domma-cms 0.50.0 → 0.51.0

package/server/routes/public.js

@@ -12,6 +12,7 @@ import {renderPage} from '../services/renderer.js';
 import {buildRobotsTxt, generate as generateSitemap} from '../services/sitemap.js';
 import {checkVisibility} from '../middleware/auth.js';
 import {resolveViewer} from '../services/viewerSession.js';
+import {touchPreviewLink, verifyPreviewToken} from '../services/previewLinks.js';
 import {getPermissionsFor} from '../services/roles.js';
 import {getEffectiveRoles} from '../services/userRoles.js';
 import {hooks} from '../services/hooks.js';
@@ -81,6 +82,61 @@ export async function publicRoutes(fastify) {
         return reply.type('text/plain').send(buildRobotsTxt(getBaseUrl(request)));
     });
 
+    // Share-link preview: one signed token, one page, no account needed.
+    //
+    // The token rides in the query string, not the path: Fastify caps a route
+    // parameter at 100 characters by default and a signed token is three times
+    // that, so `/_preview/:token` silently fell through to the catch-all and
+    // 404'd. Raising maxParamLength would fix it only for instances that
+    // remember to set it - tests and embedders included - so the query string
+    // is the form that cannot come apart.
+    //
+    // The token names the page, so a holder cannot repoint the link; the
+    // server-side index means it can be withdrawn after the fact.
+    fastify.get('/_preview', async (request, reply) => {
+        // Referrer-Policy matters more here than anywhere else on the site: the
+        // credential is IN the URL, so a default referrer would hand the whole
+        // token to every third-party asset the page loads.
+        reply.header('referrer-policy', 'no-referrer');
+        reply.header('cache-control', 'no-store, private');
+        reply.header('x-robots-tag', 'noindex, nofollow');
+
+        const link = await verifyPreviewToken((request.query || {}).token, fastify.jwt);
+        if (!link) {
+            reply.status(404);
+            return reply.type('text/html').send(await render404('/_preview'));
+        }
+
+        const page = await getPage(link.urlPath);
+        if (!page) {
+            reply.status(404);
+            return reply.type('text/html').send(await render404(link.urlPath));
+        }
+
+        // A disabled project stays a hard kill switch. A share link narrows who
+        // may see one page; it is not a way around taking a whole project down.
+        const project = await getProjectForPage(page.urlPath || link.urlPath, page.project);
+        if (!(await isProjectEnabled(project))) {
+            reply.status(404);
+            return reply.type('text/html').send(await render404(link.urlPath));
+        }
+
+        // Rendered as anonymous on purpose: the recipient has no account, so
+        // menus and role-gated shortcodes must show them the least, not the
+        // most. The token satisfies this page's own gate and nothing else.
+        await touchPreviewLink(link.id);
+        const html = await renderPage(page, {
+            baseUrl: getBaseUrl(request),
+            user: null,
+            preview: {
+                status: page.status || 'draft',
+                urlPath: page.urlPath || link.urlPath,
+                shared: {expiresAt: link.expiresAt, label: link.label}
+            }
+        });
+        return reply.type('text/html').send(html);
+    });
+
     // Public pages catch-all
     fastify.get('/*', async (request, reply) => {
         const rawPath = request.params['*'];

package/server/services/content.js

@@ -76,6 +76,33 @@ export async function getPage(urlPath, opts = {}) {
     }
 }
 
+/**
+ * Compose a page object from unsaved frontmatter and body, without touching
+ * disk.
+ *
+ * Deliberately runs the same `parseMarkdown` call as readPageFile() and
+ * returns the same shape, so the editor's full-page preview renders through
+ * the identical pipeline the public site would use on save. Anything that
+ * diverges here becomes a preview that lies.
+ *
+ * `urlPath` matters even for an unsaved page: `[menu location="…"]` and menu
+ * bindings resolve against it, so a preview of a page destined for
+ * /projects/x sees the menus that page will actually get.
+ *
+ * @param {string} urlPath
+ * @param {object} frontmatter
+ * @param {string} body
+ * @param {object} [opts]
+ * @param {object|null} [opts.user]
+ * @returns {Promise<object>} Same shape as getPage()
+ */
+export async function buildPreviewPage(urlPath, frontmatter, body, opts = {}) {
+    const raw = serialiseMarkdown({...(frontmatter || {})}, body || '');
+    const {data, content, html, usedComponents, tags} =
+        await parseMarkdown(raw, {user: opts.user || null, urlPath});
+    return {...data, urlPath, content, html, usedComponents, cacheTags: tags};
+}
+
 /**
  * Create a new page. Auto-creates parent directories.
  *

