domma-cms 0.55.1 → 0.66.0

package/server/routes/api/collections.js

@@ -359,6 +359,40 @@ export async function collectionsRoutes(fastify) {
         }
     });
 
+    /*
+     * Flag one entry as spam without disturbing the rest of it.
+     *
+     * `updateEntry` REPLACES `data` wholesale, so the obvious client-side PUT
+     * of {spam: true} would wipe every other field on the record. The merge
+     * has to happen server-side, which is the whole reason this endpoint
+     * exists rather than the context menu calling the generic update route.
+     *
+     * The field defaults to `spam` and need not be declared in the schema -
+     * validateEntryData only checks required fields, so an undeclared key is
+     * carried through untouched. Guarded by the same collections.update
+     * permission as any other write, so a public visitor cannot reach it.
+     */
+    fastify.post('/collections/:slug/entries/:id/spam', canUpdate, async (request, reply) => {
+        const {slug, id} = request.params;
+        const field = typeof request.body?.field === 'string' && request.body.field.trim()
+            ? request.body.field.trim()
+            : 'spam';
+        const value = request.body?.spam === false ? false : true;
+        try {
+            const existing = await getEntry(slug, id);
+            if (!existing) return reply.code(404).send({error: 'Entry not found'});
+
+            const entry = await updateEntry(slug, id, {...(existing.data || {}), [field]: value});
+            hooks.emit('collection:entryUpdated', {
+                slug, entryId: entry.id, data: entry.data, userId: request.user?.id || null
+            });
+            return {entry, field, spam: value};
+        } catch (err) {
+            const code = /not found/i.test(err.message) ? 404 : 400;
+            return reply.code(code).send({error: err.message});
+        }
+    });
+
     fastify.put('/collections/:slug/entries/:id', canUpdate, async (request, reply) => {
         try {
             const entry = await updateEntry(request.params.slug, request.params.id, request.body?.data || {});

package/server/routes/api/context-menus.js

@@ -0,0 +1,104 @@
+/**
+ * Context menus API
+ *
+ * GET    /api/context-menus                  - list (metadata only)
+ * GET    /api/context-menus/:slug            - full menu
+ * POST   /api/context-menus                  - create
+ * PUT    /api/context-menus/:slug            - replace
+ * DELETE /api/context-menus/:slug            - delete
+ * POST   /api/context-menus/:slug/duplicate  - copy as <slug>-copy
+ *
+ * Auth middlewares are accepted as options so tests can supply no-ops without
+ * needing @fastify/jwt and a seeded roles cache - the same DI pattern as
+ * menus.js and projects.js.
+ */
+import {
+    authenticate as defaultAuthenticate,
+    requirePermission as defaultRequirePermission
+} from '../../middleware/auth.js';
+import {
+    ACTION_TYPES,
+    createContextMenu,
+    deleteContextMenu,
+    duplicateContextMenu,
+    getContextMenu,
+    listContextMenus,
+    updateContextMenu
+} from '../../services/contextMenus.js';
+
+export async function contextMenusRoutes(fastify, opts = {}) {
+    const authenticate      = opts.authenticate      || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+
+    const canRead   = {preHandler: [authenticate, requirePermission('context-menus', 'read')]};
+    const canCreate = {preHandler: [authenticate, requirePermission('context-menus', 'create')]};
+    const canUpdate = {preHandler: [authenticate, requirePermission('context-menus', 'update')]};
+    const canDelete = {preHandler: [authenticate, requirePermission('context-menus', 'delete')]};
+
+    // The editor builds its action picker from this rather than hardcoding a
+    // list that would drift from the server's validation.
+    fastify.get('/context-menus/action-types', canRead, async () => [...ACTION_TYPES]);
+
+    fastify.get('/context-menus', canRead, async (request) => {
+        const {canSeeArtefact} = await import('../../services/projects.js');
+        const all = await listContextMenus();
+        return all.filter((m) => canSeeArtefact(request.user, m));
+    });
+
+    fastify.get('/context-menus/:slug', canRead, async (request, reply) => {
+        const menu = await getContextMenu(request.params.slug);
+        if (!menu) return reply.code(404).send({error: 'Context menu not found'});
+
+        const {canSeeArtefact} = await import('../../services/projects.js');
+        if (!canSeeArtefact(request.user, menu)) {
+            return reply.code(403).send({error: 'Outside your project scope'});
+        }
+        return menu;
+    });
+
+    fastify.post('/context-menus', canCreate, async (request, reply) => {
+        try {
+            return await createContextMenu(request.body || {});
+        } catch (err) {
+            // Validation and collision are both the caller's fault, and the
+            // message already names the field - passing it through is what
+            // makes the editor able to show it.
+            return reply.code(400).send({error: err.message});
+        }
+    });
+
+    fastify.put('/context-menus/:slug', canUpdate, async (request, reply) => {
+        const existing = await getContextMenu(request.params.slug);
+        if (!existing) return reply.code(404).send({error: 'Context menu not found'});
+
+        const {canSeeArtefact} = await import('../../services/projects.js');
+        if (!canSeeArtefact(request.user, existing)) {
+            return reply.code(403).send({error: 'Outside your project scope'});
+        }
+        try {
+            return await updateContextMenu(request.params.slug, request.body || {});
+        } catch (err) {
+            return reply.code(400).send({error: err.message});
+        }
+    });
+
+    fastify.delete('/context-menus/:slug', canDelete, async (request, reply) => {
+        const existing = await getContextMenu(request.params.slug);
+        if (!existing) return reply.code(404).send({error: 'Context menu not found'});
+
+        const {canSeeArtefact} = await import('../../services/projects.js');
+        if (!canSeeArtefact(request.user, existing)) {
+            return reply.code(403).send({error: 'Outside your project scope'});
+        }
+        await deleteContextMenu(request.params.slug);
+        return {deleted: true};
+    });
+
+    fastify.post('/context-menus/:slug/duplicate', canCreate, async (request, reply) => {
+        try {
+            return await duplicateContextMenu(request.params.slug);
+        } catch (err) {
+            return reply.code(400).send({error: err.message});
+        }
+    });
+}

