domma-cms 0.54.2 → 0.66.0

package/server/routes/public.js

@@ -18,6 +18,7 @@ import {getEffectiveRoles} from '../services/userRoles.js';
 import {hooks} from '../services/hooks.js';
 import {getConfig} from '../config.js';
 import * as cache from '../services/cache/index.js';
+import {createHash} from 'crypto';
 
 /**
  * Derive the absolute origin for the current request.
@@ -55,6 +56,40 @@ function escapeHtml(str) {
         .replace(/'/g, ''');
 }
 
+/*
+ * Send an HTML page with headers that make a browser CHECK before reusing it.
+ *
+ * Public pages went out with no Cache-Control, no ETag and no Last-Modified at
+ * all. With nothing to go on a browser applies heuristic caching, so an edited
+ * page could keep showing the old content on a normal refresh - the server was
+ * serving the new one the whole time. That is indistinguishable from a CMS bug
+ * and was reported as one.
+ *
+ * `no-cache` does not mean "do not store": it means store it, then revalidate
+ * before every reuse. Paired with an ETag that makes the common case a 304 with
+ * no body rather than a full re-download.
+ *
+ * `private` because these responses are role-dependent - the response cache
+ * keys on role for exactly that reason - and a shared proxy must never hand one
+ * visitor a page rendered for another's permissions.
+ */
+function sendHtml(request, reply, html) {
+    const etag = `"${createHash('sha1').update(html).digest('base64')}"`;
+    reply.header('cache-control', 'private, no-cache');
+    reply.header('etag', etag);
+
+    // If-None-Match may carry a list, and a weak validator's W/ prefix.
+    const seen = String(request.headers['if-none-match'] || '')
+        .split(',')
+        .map((t) => t.trim().replace(/^W\//, ''));
+    if (seen.includes(etag)) return reply.code(304).send();
+
+    // Deliberately no reply.code() here: the 404 handlers have already called
+    // reply.status(404), and forcing 200 would turn every not-found into a
+    // soft 404 that search engines index as a real page.
+    return reply.type('text/html').send(html);
+}
+
 export async function publicRoutes(fastify) {
     // Admin panel: serve index.html for all /admin/* paths (SPA fallback)
     fastify.get('/admin', async (request, reply) => {
@@ -104,13 +139,13 @@ export async function publicRoutes(fastify) {
         const link = await verifyPreviewToken((request.query || {}).token, fastify.jwt);
         if (!link) {
             reply.status(404);
-            return reply.type('text/html').send(await render404('/_preview'));
+            return sendHtml(request, reply, await render404('/_preview'));
         }
 
         const page = await getPage(link.urlPath);
         if (!page) {
             reply.status(404);
-            return reply.type('text/html').send(await render404(link.urlPath));
+            return sendHtml(request, reply, await render404(link.urlPath));
         }
 
         // A disabled project stays a hard kill switch. A share link narrows who
@@ -118,7 +153,7 @@ export async function publicRoutes(fastify) {
         const project = await getProjectForPage(page.urlPath || link.urlPath, page.project);
         if (!(await isProjectEnabled(project))) {
             reply.status(404);
-            return reply.type('text/html').send(await render404(link.urlPath));
+            return sendHtml(request, reply, await render404(link.urlPath));
         }
 
         // Rendered as anonymous on purpose: the recipient has no account, so
@@ -161,7 +196,7 @@ export async function publicRoutes(fastify) {
 
         if (!page) {
             reply.status(404);
-            return reply.type('text/html').send(await render404(urlPath));
+            return sendHtml(request, reply, await render404(urlPath));
         }
 
         // Hard kill-switch: a disabled project takes its pages off the public
@@ -169,7 +204,7 @@ export async function publicRoutes(fastify) {
         const pageProject = await getProjectForPage(page.urlPath || urlPath, page.project);
         if (!(await isProjectEnabled(pageProject))) {
             reply.status(404);
-            return reply.type('text/html').send(await render404(urlPath));
+            return sendHtml(request, reply, await render404(urlPath));
         }
 
         // Draft preview: a page that is not published stays invisible to the
@@ -209,7 +244,7 @@ export async function publicRoutes(fastify) {
 
         if (isDraft && !canPreviewDrafts(userObj)) {
             reply.status(404);
-            return reply.type('text/html').send(await render404(urlPath));
+            return sendHtml(request, reply, await render404(urlPath));
         }
 
         if (!isPublic && !checkVisibility(userObj, vis)) {
@@ -249,7 +284,7 @@ export async function publicRoutes(fastify) {
         const cacheTags = [`page:${urlPath}`, ...(page.cacheTags || []), 'nav', 'site'];
         const html = await cache.wrap(cacheKey, render, {tags: cacheTags});
         hooks.emit('content:pageViewed', {urlPath, title: page.title || ''});
-        return reply.type('text/html').send(html);
+        return sendHtml(request, reply, html);
     });
 }
 

package/server/server.js

@@ -218,6 +218,29 @@ await refreshComponentTagAllowlist();
 // Menus - one-shot migration from legacy navigation.json + site footer links
 // ---------------------------------------------------------------------------
 
