domma-cms 0.55.1 → 0.69.3

package/plugins/blog/public/samples/rosewood.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1600 900" width="1600" height="900">
+<defs><linearGradient id="g" x1="0" y1="0" x2="1" y2="1"><stop offset="0" stop-color="#831843"/><stop offset="1" stop-color="#ec4899"/></linearGradient>
+<filter id="blur"><feGaussianBlur stdDeviation="40"/></filter></defs>
+<rect width="1600" height="900" fill="url(#g)"/>
+<g filter="url(#blur)"><circle cx="1309" cy="431" r="339" fill="#fecdd3" opacity="0.1"/><circle cx="750" cy="714" r="357" fill="#fecdd3" opacity="0.18"/><circle cx="1245" cy="680" r="207" fill="#ffffff" opacity="0.18"/><circle cx="546" cy="727" r="288" fill="#ffffff" opacity="0.18"/><circle cx="1564" cy="596" r="325" fill="#ec4899" opacity="0.14"/><circle cx="172" cy="540" r="370" fill="#ffffff" opacity="0.14"/><circle cx="1078" cy="252" r="125" fill="#ffffff" opacity="0.22"/></g>
+<path d="M0 520 C400 400 1200 640 1600 520" stroke="#fff" stroke-opacity=".12" stroke-width="2" fill="none"/><path d="M0 580 C400 460 1200 700 1600 580" stroke="#fff" stroke-opacity=".12" stroke-width="2" fill="none"/><path d="M0 640 C400 520 1200 760 1600 640" stroke="#fff" stroke-opacity=".12" stroke-width="2" fill="none"/><path d="M0 700 C400 580 1200 820 1600 700" stroke="#fff" stroke-opacity=".12" stroke-width="2" fill="none"/><path d="M0 760 C400 640 1200 880 1600 760" stroke="#fff" stroke-opacity=".12" stroke-width="2" fill="none"/><path d="M0 820 C400 700 1200 940 1600 820" stroke="#fff" stroke-opacity=".12" stroke-width="2" fill="none"/><path d="M0 880 C400 760 1200 1000 1600 880" stroke="#fff" stroke-opacity=".12" stroke-width="2" fill="none"/>
+</svg>

package/plugins/blog/templates/index.html

@@ -1,9 +1,10 @@
-<main class="container" style="padding: 2rem 0;">
-  <h1 class="mb-4">{{archiveTitle}}</h1>
-  <div id="blog-posts-list">
-    {{posts}}
-  </div>
-  <div id="blog-pagination" class="mt-4">
-    {{pagination}}
-  </div>
+<link rel="stylesheet" href="/plugins/blog/public/blog.css?v={{assetV}}">
+<main class="container blog-page" id="dm-blog">
+  <header class="blog-archive-head">
+    <h1>{{archiveTitle}}</h1>
+    {{archiveIntro}}
+  </header>
+  {{archive}}
+  {{pagination}}
 </main>
+<script type="module" src="/plugins/blog/public/blog.js?v={{assetV}}"></script>

package/plugins/blog/templates/post.html

@@ -1,18 +1,5 @@
-<main class="container" style="padding: 2rem 0;">
-  <article class="blog-post">
-    <header class="mb-4">
-      <h1>{{title}}</h1>
-      <p class="text-muted">by {{authorName}} &bull; <time>{{publishedAt}}</time></p>
-      <div class="mb-2">{{categories}}{{tags}}</div>
-    </header>
-    {{featuredImage}}
-    <div class="post-content mb-5">
-      {{content}}
-    </div>
-  </article>
-
-  <section id="comments" class="mt-5">
-    {{comments}}
-    {{commentForm}}
-  </section>
+<link rel="stylesheet" href="/plugins/blog/public/blog.css?v={{assetV}}">
+<main class="container blog-page" id="dm-blog">
+  {{post}}
 </main>
+<script type="module" src="/plugins/blog/public/blog.js?v={{assetV}}"></script>

