domma-cms 0.106.0 → 0.107.0

package/server/services/callInvites.js

@@ -0,0 +1,238 @@
+/**
+ * "Add people" to a call - what core does for every Tool with calls (instant
+ * calls, Booking, Calendar, Messages). The pure parts (the request's shape, the
+ * invite pass, matching, limits) are `plugins/_lib/call/invite.js`; the routes
+ * are the engine's (`plugins/_lib/call/routes.js`). This file finds people and
+ * sends what the host chose:
+ *
+ *   searchInvitees({hostUserId, q, excludeUserIds, contacts, team})
+ *       the host's readable contacts (their own plus what a sharing Tool lets
+ *       them read - `readableContactIds`) and the team, matched to `q`
+ *   resolveInvitees(people, {hostUserId, contacts, team, emails})
+ *       the request's {kind, id} / {kind: 'email'} list as real people - a
+ *       contact the host may read, an active team member - else an error row
+ *   deliverInvites(targets, {linkFor, hostName, hostUserId, title, via, key})
+ *       per person: the Join email (via.email, any address), a notification
+ *       (via.notify, team members: bell + desktop, `core:call-invites`,
+ *       dedupeKey per call + person) and a direct message from the host
+ *       (via.message, team members, when a Tool registered a messenger -
+ *       Messages; hooks.sendDirectMessage). Never throws.
+ *
+ * "The team": active users whose most senior role is at the base `user` level
+ * or above - roles a plugin makes for people from outside (Job Board's
+ * candidates) are not the team.
+ *
+ * @module services/callInvites
+ */
+import {getConfig} from '../config.js';
+import {getEntry, listEntries} from './collections.js';
+import {createTransport, escapeHtml, isSmtpConfigured, sendEmail} from './email.js';
+import {hasDirectMessenger, readableContactIds, sendDirectMessage} from './hooks.js';
+import {notify, registerNotificationSource} from './notify.js';
+import {getPermissionsFor, getRoleLevel} from './roles.js';
+import {isToolEnabled} from './tools.js';
+import {getUserById, listUsers} from './users.js';
+import {getEffectiveLevel, getEffectiveRoles} from './userRoles.js';
+import {cleanText, createLimiter, inviteMessage, inviteTitle, matchPeople} from '../../plugins/_lib/call/invite.js';
+
+export const SOURCE = 'core:call-invites';
+const CONTACTS_SLUG = 'contacts-contacts';
+/** Join emails one address may be sent in an hour, whoever sends them. */
+export const EMAILS_PER_ADDRESS_HOUR = 3;
+/** Join emails the whole site may send in an hour (every call, every Tool) - a leaked host link cannot spam. */
+export const EMAILS_PER_SITE_HOUR = 30;
+
+try {
+    registerNotificationSource({id: SOURCE, owner: 'core', label: 'Call invitations', severity: 'info', defaultOn: true,
+        description: 'Someone in a video call adds a team member to it ("Add people") - told to that person, with the Join link.'});
+} catch { /* never stops the calls */ }
+
+const isActive = (u) => Boolean(u) && u.disabled !== true && u.active !== false && u.isActive !== false;
+
+/** Is this user one of the team (active, at the base user level or more senior)? */
+export function isTeamMember(u) {
+    if (!isActive(u)) return false;
+    const base = getRoleLevel('user');
+    try { return getEffectiveLevel(u) <= (Number.isFinite(base) ? base : 2); } catch { return false; }
+}
+
+/** The team, by name. */
+export async function teamMembers() {
+    return (await listUsers().catch(() => [])).filter(isTeamMember);
+}
+
+/** May this user read contacts at all (Contacts on, a role with contacts.read)? */
+function mayReadContacts(user) {
+    try {
+        const roles = getEffectiveRoles(user || {});
+        return isToolEnabled('contacts') && roles.some(r => getPermissionsFor('contacts', 'read').includes(r));
+    } catch { return false; }
+}
+
+/** The contacts this user may read, as {id, name, email} (with an email only). */
+export async function contactsOf(hostUserId) {
+    const user = hostUserId ? await getUserById(String(hostUserId)).catch(() => null) : null;
+    if (!user || !mayReadContacts(user)) return [];
+    const {entries} = await listEntries(CONTACTS_SLUG, {limit: 100000}).catch(() => ({entries: []}));
+    const withEmail = (entries || []).filter(e => String(e?.data?.email || '').includes('@'));
+    const ok = await readableContactIds(withEmail, {id: user.id, roles: getEffectiveRoles(user)});
+    return withEmail.filter(e => ok.has(e.id)).map(e => ({id: e.id, name: String(e.data?.name || '').trim(), email: String(e.data.email).trim()}));
+}
+
+/**
+ * Search: the team (not `excludeUserIds`, not the host) and the host's contacts.
+ *
