domma-cms 0.55.1 → 0.69.3

package/plugins/blog/lib/samples.js

@@ -0,0 +1,234 @@
+/**
+ * Sample posts - a blog to look at before there is one.
+ *
+ * Every sample post and category carries `sample: true`, so "Remove sample
+ * posts" takes away exactly what "Add sample posts" put there and nothing an
+ * author wrote. A sample category an author has since filed a real post under
+ * is left alone.
+ *
+ * The posts are spread over the four shipped layouts and use the covers in
+ * public/samples/, so nothing is hotlinked from elsewhere.
+ *
+ * @module blog/lib/samples
+ */
+
+const IMG = (name) => `/plugins/blog/public/samples/${name}.svg`;
+
+export const SAMPLE_CATEGORIES = [
+    {name: 'Guides', slug: 'guides', description: 'How to get things done, step by step.'},
+    {name: 'News', slug: 'news', description: 'What is new, and what changed.'},
+    {name: 'Design', slug: 'design', description: 'Notes on layout, type and colour.'},
+    {name: 'Engineering', slug: 'engineering', description: 'How it works under the bonnet.'}
+];
+
+const DAY = 86_400_000;
+
+/**
+ * @param {number} daysAgo
+ * @param {number} [hour]
+ */
+const ago = (daysAgo, hour = 9) => {
+    const d = new Date(Date.now() - daysAgo * DAY);
+    d.setUTCHours(hour, 0, 0, 0);
+    return d.toISOString();
+};
+
+/** Posts reference categories by slug here; the installer maps them to ids. */
+export function samplePosts() {
+    return [
+        {
+            title: 'Welcome to the new blog',
+            slug: 'welcome-to-the-new-blog',
+            excerpt: 'Layouts you can choose per post, listings you can filter with a right-click, and every template editable as a block.',
+            categories: ['news'], tags: ['announcement', 'blog'],
+            featuredImage: IMG('aurora'), template: 'blog-post-feature', publishedAt: ago(1),
+            content: `The blog has had a proper overhaul. Every post can now choose how it looks, every listing can be searched and filtered without leaving the page, and all of it is built from blocks you can edit.
+
+## Layouts, per post
+
+Open any post in the editor and pick a layout from the **Layout** card: *Classic*, *Feature* (this one), *Minimal* or *Sidebar*. The site-wide default lives in the Blog settings, behind the cog.
+
+## Listings that answer back
+
+The blog index is no longer a static list. Search it, narrow it to a category with the pills, or **right-click any post** for "More in this category", "More tagged…" and "More by this author".
+
+## Everything is a block
+
+The layouts are ordinary blocks called \`blog-post-*\` and \`blog-card-*\`. Change one in the Blocks tool and every post using it changes with it. Copy one under a new name and it appears as a new choice.
+
+> Start with the Blocks tool, not the code. That is the point.
+
+Enjoy it - and delete these sample posts from the Posts menu whenever you are ready.`
+        },
+        {
+            title: 'Writing your first post, start to finish',
+            slug: 'writing-your-first-post',
+            excerpt: 'From a blank editor to a published, well-linked post in about ten minutes.',
+            categories: ['guides'], tags: ['writing', 'getting-started'],
+            featuredImage: IMG('meadow'), template: 'blog-post-sidebar', publishedAt: ago(4),
+            content: `This guide walks through a post from the first word to the Publish button. The contents list beside it follows you down the page.
+
+## Start with the title
+
+A good title says what the reader gets. "Ten minutes to your first post" beats "Some thoughts on writing". The slug fills itself in from the title while **Auto** is ticked.
+
+## Write the excerpt
+
+The excerpt is the sentence or two shown on listings and in search results. Write it last if that is easier - it is often clearer once the post exists.
