domma-cms 0.32.4 → 0.33.1

package/server/routes/api/navigation.js

@@ -1,42 +1,42 @@
-/**
- * Navigation API
- * GET /api/navigation    - get navigation config
- * PUT /api/navigation    - save navigation config
- */
-import {getConfig, saveConfig} from '../../config.js';
-import {authenticate, requirePermission} from '../../middleware/auth.js';
-import * as cache from '../../services/cache/index.js';
-
-export async function navigationRoutes(fastify) {
-    const canRead = {preHandler: [authenticate, requirePermission('navigation', 'read')]};
-    const canUpdate = {preHandler: [authenticate, requirePermission('navigation', 'update')]};
-
-    fastify.get('/navigation', canRead, async () => {
-        return getConfig('navigation');
-    });
-
-    fastify.put('/navigation', canUpdate, async (request, reply) => {
-        const data = request.body;
-        if (!data || typeof data !== 'object') {
-            return reply.status(400).send({ error: 'Invalid navigation data' });
-        }
-        if (!Array.isArray(data.items) && !Array.isArray(data)) {
-            return reply.status(400).send({ error: 'Navigation must be an array of items' });
-        }
-        // Normalise child key: Domma navbar expects `items`, not `children`
-        if (Array.isArray(data.items)) {
-            data.items = data.items.map(item => {
-                const children = item.items || item.children;
-                if (children?.length) {
-                    const { children: _c, ...rest } = item;
-                    return { ...rest, items: children };
-                }
-                const { children: _c, ...rest } = item;
-                return rest;
-            });
-        }
-        saveConfig('navigation', data);
-        await cache.invalidateTags(['nav']);
-        return { success: true };
-    });
-}
+/**
+ * Navigation API
+ * GET /api/navigation    - get navigation config
+ * PUT /api/navigation    - save navigation config
+ */
+import {getConfig, saveConfig} from '../../config.js';
+import {authenticate, requirePermission} from '../../middleware/auth.js';
+import * as cache from '../../services/cache/index.js';
+
+export async function navigationRoutes(fastify) {
+    const canRead = {preHandler: [authenticate, requirePermission('navigation', 'read')]};
+    const canUpdate = {preHandler: [authenticate, requirePermission('navigation', 'update')]};
+
+    fastify.get('/navigation', canRead, async () => {
+        return getConfig('navigation');
+    });
+
+    fastify.put('/navigation', canUpdate, async (request, reply) => {
+        const data = request.body;
+        if (!data || typeof data !== 'object') {
+            return reply.status(400).send({ error: 'Invalid navigation data' });
+        }
+        if (!Array.isArray(data.items) && !Array.isArray(data)) {
+            return reply.status(400).send({ error: 'Navigation must be an array of items' });
+        }
+        // Normalise child key: Domma navbar expects `items`, not `children`
+        if (Array.isArray(data.items)) {
+            data.items = data.items.map(item => {
+                const children = item.items || item.children;
+                if (children?.length) {
+                    const { children: _c, ...rest } = item;
+                    return { ...rest, items: children };
+                }
+                const { children: _c, ...rest } = item;
+                return rest;
+            });
+        }
+        saveConfig('navigation', data);
+        await cache.invalidateTags(['nav']);
+        return { success: true };
+    });
+}

package/server/routes/api/settings.js

@@ -1,141 +1,141 @@
-/**
- * Settings API
- * GET  /api/settings            - get site settings
- * PUT  /api/settings            - save site settings
- * POST /api/settings/test-email - send a test email using stored SMTP config
- */
-import {getConfig, saveConfig} from '../../config.js';
-import {authenticate, requirePermission} from '../../middleware/auth.js';
-import nodemailer from 'nodemailer';
-import fs from 'fs/promises';
-import path from 'path';
-import {fileURLToPath} from 'url';