+// ---------------------------------------------------------------------------
+// Theme - one-shot lift of the theme keys out of site.json into theme.json
+// ---------------------------------------------------------------------------
+
+try {
+    const {migrateThemeConfig} = await import('./services/themeSettings.js');
+    if (await migrateThemeConfig()) app.log.info('[theme] Migrated theme settings into config/theme.json');
+} catch (err) {
+    app.log.warn(`[theme] Migration skipped: ${err.message}`);
+}
+
+// ---------------------------------------------------------------------------
+// Search - one-shot retirement of the site-search plugin (settings + files)
+// ---------------------------------------------------------------------------
+
+try {
+    const {migrateSiteSearchPlugin} = await import('./services/search-migration.js');
+    const changes = migrateSiteSearchPlugin();
+    if (changes.length) app.log.info(`[search] Migrated from the site-search plugin: ${changes.join(', ')}`);
+} catch (err) {
+    app.log.warn(`[search] Migration skipped: ${err.message}`);
+}
+
 try {
     const {runMigration: runMenusMigration} = await import('./services/menus-migration.js');
     await runMenusMigration();
@@ -237,6 +260,18 @@ try {
         groupText: 'Data',
         item: {text: 'API Builder', url: '#/api-endpoints', icon: 'code', permission: 'api-endpoints'}
     });
+    await ensureSidebarItem({
+        groupText: 'Content',
+        item: {text: 'Context Menus', url: '#/context-menus', icon: 'menu', permission: 'context-menus'}
+    });
+    await ensureSidebarItem({
+        groupText: 'Content',
+        item: {text: 'Theme', url: '#/theme', icon: 'droplet', permission: 'theme'}
+    });
+    await ensureSidebarItem({
+        groupText: 'System',
+        item: {text: 'Search', url: '#/search', icon: 'search', permission: 'settings'}
+    });
     // Restructure Documentation: Tutorials → submenu, add Components reference set.
     await ensureDocumentationSubmenus();
 } catch (err) {
@@ -245,6 +280,39 @@ try {
 
 // Initialise response cache (Memory/None/Redis driver per config.cache).
 await cache.initCache(config.cache);
+
+/*
+ * An admin change clears the response cache.
+ *
+ * Every service that mutates something is meant to invalidate the tags its
+ * change affects, and mostly they do - but a miss is INVISIBLE. The cache is
+ * off in development and on in production, so a missed invalidation works
+ * perfectly on the machine it was written on and serves stale HTML live until
+ * the TTL expires an hour later. Context menus shipped that way for three
+ * releases: the call named a function the cache module does not export AND a
+ * tag nothing is ever stored with, and a try/catch ate the evidence.
+ *
+ * This is the safety net, not the mechanism. The targeted invalidations stay -
+ * they are what stops one collection edit clearing every unrelated page - and
+ * this catches whatever they missed.
+ *
+ * Scoped to AUTHENTICATED mutations on purpose. A public form submission is
+ * not an admin change, and clearing on each of those would cold-start the
+ * cache on a busy site; entry writes already invalidate their own collection
+ * tag. Runs on onResponse, after the reply has gone, so it costs the caller
+ * nothing - and a memory-driver clear is two Map resets.
+ */
+const CACHE_CLEARING_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+app.addHook('onResponse', async (request, reply) => {
+    if (!CACHE_CLEARING_METHODS.has(request.method)) return;
+    if (reply.statusCode >= 400) return;
+    if (!request.user) return;
+    try {
+        await cache.clear();
+    } catch (err) {
+        app.log.warn(`[cache] Admin change did not clear the cache: ${err.message}`);
+    }
+});
 console.log(`[cache] driver=${cache.isEnabled() ? config.cache.driver : 'disabled'}`);
 
 // Docs are rendered at request time from the shipped admin templates; clear any
@@ -332,9 +400,11 @@ await app.register(authRoutes, { prefix: '/api' });
 