+
+## The body
+
+Posts are Markdown. Headings (\`##\`) become the contents list in the Sidebar layout, so use them for the real sections of your argument.
+
+### Links and images
+
+Link generously to your own older posts. Pick a featured image from the Media library; it appears on listings and at the top of most layouts.
+
+### Shortcodes
+
+Every shortcode the site supports works in a post, including blocks.
+
+## Categories and tags
+
+Categories are the few big shelves your blog has. Tags are the many small labels. A reader can right-click any post on the listing to see more with the same tag.
+
+## Publish, or schedule
+
+**Publish now** puts it live. **Schedule** holds it until the date you choose - no need to be awake at 7am.`
+        },
+        {
+            title: 'Why whitespace is a feature',
+            slug: 'why-whitespace-is-a-feature',
+            excerpt: 'Room to breathe is not wasted space. It is how a reader knows what matters.',
+            categories: ['design'], tags: ['typography', 'layout'],
+            featuredImage: IMG('dusk'), template: 'blog-post-minimal', publishedAt: ago(9),
+            content: `Every page makes an argument about what matters, and whitespace is how it makes it.
+
+Crowd two things together and the reader assumes they belong together. Put room between them and they read as separate thoughts. Layout is grammar.
+
+## Measure
+
+A line of text is most comfortable at somewhere between 55 and 75 characters. Wider, and the eye loses its place on the way back. This layout keeps to a narrow column on purpose.
+
+## Rhythm
+
+Consistent spacing - the same gap after every paragraph, the same before every heading - is what makes a page feel calm. Inconsistent spacing is noise the reader cannot name but can feel.
+
+## Restraint
+
+The hardest part of design is leaving things out. This layout has no featured image and no sidebar. It has the words, and room around them.`
+        },
+        {
+            title: 'How the listing filters work',
+            slug: 'how-the-listing-filters-work',
+            excerpt: 'The blog index filters in the browser with domma-reactive - here is what happens between the click and the cards.',
+            categories: ['engineering'], tags: ['domma-reactive', 'javascript', 'blog'],
+            featuredImage: IMG('harbour'), publishedAt: ago(15),
+            content: `The listing you came from is rendered on the server, so it works without JavaScript and search engines see every post. The script then takes it over.
+
+## One model
+
+Each card carries a small bundle of plain values - title, date, categories, tags, author. The script reads those into a list and keeps the filters in a handful of observables: the search text, the category, the tag, the author and the sort order.
+
+## Derived, not managed
+
+What is shown is a *computed* value: filter the list, sort it, take the first page. Nothing hides or shows a card by hand; an effect applies whatever the computed says. Change any filter and everything downstream follows.
+
+## The right-click menu
+
+Right-clicking a card opens a menu built from that card's own values. "More in Design" simply sets the category observable. The chips above the list are the same observables, drawn the other way round.
+
+## The address bar
+
+Filters are written back into the address, so a filtered view is a link you can share.`
+        },
+        {
+            title: 'Five small things that make a site feel fast',
+            slug: 'five-things-that-make-a-site-feel-fast',
+            excerpt: 'Speed is partly measured and partly perceived. These five help with both.',
+            categories: ['engineering', 'design'], tags: ['performance'],
+            featuredImage: IMG('ember'), publishedAt: ago(23),
