domma-cms 0.104.1 → 0.105.0

package/server/services/instantCalls.js

@@ -0,0 +1,362 @@
+/**
+ * Instant calls - "Call Sam now…": a video call with one person, starting now,
+ * that is not a booking or an event. Nothing is reserved; it is a room, a link
+ * for the guest and a link for the host, open for INSTANT_HOURS.
+ *
+ * PRO ONLY. Core holds the code, but a site has instant calls only while a
+ * paid Tool with calls (Booking Pro, Contacts Pro, Calendar) is running and has
+ * called `hooks.enableInstantCalls()` at boot. Until then every route answers
+ * 404 (routes/api/calls.js, routes/call-public.js) and no "Call … now" action
+ * is registered anywhere - a free site never has them. plugins.js binds the
+ * hook to the plugin's own name, tier and closedSource flag; only a plugin that
+ * is `tier: "paid"` AND `closedSource: true` (so it loads only when licensed)
+ * may switch them on - a direct call without those (an import) is refused.
+ * Disabling the last such plugin switches them off at once (disableInstantCalls,
+ * from plugins.js runLifecycleHook).
+ *
+ * An OLDER Booking Pro (0.3.x) still carries its own instant calls under the
+ * related provider id 'booking-pro-call'. While it is registered, core's own
+ * actions and list stand aside (checked per request), so nobody sees two.
+ *
+ * A record: {id, name, email, contactId, hostId, hostName, token, hostKey,
+ * createdAt, expiresAt}. Kept in memory and in one JSON file with the sign-in
+ * sessions (content/sessions/ - runtime state, never committed; see
+ * siteGitignore.js), so a restart keeps the links working. The call itself (who
+ * is in it) is the call engine's, in memory. Records are forgotten KEEP_DAYS
+ * after they end (a contact's card lists the recent ones), and never more than
+ * MAX_KEPT are kept.
+ *
+ * The page is `/_call/<id>?t=<guest token>` or `?h=<host key>`; the engine's
+ * routes are /api/calls/room/<id>/... Guests knock; the host lets them in.
+ *
+ * @module services/instantCalls
+ */
+
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import {randomBytes, timingSafeEqual} from 'node:crypto';
+import {config, getConfig} from '../config.js';
+import {hasRelatedProvider, registerRelatedItems, unregisterRelatedItems} from './hooks.js';
+import {getPermissionsFor} from './roles.js';
+import {getEffectiveRoles} from './userRoles.js';
+import {createTransport, escapeHtml, isSmtpConfigured, sendEmail} from './email.js';
+
+export const INSTANT_HOURS = 3;
+export const KEEP_DAYS = 30;
+export const MAX_KEPT = 2000;
+export const CALL_PATH = '/_call';
+export const ROOM_API = '/api/calls/room';
+export const ID_RE = /^[\w-]{16,40}$/;
+export const EMAIL_RE = /^[^\s@<>"]+@[^\s@<>"]+\.[^\s@<>"]+$/;
+/** The related-items provider id, on a contact and on an email. */
+export const PROVIDER_ID = 'instant-calls';
+
+// ---------------------------------------------------------------------------
+// Switched on by a Pro Tool
+// ---------------------------------------------------------------------------
+
+/** The related provider id an older Booking Pro (0.3.x) registers for its own instant calls. */
+export const LEGACY_PROVIDER_ID = 'booking-pro-call';
+
+const owners = new Set();
+let granted = false;
+
+/**
+ * A Pro Tool switches instant calls on (plugins.js hands it to each plugin as
+ * `hooks.enableInstantCalls`, bound to the plugin's name, tier and closedSource).
+ *
+ * @param {{owner: string, tier?: string, closedSource?: boolean}} opts
+ * @returns {boolean} true when the owner is (now) one of the enablers
+ */
+export function enableInstantCalls({owner, tier, closedSource} = {}) {
+    if (typeof owner !== 'string' || !owner.trim()) return false;
+    // Pro only, and only through the plugin-bound hook: a paid, licensed (closedSource) plugin.
+    if (tier !== 'paid' || closedSource !== true) return false;
+    const first = owners.size === 0;
+    owners.add(owner.trim());
+    if (first) registerActions();
+    return true;
+}
+
+/**
+ * A Tool with calls was disabled: it no longer keeps them on. The last one
+ * gone switches them off at once - routes answer 404, the actions go.
+ *
+ * @param {string} owner
+ * @returns {boolean} whether instant calls are still on