-import * as cache from '../../services/cache/index.js';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const CUSTOM_CSS_FILE = path.resolve(__dirname, '../../../content/custom.css');
-const CONNECTIONS_FILE = path.resolve(__dirname, '../../../config/connections.json');
-const CUSTOM_CSS_MAX = 100 * 1024; // 100 KB
-
-export async function settingsRoutes(fastify) {
-    const canRead = {preHandler: [authenticate, requirePermission('settings', 'read')]};
-    const canUpdate = {preHandler: [authenticate, requirePermission('settings', 'update')]};
-
-    fastify.get('/settings', canRead, async (request, reply) => {
-        const config = getConfig('site');
-        const safeConfig = { ...config };
-        if (safeConfig.smtp) {
-            safeConfig.smtp = { ...safeConfig.smtp, pass: '' };
-        }
-        return reply.send(safeConfig);
-    });
-
-    fastify.put('/settings', canUpdate, async (request, reply) => {
-        const data = request.body;
-        if (!data || typeof data !== 'object') {
-            return reply.status(400).send({ error: 'Invalid settings data' });
-        }
-        const ALLOWED_KEYS = new Set([
-            'title', 'tagline', 'description', 'logo', 'favicon',
-            'theme', 'adminTheme', 'fontFamily', 'fontSize',
-            'smtp', 'footer', 'analytics', 'social', 'locale',
-            'layoutOptions', 'seo', 'backToTop', 'cookieConsent', 'breadcrumbs', 'autoTheme',
-            'adminBrand'
-        ]);
-        const unknownKeys = Object.keys(data).filter(k => !ALLOWED_KEYS.has(k));
-        if (unknownKeys.length > 0) {
-            return reply.status(400).send({ error: `Unknown settings keys: ${unknownKeys.join(', ')}` });
-        }
-        // Merge incoming data with existing config so partial updates (e.g. just adminBrand)
-        // don't wipe unrelated keys. Nested objects get a shallow merge so sub-fields are
-        // preserved even when only some sub-fields are sent.
-        const existing = getConfig('site');
-        const merged = {...existing};
-        for (const [k, v] of Object.entries(data)) {
-            const isPlainObject = v !== null && typeof v === 'object' && !Array.isArray(v);
-            const existingIsPlainObject = existing[k] !== null && typeof existing[k] === 'object' && !Array.isArray(existing[k]);
-            if (isPlainObject && existingIsPlainObject) {
-                merged[k] = {...existing[k], ...v};
-            } else {
-                merged[k] = v;
-            }
-        }
-        // Never erase smtp.pass with the empty string that the GET endpoint injects for safety
-        if (merged.smtp && merged.smtp.pass === '' && existing.smtp?.pass) {
-            merged.smtp = {...merged.smtp, pass: existing.smtp.pass};
-        }
-        saveConfig('site', merged);
-        await cache.invalidateTags(['site']);
-        return { success: true };
-    });
-
-    fastify.post('/settings/test-email', canRead, async (request, reply) => {
-        const smtp = getConfig('site')?.smtp;
-        if (!smtp?.host) {
-            return reply.status(400).send({ error: 'SMTP is not configured. Save your SMTP settings first.' });
-        }
-
-        const transporter = nodemailer.createTransport({
-            host:   smtp.host,
-            port:   smtp.port || 587,
-            secure: smtp.secure || false,
-            auth:   smtp.user ? { user: smtp.user, pass: smtp.pass } : undefined
-        });
-
-        const to = request.body?.to || smtp.fromAddress;
-        if (!to) {
-            return reply.status(400).send({ error: 'No recipient address. Provide "to" in the request body or set a From Address.' });
-        }
-
-        try {
-            await transporter.sendMail({
-                from:    smtp.fromName ? `"${smtp.fromName}" <${smtp.fromAddress}>` : smtp.fromAddress,
-                to,
-                subject: 'Domma CMS — Test Email',
-                text:    'This is a test email sent from Domma CMS to verify your SMTP configuration.',
-                html:    '<p>This is a test email sent from <strong>Domma CMS</strong> to verify your SMTP configuration.</p>'
-            });
-            return { success: true, message: `Test email sent to ${to}` };
