domma-cms 0.101.7 → 0.101.8

package/admin/js/lib/collections-arrange.js

@@ -1 +1 @@
-export const SYSTEM_SLUGS=["roles","user-profiles"],FILTERS=["all","own","builtin","plugin"];const u="core";export function slugify(n){return String(n??"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"")}export function kindOf(n){return n?.builtIn===!0||n?.preset===!0||SYSTEM_SLUGS.includes(n?.slug)?"builtin":n?.plugin?"plugin":"own"}export const projectOf=n=>n?.meta?.project||u;export function arrangeCollections(n,{filter:e="all",query:t="",project:r=null}={}){const i=String(t).trim().toLowerCase();return[...n||[]].filter(o=>!r||projectOf(o)===r).filter(o=>e==="all"||kindOf(o)===e).filter(o=>!i||[o.title,o.slug,o.description,o.plugin].some(l=>String(l||"").toLowerCase().includes(i))).sort((o,l)=>String(o.title||o.slug).localeCompare(String(l.title||l.slug)))}export function kindCounts(n,{project:e=null}={}){const t=(n||[]).filter(i=>!e||projectOf(i)===e),r={all:t.length,own:0,builtin:0,plugin:0};for(const i of t)r[kindOf(i)]++;return r}const a=(n,e,t=`${e}s`)=>`${n} ${n===1?e:t}`;export function collectionRow(n){const e=kindOf(n),t=Array.isArray(n.fields)?n.fields.length:0,r=Number(n.entryCount)||0,i=n.storage?.adapter==="mongodb",o=n.meta?.project||"";return{slug:n.slug,title:n.title||n.slug,meta:[n.slug,a(t,"field"),o?`project ${o}`:""].filter(Boolean).join(" \xB7 "),entries:r,entriesText:r.toLocaleString("en-GB"),mongo:i,mongoTitle:i?`MongoDB - connection "${n.storage.connection||"default"}"`:"",builtin:e==="builtin",bundled:e!=="builtin"&&n.bundled===!0,plugin:n.plugin||"",pluginTitle:n.plugin?`Managed by the ${n.plugin} plugin`:"",canDelete:e!=="builtin",hasForm:!SYSTEM_SLUGS.includes(n.slug)}}export function checkNewCollection(n,e=[]){const t=String(n??"").trim(),r=slugify(t);return t?r?e.includes(r)?{slug:r,error:`"${r}" is already a collection.`}:{slug:r,error:""}:{slug:r,error:"The title needs at least one letter or number."}:{slug:"",error:""}}let s=0;export function connectionRows(n){return Object.entries(n||{}).filter(([e])=>e!=="_comment").map(([e,t])=>({id:`c${++s}`,name:e,uri:String(t?.uri||""),database:String(t?.database||"")}))}export function newConnectionRow(n){const e=new Set((n||[]).map(r=>r.name));let t=(n||[]).length+1;for(;e.has(`connection${t}`);)t++;return{id:`c${++s}`,name:t===1&&!e.has("default")?"default":`connection${t}`,uri:"",database:""}}export function connectionsFromRows(n){const e=[],t={};for(const r of n||[]){const i=String(r.name??"").trim();if(!i){e.push("Every connection needs a name.");continue}if(t[i]){e.push(`Two connections are called "${i}".`);continue}const o=String(r.uri??"").trim(),l=String(r.database??"").trim();o||e.push(`"${i}" needs a URI.`),l||e.push(`"${i}" needs a database.`),t[i]={type:"mongodb",uri:o,database:l,options:{}}}return{errors:e,config:t}}export function parseConnectionsJson(n){let e;try{e=JSON.parse(String(n??"").trim()||"{}")}catch(t){return{error:`Not valid JSON: ${t.message}`,config:null}}return!e||typeof e!="object"||Array.isArray(e)?{error:"The JSON must be an object of named connections.",config:null}:{error:"",config:e}}export function maskUri(n){return String(n??"").replace(/(\/\/[^:/@]+:)([^@]+)(@)/,"$1\u2022\u2022\u2022$3")}