package/server/services/previewLinks.js

@@ -0,0 +1,215 @@
+/**
+ * Preview Links
+ *
+ * Revocable, expiring, single-page share links for unpublished content. They
+ * exist for the reviewer who has no account: a client, an external designer,
+ * a copywriter. The holder of the link sees exactly one page and nothing else.
+ *
+ * Why a server-side index rather than a bare signed token: a JWT alone cannot
+ * be withdrawn. Once a link is out it is out until it expires, and "I sent that
+ * to the wrong address" is precisely the moment you need it gone. Every token
+ * carries a `jti` that must still be present and unrevoked in the index, so
+ * revocation is immediate.
+ *
+ * The index lives at content/preview-links.json and is small by construction -
+ * expired records are pruned whenever it is written.
+ */
+import fs from 'fs/promises';
+import path from 'path';
+import crypto from 'node:crypto';
+import {config} from '../config.js';
+
+const STORE_PATH = path.join(config.content.contentDir, 'preview-links.json');
+
+/** Token type claim - a page-preview token must never satisfy an API guard. */
+export const PREVIEW_TOKEN_TYPE = 'page-preview';
+
+/** Expiry choices offered to the issuer, in seconds. */
+export const EXPIRY_CHOICES = {
+    '1h':  3600,
+    '24h': 86_400,
+    '7d':  604_800,
+    '30d': 2_592_000
+};
+
+const DEFAULT_EXPIRY = EXPIRY_CHOICES['7d'];
+const MAX_EXPIRY     = EXPIRY_CHOICES['30d'];
+
+/**
+ * Read the link index. Missing or corrupt file yields an empty index rather
+ * than throwing - a broken store must not take the public site down, it must
+ * only mean no link validates.
+ *
+ * @returns {Promise<object[]>}
+ */
+async function readStore() {
+    try {
+        const raw = await fs.readFile(STORE_PATH, 'utf8');
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed : [];
+    } catch {
+        return [];
+    }
+}
+
+/**
+ * Write the index, dropping records that expired more than a day ago.
+ *
+ * @param {object[]} links
+ * @returns {Promise<void>}
+ */
+async function writeStore(links) {
+    const cutoff = Date.now() - 86_400_000;
+    const kept = links.filter(l => new Date(l.expiresAt).getTime() > cutoff);
+    await fs.mkdir(path.dirname(STORE_PATH), {recursive: true});
+    await fs.writeFile(STORE_PATH, JSON.stringify(kept, null, 2), 'utf8');
+}
+
+/**
+ * Normalise a requested lifetime to a whole number of seconds within bounds.
+ *
+ * @param {string|number} [requested] - A key of EXPIRY_CHOICES or seconds
+ * @returns {number}
+ */
+export function resolveExpirySeconds(requested) {
+    if (typeof requested === 'string' && requested in EXPIRY_CHOICES) {
+        return EXPIRY_CHOICES[requested];
+    }
+    const n = Number(requested);
+    if (Number.isFinite(n) && n > 0) return Math.min(Math.floor(n), MAX_EXPIRY);
+    return DEFAULT_EXPIRY;
+}
+
+/**
+ * Mint a share link for one page.
+ *
+ * @param {object} params
+ * @param {string} params.urlPath          - Page the link unlocks; nothing else
+ * @param {object} params.jwt              - fastify.jwt
+ * @param {string} [params.label]          - Free-text note for the issuer's own use
+ * @param {string} [params.createdBy]      - Issuing user's id
+ * @param {string} [params.createdByName]  - Issuing user's display name
+ * @param {string|number} [params.expiresIn]
+ * @returns {Promise<{id: string, token: string, urlPath: string, expiresAt: string, label: string}>}
+ */
+export async function createPreviewLink({urlPath, jwt, label = '', createdBy = null, createdByName = '', expiresIn}) {
+    if (!urlPath || typeof urlPath !== 'string' || !urlPath.startsWith('/')) {
+        throw new Error('A urlPath beginning with / is required');
+    }
+    const seconds   = resolveExpirySeconds(expiresIn);
+    const id        = crypto.randomUUID();
+    const createdAt = new Date().toISOString();
+    const expiresAt = new Date(Date.now() + seconds * 1000).toISOString();
+