+ * @param {{hostUserId?: string, q?: string, excludeUserIds?: string[], contacts?: boolean, team?: boolean, teamFilter?: (u: object) => boolean}} opts
+ */
+export async function searchInvitees({hostUserId = '', q = '', excludeUserIds = [], contacts = true, team = true, teamFilter = null} = {}) {
+    const users = team ? (await teamMembers()).filter(u => !teamFilter || teamFilter(u)) : [];
+    const known = contacts && String(q || '').trim() ? await contactsOf(hostUserId) : [];
+    return matchPeople({q, users, contacts: known, excludeUserIds: [...excludeUserIds, hostUserId].filter(Boolean),
+        canMessage: Boolean(hostUserId) && hasDirectMessenger()});
+}
+
+/**
+ * The request's people as real people: `{kind, id?, name, email, userId?}`, or `{name, error}` for someone who
+ * cannot be invited (a contact the host may not read, not a team member, an email not allowed here).
+ *
+ * @param {object[]} people - cleanInviteRequest()'s list
+ * @param {{hostUserId?: string, contacts?: boolean, team?: boolean, emails?: boolean, teamFilter?: (u: object) => boolean}} opts
+ */
+export async function resolveInvitees(people = [], {hostUserId = '', contacts = true, team = true, emails = true, teamFilter = null} = {}) {
+    const out = [];
+    let readable = null;
+    for (const p of people) {
+        if (p.kind === 'email') {
+            out.push(emails ? {kind: 'email', name: p.name, email: p.email} : {name: p.name, error: 'Only team members can be added to this call.'});
+        } else if (p.kind === 'user') {
+            const u = team ? await getUserById(p.id).catch(() => null) : null;
+            if (!u || !isTeamMember(u) || (teamFilter && !teamFilter(u)) || u.id === hostUserId) out.push({name: 'Someone', error: 'That person cannot be added.'});
+            else out.push({kind: 'user', id: u.id, name: String(u.name || '').trim() || 'Team member', email: String(u.email || '').trim()});
+        } else if (p.kind === 'contact') {
+            readable ||= contacts ? await contactsOf(hostUserId) : [];
+            const c = readable.find(x => x.id === p.id);
+            out.push(c ? {kind: 'contact', id: c.id, name: c.name || c.email.split('@')[0], email: c.email.toLowerCase()} : {name: 'Someone', error: 'That contact could not be found.'});
+        }
+    }
+    return out;
+}
+
+// ---------------------------------------------------------------------------
+// The Join email
+// ---------------------------------------------------------------------------
+
+let mailer = null;
+let transport = null;
+let transportFor = '';
+const emailsTo = createLimiter({max: EMAILS_PER_ADDRESS_HOUR, windowMs: 3600000});
+const emailsFromSite = createLimiter({max: EMAILS_PER_SITE_HOUR, windowMs: 3600000});
+
+/** Tests only: `fn(msg)` receives every message instead of SMTP. null restores. */
+export function setInviteMailer(fn) { mailer = fn; }
+/** Tests only. */
+export function resetInviteLimits() { emailsTo.reset(); emailsFromSite.reset(); }
+
+const site = () => { try { return getConfig('site') || {}; } catch { return {}; } };
+
+/** Can mail really leave this site? */
+export const inviteMailReady = () => Boolean(mailer) || isSmtpConfigured(site().smtp || {});
+
+/** The message, escaped. */
+export function composeInviteEmail({name = '', hostName = '', title = '', link = ''}) {
+    const host = cleanText(hostName, 80) || 'Someone';
+    name = cleanText(name, 120);
+    title = cleanText(title, 120);
+    const subject = `${host} is inviting you to a video call now`;
+    const lines = [`Hello${name ? ` ${name}` : ''}, ${host} is in a video call${title ? ` (${title})` : ''} and would like you to join now.`,
+        'Use the button below. You will wait a moment until you are let in. You need a camera and microphone, or you can join with just one.'];
+    const html = [...lines.map(l => `<p>${escapeHtml(l)}</p>`),
+        `<p><a href="${escapeHtml(link)}" style="display:inline-block;padding:10px 18px;background:#2563eb;color:#fff;border-radius:6px;text-decoration:none">Join the call</a></p>`,
+        `<p style="color:#666;font-size:13px">Or paste this into your browser: ${escapeHtml(link)}</p>`].join('\n');
+    return {subject, html, text: [...lines, `Join the call: ${link}`].join('\n\n')};
+}
+
+/** Send it. Never throws; true only when it left. */
+export async function sendInviteEmail({to, name, hostName, title, link}, {log} = {}) {
+    try {
+        if (!to || !link) return false;
+        const msg = {to, ...composeInviteEmail({name, hostName, title, link})};
+        if (mailer) { await mailer(msg); return true; }
+        const s = site();
+        const smtp = s.smtp || {};