+export const SYSTEM_SLUGS=["roles","user-profiles"],FILTERS=["all","own","builtin","plugin"];const u="core";export function slugify(n){return String(n??"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"")}export function kindOf(n){return n?.builtIn===!0||n?.preset===!0||SYSTEM_SLUGS.includes(n?.slug)?"builtin":n?.plugin?"plugin":"own"}export const projectOf=n=>n?.meta?.project||u;export function arrangeCollections(n,{filter:t="all",query:e="",project:o=null}={}){const i=String(e).trim().toLowerCase();return[...n||[]].filter(r=>!o||projectOf(r)===o).filter(r=>t==="all"||kindOf(r)===t).filter(r=>!i||[r.title,r.slug,r.description,r.plugin].some(l=>String(l||"").toLowerCase().includes(i))).sort((r,l)=>String(r.title||r.slug).localeCompare(String(l.title||l.slug)))}export function kindCounts(n,{project:t=null}={}){const e=(n||[]).filter(i=>!t||projectOf(i)===t),o={all:e.length,own:0,builtin:0,plugin:0};for(const i of e)o[kindOf(i)]++;return o}const a=(n,t,e=`${t}s`)=>`${n} ${n===1?t:e}`;export function collectionRow(n){const t=kindOf(n),e=Array.isArray(n.fields)?n.fields.length:0,o=Number(n.entryCount)||0,i=n.storage?.adapter==="mongodb",r=n.meta?.project||"";return{slug:n.slug,title:n.title||n.slug,meta:[n.slug,a(e,"field"),r?`project ${r}`:""].filter(Boolean).join(" \xB7 "),entries:o,entriesText:o.toLocaleString("en-GB"),mongo:i,mongoTitle:i?`MongoDB - connection "${n.storage.connection||"default"}"`:"",builtin:t==="builtin",bundled:t!=="builtin"&&n.bundled===!0,plugin:n.plugin||"",pluginTitle:n.plugin?`Managed by the ${n.plugin} plugin`:"",canDelete:t!=="builtin",hasForm:!SYSTEM_SLUGS.includes(n.slug)}}export function checkNewCollection(n,t=[]){const e=String(n??"").trim(),o=slugify(e);return e?o?t.includes(o)?{slug:o,error:`"${o}" is already a collection.`}:{slug:o,error:""}:{slug:o,error:"The title needs at least one letter or number."}:{slug:"",error:""}}let s=0;export function connectionRows(n){return Object.entries(n||{}).filter(([t])=>t!=="_comment").map(([t,e])=>({id:`c${++s}`,name:t,uri:String(e?.uri||""),database:String(e?.database||""),options:e?.options&&typeof e.options=="object"?e.options:{}}))}export function newConnectionRow(n){const t=new Set((n||[]).map(o=>o.name));let e=(n||[]).length+1;for(;t.has(`connection${e}`);)e++;return{id:`c${++s}`,name:e===1&&!t.has("default")?"default":`connection${e}`,uri:"",database:""}}export function connectionsFromRows(n){const t=[],e={};for(const o of n||[]){const i=String(o.name??"").trim();if(!i){t.push("Every connection needs a name.");continue}if(e[i]){t.push(`Two connections are called "${i}".`);continue}const r=String(o.uri??"").trim(),l=String(o.database??"").trim();r||t.push(`"${i}" needs a URI.`),l||t.push(`"${i}" needs a database.`),e[i]={type:"mongodb",uri:r,database:l,options:o.options&&typeof o.options=="object"?o.options:{}}}return{errors:t,config:e}}export function parseConnectionsJson(n){let t;try{t=JSON.parse(String(n??"").trim()||"{}")}catch(e){return{error:`Not valid JSON: ${e.message}`,config:null}}return!t||typeof t!="object"||Array.isArray(t)?{error:"The JSON must be an object of named connections.",config:null}:{error:"",config:t}}export function maskUri(n){return String(n??"").replace(/(\/\/[^:/@]+:)([^@]+)(@)/,"$1\u2022\u2022\u2022$3")}