+    // The page is named in the token, so a holder cannot repoint it, and the
+    // index is consulted on every use, so it can be withdrawn.
+    const token = jwt.sign({type: PREVIEW_TOKEN_TYPE, jti: id, urlPath}, {expiresIn: seconds});
+
+    const links = await readStore();
+    links.push({
+        id, urlPath, label: String(label || '').slice(0, 200),
+        createdBy, createdByName: String(createdByName || '').slice(0, 120),
+        createdAt, expiresAt, revokedAt: null, lastUsedAt: null, useCount: 0
+    });
+    await writeStore(links);
+
+    return {id, token, urlPath, expiresAt, label};
+}
+
+/**
+ * List links, newest first. Optionally filtered to one page.
+ *
+ * @param {string} [urlPath]
+ * @returns {Promise<object[]>}
+ */
+export async function listPreviewLinks(urlPath) {
+    const links = await readStore();
+    const filtered = urlPath ? links.filter(l => l.urlPath === urlPath) : links;
+    return filtered
+        .map(l => ({...l, expired: new Date(l.expiresAt).getTime() <= Date.now()}))
+        .sort((a, b) => String(b.createdAt).localeCompare(String(a.createdAt)));
+}
+
+/**
+ * Revoke a link. Idempotent; returns false when the id is unknown.
+ *
+ * @param {string} id
+ * @returns {Promise<boolean>}
+ */
+export async function revokePreviewLink(id) {
+    const links = await readStore();
+    const link = links.find(l => l.id === id);
+    if (!link) return false;
+    link.revokedAt = link.revokedAt || new Date().toISOString();
+    await writeStore(links);
+    return true;
+}
+
+/**
+ * Verify a share token and return the page it unlocks.
+ *
+ * Every check is a separate reason to refuse: a bad signature, the wrong token
+ * type (an access token must not double as a share link, nor the reverse), an
+ * expired `exp`, an unknown `jti`, a revoked record, an index expiry that has
+ * passed, or a token whose `urlPath` no longer matches the record it names.
+ *
+ * @param {string} token
+ * @param {object} jwt - fastify.jwt
+ * @returns {Promise<{urlPath: string, id: string, expiresAt: string, label: string}|null>}
+ */
+export async function verifyPreviewToken(token, jwt) {
+    if (!token || typeof token !== 'string') return null;
+
+    let payload;
+    try {
+        payload = jwt.verify(token);
+    } catch {
+        return null;
+    }
+    if (payload?.type !== PREVIEW_TOKEN_TYPE || !payload.jti || !payload.urlPath) return null;
+
+    const links = await readStore();
+    const link = links.find(l => l.id === payload.jti);
+    if (!link) return null;
+    if (link.revokedAt) return null;
+    if (link.urlPath !== payload.urlPath) return null;
+    if (new Date(link.expiresAt).getTime() <= Date.now()) return null;
+
+    return {urlPath: link.urlPath, id: link.id, expiresAt: link.expiresAt, label: link.label || ''};
+}
+
+/**
+ * Record a use of a link. Best-effort - a failure to write the counter must
+ * never deny an otherwise valid preview.
+ *
+ * @param {string} id
+ * @returns {Promise<void>}
+ */
+export async function touchPreviewLink(id) {
+    try {
+        const links = await readStore();
+        const link = links.find(l => l.id === id);
+        if (!link) return;
+        link.lastUsedAt = new Date().toISOString();
+        link.useCount = (link.useCount || 0) + 1;
+        await writeStore(links);
+    } catch { /* counters are not load-bearing */ }
+}
+
+/**
+ * Drop every link for a page - used when the page is deleted or renamed, so a
+ * link cannot outlive the thing it pointed at.
+ *
+ * @param {string} urlPath
+ * @returns {Promise<number>} how many were removed
+ */
+export async function deletePreviewLinksForPage(urlPath) {
+    const links = await readStore();
+    const remaining = links.filter(l => l.urlPath !== urlPath);
+    const removed = links.length - remaining.length;
+    if (removed) await writeStore(remaining);
+    return removed;
+}
+
+/** Absolute path of the backing store - exported for tests. */
+export const storePath = STORE_PATH;

