domma-cms 0.109.1 → 0.109.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "0.109.1",
+  "version": "0.109.3",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/plugins/_lib/admin/mail/reader-view.js

@@ -34,6 +34,7 @@ const {
     unreadInSubtree
 } = await import(versioned('folder-tree.js'));
 const {imageSendersSection} = await import(versioned('image-senders-section.js'));
+const {createSettingsSection, READ_DELAY_KEY, readDelaySeconds, scheduleMarkRead} = await import(versioned('settings-section.js'));
 const {createSplitters, fitToViewport} = await import(versioned('panes.js'));
 const {createDiagnosticsSection} = await import(versioned('diagnostics-section.js'));
 const {fmtDate, fmtDateTime} = await import(new URL(`../ui/dates.js?v=${ASSET_VERSION}`, import.meta.url).href);
@@ -184,7 +185,6 @@ const THREADS_KEY = 'domma-mail.threads';
  * Long enough that arrowing through a list does not mark everything it passed
  * over, short enough that actually reading something always marks it.
  */
-const MARK_READ_DELAY_MS = 1000;
 
 /** How long the undo strip stays on screen. */
 const UNDO_WINDOW_MS = 12_000;
@@ -740,6 +740,14 @@ return {
             });
 
             const sections = [
+                createSettingsSection({
+                    canWrite: features.write,
+                    load: () => readDelaySeconds(S.get(READ_DELAY_KEY)),
+                    save: seconds => {
+                        S.set(READ_DELAY_KEY, seconds);
+                        cancelMarkRead();
+                    }
+                }),
                 {
                     id: 'mailboxes',
                     label: 'Mailboxes',
@@ -2126,10 +2134,8 @@ return {
                 const message = await api(`${BASE}/messages/${uid}?${params}`);
                 renderMessage(message);
 
-                // Opening mail marks it read after a pause, not instantly.
-                // Arrowing through a list would otherwise mark everything it
-                // passed over, and the delay is the difference between reading
-                // something and glancing at it.
+                // The reading preference controls how long mail stays open
+                // before marking it read; zero applies the flag immediately.
                 //
                 // Only where the edition can write at all: the free reader's
                 // guarantee is that looking at mail never changes it, and that
@@ -2137,14 +2143,14 @@ return {
                 const row = messages.find(m => m.uid === uid);
                 if (features.write && row && row.seen === false) {
                     const forFolder = openFolder;
-                    markReadTimer = setTimeout(() => {
+                    markReadTimer = scheduleMarkRead(() => {
                         markReadTimer = null;
                         // Still the message on screen? If the user moved on
                         // during the pause, they did not read this one.
                         if (selectedUid$.value !== uid) return;
                         changeFlags({...message, folder: forFolder}, {add: ['\\Seen']})
                             .catch(() => {/* not worth interrupting a read for */});
-                    }, MARK_READ_DELAY_MS);
+                    }, readDelaySeconds(S.get(READ_DELAY_KEY)));
                 }
             } catch (err) {
                 handleError(err);

package/plugins/_lib/admin/mail/settings-section.js

@@ -0,0 +1,60 @@
+/** Browser preferences for the shared mail reader. */
+export const READ_DELAY_KEY = 'domma-mail.mark-read-seconds';
+export const DEFAULT_READ_DELAY_SECONDS = 1;
+
+export function readDelaySeconds(value) {
+    if (value === null || value === undefined || value === '') return DEFAULT_READ_DELAY_SECONDS;
+    const seconds = Number(value);
+    return Number.isFinite(seconds) && seconds >= 0 && seconds <= 2147483
+        ? seconds : DEFAULT_READ_DELAY_SECONDS;
+}
+
+export function scheduleMarkRead(markRead, seconds, schedule = setTimeout) {
+    const delay = readDelaySeconds(seconds);
+    if (delay === 0) {
+        markRead();
+        return null;
+    }
+    return schedule(markRead, delay * 1000);
+}
+
+export function createSettingsSection({canWrite, load, save}) {
+    return {
+        id: 'settings',
+        label: 'Settings',
+        help: 'Preferences for reading email in this browser.',
+        async render(container, ctx) {
+            const kit = await import(new URL(`./section-kit.js?v=${ctx.assetVersion ?? '1'}`, import.meta.url).href);
+            kit.note(container, 'Settings are saved in this browser and apply to all your mailboxes.');
+            if (!canWrite) {
+                kit.note(container, 'This reader leaves messages unread. Automatic marking as read requires an edition that can update messages.');
+                return;
+            }
+            const {state} = kit.formIn(container, {
+                markReadSeconds: {
+                    type: 'number',
+                    label: 'How long before a message is marked as read? (seconds)',
+                    required: true,
+                    min: 0,
+                    max: 2147483,
+                    formConfig: {hint: '0 marks a message as read immediately. Otherwise, it must stay open for this long.'}
+                }
+            }, {markReadSeconds: load()});
+            const bar = kit.actionBar(container);
+            kit.button(bar.row, 'Save', () => {
+                const value = state.markReadSeconds;
+                const seconds = Number(value);
+                if (value === '' || value === null || value === undefined || !Number.isFinite(seconds) || seconds < 0 || seconds > 2147483) {
+                    bar.say('Enter a number of seconds between 0 and 2147483.', 'bad');
+                    return;
+                }
+                try {
+                    save(seconds);
+                    bar.say('Saved.', 'ok');
+                } catch (err) {
+                    bar.say(err.message || 'Settings could not be saved.', 'bad');
+                }
+            }, {variant: 'primary'});
+        }
+    };
+}