package/server/routes/api/forms.js

@@ -578,6 +578,24 @@ export async function formsRoutes(fastify) {
             formValues[field.name] = val !== undefined ? (typeof val === 'string' ? val.trim() : val) : '';
         }
 
+        // Triggers, from the same engine the browser ran. A block-submit that
+        // only existed in the browser would be a suggestion: anyone can re-enable
+        // a button. Resolved BEFORE the field pass because a trigger decides
+        // which fields are in play at all.
+        const triggerState = FormLogicEngine.resolveTriggerState(form.fields || [], formValues);
+
+        if (triggerState.blocks.length) {
+            return reply.status(400).send({
+                error: triggerState.blocks.map(b => b.message).join(' ')
+            });
+        }
+
+        // Hidden and disabled are the same thing to a submission: the visitor
+        // was given no way to answer, so the answer is not theirs and is not
+        // required. A value posted for one anyway is dropped below.
+        const triggerOff = new Set([...triggerState.hidden, ...triggerState.disabled]);
+        const triggerRequired = new Set(triggerState.required);
+
         // Evaluate conditional logic
         const missingFields    = [];
         const validationErrors = [];
@@ -587,11 +605,13 @@ export async function formsRoutes(fastify) {
             if (field.type === 'page-break' || field.type === 'spacer') continue;
             const vis = FormLogicEngine.evaluateFieldVisibility(field, formValues);
             if (vis === 'hidden') continue;
+            if (triggerOff.has(field.name)) continue;
             visibleFieldNames.add(field.name);
 
             const value   = formValues[field.name];
             const isEmpty = !value?.toString().trim();
-            const required = FormLogicEngine.evaluateFieldRequirement(field, formValues);
+            const required = FormLogicEngine.evaluateFieldRequirement(field, formValues)
+                || triggerRequired.has(field.name);
             if (required && isEmpty) {
                 missingFields.push(field.label || field.name);
             }
@@ -719,10 +739,29 @@ export async function formsRoutes(fastify) {
             }
         }
 
+        // Trigger events the server owns. Fired after the entry is stored, for
+        // the same reason the other actions are: a failed side effect must not
+        // cost the visitor their submission.
+        let triggerRedirect = null;
+        for (const event of triggerState.events) {
+            if (event.type === 'run-action' && event.action.slug && entry) {
+                try {
+                    await executeAction(event.action.slug, entry.id, {user: submittingUser});
+                } catch (err) {
+                    fastify.log.warn(`[forms] Trigger action "${event.action.slug}" failed for form "${slug}": ${err.message}`);
+                }
+            } else if (event.type === 'redirect' && event.action.url && !triggerRedirect) {
+                // First one wins - two triggers redirecting at once is an
+                // authoring mistake, not a case to resolve cleverly.
+                triggerRedirect = String(event.action.url);
+            }
+        }
+
         hooks.emit('form:submitted', {slug, entryId: entry?.id || null, data, formTitle: form.title});
 