+            content: `A site can be quick on paper and still feel slow. These are the small things that close the gap.
+
+## 1. Reserve space for images
+
+Give images their proportions up front so the page does not jump as they arrive. Cards here use a fixed aspect ratio for exactly that reason.
+
+## 2. Lazy-load what is below the fold
+
+The browser does this for you with \`loading="lazy"\`. Cards use it; the image at the top of a post does not, because it is the first thing you see.
+
+## 3. Respond instantly, finish later
+
+Filtering the blog listing happens in the browser, so the cards change the moment you type - there is no round trip to wait for.
+
+## 4. Compress the right things
+
+Text compresses beautifully. Already-compressed files - images, archives - should be sent as they are.
+
+## 5. Do less
+
+The fastest code is the code that never runs. Every feature should earn its bytes.`
+        },
+        {
+            title: 'Choosing categories that last',
+            slug: 'choosing-categories-that-last',
+            excerpt: 'A handful of broad, stable categories and a generous sprinkling of tags will outlive any clever taxonomy.',
+            categories: ['guides'], tags: ['writing', 'organisation'],
+            featuredImage: IMG('rosewood'), publishedAt: ago(31),
+            content: `Categories are the shelves; tags are the labels on the books. Get the shelves right and the rest looks after itself.
+
+## Keep them few
+
+Four to eight categories is plenty for most blogs. More than that and authors start guessing, and readers stop trusting the pills at the top of the listing.
+
+## Make them stable
+
+A category should still make sense in two years. "News" will. "Spring 2026 launch" will not - that is a tag.
+
+## Let tags do the detail
+
+Tags can be as specific as you like. Readers find them by right-clicking a post and choosing "More tagged…", so a precise tag is genuinely useful.`
+        },
+        {
+            title: 'Release notes: comments, moderation and more',
+            slug: 'release-notes-comments-and-moderation',
+            excerpt: 'Comments now respect their settings the moment you change them, and moderation gained a Rejected list.',
+            categories: ['news'], tags: ['release', 'comments'],
+            featuredImage: IMG('harbour'), publishedAt: ago(40),
+            content: `A round-up of the changes to comments.
+
+## Settings take effect immediately
+
+Switching comments off now closes them straight away - no restart. Holding comments for approval works the same way.
+
+## A place for rejected comments
+
+Rejected comments used to vanish from view. They now have their own list, so a mistaken rejection can be undone.
+
+## Posting without leaving the page
+
+The comment form under each post now sends in place and tells you whether your comment is live or waiting for approval.`
+        },
+        {
+            title: 'A colour palette in an afternoon',
+            slug: 'a-colour-palette-in-an-afternoon',
+            excerpt: 'Start from one colour you love, and let contrast rules do the rest.',
+            categories: ['design'], tags: ['colour', 'theming'],
+            featuredImage: IMG('meadow'), publishedAt: ago(52),
+            content: `You do not need a design degree to build a palette that works. You need one colour, and some discipline.
+
+## Start with one
+
+Pick a primary colour you would be happy to see every day. It will be your links, your buttons and the accent on every card.
+
+## Derive the rest
+
+A darker shade for hover, a pale tint for backgrounds, and a neutral grey family for text. The theme settings can generate these from the one colour.
+
+## Check contrast
+
+Body text needs a contrast ratio of at least 4.5:1 against its background. Test it rather than trusting your eyes on a bright screen.`
+        }
+    ];
+}