package/plugins/blog/tests/layouts.test.js

@@ -0,0 +1,97 @@
+/**
+ * Blog layouts - the pure half of rendering through blocks (lib/layouts.js).
+ *
+ * Post fields reach these functions from authors, and the listing's metadata
+ * reaches every visitor's browser, so the escaping and the whitelists are
+ * pinned here rather than trusted.
+ */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {
+    buildToc, cardMeta, cardVars, interpolate, listDisplays, pickDisplay, pickDisplaySettings,
+    pickPostLayout, postLayouts, relatedPosts, safeImageUrl
+} from '../lib/layouts.js';
+
+test('interpolate: escaped by default, raw on request, dates formatted, comments dropped', () => {
+    const tpl = '<!-- header: {{title}} --><h1>{{title}}</h1>{{{html}}}<time>{{when:D MMM YYYY}}</time>{{missing}}';
+    assert.equal(
+        interpolate(tpl, {title: '<script>x</script>', html: '<b>ok</b>', when: '2026-09-23T10:00:00Z'}),
+        '<h1>&lt;script&gt;x&lt;/script&gt;</h1><b>ok</b><time>23 Sep 2026</time>'
+    );
+    assert.equal(interpolate('{{when:YYYY}}', {when: 'not a date'}), 'not a date', 'a non-date prints as itself');
+});
+
+test('the layouts on offer: shipped ones first, then any blog-post-* / blog-card-* block', () => {
+    const names = ['blog-post-long-read', 'blog-card-poster', 'blog-card', 'cta-banner', 'blog-post-classic', 'blog-post-Bad'];
+    assert.deepEqual(postLayouts(names).map(l => l.id),
+        ['blog-post-classic', 'blog-post-feature', 'blog-post-minimal', 'blog-post-sidebar', 'blog-post-long-read']);
+    assert.equal(postLayouts(names).at(-1).label, 'Long read');
+    const displays = listDisplays(names);
+    assert.deepEqual(displays.map(d => d.id), ['cards', 'list', 'magazine', 'compact', 'blog-card-poster']);
+    assert.equal(displays.at(-1).block, 'blog-card-poster');
+});
+
+test('a post uses its own layout, else the site default, else Classic', () => {
+    const layouts = postLayouts([]);
+    assert.equal(pickPostLayout({template: 'blog-post-feature'}, {postLayout: 'blog-post-minimal'}, layouts), 'blog-post-feature');
+    assert.equal(pickPostLayout({template: 'blog-post-gone'}, {postLayout: 'blog-post-minimal'}, layouts), 'blog-post-minimal');
+    assert.equal(pickPostLayout({}, {postLayout: 'blog-post-gone'}, layouts), 'blog-post-classic');
+    const displays = listDisplays([]);
+    assert.equal(pickDisplay('list', {listDisplay: 'compact'}, displays).id, 'list');
+    assert.equal(pickDisplay('nope', {listDisplay: 'compact'}, displays).id, 'compact');
+    assert.equal(pickDisplay('', {}, displays).id, 'cards');
+});
+
+test('display settings are whitelisted, and only the keys sent come back', () => {
+    assert.deepEqual(pickDisplaySettings({postLayout: 'blog-post-x', listDisplay: 'List!', relatedCount: '99', interactive: 0, other: 1}),