-        // Template interpolation for successRedirect
-        let redirect = settings.successRedirect || null;
+        // Template interpolation for successRedirect. A trigger's redirect is
+        // the more specific instruction, so it wins over the form's default.
+        let redirect = triggerRedirect || settings.successRedirect || null;
         if (redirect && entry?.id) {
             redirect = redirect.replace(/\{\{entryId\}\}/g, entry.id);
         }

package/server/routes/api/notifications.js

@@ -7,13 +7,63 @@
  * POST   /api/system/notifications/:id/dismiss  - Mark dismissed
  * DELETE /api/system/notifications/:id          - Hard delete (admin only)
  */
-import { authenticate, requirePermission } from '../../middleware/auth.js';
+import {
+    authenticate as defaultAuthenticate,
+    requirePermission as defaultRequirePermission
+} from '../../middleware/auth.js';
 import { requireManager } from '../../middleware/managerAuth.js';
 import { getAdapter } from '../../services/adapterRegistry.js';
 
 const SLUG = 'notifications';
 
-export async function notificationsRoutes(fastify) {
+/** Ids already warned about, so one bad record does not fill the log. */
+const warnedMalformed = new Set();
+
+/**
+ * A notification's payload, or null when the record is not a notification.
+ *
+ * Entries are `{id, data, meta}`, but this collection has been written to
+ * directly before now - a form once pointed its submissions at `notifications`
+ * and left flat records behind with no `data` at all. Reading `entry.data.x`
+ * off one of those threw, and because the bell polls on every admin page load,
+ * a single stray record turned into a 500 on every screen in the admin. One
+ * unreadable row is skipped; it is not the rest of the inbox's problem.
+ *
+ * @param {object} entry
+ * @param {object} [log] - Fastify logger, when there is one to warn through.
+ * @returns {object|null}
+ */
+function notificationData(entry, log) {
+    const data = entry && entry.data;
+    if (data && typeof data === 'object') return data;
+    const id = entry?.id || '(no id)';
+    if (log && !warnedMalformed.has(id)) {
+        warnedMalformed.add(id);
+        log.warn(`[notifications] Skipping malformed entry "${id}" - no data object. `
+            + 'Something wrote to the notifications collection directly.');
+    }
+    return null;
+}
+
+/**
+ * Is this notification live for this user right now: not expired, not dismissed.
+ *
+ * @param {object} data - A notification payload.
+ * @param {string} userId
+ * @param {string} now - ISO timestamp.
+ * @returns {boolean}
+ */
+function isActiveFor(data, userId, now) {
+    if (data.expiresAt && data.expiresAt < now) return false;
+    return !(Array.isArray(data.dismissedBy) && data.dismissedBy.includes(userId));
+}
+
+export async function notificationsRoutes(fastify, opts = {}) {
+    // Injectable so tests can supply no-ops rather than a seeded roles cache -
+    // the same DI pattern as menus.js, projects.js and context-menus.js.
+    const authenticate      = opts.authenticate      || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+
     const canRead   = { preHandler: [authenticate, requirePermission('notifications', 'read')]   };
     const canDelete = { preHandler: [authenticate, requirePermission('notifications', 'delete')] };
 
@@ -69,14 +119,12 @@ export async function notificationsRoutes(fastify) {
 
         return all
             .filter(entry => {
-                const d = entry.data;
-                // Exclude expired
-                if (d.expiresAt && d.expiresAt < now) return false;
-                // Exclude dismissed by this user
-                if (Array.isArray(d.dismissedBy) && d.dismissedBy.includes(userId)) return false;
-                return true;
+                const d = notificationData(entry, fastify.log);
+                return !!d && isActiveFor(d, userId, now);
             })
-            .sort((a, b) => b.data.createdAt.localeCompare(a.data.createdAt))
+            // A record with no createdAt sorts last rather than taking the
+            // whole list down with it.
+            .sort((a, b) => String(b.data.createdAt || '').localeCompare(String(a.data.createdAt || '')))
             .map(entry => ({
                 ...entry,
                 unread: !Array.isArray(entry.data.readBy) || !entry.data.readBy.includes(userId)
@@ -91,9 +139,8 @@ export async function notificationsRoutes(fastify) {
         const all = await adapter.all(SLUG);
 