package/plugins/blog/plugin.js

@@ -1,6 +1,12 @@
+import {fileURLToPath} from 'url';
 import defaultConfig from './config.js';
 import {createEntry, deleteEntry, getEntry, listEntries, updateEntry} from '../../server/services/collections.js';
-import {getConfig, saveConfig} from '../../server/config.js';
+import {getPluginStates, savePluginState} from '../../server/services/plugins.js';
+import {renderBlogPage} from '../../server/services/renderer.js';
+import {DISPLAY_DEFAULTS, pickDisplaySettings, safeImageUrl} from './lib/layouts.js';
+import {catalogue, seedBlocks} from './lib/render.js';
+import {liveSettings, loadEntries as loadAll, renderPostPage} from './lib/page.js';
+import {SAMPLE_CATEGORIES, samplePosts} from './lib/samples.js';
 
 const POSTS_SLUG      = 'blog-posts';
 const CATEGORIES_SLUG = 'blog-categories';
@@ -16,6 +22,53 @@ function isEditorOrAdmin(user) {
     return canPublish(user);
 }
 
+// Sidebar badge text helpers - kept here rather than imported from core, so the
+// plugin still loads on an engine that predates server/services/sidebarBadges.js.
+const plural = (n, one) => `${n} ${n === 1 ? one : `${one}s`}`;
+function clip(text, max) {
+    const s = String(text ?? '').replace(/\s+/g, ' ').trim();
+    return s.length <= max ? s : `${s.slice(0, max - 1).trimEnd()}…`;
+}
+function ago(iso) {
+    const secs = Math.max(0, Math.round((Date.now() - new Date(iso).getTime()) / 1000));
+    if (!Number.isFinite(secs)) return '';
+    if (secs < 60) return 'just now';
+    if (secs < 3600) return `${Math.round(secs / 60)} min ago`;
+    if (secs < 86400) return `${plural(Math.round(secs / 3600), 'hour')} ago`;
+    return `${plural(Math.round(secs / 86400), 'day')} ago`;
+}
+
+/** '' (the site default) or a post layout's block name. */
+function cleanTemplate(value) {
+    const v = String(value ?? '').trim();
+    return /^blog-post-[a-z0-9-]+$/.test(v) ? v : '';
+}
+
+/**
+ * The fields a caller may set on a post. Status, publish date and authorship
+ * go through the publish / schedule routes, which check who is asking: taken
+ * straight from the body, a blog-author could publish their own post with
+ * `{"status": "published"}` and skip the editor entirely.
+ */
+export function postFields(body, user) {
+    const out = {};
+    if (typeof body.title === 'string') out.title = body.title.trim();
+    if (typeof body.slug === 'string') out.slug = body.slug.trim();
+    if (typeof body.content === 'string') out.content = body.content;
+    if (typeof body.excerpt === 'string') out.excerpt = body.excerpt.trim();
+    if (body.featuredImage !== undefined) out.featuredImage = body.featuredImage ? String(body.featuredImage) : null;
+    if (Array.isArray(body.categories)) out.categories = body.categories.map(String);
+    if (Array.isArray(body.tags)) out.tags = body.tags.map(t => String(t).trim()).filter(Boolean);
+    if (body.seo && typeof body.seo === 'object') {
+        out.seo = {title: String(body.seo.title ?? ''), description: String(body.seo.description ?? '')};
+    }
+    if (body.template !== undefined) out.template = cleanTemplate(body.template);
+    // Only a publisher may move a post out of draft here (Save Draft sends 'draft').
+    if (body.status === 'draft') out.status = 'draft';
+    else if (body.status !== undefined && canPublish(user) && ['scheduled', 'published'].includes(body.status)) out.status = body.status;
+    return out;
+}
+
 /** Derive a URL slug from a title string. */
 function slugify(str) {
     return String(str)
@@ -188,6 +241,120 @@ export default async function blogPlugin(fastify, options) {
         registerEmbedShortcodes(options.hooks.registerShortcode, basePath);
     }
 
