domma-cms 0.55.1 → 0.66.0

package/server/services/roles.js

@@ -74,7 +74,7 @@ const SEED_ENTRIES = [
             'pages', 'media', 'blocks', 'components', 'navigation', 'menus',
             'projects', 'layouts', 'collections', 'views', 'actions',
             'users', 'settings', 'notifications', 'plugins',
-            'api-tokens', 'api-endpoints'
+            'api-tokens', 'api-endpoints', 'context-menus', 'theme'
         ],
         badgeClass: 'badge-warning'
     },

package/server/services/search-migration.js

@@ -0,0 +1,82 @@
+/**
+ * Search migration - one-shot lift of the retired `site-search` plugin.
+ *
+ * Search used to be a bundled plugin that the loader force-enabled as a core
+ * feature. It is now part of the CMS, which leaves three traces on an existing
+ * install:
+ *
+ *   1. its settings, stored inside config/plugins.json,
+ *   2. its plugins.json entry, which would otherwise offer a toggle for a
+ *      feature that is no longer a plugin,
+ *   3. plugins/site-search/ itself - the updater replaces the plugins it ships
+ *      and adds new ones, but never removes one that has gone away, so the old
+ *      directory sits there and a click in the admin would run a SECOND copy of
+ *      the search UI on every public page.
+ *
+ * Idempotent: with no plugins.json entry and no plugin directory there is
+ * nothing to do, which is the state of every fresh install.
+ */
+import fs from 'fs';
+import path from 'path';
+import {normaliseSearchSettings} from './search.js';
+
+/**
+ * Run the migration.
+ *
+ * Paths are resolved per call rather than at import: the same process can run
+ * this against more than one install (the tests do), and a path frozen at load
+ * time would point at the first one forever.
+ *
+ * @returns {string[]} What it changed, for the startup log (empty = nothing to do)
+ */
+export function migrateSiteSearchPlugin() {
+    const CONFIG_DIR = path.resolve('config');
+    const SEARCH_CONFIG = path.join(CONFIG_DIR, 'search.json');
+    const PLUGINS_CONFIG = path.join(CONFIG_DIR, 'plugins.json');
+    const RETIRED_PLUGIN_DIR = path.resolve('plugins', 'site-search');
+
+    const changes = [];
+    let plugins = null;
+
+    try {
+        plugins = JSON.parse(fs.readFileSync(PLUGINS_CONFIG, 'utf8'));
+    } catch {
+        // No plugins.json, or a malformed one. Neither is this migration's
+        // business - a broken file is reported loudly elsewhere.
+    }
+
+    const stored = plugins?.['site-search'];
+
+    // 1. Settings. Only ever written when the file is absent: a site that has
+    //    already saved search settings has the newer answer.
+    if (!fs.existsSync(SEARCH_CONFIG)) {
+        const settings = normaliseSearchSettings(stored?.settings || {});
+        fs.writeFileSync(SEARCH_CONFIG, JSON.stringify(settings, null, 2) + '\n');
+        changes.push(stored ? 'lifted settings out of plugins.json' : 'wrote default settings');
+    }
+
+    // 2. The plugins.json entry.
+    if (plugins && stored) {
+        delete plugins['site-search'];
+        fs.writeFileSync(PLUGINS_CONFIG, JSON.stringify(plugins, null, 2) + '\n');
+        changes.push('removed the plugins.json entry');
+    }
+
+    // 3. The plugin directory - but only if it is the bundled one. A directory
+    //    of that name carrying anything else is somebody's own work, and this
+    //    is no place to decide it should go.
+    if (fs.existsSync(RETIRED_PLUGIN_DIR)) {
+        let isBundled = false;
+        try {
+            const manifest = JSON.parse(fs.readFileSync(path.join(RETIRED_PLUGIN_DIR, 'plugin.json'), 'utf8'));
+            isBundled = manifest.name === 'site-search' && manifest.author === 'Darryl Waterhouse';
+        } catch { /* no manifest - leave it alone */ }
+
+        if (isBundled) {
+            fs.rmSync(RETIRED_PLUGIN_DIR, {recursive: true, force: true});
+            changes.push('removed plugins/site-search/');
+        }
+    }
+
+    return changes;
+}

package/server/services/search.js

@@ -0,0 +1,413 @@
+/**
+ * Search Service
+ *
+ * Full-text search over the site's own pages: the index (such as it is), the
+ * scoring, and the settings behind the public search UI.