package/server/services/renderer.js

@@ -449,46 +449,43 @@ function buildSeoTags({page, site, baseUrl, seoTitle, seoDescription, ogImage})
  * never with the session cookie - keeping every state-changing call
  * explicitly credentialled and the cookie free of write authority.
  *
- * @param {{status?: string, urlPath?: string, user?: object|null}} preview
+ * A share-link view (`preview.shared`) gets a different bar: its reader has no
+ * account, so Edit and Publish would only be doors they cannot open. They get
+ * the expiry instead, which is the thing they actually need to know.
+ *
+ * @param {{status?: string, urlPath?: string, user?: object|null,
+ *          shared?: {expiresAt?: string, label?: string}}} preview
  * @returns {string}
  */
 function buildDraftBanner(preview) {
     const urlPath  = preview.urlPath || '/';
     const status   = preview.status || 'draft';
     const user     = preview.user || {};
+    const shared   = preview.shared || null;
     const who      = escapeHtml(user.name || user.email || 'an authorised user');
     const role     = escapeHtml(user.role || '');
     const editHref = '/admin/#/pages/edit' + escapeHtml(urlPath);
     const pathAttr = escapeHtml(urlPath);
-    const label    = escapeHtml(status.charAt(0).toUpperCase() + status.slice(1));
+    const label    = escapeHtml(shared ? 'Preview' : status.charAt(0).toUpperCase() + status.slice(1));
 