+        if (!isSmtpConfigured(smtp)) return false;
+        const k = JSON.stringify([smtp.host, smtp.port, smtp.user, smtp.secure]);
+        if (!transport || transportFor !== k) { transport = await createTransport(smtp); transportFor = k; }
+        await sendEmail(transport, {from: smtp.fromAddress || 'noreply@example.com', fromName: smtp.fromName || s.title || 'Calls', ...msg});
+        return true;
+    } catch (err) {
+        try { (log?.error || console.error).call(log || console, `[calls] Invitation to ${to} not sent: ${err?.message || err}`); } catch { /* never */ }
+        return false;
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Sending
+// ---------------------------------------------------------------------------
+
+/**
+ * Tell each person. `linkFor(target)` is their Join link (absolute). Resolves to one result per target:
+ * `{name, emailed, notified, messaged, error?}` - `error` says why nothing reached them.
+ *
+ * @param {object[]} targets - resolveInvitees()'s list
+ * @param {{linkFor: (t: object) => string|Promise<string>, hostName?: string, hostUserId?: string, title?: string,
+ *   via?: {email?: boolean, notify?: boolean, message?: boolean}, key?: string, expiresAt?: string, log?: object,
+ *   deps?: {notify?: Function, sendDirectMessage?: Function}}} opts - `key`: the call, for the notification's dedupeKey
+ */
+export async function deliverInvites(targets = [], {linkFor, hostName = '', hostUserId = '', title = '', via = {}, key = '', expiresAt, log, deps = {}} = {}) {
+    const raise = deps.notify || notify;
+    const dm = deps.sendDirectMessage || sendDirectMessage;
+    const results = [];
+    for (const t of targets) {
+        if (t.error) { results.push({name: t.name, emailed: false, notified: false, messaged: false, error: t.error}); continue; }
+        const r = {name: t.name, emailed: false, notified: false, messaged: false};
+        let link = '';
+        try { link = await linkFor(t); } catch { link = ''; }
+        if (!link) { results.push({...r, error: 'No link could be made for them.'}); continue; }
+        const why = [];
+        if (via.email && t.email) {
+            if (!inviteMailReady()) why.push('email is not set up on this site');
+            else if (!emailsTo.take(t.email)) why.push('they have been emailed several times this hour');
+            else if (!emailsFromSite.take('site')) why.push('this site has sent a lot of call invitations this hour');
+            else if (!(r.emailed = await sendInviteEmail({to: t.email, name: t.name, hostName, title, link}, {log}))) why.push('the email could not be sent');
+        }
+        if (t.kind === 'user') {
+            if (via.notify) {
+                try {
+                    r.notified = Boolean(await raise({title: inviteTitle(hostName), body: title ? `Video call: ${title}` : 'A video call, now.', severity: 'info', link,
+                        source: SOURCE, dedupeKey: `call-invite:${key}:${t.id}`.slice(0, 200), audience: {userIds: [t.id]},
+                        expiresAt: expiresAt || new Date(Date.now() + 3 * 3600e3).toISOString()}));
+                } catch { r.notified = false; }
+                if (!r.notified) why.push('the notification was not raised');
+            }
+            if (via.message) {
+                if (!hostUserId) why.push('a message needs a host who is a team member');
+                else if (!hasDirectMessenger() && !deps.sendDirectMessage) why.push('Messages is not on');
+                else {
+                    let out = null;
+                    try { out = await dm({fromUserId: hostUserId, toUserId: t.id, text: inviteMessage(hostName, title, link)}); } catch { out = null; }
+                    r.messaged = out === true || out?.sent === true;
+                    if (!r.messaged) why.push(`no message: ${out?.reason || 'it could not be sent'}`);
+                }
+            }
+        }
+        if (!r.emailed && !r.notified && !r.messaged) r.error = why.length ? `Not reached: ${why.join('; ')}.` : 'Nothing was sent - copy the link and pass it on.';
+        results.push(r);
+    }
+    return results;
+}
+
+/**
+ * The origin Join links are built on: the site's configured `baseUrl` whenever there is one (links in emails
+ * and notices must never follow a Host header), else the request's own origin.
+ */
+export function inviteOrigin(request) {
+    const base = String(site().baseUrl || '').trim();
+    if (/^https?:\/\/[^/\s]+/i.test(base)) return base.replace(/\/+$/, '');
+    if (!request) return '';
+    return `${request.protocol}://${request.host || request.headers?.host || request.hostname}`;
+}

