domma-cms 0.43.1 → 0.44.0

package/admin/js/templates/forms.html

@@ -1,17 +1,17 @@
-<div class="view-header">
-    <h1><span data-icon="layout"></span> Forms</h1>
-    <div style="display:flex;gap:.5rem;">
-        <button id="test-email-btn" class="btn btn-ghost btn-sm">
-            <span data-icon="mail"></span> Test Email
-        </button>
-        <button id="create-form-btn" class="btn btn-primary">
-            <span data-icon="plus"></span> Create Form
-        </button>
-    </div>
-</div>
-
-<div class="card">
-    <div class="card-body">
-        <div id="forms-table"></div>
-    </div>
-</div>
+<div class="view-header">
+    <h1><span data-icon="layout"></span> Forms</h1>
+    <div style="display:flex;gap:.5rem;">
+        <button id="test-email-btn" class="btn btn-ghost btn-sm">
+            <span data-icon="mail"></span> Test Email
+        </button>
+        <button id="create-form-btn" class="btn btn-primary">
+            <span data-icon="plus"></span> Create Form
+        </button>
+    </div>
+</div>
+
+<div class="card">
+    <div class="card-body">
+        <div id="forms-table"></div>
+    </div>
+</div>

package/admin/js/templates/my-profile.html

@@ -1,17 +1,17 @@
-<div class="view-header">
-    <h1><span data-icon="user"></span> My Profile</h1>
-</div>
-
-<div class="card">
-    <div class="card-header"><h2>Account</h2></div>
-    <div class="card-body">
-        <div id="account-form-container"></div>
-    </div>
-</div>
-
-<div class="card mt-4" id="profile-card" style="display:none;">
-    <div class="card-header"><h2>Profile</h2></div>
-    <div class="card-body">
-        <div id="profile-form-container"></div>
-    </div>
-</div>
+<div class="view-header">
+    <h1><span data-icon="user"></span> My Profile</h1>
+</div>
+
+<div class="card">
+    <div class="card-header"><h2>Account</h2></div>
+    <div class="card-body">
+        <div id="account-form-container"></div>
+    </div>
+</div>
+
+<div class="card mt-4" id="profile-card" style="display:none;">
+    <div class="card-header"><h2>Profile</h2></div>
+    <div class="card-body">
+        <div id="profile-form-container"></div>
+    </div>
+</div>

