domma-cms 0.44.0 → 0.45.1

package/server/services/email.js

@@ -1,167 +1,167 @@
-/**
- * Core Email Utility
- * Nodemailer transport factory and generic form email sending utility.
- */
-import nodemailer from 'nodemailer';
-
-let lastSendResult = null;
-
-/**
- * Return the most recent email send result, or null if no send has occurred.
- *
- * @returns {{ ok: boolean, at: string, info: string|null } | null}
- */
-export function getLastSendResult() {
-    return lastSendResult;
-}
-
-/**
- * Record the outcome of an email send for health reporting.
- *
- * @param {boolean} ok
- * @param {string|null} info
- * @returns {void}
- */
-function recordSendResult(ok, info) {
-    lastSendResult = {
-        ok,
-        at: new Date().toISOString(),
-        info: info || null
-    };
-}
-
-/**
- * Escape HTML special characters for safe use in email bodies.
- *
- * @param {string} str
- * @returns {string}
- */
-export function escapeHtml(str) {
-    return String(str)
-        .replace(/&/g, '&')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;')
-        .replace(/'/g, '&#39;');
-}
-
-/**
- * Create a nodemailer transport.
- * Falls back to an Ethereal test account when no SMTP host is configured.
- *
- * @param {{ host: string, port: number, secure: boolean, user: string, pass: string }} smtp
- * @returns {Promise<import('nodemailer').Transporter>}
- * @throws {Error} If Ethereal test account creation fails.
- */
-export async function createTransport(smtp) {
-    if (smtp?.host) {
-        return nodemailer.createTransport({
-            host: smtp.host,
-            port: smtp.port || 587,
-            secure: smtp.secure || false,
-            auth: smtp.user ? { user: smtp.user, pass: smtp.pass } : undefined,
-            tls: { rejectUnauthorized: false }
-        });
-    }
-
-    // No SMTP configured — use Ethereal for dev/demo
-    const testAccount = await nodemailer.createTestAccount();
-    console.log('[email] No SMTP configured. Using Ethereal test account:', testAccount.user);
-    return nodemailer.createTransport({
-        host: 'smtp.ethereal.email',
-        port: 587,
-        secure: false,
-        auth: { user: testAccount.user, pass: testAccount.pass }
-    });
-}
-
-/**
- * Send a generic transactional email.
- *
- * @param {import('nodemailer').Transporter} transport
- * @param {{ from: string, fromName: string, to: string, subject: string, html: string, text: string }} opts
- * @returns {Promise<void>}
- * @throws {Error} If sending the email fails.
- */
-export async function sendEmail(transport, {from, fromName, to, subject, html, text}) {
-    try {
-        const info = await transport.sendMail({
-            from: `"${fromName}" <${from}>`,
-            to,
-            subject,
-            text,
-            html
-        });
-        recordSendResult(true, info.messageId);
-
-        const previewUrl = nodemailer.getTestMessageUrl(info);
-        if (previewUrl) {
-            console.log('[email] Preview URL:', previewUrl);
-        }
-        return info;
-    } catch (err) {
-        recordSendResult(false, err.message);
-        throw err;
-    }
-}
-
-/**
- * Send an HTML + plain-text form submission notification email.
- * Builds a generic table of field→value pairs from the submitted data.
- *
- * @param {import('nodemailer').Transporter} transport
- * @param {{ from: string, fromName: string, to: string, subject: string, formTitle: string, fields: Array<{name: string, label: string}>, data: Record<string, unknown> }} opts
- * @returns {Promise<void>}
- * @throws {Error} If sending the email fails.
- */
-export async function sendFormEmail(transport, { from, fromName, to, subject, formTitle, fields, data }) {
-    const rows = fields.map(field => {
-        const val  = data[field.name] ?? '';
-        const safe = escapeHtml(String(val)).replace(/\n/g, '<br>');
-        const safeLabel = escapeHtml(field.label || field.name);
-        return `
-        <tr>
-            <td style="padding:8px 12px;font-weight:600;background:#f9f9f9;border:1px solid #eee;white-space:nowrap;vertical-align:top;">${safeLabel}</td>
-            <td style="padding:8px 12px;border:1px solid #eee;vertical-align:top;">${safe}</td>
-        </tr>`.trim();
-    }).join('\n');
-
-    const plainRows = fields.map(field => {
-        const val = data[field.name] ?? '';
-        return `${field.label || field.name}: ${val}`;
-    }).join('\n');
-
-    const html = `
-<!DOCTYPE html>
-<html>
-<body style="font-family:sans-serif;max-width:640px;margin:0 auto;padding:20px;">
-    <h2 style="color:#333;margin-bottom:4px;">New Form Submission</h2>
-    <p style="color:#888;margin-top:0;font-size:.9rem;">${escapeHtml(formTitle)}</p>
-    <table style="width:100%;border-collapse:collapse;margin-top:16px;">
-        ${rows}
-    </table>
-</body>
-</html>`.trim();
-
-    const text = `New form submission: ${formTitle}\n\n${plainRows}`;
-
-    try {
-        const info = await transport.sendMail({
-            from: `"${fromName}" <${from}>`,
-            to,
-            subject,
-            text,
-            html
-        });
-        recordSendResult(true, info.messageId);
-
-        const previewUrl = nodemailer.getTestMessageUrl(info);
-        if (previewUrl) {
-            console.log('[email] Preview URL:', previewUrl);
-        }
-        return info;
-    } catch (err) {