+    // The layouts are blocks; put the shipped ones where the Blocks tool can
+    // edit them. Once each, never over a site's own copy (lib/render.js).
+    try {
+        const copied = await seedBlocks();
+        if (copied.length) fastify.log.info(`[blog] added layout blocks: ${copied.join(', ')}`);
+    } catch (err) {
+        fastify.log.warn(`[blog] could not add the layout blocks: ${err.message}`);
+    }
+
+    // -------------------------------------------------------------------------
+    // Layouts
+    // -------------------------------------------------------------------------
+
+    /** GET /api/plugins/blog/layouts - every post layout and listing display on offer */
+    fastify.get('/layouts', { preHandler: [authenticate] }, async () => {
+        const s = liveSettings(settings);
+        return { ...(await catalogue()), postLayout: s.postLayout, listDisplay: s.listDisplay };
+    });
+
+    /**
+     * POST /api/plugins/blog/preview - a post as the site would show it, from
+     * the editor's UNSAVED fields and in any layout, for the preview panel.
+     * The whole page, chrome and all, so what the author sees is what readers get.
+     */
+    fastify.post('/preview', { preHandler: [authenticate] }, async (request, reply) => {
+        const body = request.body ?? {};
+        const user = request.user;
+        let stored = null;
+        if (body.id) {
+            const entry = await getEntry(POSTS_SLUG, String(body.id));
+            if (entry) {
+                if (!isEditorOrAdmin(user) && entry.data.authorId !== (user?.id ?? user?.sub)) {
+                    return reply.code(403).send({ error: 'Forbidden' });
+                }
+                stored = { id: entry.id, ...entry.data };
+            }
+        }
+        const post = {
+            id: stored?.id ?? '__preview__',
+            status: 'published',
+            publishedAt: stored?.publishedAt ?? new Date().toISOString(),
+            authorId: stored?.authorId ?? (user?.id ?? user?.sub ?? ''),
+            ...(stored ?? {}),
+            ...postFields(body, user)
+        };
+        post.status = 'published';
+        post.slug = post.slug || 'preview';
+        const allPosts = (await loadAll(POSTS_SLUG)).filter(p => p.id !== post.id);
+        const s = liveSettings(settings);
+        const page = await renderPostPage(post, [...allPosts, post], s, {
+            base: basePath, layout: cleanTemplate(body.layout) || null, preview: true
+        });
+        const html = await renderBlogPage(
+            fileURLToPath(new URL('./templates/post.html', import.meta.url)),
+            { post: page.html, assetV: '1.4.4' },
+            { title: post.title || 'Preview', description: post.excerpt || '', ogImage: safeImageUrl(post.featuredImage),
+              usedComponents: page.usedComponents, urlPath: `${basePath}/${post.slug}`, noindex: true }
+        );
+        return reply.send({ html, layout: page.layout });
+    });
+
+    // -------------------------------------------------------------------------
+    // Sample posts
+    // -------------------------------------------------------------------------
+
+    /**
+     * POST /api/plugins/blog/samples - add the sample posts (and any sample
+     * category the site lacks). A sample whose slug is taken is skipped, so
+     * pressing it twice adds nothing the second time.
+     */
+    fastify.post('/samples', { preHandler: [authenticate, requireAdmin] }, async (request) => {
+        const uid = request.user?.id ?? request.user?.sub ?? null;
+        const cats = await loadAll(CATEGORIES_SLUG);
+        const catIds = {};
+        for (const c of SAMPLE_CATEGORIES) {
+            const have = cats.find(x => x.slug === c.slug);
+            catIds[c.slug] = have ? have.id : (await createEntry(CATEGORIES_SLUG, { ...c, sample: true }, { createdBy: uid, source: 'admin' })).id;
+        }
+        const existing = new Set((await loadAll(POSTS_SLUG)).map(p => p.slug));
+        let added = 0;
+        for (const p of samplePosts()) {
+            if (existing.has(p.slug)) continue;
+            await createEntry(POSTS_SLUG, {
+                ...p,
+                categories: p.categories.map(slug => catIds[slug]).filter(Boolean),
+                template: p.template ?? '',
+                status: 'published',
+                authorId: uid,
+                sample: true,
+                seo: { title: '', description: '' }
+            }, { createdBy: uid, source: 'admin' });
+            added++;
+        }
+        return { ok: true, added };
+    });
+
+    /**
+     * DELETE /api/plugins/blog/samples - remove exactly what "Add" put there:
+     * posts marked as samples, and sample categories no remaining post uses.
+     */
+    fastify.delete('/samples', { preHandler: [authenticate, requireAdmin] }, async () => {
+        let posts = 0, categories = 0;
+        for (const p of (await loadAll(POSTS_SLUG)).filter(p => p.sample === true)) {
+            await deleteEntry(POSTS_SLUG, p.id);
+            posts++;
+        }
+        const inUse = new Set((await loadAll(POSTS_SLUG)).flatMap(p => p.categories ?? []));
+        for (const c of (await loadAll(CATEGORIES_SLUG)).filter(c => c.sample === true && !inUse.has(c.id))) {
+            await deleteEntry(CATEGORIES_SLUG, c.id);
+            categories++;
+        }
+        return { ok: true, posts, categories };
+    });
+
     // -------------------------------------------------------------------------
     // Posts
     // -------------------------------------------------------------------------
@@ -212,24 +379,31 @@ export default async function blogPlugin(fastify, options) {
         const uid  = user?.id ?? user?.sub ?? null;
         const body = request.body ?? {};
 