+ */
+export function disableInstantCalls(owner) {
+    if (owners.delete(String(owner || '').trim()) && owners.size === 0) unregisterActions();
+    return owners.size > 0;
+}
+
+/**
+ * Admins may call; a role editor can give it to other roles. Once only - removed
+ * by hand, it stays removed. Awaited by plugins.js in its one-plugin-at-a-time
+ * access step (right after registerPluginAccess), so it never interleaves with a
+ * plugin's own grants (roles.js rewrites the roles file unlocked).
+ *
+ * @param {{grantPermissionOnce: Function}} rolesService
+ */
+export async function grantInstantCallsOnce(rolesService) {
+    if (granted || owners.size === 0 || typeof rolesService?.grantPermissionOnce !== 'function') return false;
+    granted = true;
+    try { await rolesService.grantPermissionOnce('admin', 'calls', 'core'); } catch { /* no admin role: nothing to grant */ }
+    return true;
+}
+
+/** Does this site have instant calls (a Pro Tool with calls running)? */
+export const instantCallsEnabled = () => owners.size > 0;
+
+/** Which Tools switched them on. */
+export const instantCallOwners = () => [...owners];
+
+/** Tests only: back to a site without instant calls. */
+export function resetInstantCalls() {
+    owners.clear();
+    granted = false;
+    unregisterActions();
+}
+
+/** May this user (a JWT user, or {roles}) do `action` with calls? */
+export function mayCall(user, action = 'create') {
+    const roles = Array.isArray(user?.roles) ? user.roles : getEffectiveRoles(user || {});
+    return roles.some(r => getPermissionsFor('calls', action).includes(r));
+}
+
+/** An older Booking Pro's own "Call … now" is registered for this kind: core stands aside. */
+const legacyHere = (kind) => hasRelatedProvider(kind, LEGACY_PROVIDER_ID);
+
+function unregisterActions() {
+    unregisterRelatedItems('contact', PROVIDER_ID);
+    unregisterRelatedItems('message', PROVIDER_ID);
+}
+
+function registerActions() {
+    const permission = {resource: 'calls', action: 'create'};
+    // A contact: "Call Sam now…" in its menu, and its recent calls on the card.
+    registerRelatedItems('contact', {
+        id: PROVIDER_ID, label: 'Calls', icon: 'video', owner: 'core', when: () => !legacyHere('contact'),
+        actions: [{label: 'Call {name} now…', icon: 'video', url: '#/calls/new?contact={id}', permission}],
+        async list({id, user}) {
+            if (!user?.id || !mayCall(user, 'read')) return [];
+            const now = Date.now();
+            return (await callsOfContact(id, String(user.id))).slice(0, 5).map(c => ({
+                id: c.id, title: 'Video call', startAt: c.createdAt, past: !isOpen(c, now), meta: isOpen(c, now) ? 'open now' : ''
+            }));
+        }
+    });
+    // An email in the mail reader: "Call Sam now…" with the sender filled in.
+    registerRelatedItems('message', {
+        id: PROVIDER_ID, label: 'Call', icon: 'video', owner: 'core', when: () => !legacyHere('message'),
+        actions: [{label: 'Call {name} now…', icon: 'video', url: '#/calls/new?email={email}&name={name}', permission}]
+    });
+}
+
+// ---------------------------------------------------------------------------
+// The records
+// ---------------------------------------------------------------------------
+
+let file = null;
+let loading = null;   // ONE promise of the Map id -> record: concurrent first calls share the same Map
+let writing = Promise.resolve();
+
+const defaultFile = () => path.resolve(path.dirname(config.content.usersDir), 'sessions', 'instant-calls.json');
+
+/** Tests: where the records live (null = the default). Forgets what was read. */
+export function useCallsFile(p) {
+    file = p || null;
+    loading = null;
+}
+
+function load() {
+    loading ||= (async () => {
+        let list = [];
+        try {
+            const parsed = JSON.parse(await fs.readFile(file || defaultFile(), 'utf8'));
+            if (Array.isArray(parsed)) list = parsed;
+        } catch { /* none yet, or unreadable: no link validates */ }
+        return new Map(list.filter(c => c && typeof c.id === 'string' && ID_RE.test(c.id)).map(c => [c.id, c]));
+    })();
+    return loading;
+}
+
+/** Queue a write of the whole store; writes run one after another, each with the Map as it is then. */
