domma-cms 0.105.2 → 0.107.0

package/plugins/free-tier.lock.json

@@ -1,6 +1,6 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@25153e0",
+  "source": "dcms-marketplace@f582d78",
   "plugins": {
     "blog": {
       "version": "1.9.4",
@@ -73,19 +73,19 @@
       }
     },
     "booking": {
-      "version": "1.4.1",
+      "version": "1.6.0",
       "files": {
-        "CLAUDE.md": "c4401810011ed98fe488e89e03d32ee601025818d1f354ec07fcd9f9add1115a",
+        "CLAUDE.md": "9bcab41375a2aaecbdd332766ceca5b18bf9dafa99d4c8315549e38033c1f5c5",
         "admin/css/index.css": "4f7731921c0c5038cb1566a6ab2d43ffc35bf9b161e58f87a0cff423e81b47fa",
         "admin/lib/details.js": "8b37536bfa9ccfcc5265cc957ba8266d3f5f777133e7c0946ae49540f1c80e3c",
         "admin/lib/diary-layout.js": "d818c79001fb9a9ecc15c96239ba961b0a1d98b9e8fce903eefb57d85adf2a73",
         "admin/lib/extension-sections.js": "0588ad47660e511b0dd8077bb9c3999c775d97597333a75e87ee12d915bbf00b",
-        "admin/lib/kit.js": "661e9c407bf398694dfa08105590065a6352594d526f3c09c31b180c840045bf",
+        "admin/lib/kit.js": "b69b02172d76ef80879da3f003cc1e687c6149626c9e58af51729c2e4a3ff959",
         "admin/templates/booking.html": "20b9a3bfe3e5d5bbee613f29be99551b12790fb38f80d119585360cc38e9ec57",
         "admin/views/booking.js": "4eddf6c0b60dbbba4c6e35352df247a3d34b66ee1d43c51fe2d53f894707348f",
         "admin/views/bookings.js": "bf17db82ed4d2f5c29ac924dd60dc0b84c8bd9c8ce32da6cbb011527699a56a6",
         "admin/views/diary.js": "9e8976e67c2232d353b3d9a1ef0d0503cc4d06b710d54d0cba84fb5b796fdfe9",
-        "admin/views/panels.js": "9d1c45e56d2a7a8caa12e9af29545c808ffb88da3ea48397d55aae19e802ec69",
+        "admin/views/panels.js": "1d269d90553a5482fd6ebd18180cb736011770f0204d5c1306948abcb4b676b2",
         "admin/views/people.js": "58cb9cc550b48c959a5572a4d25650ea2b32b658c9d0bf4c244e4abe0277c211",
         "admin/views/services.js": "122326d222ed16dc8ec903fef6f62f6a7638c31d73c4612b7a8c2ced38358068",
         "admin/views/settings.js": "299297b47a6509986276a859807a33ea225681d28e0e9cd06cdf36b0f6ec0c11",
@@ -93,15 +93,15 @@
         "collections/booking-bookings.json": "fa0b15cc81b4a2114734a0bc8adc4b4d25049d16cf62549b83634cdbeb543b52",
         "collections/booking-services.json": "cecb500a9215a0eba894e6b4c9ae78f5fbeb209830d07d47050c56c75143f66a",
         "config.js": "5565fd627481cf809322257cc300a7cbb7ccbf6cae076b4cf8a7453fcf554bd3",
-        "docs/guide.md": "545b050500a09ffdf7bc620e01f0b63bf59e92dfe855ba3201419b0bcc92a1fc",
+        "docs/guide.md": "186e2419f44ff5b13dfbcea709dc8616f3817c260717839a9fa51834ab73f718",
         "inject/body.html": "ab55ce945eec2302eb0c836a4626cffa5e091d050c6a59c6f2af332b05570777",
-        "lib/call.js": "7dfa0ae60be87d8f7f26b4360d5c1144322abe66eb61b233ed812e35bb8e59bd",
+        "lib/call.js": "87c11b8531e1a6d247d52d4e03ea8e5aa06a1af49cbd7cbd0af97e2586237f7b",
         "lib/extensions.js": "8cec28ff8685daad8083b23f034f1c3bf82fd2322943dd19d46570ccdc311105",
         "lib/mail.js": "cad8f409df62d6e42f0f4024ec364bbe018a62b842fa3f7c38786fd4e7f92408",
-        "lib/store.js": "270161f907c68de39d32758931e86c290582524af4650e722c2c3be209acc875",
-        "plugin.js": "963e8190dbcaec71915d73402648899bb38135b25ec869a659d0938d03868682",
-        "plugin.json": "704402863b0aec563046b347d4341680e2dc9739db967bec0a933c2bf0e4e5c9",
-        "plugin.public.js": "5f2dc4f01202b16ae804364a33c547509d1fa4026eadebac440730234aa266b5",
+        "lib/store.js": "7aa7967e4694e5a3b85378f60302e5a47394b1d90c7dd86e09578156f1c13e03",
+        "plugin.js": "90424e681de6c086dcc316c734ddb907c7572e452949ced4cc756205a4798f6e",
+        "plugin.json": "8f7a5b1ed1e0bbfb1e933906b2c63bff4fbfc62868244b2077b1090d87fc3cc0",
+        "plugin.public.js": "4d5b4e8ad6943182ee3b6c6e6f6762a2d3f676d8d7ee363fcb07bd47d3d6532e",
         "public/booking.css": "8b88989fdd04e50efc1688a2f32fe2e422299d7d13b81bb8fce0cc162fa99df6",
         "public/booking.js": "7dfc3d205696967013886567f67a867443c2e370bac29019d69911d695fdbade",
         "public/lib/clean.js": "d591be9ea8462705b7bc8806670027fdd4d6d4764777da08e91a010d27ec1651",
@@ -110,7 +110,7 @@
         "public/lib/time.js": "48e13a23e3d7a4916e2097e8f87c03a87d37b71c4ef037a5a16143c6a4185c41",
         "templates/booking.html": "a4995de46dfdab7e692b56f21347f29c76320cf3b0477889dc3c5d14e0b6dcd7",
         "tests/admin-diary.test.js": "4e34b447d62b41272ceec49bad9d491ae00dd04f4760d8a7a3046be1912f4abe",
-        "tests/api.test.js": "57ce73f48776e15454794405bae5b9674baeda46a96e4a11d0e253c6a977a764",
+        "tests/api.test.js": "43ae40477a43a03d21096038f317d745bc08cd51767c97548bf0601e99ebdd97",
         "tests/public.test.js": "0b7b626d60df5a3d73d7c0077b73f59b62a9fded98ce84a8d93cd32cd0333159",
         "tests/pure.test.js": "8ba0c8f76b4c9efcc422f39ff29509612544d81f760025a4b9a5594af14e7bcf"
       }

