limit are not here: none of them is the commenter's mistake, and two of them
+ * should not be explained to whoever tripped them.
+ *
+ * A signed-in commenter is asked for nothing but the comment (TASK-103), so
+ * only the comment is checked: the name, the email and the website come off
+ * the account and there are no boxes on the form to put anything right in.
+ */
+export function commentProblems(form, signedIn = false) {
+    const problems = {};
+    const body = form.body.trim();
+    if (body === '')
+        problems.body = 'A comment needs something in it.';
+    else if (body.length > MAXIMUM_BODY_LENGTH) {
+        problems.body = `That comment is longer than ${String(MAXIMUM_BODY_LENGTH)} characters.`;
+    }
+    if (signedIn)
+        return problems;
+    const name = form.name.trim();
+    if (name === '')
+        problems.name = 'A comment needs a name to go under.';
+    else if (name.length > MAXIMUM_NAME_LENGTH) {
+        problems.name = `That name is longer than ${String(MAXIMUM_NAME_LENGTH)} characters.`;
+    }
+    const email = form.email.trim();
+    if (email !== '' && !isEmail(email)) {
+        problems.email =
+            'That does not look like an email address. Leave it empty if you would rather.';
+    }
+    const url = form.url.trim();
+    if (url !== '' && normalizeWebsite(url) === undefined) {
+        problems.url = 'A website is an http:// or https:// address.';
+    }
+    return problems;
+}
+/**
+ * Take a submitted form and, if it survives everything, store the comment.
+ *
+ * The caller has already decided that the post is open: whether a form should
+ * exist at all is {@link commentsOpen}'s question, and asking it here as well
+ * would let the two answers differ.
+ */
+export async function submitComment(options) {
+    const { records, document, form, throttle } = options;
+    const now = options.now ?? new Date();
+    // Whether the site knows who this is. It decides the attribution, the two
+    // cheap defences and where the comment lands, so it is read once.
+    const signedIn = options.author;
+    // The honeypot first, because it costs one comparison and because a
+    // submission that tripped it should not reach anything that could tell it so.
+    // Not for a signed-in commenter: their form carries no honeypot, and a
+    // session is better evidence than an empty box.
+    if (signedIn === undefined && trapped(form.trap))
+        return refused({ kind: 'discarded' });
+    const problems = commentProblems(form, signedIn !== undefined);
+    if (Object.keys(problems).length > 0)
+        return refused({ kind: 'invalid', problems });
+    // The form's age, for the same reason and with the same exception: a
+    // signed-in form carries no loaded-at stamp to measure.
+    if (signedIn === undefined) {
+        const timing = formTimingRefusal(form.loaded, now);
+        if (timing !== undefined)
+            return refused({ kind: timing });
+    }
+    // The rate limit stays either way. It is not about proving somebody is a
+    // person; it is about what one address may do in ten minutes, and a stolen
+    // session is exactly the case it would be wanted for.
+    const keys = commentKeys(options.address);
+    const wait = throttle.retryAfter(keys);
+    if (wait !== undefined)
+        return refused({ kind: 'rate-limited', retryAfter: wait });
+    const markdown = form.body.trim();
+    const author = signedIn === undefined
+        ? {
+            name: form.name.trim(),
+            url: normalizeWebsite(form.url.trim()) ?? null,
+            email: form.email.trim() === '' ? null : form.email.trim(),
+            // A form asks for no picture: only a webmention brings one (TASK-51).
+            avatar: null,
+        }
+        : {
+            name: signedIn.name,
+            url: signedIn.url,
+            email: signedIn.email,
+            avatar: null,
+        };
+    const proposed = {
+        slug: document.slug,
+        permalink: document.permalink,
+        source: 'comment',
+        kind: 'reply',
+        author,
+        content: { markdown, html: renderCommentMarkdown(markdown) },
+        submitted: now.toISOString(),
+        inReplyTo: parentOf(form.inReplyTo, document.slug, records),
+        // A comment written here lives here: only a webmention has a page of its
+        // own somewhere else (TASK-51).
+        url: null,
+        // Only ever true when there is an address to send to. A box ticked with
+        // the email field empty is somebody asking to be told at nowhere.