package/admin/js/templates/role-editor.html

@@ -1,70 +1,70 @@
-<div class="view-header">
-    <h1><span data-icon="shield"></span> <span id="role-title">Edit Role</span></h1>
-    <div>
-        <a href="#/roles" class="btn btn-secondary"><span data-icon="arrow-left"></span> Back</a>
-        <button id="btn-save-role" class="btn btn-primary"><span data-icon="save"></span> Save</button>
-    </div>
-</div>
-
-<div class="tabs" id="role-tabs">
-    <div class="tab-list">
-        <button class="tab-item active">General</button>
-        <button class="tab-item">Permissions</button>
-    </div>
-    <div class="tab-content">
-        <!-- General Tab -->
-        <div class="tab-panel active" id="panel-general">
-            <div class="card">
-                <div class="card-body">
-                    <div class="row">
-                        <div class="col-6">
-                            <div class="mb-3">
-                                <label class="form-label">Name (slug)</label>
-                                <input id="role-name" type="text" class="form-input" placeholder="e.g. moderator">
-                                <p class="form-hint">Lowercase identifier. Cannot be changed for the root admin
-                                    role.</p>
-                            </div>
-                        </div>
-                        <div class="col-6">
-                            <div class="mb-3">
-                                <label class="form-label">Display Label</label>
-                                <input id="role-label" type="text" class="form-input" placeholder="e.g. Moderator">
-                            </div>
-                        </div>
-                    </div>
-                    <div class="row">
-                        <div class="col-6">
-                            <div class="mb-3">
-                                <label class="form-label">Level</label>
-                                <input id="role-level" type="number" class="form-input" min="0">
-                                <p class="form-hint">Lower = more privileged. 0 is reserved for the root admin.</p>
-                            </div>
-                        </div>
-                        <div class="col-6">
-                            <div class="mb-3">
-                                <label class="form-label">Badge Colour</label>
-                                <select id="role-badge" class="form-input"></select>
-                            </div>
-                        </div>
-                    </div>
-                    <div class="row">
-                        <div class="col-6">
-                            <div class="mb-3">
-                                <label class="form-label">Project</label>
-                                <select id="role-project" class="form-input">
-                                    <option value="">— none —</option>
-                                </select>
-                                <p class="form-hint">Tag this role to a project for grouping.</p>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-            </div>
-        </div>
-
-        <!-- Permissions Tab -->
-        <div class="tab-panel" id="panel-permissions">
-            <div id="permissions-container"></div>
-        </div>
-    </div>
-</div>
+<div class="view-header">
+    <h1><span data-icon="shield"></span> <span id="role-title">Edit Role</span></h1>
+    <div>
+        <a href="#/roles" class="btn btn-secondary"><span data-icon="arrow-left"></span> Back</a>
+        <button id="btn-save-role" class="btn btn-primary"><span data-icon="save"></span> Save</button>
+    </div>
+</div>
+
+<div class="tabs" id="role-tabs">
+    <div class="tab-list">
+        <button class="tab-item active">General</button>
+        <button class="tab-item">Permissions</button>
+    </div>
+    <div class="tab-content">
+        <!-- General Tab -->
+        <div class="tab-panel active" id="panel-general">
+            <div class="card">
+                <div class="card-body">
+                    <div class="row">
+                        <div class="col-6">
+                            <div class="mb-3">
+                                <label class="form-label">Name (slug)</label>
+                                <input id="role-name" type="text" class="form-input" placeholder="e.g. moderator">
+                                <p class="form-hint">Lowercase identifier. Cannot be changed for the root admin
+                                    role.</p>
+                            </div>
+                        </div>
+                        <div class="col-6">
+                            <div class="mb-3">
+                                <label class="form-label">Display Label</label>
+                                <input id="role-label" type="text" class="form-input" placeholder="e.g. Moderator">
+                            </div>
+                        </div>
+                    </div>
+                    <div class="row">
+                        <div class="col-6">
+                            <div class="mb-3">
+                                <label class="form-label">Level</label>
+                                <input id="role-level" type="number" class="form-input" min="0">
+                                <p class="form-hint">Lower = more privileged. 0 is reserved for the root admin.</p>
+                            </div>
+                        </div>
+                        <div class="col-6">
+                            <div class="mb-3">
+                                <label class="form-label">Badge Colour</label>
+                                <select id="role-badge" class="form-input"></select>
+                            </div>
+                        </div>
+                    </div>
+                    <div class="row">
+                        <div class="col-6">
+                            <div class="mb-3">
+                                <label class="form-label">Project</label>
+                                <select id="role-project" class="form-input">
+                                    <option value="">— none —</option>
+                                </select>
+                                <p class="form-hint">Tag this role to a project for grouping.</p>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </div>
+
+        <!-- Permissions Tab -->
+        <div class="tab-panel" id="panel-permissions">
+            <div id="permissions-container"></div>
+        </div>
+    </div>
+</div>

package/admin/js/templates/roles.html

@@ -1,10 +1,10 @@
-<div class="view-header">
-    <h1><span data-icon="shield"></span> Roles &amp; Permissions</h1>
-    <button id="btn-add-role" class="btn btn-primary"><span data-icon="plus"></span> Add Role</button>
-</div>
-
-<div class="card">
-    <div class="card-body">
-        <div id="roles-table"></div>
-    </div>
-</div>
+<div class="view-header">
+    <h1><span data-icon="shield"></span> Roles &amp; Permissions</h1>
+    <button id="btn-add-role" class="btn btn-primary"><span data-icon="plus"></span> Add Role</button>
+</div>
+
+<div class="card">
+    <div class="card-body">
+        <div id="roles-table"></div>
+    </div>
+</div>