package/server/routes/api/calls.js

@@ -10,7 +10,8 @@
  *   GET  /api/calls/contacts?q=         contacts the caller may READ (own + shared), to pick     (calls.create)
  *   GET  /api/calls/contact/:id         one contact the caller may read, to fill in             (calls.create)
  *   POST /api/calls                     {name, email?, contactId?, notify} -> 201 {id, hostUrl, joinUrl, emailed, emailLimited?, expiresAt}
- *   GET  /api/calls?contact=<id>        the caller's recent calls with that contact             (calls.read)
+ *   GET  /api/calls?contact=<id>        the caller's recent calls with that contact, with `messages` (calls.read)
+ *   GET  /api/calls/:id/chat            the call's saved chat (read-only transcript) - its HOST or an admin (calls.read)
  *
  * Contacts are read through `readableContactIds` (services/hooks.js): the
  * caller's own, plus whatever a sharing plugin (Contacts Pro) lets them read -
@@ -24,18 +25,23 @@
  * The call itself (no sign-in - the link is the credential):
  *   /api/calls/room/:id/{join,poll,signal,chat,answer,recording,leave}   (plugins/_lib/call/routes.js)
  *   join takes {t} (the guest) or {h} (the host); guests knock and the host lets them in.
+ *   "Add people" (the host, in the call): GET /api/calls/room/:id/people?q= - the host's readable contacts and the
+ *   team; POST /api/calls/room/:id/invite - each person gets their own Join link `?g=<pass>` (never the guest's
+ *   token), by email, notification and Messages as chosen (services/callInvites.js). They knock like any guest.
  */
 import {authenticate as defaultAuthenticate, requirePermission as defaultRequirePermission} from '../../middleware/auth.js';
 import {getEntry, listEntries} from '../../services/collections.js';
 import {readableContactIds} from '../../services/hooks.js';
 import {getPermissionsFor} from '../../services/roles.js';
-import {getEffectiveRoles} from '../../services/userRoles.js';
+import {getEffectiveLevel, getEffectiveRoles} from '../../services/userRoles.js';
 import {isToolEnabled} from '../../services/tools.js';
 import {mountCallRoutes} from '../../../plugins/_lib/call/routes.js';
+import {whoOf} from '../../../plugins/_lib/call/rooms.js';
 import {getBaseUrl} from '../public.js';
+import {deliverInvites, resolveInvitees, searchInvitees} from '../../services/callInvites.js';
 import {
-    EMAIL_RE, callMailReady, callPaths, callsOfContact, createCall, getCall, instantCallsEnabled, isOpen,
-    mayEmailAddress, mayStartCall, sendCallEmail, whoIsCalling
+    EMAIL_RE, callChat, callMailReady, callPaths, callsOfContact, chatCountOf, createCall, getCall, instantCallsEnabled, isOpen,
+    invitePath, mayEmailAddress, mayStartCall, saveCallChat, sendCallEmail, whoIsCalling
 } from '../../services/instantCalls.js';
 
 const CONTACTS_SLUG = 'contacts-contacts';
@@ -122,13 +128,49 @@ export async function callsRoutes(fastify, opts = {}) {
         if (!contact) return fail(reply, 400, 'contact is required');
         const now = Date.now();
         const list = (await callsOfContact(contact, uidOf(request))).slice(0, 20)
-            .map(c => ({id: c.id, name: c.name, createdAt: c.createdAt, expiresAt: c.expiresAt, open: isOpen(c, now)}));
+            .map(c => ({id: c.id, name: c.name, createdAt: c.createdAt, expiresAt: c.expiresAt, open: isOpen(c, now), messages: chatCountOf(c)}));
         return reply.send(list);
     });
 