-        } catch (err) {
-            return reply.status(500).send({ error: `Failed to send email: ${err.message}` });
-        }
-    });
-
-    // GET /api/settings/db-status — returns whether MongoDB connections are configured
-    fastify.get('/settings/db-status', canRead, async () => {
-        try {
-            const raw = await fs.readFile(CONNECTIONS_FILE, 'utf8');
-            const connections = JSON.parse(raw);
-            const names = Object.keys(connections).filter(k =>
-                connections[k]?.type === 'mongodb' && connections[k]?.uri
-            );
-            return {configured: names.length > 0, connections: names};
-        } catch {
-            return {configured: false, connections: []};
-        }
-    });
-
-    // GET /api/settings/custom-css — return current CSS as JSON
-    fastify.get('/settings/custom-css', canUpdate, async () => {
-        try {
-            const css = await fs.readFile(CUSTOM_CSS_FILE, 'utf8');
-            return { css };
-        } catch {
-            return { css: '' };
-        }
-    });
-
-    // PUT /api/settings/custom-css — save CSS to content/custom.css
-    fastify.put('/settings/custom-css', canUpdate, async (request, reply) => {
-        const { css } = request.body || {};
-        if (typeof css !== 'string') {
-            return reply.status(400).send({ error: 'css must be a string.' });
-        }
-        if (Buffer.byteLength(css, 'utf8') > CUSTOM_CSS_MAX) {
-            return reply.status(400).send({ error: 'CSS exceeds the 100 KB limit.' });
-        }
-        await fs.writeFile(CUSTOM_CSS_FILE, css, 'utf8');
-        await cache.invalidateTags(['site']);
-        return { success: true };
-    });
-}
+/**
+ * Settings API
+ * GET  /api/settings            - get site settings
+ * PUT  /api/settings            - save site settings
+ * POST /api/settings/test-email - send a test email using stored SMTP config
+ */
+import {getConfig, saveConfig} from '../../config.js';
+import {authenticate, requirePermission} from '../../middleware/auth.js';
+import nodemailer from 'nodemailer';
+import fs from 'fs/promises';
+import path from 'path';
+import {fileURLToPath} from 'url';
+import * as cache from '../../services/cache/index.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const CUSTOM_CSS_FILE = path.resolve(__dirname, '../../../content/custom.css');
+const CONNECTIONS_FILE = path.resolve(__dirname, '../../../config/connections.json');
+const CUSTOM_CSS_MAX = 100 * 1024; // 100 KB
+
+export async function settingsRoutes(fastify) {
+    const canRead = {preHandler: [authenticate, requirePermission('settings', 'read')]};
+    const canUpdate = {preHandler: [authenticate, requirePermission('settings', 'update')]};
+
+    fastify.get('/settings', canRead, async (request, reply) => {
+        const config = getConfig('site');
+        const safeConfig = { ...config };
+        if (safeConfig.smtp) {
+            safeConfig.smtp = { ...safeConfig.smtp, pass: '' };
+        }
+        return reply.send(safeConfig);
+    });
+
+    fastify.put('/settings', canUpdate, async (request, reply) => {
+        const data = request.body;
+        if (!data || typeof data !== 'object') {
+            return reply.status(400).send({ error: 'Invalid settings data' });
+        }
+        const ALLOWED_KEYS = new Set([
+            'title', 'tagline', 'description', 'logo', 'favicon',
+            'theme', 'adminTheme', 'fontFamily', 'fontSize',
+            'smtp', 'footer', 'analytics', 'social', 'locale',
+            'layoutOptions', 'seo', 'backToTop', 'cookieConsent', 'breadcrumbs', 'autoTheme',
+            'adminBrand'
+        ]);
+        const unknownKeys = Object.keys(data).filter(k => !ALLOWED_KEYS.has(k));
+        if (unknownKeys.length > 0) {
+            return reply.status(400).send({ error: `Unknown settings keys: ${unknownKeys.join(', ')}` });
+        }
+        // Merge incoming data with existing config so partial updates (e.g. just adminBrand)
+        // don't wipe unrelated keys. Nested objects get a shallow merge so sub-fields are
+        // preserved even when only some sub-fields are sent.