package/server/services/hooks.js

@@ -404,6 +404,61 @@ export async function readableContactIds(entries, viewer) {
   return out;
 }
 
+// ---------------------------------------------------------------------------
+// 7c. Direct messages - one team member writing to another (Messages)
+// ---------------------------------------------------------------------------
+//
+// Core has no messaging of its own. A Tool that has it (Messages) registers a
+// messenger, and core code - a call's "Add people" (services/callInvites.js) -
+// sends a direct message from one user to another through it, without knowing
+// the Tool. No messenger (Messages off or absent): sendDirectMessage answers
+// false and the caller carries on without it.
+
+const _messengers = new Map(); // owner -> fn({fromUserId, toUserId, text}) => Promise<boolean | {sent, reason}>
+
+/**
+ * @param {string} owner - the plugin
+ * @param {(msg: {fromUserId: string, toUserId: string, text: string}) => Promise<boolean|{sent: boolean, reason?: string}>} fn
+ *   post `text` from `fromUserId` to `toUserId` in their direct conversation (made when there is none), by the
+ *   Tool's OWN rules (who may message whom): true / {sent: true} when posted, else false or {sent: false, reason}
+ */
+export function registerDirectMessenger(owner, fn) {
+  if (typeof owner !== 'string' || !owner || typeof fn !== 'function') return false;
+  _messengers.set(owner, fn);
+  return true;
+}
+
+/** @param {string} owner */
+export function unregisterDirectMessenger(owner) {
+  _messengers.delete(owner);
+}
+
+/** Is there a Tool that can send a direct message? */
+export const hasDirectMessenger = () => _messengers.size > 0;
+
+/**
+ * Send a direct message through the registered messenger. Never throws.
+ *
+ * @param {{fromUserId: string, toUserId: string, text: string}} msg
+ * @returns {Promise<{sent: boolean, reason?: string}>} sent when a messenger posted it; else why not
+ */
+export async function sendDirectMessage({fromUserId, toUserId, text} = {}) {
+  const from = String(fromUserId || '');
+  const to = String(toUserId || '');
+  const body = String(text || '').trim().slice(0, 4000);
+  if (!from || !to || from === to || !body) return {sent: false, reason: 'nobody to send it to'};
+  if (!_messengers.size) return {sent: false, reason: 'Messages is not on'};
+  let reason = 'the message could not be sent';
+  for (const fn of _messengers.values()) {
+    try {
+      const out = await fn({fromUserId: from, toUserId: to, text: body});
+      if (out === true || out?.sent === true) return {sent: true};
+      if (out?.reason) reason = String(out.reason).slice(0, 200);
+    } catch { /* a failing messenger sends nothing */ }
+  }
+  return {sent: false, reason};
+}
+
 // ---------------------------------------------------------------------------
 // 8. Sitemap sources (0.89) - URLs a plugin serves, in /sitemap.xml
 // ---------------------------------------------------------------------------

package/server/services/instantCalls.js

@@ -19,7 +19,10 @@
  * actions and list stand aside (checked per request), so nobody sees two.
  *
  * A record: {id, name, email, contactId, hostId, hostName, token, hostKey,
- * createdAt, expiresAt, chat?}. `chat` is the call's chat, saved against the
+ * createdAt, expiresAt, chat?, inviteKey?}. `inviteKey` (made on the first "Add
+ * people", `inviteKeyOf`) signs the passes of people added to the call
+ * (`?g=<pass>`, _lib/call/invite.js) - never the guest's token, which carries
+ * the guest's name and place. `chat` is the call's chat, saved against the
  * call (the engine's items - typed messages plus joined/left lines - the last
  * CHAT_MAX); the engine seeds a reopened room from it, and the host (or an
  * admin) reads it afterwards through GET /api/calls/:id/chat. Kept in memory and in one JSON file with the sign-in
@@ -43,6 +46,7 @@ import {hasRelatedProvider, registerRelatedItems, unregisterRelatedItems} from '
 import {getPermissionsFor} from './roles.js';
 import {getEffectiveRoles} from './userRoles.js';
 import {createTransport, escapeHtml, isSmtpConfigured, sendEmail} from './email.js';
+import {checkInvitePass, invitePass, newInviteKey} from '../../plugins/_lib/call/invite.js';
 