-        recordSendResult(false, err.message);
-        throw err;
-    }
-}
+/**
+ * Core Email Utility
+ * Nodemailer transport factory and generic form email sending utility.
+ */
+import nodemailer from 'nodemailer';
+
+let lastSendResult = null;
+
+/**
+ * Return the most recent email send result, or null if no send has occurred.
+ *
+ * @returns {{ ok: boolean, at: string, info: string|null } | null}
+ */
+export function getLastSendResult() {
+    return lastSendResult;
+}
+
+/**
+ * Record the outcome of an email send for health reporting.
+ *
+ * @param {boolean} ok
+ * @param {string|null} info
+ * @returns {void}
+ */
+function recordSendResult(ok, info) {
+    lastSendResult = {
+        ok,
+        at: new Date().toISOString(),
+        info: info || null
+    };
+}
+
+/**
+ * Escape HTML special characters for safe use in email bodies.
+ *
+ * @param {string} str
+ * @returns {string}
+ */
+export function escapeHtml(str) {
+    return String(str)
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+
+/**
+ * Create a nodemailer transport.
+ * Falls back to an Ethereal test account when no SMTP host is configured.
+ *
+ * @param {{ host: string, port: number, secure: boolean, user: string, pass: string }} smtp
+ * @returns {Promise<import('nodemailer').Transporter>}
+ * @throws {Error} If Ethereal test account creation fails.
+ */
+export async function createTransport(smtp) {
+    if (smtp?.host) {
+        return nodemailer.createTransport({
+            host: smtp.host,
+            port: smtp.port || 587,
+            secure: smtp.secure || false,
+            auth: smtp.user ? { user: smtp.user, pass: smtp.pass } : undefined,
+            tls: { rejectUnauthorized: false }
+        });
+    }
+
+    // No SMTP configured - use Ethereal for dev/demo
+    const testAccount = await nodemailer.createTestAccount();
+    console.log('[email] No SMTP configured. Using Ethereal test account:', testAccount.user);
+    return nodemailer.createTransport({
+        host: 'smtp.ethereal.email',
+        port: 587,
+        secure: false,
+        auth: { user: testAccount.user, pass: testAccount.pass }
+    });
+}
+
+/**
+ * Send a generic transactional email.
+ *
+ * @param {import('nodemailer').Transporter} transport
+ * @param {{ from: string, fromName: string, to: string, subject: string, html: string, text: string }} opts
+ * @returns {Promise<void>}
+ * @throws {Error} If sending the email fails.
+ */
+export async function sendEmail(transport, {from, fromName, to, subject, html, text}) {
+    try {
+        const info = await transport.sendMail({
+            from: `"${fromName}" <${from}>`,
+            to,
+            subject,
+            text,
+            html
+        });
+        recordSendResult(true, info.messageId);
+
+        const previewUrl = nodemailer.getTestMessageUrl(info);
+        if (previewUrl) {
+            console.log('[email] Preview URL:', previewUrl);
+        }
+        return info;
+    } catch (err) {
+        recordSendResult(false, err.message);
+        throw err;
+    }
+}
+
+/**
+ * Send an HTML + plain-text form submission notification email.
+ * Builds a generic table of field→value pairs from the submitted data.
+ *
+ * @param {import('nodemailer').Transporter} transport
+ * @param {{ from: string, fromName: string, to: string, subject: string, formTitle: string, fields: Array<{name: string, label: string}>, data: Record<string, unknown> }} opts
+ * @returns {Promise<void>}
+ * @throws {Error} If sending the email fails.
+ */
+export async function sendFormEmail(transport, { from, fromName, to, subject, formTitle, fields, data }) {
+    const rows = fields.map(field => {
+        const val  = data[field.name] ?? '';
+        const safe = escapeHtml(String(val)).replace(/\n/g, '<br>');
+        const safeLabel = escapeHtml(field.label || field.name);
+        return `
+        <tr>
+            <td style="padding:8px 12px;font-weight:600;background:#f9f9f9;border:1px solid #eee;white-space:nowrap;vertical-align:top;">${safeLabel}</td>
+            <td style="padding:8px 12px;border:1px solid #eee;vertical-align:top;">${safe}</td>
+        </tr>`.trim();
+    }).join('\n');
+
+    const plainRows = fields.map(field => {
+        const val = data[field.name] ?? '';
+        return `${field.label || field.name}: ${val}`;
+    }).join('\n');
+
+    const html = `
+<!DOCTYPE html>
+<html>
+<body style="font-family:sans-serif;max-width:640px;margin:0 auto;padding:20px;">
+    <h2 style="color:#333;margin-bottom:4px;">New Form Submission</h2>
+    <p style="color:#888;margin-top:0;font-size:.9rem;">${escapeHtml(formTitle)}</p>
+    <table style="width:100%;border-collapse:collapse;margin-top:16px;">
+        ${rows}
+    </table>
+</body>
+</html>`.trim();
+
+    const text = `New form submission: ${formTitle}\n\n${plainRows}`;
+
+    try {
+        const info = await transport.sendMail({
+            from: `"${fromName}" <${from}>`,
+            to,
+            subject,
+            text,
+            html
+        });
+        recordSendResult(true, info.messageId);
+
+        const previewUrl = nodemailer.getTestMessageUrl(info);
+        if (previewUrl) {
+            console.log('[email] Preview URL:', previewUrl);
+        }
+        return info;
+    } catch (err) {
+        recordSendResult(false, err.message);
+        throw err;
+    }
+}