package/server/server.js

@@ -29,7 +29,8 @@ import {seedDefaultBlocks} from './services/blocks.js';
 import {seedDefaultComponents} from './services/components.js';
 import {refreshComponentTagAllowlist} from './services/markdown.js';
 import * as cache from './services/cache/index.js';
-import {isGenuinelyLocal, parseTrustProxy} from './services/network.js';
+import {parseTrustProxy} from './services/network.js';
+import {rateLimitOptions} from './services/rate-limit.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(__dirname, '..');
@@ -148,15 +149,7 @@ if (publicCorsPrefixes.length) {
     app.log.info(`[cors] open reads on ${publicCorsPrefixes.join(', ')}`);
 }
 await app.register(multipart, { limits: { fileSize: serverConfig.uploads.maxFileSize } });
-await app.register(rateLimit, {
-    global: true, // apply default limit to all routes; stricter per-route limits override this
-    max: 500,
-    timeWindow: '1 minute',
-    // Only a genuinely local call is exempt (loopback socket, no X-Forwarded-For).
-    // A static loopback list exempted every visitor relayed by a proxy that is
-    // not trusted - on dcm, everyone, the login included. See services/network.js.
-    allowList: (request) => isGenuinelyLocal(request),
-});
+await app.register(rateLimit, rateLimitOptions());
 
 // Negotiates brotli/gzip/deflate per Accept-Encoding. Skips already-compressed
 // content types (images, fonts, video) and responses under threshold.
@@ -744,4 +737,3 @@ try {
     process.exit(1);
 }
 // scaffold-restart 1779615684
-

package/server/services/rate-limit.js

@@ -0,0 +1,37 @@
+import {isGenuinelyLocal} from './network.js';
+
+/** Browser assets should never spend the API's request budget. */
+export function isBrowserAsset(request) {
+    if (!['GET', 'HEAD'].includes(request.method)) return false;
+    const path = request.url.split('?')[0];
+    return /^\/(?:admin|plugins|dist|public)\//.test(path)
+        && /\.(?:m?js|css|map|png|jpe?g|gif|webp|avif|svg|ico|woff2?|ttf|otf|html)$/i.test(path);
+}
+
+export function rateLimitOptions({publicMax = 500, authenticatedMax = 3000} = {}) {
+    // Keep verified identities separate from public IP buckets. A supplied
+    // bearer string alone is never enough to receive the larger allowance.
+    const identities = new WeakMap();
+    return {
+        global: true,
+        timeWindow: '1 minute',
+        async keyGenerator(request) {
+            // Explicit route limits retain their original IP-based buckets,
+            // even when the caller also holds a valid access token.
+            if (request.routeOptions.config.rateLimit) return request.ip;
+            if (request.url.startsWith('/api/') && request.headers.authorization) {
+                try {
+                    const user = await request.jwtVerify();
+                    if (user.type === 'access' && user.id) {
+                        identities.set(request, user.id);
+                        return `user:${user.id}`;
+                    }
+                } catch { /* invalid tokens retain the public limit */ }
+            }
+            return request.ip;
+        },
+        max: request => identities.has(request) ? authenticatedMax : publicMax,
+        allowList: request => isGenuinelyLocal(request)
+            || (!request.routeOptions.config.rateLimit && isBrowserAsset(request))
+    };
+}