+        notify: options.notifiable === true && form.notify.trim() !== '' && author.email !== null,
+    };
+    const outcome = await intakeComment({
+        records,
+        // Geekity has one role, so anybody who can sign in can already publish a
+        // post and approve any comment. A comment of theirs waiting in a queue for
+        // them to approve would be theatre, and a spam service has no say in what
+        // the owner of the site says — so a signed-in comment arrives at the
+        // intake as exactly what it is, the site's own author writing, and is
+        // approved on arrival with no call to the checker (TASK-103).
+        origin: signedIn === undefined ? 'form' : 'moderator',
+        comment: proposed,
+        post: {
+            title: document.title,
+            url: absolute(document.permalink, options.baseUrl),
+        },
+        dataDir: options.dataDir,
+        baseUrl: options.baseUrl,
+        checker: options.checker,
+        notices: options.notices,
+        address: options.address,
+        userAgent: options.userAgent,
+        referrer: options.referrer,
+    });
+    // Counted against the address whatever became of it: a machine posting
+    // rubbish should not get unlimited free attempts because the rubbish was
+    // recognised.
+    throttle.fail(keys);
+    return outcome.kind === 'stored'
+        ? { kind: 'stored', comment: outcome.comment }
+        : refused({ kind: 'discarded' });
+}
+/**
+ * The comment a submission answers, or `null`.
+ *
+ * A named parent that is not a comment on this very post is dropped rather
+ * than stored: threading a reply under something on another page would put it
+ * somewhere nobody can see it, and an id somebody made up is not a parent.
+ */
+function parentOf(submitted, slug, records) {
+    const id = submitted.trim();
+    if (id === '')
+        return null;
+    const parent = records.admin.getComment(id);
+    return parent !== undefined && parent.slug === slug ? parent.id : null;
+}
+/** The keys a submission is rate limited against. */
+export function commentKeys(address) {
+    return address === undefined ? [] : [`comment:${address}`];
+}
+/**
+ * A submitted website as the absolute URL it means, or `undefined` when it
+ * means none.
+ *
+ * A bare `example.com` becomes `https://example.com/`, because that is what
+ * somebody typing it meant and refusing it would be pedantry; anything whose
+ * scheme is not http or https is refused, because it is going on a page as a
+ * link.
+ */
+export function normalizeWebsite(value) {
+    const trimmed = value.trim();
+    if (trimmed === '' || trimmed.length > MAXIMUM_URL_LENGTH)
+        return undefined;
+    const candidate = /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed) ? trimmed : `https://${trimmed}`;
+    let url;
+    try {
+        url = new URL(candidate);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        return undefined;
+    if (url.hostname === '')
+        return undefined;
+    return url.href;
+}
+/**
+ * Whether something looks like an email address.
+ *
+ * Deliberately loose. The address is never shown and nothing is ever sent to
+ * it (TASK-50 has no email at all), so the only thing checking it buys is
+ * catching a typo; a stricter rule would refuse valid addresses and buy
+ * nothing.