+function save(calls) {
+    const target = file || defaultFile();
+    const list = [...calls.values()];
+    writing = writing.then(async () => {
+        await fs.mkdir(path.dirname(target), {recursive: true});
+        const tmp = `${target}.tmp`;
+        await fs.writeFile(tmp, JSON.stringify(list, null, 2) + '\n', {encoding: 'utf8', mode: 0o600});
+        await fs.rename(tmp, target);
+    }).catch((err) => { console.warn(`[calls] Could not save the call links: ${err?.message || err}`); });
+    return writing;
+}
+
+const key = () => randomBytes(18).toString('base64url');
+
+/**
+ * Start one: the record, stored. Old records go first (ended KEEP_DAYS ago),
+ * then the oldest past MAX_KEPT - the file never grows without bound.
+ *
+ * @param {{name?: string, email?: string, contactId?: string, hostId?: string, hostName?: string}} who
+ * @param {number} [now]
+ */
+export async function createCall({name = '', email = '', contactId = '', hostId = '', hostName = ''} = {}, now = Date.now()) {
+    const all = await load();
+    for (const [id, c] of all) if (!(Date.parse(c.expiresAt) >= now - KEEP_DAYS * 86400000)) all.delete(id);
+    const over = all.size - MAX_KEPT + 1;
+    if (over > 0) {
+        [...all.entries()].sort((a, b) => String(a[1].createdAt).localeCompare(String(b[1].createdAt)))
+            .slice(0, over).forEach(([id]) => all.delete(id));
+    }
+    const rec = {
+        id: randomBytes(12).toString('base64url'),
+        name: String(name || '').trim().slice(0, 120),
+        email: String(email || '').trim().toLowerCase().slice(0, 200),
+        contactId: String(contactId || '').slice(0, 64),
+        hostId: String(hostId || '').slice(0, 64),
+        hostName: String(hostName || '').trim().slice(0, 120) || 'Your host',
+        token: key(),
+        hostKey: key(),
+        createdAt: new Date(now).toISOString(),
+        expiresAt: new Date(now + INSTANT_HOURS * 3600000).toISOString()
+    };
+    all.set(rec.id, rec);
+    await save(all);
+    return rec;
+}
+
+/** One record, or null. */
+export async function getCall(id) {
+    if (typeof id !== 'string' || !ID_RE.test(id)) return null;
+    return (await load()).get(id) || null;
+}
+
+/** One host's calls with one contact, newest first. */
+export async function callsOfContact(contactId, hostId) {
+    if (!contactId || !hostId) return [];
+    return [...(await load()).values()].filter(c => c.contactId === contactId && c.hostId === hostId)
+        .sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+}
+
+const same = (a, b) => {
+    const x = Buffer.from(String(a || ''));
+    const y = Buffer.from(String(b || ''));
+    return x.length === y.length && x.length > 0 && timingSafeEqual(x, y);
+};
+
+/**
+ * Who the caller is in an instant call, or null (the engine answers 404).
+ * `cred` is what the link carried: {t} for the guest, {h} for the host. The
+ * engine answers 410 once `closesAt` has passed.
+ */
+export function whoIsCalling(rec, cred = {}) {
+    if (!rec) return null;
+    // One title for both: the room keeps the title of whoever joined first, so a per-person one
+    // ("Call with <the other>") would show the guest their own name.
+    const title = `Video call: ${rec.hostName} and ${rec.name || 'a guest'}`;
+    const base = {max: 6, recordingAllowed: false, autoAdmit: false, opensAt: rec.createdAt, closesAt: rec.expiresAt, title};
+    if (cred.h && same(cred.h, rec.hostKey)) {
+        return {...base, host: true, name: rec.hostName, identity: `${rec.id}:host`};
+    }
+    if (cred.t && same(cred.t, rec.token)) {
+        return {...base, host: false, name: rec.name || '', identity: `${rec.id}:guest`};
+    }
+    return null;
+}
+
+/** Is the call still open? */
+export const isOpen = (rec, now = Date.now()) => Boolean(rec) && Date.parse(rec.expiresAt) > now;
+
+/** The page addresses (relative to the site) of a call: the guest's and the host's. */
+export function callPaths(rec) {
+    const at = `${CALL_PATH}/${encodeURIComponent(rec.id)}`;
+    return {join: `${at}?t=${encodeURIComponent(rec.token)}`, host: `${at}?h=${encodeURIComponent(rec.hostKey)}`};
+}
+
+// ---------------------------------------------------------------------------
