domma-cms 0.44.0 → 0.45.0

package/server/services/scaffolder.js

@@ -1,5 +1,5 @@
 /**
- * Scaffolder — one-shot creator for a working CRUD system from a recipe.
+ * Scaffolder - one-shot creator for a working CRUD system from a recipe.
  *
  * A "recipe" is a JSON file under `server/services/recipes/` that describes:
  *   - one Collection (schema + initial api access rules)
@@ -14,7 +14,7 @@
  * and template variable.
  *
  * Atomicity: pre-flight check refuses to start if ANY target slug already
- * exists — keeps the user out of a partial-create state. If pre-flight passes
+ * exists - keeps the user out of a partial-create state. If pre-flight passes
  * we apply collection → form → actions in order. Action creation requires
  * MongoDB (Pro feature); when not configured we still complete the
  * collection + form and report actions as skipped with a warning.
@@ -64,7 +64,7 @@ export async function listRecipes() {
                 options:     r.options || []
             });
         } catch {
-            /* skip malformed recipe — don't break the listing */
+            /* skip malformed recipe - don't break the listing */
         }
     }
     return recipes;
@@ -101,7 +101,7 @@ function substituteTokens(value, tokens) {
     if (typeof value === 'string') {
         return value.replace(/\{\{\s*([A-Za-z0-9_]+)\s*\}\}/g, (_m, key) => {
             // Leave action template variables (entry.*, user.*, now, env.*) untouched
-            // — those are resolved at action execution time, not at scaffold time.
+            // - those are resolved at action execution time, not at scaffold time.
             if (key.includes('.') || key === 'now') return _m;
             if (key === 'entry' || key === 'user' || key === 'env') return _m;
             return tokens[key] != null ? String(tokens[key]) : _m;
@@ -117,18 +117,18 @@ function substituteTokens(value, tokens) {
 }
 
 /**
- * Resolve effective options for a recipe — recipe defaults merged with caller
+ * Resolve effective options for a recipe - recipe defaults merged with caller
  * overrides, with non-empty user values winning. Returns a plain `{ name: value }`
  * map suitable to pass to `substituteTokens`.
  *
  * **Default-chaining**: an option's `default` may template-reference earlier
- * options via `{{otherOption}}`. This is the "namespacing" affordance — set
+ * options via `{{otherOption}}`. This is the "namespacing" affordance - set
  * one `namespace` option and let `collectionSlug`, `formSlug`, `actionPrefix`
  * default to `{{namespace}}`, `{{namespace}}-form`, `{{namespace}}` etc. The
  * recipe author chooses which options participate; users can still override
  * any individual option to break the chain.
  *
- * Resolution is left-to-right over the options array — so the option being
+ * Resolution is left-to-right over the options array - so the option being
  * referenced MUST appear earlier in the array than the option that references
  * it. (If forward references become a recurring need we can topologically
  * sort, but the explicit-order rule keeps recipe files readable.)
@@ -160,7 +160,7 @@ function resolveOptions(recipe, userOverrides = {}) {
  * Check whether anything the recipe wants to create already exists. Returns a
  * list of human-readable conflict descriptions; empty array means clear.
  *
- * Action conflict checks are skipped silently when MongoDB isn't configured —
+ * Action conflict checks are skipped silently when MongoDB isn't configured -
  * the apply phase will degrade those into warnings rather than blocking.
  *
  * @param {object} resolvedRecipe
@@ -188,12 +188,12 @@ async function preflight(resolvedRecipe) {
             const existing = await getAction(action.slug);
             if (existing) conflicts.push(`Action "${action.slug}" already exists`);
         } catch {
-            // Mongo unavailable — treat as not-conflicting; the apply step
+            // Mongo unavailable - treat as not-conflicting; the apply step
             // will report actions as skipped instead.
         }
     }
 