+ */
+function isEmail(value) {
+    if (value.length > MAXIMUM_URL_LENGTH)
+        return false;
+    return /^[^\s@]+@[^\s@.]+(\.[^\s@.]+)+$/.test(value);
+}
+/** A site-root path as an absolute URL. */
+function absolute(pathname, baseUrl) {
+    try {
+        return new URL(pathname, baseUrl).href;
+    }
+    catch {
+        return pathname;
+    }
+}
+function refused(refusal) {
+    return { kind: 'refused', refusal };
+}
+//# sourceMappingURL=submission.js.map

package/dist/comments/submission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission.js","sourceRoot":"","sources":["../../src/comments/submission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGjD,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,OAAO,GACR,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,6EAA6E;AAC7E,6EAA6E;AAC7E,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAEhC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAEnD,2CAA2C;AAC3C,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,gDAAgD;IAChD,IAAI,EAAE,MAAM;IACZ,sCAAsC;IACtC,IAAI,EAAE,MAAM;IACZ,8CAA8C;IAC9C,KAAK,EAAE,OAAO;IACd,+BAA+B;IAC/B,GAAG,EAAE,KAAK;IACV,iDAAiD;IACjD,IAAI,EAAE,MAAM;IACZ,uEAAuE;IACvE,SAAS,EAAE,aAAa;IACxB,sEAAsE;IACtE,IAAI,EAAE,eAAe;IACrB,yDAAyD;IACzD,MAAM,EAAE,iBAAiB;IACzB;;;;;OAKG;IACH,IAAI,EAAE,UAAU;IAChB;;;;;;OAMG;IACH,MAAM,EAAE,QAAQ;CACR,CAAC;AAQX,oEAAoE;AACpE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAE/C,iCAAiC;AACjC,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC,gDAAgD;AAChD,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAEtC,mDAAmD;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAK1C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,IAAiB,EAAE,QAAQ,GAAG,KAAK;IACjE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,GAAG,kCAAkC,CAAC;SAC/D,IAAI,IAAI,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,GAAG,+BAA+B,MAAM,CAAC,mBAAmB,CAAC,cAAc,CAAC;IAC3F,CAAC;IAED,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,GAAG,qCAAqC,CAAC;SAClE,IAAI,IAAI,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,GAAG,4BAA4B,MAAM,CAAC,mBAAmB,CAAC,cAAc,CAAC;IACxF,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,QAAQ,CAAC,KAAK;YACZ,+EAA+E,CAAC;IACpF,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,GAAG,KAAK,EAAE,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;QACtD,QAAQ,CAAC,GAAG,GAAG,8CAA8C,CAAC;IAChE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAwLD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA6B;IAC/D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACtC,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;IAEhC,oEAAoE;IACpE,8EAA8E;IAC9E,uEAAuE;IACvE,gDAAgD;IAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAExF,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEpF,qEAAqE;IACrE,wDAAwD;IACxD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,sDAAsD;IACtD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAEnF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,MAAM,GACV,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC;YACE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YACtB,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI;YAC9C,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAC1D,sEAAsE;YACtE,MAAM,EAAE,IAAI;SACb;QACH,CAAC,CAAC;YACE,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,IAAI;SACb,CAAC;IACR,MAAM,QAAQ,GAAoB;QAChC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,MAAM,EAAE,SAAS;QACjB,IAAI,EAAE,OAAO;QACb,MAAM;QACN,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,CAAC,QAAQ,CAAC,EAAE;QAC5D,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;QAC3D,yEAAyE;QACzE,gCAAgC;QAChC,GAAG,EAAE,IAAI;QACT,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI;KAC1F,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC;QAClC,OAAO;QACP,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,qEAAqE;QACrE,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;QACrD,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE;YACJ,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC;SACnD;QACD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IAEH,uEAAuE;IACvE,yEAAyE;IACzE,cAAc;IACd,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEpB,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QAC9B,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;QAC9C,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,SAAiB,EAAE,IAAY,EAAE,OAAuB;IACxE,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5C,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,WAAW,CAAC,OAA2B;IACrD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,SAAS,CAAC;IAE5E,MAAM,SAAS,GAAG,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC;IAC7F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5E,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,2CAA2C;AAC3C,SAAS,QAAQ,CAAC,QAAgB,EAAE,OAAe;IACjD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,OAAuB;IACtC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC"}

package/dist/comments/viewer.d.ts

@@ -0,0 +1,21 @@
+import type { Context } from 'hono';
+import type { GeekityEnv } from '../env.ts';
+import type { CommentViewer } from './form.ts';
+/**
+ * Who the public site knows is reading it, when the request carries a login.
+ *
+ * The one place outside `/admin` that turns a session cookie into a person.
+ * Everything a comment needs about them is answered here — the name it goes
+ * under, the archive it links to, the email it is stored with and the token
+ * the form has to carry — so the page that draws the form and the endpoint
+ * that takes the submission are looking at one reading of one session.
+ *
+ * Deliberately total about the ways a cookie can be worth nothing. A forged or
+ * expired id, a session belonging to a user who has since been deleted, and
+ * the anonymous session that holds a CSRF token before anybody has logged in
+ * all answer `undefined`, which is the stranger's form: the only thing that
+ * gets the short form is a live session naming a user `users.json` still
+ * holds, which is the same test the admin guard applies at its own door.