+        const existing = getConfig('site');
+        const merged = {...existing};
+        for (const [k, v] of Object.entries(data)) {
+            const isPlainObject = v !== null && typeof v === 'object' && !Array.isArray(v);
+            const existingIsPlainObject = existing[k] !== null && typeof existing[k] === 'object' && !Array.isArray(existing[k]);
+            if (isPlainObject && existingIsPlainObject) {
+                merged[k] = {...existing[k], ...v};
+            } else {
+                merged[k] = v;
+            }
+        }
+        // Never erase smtp.pass with the empty string that the GET endpoint injects for safety
+        if (merged.smtp && merged.smtp.pass === '' && existing.smtp?.pass) {
+            merged.smtp = {...merged.smtp, pass: existing.smtp.pass};
+        }
+        saveConfig('site', merged);
+        await cache.invalidateTags(['site']);
+        return { success: true };
+    });
+
+    fastify.post('/settings/test-email', canRead, async (request, reply) => {
+        const smtp = getConfig('site')?.smtp;
+        if (!smtp?.host) {
+            return reply.status(400).send({ error: 'SMTP is not configured. Save your SMTP settings first.' });
+        }
+
+        const transporter = nodemailer.createTransport({
+            host:   smtp.host,
+            port:   smtp.port || 587,
+            secure: smtp.secure || false,
+            auth:   smtp.user ? { user: smtp.user, pass: smtp.pass } : undefined
+        });
+
+        const to = request.body?.to || smtp.fromAddress;
+        if (!to) {
+            return reply.status(400).send({ error: 'No recipient address. Provide "to" in the request body or set a From Address.' });
+        }
+
+        try {
+            await transporter.sendMail({
+                from:    smtp.fromName ? `"${smtp.fromName}" <${smtp.fromAddress}>` : smtp.fromAddress,
+                to,
+                subject: 'Domma CMS — Test Email',
+                text:    'This is a test email sent from Domma CMS to verify your SMTP configuration.',
+                html:    '<p>This is a test email sent from <strong>Domma CMS</strong> to verify your SMTP configuration.</p>'
+            });
+            return { success: true, message: `Test email sent to ${to}` };
+        } catch (err) {
+            return reply.status(500).send({ error: `Failed to send email: ${err.message}` });
+        }
+    });
+
+    // GET /api/settings/db-status — returns whether MongoDB connections are configured
+    fastify.get('/settings/db-status', canRead, async () => {
+        try {
+            const raw = await fs.readFile(CONNECTIONS_FILE, 'utf8');
+            const connections = JSON.parse(raw);
+            const names = Object.keys(connections).filter(k =>
+                connections[k]?.type === 'mongodb' && connections[k]?.uri
+            );
+            return {configured: names.length > 0, connections: names};
+        } catch {
+            return {configured: false, connections: []};
+        }
+    });
+
+    // GET /api/settings/custom-css — return current CSS as JSON
+    fastify.get('/settings/custom-css', canUpdate, async () => {
+        try {
+            const css = await fs.readFile(CUSTOM_CSS_FILE, 'utf8');
+            return { css };
+        } catch {
+            return { css: '' };
+        }
+    });
+
+    // PUT /api/settings/custom-css — save CSS to content/custom.css
+    fastify.put('/settings/custom-css', canUpdate, async (request, reply) => {
+        const { css } = request.body || {};
+        if (typeof css !== 'string') {
+            return reply.status(400).send({ error: 'css must be a string.' });
+        }
+        if (Buffer.byteLength(css, 'utf8') > CUSTOM_CSS_MAX) {
+            return reply.status(400).send({ error: 'CSS exceeds the 100 KB limit.' });
+        }
+        await fs.writeFile(CUSTOM_CSS_FILE, css, 'utf8');
+        await cache.invalidateTags(['site']);
+        return { success: true };
+    });
+}

package/server/services/apiEndpoints.js

@@ -386,9 +386,64 @@ function substituteFilter(filterTemplate, params, query) {
     return out;
 }
 
+/**
+ * Query keys that control the query envelope, not a field to filter on — they
+ * must never be interpreted as ad-hoc filters (otherwise `?limit=5` would
+ * filter a field called "limit").
+ */
+const RESERVED_QUERY_KEYS = new Set(['page', 'limit', 'sort', 'order', 'search']);
+
+/**
+ * The fields an endpoint is allowed to expose — and therefore the only fields
+ * an ad-hoc query filter may touch. A read-field allowlist, when set, is the
+ * boundary; otherwise every declared collection field (plus the always-safe
+ * `id` / `createdBy` pseudo-fields) is fair game. Restricting ad-hoc filters
+ * to exposed fields closes the boolean-oracle: a caller can never probe a
+ * field they cannot already see in the response.