-    // Roles + users are NOT treated as pre-flight conflicts — they're a
+    // Roles + users are NOT treated as pre-flight conflicts - they're a
     // looser kind of resource that frequently already exists (re-running a
     // recipe, admin-created role, etc.) and where overwriting would lose
     // data the user cares about (existing role's permissions tweaks, user's
@@ -247,7 +247,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
         }
     }
 
-    // Project — auto-create if the recipe declares one and it doesn't exist.
+    // Project - auto-create if the recipe declares one and it doesn't exist.
     // Uses the recipe's `namespace` token as the project slug, so a single user
     // choice ties together every artefact's `meta.project` tag below.
     let projectSlug = null;
@@ -273,7 +273,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
 
     const conflicts = await preflight(resolved);
     if (conflicts.length) {
-        const err = new Error(`Cannot apply recipe — conflicts:\n  - ${conflicts.join('\n  - ')}`);
+        const err = new Error(`Cannot apply recipe - conflicts:\n  - ${conflicts.join('\n  - ')}`);
         err.statusCode = 409;
         err.conflicts  = conflicts;
         throw err;
@@ -283,16 +283,16 @@ export async function applyRecipe(recipeSlug, opts = {}) {
     const skipped  = [];
     const warnings = [];
 
-    // 0. Roles — create FIRST so subsequent actions can reference them by name.
+    // 0. Roles - create FIRST so subsequent actions can reference them by name.
     // If a role with the same name already exists (re-run, admin-created),
-    // we skip silently rather than failing — the role's existence is what
+    // we skip silently rather than failing - the role's existence is what
     // matters for the actions that reference it, not who created it.
     const existingRoles = getRoleMap();
     for (const role of (resolved.roles || [])) {
         if (!role.name) continue;
         if (existingRoles.has(role.name)) {
             skipped.push(`role:${role.name}`);
-            warnings.push(`Role "${role.name}" already exists — using existing definition (recipe-defined permissions not applied)`);
+            warnings.push(`Role "${role.name}" already exists - using existing definition (recipe-defined permissions not applied)`);
             continue;
         }
         try {
@@ -310,7 +310,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
         }
     }
 
-    // 0b. Menus — write each declared menu and, if requested, map it to a slot.
+    // 0b. Menus - write each declared menu and, if requested, map it to a slot.
     for (const menu of (resolved.menus || [])) {
         if (!menu.slug) continue;
         try {
@@ -331,7 +331,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
                 let touched = false;
                 for (const slot of menu.locations) {
                     if (map[slot] && map[slot] !== menu.slug && !menu.force) {
-                        warnings.push(`Slot "${slot}" already mapped to "${map[slot]}" — left unchanged (set force:true to overwrite)`);
+                        warnings.push(`Slot "${slot}" already mapped to "${map[slot]}" - left unchanged (set force:true to overwrite)`);
                         continue;
                     }
                     map[slot] = menu.slug;
@@ -358,11 +358,11 @@ export async function applyRecipe(recipeSlug, opts = {}) {
             api:         resolved.collection.api,
             // rowAccess is a top-level schema field; createCollection accepts arbitrary keys via spread,
             // but to be explicit we set it on the schema after create. Simpler: write it via the schema
-            // file directly — createCollection already writes the schema, so we re-read + patch + write.
+            // file directly - createCollection already writes the schema, so we re-read + patch + write.
             ...(projectSlug && {meta: {project: projectSlug}})
         });
 
-        // Patch in rowAccess (if any) — collections.createCollection doesn't take it directly
+        // Patch in rowAccess (if any) - collections.createCollection doesn't take it directly
         if (resolved.collection.rowAccess) {
             const {getCollection: get, updateCollection} = await import('./collections.js');
             const cur = await get(tokens.collectionSlug);
@@ -386,7 +386,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
         created.form = tokens.formSlug;
     }
 