-    return `<div id="dm-draft-banner" role="status" aria-live="polite" data-url-path="${pathAttr}">
-<style>
-#dm-draft-banner{position:fixed;left:0;right:0;bottom:0;z-index:2147483000;display:flex;align-items:center;gap:.75rem;flex-wrap:wrap;
-padding:.6rem .9rem;font:500 .8125rem/1.4 system-ui,-apple-system,"Segoe UI",sans-serif;color:#1c1601;
-background:repeating-linear-gradient(135deg,#ffcf33,#ffcf33 14px,#f5b800 14px,#f5b800 28px);box-shadow:0 -2px 12px rgba(0,0,0,.28)}
-#dm-draft-banner[hidden]{display:none}
-#dm-draft-banner .dmdb-pill{flex:none;padding:.2rem .55rem;border-radius:999px;background:#1c1601;color:#ffcf33;
-font-weight:700;font-size:.6875rem;letter-spacing:.08em;text-transform:uppercase}
-#dm-draft-banner .dmdb-text{flex:1 1 16rem;min-width:0}
-#dm-draft-banner .dmdb-actions{flex:none;display:flex;align-items:center;gap:.4rem}
-#dm-draft-banner button,#dm-draft-banner a.dmdb-btn{font:inherit;cursor:pointer;border:1px solid rgba(28,22,1,.45);
-border-radius:.3rem;padding:.3rem .7rem;background:rgba(255,255,255,.55);color:#1c1601;text-decoration:none}
-#dm-draft-banner button:hover,#dm-draft-banner a.dmdb-btn:hover{background:#fff}
-#dm-draft-banner button[disabled]{opacity:.55;cursor:default}
-#dm-draft-banner .dmdb-publish{background:#1c1601;color:#ffcf33;border-color:#1c1601}
-#dm-draft-banner .dmdb-publish:hover{background:#000;color:#ffe27a}
-#dm-draft-banner .dmdb-close{padding:.2rem .5rem;line-height:1;font-size:1rem;background:transparent;border-color:transparent}
-@media print{#dm-draft-banner{display:none}}
-</style>
-<span class="dmdb-pill">${label}</span>
-<span class="dmdb-text">Not published - the public gets a 404 here. You can see it because you are signed in as <strong>${who}</strong>${role ? ` (${role})` : ''}.</span>
-<span class="dmdb-actions">
-<a class="dmdb-btn" href="${editHref}">Edit page</a>
-<button type="button" class="dmdb-publish" data-dmdb-publish>Publish</button>
-<button type="button" class="dmdb-close" data-dmdb-close aria-label="Hide draft banner" title="Hide">&times;</button>
-</span>
-<script>
+    const message = shared
+        ? `Shared preview of an unpublished page.${formatExpiry(shared.expiresAt)} It is not visible to the public.`
+        : `Not published - the public gets a 404 here. You can see it because you are signed in as <strong>${who}</strong>${role ? ` (${role})` : ''}.`;
+
+    const actions = shared
+        ? ''
+        : `<a class="dmdb-btn" href="${editHref}">Edit page</a>
+<button type="button" class="dmdb-publish" data-dmdb-publish>Publish</button>`;
+
+    const script = shared
+        ? `<script>
+(function(){
+  var bar = document.getElementById('dm-draft-banner');
+  if (!bar) return;
+  bar.querySelector('[data-dmdb-close]').addEventListener('click', function(){ bar.hidden = true; });
+})();
+</script>`
+        : `<script>
 (function(){
   var bar = document.getElementById('dm-draft-banner');
   if (!bar) return;
@@ -501,7 +498,7 @@ border-radius:.3rem;padding:.3rem .7rem;background:rgba(255,255,255,.55);color:#
     if (!token) { window.location.href = '/admin/'; return; }
     if (!window.confirm('Publish this page? It becomes visible to everyone.')) return;
     btn.disabled = true;
-    btn.textContent = 'Publishing…';
+    btn.textContent = 'Publishing\u2026';
     fetch('/api/pages' + path, {
       method: 'PUT',
       headers: {'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token},
@@ -516,10 +513,51 @@ border-radius:.3rem;padding:.3rem .7rem;background:rgba(255,255,255,.55);color:#
     });
   });
 })();
-</script>
+</script>`;
+
+    return `<div id="dm-draft-banner" role="status" aria-live="polite" data-url-path="${pathAttr}">
+<style>
+#dm-draft-banner{position:fixed;left:0;right:0;bottom:0;z-index:2147483000;display:flex;align-items:center;gap:.75rem;flex-wrap:wrap;
+padding:.6rem .9rem;font:500 .8125rem/1.4 system-ui,-apple-system,"Segoe UI",sans-serif;color:#1c1601;
+background:repeating-linear-gradient(135deg,#ffcf33,#ffcf33 14px,#f5b800 14px,#f5b800 28px);box-shadow:0 -2px 12px rgba(0,0,0,.28)}
+#dm-draft-banner[hidden]{display:none}
+#dm-draft-banner .dmdb-pill{flex:none;padding:.2rem .55rem;border-radius:999px;background:#1c1601;color:#ffcf33;
+font-weight:700;font-size:.6875rem;letter-spacing:.08em;text-transform:uppercase}
+#dm-draft-banner .dmdb-text{flex:1 1 16rem;min-width:0}
+#dm-draft-banner .dmdb-actions{flex:none;display:flex;align-items:center;gap:.4rem}
+#dm-draft-banner button,#dm-draft-banner a.dmdb-btn{font:inherit;cursor:pointer;border:1px solid rgba(28,22,1,.45);
+border-radius:.3rem;padding:.3rem .7rem;background:rgba(255,255,255,.55);color:#1c1601;text-decoration:none}
+#dm-draft-banner button:hover,#dm-draft-banner a.dmdb-btn:hover{background:#fff}
+#dm-draft-banner button[disabled]{opacity:.55;cursor:default}
+#dm-draft-banner .dmdb-publish{background:#1c1601;color:#ffcf33;border-color:#1c1601}
+#dm-draft-banner .dmdb-publish:hover{background:#000;color:#ffe27a}
+#dm-draft-banner .dmdb-close{padding:.2rem .5rem;line-height:1;font-size:1rem;background:transparent;border-color:transparent}
+@media print{#dm-draft-banner{display:none}}
+</style>
+<span class="dmdb-pill">${label}</span>
+<span class="dmdb-text">${message}</span>
+<span class="dmdb-actions">
+${actions}
+<button type="button" class="dmdb-close" data-dmdb-close aria-label="Hide preview banner" title="Hide">&times;</button>
+</span>
+${script}
 </div>`;
 }
 
+/**
+ * Render a share link's expiry as a sentence fragment, or '' when unknown.
+ *
+ * @param {string} [iso]
+ * @returns {string}
+ */
+function formatExpiry(iso) {
+    if (!iso) return '';
+    const when = new Date(iso);
+    if (Number.isNaN(when.getTime())) return '';
+    const opts = {day: 'numeric', month: 'short', year: 'numeric', hour: '2-digit', minute: '2-digit'};
+    return ` This link expires ${escapeHtml(when.toLocaleString('en-GB', opts))}.`;
+}
+
 function escapeHtml(str) {
     return String(str)
         .replace(/&/g, '&amp;')