+    // The call's chat, saved against it: for the host who made the call, or an admin. Anyone else: 404 (not 403 -
+    // whether a call exists is the host's business). `mine` marks the host's own lines for the bubbles.
+    fastify.get('/:id/chat', can('read'), async (request, reply) => {
+        const rec = await getCall(String(request.params.id));
+        const uid = uidOf(request);
+        let admin = false;
+        try { admin = getEffectiveLevel(request.user || {}) <= 1; } catch { admin = false; }
+        if (!rec || !uid || (rec.hostId !== uid && !admin)) return fail(reply, 404, 'That call could not be found.');
+        const hostWho = whoOf(`${rec.id}:host`, '');
+        const mineToo = rec.hostId === uid;
+        const items = (await callChat(rec.id)).map(({from, ...i}) => ({...i, mine: mineToo && i.kind === 'chat' && i.who === hostWho}));
+        reply.header('Cache-Control', 'no-store');
+        return reply.send({id: rec.id, name: rec.name, hostName: rec.hostName, createdAt: rec.createdAt, expiresAt: rec.expiresAt,
+            messages: chatCountOf(rec), items});
+    });
+
     // The call engine: a room per call, guests knock, the host lets them in, open createdAt..expiresAt.
     mountCallRoutes(fastify, {
         prefix: '/room', ns: 'instant', ...(opts.rooms ? {rooms: opts.rooms} : {}),
-        resolve: async (request, room, body) => whoIsCalling(await getCall(String(room)), {t: body?.t, h: body?.h})
+        resolve: async (request, room, body) => whoIsCalling(await getCall(String(room)), {t: body?.t, h: body?.h, g: body?.g}),
+        // The chat is saved against the call record, so a call reopened (or after a restart) shows it again.
+        chat: {load: (room) => callChat(String(room)), save: (room, item) => saveCallChat(String(room), item)},
+        // Add people (the host): the host user's contacts and the team; each invitee gets their own `?g=` link.
+        invite: {
+            search: async (room, q) => {
+                const rec = await getCall(String(room));
+                if (!rec || !isOpen(rec)) return [];
+                return searchInvitees({hostUserId: rec.hostId, q});
+            },
+            send: async (room, people, {via, request}) => {
+                const rec = await getCall(String(room));
+                if (!rec || !isOpen(rec)) return {error: 'This call has ended.'};
+                const base = getBaseUrl(request);
+                const newLink = async () => `${base}${await invitePath(rec.id)}`;
+                const targets = await resolveInvitees(people, {hostUserId: rec.hostId});
+                const results = await deliverInvites(targets, {linkFor: newLink, hostName: rec.hostName, hostUserId: rec.hostId,
+                    title: `Video call: ${rec.hostName} and ${rec.name || 'a guest'}`, via, key: `instant:${rec.id}`, expiresAt: rec.expiresAt, log: request.log});
+                return {link: await newLink(), results};
+            }
+        }
     });
 }

package/server/routes/call-public.js

@@ -3,6 +3,7 @@
  *
  *   /_call/<id>?t=<guest token>   the person called
  *   /_call/<id>?h=<host key>      the host
+ *   /_call/<id>?g=<invite pass>   someone the host added ("Add people") - names themselves, knocks
  *
  * Under `/_call`, like `/_preview`. Answered from an onRequest hook, and ONLY
  * while instant calls are on: with no Pro Tool with calls the request goes on
@@ -53,14 +54,14 @@ export const recoverScript = '<script>(function(){try{if(location.search)return;
 
 export function callPage(rec, who, cred, now = Date.now()) {
     if (!rec || !who) {
-        const bare = !cred?.t && !cred?.h;
+        const bare = !cred?.t && !cred?.h && !cred?.g;
         return {status: 404, title: 'Call', body: '<h1>This call link is not valid</h1><p>Ask the person who sent it for a new one.</p>'
             + (bare ? recoverScript : '')};
     }
     if (!(Date.parse(rec.expiresAt) > now)) {
         return {status: 410, title: 'Call', body: '<h1>This call has ended</h1><p>Ask the person who sent the link for a new one.</p>'};
     }
-    const cfg = {api: ROOM_API, room: rec.id, cred, title: who.title, askName: !who.host && !rec.name, recordingAllowed: false, closesAt: rec.expiresAt};
+    const cfg = {api: ROOM_API, room: rec.id, cred, title: who.title, askName: !who.host && (!rec.name || who.invited === true), recordingAllowed: false, closesAt: rec.expiresAt};
     return {
         status: 200,
         title: who.title,
@@ -89,7 +90,7 @@ export async function callPublicRoutes(fastify, opts = {}) {
         reply.header('cache-control', 'no-store, private');
         reply.header('x-robots-tag', 'noindex, nofollow');
         const q = new URLSearchParams(search);
-        const cred = q.get('h') ? {h: q.get('h').slice(0, 128)} : {t: String(q.get('t') || '').slice(0, 128)};
+        const cred = q.get('h') ? {h: q.get('h').slice(0, 128)} : q.get('g') ? {g: q.get('g').slice(0, 128)} : {t: String(q.get('t') || '').slice(0, 128)};
         const rec = await getCall(id);
         const page = callPage(rec, whoIsCalling(rec, cred), cred);
         const html = await renderBlogPage(TEMPLATE, {body: page.body}, {