-    // 2b. Users — recipe-defined seed accounts. Password is mandatory (the
+    // 2b. Users - recipe-defined seed accounts. Password is mandatory (the
     // scaffolder won't invent one); if omitted, the user is reported as
     // skipped so the admin knows to create them manually. Auto-creating
     // accounts with a default password would be a meaningful security trap.
@@ -398,14 +398,14 @@ export async function applyRecipe(recipeSlug, opts = {}) {
             const existing = await getUserByEmail(u.email);
             if (existing) {
                 skipped.push(`user:${u.email}`);
-                warnings.push(`User "${u.email}" already exists — left unchanged`);
+                warnings.push(`User "${u.email}" already exists - left unchanged`);
                 continue;
             }
         } catch { /* no-op */ }
 
         if (!u.password) {
             skipped.push(`user:${u.email}`);
-            warnings.push(`User "${u.email}" skipped — no password set in recipe. Create the account manually under Users → New.`);
+            warnings.push(`User "${u.email}" skipped - no password set in recipe. Create the account manually under Users → New.`);
             continue;
         }
         try {
@@ -423,7 +423,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
         }
     }
 
-    // 3. Actions — best-effort; skip with warning when Mongo isn't available
+    // 3. Actions - best-effort; skip with warning when Mongo isn't available
     for (const action of (resolved.actions || [])) {
         if (!action.slug) continue;
         try {
@@ -441,7 +441,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
             created.actions.push(a.slug);
         } catch (err) {
             const reason = err.message.includes('MongoDB') || err.message.includes('Mongo')
-                ? `MongoDB not configured — action "${action.slug}" skipped (Pro feature)`
+                ? `MongoDB not configured - action "${action.slug}" skipped (Pro feature)`
                 : `Action "${action.slug}" failed: ${err.message}`;
             skipped.push(action.slug);
             warnings.push(reason);
@@ -449,17 +449,17 @@ export async function applyRecipe(recipeSlug, opts = {}) {
     }
 
     // Wire the form's actionSlug to the first created action if the recipe
-    // wanted it — convenient for "submit this form, fire that action" patterns.
+    // wanted it - convenient for "submit this form, fire that action" patterns.
     if (created.form && created.actions.length && resolved.form?.settings?.actionSlug === '') {
         try {
             const formDef = await readForm(created.form);
             formDef.settings = formDef.settings || {};
             formDef.settings.actionSlug = created.actions[0];
             await writeForm(created.form, formDef);
-        } catch { /* non-fatal — admin can wire it manually */ }
+        } catch { /* non-fatal - admin can wire it manually */ }
     }
 
-    // API tokens — generated at apply time; the plaintext rides ONCE in
+    // API tokens - generated at apply time; the plaintext rides ONCE in
     // `created.apiTokens[].token` (only a hash is stored). Idempotent:
     // re-applying never re-issues an existing name+project token, so the
     // credential the user already deployed survives recipe re-runs.
@@ -471,7 +471,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
             if (!t.name) continue;
             if (await findTokenByName(t.name, tokenProject)) {
                 skipped.push(`apiToken:${t.name}`);
-                warnings.push(`API token "${t.name}" already exists for project "${tokenProject}" — left unchanged (token value NOT re-issued)`);
+                warnings.push(`API token "${t.name}" already exists for project "${tokenProject}" - left unchanged (token value NOT re-issued)`);
                 continue;
             }
             try {
@@ -489,7 +489,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
         }
     }
 
-    // Custom API endpoints — declared as definition objects (path, collection,
+    // Custom API endpoints - declared as definition objects (path, collection,
     // filter, ...). Idempotent: an existing (project, path-shape) match is
     // skipped so re-applying a recipe never clobbers a tuned definition.
     const endpointDecls = resolved.apiEndpoints ? [].concat(resolved.apiEndpoints) : [];
@@ -500,7 +500,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
             if (!ep.path) continue;
             if (await findEndpointByPath(epProject, ep.path)) {
                 skipped.push(`apiEndpoint:${ep.path}`);
-                warnings.push(`API endpoint "${ep.path}" already exists for project "${epProject}" — left unchanged`);
+                warnings.push(`API endpoint "${ep.path}" already exists for project "${epProject}" - left unchanged`);
                 continue;
             }
             try {