+// Limits - a host starting calls, and emails to one address
+// ---------------------------------------------------------------------------
+
+/** Calls one user may start in a minute (on top of the route's per-address limit). */
+export const CREATES_PER_MINUTE = 10;
+/** "Would like to talk now" emails one address may be sent in an hour, whoever sends them. */
+export const EMAILS_PER_ADDRESS_HOUR = 3;
+
+const createsBy = new Map();   // user id -> [times]
+const emailsTo = new Map();    // address -> [times]
+
+function take(map, key, max, windowMs, now) {
+    const since = now - windowMs;
+    const recent = (map.get(key) || []).filter(t => t > since);
+    if (recent.length >= max) { map.set(key, recent); return false; }
+    recent.push(now);
+    map.set(key, recent);
+    if (map.size > 10000) for (const [k, list] of map) if (!list.some(t => t > since)) map.delete(k);
+    return true;
+}
+
+/** May this user start another call now? Counts it when yes. */
+export const mayStartCall = (userId, now = Date.now()) => take(createsBy, String(userId || ''), CREATES_PER_MINUTE, 60000, now);
+
+/** May this address be emailed another call link now? Counts it when yes. */
+export const mayEmailAddress = (email, now = Date.now()) => take(emailsTo, String(email || '').trim().toLowerCase(), EMAILS_PER_ADDRESS_HOUR, 3600000, now);
+
+/** Tests only. */
+export function resetCallLimits() {
+    createsBy.clear();
+    emailsTo.clear();
+}
+
+// ---------------------------------------------------------------------------
+// The email ("<host> would like to talk now")
+// ---------------------------------------------------------------------------
+
+let mailer = null;
+let transport = null;
+let transportFor = '';
+
+/** Tests only: `fn(msg)` receives every message instead of SMTP. null restores. */
+export function setCallMailer(fn) { mailer = fn; }
+
+const site = () => { try { return getConfig('site') || {}; } catch { return {}; } };
+
+/** Can mail really leave this site? (No SMTP host = Ethereal = delivered to nobody, so not sent at all.) */
+export const callMailReady = () => Boolean(mailer) || isSmtpConfigured(site().smtp || {});
+
+/** The message, escaped. */
+export function composeCallEmail({name = '', hostName = '', joinUrl = ''}) {
+    const subject = `${hostName} would like to talk now`;
+    const lines = [`Hello${name ? ` ${name}` : ''}, ${hostName} would like to talk to you now, on a video call.`,
+        'Use the button below to join. You need a camera and microphone, or you can join with just one. The link works for the next few hours.'];
+    const html = [...lines.map(l => `<p>${escapeHtml(l)}</p>`),
+        `<p><a href="${escapeHtml(joinUrl)}" style="display:inline-block;padding:10px 18px;background:#2563eb;color:#fff;border-radius:6px;text-decoration:none">Join the call</a></p>`,
+        `<p style="color:#666;font-size:13px">Or paste this into your browser: ${escapeHtml(joinUrl)}</p>`].join('\n');
+    const text = [...lines, `Join the call: ${joinUrl}`].join('\n\n');
+    return {subject, html, text};
+}
+
+/**
+ * Send it. Never throws: a lost email must not fail the call (the host still
+ * has the link to pass on). Resolves to true only when it left.
+ */
+export async function sendCallEmail({to, name, hostName, joinUrl}, {log} = {}) {
+    try {
+        if (!to) return false;
+        const msg = {to, ...composeCallEmail({name, hostName, joinUrl})};
+        if (mailer) { await mailer(msg); return true; }
+        const s = site();
+        const smtp = s.smtp || {};
+        if (!isSmtpConfigured(smtp)) return false;
+        const k = JSON.stringify([smtp.host, smtp.port, smtp.user, smtp.secure]);
+        if (!transport || transportFor !== k) { transport = await createTransport(smtp); transportFor = k; }
+        await sendEmail(transport, {from: smtp.fromAddress || 'noreply@example.com', fromName: smtp.fromName || s.title || 'Calls', ...msg});
+        return true;
+    } catch (err) {
+        const line = `[calls] Email to ${to} not sent: ${err?.message || err}`;
+        try { if (typeof log?.error === 'function') log.error(line); else console.error(line); } catch { /* never */ }
+        return false;
+    }
+}

