domma-cms 0.115.2 → 0.115.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "0.115.2",
+  "version": "0.115.4",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/plugins/free-tier.lock.json

@@ -1,6 +1,6 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@26a9062",
+  "source": "dcms-marketplace@33c799d",
   "plugins": {
     "blog": {
       "version": "1.9.4",
@@ -224,25 +224,25 @@
       }
     },
     "support": {
-      "version": "1.0.0",
+      "version": "1.0.2",
       "files": {
         "CLAUDE.md": "a54f3af90bc273622e67d0da0502da39a9e0962633d43d82eebf1228cf996f79",
         "admin/css/index.css": "43a792dbc08acafc9f79757ac96c3675a49abb39aab05a553c6871f6f2050a1e",
         "admin/lib/kit.js": "bc52d8dfe031b470b49c51e7170d46689a6b2892871e53ec0d6a44f37a91afc1",
         "admin/templates/support.html": "2bb69d0443a367a402e6160fe68f4af3e8983b578cfff9575b4df9a534fcb480",
         "admin/views/desk.js": "f0770c750dd340b83438c8f41b222b814c0937081201cb06b851a3fdea2952fd",
-        "admin/views/inbox.js": "fac961363a827ce5139689464a6b9a65c685752b0771f4bf956fb1dcd8d95ccb",
-        "admin/views/support.js": "448595a7087f7cff633bf5844755a931d1ca461af1c418f275dadb97673502dc",
+        "admin/views/inbox.js": "53321d9efba883b7fb2b26fcfe72e902f484b9cb1eb85eb0e043b228a7035252",
+        "admin/views/support.js": "f5621fd99782e40d9faeeddf187c5c8b0412ee621ab53f03fb96d60b3f144478",
         "collections/support-tickets.json": "aa1e6b4814fdfbbcd46d097edd93dfb838cc49f5232a86ba76b54c9b29d82ac5",
-        "config.js": "07a72a5c7900d5eb3e2464f7f58b316fd2217f41f57fdad43ce917fe2da80b82",
-        "lib/mail.js": "4365511b2c3ab93bbe6e2635e4e2ebe39eb841f968a836507331b426ab6f4c1c",
+        "config.js": "eb7ccc1169fa8b2be52a213536825492fedaec5fa73fd749cba9f498dd54b503",
+        "lib/mail.js": "d14aae3a59aad6af61451863cdaaf94fc4a87810b16e1dcb9c655dda6c803b3b",
         "lib/receiver.js": "ef958be2a8fadcec10169ff76f10404d395f9c6b401a51642ede9218547d6262",
         "lib/sender.js": "71e9146729e443df401a1b84e9778e9243d057012462e48a05e32a73f7309aa2",
         "lib/shape.js": "7bef95c823ee4c6d4041152a58fdb2279dbe6797710a89e1339f8aca60cd0f89",
-        "plugin.js": "50db3f804ad987490d322c265be0d00e11202af265c5067b20816defa6ff990d",
-        "plugin.json": "75d1eaf11416b855e5255ae565781f2f7c144b42384362cd0f00f7da85f046ab",
-        "tests/api.test.js": "57a00bd19ba3569246f0841d8fb8f3d488fcf420c4c0556bfe07331576d74cf5",
-        "tests/shape.test.js": "cd7c44c8e2f676734c90044f25acc0583ab6074c1661cce05103fd0cbe307796"
+        "plugin.js": "7ff5ec08e469cc14aabca09c560d53d57d8c406eff44937c5464f8b60ae3b88f",
+        "plugin.json": "f41c2b77ab2f8986a67912c219b3a137af7fa500b5017d89ba43324a970d9508",
+        "tests/api.test.js": "c9483f1583d4449c6cb28624455b727e781063033878a79bd569162110980d36",
+        "tests/shape.test.js": "6d7b7a23dcb1933e4ed6e2f4b9fce2bf0b50125073f6ec60d15d6f2e6d7f8aa1"
       }
     }
   }

package/plugins/support/admin/views/inbox.js

@@ -101,10 +101,14 @@ export async function mount(root, ctx) {
     const replace = (t) => { tickets.value = tickets.peek().map(x => (x.id === t.id ? {...x, ...t} : x)); refreshBadge(); };
 