package/server/services/sidebar-migration.js

@@ -1,7 +1,7 @@
 /**
  * Admin sidebar auto-migration.
  *
- * Runs once on server boot. Idempotent — guarded by the existence of
+ * Runs once on server boot. Idempotent - guarded by the existence of
  * config/menus/admin-sidebar.json. Seeds the admin sidebar menu with the
  * standard tree (Overview, Projects, Content, Data, System, Documentation)
  * and patches config/menu-locations.json to map the `admin-sidebar` slot.
@@ -148,7 +148,7 @@ async function readJson(p) {
 
 async function writeJson(p, data) {
     await fs.writeFile(p, JSON.stringify(data, null, 2) + '\n', 'utf8');
-    // Menu files written outside the menus service — drop its cached index so
+    // Menu files written outside the menus service - drop its cached index so
     // binding resolution sees the seeded sidebar menu.
     invalidateMenuIndex();
 }
@@ -180,7 +180,7 @@ export async function runMigration(opts = {}) {
 
     let locations = {};
     if (await exists(locPath)) {
-        try { locations = await readJson(locPath); } catch { /* malformed — start fresh */ }
+        try { locations = await readJson(locPath); } catch { /* malformed - start fresh */ }
     }
     locations['admin-sidebar'] = 'admin-sidebar';
     await writeJson(locPath, locations);
@@ -193,8 +193,8 @@ export async function runMigration(opts = {}) {
  * Append-if-absent: ensure a single item exists in the persisted admin
  * sidebar menu. Lets updates surface new admin pages on EXISTING installs
  * (the seed above only reaches fresh ones) without clobbering admin edits:
- * if any node in the tree already has the item's url — even moved, renamed,
- * or hidden — this is a no-op.
+ * if any node in the tree already has the item's url - even moved, renamed,
+ * or hidden - this is a no-op.
  *
  * Returns `{ensured: boolean, reason?: string}`.
  *
@@ -237,13 +237,13 @@ export async function ensureSidebarItem({groupText, item}, opts = {}) {
  * per-topic submenus. Idempotent and non-clobbering:
  *
  *  - If the persisted menu has no "Documentation" group, do nothing (the admin
- *    may have removed it deliberately — don't resurrect it).
- *  - Convert each flat leaf — "Usage" (`#/documentation`), "Tutorials"
- *    (`#/tutorials`) and "API Reference" (`#/api-reference`) — into its
+ *    may have removed it deliberately - don't resurrect it).
+ *  - Convert each flat leaf - "Usage" (`#/documentation`), "Tutorials"
+ *    (`#/tutorials`) and "API Reference" (`#/api-reference`) - into its
  *    submenu, replacing the node in place so its position is preserved. A leaf
  *    that the admin already turned into a parent, or whose new pages already
  *    appear anywhere in the group, is left untouched.
- *  - Add the Components submenu only if `#/docs/components` isn't present yet —
+ *  - Add the Components submenu only if `#/docs/components` isn't present yet -
  *    inserted before "API Reference" when that node exists.
  *
  * Returns `{updated: boolean, reason?: string}`.
@@ -290,7 +290,7 @@ export async function ensureDocumentationSubmenus(opts = {}) {
         changed = true;
     }
 
-    // Components submenu — add if absent, before API Reference.
+    // Components submenu - add if absent, before API Reference.
     if (!hasUrl(docGroup.items, '#/docs/components')) {
         const apiIdx = findByText('API Reference');
         const node = DOC_COMPONENTS_SUBMENU();

package/server/services/sitemap.js

@@ -1,7 +1,7 @@
 /**
  * Sitemap Service
  * Builds sitemap.xml from the page list. Filter logic lives in
- * shouldIncludeInSitemap() — see the TODO below.
+ * shouldIncludeInSitemap() - see the TODO below.
  *
  * Cache: callers should wrap generate() with the 'sitemap' tag so it
  * invalidates whenever a page is created, updated, renamed, or deleted.