         const count = all.filter(entry => {
-            const d = entry.data;
-            if (d.expiresAt && d.expiresAt < now) return false;
-            if (Array.isArray(d.dismissedBy) && d.dismissedBy.includes(userId)) return false;
+            const d = notificationData(entry, fastify.log);
+            if (!d || !isActiveFor(d, userId, now)) return false;
             return !Array.isArray(d.readBy) || !d.readBy.includes(userId);
         }).length;
 
@@ -107,13 +154,15 @@ export async function notificationsRoutes(fastify) {
         const adapter = await getAdapter(SLUG);
         const entry = await adapter.get(SLUG, id);
 
-        if (!entry) return reply.code(404).send({ error: 'Notification not found.' });
+        const data = notificationData(entry, fastify.log);
+        // A record the list never showed is not one this route can mark read.
+        if (!data) return reply.code(404).send({ error: 'Notification not found.' });
 
-        const readBy = Array.isArray(entry.data.readBy) ? entry.data.readBy : [];
+        const readBy = Array.isArray(data.readBy) ? data.readBy : [];
         if (readBy.includes(userId)) return { ok: true }; // already read - idempotent
 
         const updated = await adapter.update(SLUG, id, {
-            ...entry.data,
+            ...data,
             readBy: [...readBy, userId]
         });
 
@@ -127,13 +176,14 @@ export async function notificationsRoutes(fastify) {
         const adapter = await getAdapter(SLUG);
         const entry = await adapter.get(SLUG, id);
 
-        if (!entry) return reply.code(404).send({ error: 'Notification not found.' });
+        const data = notificationData(entry, fastify.log);
+        if (!data) return reply.code(404).send({ error: 'Notification not found.' });
 
-        const dismissedBy = Array.isArray(entry.data.dismissedBy) ? entry.data.dismissedBy : [];
-        const readBy = Array.isArray(entry.data.readBy) ? entry.data.readBy : [];
+        const dismissedBy = Array.isArray(data.dismissedBy) ? data.dismissedBy : [];
+        const readBy = Array.isArray(data.readBy) ? data.readBy : [];
 
         const updated = await adapter.update(SLUG, id, {
-            ...entry.data,
+            ...data,
             dismissedBy: dismissedBy.includes(userId) ? dismissedBy : [...dismissedBy, userId],
             readBy: readBy.includes(userId) ? readBy : [...readBy, userId] // dismissing also marks read
         });

package/server/routes/api/plugins.js

@@ -12,10 +12,14 @@ import {
 import {
     discoverPlugins,
     getAdminPluginConfig,
+    getLoadedPlugins,
     getPluginStates,
+    isCorePlugin,
+    pluginLicence,
     runLifecycleHook,
     savePluginState
 } from '../../services/plugins.js';
+import {getEffectiveLevel} from '../../services/userRoles.js';
 import {scaffoldPlugin} from '../../services/pluginScaffold.js';
 import {deletePluginFile, listPluginFiles, readPluginFile, writePluginFile} from '../../services/pluginFiles.js';
 import {getConfig} from '../../config.js';
@@ -78,9 +82,10 @@ export async function pluginsRoutes(fastify, opts = {}) {
     const canDevelop = { preHandler: [authenticate, requirePermission('plugins', 'develop')] };
 
     // List all plugins with their current state
-    fastify.get('/plugins', canRead, async () => {
+    fastify.get('/plugins', canRead, async (request) => {
         const manifests = await discoverPlugins();
         const states = getPluginStates();
+        const loadedPlugins = getLoadedPlugins();
 
