domma-cms 0.1.0

package/server/services/users.js

@@ -0,0 +1,212 @@
+/**
+ * User Storage Service
+ * File-based CRUD — one JSON file per user in content/users/{id}.json.
+ * Mirrors the page-per-file pattern from the content service.
+ */
+import fs from 'fs/promises';
+import path from 'path';
+import bcrypt from 'bcryptjs';
+import { v4 as uuidv4 } from 'uuid';
+import { config } from '../config.js';
+
+const USERS_DIR = path.resolve(config.content.usersDir);
+
+async function ensureDir() {
+    await fs.mkdir(USERS_DIR, { recursive: true });
+}
+
+/**
+ * Strip the password field from a user object before returning it to callers.
+ *
+ * @param {object} user
+ * @returns {object}
+ */
+function stripPassword(user) {
+    const { password, ...safe } = user;
+    return safe;
+}
+
+/**
+ * Read a user file by ID.
+ *
+ * @param {string} id
+ * @returns {Promise<object>} Full user object including password hash
+ */
+async function readUserFile(id) {
+    const filePath = path.join(USERS_DIR, `${id}.json`);
+    const raw = await fs.readFile(filePath, 'utf8');
+    return JSON.parse(raw);
+}
+
+/**
+ * Write a user file.
+ *
+ * @param {object} user
+ * @returns {Promise<void>}
+ */
+async function writeUserFile(user) {
+    await ensureDir();
+    const filePath = path.join(USERS_DIR, `${user.id}.json`);
+    await fs.writeFile(filePath, JSON.stringify(user, null, 2) + '\n', 'utf8');
+}
+
+/**
+ * List all users (password stripped).
+ *
+ * @returns {Promise<object[]>}
+ */
+export async function listUsers() {
+    await ensureDir();
+    let files;
+    try {
+        files = await fs.readdir(USERS_DIR);
+    } catch {
+        return [];
+    }
+    const jsonFiles = files.filter(f => f.endsWith('.json'));
+    const users = await Promise.all(jsonFiles.map(async (file) => {
+        const raw = await fs.readFile(path.join(USERS_DIR, file), 'utf8');
+        return stripPassword(JSON.parse(raw));
+    }));
+    return users.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/**
+ * Get a single user by ID (password stripped).
+ *
+ * @param {string} id
+ * @returns {Promise<object|null>}
+ */
+export async function getUserById(id) {
+    try {
+        return stripPassword(await readUserFile(id));
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * Get a user by email address — includes password hash (needed for login).
+ *
+ * @param {string} email
+ * @returns {Promise<object|null>}
+ */
+export async function getUserByEmail(email) {
+    await ensureDir();
+    let files;
+    try {
+        files = await fs.readdir(USERS_DIR);
+    } catch {
+        return null;
+    }
+    for (const file of files.filter(f => f.endsWith('.json'))) {
+        const raw = await fs.readFile(path.join(USERS_DIR, file), 'utf8');
+        const user = JSON.parse(raw);
+        if (user.email.toLowerCase() === email.toLowerCase()) return user;
+    }
+    return null;
+}
+
+/**
+ * Create a new user.
+ *
+ * @param {object} data - { name, email, password, role }
+ * @returns {Promise<object>} Created user (password stripped)
+ */
+export async function createUser({ name, email, password, role = 'editor' }) {
+    const existing = await getUserByEmail(email);
+    if (existing) throw new Error('A user with that email already exists');
+
+    const hash = await bcrypt.hash(password, config.auth.bcryptRounds);
+    const now = new Date().toISOString();
+    const user = {
+        id: uuidv4(),
+        email: email.toLowerCase().trim(),
+        name: name.trim(),
+        password: hash,
+        role,
+        isActive: true,
+        createdAt: now,
+        updatedAt: now,
+        lastLogin: null
+    };
+
+    await writeUserFile(user);
+    return stripPassword(user);
+}
+
+/**
+ * Update an existing user.
+ * Pass a new `password` field to re-hash; omit to keep the existing hash.
+ *
+ * @param {string} id
+ * @param {object} updates
+ * @returns {Promise<object>} Updated user (password stripped)
+ */
+export async function updateUser(id, updates) {
+    const user = await readUserFile(id);
+    if (!user) throw new Error('User not found');
+
+    if (updates.password) {
+        updates.password = await bcrypt.hash(updates.password, config.auth.bcryptRounds);
+    }
+
+    const updated = {
+        ...user,
+        ...updates,
+        id: user.id,
+        updatedAt: new Date().toISOString()
+    };
+
+    await writeUserFile(updated);
+    return stripPassword(updated);
+}
+
+/**
+ * Delete a user file.
+ *
+ * @param {string} id
+ * @returns {Promise<void>}
+ */
+export async function deleteUser(id) {
+    const filePath = path.join(USERS_DIR, `${id}.json`);
+    await fs.unlink(filePath);
+}
+
+/**
+ * Count total users.
+ *
+ * @returns {Promise<number>}
+ */
+export async function countUsers() {
+    await ensureDir();
+    try {
+        const files = await fs.readdir(USERS_DIR);
+        return files.filter(f => f.endsWith('.json')).length;
+    } catch {
+        return 0;
+    }
+}
+
+/**
+ * Validate a plain-text password against a bcrypt hash.
+ *
+ * @param {string} plain
+ * @param {string} hash
+ * @returns {Promise<boolean>}
+ */
+export async function validatePassword(plain, hash) {
+    return bcrypt.compare(plain, hash);
+}
+
+/**
+ * Record the current timestamp as the user's last login.
+ *
+ * @param {string} id
+ * @returns {Promise<void>}
+ */
+export async function touchLastLogin(id) {
+    const user = await readUserFile(id);
+    user.lastLogin = new Date().toISOString();
+    await writeUserFile(user);
+}