package/bin/lib/config-merge.js

@@ -1,44 +1,44 @@
-/**
- * Domma CMS — Config Merge Utility
- * Merges new keys from an upstream config into an existing user config,
- * without ever overwriting values the user already has.
- */
-
-/**
- * Deep-merge new keys from `upstream` into `existing`.
- * Existing values are never modified — only missing keys are added.
- *
- * @param {object} existing - The user's current config object
- * @param {object} upstream - The upstream (new version) config object
- * @param {string} [_prefix] - Internal: key path prefix for reporting
- * @returns {{ merged: object, added: string[] }} Merged object + list of added key paths
- */
-export function deepMergeNewKeys(existing, upstream, _prefix = '') {
-    const merged = {...existing};
-    const added = [];
-
-    for (const [key, upstreamVal] of Object.entries(upstream)) {
-        const fullKey = _prefix ? `${_prefix}.${key}` : key;
-
-        if (!(key in existing)) {
-            // Key is entirely missing — add it wholesale
-            merged[key] = upstreamVal;
-            added.push(fullKey);
-        } else if (
-            upstreamVal !== null &&
-            typeof upstreamVal === 'object' &&
-            !Array.isArray(upstreamVal) &&
-            typeof existing[key] === 'object' &&
-            existing[key] !== null &&
-            !Array.isArray(existing[key])
-        ) {
-            // Both sides are plain objects — recurse
-            const child = deepMergeNewKeys(existing[key], upstreamVal, fullKey);
-            merged[key] = child.merged;
-            added.push(...child.added);
-        }
-        // Otherwise: existing value wins — no action
-    }
-
-    return {merged, added};
-}
+/**
+ * Domma CMS — Config Merge Utility
+ * Merges new keys from an upstream config into an existing user config,
+ * without ever overwriting values the user already has.
+ */
+
+/**
+ * Deep-merge new keys from `upstream` into `existing`.
+ * Existing values are never modified — only missing keys are added.
+ *
+ * @param {object} existing - The user's current config object
+ * @param {object} upstream - The upstream (new version) config object
+ * @param {string} [_prefix] - Internal: key path prefix for reporting
+ * @returns {{ merged: object, added: string[] }} Merged object + list of added key paths
+ */
+export function deepMergeNewKeys(existing, upstream, _prefix = '') {
+    const merged = {...existing};
+    const added = [];
+
+    for (const [key, upstreamVal] of Object.entries(upstream)) {
+        const fullKey = _prefix ? `${_prefix}.${key}` : key;
+
+        if (!(key in existing)) {
+            // Key is entirely missing — add it wholesale
+            merged[key] = upstreamVal;
+            added.push(fullKey);
+        } else if (
+            upstreamVal !== null &&
+            typeof upstreamVal === 'object' &&
+            !Array.isArray(upstreamVal) &&
+            typeof existing[key] === 'object' &&
+            existing[key] !== null &&
+            !Array.isArray(existing[key])
+        ) {
+            // Both sides are plain objects — recurse
+            const child = deepMergeNewKeys(existing[key], upstreamVal, fullKey);
+            merged[key] = child.merged;
+            added.push(...child.added);
+        }
+        // Otherwise: existing value wins — no action
+    }
+
+    return {merged, added};
+}

package/config/plugins.json

@@ -20,7 +20,7 @@
     "settings": {}
   },
   "blog": {
-    "enabled": false,
+    "enabled": true,
     "bundled": false,
     "settings": {}
   },