package/server/services/permissionRegistry.js

@@ -216,6 +216,19 @@ export const REGISTRY = [
             {key: 'manageGroups', label: 'Manage groups', description: 'Rename or delete any group, not only the ones they created - groups are shared, so this changes everyone\'s contacts'}
         ]
     },
+    {
+        // Instant calls (services/instantCalls.js). Only in use while a Pro Tool with calls
+        // (Booking Pro, Contacts Pro, Calendar) is running; admins are granted it then, once.
+        key: 'calls',
+        label: 'Calls',
+        description: 'Call someone now on a video call on your site ("Call Sam now…"). Needs a Pro Tool with calls: Booking Pro, Contacts Pro or Calendar.',
+        icon: 'video',
+        group: 'Tools',
+        actions: [
+            {key: 'read', label: 'View', description: 'See their own recent calls on a contact'},
+            {key: 'create', label: 'Call', description: 'Start a call and send the link'}
+        ]
+    },
     {
         key: 'analytics',
         label: 'Analytics',

package/server/services/plugins.js

@@ -26,6 +26,8 @@ import {
     registerShortcode,
     hideSidebarUrl,
     registerComponent,
+    registerContactAccess,
+    unregisterContactAccess,
     registerSidebarItem,
     registerTransform
 } from './hooks.js';
@@ -33,6 +35,7 @@ import {registerPluginResource, unregisterPluginResourcesByPlugin} from './permi
 import {registerThemeProvider} from './themeSettings.js';
 import {classifyEntitlement, mayLoad} from './pluginEntitlement.js';
 import {notifierFor} from './notify.js';
+import {disableInstantCalls, enableInstantCalls, grantInstantCallsOnce} from './instantCalls.js';
 import {createCollection, getCollection} from './collections.js';
 import * as defaultRolesService from './roles.js';
 import {getAdminScope, normaliseAdminScope} from './roles.js';
@@ -550,7 +553,13 @@ export async function registerPlugins(fastify) {
                   registerLoginCheck: (def) => registerLoginCheck(manifest.name, def),
                   registerPasswordCheck: (def) => registerPasswordCheck(manifest.name, def),
                   // A Domma component (.dmc source) usable as <dm-name> / [component] on pages (0.92.2).
-                  registerComponent: pluginComponentHook},
+                  registerComponent: pluginComponentHook,
+                  // Instant calls ("Call Sam now…", services/instantCalls.js) - a Pro Tool with calls switches
+                  // them on at boot. Bound to the plugin's name, tier and closedSource: only a paid plugin that
+                  // loads under a licence may.
+                  enableInstantCalls: () => enableInstantCalls({owner: manifest.name, tier: manifest.tier || 'free', closedSource: manifest.closedSource === true}),
+                  // Who may read a contact that is not their own (Contacts Pro's sharing) - hooks.js 7b.
+                  registerContactAccess: (fn) => registerContactAccess(manifest.name, fn)},
               settings,
               config: {}
           });
@@ -587,8 +596,13 @@ export async function registerPlugins(fastify) {
 