+        {postLayout: 'blog-post-x', relatedCount: 6, interactive: false});
+    assert.deepEqual(pickDisplaySettings({postLayout: '../etc'}), {});
+    assert.deepEqual(pickDisplaySettings({}), {});
+});
+
+test('contents: headings get unique ids; one heading is not worth a list', () => {
+    const {html, toc, count} = buildToc('<h2>Intro</h2><p>x</p><h3 id="kept">Detail</h3><h2>Intro</h2>');
+    assert.equal(count, 3);
+    assert.match(html, /<h2 id="intro">Intro<\/h2>/);
+    assert.match(html, /<h2 id="intro-2">Intro<\/h2>/);
+    assert.match(html, /<h3 id="kept">/);
+    assert.match(toc, /href="#intro-2"/);
+    assert.equal(buildToc('<h2>Only</h2>').toc, '');
+});
+
+test('image addresses are only ever plain URLs - nothing that escapes url() or src=""', () => {
+    assert.equal(safeImageUrl('/media/a.jpg'), '/media/a.jpg');
+    assert.equal(safeImageUrl('https://x.test/a.png'), 'https://x.test/a.png');
+    for (const bad of ["javascript:alert(1)", "/a.jpg') ; background:red", '/a".jpg', 'a.jpg', '']) {
+        assert.equal(safeImageUrl(bad), '', bad);
+    }
+});
+
+test('a card: markup only where the plugin built it; the browser gets plain values', () => {
+    const post = {id: 'p1', slug: 'hi there', title: 'A <b>', excerpt: 'e', categories: ['c1', 'gone'], tags: ['x"y'],
+        authorId: 'u1', content: 'word '.repeat(450), featuredImage: 'javascript:1', publishedAt: '2026-01-02T00:00:00Z'};
+    const catMap = {c1: {name: 'News <i>', slug: 'news'}};
+    const v = cardVars(post, {base: '/blog', catMap, authorName: 'Ann'});
+    assert.equal(v.url, '/blog/hi%20there');
+    assert.equal(v.image, '', 'an unsafe image is dropped, not escaped into place');
+    assert.equal(v.imageClass, 'no-image');
+    assert.equal(v.readingTime, '2 min read');
+    assert.match(v.categories, /News &lt;i&gt;/);
+    assert.match(v.tags, /data-blog-tag="x&quot;y"/);
+    const m = cardMeta(post, {catMap, authorName: 'Ann'});
+    assert.deepEqual(m.cats, [{slug: 'news', name: 'News <i>'}], 'plain text: the browser sets it as text');
+    assert.equal(m.minutes, 2);
+});
+
+test('related posts: shared categories outweigh shared tags; newer breaks a tie', () => {
+    const me = {id: 'me', categories: ['a'], tags: ['t']};
+    const all = [
+        me,
+        {id: 'tag-only', tags: ['t'], publishedAt: '2026-05-01'},
+        {id: 'cat-old', categories: ['a'], publishedAt: '2026-01-01'},
+        {id: 'cat-new', categories: ['a'], publishedAt: '2026-03-01'},
+        {id: 'none', publishedAt: '2026-06-01'}
+    ];
+    assert.deepEqual(relatedPosts(me, all, 3).map(p => p.id), ['cat-new', 'cat-old', 'tag-only']);
+    assert.deepEqual(relatedPosts(me, all, 0), []);
+});