package/config/site.json

@@ -1,88 +1,88 @@
 {
-  "title": "My CMS Site",
-  "url": "http://domma-cms.local:4096",
-  "tagline": "This is the Domma CMS",
-  "theme": "silver-dark",
-  "seo": {
-    "defaultTitle": "My Bloggy Thing",
-    "titleSeparator": " | ",
-    "defaultDescription": "A site built with Domma CMS"
-  },
-  "footer": {
-    "copyright": "© My Site. All rights reserved.",
-    "links": []
-  },
-  "social": {
-    "twitter": "",
-    "facebook": "",
-    "instagram": "",
-    "linkedin": "",
-    "github": "",
-    "youtube": ""
-  },
-  "smtp": {
-    "host": "192.168.1.27",
-    "port": 1025,
-    "user": "",
-    "pass": "",
-    "secure": false,
-    "fromAddress": "",
-    "fromName": ""
-  },
-  "adminBrand": {
-    "title": "Domma CMS"
-  },
-  "fontFamily": "Nunito",
-  "fontSize": 18,
-  "autoTheme": {
-    "enabled": false,
-    "dayTheme": "charcoal-light",
-    "nightTheme": "charcoal-dark",
-    "dayStart": "07:00",
-    "nightStart": "19:00"
-  },
-  "adminTheme": "silver-dark",
-  "layoutOptions": {
-    "spacerSize": 40
-  },
-  "backToTop": {
-    "enabled": true,
-    "scrollThreshold": 300,
-    "position": "bottom-right",
-    "offset": 32,
-    "bottomOffset": 32,
-    "label": "",
-    "smooth": true
-  },
-  "cookieConsent": {
-    "enabled": true,
-    "message": "",
-    "acceptAllText": "Accept All",
-    "rejectAllText": "Reject All",
-    "customizeText": "Customize",
-    "savePreferencesText": "Save Preferences",
-    "privacyPolicyText": "Privacy Policy",
-    "privacyPolicyUrl": "",
-    "cookiePolicyText": "Cookie Policy",
-    "cookiePolicyUrl": "",
-    "position": "bottom",
-    "layout": "bar",
-    "theme": "dark",
-    "showFunctional": true,
-    "showAnalytics": true,
-    "showMarketing": true,
-    "consentVersion": "1.0"
-  },
-  "breadcrumbs": {
-    "enabled": false,
-    "homeLabel": "Home",
-    "position": "TR",
-    "offsetX": 64,
-    "offsetY": 64
-  },
-  "brand": {
-    "text": "My Bloggy Thing",
-    "logo": null,
-    "url": "/"
-  }
+    "title": "My CMS Site",
+    "url": "http://localhost:4096",
+    "tagline": "This is the Domma CMS",
+    "theme": "silver-dark",
+    "seo": {
+        "defaultTitle": "My Bloggy Thing",
+        "titleSeparator": " | ",
+        "defaultDescription": "A site built with Domma CMS"
+    },
+    "footer": {
+        "copyright": "© My Site. All rights reserved.",
+        "links": []
+    },
+    "social": {
+        "twitter": "",
+        "facebook": "",
+        "instagram": "",
+        "linkedin": "",
+        "github": "",
+        "youtube": ""
+    },
+    "smtp": {
+        "host": "",
+        "port": 587,
+        "user": "",
+        "pass": "",
+        "secure": false,
+        "fromAddress": "",
+        "fromName": ""
+    },
+    "adminBrand": {
+        "title": "Domma CMS"
+    },
+    "fontFamily": "Nunito",
+    "fontSize": 18,
+    "autoTheme": {
+        "enabled": false,
+        "dayTheme": "charcoal-light",
+        "nightTheme": "charcoal-dark",
+        "dayStart": "07:00",
+        "nightStart": "19:00"
+    },
+    "adminTheme": "silver-dark",
+    "layoutOptions": {
+        "spacerSize": 40
+    },
+    "backToTop": {
+        "enabled": true,
+        "scrollThreshold": 300,
+        "position": "bottom-right",
+        "offset": 32,
+        "bottomOffset": 32,
+        "label": "",
+        "smooth": true
+    },
+    "cookieConsent": {
+        "enabled": true,
+        "message": "",
+        "acceptAllText": "Accept All",
+        "rejectAllText": "Reject All",
+        "customizeText": "Customize",
+        "savePreferencesText": "Save Preferences",
+        "privacyPolicyText": "Privacy Policy",
+        "privacyPolicyUrl": "",
+        "cookiePolicyText": "Cookie Policy",
+        "cookiePolicyUrl": "",
+        "position": "bottom",
+        "layout": "bar",
+        "theme": "dark",
+        "showFunctional": true,
+        "showAnalytics": true,
+        "showMarketing": true,
+        "consentVersion": "1.0"
+    },
+    "breadcrumbs": {
+        "enabled": false,
+        "homeLabel": "Home",
+        "position": "TR",
+        "offsetX": 64,
+        "offsetY": 64
+    },
+    "brand": {
+        "text": "My Bloggy Thing",
+        "logo": null,
+        "url": "/"
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "0.43.1",
+  "version": "0.44.0",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/scripts/build.js