package/admin/js/templates/collections.html

@@ -40,7 +40,7 @@
             <div class="clx-card">
                 <div class="clx-bar">
                     <strong>MongoDB connections</strong>
-                    <span data-help-title="Database connections" data-help="Collections are stored as files unless their storage is set to MongoDB, which needs a connection here - usually one called default. Each needs a URI (mongodb://…) and a database name. Kept in config/connections.json; with none, every collection stays on files. Ctrl+S saves."></span>
+                    <span data-help-title="Database connections" data-help="Collections are stored as files unless their storage is set to MongoDB, which needs a connection here - usually one called default. Each needs a URI (mongodb://…) and a database name. Passwords are never shown: a saved one appears as dots - leave them to keep it, or type a new one. Change the host, user or options and you must type it again. Kept in config/connections.json; with none, every collection stays on files. Ctrl+S saves."></span>
                     <span class="clx-spacer"></span>
                     <label class="clx-toggle"><input type="checkbox" data-model="raw.value"> Raw JSON</label>
                     <button type="button" class="btn btn-sm btn-ghost" data-on-click="addConnection" data-bind-hidden="raw.value">

package/admin/js/templates/docs/api-collections.html

@@ -150,11 +150,14 @@
 <h3><span class="method-badge method-get">GET</span><span class="endpoint-path">/api/collections/connections</span></h3>
 <p class="auth-note">Requires Bearer token + an admin role (level 0 or 1).</p>
 <p>The MongoDB connections in <code>config/connections.json</code>. <code>PUT</code> saves them; each needs
-    <code>type</code>, <code>uri</code> and <code>database</code>.</p>
+    <code>type</code>, <code>uri</code> and <code>database</code>. Passwords are never sent: the one in a URI, and any
+    secret-looking option, comes back as <code>••••••••</code>. Send the mask back unchanged to keep the stored value; it is restored only while scheme, user, hosts, query
+    and options are unchanged.</p>
 <pre class="code-block"><code>// Response 200
-{ "default": { "type": "mongodb", "uri": "mongodb://localhost:27017", "database": "my_cms" } }
+{ "default": { "type": "mongodb", "uri": "mongodb://site:••••••••@localhost:27018/my_cms", "database": "my_cms" } }
 // PUT - Error 400
-{ "error": "Connection \"default\" requires type, uri, and database" }</code></pre>
+{ "error": "Connection \"default\" requires type, uri, and database" }
+{ "error": "Connection \"default\": type the password again - it was hidden, and the connection now points somewhere else or it was never saved" }</code></pre>
 
 <h3 style="margin-top:24px;font-size:15px;text-transform:uppercase;letter-spacing:.5px;opacity:.6">
     Admin Entry CRUD</h3>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "0.101.7",
+  "version": "0.101.8",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/routes/api/collections.js

@@ -63,6 +63,7 @@ import {ensureFormForCollection} from '../../services/forms.js';
 import {hooks} from '../../services/hooks.js';
 import {scopeAllows, validateToken} from '../../services/apiTokens.js';
 import {isProjectEnabled, resolveArtefactProject} from '../../services/projects.js';
+import {maskConnections, restoreConnections} from '../../services/connectionSecrets.js';
 
 const ALL_PRESET_SLUGS = new Set(['roles', 'user-profiles', ...PRESET_COLLECTION_SLUGS]);
 
@@ -323,7 +324,7 @@ export async function collectionsRoutes(fastify) {
   fastify.get('/collections/connections', {preHandler: [authenticate, requireAdmin]}, async () => {
     try {
       const {_comment, ...rest} = getConfig('connections');
-      return rest;
+      return maskConnections(rest);
     } catch {
       return {};
     }
@@ -339,7 +340,11 @@ export async function collectionsRoutes(fastify) {
         return reply.status(400).send({error: `Connection "${name}" requires type, uri, and database`});
       }
     }
-    saveConfig('connections', data);
+    let stored = {};
+    try { stored = getConfig('connections'); } catch { /* nothing saved yet */ }
+    const {config, error} = restoreConnections(data, stored);
+    if (error) return reply.status(400).send({error});
+    saveConfig('connections', stored._comment !== undefined ? {_comment: stored._comment, ...config} : config);
     return {success: true};
   });
 