+ *
+ * This was the `site-search` plugin until it was brought into the CMS. Nothing
+ * about the algorithm changed in the move; what changed is that the settings
+ * now live in `config/search.json` rather than inside plugins.json, and the
+ * public page carries them inline instead of fetching them.
+ */
+import {getConfig, saveConfig} from '../config.js';
+
+/**
+ * Settings, and the shape of them.
+ *
+ * Every key here is PUBLIC - the renderer embeds the resolved settings in the
+ * page source so the search UI needs no round trip before it can draw itself.
+ * Nothing sensitive belongs in this object.
+ */
+export const SEARCH_DEFAULTS = Object.freeze({
+    enabled: true,
+    placeholder: 'Search pages...',
+    keyboardShortcut: true,
+    maxResults: 10,
+    minQueryLength: 2,
+    debounceMs: 300,
+    displayMode: 'navbar',
+    position: 'bottom-right',
+    offsetX: 32,
+    offsetY: 32,
+    iconOnly: true,
+    iconSize: 52,
+    iconRadius: 26
+});
+
+/**
+ * How big the floating trigger may be, in pixels.
+ *
+ * Below the floor it stops being a comfortable tap target (the usual advice is
+ * ~44px, and 32 is already small for a thumb); above the ceiling it competes
+ * with the page rather than sitting beside it. 52 is what the button has
+ * always been, so a site that never touches this sees no change.
+ */
+const ICON_SIZE_MIN = 32;
+const ICON_SIZE_MAX = 96;
+
+/**
+ * The radius ceiling is HALF THE SIZE, not a constant: at half its width a
+ * square is already a circle, and anything beyond renders identically while
+ * storing a number the UI cannot represent. So the two settings are coupled -
+ * the size has to be resolved first and the radius clamped against it.
+ *
+ * @param   {number} size
+ * @returns {number}
+ */
+function maxIconRadius(size) {
+    return Math.floor(size / 2);
+}
+
+const DISPLAY_MODES = new Set(['navbar', 'floating']);
+const POSITIONS = new Set([
+    'top-left', 'top-right', 'left-center', 'right-center', 'bottom-left', 'bottom-right'
+]);
+
+/** Clamp a number into a range, falling back when it is not one. */
+function num(value, fallback, min, max) {
+    const n = typeof value === 'number' ? value : parseInt(value, 10);
+    if (!Number.isFinite(n)) return fallback;
+    return Math.min(max, Math.max(min, Math.round(n)));
+}
+
+/**
+ * Coerce a stored or submitted settings object into the known shape.
+ *
+ * Whitelisted rather than merged: these settings are served to every visitor
+ * inside the page, so an unknown key someone PUT once should not end up in the
+ * source of every page forever.
+ *
+ * @param {object} [raw]
+ * @returns {object}
+ */
+export function normaliseSearchSettings(raw = {}) {
+    const placeholder = typeof raw.placeholder === 'string' && raw.placeholder.trim()
+        ? raw.placeholder.trim().slice(0, 120)
+        : SEARCH_DEFAULTS.placeholder;
+
+    // Resolved before the return, because the radius is clamped against it.
+    const iconSize = num(raw.iconSize, SEARCH_DEFAULTS.iconSize, ICON_SIZE_MIN, ICON_SIZE_MAX);
+    // `num` returns its fallback UNCLAMPED, so the default 26 has to be capped
+    // here too: a site that shrinks the button without touching the radius
+    // would otherwise store 26 against a ceiling of 16 - invisible on the page,
+    // because a browser floors border-radius at half the box anyway, but the
+    // admin slider cannot represent it and would silently rewrite it on save.
+    const maxRadius = maxIconRadius(iconSize);
+
+    return {
+        enabled: raw.enabled !== false,
+        placeholder,
+        keyboardShortcut: raw.keyboardShortcut !== false,
+        maxResults: num(raw.maxResults, SEARCH_DEFAULTS.maxResults, 1, 50),
+        minQueryLength: num(raw.minQueryLength, SEARCH_DEFAULTS.minQueryLength, 1, 5),
+        debounceMs: num(raw.debounceMs, SEARCH_DEFAULTS.debounceMs, 100, 1000),
+        displayMode: DISPLAY_MODES.has(raw.displayMode) ? raw.displayMode : SEARCH_DEFAULTS.displayMode,
+        position: POSITIONS.has(raw.position) ? raw.position : SEARCH_DEFAULTS.position,
+        offsetX: num(raw.offsetX, SEARCH_DEFAULTS.offsetX, 0, 500),
+        offsetY: num(raw.offsetY, SEARCH_DEFAULTS.offsetY, 0, 500),
+        iconOnly: raw.iconOnly !== false,
+        iconSize,
+        iconRadius: Math.min(maxRadius, num(raw.iconRadius, SEARCH_DEFAULTS.iconRadius, 0, maxRadius))
+    };
+}
+
+/**
+ * Current search settings, defaults filled in.