+ */
+export declare function signedInCommenter(c: Context<GeekityEnv>): CommentViewer | undefined;
+//# sourceMappingURL=viewer.d.ts.map

package/dist/comments/viewer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"viewer.d.ts","sourceRoot":"","sources":["../../src/comments/viewer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAIpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,aAAa,GAAG,SAAS,CAwBnF"}

package/dist/comments/viewer.js

@@ -0,0 +1,45 @@
+import { findUserById } from '../admin/accounts.js';
+import { sessionIdFrom } from '../admin/session.js';
+import { authorHref } from '../web/authors.js';
+/**
+ * Who the public site knows is reading it, when the request carries a login.
+ *
+ * The one place outside `/admin` that turns a session cookie into a person.
+ * Everything a comment needs about them is answered here — the name it goes
+ * under, the archive it links to, the email it is stored with and the token
+ * the form has to carry — so the page that draws the form and the endpoint
+ * that takes the submission are looking at one reading of one session.
+ *
+ * Deliberately total about the ways a cookie can be worth nothing. A forged or
+ * expired id, a session belonging to a user who has since been deleted, and
+ * the anonymous session that holds a CSRF token before anybody has logged in
+ * all answer `undefined`, which is the stranger's form: the only thing that
+ * gets the short form is a live session naming a user `users.json` still
+ * holds, which is the same test the admin guard applies at its own door.
+ */
+export function signedInCommenter(c) {
+    const id = sessionIdFrom(c);
+    if (id === undefined)
+        return undefined;
+    // Reading a session prunes an expired one, so this is a live session or
+    // nothing at all. Measured against the wall clock rather than the site's
+    // configured one, because that is the clock a session was minted against and
+    // the one the admin guard reads: a login cannot last longer on the public
+    // site than it does in the admin.
+    const session = c.var.admin.getSession(id);
+    if (session?.userId == null)
+        return undefined;
+    const user = findUserById(c.var.config.dataDir, session.userId);
+    if (user === undefined)
+        return undefined;
+    return {
+        // What a byline would print for them, on the same rule: a user who has
+        // written no display name is called by their username, which is what
+        // their archive is under anyway.
+        name: user.profile?.displayName ?? user.username,
+        url: authorHref(user.username),
+        email: user.email ?? null,
+        csrfToken: session.csrfToken,
+    };
+}
+//# sourceMappingURL=viewer.js.map

package/dist/comments/viewer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"viewer.js","sourceRoot":"","sources":["../../src/comments/viewer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAG/C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAsB;IACtD,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAEvC,wEAAwE;IACxE,yEAAyE;IACzE,6EAA6E;IAC7E,0EAA0E;IAC1E,kCAAkC;IAClC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC3C,IAAI,OAAO,EAAE,MAAM,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAEzC,OAAO;QACL,uEAAuE;QACvE,qEAAqE;QACrE,iCAAiC;QACjC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,IAAI,IAAI,CAAC,QAAQ;QAChD,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC9B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -1,5 +1,10 @@
 import type { KvStore, MessageQueue } from '@fedify/fedify';
+import type { AccessLogWriter } from './access-log.ts';
+import type { CommentChecker } from './comments/submission.ts';
+import type { Clock } from './content/store.ts';
 import type { DocumentChange } from './content/sync.ts';
+import type { MailProvider } from './mail/provider.ts';
+import type { MailLogger } from './mail/service.ts';
 /**
  * Something a site wants to happen when the index changes.
  *
@@ -44,6 +49,36 @@ export interface FederationOverrides {
      */
     allowPrivateAddress?: boolean | undefined;
 }
+/**
+ * The mail pieces a site may swap (TASK-53).
+ *
+ * Everything here has a default that is right for a personal blog: the
+ * provider comes from the settings screen and `data/mail.json`, a refused
+ * message is tried three times with a growing wait, and attempts go to the
+ * console. A site names one of these when it has outgrown that, and a test
+ * names them to read back the mail and to not wait for the backoff.
+ */
+export interface MailOverrides {
+    /**
+     * What carries the site's email.
+     *
+     * Naming one wins outright over the provider the settings screen chose and
+     * the credential in `data/mail.json`, exactly as
+     * {@link GeekityConfig.commentChecker} wins over the Akismet key: a site
+     * that wrote a provider meant it. `createMemoryMailProvider()` is what a
+     * test names here to read back the mail a feature would have sent.