package/server/services/connectionSecrets.js

@@ -0,0 +1,160 @@
+/**
+ * Database connection secrets never reach the browser.
+ *
+ * GET /collections/connections sends each URI with its password, and any secret query
+ * parameter (tlsCertificateKeyFilePassword, proxyPassword, authMechanismProperties), replaced
+ * by CONNECTION_MASK, and any option whose key looks secret (auth.password) as the mask too.
+ * PUT sends the mask back for anything left untouched and restoreConnections() puts the stored
+ * value back - but only from a stored connection with the same endpoint (scheme, user, host
+ * list, query and driver options, secrets aside). Change where or how a connection
+ * authenticates and its secrets must be typed again, or a masked URI aimed at another host or
+ * proxy would carry the stored password there. The database path may change freely. A mask
+ * that cannot be matched is refused, never saved as the password. A URI whose credentials
+ * cannot be told apart from its query (a raw ? in the password) is masked whole.
+ */
+
+export const CONNECTION_MASK = '••••••••';
+
+const SECRET_KEY = /pass(word)?|secret|token|api[-_]?key|private|credential/i;
+const SECRET_PARAM = /pass(word)?|secret|token|authMechanismProperties/i;
+
+/**
+ * scheme://[user[:password]@]hosts[/path][?query]. The query is split off first and the LAST
+ * @ before it ends the credentials, so an @ in the query or an unescaped one in the password
+ * cannot move the split.
+ */
+function parseUri(uri) {
+    if (typeof uri !== 'string') return null;
+    const m = uri.trim().match(/^([a-z][a-z0-9+.-]*:\/\/)(.*)$/is);
+    if (!m) return null;
+    const rest = m[2];
+    const qi = rest.indexOf('?');
+    const main = qi < 0 ? rest : rest.slice(0, qi);
+    const at = main.lastIndexOf('@');
+    // An @ only after the first ? is either in the query or behind a raw ? in the password:
+    // unknowable, so the whole URI is treated as one secret.
+    if (rest === CONNECTION_MASK || (at < 0 && qi >= 0 && rest.indexOf('@', qi) >= 0)) {
+        return {opaque: true, scheme: m[1].toLowerCase(), uri: uri.trim()};
+    }
+    const userinfo = at < 0 ? null : main.slice(0, at);
+    const hp = at < 0 ? main : main.slice(at + 1);
+    const si = hp.indexOf('/');
+    const ci = userinfo === null ? -1 : userinfo.indexOf(':');
+    return {
+        scheme: m[1].toLowerCase(),
+        user: userinfo === null ? null : (ci < 0 ? userinfo : userinfo.slice(0, ci)),
+        pass: ci < 0 ? null : userinfo.slice(ci + 1),
+        hosts: si < 0 ? hp : hp.slice(0, si),
+        path: si < 0 ? '' : hp.slice(si),
+        params: qi < 0 ? null : rest.slice(qi + 1).split('&').map(p => {
+            const e = p.indexOf('=');
+            return e < 0 ? [p, null] : [p.slice(0, e), p.slice(e + 1)];
+        })
+    };
+}
+
+function formatUri(p) {
+    if (p.opaque) return p.scheme + CONNECTION_MASK;
+    const cred = p.user === null ? '' : p.user + (p.pass === null ? '' : ':' + p.pass) + '@';
+    const query = p.params === null ? '' : '?' + p.params.map(([k, v]) => (v === null ? k : `${k}=${v}`)).join('&');
+    return p.scheme + cred + p.hosts + p.path + query;
+}
+
+const maskParams = (params) => params && params.map(([k, v]) => [k, v && SECRET_PARAM.test(k) ? CONNECTION_MASK : v]);
+
+// Key order must not matter when comparing options.
+const canonical = (v) => Array.isArray(v) ? v.map(canonical)
+    : v && typeof v === 'object' ? Object.fromEntries(Object.keys(v).sort().map(k => [k, canonical(v[k])])) : v;
+
+/** Where and how a connection authenticates, secrets aside - whether stored secrets may follow it. */
+function endpoint(p, options) {
+    const opts = canonical(maskOptions(options ?? {}));
+    if (p.opaque) return JSON.stringify(['opaque', p.scheme, opts]);