package/server/services/filterEngine.js

@@ -1,5 +1,5 @@
 /**
- * Filter Engine — Structured Query Translator for Collection Entries
+ * Filter Engine - Structured Query Translator for Collection Entries
  *
  * Defines the structured-filter DSL used by `listEntries` and the `[collection]`
  * shortcode (via `where_*` attributes). One module, two outputs:
@@ -36,19 +36,19 @@
  * possible; all comparisons fall back to string compare on NaN. _in / _nin
  * split on `,` and trim each value. _exists accepts "true" | "false" | "1" | "0".
  *
- * Field paths support dot notation against `entry.data` — e.g.
+ * Field paths support dot notation against `entry.data` - e.g.
  *   { 'address.city_eq': 'London' } → matches entry.data.address.city
  *
  * ---------------------------------------------------------------------------
  * Special pseudo-fields
  * ---------------------------------------------------------------------------
- *   createdBy   — matches against entry.meta.createdBy (not entry.data.*)
- *   id          — matches against entry.id (top-level)
+ *   createdBy   - matches against entry.meta.createdBy (not entry.data.*)
+ *   id          - matches against entry.id (top-level)
  *
  * Anything else maps to a path inside entry.data.
  */
 
-/** Recognised operator suffixes — order matters for greedy matching (_gte before _gt). */
+/** Recognised operator suffixes - order matters for greedy matching (_gte before _gt). */
 export const OPERATORS = [
     '_eq', '_ne', '_gte', '_lte', '_gt', '_lt',
     '_in', '_nin', '_contains', '_starts', '_ends', '_exists'
@@ -208,7 +208,7 @@ export function applyFilter(entries, filter) {
  * pseudo-fields (`createdBy` → `meta.createdBy`, `id` → `id`).
  *
  * Conditions are combined with AND. Multiple operators on the same field are
- * merged into a single sub-document — e.g. `{ salary_gte: 100, salary_lte: 200 }`
+ * merged into a single sub-document - e.g. `{ salary_gte: 100, salary_lte: 200 }`
  * becomes `{ 'data.salary': { $gte: 100, $lte: 200 } }`.
  *
  * @param {Record<string, unknown>} filter