+ *
+ * @param {object} def
+ * @returns {Promise<Set<string>>}
+ */
+async function exposedFieldSet(def) {
+    if (Array.isArray(def.fields) && def.fields.length) return new Set(def.fields);
+    const schema = await getCollection(def.collection);
+    const names = (schema?.fields || []).map(f => f.name).filter(Boolean);
+    return new Set([...names, 'id', 'createdBy']);
+}
+
+/**
+ * Collect ad-hoc filters from the request query, layered UNDER the definition's
+ * declared filters: reserved envelope keys are skipped, values must target an
+ * exposed field, and a field already constrained by a declared filter is left
+ * to the declaration (the curated filter always wins — a caller cannot loosen
+ * or override it).
+ *
+ * @param {Record<string, unknown>} query
+ * @param {Set<string>} exposed        - Filterable field names
+ * @param {Set<string>} declaredFields - Fields already fixed by the definition
+ * @returns {object} Ad-hoc filter clauses for the filterEngine
+ */
+function collectAdHocFilter(query, exposed, declaredFields) {
+    const out = {};
+    for (const [key, value] of Object.entries(query || {})) {
+        if (RESERVED_QUERY_KEYS.has(key)) continue;
+        if (typeof value !== 'string' || value === '') continue;
+        const {field} = parseFilterKey(key);
+        if (!field) continue;
+        if (!exposed.has(field.split('.')[0])) continue; // can't filter what you can't see
+        if (declaredFields.has(field)) continue;         // declared filter wins
+        out[key] = value;
+    }
+    return out;
+}
+
 /**
  * Execute a matched endpoint definition.
  *
+ * The final filter is the definition's declared filters (fixed literals,
+ * {{params.x}}, {{query.x}}) with ad-hoc query-string filters layered beneath
+ * them — declared always wins on any overlap.
+ *
  * @param {object} def
  * @param {Record<string, string>} params - Decoded path params
  * @param {Record<string, string>} query  - Request query object
@@ -396,12 +451,36 @@ function substituteFilter(filterTemplate, params, query) {
  * @throws {EndpointParamError}
  */
 export async function executeEndpoint(def, params, query) {
-    const filter = substituteFilter(def.filter, params, query || {});
+    const q = query || {};
+    const exposed = await exposedFieldSet(def);
+    const declared = substituteFilter(def.filter, params, q);
+    const declaredFields = new Set(Object.keys(def.filter || {}).map(k => parseFilterKey(k).field));
+    const adhoc = collectAdHocFilter(q, exposed, declaredFields);
+    const filter = {...adhoc, ...declared}; // declared wins on any key collision
+
+    // Envelope controls — the reserved query keys tune pagination and sort
+    // rather than filter (list mode only). The definition's own limit is the
+    // ceiling: a caller may page/shrink within it but never pull more than the
+    // endpoint intends; sort is restricted to exposed fields.
+    let page = 1;
+    let limit = Number.isInteger(def.limit) ? def.limit : 50;
+    let sort = def.sort || 'createdAt';
+    let order = ORDERS.includes(def.order) ? def.order : 'desc';
+    if (def.mode !== 'single') {
+        const cap = limit > 0 ? limit : 500;
+        const qLimit = Number.parseInt(q.limit, 10);
+        if (Number.isInteger(qLimit) && qLimit >= 1) limit = Math.min(qLimit, cap);
+        const qPage = Number.parseInt(q.page, 10);
+        if (Number.isInteger(qPage) && qPage >= 1) page = qPage;
+        if (q.order === 'asc' || q.order === 'desc') order = q.order;
+        if (typeof q.sort === 'string' && q.sort && exposed.has(q.sort.split('.')[0])) sort = q.sort;
+    }
+
     const result = await listEntries(def.collection, {
-        page: 1,
-        limit: def.mode === 'single' ? 1 : (def.limit ?? 50),
-        sort: def.sort || 'createdAt',
-        order: def.order || 'desc',
+        page,
+        limit: def.mode === 'single' ? 1 : limit,
+        sort,
+        order,
         filter: Object.keys(filter).length ? filter : undefined
     });
     if (def.mode === 'single') return result.entries[0] || null;