+ *
+ * `config/search.json` is optional: a site that has never opened the Search
+ * screen has no file, and the defaults are the answer.
+ *
+ * @returns {object}
+ */
+export function getSearchSettings() {
+    try {
+        return normaliseSearchSettings(getConfig('search'));
+    } catch {
+        return {...SEARCH_DEFAULTS};
+    }
+}
+
+/**
+ * Save search settings, returning what was actually stored.
+ *
+ * @param {object} patch - Partial or complete settings
+ * @returns {object}
+ */
+export function saveSearchSettings(patch) {
+    const next = normaliseSearchSettings({...getSearchSettings(), ...(patch || {})});
+    saveConfig('search', next);
+    return next;
+}
+
+// ---------------------------------------------------------------------------
+// Indexing and scoring
+// ---------------------------------------------------------------------------
+
+/**
+ * Named entities for accented Latin letters, built from the HTML pattern
+ * (`eacute` = e + acute). Generated rather than typed out: the list is long,
+ * every entry is mechanical, and a typo in one would silently corrupt a word.
+ */
+const ACCENTED = (() => {
+    const map = {};
+    const accents = {
+        grave: '\u0300', acute: '\u0301', circ: '\u0302',
+        tilde: '\u0303', uml: '\u0308', ring: '\u030A', cedil: '\u0327'
+    };
+    for (const letter of 'aeiouyncAEIOUYNC') {
+        for (const [name, mark] of Object.entries(accents)) {
+            // Compose and keep it only if the pair is a real character.
+            const composed = (letter + mark).normalize('NFC');
+            if (composed.length === 1) map[letter + name] = composed;
+        }
+    }
+    return Object.assign(map, {
+        szlig: '\u00DF', aelig: '\u00E6', AElig: '\u00C6',
+        oslash: '\u00F8', Oslash: '\u00D8'
+    });
+})();
+
+/**
+ * Attribute values worth indexing. A `[card title="…"]` or
+ * `[section-label label="…"]` is often the only place a heading exists, and
+ * stripping the tag takes it with it.
+ */
+const TEXTUAL_ATTRS = /\b(?:title|subtitle|label|text|alt|caption|heading)\s*=\s*"([^"]*)"/gi;
+
+/**
+ * Reduce page source to plain prose for indexing and snippets.
+ *
+ * ORDER IS THE WHOLE JOB. The previous version stripped shortcodes first with
+ * `\[[a-z][^\]]*\][\s\S]*?\[\/[a-z]+\]`, which is non-greedy to the FIRST
+ * closing tag - so on a page opening with `[hero]…[grid][col]…[/col]` it
+ * deleted everything from `[hero` to the first `[/col]` and kept going. On a
+ * real 6,400-character page that left **226 characters, 4% of the body**, most
+ * of it orphaned `[/col]` `[/grid]` closers that no rule ever removed (they
+ * start with `/`, and every pattern required `[` followed by a letter).
+ *
+ * Both reported symptoms were that one bug: snippets reading
+ * "[/hero] [/listgroup] [/col] [/col]", and pages that plainly discuss a term
+ * scoring zero because the text had been thrown away before it was searched.
+ *
+ * So: take the code out first, then links (their `[text]` looks exactly like a
+ * shortcode and must be read as a link before anything eats it), then drop
+ * shortcode TAGS while keeping the prose between them.
+ *
+ * @param {string} content
+ * @returns {string}
+ */
+export function stripMarkdown(content) {
+    if (!content) return '';
+    return content
+        // Fenced code first - it can contain anything, including shortcodes
+        // written as examples, which are not this page's prose.
+        .replace(/```[\s\S]*?```/g, ' ')
+        // Images carry no prose; links do, so keep the text and drop the URL.
+        // Both must run BEFORE shortcodes: `[see the docs](/docs)` starts with
+        // `[` + a letter, so a shortcode pattern would eat the link text.
+        .replace(/!\[[^\]]*\]\([^)]*\)/g, ' ')
+        .replace(/\[([^\]]+)\]\([^)]*\)/g, '$1')
+        // [dconfig] holds JSON, not prose.