package/server/services/forms.js

@@ -63,7 +63,7 @@ export async function listForms() {
     for (const entry of entries.filter(e => e.endsWith('.json'))) {
         try {
             const data = JSON.parse(await fs.readFile(path.join(FORMS_DIR, entry), 'utf8'));
-            // The filename is the canonical slug — readForm/deleteForm/save all
+            // The filename is the canonical slug - readForm/deleteForm/save all
             // resolve `${slug}.json`, and the [form] shortcode embeds by file.
             // Normalise so a stale internal slug can't desync list vs read.
             forms.push({...data, slug: entry.replace(/\.json$/, '')});
@@ -140,7 +140,7 @@ export async function createForm(data) {
         throw err;
     } catch (err) {
         if (err.code === 'FORM_ALREADY_EXISTS') throw err;
-        // File not found — safe to proceed
+        // File not found - safe to proceed
     }
 
     const now = new Date().toISOString();
@@ -155,7 +155,11 @@ export async function createForm(data) {
         settings: {
             submitText: 'Submit',
             successMessage: 'Thank you for your submission.',
-            layout: 'stacked',
+            // New forms start as a 2-column grid: the stacked default made
+            // every fresh form a single tall column that had to be re-laid-out
+            // by hand before it looked like anything.
+            layout: 'grid',
+            columns: 2,
             honeypot: true,
             rateLimitPerMinute: 3,
             ...settings
@@ -224,7 +228,11 @@ function buildFormFromCollection(schema) {
         settings: {
             submitText: 'Submit',
             successMessage: 'Thank you for your submission.',
-            layout: 'stacked',
+            // New forms start as a 2-column grid: the stacked default made
+            // every fresh form a single tall column that had to be re-laid-out
+            // by hand before it looked like anything.
+            layout: 'grid',
+            columns: 2,
             honeypot: true,
             rateLimitPerMinute: 5
         },
@@ -240,7 +248,7 @@ function buildFormFromCollection(schema) {
 
 /**
  * Ensure a form exists for the given collection schema.
- * Creates the form only if absent — never overwrites an existing one.
+ * Creates the form only if absent - never overwrites an existing one.
  * Skips system collections (roles, user-profiles).
  *
  * @param {object} schema - Collection schema
@@ -282,11 +290,11 @@ function toCollectionFieldType(type) {
  *
  * This is the inverse of {@link ensureFormForCollection}. A form whose
  * `collection` action points at a slug that was never created is permanently
- * broken: listing submissions 404s and — worse — every public submission is
+ * broken: listing submissions 404s and - worse - every public submission is
  * rejected and lost. Provisioning the collection from the form's own fields
  * makes such forms self-heal instead of silently dropping data.
  *
- * Creates the collection only if absent — never overwrites an existing one.
+ * Creates the collection only if absent - never overwrites an existing one.
  * No-op when the form disables collection storage.
  *
  * @param {object} form - Form definition
@@ -296,7 +304,7 @@ export async function ensureCollectionForForm(form) {
     if (!form || typeof form !== 'object') return null;
 
     const action = form.actions?.collection;
-    // Respect an explicitly disabled collection store — nothing to provision.
+    // Respect an explicitly disabled collection store - nothing to provision.
     if (action && action.enabled === false) return null;
 
     const targetSlug = (action && action.slug) ? action.slug : form.slug;
@@ -328,7 +336,7 @@ export async function ensureCollectionForForm(form) {
             slug: targetSlug,
             description: form.description || `Submissions for the "${form.title || targetSlug}" form.`,
             fields,
-            // Submissions can contain PII — lock the backing collection to admin
+            // Submissions can contain PII - lock the backing collection to admin
             // access so it is never exposed through the public collections API.
             // (Mirrors the access config the POST /forms create path applies.)
             api: {
@@ -340,7 +348,7 @@ export async function ensureCollectionForForm(form) {
             meta: { generatedFromForm: form.slug }
         });
     } catch (err) {
-        // Lost a race with a concurrent provision (EEXIST) — re-read and use it.
+        // Lost a race with a concurrent provision (EEXIST) - re-read and use it.
         const now = await getCollection(targetSlug);
         if (now) return now;
         throw err;