package/server/services/callInvites.js

@@ -0,0 +1,238 @@
+/**
+ * "Add people" to a call - what core does for every Tool with calls (instant
+ * calls, Booking, Calendar, Messages). The pure parts (the request's shape, the
+ * invite pass, matching, limits) are `plugins/_lib/call/invite.js`; the routes
+ * are the engine's (`plugins/_lib/call/routes.js`). This file finds people and
+ * sends what the host chose:
+ *
+ *   searchInvitees({hostUserId, q, excludeUserIds, contacts, team})
+ *       the host's readable contacts (their own plus what a sharing Tool lets
+ *       them read - `readableContactIds`) and the team, matched to `q`
+ *   resolveInvitees(people, {hostUserId, contacts, team, emails})
+ *       the request's {kind, id} / {kind: 'email'} list as real people - a
+ *       contact the host may read, an active team member - else an error row
+ *   deliverInvites(targets, {linkFor, hostName, hostUserId, title, via, key})
+ *       per person: the Join email (via.email, any address), a notification
+ *       (via.notify, team members: bell + desktop, `core:call-invites`,
+ *       dedupeKey per call + person) and a direct message from the host
+ *       (via.message, team members, when a Tool registered a messenger -
+ *       Messages; hooks.sendDirectMessage). Never throws.
+ *
+ * "The team": active users whose most senior role is at the base `user` level
+ * or above - roles a plugin makes for people from outside (Job Board's
+ * candidates) are not the team.
+ *
+ * @module services/callInvites
+ */
+import {getConfig} from '../config.js';
+import {getEntry, listEntries} from './collections.js';
+import {createTransport, escapeHtml, isSmtpConfigured, sendEmail} from './email.js';
+import {hasDirectMessenger, readableContactIds, sendDirectMessage} from './hooks.js';
+import {notify, registerNotificationSource} from './notify.js';
+import {getPermissionsFor, getRoleLevel} from './roles.js';
+import {isToolEnabled} from './tools.js';
+import {getUserById, listUsers} from './users.js';
+import {getEffectiveLevel, getEffectiveRoles} from './userRoles.js';
+import {cleanText, createLimiter, inviteMessage, inviteTitle, matchPeople} from '../../plugins/_lib/call/invite.js';
+
+export const SOURCE = 'core:call-invites';
+const CONTACTS_SLUG = 'contacts-contacts';
+/** Join emails one address may be sent in an hour, whoever sends them. */
+export const EMAILS_PER_ADDRESS_HOUR = 3;
+/** Join emails the whole site may send in an hour (every call, every Tool) - a leaked host link cannot spam. */
+export const EMAILS_PER_SITE_HOUR = 30;
+
+try {
+    registerNotificationSource({id: SOURCE, owner: 'core', label: 'Call invitations', severity: 'info', defaultOn: true,
+        description: 'Someone in a video call adds a team member to it ("Add people") - told to that person, with the Join link.'});
+} catch { /* never stops the calls */ }
+
+const isActive = (u) => Boolean(u) && u.disabled !== true && u.active !== false && u.isActive !== false;
+
+/** Is this user one of the team (active, at the base user level or more senior)? */
+export function isTeamMember(u) {
+    if (!isActive(u)) return false;
+    const base = getRoleLevel('user');
+    try { return getEffectiveLevel(u) <= (Number.isFinite(base) ? base : 2); } catch { return false; }
+}
+
+/** The team, by name. */
+export async function teamMembers() {
+    return (await listUsers().catch(() => [])).filter(isTeamMember);
+}
+
+/** May this user read contacts at all (Contacts on, a role with contacts.read)? */
+function mayReadContacts(user) {
+    try {
+        const roles = getEffectiveRoles(user || {});
+        return isToolEnabled('contacts') && roles.some(r => getPermissionsFor('contacts', 'read').includes(r));
+    } catch { return false; }
+}
+
+/** The contacts this user may read, as {id, name, email} (with an email only). */
+export async function contactsOf(hostUserId) {
+    const user = hostUserId ? await getUserById(String(hostUserId)).catch(() => null) : null;
+    if (!user || !mayReadContacts(user)) return [];
+    const {entries} = await listEntries(CONTACTS_SLUG, {limit: 100000}).catch(() => ({entries: []}));
+    const withEmail = (entries || []).filter(e => String(e?.data?.email || '').includes('@'));
+    const ok = await readableContactIds(withEmail, {id: user.id, roles: getEffectiveRoles(user)});
+    return withEmail.filter(e => ok.has(e.id)).map(e => ({id: e.id, name: String(e.data?.name || '').trim(), email: String(e.data.email).trim()}));
+}
+
+/**
+ * Search: the team (not `excludeUserIds`, not the host) and the host's contacts.
+ *