 export const INSTANT_HOURS = 3;
 export const KEEP_DAYS = 30;
@@ -244,6 +248,25 @@ export async function getCall(id) {
     return (await load()).get(id) || null;
 }
 
+/** The call's invite key, made (and stored) the first time someone is added to it. Null for no such call. */
+export async function inviteKeyOf(id) {
+    if (typeof id !== 'string' || !ID_RE.test(id)) return null;
+    const all = await load();
+    const rec = all.get(id);
+    if (!rec) return null;
+    if (!rec.inviteKey) {
+        rec.inviteKey = newInviteKey();
+        await save(all);
+    }
+    return rec.inviteKey;
+}
+
+/** A new Join link (relative) for someone added to the call: `?g=<pass>`. */
+export async function invitePath(id) {
+    const k = await inviteKeyOf(id);
+    return k ? `${CALL_PATH}/${encodeURIComponent(id)}?g=${encodeURIComponent(invitePass(k, id))}` : '';
+}
+
 /** The chat item as it is kept on a record; null for junk. System lines other than joined/left are not kept. */
 function chatItem(raw) {
     if (!raw || typeof raw !== 'object' || typeof raw.text !== 'string' || !raw.id) return null;
@@ -299,8 +322,10 @@ const same = (a, b) => {
 
 /**
  * Who the caller is in an instant call, or null (the engine answers 404).
- * `cred` is what the link carried: {t} for the guest, {h} for the host. The
- * engine answers 410 once `closesAt` has passed.
+ * `cred` is what the link carried: {t} for the guest, {h} for the host, {g}
+ * for someone added to the call (a pass under `inviteKey`: they give their own
+ * name and knock; each pass is its own identity). The engine answers 410 once
+ * `closesAt` has passed.
  */
 export function whoIsCalling(rec, cred = {}) {
     if (!rec) return null;
@@ -314,6 +339,8 @@ export function whoIsCalling(rec, cred = {}) {
     if (cred.t && same(cred.t, rec.token)) {
         return {...base, host: false, name: rec.name || '', identity: `${rec.id}:guest`};
     }
+    const nonce = cred.g && rec.inviteKey ? checkInvitePass(rec.inviteKey, rec.id, cred.g) : null;
+    if (nonce) return {...base, host: false, name: '', identity: `${rec.id}:inv:${nonce}`, invited: true};
     return null;
 }
 

package/server/services/plugins.js

@@ -28,6 +28,8 @@ import {
     registerComponent,
     registerContactAccess,
     unregisterContactAccess,
+    registerDirectMessenger,
+    unregisterDirectMessenger,
     registerSidebarItem,
     registerTransform
 } from './hooks.js';
@@ -559,7 +561,9 @@ export async function registerPlugins(fastify) {
                   // loads under a licence may.
                   enableInstantCalls: () => enableInstantCalls({owner: manifest.name, tier: manifest.tier || 'free', closedSource: manifest.closedSource === true}),
                   // Who may read a contact that is not their own (Contacts Pro's sharing) - hooks.js 7b.
-                  registerContactAccess: (fn) => registerContactAccess(manifest.name, fn)},
+                  registerContactAccess: (fn) => registerContactAccess(manifest.name, fn),
+                  // Direct messages between team members (Messages) - hooks.js 7c; a call's "Add people" uses it.
+                  registerDirectMessenger: (fn) => registerDirectMessenger(manifest.name, fn)},
               settings,
               config: {}
           });
@@ -1120,6 +1124,7 @@ export async function runLifecycleHook(name, hook, fastify) {
     if (hook === 'onDisable') {
         disableInstantCalls(name);
         unregisterContactAccess(name);
+        unregisterDirectMessenger(name);
     }
 
     const pluginJsPath = path.join(PLUGINS_DIR, name, 'plugin.js');