 const { pagesRoutes }      = await import('./routes/api/pages.js');
 const { settingsRoutes }   = await import('./routes/api/settings.js');
+const { themeRoutes }      = await import('./routes/api/theme.js');
 const { layoutsRoutes }    = await import('./routes/api/layouts.js');
 const { navigationRoutes } = await import('./routes/api/navigation.js');
 const {menusRoutes}         = await import('./routes/api/menus.js');
+const {contextMenusRoutes}  = await import('./routes/api/context-menus.js');
 const {menuLocationsRoutes} = await import('./routes/api/menu-locations.js');
 const {projectsRoutes}      = await import('./routes/api/projects.js');
 const {apiTokensRoutes}     = await import('./routes/api/api-tokens.js');
@@ -353,6 +423,7 @@ const {blocksRoutes} = await import('./routes/api/blocks.js');
 const {componentsRoutes} = await import('./routes/api/components.js');
 const {versionsRoutes} = await import('./routes/api/versions.js');
 const {effectsRoutes} = await import('./routes/api/effects.js');
+const {searchRoutes} = await import('./routes/api/search.js');
 const {notificationsRoutes} = await import('./routes/api/notifications.js');
 const {dashboardRoutes} = await import('./routes/api/dashboard.js');
 const {cacheRoutes} = await import('./routes/api/cache.js');
@@ -363,6 +434,8 @@ await app.register(settingsRoutes,    { prefix: '/api' });
 await app.register(layoutsRoutes,     { prefix: '/api' });
 await app.register(navigationRoutes,  { prefix: '/api' });
 await app.register(menusRoutes,         {prefix: '/api'});
+await app.register(contextMenusRoutes,  {prefix: '/api'});
+await app.register(themeRoutes,         {prefix: '/api'});
 await app.register(menuLocationsRoutes, {prefix: '/api'});
 await app.register(projectsRoutes,      {prefix: '/api'});
 await app.register(apiTokensRoutes,     {prefix: '/api'});
@@ -381,6 +454,7 @@ await app.register(blocksRoutes, {prefix: '/api'});
 await app.register(componentsRoutes, {prefix: '/api'});
 await app.register(versionsRoutes, {prefix: '/api'});
 await app.register(effectsRoutes, {prefix: '/api'});
+await app.register(searchRoutes, {prefix: '/api'});
 await app.register(notificationsRoutes, {prefix: '/api'});
 await app.register(dashboardRoutes, {prefix: '/api'});
 await app.register(cacheRoutes, {prefix: '/api'});

package/server/services/adapters/FileAdapter.js

@@ -86,7 +86,12 @@ export class FileAdapter {
         entries.sort((a, b) => {
             const aVal = sort === 'createdAt' ? a.meta?.createdAt : (a.data?.[sort] ?? '');
             const bVal = sort === 'createdAt' ? b.meta?.createdAt : (b.data?.[sort] ?? '');
-            const cmp  = String(aVal).localeCompare(String(bVal));
+            // Numeric collation, because a plain string compare orders a number
+            // field 1, 10, 11, 2 - so any collection sorted by `order` scrambles
+            // itself the moment it has ten entries. MongoAdapter sorts natively
+            // and has always ordered these correctly, so this also stops the two
+            // adapters disagreeing about the same data.
+            const cmp  = String(aVal).localeCompare(String(bVal), undefined, {numeric: true});
             return order === 'desc' ? -cmp : cmp;
         });
 

package/server/services/content.js

@@ -122,6 +122,25 @@ export async function buildPreviewPage(urlPath, frontmatter, body, opts = {}) {
  * @param {string} body
  * @returns {Promise<object>}
  */
+/**
+ * Keep a page's tag list to actual tags.
+ *
+ * An empty tag input has a way of arriving as `[null]` - which is an array,
+ * passes every `Array.isArray` guard, and then throws the moment anything
+ * calls a string method on the contents. It reached disk on dozens of pages
+ * and took the whole of site search down with it, so it is cleaned on the way
+ * IN rather than defended against at each of the places that read it.
+ *
+ * @param   {unknown} tags
+ * @returns {string[]}
+ */
+function cleanTags(tags) {
+    if (!Array.isArray(tags)) return [];
+    return [...new Set(
+        tags.filter(tag => typeof tag === 'string' && tag.trim()).map(tag => tag.trim())
+    )];
+}
+
 export async function createPage(urlPath, frontmatter, body) {
     const filePath = urlPathToFilePath(urlPath);
     await fs.mkdir(path.dirname(filePath), { recursive: true });
@@ -138,6 +157,7 @@ export async function createPage(urlPath, frontmatter, body) {
         sortOrder: frontmatter.sortOrder ?? defaults.sortOrder,
         showInNav: frontmatter.showInNav ?? false,
         sidebar: frontmatter.sidebar ?? false,
+        tags: cleanTags(frontmatter.tags),
         seo: frontmatter.seo || {},
         dconfig: frontmatter.dconfig || null,
         createdAt: now,
@@ -172,6 +192,12 @@ export async function updatePage(urlPath, frontmatter, body, {author} = {}) {
         updatedAt: new Date().toISOString()
     };
 
+    // Cleaned on every save, so an existing page carrying `[null]` is repaired
+    // the next time anyone touches it rather than staying broken for ever.
+    // Only when tags are part of this save: a caller that sends no tags is not
+    // asking for the page's tags to be emptied.
+    if ('tags' in meta) meta.tags = cleanTags(meta.tags);
+
     if (existingMeta.createdAt) meta.createdAt = existingMeta.createdAt;
 
     // '' is the editor's "inherit by rootUrl" choice - drop the key so the