+ * @param {{hostUserId?: string, q?: string, excludeUserIds?: string[], contacts?: boolean, team?: boolean, teamFilter?: (u: object) => boolean}} opts
+ */
+export async function searchInvitees({hostUserId = '', q = '', excludeUserIds = [], contacts = true, team = true, teamFilter = null} = {}) {
+    const users = team ? (await teamMembers()).filter(u => !teamFilter || teamFilter(u)) : [];
+    const known = contacts && String(q || '').trim() ? await contactsOf(hostUserId) : [];
+    return matchPeople({q, users, contacts: known, excludeUserIds: [...excludeUserIds, hostUserId].filter(Boolean),
+        canMessage: Boolean(hostUserId) && hasDirectMessenger()});
+}
+
+/**
+ * The request's people as real people: `{kind, id?, name, email, userId?}`, or `{name, error}` for someone who
+ * cannot be invited (a contact the host may not read, not a team member, an email not allowed here).
+ *
+ * @param {object[]} people - cleanInviteRequest()'s list
+ * @param {{hostUserId?: string, contacts?: boolean, team?: boolean, emails?: boolean, teamFilter?: (u: object) => boolean}} opts
+ */
+export async function resolveInvitees(people = [], {hostUserId = '', contacts = true, team = true, emails = true, teamFilter = null} = {}) {
+    const out = [];
+    let readable = null;
+    for (const p of people) {
+        if (p.kind === 'email') {
+            out.push(emails ? {kind: 'email', name: p.name, email: p.email} : {name: p.name, error: 'Only team members can be added to this call.'});
+        } else if (p.kind === 'user') {
+            const u = team ? await getUserById(p.id).catch(() => null) : null;
+            if (!u || !isTeamMember(u) || (teamFilter && !teamFilter(u)) || u.id === hostUserId) out.push({name: 'Someone', error: 'That person cannot be added.'});
+            else out.push({kind: 'user', id: u.id, name: String(u.name || '').trim() || 'Team member', email: String(u.email || '').trim()});
+        } else if (p.kind === 'contact') {
+            readable ||= contacts ? await contactsOf(hostUserId) : [];
+            const c = readable.find(x => x.id === p.id);
+            out.push(c ? {kind: 'contact', id: c.id, name: c.name || c.email.split('@')[0], email: c.email.toLowerCase()} : {name: 'Someone', error: 'That contact could not be found.'});
+        }
+    }
+    return out;
+}
+
+// ---------------------------------------------------------------------------
+// The Join email
+// ---------------------------------------------------------------------------
+
+let mailer = null;
+let transport = null;
+let transportFor = '';
+const emailsTo = createLimiter({max: EMAILS_PER_ADDRESS_HOUR, windowMs: 3600000});
+const emailsFromSite = createLimiter({max: EMAILS_PER_SITE_HOUR, windowMs: 3600000});
+
+/** Tests only: `fn(msg)` receives every message instead of SMTP. null restores. */
+export function setInviteMailer(fn) { mailer = fn; }
+/** Tests only. */
+export function resetInviteLimits() { emailsTo.reset(); emailsFromSite.reset(); }
+
+const site = () => { try { return getConfig('site') || {}; } catch { return {}; } };
+
+/** Can mail really leave this site? */
+export const inviteMailReady = () => Boolean(mailer) || isSmtpConfigured(site().smtp || {});
+
+/** The message, escaped. */
+export function composeInviteEmail({name = '', hostName = '', title = '', link = ''}) {
+    const host = cleanText(hostName, 80) || 'Someone';
+    name = cleanText(name, 120);
+    title = cleanText(title, 120);
+    const subject = `${host} is inviting you to a video call now`;
+    const lines = [`Hello${name ? ` ${name}` : ''}, ${host} is in a video call${title ? ` (${title})` : ''} and would like you to join now.`,
+        'Use the button below. You will wait a moment until you are let in. You need a camera and microphone, or you can join with just one.'];
+    const html = [...lines.map(l => `<p>${escapeHtml(l)}</p>`),
+        `<p><a href="${escapeHtml(link)}" style="display:inline-block;padding:10px 18px;background:#2563eb;color:#fff;border-radius:6px;text-decoration:none">Join the call</a></p>`,
+        `<p style="color:#666;font-size:13px">Or paste this into your browser: ${escapeHtml(link)}</p>`].join('\n');
+    return {subject, html, text: [...lines, `Join the call: ${link}`].join('\n\n')};
+}
+
+/** Send it. Never throws; true only when it left. */
+export async function sendInviteEmail({to, name, hostName, title, link}, {log} = {}) {
+    try {
+        if (!to || !link) return false;
+        const msg = {to, ...composeInviteEmail({name, hostName, title, link})};
+        if (mailer) { await mailer(msg); return true; }
+        const s = site();
+        const smtp = s.smtp || {};