package/server/services/health.js

@@ -246,7 +246,7 @@ async function safeCheck(label, fn) {
  * Aggregate site + server health checks.
  *
  * Returns the cached result if it's within the 30 s TTL; otherwise runs all eight
- * checks in parallel and caches the result. Per-check errors are isolated — an
+ * checks in parallel and caches the result. Per-check errors are isolated - an
  * unexpected throw degrades only that check to `fail`, never the whole call.
  *
  * Note: no in-flight deduplication. Two concurrent cache misses will both run the

package/server/services/hooks.js

@@ -1,10 +1,10 @@
 /**
  * Hook System
  * Provides three extensibility mechanisms for plugins:
- *   1. EventEmitter — fire-and-forget content lifecycle events
- *   2. Shortcode registry — register custom [shortcode] handlers at startup
- *   3. Sanitize rule extensions — expand the HTML whitelist for plugin output
- *   4. Transform pipeline — modify markdown/render values at named hook points
+ *   1. EventEmitter - fire-and-forget content lifecycle events
+ *   2. Shortcode registry - register custom [shortcode] handlers at startup
+ *   3. Sanitize rule extensions - expand the HTML whitelist for plugin output
+ *   4. Transform pipeline - modify markdown/render values at named hook points
  */
 import {EventEmitter} from 'node:events';
 
@@ -47,7 +47,7 @@ export function getShortcodeProcessors() {
 }
 
 // ---------------------------------------------------------------------------
-// Menu-location registry — delegated to server/services/menus.js
+// Menu-location registry - delegated to server/services/menus.js
 // ---------------------------------------------------------------------------
 
 /**
@@ -65,14 +65,14 @@ export async function registerMenuLocation(slot, def) {
 }
 
 // ---------------------------------------------------------------------------
-// Admin sidebar items — plugin-registered runtime injection
+// Admin sidebar items - plugin-registered runtime injection
 // ---------------------------------------------------------------------------
 
 const _registeredSidebarItems = [];
 
 /**
  * Register a sidebar item from a plugin. Items are merged into the rendered
- * admin sidebar at render time — they are NOT persisted into menu JSON.
+ * admin sidebar at render time - they are NOT persisted into menu JSON.
  * Plugins re-register on each server boot via their setupPlugin hook.
  *
  * @param {{parent?: string, item: {text: string, url: string, icon?: string, permission?: string, items?: object[]}}} opts

package/server/services/images.js

@@ -139,8 +139,8 @@ function applyAdjustments(pipeline, adj) {
  * @param {import('sharp').Sharp} pipeline
  * @param {object} wm
  * @param {string} wm.image     Filename in MEDIA_DIR
- * @param {number} wm.opacity   0–1
- * @param {number} wm.scale     Fraction of image width (0–1)
+ * @param {number} wm.opacity   0-1
+ * @param {number} wm.scale     Fraction of image width (0-1)
  * @param {string} wm.position  e.g. 'bottom-right'
  * @returns {Promise<import('sharp').Sharp>}
  * @throws {Error} If watermark file cannot be read
@@ -214,7 +214,7 @@ function applyBorder(pipeline, border) {
  * @param {import('sharp').Sharp} pipeline
  * @param {object} format
  * @param {string} format.type     'jpeg' | 'png' | 'webp'
- * @param {number} [format.quality] 1–100
+ * @param {number} [format.quality] 1-100
  * @returns {import('sharp').Sharp}
  */
 function applyFormat(pipeline, format) {
@@ -262,7 +262,7 @@ function applyFormat(pipeline, format) {
 export async function transformImage(filename, operations = {}, outputFilename = null) {
   const srcPath = path.join(MEDIA_DIR, filename);
 
-  // Read into buffer first — avoids file-lock when overwriting the source
+  // Read into buffer first - avoids file-lock when overwriting the source
   const inputBuffer = await fs.readFile(srcPath);
 
   let pipeline = sharp(inputBuffer);

package/server/services/managerClient.js

@@ -37,7 +37,7 @@ export async function registerInstance(fingerprint) {
 
     if (!MANAGER_URL) return null;
     if (!INSTANCE_SECRET) {
-        console.warn('[managerClient] INSTANCE_SECRET not set — skipping registerInstance');
+        console.warn('[managerClient] INSTANCE_SECRET not set - skipping registerInstance');
         return null;
     }