+     */
+    provider?: MailProvider | undefined;
+    /** How many times one message is tried. Defaults to three. */
+    attempts?: number | undefined;
+    /**
+     * How long to wait before attempt `n + 1`, in milliseconds. Defaults to two
+     * seconds, then eight, then eighteen. A test hands in `() => 0`.
+     */
+    backoffMs?: ((attempt: number) => number) | undefined;
+    /** Where attempts are logged. Defaults to `console`. */
+    logger?: MailLogger | undefined;
+}
 /**
  * What a site writes in `geekity.config.ts`. Every field is optional; see
  * {@link DEFAULT_PORT} and friends for what each one falls back to.
@@ -55,8 +90,17 @@ export interface GeekityConfig {
     contentDir?: string;
     /** Directory for derived state such as the SQLite index. Default `<cwd>/data`. Overridden by `GEEKITY_DATA_DIR`. */
     dataDir?: string;
-    /** Site template overrides, resolved before the packaged default theme. Default `<cwd>/theme`. Overridden by `GEEKITY_THEME_DIR`. */
-    themeDir?: string;
+    /**
+     * Where this site's themes are, one directory per theme, each with a
+     * `theme.json` (decision-15). Default `<cwd>/themes`. Overridden by
+     * `GEEKITY_THEMES_DIR`. It need not exist: a site using the packaged theme
+     * has no themes of its own.
+     *
+     * Which one is in use is a setting rather than a deployment fact — `theme`
+     * in `content/_data/site.json`, chosen on the Appearance screen — because it
+     * is a look a site changes, not a path a host decides.
+     */
+    themesDir?: string;
     /** Public origin, used for canonical URLs, feeds and ActivityPub ids. Default `http://localhost:<port>`. Overridden by `GEEKITY_BASE_URL`. */
     baseUrl?: string;
     /**
@@ -84,6 +128,101 @@ export interface GeekityConfig {
      * `KNOWN_UPLOAD_TYPES`.
      */
     uploadTypes?: string[];
+    /**
+     * Derive smaller and more modern copies of an uploaded raster image, and
+     * serve the site's pages a `<picture>` that offers them. Default `true`.
+     * Overridden by `GEEKITY_IMAGE_OPTIMIZATION`.
+     *
+     * Turning it off changes nothing on disk under `content/uploads/` — the
+     * original was always the only source of truth (decision-10) — and nothing
+     * about the feeds. The pages go back to the plain `<img>` the Markdown
+     * asked for, and no encoding happens on upload.
+     */
+    imageOptimization?: boolean;
+    /**
+     * The widths variants are made at, in pixels. Default 320, 640, 960, 1280
+     * and 1920, which is 11ty/image's own set. Overridden by
+     * `GEEKITY_IMAGE_WIDTHS`, a comma-separated list.
+     *
+     * Nothing is ever upscaled: a width wider than the original is skipped, and
+     * the original's own width is always added, so the `srcset` has a full-size
+     * entry whatever the list says.
+     */
+    imageWidths?: number[];
+    /**
+     * The formats variants are made in, besides the original's own. Default
+     * `['webp']`. Overridden by `GEEKITY_IMAGE_FORMATS`, a comma-separated list.
+     *
+     * The original's format is always generated too, because it is what the
+     * `<img>` inside the `<picture>` falls back to; these are the `<source>`
+     * elements in front of it, in the order they are given. AVIF is opt-in —
+     * `['avif', 'webp']` — because its encoder is an order of magnitude slower
+     * than WebP's and the encoding happens in the request that uploads the file.
+     */
+    imageFormats?: string[];
+    /**
+     * How many failed sign-ins a username or a client address may make before
+     * the admin locks it out. Default 5. Overridden by `GEEKITY_LOGIN_ATTEMPTS`.
+     */
+    loginAttempts?: number;
+    /**
+     * How long the first lockout lasts, in seconds. Default 15 minutes. Each
+     * further failure doubles the wait, up to sixteen times the first one.
+     * Overridden by `GEEKITY_LOGIN_LOCKOUT`.
+     */
+    loginLockout?: number;
+    /**
+     * Whether an `X-Forwarded-For` header may be believed when the admin decides
+     * which client address a failed login belongs to. Default `false`.