+        if (!isSmtpConfigured(smtp)) return false;
+        const k = JSON.stringify([smtp.host, smtp.port, smtp.user, smtp.secure]);
+        if (!transport || transportFor !== k) { transport = await createTransport(smtp); transportFor = k; }
+        await sendEmail(transport, {from: smtp.fromAddress || 'noreply@example.com', fromName: smtp.fromName || s.title || 'Calls', ...msg});
+        return true;
+    } catch (err) {
+        try { (log?.error || console.error).call(log || console, `[calls] Invitation to ${to} not sent: ${err?.message || err}`); } catch { /* never */ }
+        return false;
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Sending
+// ---------------------------------------------------------------------------
+
+/**
+ * Tell each person. `linkFor(target)` is their Join link (absolute). Resolves to one result per target:
+ * `{name, emailed, notified, messaged, error?}` - `error` says why nothing reached them.
+ *
+ * @param {object[]} targets - resolveInvitees()'s list
+ * @param {{linkFor: (t: object) => string|Promise<string>, hostName?: string, hostUserId?: string, title?: string,
+ *   via?: {email?: boolean, notify?: boolean, message?: boolean}, key?: string, expiresAt?: string, log?: object,
+ *   deps?: {notify?: Function, sendDirectMessage?: Function}}} opts - `key`: the call, for the notification's dedupeKey
+ */
+export async function deliverInvites(targets = [], {linkFor, hostName = '', hostUserId = '', title = '', via = {}, key = '', expiresAt, log, deps = {}} = {}) {
+    const raise = deps.notify || notify;
+    const dm = deps.sendDirectMessage || sendDirectMessage;
+    const results = [];
+    for (const t of targets) {
+        if (t.error) { results.push({name: t.name, emailed: false, notified: false, messaged: false, error: t.error}); continue; }
+        const r = {name: t.name, emailed: false, notified: false, messaged: false};
+        let link = '';
+        try { link = await linkFor(t); } catch { link = ''; }
+        if (!link) { results.push({...r, error: 'No link could be made for them.'}); continue; }
+        const why = [];
+        if (via.email && t.email) {
+            if (!inviteMailReady()) why.push('email is not set up on this site');
+            else if (!emailsTo.take(t.email)) why.push('they have been emailed several times this hour');
+            else if (!emailsFromSite.take('site')) why.push('this site has sent a lot of call invitations this hour');
+            else if (!(r.emailed = await sendInviteEmail({to: t.email, name: t.name, hostName, title, link}, {log}))) why.push('the email could not be sent');
+        }
+        if (t.kind === 'user') {
+            if (via.notify) {
+                try {
+                    r.notified = Boolean(await raise({title: inviteTitle(hostName), body: title ? `Video call: ${title}` : 'A video call, now.', severity: 'info', link,
+                        source: SOURCE, dedupeKey: `call-invite:${key}:${t.id}`.slice(0, 200), audience: {userIds: [t.id]},
+                        expiresAt: expiresAt || new Date(Date.now() + 3 * 3600e3).toISOString()}));
+                } catch { r.notified = false; }
+                if (!r.notified) why.push('the notification was not raised');
+            }
+            if (via.message) {
+                if (!hostUserId) why.push('a message needs a host who is a team member');
+                else if (!hasDirectMessenger() && !deps.sendDirectMessage) why.push('Messages is not on');
+                else {
+                    let out = null;
+                    try { out = await dm({fromUserId: hostUserId, toUserId: t.id, text: inviteMessage(hostName, title, link)}); } catch { out = null; }
+                    r.messaged = out === true || out?.sent === true;
+                    if (!r.messaged) why.push(`no message: ${out?.reason || 'it could not be sent'}`);
+                }
+            }
+        }
+        if (!r.emailed && !r.notified && !r.messaged) r.error = why.length ? `Not reached: ${why.join('; ')}.` : 'Nothing was sent - copy the link and pass it on.';
+        results.push(r);
+    }
+    return results;
+}
+
+/**
+ * The origin Join links are built on: the site's configured `baseUrl` whenever there is one (links in emails
+ * and notices must never follow a Host header), else the request's own origin.
+ */
+export function inviteOrigin(request) {
+    const base = String(site().baseUrl || '').trim();
+    if (/^https?:\/\/[^/\s]+/i.test(base)) return base.replace(/\/+$/, '');
+    if (!request) return '';
+    return `${request.protocol}://${request.host || request.headers?.host || request.hostname}`;
+}