         return manifests.map(manifest => ({
             name: manifest.name,
@@ -90,8 +95,25 @@ export async function pluginsRoutes(fastify, opts = {}) {
             author: manifest.author || '',
             date: manifest.date || '',
             icon: manifest.icon || 'package',
-            enabled: !!(states[manifest.name]?.enabled),
+            // A core plugin runs whatever plugins.json says, so reporting its
+            // stored flag would show "Disabled" next to a feature that is
+            // plainly running. It is on because it is built in.
+            core: isCorePlugin(manifest.name),
+            enabled: isCorePlugin(manifest.name) || !!(states[manifest.name]?.enabled),
             bundled: !!(states[manifest.name]?.bundled),
+            // A licensed plugin is distributed to run, not to be read: the
+            // source endpoints refuse it (pluginFiles.isClosedSource). Sent so
+            // the screen can leave the Code button off rather than offer one
+            // that answers 403 - the refusal is the guard, not the UI.
+            closedSource: manifest.closedSource === true,
+            licence: pluginLicence(manifest),
+            // Whether the CODE button belongs on this viewer's card. Decided
+            // here rather than in the browser: it is the same answer the file
+            // endpoints will give, from the same two facts.
+            sourceEditable: manifest.closedSource !== true || mayEditLicensed(request),
+            // Enabled but displaced by another plugin that replaces it. Shown
+            // so the screen can explain the inactivity instead of looking broken.
+            supersededBy: loadedPlugins[manifest.name]?.supersededBy ?? null,
             settings: states[manifest.name]?.settings || {}
         }));
     });
@@ -119,6 +141,16 @@ export async function pluginsRoutes(fastify, opts = {}) {
         const manifest = manifests.find(m => m.name === name);
         if (!manifest) return reply.status(404).send({ error: 'Plugin not found' });
 
+        // A core plugin is a built-in feature, not an add-on. Refusing here
+        // rather than writing the flag and ignoring it keeps the stored state
+        // honest - otherwise plugins.json says disabled while the feature runs.
+        // Settings are still editable; only the on/off switch is not.
+        if (isCorePlugin(name) && enabled === false) {
+            return reply.status(409).send({
+                error: `${manifest.displayName || name} is a built-in feature and cannot be disabled.`
+            });
+        }
+
         const prevState = getPluginStates()[name] || {};
         const update = {};
         if (enabled !== undefined) update.enabled = !!enabled;
@@ -158,17 +190,29 @@ export async function pluginsRoutes(fastify, opts = {}) {
 
     const mapErr = (reply, err) => reply.status(err.statusCode || 500).send({ error: err.message });
 
+    /*
+     * May this request read a LICENSED plugin's source?
+     *
+     * Only a super-admin (level 0). On the fleet that role exists on the
+     * manager and nowhere else - every customer-site user is an admin, level 1
+     * - so this opens the source to the people who publish the paid plugins
+     * without opening it on the sites they are distributed to. Level rather
+     * than role name, the same way requireAdmin and canManageUser decide.
+     */
+    const mayEditLicensed = (request) => !!request.user && getEffectiveLevel(request.user) === 0;
+    const licensed = (request) => ({allowLicensed: mayEditLicensed(request)});
+
     // List a plugin's editable files
     fastify.get('/plugins/:name/files', canDevelop, async (request, reply) => {
         try {
-            return { files: await listPluginFiles(request.params.name) };
+            return { files: await listPluginFiles(request.params.name, licensed(request)) };
         } catch (err) { return mapErr(reply, err); }
     });
 
     // Read one file (?path=admin/views/index.js)
     fastify.get('/plugins/:name/file', canDevelop, async (request, reply) => {
         try {
-            return await readPluginFile(request.params.name, request.query.path);
+            return await readPluginFile(request.params.name, request.query.path, licensed(request));
         } catch (err) { return mapErr(reply, err); }
     });
 
@@ -176,7 +220,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
     fastify.put('/plugins/:name/file', canDevelop, async (request, reply) => {
         const { path: relPath, content } = request.body || {};
         try {
-            const result = await writePluginFile(request.params.name, relPath, content);
+            const result = await writePluginFile(request.params.name, relPath, content, licensed(request));
             return { success: true, ...result };
         } catch (err) { return mapErr(reply, err); }
     });
@@ -184,7 +228,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
     // Delete one file (?path=admin/views/extra.js)
     fastify.delete('/plugins/:name/file', canDevelop, async (request, reply) => {
         try {
-            const result = await deletePluginFile(request.params.name, request.query.path);
+            const result = await deletePluginFile(request.params.name, request.query.path, licensed(request));
             return { success: true, ...result };
         } catch (err) { return mapErr(reply, err); }
     });