+    return JSON.stringify([p.scheme, p.user, p.hosts.toLowerCase(), maskParams(p.params), opts]);
+}
+
+/** A URI with its password and secret query parameters masked. */
+export function maskConnectionUri(uri) {
+    const p = parseUri(uri);
+    if (!p) return uri;
+    if (p.opaque) return formatUri(p);
+    return formatUri({...p, pass: p.pass ? CONNECTION_MASK : p.pass, params: maskParams(p.params)});
+}
+
+function maskOptions(value, key = '') {
+    if (Array.isArray(value)) return value.map(v => maskOptions(v, key));
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, maskOptions(v, k)]));
+    }
+    return SECRET_KEY.test(key) && typeof value === 'string' && value !== '' ? CONNECTION_MASK : value;
+}
+
+// A mask with nothing stored behind it stays a mask, so the caller refuses the save.
+function restoreOptions(incoming, stored) {
+    if (incoming === CONNECTION_MASK) return typeof stored === 'string' ? stored : incoming;
+    if (Array.isArray(incoming)) {
+        const before = Array.isArray(stored) ? stored : [];
+        return incoming.map((v, i) => restoreOptions(v, before[i]));
+    }
+    if (incoming && typeof incoming === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(incoming)) {
+            out[k] = restoreOptions(v, stored && typeof stored === 'object' ? stored[k] : undefined);
+        }
+        return out;
+    }
+    return incoming;
+}
+
+function restoreUri(incoming, stored) {
+    const pi = parseUri(incoming);
+    const ps = parseUri(stored);
+    if (pi.opaque) return ps.uri;
+    const pass = pi.pass === CONNECTION_MASK ? ps.pass : pi.pass;
+    const params = pi.params && pi.params.map(([k, v], i) => [k, v === CONNECTION_MASK ? ps.params[i][1] : v]);
+    return formatUri({...pi, pass, params});
+}
+
+/** The connections as the browser may see them. */
+export function maskConnections(connections) {
+    const out = {};
+    for (const [name, conn] of Object.entries(connections || {})) {
+        if (!conn || typeof conn !== 'object') { out[name] = conn; continue; }
+        const masked = {...conn, uri: maskConnectionUri(conn.uri)};
+        if (conn.options !== undefined) masked.options = maskOptions(conn.options);
+        out[name] = masked;
+    }
+    return out;
+}
+
+/**
+ * The connections to save: masks put back from what is stored.
+ * @returns {{config?: object, error?: string}}
+ */
+export function restoreConnections(incoming, stored) {
+    const before = stored && typeof stored === 'object' ? stored : {};
+    const config = {};
+    for (const [name, conn] of Object.entries(incoming)) {
+        if (!conn || typeof conn !== 'object' || !JSON.stringify(conn).includes(CONNECTION_MASK)) {
+            config[name] = conn;
+            continue;
+        }
+        const pi = parseUri(conn.uri);
+        // The same name first, then any other stored connection at the same endpoint (a rename).
+        const candidates = [before[name], ...Object.entries(before).filter(([n]) => n !== name).map(([, c]) => c)];
+        const source = pi && candidates.find(c => {
+            const ps = c && typeof c === 'object' ? parseUri(c.uri) : null;
+            return ps && endpoint(ps, c.options) === endpoint(pi, conn.options);
+        });
+        const out = {...conn};
+        if (source) {
+            out.uri = restoreUri(conn.uri, source.uri);
+            if (conn.options !== undefined) out.options = restoreOptions(conn.options, source.options);
+        }
+        if (JSON.stringify(out).includes(CONNECTION_MASK)) {
+            return {error: `Connection "${name}": type the password again - it was hidden, and the connection now points somewhere else or it was never saved`};
+        }
+        config[name] = out;
+    }
+    return {config};
+}