package/server/services/hooks.js

@@ -404,6 +404,61 @@ export async function readableContactIds(entries, viewer) {
   return out;
 }
 
+// ---------------------------------------------------------------------------
+// 7c. Direct messages - one team member writing to another (Messages)
+// ---------------------------------------------------------------------------
+//
+// Core has no messaging of its own. A Tool that has it (Messages) registers a
+// messenger, and core code - a call's "Add people" (services/callInvites.js) -
+// sends a direct message from one user to another through it, without knowing
+// the Tool. No messenger (Messages off or absent): sendDirectMessage answers
+// false and the caller carries on without it.
+
+const _messengers = new Map(); // owner -> fn({fromUserId, toUserId, text}) => Promise<boolean | {sent, reason}>
+
+/**
+ * @param {string} owner - the plugin
+ * @param {(msg: {fromUserId: string, toUserId: string, text: string}) => Promise<boolean|{sent: boolean, reason?: string}>} fn
+ *   post `text` from `fromUserId` to `toUserId` in their direct conversation (made when there is none), by the
+ *   Tool's OWN rules (who may message whom): true / {sent: true} when posted, else false or {sent: false, reason}
+ */
+export function registerDirectMessenger(owner, fn) {
+  if (typeof owner !== 'string' || !owner || typeof fn !== 'function') return false;
+  _messengers.set(owner, fn);
+  return true;
+}
+
+/** @param {string} owner */
+export function unregisterDirectMessenger(owner) {
+  _messengers.delete(owner);
+}
+
+/** Is there a Tool that can send a direct message? */
+export const hasDirectMessenger = () => _messengers.size > 0;
+
+/**
+ * Send a direct message through the registered messenger. Never throws.
+ *
+ * @param {{fromUserId: string, toUserId: string, text: string}} msg
+ * @returns {Promise<{sent: boolean, reason?: string}>} sent when a messenger posted it; else why not
+ */
+export async function sendDirectMessage({fromUserId, toUserId, text} = {}) {
+  const from = String(fromUserId || '');
+  const to = String(toUserId || '');
+  const body = String(text || '').trim().slice(0, 4000);
+  if (!from || !to || from === to || !body) return {sent: false, reason: 'nobody to send it to'};
+  if (!_messengers.size) return {sent: false, reason: 'Messages is not on'};
+  let reason = 'the message could not be sent';
+  for (const fn of _messengers.values()) {
+    try {
+      const out = await fn({fromUserId: from, toUserId: to, text: body});
+      if (out === true || out?.sent === true) return {sent: true};
+      if (out?.reason) reason = String(out.reason).slice(0, 200);
+    } catch { /* a failing messenger sends nothing */ }
+  }
+  return {sent: false, reason};
+}
+
 // ---------------------------------------------------------------------------
 // 8. Sitemap sources (0.89) - URLs a plugin serves, in /sitemap.xml
 // ---------------------------------------------------------------------------

package/server/services/instantCalls.js

@@ -19,7 +19,13 @@
  * actions and list stand aside (checked per request), so nobody sees two.
  *
  * A record: {id, name, email, contactId, hostId, hostName, token, hostKey,
- * createdAt, expiresAt}. Kept in memory and in one JSON file with the sign-in
+ * createdAt, expiresAt, chat?, inviteKey?}. `inviteKey` (made on the first "Add
+ * people", `inviteKeyOf`) signs the passes of people added to the call
+ * (`?g=<pass>`, _lib/call/invite.js) - never the guest's token, which carries
+ * the guest's name and place. `chat` is the call's chat, saved against the
+ * call (the engine's items - typed messages plus joined/left lines - the last
+ * CHAT_MAX); the engine seeds a reopened room from it, and the host (or an
+ * admin) reads it afterwards through GET /api/calls/:id/chat. Kept in memory and in one JSON file with the sign-in
  * sessions (content/sessions/ - runtime state, never committed; see
  * siteGitignore.js), so a restart keeps the links working. The call itself (who
  * is in it) is the call engine's, in memory. Records are forgotten KEEP_DAYS
@@ -40,10 +46,13 @@ import {hasRelatedProvider, registerRelatedItems, unregisterRelatedItems} from '
 import {getPermissionsFor} from './roles.js';
 import {getEffectiveRoles} from './userRoles.js';
 import {createTransport, escapeHtml, isSmtpConfigured, sendEmail} from './email.js';
+import {checkInvitePass, invitePass, newInviteKey} from '../../plugins/_lib/call/invite.js';
 