@@ -169,6 +169,60 @@ async function stampPluginVersions() {
     }
 }
 
+/**
+ * Domma Tools is the one Domma asset npm cannot deliver.
+ *
+ * `domma-js` does not list `domma-tools.*` in its package `files`, so the pair under
+ * `admin/dist/domma/` can only ever arrive by hand-copying it out of a domma build. Meanwhile
+ * `/dist/domma/domma.min.js` is served straight from `node_modules/domma-js` (server.js), so a
+ * `npm install domma-js@next` silently upgrades one half of the admin and leaves the other on
+ * whatever version was last copied across. The tools bundle's own banner says
+ * `Requires: domma.min.js` — it is built against a specific core and is not version-independent.
+ *
+ * That skew is invisible: both files load, no import dangles, nothing throws. It surfaces later as
+ * a Theme Roller or Page Roller that misbehaves against a core it was not built for. This is the
+ * one place that can see both versions at once, so it is the place that checks.
+ *
+ * @returns {{ok: boolean, installed: string, found: Array<{rel: string, version: string|null}>, problems: string[]}}
+ */
+function verifyDommaToolsVersion(toolsRelPaths) {
+    const installed = JSON.parse(
+        readFileSync(join(ROOT, 'node_modules/domma-js/package.json'), 'utf8'),
+    ).version;
+
+    // Banners differ between the two artefacts: "Domma Tools v0.38.0" (JS) and
+    // "Domma Tools CSS v0.38.0" (CSS). Match both rather than only the one you happened to open.
+    const BANNER = /\*\s*Domma Tools(?: CSS)? v(\d+\.\d+\.\d+)/;
+
+    const found = [];
+    const problems = [];
+
+    for (const rel of toolsRelPaths) {
+        const src = join(ROOT, rel);
+        if (!existsSync(src)) {
+            // admin/index.html loads both unconditionally, so an absent file is a dead <script>/<link>
+            // in the published admin. The copy step already tolerates absence; flag it rather than
+            // silently agreeing.
+            problems.push(`${rel} is missing — the published admin will reference a file that isn't there`);
+            continue;
+        }
+        // The banner is in the first few lines; no need to read a 230 KB bundle in full.
+        const head = readFileSync(src, 'utf8').slice(0, 512);
+        const match = head.match(BANNER);
+        if (!match) {
+            problems.push(`${rel} carries no recognisable Domma Tools banner — cannot confirm its version`);
+            found.push({rel, version: null});
+            continue;
+        }
+        found.push({rel, version: match[1]});
+        if (match[1] !== installed) {
+            problems.push(`${rel} is v${match[1]} but domma-js is v${installed}`);
+        }
+    }
+
+    return {ok: problems.length === 0, installed, found, problems};
+}
+
 async function build() {
   // Clean and recreate _publish/
   if (existsSync(OUT)) rmSync(OUT, {recursive: true, force: true});
@@ -191,6 +245,32 @@ async function build() {
   delete pkg.scripts?.prepublishOnly;
   writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
 
+  // Scrub this machine's local config out of the staged copy. config/site.json
+  // is a working file on a development install, so it carries whatever SMTP
+  // host and site URL were last set here — published releases up to 0.43.1 put
+  // a LAN address on the public registry and handed every manual installer a
+  // mail host that does not exist for them. Same reasoning as the analytics
+  // counters in .npmignore: runtime state must not ride along in the tarball.
+  const sitePath = join(OUT, 'config', 'site.json');
+  if (existsSync(sitePath)) {
+    const site = JSON.parse(readFileSync(sitePath, 'utf8'));
+    site.url = 'http://localhost:4096';
+    if (site.smtp) {
+      site.smtp = {
+        host: '', port: 587, user: '', pass: '',
+        secure: false, fromAddress: '', fromName: '',
+      };
+    }
+    writeFileSync(sitePath, JSON.stringify(site, null, 4) + '\n');
+  }
+
+  // .bak files are migration leftovers from whichever machine built the
+  // release — never something an installer should receive.
+  for (const rel of ['config/navigation.json.bak', 'config/connections.json.bak']) {
+    const bak = join(OUT, rel);
+    if (existsSync(bak)) rmSync(bak, {force: true});
+  }
+
   // Copy plugin server-side code verbatim
   const pluginAsIs = await collectFiles('{' + PLUGIN_AS_IS_PATTERNS.join(',') + '}');
   for (const rel of pluginAsIs) {
@@ -212,6 +292,20 @@ async function build() {
     'admin/dist/domma/domma-tools.css',
     'admin/dist/domma/domma-tools.min.js',
   ];
+
+  // Version-skew gate — see verifyDommaToolsVersion() for why this cannot be left to npm.
+  const toolsCheck = verifyDommaToolsVersion(dommaTools);
+  if (toolsCheck.ok) {
+    console.log(`Domma Tools v${toolsCheck.installed} — matches installed domma-js`);
+  } else {
+    for (const problem of toolsCheck.problems) console.error(`  ${problem}`);
+    throw new Error(
+      `Domma Tools is out of step with domma-js v${toolsCheck.installed} — copy `
+      + `domma-tools.min.js and domma-tools.css from that version's build into admin/dist/domma/, `
+      + `then rebuild`,
+    );
+  }
+
   for (const rel of dommaTools) {
     const src = join(ROOT, rel);
     if (existsSync(src)) {