package/plugins/blog/tests/public.test.js

@@ -0,0 +1,71 @@
+/**
+ * Blog - the routes readers and authors actually hit.
+ *
+ * The public pages are driven through @fastify/compress with a browser's
+ * Accept-Encoding, because that is where they broke: the handlers sent the
+ * page without returning the reply, and under compression every browser got a
+ * 200 with an EMPTY body. Plain requests (curl, tests without compression)
+ * still got the page, which is how it went unnoticed.
+ *
+ * Nothing here writes to the host CMS: the public plugin only reads, and the
+ * post rules are tested on the pure function that applies them.
+ */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import zlib from 'zlib';
+import Fastify from 'fastify';
+import compress from '@fastify/compress';
+import blogPublicPlugin from '../plugin.public.js';
+import {postFields} from '../plugin.js';
+
+async function buildPublic() {
+    const app = Fastify();
+    await app.register(compress, {global: true, threshold: 1024, encodings: ['br', 'gzip', 'deflate']});
+    await app.register(blogPublicPlugin, {settings: {basePath: '/blog'}, config: {}});
+    return app;
+}
+
+test('the blog index reaches a browser whole, under every encoding', async () => {
+    const app = await buildPublic();
+    const decoders = {gzip: zlib.gunzipSync, br: zlib.brotliDecompressSync, deflate: zlib.inflateSync};
+    for (const enc of ['gzip, deflate, br', 'gzip', 'br', 'identity']) {
+        const res = await app.inject({method: 'GET', url: '/blog', headers: {'accept-encoding': enc}});
+        assert.equal(res.statusCode, 200, enc);
+        const used = res.headers['content-encoding'];
+        const body = (used ? decoders[used](res.rawPayload) : res.rawPayload).toString('utf8');
+        assert.ok(body.length > 1000, `${enc}: a page, not an empty body (${body.length} bytes)`);
+        assert.match(body, /data-blog-archive/, enc);
+        assert.match(body, /\/plugins\/blog\/public\/blog\.js/, `${enc}: the listing script is on the page`);
+    }
+    const feed = await app.inject({method: 'GET', url: '/blog/feed.xml', headers: {'accept-encoding': 'gzip'}});
+    const xml = feed.headers['content-encoding'] === 'gzip' ? zlib.gunzipSync(feed.rawPayload) : feed.rawPayload;
+    assert.match(xml.toString('utf8'), /<rss version="2.0">/);
+    await app.close();
+});
+
+test('a display can be asked for, and an unknown one falls back', async () => {
+    const app = await buildPublic();
+    const list = await app.inject({method: 'GET', url: '/blog?display=compact'});
+    assert.match(list.body, /data-display="compact"/);
+    const odd = await app.inject({method: 'GET', url: '/blog?display=%3Cscript%3E'});
+    assert.doesNotMatch(odd.body, /data-display="<script>/);
+    assert.match(odd.body, /data-display="cards"/);
+    await app.close();
+});
+
+test('an author cannot publish by writing the status - that is what the publish route is for', () => {
+    const author = {id: 'a', role: 'blog-author'};
+    const editor = {id: 'e', role: 'blog-editor'};
+    assert.equal(postFields({status: 'published'}, author).status, undefined);
+    assert.equal(postFields({status: 'scheduled'}, author).status, undefined);
+    assert.equal(postFields({status: 'draft'}, author).status, 'draft', 'anyone may move their post back to draft');
+    assert.equal(postFields({status: 'published'}, editor).status, 'published');
+    assert.equal(postFields({status: 'bogus'}, editor).status, undefined);
+});
+
+test('a post keeps only the fields it has - no authorship, no sample flag, a valid layout', () => {
+    const out = postFields({title: ' T ', authorId: 'someone-else', sample: true, template: 'blog-post-feature', tags: [' a ', '', 'b']}, {role: 'admin'});
+    assert.deepEqual(out, {title: 'T', template: 'blog-post-feature', tags: ['a', 'b']});
+    assert.equal(postFields({template: '../../etc/passwd'}, {role: 'admin'}).template, '');
+    assert.equal(postFields({template: ''}, {role: 'admin'}).template, '', 'empty is "use the site default"');
+});