+        .replace(/\[dconfig\b[^\]]*\][\s\S]*?\[\/dconfig\]/gi, ' ')
+        // Promote the readable attributes before the tags carrying them go.
+        .replace(/\[[a-z][a-z0-9-]*[^\]]*\]/gi, (tag) => {
+            const parts = [];
+            for (const m of tag.matchAll(TEXTUAL_ATTRS)) parts.push(m[1]);
+            return parts.length ? ' ' + parts.join(' ') + ' ' : ' ';
+        })
+        // Closing tags. These start with `/`, which is why nothing caught them.
+        .replace(/\[\/[a-z][a-z0-9-]*\]/gi, ' ')
+        // Raw <pre>/<code> blocks, CONTENT INCLUDED. Stripping only the tags
+        // left the code body behind as prose, which is how a search for "forms"
+        // answered with `fastify.cms.on('form:submitted', async (data) => {`.
+        // Code is an illustration on the page, not what the page is about.
+        .replace(/<pre\b[\s\S]*?<\/pre>/gi, ' ')
+        .replace(/<code\b[\s\S]*?<\/code>/gi, ' ')
+        // Remove HTML tags
+        .replace(/<[^>]+>/g, ' ')
+        // Remove headings (keep text)
+        .replace(/^#{1,6}\s+/gm, '')
+        // Remove bold / italic
+        .replace(/\*{1,3}([^*]+)\*{1,3}/g, '$1')
+        .replace(/_{1,3}([^_]+)_{1,3}/g, '$1')
+        // Inline code
+        .replace(/`[^`]+`/g, ' ')
+        // Remove blockquotes marker
+        .replace(/^>\s+/gm, '')
+        // Entities are markup too. A snippet reading "data =&gt; {" is the
+        // index showing its working; decode so both the match and the snippet
+        // see the characters a reader would.
+        //
+        // Matched generically rather than from a list of names. Enumerating
+        // them left `&rarr;` in a snippet the moment a page used an arrow, and
+        // the next page would have found the next gap. Anything named that is
+        // not a character we care about becomes a space, which is the right
+        // answer for the decorative ones (arrows, bullets, dashes) that make up
+        // most of the tail.
+        .replace(/&(#\d{1,6}|#x[0-9a-f]{1,5}|[a-z][a-z0-9]{1,10});/gi, (_, ref) => {
+            const named = {
+                nbsp: ' ', amp: '&', lt: '<', gt: '>', quot: '"', apos: "'",
+                hellip: '…', mdash: '-', ndash: '-',
+                rsquo: "'", lsquo: "'", ldquo: '"', rdquo: '"',
+                // Accented letters are prose, not decoration. Turning
+                // `Caf&eacute;` into "Caf é" splits a word in half and loses
+                // the match for anyone searching "café".
+                ...ACCENTED
+            };
+            if (ref[0] === '#') {
+                const code = ref[1] === 'x' || ref[1] === 'X'
+                    ? parseInt(ref.slice(2), 16)
+                    : parseInt(ref.slice(1), 10);
+                // Control characters and anything unparseable read as a break.
+                if (!Number.isFinite(code) || code < 32) return ' ';
+                try { return String.fromCodePoint(code); } catch { return ' '; }
+            }
+            // Case matters: `&Eacute;` is E-acute, `&eacute;` is e-acute.
+            // Look the exact name up first and only then fall back, or every
+            // capitalised accent arrives lowercase and "Ecole" becomes "ecole".
+            return named[ref] ?? named[ref.toLowerCase()] ?? ' ';
+        })
+        // Collapse whitespace
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+
+/**
+ * Build a snippet of ~length chars around the first occurrence of term in content.
+ *
+ * @param {string} rawContent  - raw markdown content
+ * @param {string} term
+ * @param {number} length
+ * @returns {string}
+ */
+function buildSnippet(rawContent, term, length = 120) {
+    const text = stripMarkdown(rawContent);
+    if (!text) return '';
+
+    const lower = text.toLowerCase();
+    const idx = lower.indexOf(term.toLowerCase());
+
+    if (idx === -1) {
+        return text.length > length ? text.slice(0, length) + '…' : text;
+    }
+
+    const half = Math.floor(length / 2);
+    const start = Math.max(0, idx - half);
+    const end = Math.min(text.length, start + length);
+    const snippet = text.slice(start, end);
+
+    return (start > 0 ? '…' : '') + snippet + (end < text.length ? '…' : '');
+}
+
+/**
+ * Score a page against a search query using weighted field matching.