+     * Overridden by `GEEKITY_TRUST_PROXY`.
+     *
+     * Off by default because anyone may send that header: believing it on a site
+     * reached directly would let an attacker put every guess on a different
+     * make-believe address and never be locked out at all. Turn it on only when
+     * a reverse proxy in front of the site sets it.
+     */
+    trustProxy?: boolean;
+    /**
+     * Write one line per request — method, path, status, duration — to stdout.
+     * Overridden by `GEEKITY_ACCESS_LOG`.
+     *
+     * Default `false`, which is what `createCms` gets: a CMS embedded in
+     * somebody else's server has no business writing to their stdout uninvited.
+     * `geekity serve` turns it on, because a server that answers the internet
+     * should be able to say what it answered; a config that names this either
+     * way is obeyed, and the environment variable wins over both.
+     */
+    accessLog?: boolean;
+    /**
+     * Put the client address on each access-log line. Default `false`.
+     * Overridden by `GEEKITY_ACCESS_LOG_ADDRESS`.
+     *
+     * Off unless the site asks, because an address is personal data and a
+     * self-hosted blog has no retention policy for it. Which address is right is
+     * {@link GeekityConfig.trustProxy}'s answer, the same one a failed sign-in
+     * is counted against.
+     */
+    accessLogAddress?: boolean;
+    /**
+     * Where the access log's lines go. Defaults to stdout, written one line at a
+     * time exactly as the CLI writes.
+     *
+     * Config only, with no environment override: a sink is a function, and the
+     * only callers with one are a test reading the lines back and a site that
+     * has somewhere of its own to put them.
+     */
+    accessLogWriter?: AccessLogWriter;
+    /**
+     * Fill a missing or empty content directory with the starter site
+     * `geekity init` writes, when `geekity serve` starts. Default `false`.
+     * Overridden by `GEEKITY_SEED_CONTENT`.
+     *
+     * Off by default so a site run from npm never has content written that it
+     * did not ask for. The Docker image turns it on, because its content volume
+     * is empty on a new box. A directory with anything in it at all, even a lone
+     * dotfile, is never touched.
+     */
+    seedContent?: boolean;
     /**
      * Called for every `created`, `updated` and `deleted` the index records.
      *
@@ -98,6 +237,37 @@ export interface GeekityConfig {
      * same `origin` caveat as {@link GeekityConfig.onDocumentChange}.
      */
     onPublish?: DocumentChangeHook;
+    /**
+     * A third-party opinion on native comments: Akismet, or anything else that
+     * answers the same three questions (TASK-50).
+     *
+     * The whole of the CMS's knowledge of such a service. It is asked about
+     * every comment that gets past the honeypot, the form's age and the rate
+     * limit, and its `spam`, `discard` and `ham` are the three things it can
+     * say; a checker that throws is treated as having no opinion, so a service
+     * that is down never stops a site taking comments. The moderation screen
+     * tells it when a human disagrees.
+     *
+     * Naming one here wins outright over the Akismet checker the package ships
+     * (TASK-52): `createCms` builds that only when this is not set, so a site
+     * that wrote a checker gets the checker it wrote whether or not there is a
+     * key in `data/akismet.json`.
+     */
+    commentChecker?: CommentChecker;
+    /**
+     * How the site sends email (TASK-53). Every field has a default; see
+     * {@link MailOverrides}.
+     */
+    mail?: MailOverrides;
+    /**
+     * What the CMS reads the time from.
+     *
+     * A post's date decides whether it is public yet (TASK-44), so the index and
+     * the scheduler both need a clock, and it is one clock so they cannot
+     * disagree. Defaults to {@link systemClock}. A site has no reason to name
+     * one; a test that wants to be somewhere else in time does.
+     */
+    now?: Clock;
     /**
      * Federation stores and guards. Every field has a default; see
      * {@link FederationOverrides}.
@@ -114,7 +284,7 @@ export interface ResolvedConfig {
     port: number;
     contentDir: string;
     dataDir: string;
-    themeDir: string;
+    themesDir: string;
     baseUrl: string;
     /**
      * Where {@link ResolvedConfig.baseUrl} came from.