-        const {
-            title, content, excerpt, featuredImage,
-            categories, tags, status, slug
-        } = body;
+        const { title, slug } = body;
+
+        // The schema marks title, slug, authorId and status required, so an
+        // empty title reaches createEntry and throws - a 500 where the
+        // categories and comments routes both answer 400. Say so here instead.
+        if (!title || typeof title !== 'string' || !title.trim()) {
+            return reply.code(400).send({ error: 'title is required' });
+        }
 
         const derivedSlug = slug
             ? String(slug).trim()
-            : slugify(title ?? '');
+            : slugify(title);
 
+        const fields = postFields(body, user);
         const entry = await createEntry(POSTS_SLUG, {
-            title:         typeof title === 'string' ? title.trim() : '',
+            content:       '',
+            excerpt:       '',
+            featuredImage: null,
+            categories:    [],
+            tags:          [],
+            template:      '',
+            ...fields,
+            title:         title.trim(),
             slug:          derivedSlug,
-            content:       typeof content === 'string' ? content : '',
-            excerpt:       typeof excerpt === 'string' ? excerpt.trim() : '',
-            featuredImage: featuredImage ?? null,
-            categories:    Array.isArray(categories) ? categories : [],
-            tags:          Array.isArray(tags) ? tags : [],
-            status:        status ?? 'draft',
+            status:        fields.status ?? 'draft',
             authorId:      uid
         }, { createdBy: uid, source: 'admin' });
 
@@ -256,8 +430,7 @@ export default async function blogPlugin(fastify, options) {
             return reply.code(403).send({ error: 'Forbidden' });
         }
 
-        const updates = request.body ?? {};
-        const merged  = { ...entry.data, ...updates };
+        const merged  = { ...entry.data, ...postFields(request.body ?? {}, user) };
 
         const updated = await updateEntry(POSTS_SLUG, id, merged);
         return reply.send(toPost(updated));
@@ -401,10 +574,49 @@ export default async function blogPlugin(fastify, options) {
         return reply.send(comments);
     });
 
+    /** GET /api/plugins/blog/comments/pending-count - the sidebar badge on Blog: comments waiting for approval */
+    fastify.get('/comments/pending-count', { preHandler: [authenticate] }, async () => {
+        const [comments, posts] = await Promise.all([loadAll(COMMENTS_SLUG), loadAll(POSTS_SLUG)]);
+        const pending = comments.filter(c => c.status === 'pending')
+            .sort((a, b) => String(b.createdAt ?? '').localeCompare(String(a.createdAt ?? '')));
+        const titleOf = new Map(posts.map(p => [p.id, p.title || 'Untitled']));
+        const count = (status) => posts.filter(p => p.status === status).length;
+        const next = posts.filter(p => p.status === 'scheduled' && p.publishedAt)
+            .sort((a, b) => String(a.publishedAt).localeCompare(String(b.publishedAt)))[0];
+        const n = pending.length;
+        return {
+            count: n,
+            label: `${plural(n, 'comment')} waiting for approval`,
+            tone: 'attention',
+            details: {
+                title: 'Blog',
+                rows: [
+                    { label: 'Waiting for approval', value: String(n) },
+                    { label: 'Published', value: String(count('published')) },
+                    { label: 'Drafts', value: String(count('draft')) },
+                    { label: 'Scheduled', value: next ? `${count('scheduled')} · next ${String(next.publishedAt).slice(0, 10)}` : String(count('scheduled')) }
+                ],
+                // Plain text: the popover sets it with textContent, so a comment is never markup.
+                items: pending.slice(0, 4).map(c => ({
+                    text: `${clip(c.authorName, 24)}: "${clip(c.body, 50)}"`,
+                    meta: `on ${clip(titleOf.get(c.postId) ?? 'a deleted post', 36)} · ${ago(c.createdAt)}`
+                })),
+                empty: 'No comments waiting.'
+            }
+        };
+    });
+
     /** POST /api/plugins/blog/comments - public, no authenticate */
     fastify.post('/comments', async (request, reply) => {
         const body = request.body ?? {};
 