+ *
+ * @param {object} page
+ * @param {string} query
+ * @param {string[]} words - query split into words
+ * @returns {number}
+ */
+export function scorePage(page, query, words) {
+    let score = 0;
+    const title = (page.title || '').toLowerCase();
+    const description = (page.description || '').toLowerCase();
+    // Coerced, not trusted. A tag list is `Array.isArray` true and still full
+    // of nulls - `tags:\n  - null` is what a page ends up with when something
+    // writes an empty tag - and `null.toLowerCase()` threw, which took the
+    // WHOLE search down: one malformed page and every query on the site
+    // answered 500. Anything that is not a usable string is simply not a tag.
+    const tags = (Array.isArray(page.tags) ? page.tags : [])
+        .filter(tag => typeof tag === 'string' && tag.trim())
+        .map(tag => tag.toLowerCase());
+    const stripped = stripMarkdown(page.content || '').toLowerCase();
+    const q = query.toLowerCase();
+
+    // Title scoring
+    if (title === q) {
+        score += 100;
+    } else if (title.includes(q)) {
+        score += 60;
+    } else if (words.every(w => title.includes(w))) {
+        score += 40;
+    } else if (words.some(w => title.includes(w))) {
+        score += 20;
+    }
+
+    // Tags scoring
+    if (tags.includes(q)) {
+        score += 30;
+    } else if (tags.some(t => t.includes(q))) {
+        score += 20;
+    } else if (words.every(w => tags.some(t => t.includes(w)))) {
+        score += 15;
+    } else if (words.some(w => tags.some(t => t.includes(w)))) {
+        score += 8;
+    }
+
+    // Description scoring
+    if (description.includes(q)) {
+        score += 25;
+    } else if (words.some(w => description.includes(w))) {
+        score += 10;
+    }
+
+    // Content scoring
+    if (stripped.includes(q)) {
+        score += 10;
+    } else if (words.every(w => stripped.includes(w))) {
+        score += 5;
+    } else if (words.some(w => stripped.includes(w))) {
+        score += 2;
+    }
+
+    return score;
+}
+
+/**
+ * Search a set of pages.
+ *
+ * Extracted from the route so it can be tested without standing a server up -
+ * and because the thing worth testing is not the routing but this: that a
+ * malformed page is skipped rather than fatal. The null-tag crash answered
+ * 500 to every query on an entire site, which reads to everyone as "search
+ * finds nothing".
+ *
+ * @param   {object[]} pages
+ * @param   {string} query
+ * @param   {{maxResults?: number, onError?: Function}} [options]
+ * @returns {object[]}
+ */
+export function searchPages(pages, query, {maxResults = 10, onError = () => {}} = {}) {
+    const words = query.toLowerCase().split(/\s+/).filter(Boolean);
+    const results = [];
+
+    for (const page of pages) {
+        // Drafts and private pages are nobody's business out here.
+        if (page.status === 'draft') continue;
+        if (page.visibility === 'private') continue;
+
+        // One page must never be able to fail the whole search. The null-tag
+        // crash was exactly this shape and the next malformed field will be
+        // too - one result missing is a far better answer than no results.
+        let score = 0;
+        try {
+            score = scorePage(page, query, words);
+        } catch (err) {
+            onError(err, page);
+            continue;
+        }
+        if (score === 0) continue;
+
+        results.push({
+            title: page.title || 'Untitled',
+            url: page.urlPath,
+            description: page.description || '',
+            tags: Array.isArray(page.tags) ? page.tags : [],
+            snippet: buildSnippet(page.content || '', query),
+            score
+        });
+    }
+
+    results.sort((a, b) => b.score - a.score);
+    return results.slice(0, maxResults);
+}

package/server/services/sidebar-migration.js

@@ -55,6 +55,7 @@ const SEED_ITEMS = [
             {text: 'Users',         url: '#/users',                icon: 'users',    permission: 'users'},
             {text: 'Site Settings', url: '#/settings',             icon: 'settings', permission: 'settings'},
             {text: 'Effects',       url: '#/effects',              icon: 'sparkles', permission: 'settings'},
+            {text: 'Search',        url: '#/search',               icon: 'search',   permission: 'settings'},
             {text: 'Layouts',       url: '#/layouts',              icon: 'layout',   permission: 'layouts'},
             {text: 'Plugins',       url: '#/plugins',              icon: 'package',  permission: 'plugins'},
             {text: 'API Tokens',    url: '#/api-tokens',           icon: 'key',      permission: 'api-tokens'},