     async function open(tid) {
-        let t = byId(tid);
-        if (!t) {
-            try { t = await api.ticket(tid); } catch { E.toast('That request is no longer here.', {type: 'warning'}); return; }
-        }
+        // Read fresh: the panel shows where a reply will be emailed, which only the detail route works out.
+        let t;
+        try { t = await api.ticket(tid); } catch { t = byId(tid); }
+        if (!t) { E.toast('That request is no longer here.', {type: 'warning'}); return; }
+        const rt = t.replyTo || {email: t.userEmail || '', source: t.userEmail ? 'profile' : 'none'};
+        const replyNote = rt.source === 'registration' ? `Replies are emailed to ${rt.email} - the address the site was bought with.`
+            : rt.source === 'profile' ? `Replies are emailed to ${rt.email} - from the requester's profile on their site (this site was not bought through Customers).`
+                : 'This customer has no email on record - replies show only in their admin.';
         const draft = M.observable('');
         const after = M.observable('answered');
         const notes = M.observable(t.notes || '');
@@ -145,7 +149,8 @@ export async function mount(root, ctx) {
   </dl>
   <div class="sp-thread-host"></div>
   <div class="sp-reply">
-    <label class="form-label" for="sp-answer">Reply <span data-help="The customer sees it in their admin and gets it by email${t.userEmail ? '' : ' (this one has no email on record, so only in their admin)'}."></span></label>
+    <label class="form-label" for="sp-answer">Reply <span data-help="The customer sees it in their admin and gets it by email."></span></label>
+    <p class="sp-note sp-small">${esc(replyNote)}</p>
     <textarea id="sp-answer" class="form-textarea" rows="5" maxlength="8000" data-model="draft.value" placeholder="Write to ${esc(t.userName || 'the customer')}"></textarea>
     <div class="sp-actions">
       <label class="sp-inline">Then <select class="form-select" data-model="after.value"><option value="answered">wait for them</option><option value="closed">mark resolved</option></select></label>
@@ -171,7 +176,7 @@ export async function mount(root, ctx) {
                     const next = await api.reply(tid, {body: draft.peek(), status: after.peek()});
                     replace(next);
                     draft.value = '';
-                    E.toast(t.userEmail ? `Sent - ${t.userName || 'the customer'} has been emailed.` : 'Sent - it shows in their admin.', {type: 'success'});
+                    E.toast(rt.email ? `Sent - emailed to ${rt.email}.` : 'Sent - it shows in their admin.', {type: 'success'});
                 }),
                 resolve: () => run(async () => { replace(await api.reply(tid, {status: 'closed'})); E.toast('Resolved.', {type: 'success'}); }),
                 reopen: () => run(async () => { replace(await api.update(tid, {status: 'open'})); }),

package/plugins/support/admin/views/support.js

@@ -46,7 +46,7 @@ export const supportView = {
         try {
             [mode, meta] = await Promise.all([api.mode(), api.meta()]);
         } catch (err) {
-            fail(`Support could not load: ${err.message || err}. You can always email support@dommajs.org.`);
+            fail(`Support could not load: ${err.message || err}. You can always email support@domma-cms.com.`);
             return;
         }
         if (!here()) return;

package/plugins/support/config.js

@@ -17,12 +17,12 @@
  *   perSiteMinutes the window for perSiteMax
  */
 export default {
-    email: 'support@dommajs.org',
+    email: 'support@domma-cms.com',
     phone: '',
     hours: 'Monday to Friday, 9am to 5pm (UK time)',
     responseTime: 'We answer within one working day, and urgent requests first.',
     syncMinutes: 5,
-    notifyEmail: 'support@dommajs.org',
+    notifyEmail: 'support@domma-cms.com',
     perSiteMax: 20,
     perSiteMinutes: 10
 };