 export const INSTANT_HOURS = 3;
 export const KEEP_DAYS = 30;
 export const MAX_KEPT = 2000;
+/** Chat items kept on one call record (the engine's HISTORY_MAX). */
+export const CHAT_MAX = 500;
 export const CALL_PATH = '/_call';
 export const ROOM_API = '/api/calls/room';
 export const ID_RE = /^[\w-]{16,40}$/;
@@ -141,9 +150,14 @@ function registerActions() {
         async list({id, user}) {
             if (!user?.id || !mayCall(user, 'read')) return [];
             const now = Date.now();
-            return (await callsOfContact(id, String(user.id))).slice(0, 5).map(c => ({
-                id: c.id, title: 'Video call', startAt: c.createdAt, past: !isOpen(c, now), meta: isOpen(c, now) ? 'open now' : ''
-            }));
+            return (await callsOfContact(id, String(user.id))).slice(0, 5).map((c) => {
+                const n = chatCountOf(c);
+                return {
+                    id: c.id, title: 'Video call', startAt: c.createdAt, past: !isOpen(c, now), meta: isOpen(c, now) ? 'open now' : '',
+                    // The admin's Calls list offers "N messages" - a read-only transcript (GET /api/calls/:id/chat).
+                    ...(n ? {transcript: {url: `/calls/${encodeURIComponent(c.id)}/chat`, count: n, title: `Video call with ${c.name || 'a guest'}`}} : {})
+                };
+            });
         }
     });
     // An email in the mail reader: "Call Sam now…" with the sender filled in.
@@ -234,6 +248,65 @@ export async function getCall(id) {
     return (await load()).get(id) || null;
 }
 
+/** The call's invite key, made (and stored) the first time someone is added to it. Null for no such call. */
+export async function inviteKeyOf(id) {
+    if (typeof id !== 'string' || !ID_RE.test(id)) return null;
+    const all = await load();
+    const rec = all.get(id);
+    if (!rec) return null;
+    if (!rec.inviteKey) {
+        rec.inviteKey = newInviteKey();
+        await save(all);
+    }
+    return rec.inviteKey;
+}
+
+/** A new Join link (relative) for someone added to the call: `?g=<pass>`. */
+export async function invitePath(id) {
+    const k = await inviteKeyOf(id);
+    return k ? `${CALL_PATH}/${encodeURIComponent(id)}?g=${encodeURIComponent(invitePass(k, id))}` : '';
+}
+
+/** The chat item as it is kept on a record; null for junk. System lines other than joined/left are not kept. */
+function chatItem(raw) {
+    if (!raw || typeof raw !== 'object' || typeof raw.text !== 'string' || !raw.id) return null;
+    const kind = raw.kind === 'system' ? 'system' : 'chat';
+    if (kind === 'system' && raw.event !== 'joined' && raw.event !== 'left') return null;
+    const item = {id: String(raw.id).slice(0, 64), seq: Number(raw.seq) || 0, at: String(raw.at || ''), kind,
+        from: String(raw.from || '').slice(0, 64), who: String(raw.who || '').slice(0, 64),
+        name: String(raw.name || '').slice(0, 60), text: raw.text.slice(0, 1000)};
+    if (kind === 'system') item.event = raw.event;
+    return item;
+}
+
+/**
+ * Save one chat item against its call (the engine's `chat.save`). Queued with
+ * every other write to the file; the last CHAT_MAX are kept. A call that is no
+ * longer on record (forgotten, or never) keeps nothing.
+ */
+export async function saveCallChat(id, raw) {
+    const item = chatItem(raw);
+    if (!item || typeof id !== 'string' || !ID_RE.test(id)) return;
+    const all = await load();
+    const rec = all.get(id);
+    if (!rec) return;
+    const chat = Array.isArray(rec.chat) ? rec.chat : [];
+    if (chat.some(c => c?.id === item.id)) return;
+    chat.push(item);
+    if (chat.length > CHAT_MAX) chat.splice(0, chat.length - CHAT_MAX);
+    rec.chat = chat;
+    await save(all);
+}
+
+/** A call's saved chat, oldest first ([] for none). */
+export async function callChat(id) {
+    const rec = await getCall(id);
+    return Array.isArray(rec?.chat) ? rec.chat.map(c => ({...c})) : [];
+}
+
+/** How many typed messages a call's chat holds (not the joined/left lines). */
+export const chatCountOf = (rec) => (Array.isArray(rec?.chat) ? rec.chat.filter(c => c?.kind === 'chat').length : 0);
+
 /** One host's calls with one contact, newest first. */
 export async function callsOfContact(contactId, hostId) {
     if (!contactId || !hostId) return [];
@@ -249,8 +322,10 @@ const same = (a, b) => {
 
 /**
  * Who the caller is in an instant call, or null (the engine answers 404).
- * `cred` is what the link carried: {t} for the guest, {h} for the host. The
- * engine answers 410 once `closesAt` has passed.
+ * `cred` is what the link carried: {t} for the guest, {h} for the host, {g}
+ * for someone added to the call (a pass under `inviteKey`: they give their own
+ * name and knock; each pass is its own identity). The engine answers 410 once
+ * `closesAt` has passed.
  */
 export function whoIsCalling(rec, cred = {}) {
     if (!rec) return null;
@@ -264,6 +339,8 @@ export function whoIsCalling(rec, cred = {}) {
     if (cred.t && same(cred.t, rec.token)) {
         return {...base, host: false, name: rec.name || '', identity: `${rec.id}:guest`};
     }
+    const nonce = cred.g && rec.inviteKey ? checkInvitePass(rec.inviteKey, rec.id, cred.g) : null;
+    if (nonce) return {...base, host: false, name: '', identity: `${rec.id}:inv:${nonce}`, invited: true};
     return null;
 }