package/server/routes/api/search.js

@@ -0,0 +1,43 @@
+/**
+ * Search API Routes
+ *
+ * GET  /api/search?q=…      - public: full-text search across published pages
+ * GET  /api/search/settings - public: the search UI's own configuration
+ * PUT  /api/search/settings - admin-only: save it
+ *
+ * The public settings endpoint is kept for anything already calling it (and
+ * for a page served from a cache older than the feature), but it is no longer
+ * on the critical path: the renderer embeds the same object in the page as
+ * `window.__CMS_SEARCH__`, so the overlay can draw itself without a round trip.
+ */
+import {authenticate, requireAdmin} from '../../middleware/auth.js';
+import {listPages} from '../../services/content.js';
+import {getSearchSettings, saveSearchSettings, searchPages} from '../../services/search.js';
+
+export async function searchRoutes(fastify) {
+    fastify.get('/search', async (request, reply) => {
+        const settings = getSearchSettings();
+        const q = (request.query.q || '').trim();
+
+        if (q.length < settings.minQueryLength) {
+            return reply.status(400).send({
+                error: `Query must be at least ${settings.minQueryLength} characters`
+            });
+        }
+
+        const pages = await listPages();
+        const results = searchPages(pages, q, {
+            maxResults: settings.maxResults,
+            onError: (err, page) =>
+                request.log.warn({err, page: page.urlPath}, '[search] skipped an unreadable page')
+        });
+
+        return {results};
+    });
+
+    fastify.get('/search/settings', async () => getSearchSettings());
+
+    fastify.put('/search/settings', {preHandler: [authenticate, requireAdmin]}, async (request) => {
+        return {ok: true, settings: saveSearchSettings(request.body || {})};
+    });
+}

package/server/routes/api/theme.js

@@ -0,0 +1,69 @@
+/**
+ * Theme API
+ *
+ * GET  /api/theme          - the theme config (themes, fonts, overrides)
+ * PUT  /api/theme          - replace it
+ * GET  /api/theme/catalog  - theme ids and --dm-* token names the shipped
+ *                            stylesheet actually defines
+ * POST /api/theme/compile  - compile a candidate config to CSS without saving,
+ *                            so the admin previews exactly what the page gets
+ *
+ * Auth middlewares are injectable so tests can pass no-ops, the same DI pattern
+ * as menus.js and context-menus.js.
+ */
+import {
+    authenticate as defaultAuthenticate,
+    requirePermission as defaultRequirePermission
+} from '../../middleware/auth.js';
+import {
+    compileOverrideCss,
+    getThemeTokenMap,
+    listThemeIds,
+    listThemeTokens,
+    loadThemeConfig,
+    saveThemeConfig,
+    validateThemeConfig
+} from '../../services/themeSettings.js';
+
+export async function themeRoutes(fastify, opts = {}) {
+    const authenticate      = opts.authenticate      || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+
+    const canRead   = {preHandler: [authenticate, requirePermission('theme', 'read')]};
+    const canUpdate = {preHandler: [authenticate, requirePermission('theme', 'update')]};
+
+    fastify.get('/theme', canRead, async () => loadThemeConfig());
+
+    // The editor's theme picker and token picker build themselves from this
+    // rather than from a hardcoded list that would drift from the CSS.
+    fastify.get('/theme/catalog', canRead, async () => ({
+        themes: listThemeIds(),
+        tokens: listThemeTokens()
+    }));
+
+    /*
+     * One theme's token values. Fetched on demand rather than folded into
+     * /catalog: 32 themes x ~245 tokens is a payload nobody needs on a page
+     * load, and the admin only wants the one being considered.
+     */
+    fastify.get('/theme/themes/:id', canRead, async (request, reply) => {
+        const tokens = getThemeTokenMap(request.params.id);
+        if (!tokens) return reply.code(404).send({error: 'Unknown theme'});
+        return {id: request.params.id, tokens};
+    });
+
+    fastify.put('/theme', canUpdate, async (request, reply) => {
+        try {
+            return await saveThemeConfig(request.body || {});
+        } catch (err) {
+            return reply.code(400).send({error: err.message, validation: err.validation || null});
+        }
+    });
+
+    fastify.post('/theme/compile', canRead, async (request, reply) => {
+        const candidate = request.body || {};
+        const errors = validateThemeConfig(candidate);
+        if (errors.length) return reply.code(400).send({error: errors.join('; '), validation: errors});
+        return {css: compileOverrideCss(candidate)};
+    });
+}