package/plugins/support/lib/mail.js

@@ -31,7 +31,7 @@ export function siteUrl() {
  * must never fail the request that caused it, and callers do not await it - an
  * unhandled rejection stops the whole server.
  *
- * @param {{to: string, subject: string, html: string, text: string, replyTo?: string}} msg
+ * @param {{to: string, subject: string, html: string, text: string, replyTo?: string, from?: string}} msg
  * @returns {Promise<boolean>}
  */
 export async function send(msg, {log} = {}) {
@@ -44,7 +44,8 @@ export async function send(msg, {log} = {}) {
         const key = JSON.stringify([smtp.host, smtp.port, smtp.user, smtp.secure]);
         if (!transport || transportFor !== key) { transport = await createTransport(smtp); transportFor = key; }
         await sendEmail(transport, {
-            from: smtp.fromAddress || 'noreply@example.com',
+            // `msg.from`: the support mailbox, for mail TO a customer (a reply then reaches it).
+            from: msg.from || smtp.fromAddress || 'noreply@example.com',
             fromName: 'Domma Support',
             to: msg.to, subject: msg.subject, html: msg.html, text: msg.text,
             ...(msg.replyTo && {replyTo: msg.replyTo})

package/plugins/support/plugin.js

@@ -221,6 +221,21 @@ async function receiverRoutes(fastify, {can, notify, mail, receiverMod, settings
     try { await rx.ensureCollection(); } catch (err) { log.error(`[support] collection: ${err.message}`); }
 
     const siteOf = (slug) => directory()[slug] || {name: slug, host: ''};
+    /**
+     * Where Domma's replies to a site's request are emailed. A site that was BOUGHT has an owner on
+     * the manager (Customer Registration's ownerEmail service): that address, which only Domma and the
+     * owner's Manage-my-site link can change. Otherwise - a site made by hand - the email on the
+     * requester's profile, which that site's own admin controls.
+     */
+    const OWNER_KEY = Symbol.for('domma.customer-registration');
+    const ownerLookup = options.ownerEmail
+        || (async (slug) => (globalThis[OWNER_KEY]?.version >= 1 ? globalThis[OWNER_KEY].services.ownerEmail(slug) : null));
+    async function replyTarget(d) {
+        let owner = null;
+        try { owner = await ownerLookup(d.site); } catch { /* no registration service */ }
+        if (owner && /^[^\s@<>"]+@[^\s@<>"]+\.[^\s@<>"]+$/.test(owner)) return {email: owner, source: 'registration'};
+        return {email: d.userEmail || '', source: d.userEmail ? 'profile' : 'none'};
+    }
     const inboxLink = (id) => `${mail.siteUrl()}/admin/#/plugins/support/${encodeURIComponent(id)}`;
     const siteLink = (slug, ref) => {
         const host = siteOf(slug).host;
@@ -280,6 +295,8 @@ async function receiverRoutes(fastify, {can, notify, mail, receiverMod, settings
 
     const row = (e, dir = directory()) => ({id: e.id, ...e.data, siteName: dir[e.data.site]?.name || e.data.site,
         siteHost: dir[e.data.site]?.host || '', createdAt: e.meta?.createdAt, updatedAt: e.meta?.updatedAt});
+    /** One request for the panel: plus where a reply will be emailed, and why. */
+    const detail = async (e) => ({...row(e), replyTo: await replyTarget(e.data)});
 
     fastify.get('/mode', can('manage'), async () => ({mode: 'receiver', connected: true, contact: contactCard(settings),
         notifyEmail: settings.notifyEmail || ''}));
@@ -312,7 +329,7 @@ async function receiverRoutes(fastify, {can, notify, mail, receiverMod, settings
     fastify.get('/tickets/:id', can('manage'), async (request, reply) => {
         const e = await rx.getTicket(request.params.id);
         if (!e) return reply.code(404).send({error: 'No such request.'});
-        return row(e);
+        return detail(e);
     });
 