+        // Read the settings as they are NOW. `settings` above is captured when
+        // the plugin registers, so switching comments off - or moderation -
+        // did nothing until a restart, and a closed blog kept taking comments
+        // from anyone who posted straight to this route.
+        const live = { ...defaultConfig, ...(getPluginStates()?.blog?.settings ?? {}) };
+        if (!live.commentsEnabled) return reply.code(403).send({ error: 'Comments are closed' });
+
         // Honeypot: non-empty `website` field = bot, silently discard
         if (body.website) {
             return reply.code(201).send({ ok: true });
@@ -417,7 +629,7 @@ export default async function blogPlugin(fastify, options) {
         if (!authorEmail) return reply.code(400).send({ error: 'authorEmail is required' });
         if (!commentBody) return reply.code(400).send({ error: 'body is required' });
 
-        const commentStatus = settings.commentModeration !== false ? 'pending' : 'approved';
+        const commentStatus = live.commentModeration !== false ? 'pending' : 'approved';
 
         const entry = await createEntry(COMMENTS_SLUG, {
             postId:      String(postId),
@@ -465,21 +677,42 @@ export default async function blogPlugin(fastify, options) {
     // Settings
     // -------------------------------------------------------------------------
 
+    // Plugin settings live in config/plugins.json under blog.settings, and the
+    // way to reach them is getPluginStates() / savePluginState(). These used to
+    // call getConfig() and saveConfig() from server/config.js, which take a FILE
+    // NAME: getConfig() with no argument read config/undefined.json and threw,
+    // so this endpoint answered 500 every time, and saveConfig(cfg) passed the
+    // whole config object as the name.
+
     /** GET /api/plugins/blog/settings */
     fastify.get('/settings', { preHandler: [authenticate] }, async (request, reply) => {
-        const cfg      = getConfig();
-        const overrides = cfg.plugins?.blog?.settings ?? {};
-        return reply.send({ ...defaultConfig, ...overrides });
+        const stored = getPluginStates()?.blog?.settings ?? {};
+        return reply.send({ ...defaultConfig, ...DISPLAY_DEFAULTS, ...stored });
     });
 
     /** PUT /api/plugins/blog/settings */
-    fastify.put('/settings', { preHandler: [requireAdmin] }, async (request, reply) => {
+    // requireAdmin reads request.user, which only `authenticate` populates -
+    // on its own it answers 401 to everyone, admin included.
+    fastify.put('/settings', { preHandler: [authenticate, requireAdmin] }, async (request, reply) => {
         const body = request.body ?? {};
-        const cfg  = getConfig();
-        cfg.plugins            ??= {};
-        cfg.plugins.blog       ??= {};
-        cfg.plugins.blog.settings = body;
-        await saveConfig(cfg);
-        return reply.send({ ok: true });
+
+        // Whitelist rather than merge: every key here is read back by the
+        // public routes, and storing whatever was posted invites surprises.
+        // Over what is stored, not over the defaults: a PUT carrying one field
+        // used to reset every other setting to its default.
+        const stored = getPluginStates()?.blog?.settings ?? {};
+        const merged = {
+            ...defaultConfig,
+            ...stored,
+            ...(body.basePath          !== undefined && { basePath: String(body.basePath) }),
+            ...(body.postsPerPage      !== undefined && { postsPerPage: Number(body.postsPerPage) || defaultConfig.postsPerPage }),
+            ...(body.commentsEnabled   !== undefined && { commentsEnabled: Boolean(body.commentsEnabled) }),
+            ...(body.commentModeration !== undefined && { commentModeration: Boolean(body.commentModeration) }),
+            ...(body.feedLength        !== undefined && { feedLength: Number(body.feedLength) || defaultConfig.feedLength }),
+            ...pickDisplaySettings(body)
+        };
+
+        savePluginState('blog', { settings: merged });
+        return reply.send({ ok: true, settings: merged });
     });
 }