             // Permissions are held in memory, so they are registered on every
             // boot, not only on enable (roles are created once, then kept).
+            // Instant calls' admin grant rides the same awaited step, so no two grants ever write the roles
+            // file at once (roles.js rewrites it unlocked).
             await import('./roles.js')
-                .then(rolesService => registerPluginAccess(manifest.name, rolesService))
+                .then(async rolesService => {
+                    await registerPluginAccess(manifest.name, rolesService);
+                    await grantInstantCallsOnce(rolesService);
+                })
                 .catch(err => fastify.log.warn(`[plugins] Access setup for "${manifest.name}" failed: ${err.message}`));
 
             // Detect optional plugin.public.js for root-level route registration
@@ -1102,6 +1116,11 @@ export async function teardownPlugin(pluginName, services, fastify) {
 export async function runLifecycleHook(name, hook, fastify) {
     // Validate hook name
     if (!['onEnable', 'onDisable'].includes(hook)) return;
+    // A Tool with calls switched off stops keeping instant calls on - at once, not at the next restart.
+    if (hook === 'onDisable') {
+        disableInstantCalls(name);
+        unregisterContactAccess(name);
+    }
 
     const pluginJsPath = path.join(PLUGINS_DIR, name, 'plugin.js');
     try {

package/server/services/renderer.js

@@ -933,7 +933,8 @@ function buildFontVars(fontFamily, fontSize) {
  * @param {string} templatePath - Absolute path to the plugin HTML fragment
  * @param {object} data - Token replacement map; keys become {{key}} placeholders
  * @param {object} seoMeta - Optional SEO overrides: { title, description, ogImage,
- *   urlPath, ogType, noindex, baseUrl, user }. Pass `baseUrl` (derived from the
+ *   urlPath, ogType, noindex, baseUrl, user, injection }. `injection: false` leaves out the site's and
+ *   plugins' head/body snippets and the analytics beacon. Pass `baseUrl` (derived from the
  *   request) to populate canonical and og:url tags. Pass `user` (`{role, additionalRoles}`
  *   or null) so menu items gated by `visibility` are filtered correctly; blog
  *   callers currently default to anonymous (null).
@@ -941,6 +942,10 @@ function buildFontVars(fontFamily, fontSize) {
  */
 export async function renderBlogPage(templatePath, data = {}, seoMeta = {}) {
     const user = seoMeta.user || null;
+    // `injection: false` - no site/plugin head and body snippets and no analytics beacon: a page whose
+    // address carries a credential (an instant call's /_call/<id>?h=) must not hand it to a script
+    // the site or a plugin injects. The shell, theme and menus stay.
+    const bare = seoMeta.injection === false;
     // Plugin fragments know their own URL via seoMeta.urlPath - enough for a
     // menu bound to that page or to the project the URL falls under.
     const menuCtx = seoMeta.urlPath
@@ -1102,18 +1107,18 @@ export async function renderBlogPage(templatePath, data = {}, seoMeta = {}) {
                 : site.footer,
             social: site.social || null
         }).replace(/<\/script>/gi, '<\\/script>'),
-        headInject: [injection.head, navbarFontLink].filter(Boolean).join('\n'),
+        headInject: [bare ? '' : injection.head, navbarFontLink].filter(Boolean).join('\n'),
         // Theme overrides land BEFORE content/custom.css: the overrides are
         // generated, custom.css is hand-written, and the hand-written one stays
         // the last word.
-        headInjectLate: [injection.headLate, searchAssets.headTag, switcherAssets.headTag, themeView.customThemeStyleTag, themeView.overrideStyleTag, customCssTag, navbarStyleTag]
+        headInjectLate: [bare ? '' : injection.headLate, searchAssets.headTag, switcherAssets.headTag, themeView.customThemeStyleTag, themeView.overrideStyleTag, customCssTag, navbarStyleTag]
             .filter(Boolean).join('\n'),
         bodyEndInject: [
             overlayMenus,
-            injection.bodyEnd,
+            bare ? '' : injection.bodyEnd,
             searchAssets.bodyTag,
             switcherAssets.bodyTag,
-            buildAnalyticsTag(),
+            bare ? '' : buildAnalyticsTag(),
             (seoMeta.usedComponents || [])
                 .map(n => `<script type="module" src="/api/components/${n}.js"></script>`)
                 .join('\n')

package/server/templates/call.html

@@ -0,0 +1,3 @@
+<main class="container dm-call-page" style="padding: 2rem 0;">
+{{body}}
+</main>