     fastify.post('/tickets/:id/reply', {...can('manage'), bodyLimit: 32 * 1024}, async (request, reply) => {
@@ -326,11 +343,14 @@ async function receiverRoutes(fastify, {can, notify, mail, receiverMod, settings
         const next = await rx.dommaTurn(e.id, {body, status, by, msgId: randomUUID()});
         const d = next.data;
         // The customer hears of a reply, and of their request being resolved - not of a quiet status change back to open.
-        if (d.userEmail && (body || (d.status === 'closed' && e.data.status !== 'closed'))) {
-            mail.send({to: d.userEmail, ...toCustomerEmail({ticket: d, siteName: siteOf(d.site).name, link: siteLink(d.site, d.ref), body,
-                resolved: d.status === 'closed'})}, {log});
+        const target = await replyTarget(d);
+        if (target.email && (body || (d.status === 'closed' && e.data.status !== 'closed'))) {
+            // From the support mailbox and replying to it: a customer who answers the email reaches Domma Support.
+            const support = contactCard(settings).email;
+            mail.send({to: target.email, ...(support && {from: support, replyTo: support}),
+                ...toCustomerEmail({ticket: d, siteName: siteOf(d.site).name, link: siteLink(d.site, d.ref), body, resolved: d.status === 'closed'})}, {log});
         }
-        return row(next);
+        return detail(next);
     });
 
     fastify.put('/tickets/:id', can('manage'), async (request, reply) => {

package/plugins/support/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "support",
   "displayName": "Support",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "tier": "free",
   "description": "Get help from Domma straight from your admin: our email, phone and hours always to hand, and a conversation with the Domma team for anything you need - urgent requests first.",
   "author": "Domma CMS",
@@ -15,14 +15,26 @@
       "icon": "headphones",
       "description": "Ask Domma for help and follow the conversation (send). On the Domma server itself: the inbox of every site's requests (manage).",
       "actions": [
-        {"key": "send", "label": "Send", "description": "Ask Domma for help and read this site's requests and replies"},
-        {"key": "manage", "label": "Manage", "description": "On the Domma server: read and answer every site's requests"}
+        {
+          "key": "send",
+          "label": "Send",
+          "description": "Ask Domma for help and read this site's requests and replies"
+        },
+        {
+          "key": "manage",
+          "label": "Manage",
+          "description": "On the Domma server: read and answer every site's requests"
+        }
       ],
-      "grant": ["admin"]
+      "grant": [
+        "admin"
+      ]
     }
   ],
   "admin": {
-    "css": ["admin/css/index.css"],
+    "css": [
+      "admin/css/index.css"
+    ],
     "sidebar": [
       {
         "id": "support",
@@ -35,8 +47,16 @@
       }
     ],
     "routes": [
-      {"path": "/plugins/support", "view": "plugin-support", "title": "Support - Domma CMS"},
-      {"path": "/plugins/support/:id", "view": "plugin-support", "title": "Support - Domma CMS"}
+      {
+        "path": "/plugins/support",
+        "view": "plugin-support",
+        "title": "Support - Domma CMS"
+      },
+      {
+        "path": "/plugins/support/:id",
+        "view": "plugin-support",
+        "title": "Support - Domma CMS"
+      }
     ],
     "views": {
       "plugin-support": {

package/plugins/support/tests/api.test.js

@@ -60,7 +60,9 @@ before(async () => {
     manager = Fastify();
     await manager.register(support, {
         auth: {authenticate: async (req) => { req.user = {id: 'v1', name: 'Darryl'}; }, requirePermission: () => async () => {}},
-        prefix: '/api/plugins/support', mode: 'receiver', mail, dataDir: await fs.mkdtemp(path.join(dataDir, 'manager-')),
+        prefix: '/api/plugins/support', mode: 'receiver', mail,
+        // acme was bought (an owner on the manager); beta was made by hand.
+        ownerEmail: async (slug) => (slug === 'acme' ? 'owner@acme.test' : null), dataDir: await fs.mkdtemp(path.join(dataDir, 'manager-')),
         settings: {perSiteMax: 30, perSiteMinutes: 10, phone: '+44 1234 567890', hours: 'Always', notifyEmail: 'support@dommajs.test'},
         slugFromToken: async (h) => TOKENS[String(h || '').replace(/^Bearer\s+/i, '')] || null,
         siteDirectory: () => SITES,
@@ -106,8 +108,11 @@ test('Domma replies: the customer is emailed a link to their own admin, and the
     mails.length = 0;
     const r = await call(manager, 'POST', `/api/plugins/support/tickets/${t.id}/reply`, {body: 'Pages > New page.'});
     assert.equal(r.body.status, 'answered');
-    const toAnn = mails.find(x => x.to === 'ann@acme.test');
+    assert.ok(!mails.some(x => x.to === 'ann@acme.test'), 'not the profile email: acme was bought');
+    const toAnn = mails.find(x => x.to === 'owner@acme.test');
     assert.equal(toAnn.subject, 'Re: How do I add a page?');
+    assert.equal(toAnn.from, 'support@domma-cms.com', 'from the support mailbox');
+    assert.equal(toAnn.replyTo, 'support@domma-cms.com', 'so answering the email reaches support');
     assert.ok(toAnn.text.includes(`https://acme.example.test/admin/#/plugins/support/${s.ref}`));
 