@@ -122,7 +292,7 @@ export interface ResolvedConfig {
      * `default` means nobody named one and it is the `http://localhost:<port>`
      * fallback, which is what lets the admin's settings screen offer a base URL
      * of its own: an `environment` or `config` value is a deployment fact and
-     * wins over anything stored in SQLite.
+     * wins over the `url` in `content/_data/site.json`.
      */
     baseUrlSource: 'environment' | 'config' | 'default';
     watch: boolean;
@@ -130,8 +300,34 @@ export interface ResolvedConfig {
     uploadMaxBytes: number;
     /** Normalised: lower case, each with its leading dot. */
     uploadTypes: string[];
+    imageOptimization: boolean;
+    /** Ascending and without repeats. */
+    imageWidths: number[];
+    /** Normalised: lower case, in the order the `<source>` elements go. */
+    imageFormats: string[];
+    loginAttempts: number;
+    loginLockout: number;
+    trustProxy: boolean;
+    accessLog: boolean;
+    accessLogAddress: boolean;
+    /** The sink, when the site named one; otherwise the log writes to stdout. */
+    accessLogWriter: AccessLogWriter | undefined;
+    seedContent: boolean;
     onDocumentChange: DocumentChangeHook | undefined;
     onPublish: DocumentChangeHook | undefined;
+    /**
+     * The comment checker, when the site named one.
+     *
+     * `undefined` as this leaves {@link resolveConfig}. `createCms` fills it in
+     * with the Akismet checker (TASK-52) when the site named none, so by the
+     * time a request reads it off the context there is one — and with no key in
+     * `data/akismet.json` that one sends nothing anywhere.
+     */
+    commentChecker: CommentChecker | undefined;
+    /** Mail overrides, empty when the site named none. */
+    mail: MailOverrides;
+    /** The clock the index and the scheduler read. */
+    now: Clock;
     /** Federation stores and guards, empty when the site named none. */
     federation: FederationOverrides;
 }
@@ -145,7 +341,7 @@ export interface ResolveConfigContext {
 export declare const DEFAULT_PORT = 3000;
 export declare const DEFAULT_CONTENT_DIR = "content";
 export declare const DEFAULT_DATA_DIR = "data";
-export declare const DEFAULT_THEME_DIR = "theme";
+export declare const DEFAULT_THEMES_DIR = "themes";
 /** How long an admin login lasts by default: fourteen days, in seconds. */
 export declare const DEFAULT_SESSION_LIFETIME: number;
 /** Largest upload a site accepts by default: ten mebibytes. */
@@ -157,6 +353,30 @@ export declare const DEFAULT_UPLOAD_MAX_BYTES: number;
  * and so is opt-in.
  */
 export declare const DEFAULT_UPLOAD_TYPES: readonly string[];
+/**
+ * The widths an image is offered at by default.
+ *
+ * These are 11ty/image's own defaults, and deliberately so: decision-10 makes
+ * that plugin the reference for the markup and the width set, so a site that
+ * builds the same `content/` with Eleventy and runs the plugin over the same
+ * originals gets an equivalent `srcset` rather than a different one.
+ */
+export declare const DEFAULT_IMAGE_WIDTHS: readonly number[];
+/** The derived formats a site gets without asking. AVIF is not one; see {@link GeekityConfig.imageFormats}. */
+export declare const DEFAULT_IMAGE_FORMATS: readonly string[];
+/**
+ * The formats a site may ask for.
+ *
+ * Every one of them is something sharp can write and every browser that
+ * matters can read. There is no `gif` and no `svg`: an animated GIF cannot
+ * survive being resized frame by frame into a still, and an SVG has no
+ * intrinsic pixels to resize at all, so neither is ever varianted.
+ */
+export declare const KNOWN_IMAGE_FORMATS: readonly string[];
+/** Failed sign-ins allowed before the admin locks a username or an address out. */
+export declare const DEFAULT_LOGIN_ATTEMPTS = 5;
+/** How long the first lockout lasts by default: a quarter of an hour, in seconds. */
+export declare const DEFAULT_LOGIN_LOCKOUT: number;
 /**
  * Identity helper that gives a `geekity.config.ts` file type checking and
  * completion without the site importing the type by hand.