package/server/templates/page.html

@@ -0,0 +1,78 @@
+<!DOCTYPE html>
+<html lang="en-GB">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>{{seoTitle}}</title>
+    <meta name="description" content="{{seoDescription}}">
+    {{#if ogImage}}<meta property="og:image" content="{{ogImage}}">{{/if}}
+
+    <!-- Fonts -->
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,300;0,400;0,500;0,700;1,400&display=swap">
+
+    <!-- DommaJS CSS -->
+    <link rel="stylesheet" href="/dist/domma/domma.css">
+    <link rel="stylesheet" href="/dist/domma/grid.css">
+    <link rel="stylesheet" href="/dist/domma/elements.css">
+    <link rel="stylesheet" href="/dist/domma/themes/domma-themes.css">
+
+    <!-- Site CSS -->
+    <link rel="stylesheet" href="/public/css/site.css">
+
+    <!-- Plugin head injection -->
+    {{headInject}}
+
+  <!-- Late head injection — custom CSS always loads last so it can override everything -->
+  {{headInjectLate}}
+</head>
+<body class="dm-cloaked dm-theme-{{theme}}" data-layout="{{layout}}">
+
+    {{#if showNavbar}}
+    <nav id="site-navbar"></nav>
+    {{/if}}
+
+    <main class="site-main {{#if showSidebar}}with-sidebar{{/if}}">
+        {{#if showSidebar}}
+        <aside id="site-sidebar" class="site-sidebar"></aside>
+        {{/if}}
+
+        <article class="site-content">
+            <div class="container">
+                <div class="page-body">
+                    {{html}}
+                </div>
+            </div>
+        </article>
+    </main>
+
+    {{#if showFooter}}
+    <footer id="site-footer" class="page-footer"></footer>
+    {{/if}}
+
+    <!-- DOMPurify - must load before DommaJS -->
+    <script src="https://cdn.jsdelivr.net/npm/dompurify@3/dist/purify.min.js"></script>
+
+    <!-- DommaJS -->
+    <script src="/dist/domma/domma.min.js"></script>
+
+    <!-- Initialise DommaJS before module loads -->
+    <script>
+        if (window.Domma && typeof window.Domma.init === 'function') {
+            window.Domma.init();
+        }
+        if (window.Domma && window.Domma.theme) {
+            window.Domma.theme.init({ theme: '{{theme}}', persist: false });
+        }
+        window.__CMS_NAV__ = {{navJson}};
+        window.__CMS_SITE__ = {{siteJson}};
+    </script>
+
+    <!-- Site initialisation -->
+    <script src="/public/js/site.js" type="module"></script>
+
+    <!-- Plugin body-end injection -->
+    {{bodyEndInject}}
+</body>
+</html>