     const list = await call(acme, 'GET', '/tickets');
@@ -179,7 +184,7 @@ test('the contact card: the manager\'s reaches every site; a standalone site sti
     const alone = await site({env: {}});
     const mode = (await call(alone, 'GET', '/mode')).body;
     assert.equal(mode.connected, false);
-    assert.equal(mode.contact.email, 'support@dommajs.org');
+    assert.equal(mode.contact.email, 'support@domma-cms.com');
     assert.equal((await call(alone, 'POST', '/tickets', {subject: 's', body: 'b'})).status, 409);
 });
 
@@ -263,3 +268,20 @@ test('review: a manager that never answers does not hang the screen', async () =
         assert.equal(s.body.state, 'waiting');
     } finally { hang = false; }
 });
+
+test('replies go to the address a site was bought with; a hand-made site falls back to the profile', async () => {
+    const acme = await site({token: 'tok-acme'});
+    const beta = await site({token: 'tok-beta', user: {id: 'b1', name: 'Bob', email: 'bob@beta.test'}});
+    const a = (await call(acme, 'POST', '/tickets', {subject: 'Owner routing', body: 'x'})).body;
+    const b = (await call(beta, 'POST', '/tickets', {subject: 'Profile routing', body: 'y'})).body;
+    const list = (await call(manager, 'GET', '/api/plugins/support/tickets')).body.tickets;
+    const ta = list.find(t => t.ref === a.ref);
+    const tb = list.find(t => t.ref === b.ref);
+    const da = (await call(manager, 'GET', `/api/plugins/support/tickets/${ta.id}`)).body;
+    assert.deepEqual(da.replyTo, {email: 'owner@acme.test', source: 'registration'});
+    const db = (await call(manager, 'GET', `/api/plugins/support/tickets/${tb.id}`)).body;
+    assert.deepEqual(db.replyTo, {email: 'bob@beta.test', source: 'profile'});
+    mails.length = 0;
+    await call(manager, 'POST', `/api/plugins/support/tickets/${tb.id}/reply`, {body: 'hi Bob'});
+    assert.ok(mails.some(m => m.to === 'bob@beta.test'));
+});

package/plugins/support/tests/shape.test.js

@@ -74,8 +74,8 @@ test('inbox updates are checked', () => {
 });
 
 test('the contact card lets through only what is well-formed', () => {
-    assert.deepEqual(contactCard({email: 'support@dommajs.org', phone: '+44 (0)1234 567890', hours: 'Mon\nFri', responseTime: 'Soon'}),
-        {email: 'support@dommajs.org', phone: '+44 (0)1234 567890', hours: 'Mon Fri', responseTime: 'Soon'});
+    assert.deepEqual(contactCard({email: 'support@domma-cms.com', phone: '+44 (0)1234 567890', hours: 'Mon\nFri', responseTime: 'Soon'}),
+        {email: 'support@domma-cms.com', phone: '+44 (0)1234 567890', hours: 'Mon Fri', responseTime: 'Soon'});
     assert.deepEqual(contactCard({email: 'javascript:alert(1)', phone: 'call me'}), {email: '', phone: '', hours: '', responseTime: ''});
     assert.equal(telHref('+44 (0)1234 567890'), 'tel:+4401234567890');
 });