package/plugins/free-tier.lock.json

@@ -0,0 +1,74 @@
+{
+  "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
+  "source": "dcms-marketplace@6f9dbf3",
+  "plugins": {
+    "blog": {
+      "version": "1.4.4",
+      "files": {
+        "CLAUDE.md": "69087729ee22dddef5868e14fd6dd4570bb5387917020de873948785e6919756",
+        "admin/css/index.css": "2f39febfe02491f6db0e32b766723c3a2950a6a1139a108b2ec756d395472f30",
+        "admin/templates/blog.html": "a6054c1febe764bb1edf5c9e466d44a9080d9c83ba5486437b7a8244acf5ba54",
+        "admin/templates/categories.html": "ab7d6fc2fedd48876c585bc216a1532b3bdd78c946dee976c1171bfe4664feb6",
+        "admin/templates/comments.html": "095ff03bd5e1ed9ac75edf1ceb9fbe7b2907a1e35b261672da51e00742c2814a",
+        "admin/templates/post-editor.html": "c5292ecac2bfe4994ac62b4bf67631b7959dfa068cc3c1332d2268d870d0b467",
+        "admin/templates/settings.html": "e0730cd57435e592034328a699198d5e1326084767156bfc2289852f5f1a45af",
+        "admin/views/blog.js": "52bf73bfbc2d8736c1217d89dec1e69649f4b2f5334b7da1abf33bb1981dc921",
+        "admin/views/categories.js": "dade241e8d70d101366c5c8e9eed721f7b39ffda65025a272ae5679660f0f50c",
+        "admin/views/comments.js": "f5055e7b8e0c3fd8f71b2a8aeeb47c68fab5ff7d24ffb5d9e052eedfc1da1df2",
+        "admin/views/kit.js": "c7b475fe5920b6429a03976a1463a218751e0ed2e42135920e4c3b1ebf47e79f",
+        "admin/views/post-editor.js": "97ea927c539419940fccf4a78fc3098e00beca3454a56ef432fa94b7f3cacb81",
+        "admin/views/settings-cog.js": "307efc93835863dd8511f8fb17a224cf45a77532c90b854a86d2cd1d4e5f9f18",
+        "admin/views/settings.js": "2b7f775e37e034dee4ae3dfadea5e446c2e526bed8a066ef3ca2e777146ada23",
+        "blocks/blog-card-compact.css": "eb8e8ae9a6461c362bc021ea0396c6b4481047b6b36a50eeb59e47375e49be75",
+        "blocks/blog-card-compact.html": "7e1e31923808e6108d57d34309d3442b5d93b4aa4396f0e471e870249934ab8f",
+        "blocks/blog-card-row.css": "f5f0249c51a40cc71ff8d054bfa887353badc79730b0f323c76ac32f7d893b44",
+        "blocks/blog-card-row.html": "eb28d26c86c4cefcf553273e6547885b0dc03fbb6e2543e9c1aa4b132db6216a",
+        "blocks/blog-card.css": "d480a80a7378bd55659e9549bb30d8c106bdae1a9cd450a8c0114bfaefa94cd2",
+        "blocks/blog-card.html": "cf676e8e9f676ea8b49637cb54a7d6fcd6f3395af8f4a8833a65ba78b35efc76",
+        "blocks/blog-post-classic.css": "9acac617847b5a10dabd5efccb601572e2751f792c4038475325f11e24142584",
+        "blocks/blog-post-classic.html": "1fab77c7aeb67fe72b73c4db42ff4c3a66466c041104639f4898c390c665fc38",
+        "blocks/blog-post-feature.css": "7d8a242b627f3826df21d5470e643b386967122ea3585e69f96cce9ffc2452e9",
+        "blocks/blog-post-feature.html": "c0408538cc269e4f2873f9c9c44a000347e4d5cafe3ecb024f62112ea711a9ab",
+        "blocks/blog-post-minimal.css": "2323b84a7d0a99e1c85c30faa18bb2ee16763ff08cfe87f181ffadf8cff84dd0",
+        "blocks/blog-post-minimal.html": "3a04925980018a13038ebf4bcfecc4f69284c1bac087631ddc0f66e0e95e07fe",
+        "blocks/blog-post-sidebar.css": "3c66109fa48ca448605eb5acd0c998f43649fb3747813b4a811992ec89886007",
+        "blocks/blog-post-sidebar.html": "d510a9e272e9415941064b4567def47a179b88825e29c6dd340540870ab04a61",
+        "collections/categories/schema.json": "0728e522ed8e3c623fd45e137cd03e0960aa5158e70613ec8628c8b3928e0929",
+        "collections/comments/schema.json": "29cbd289cbfcfc4158c9357a218db4ce06eddc3370bfbf9afb7d7f52065a849e",
+        "collections/posts/schema.json": "19a5a770d3eefea73f4117454bd1312a7a7e3d727cfcdfde141139fbc81cabd7",
+        "config.js": "ee67396262762f5c31269d258affd75f7392a3e364f72f7792c2f1cdafd94bba",
+        "lib/layouts.js": "e55dfd79227a36e190d648dcbd3c31de538dafed9b5ca68844c98ef79b6c2509",
+        "lib/page.js": "1fb9a01c3080e8ecf65c19b1273b23d550a131fe30079a493a9f5b1c90b720ae",
+        "lib/render.js": "0e97c6a950bc962c8d8ea4b2f21d06cb73fbcdc738d8942d6935d01309a29b1d",
+        "lib/samples.js": "e8cdb77ce22e43937707f6854d3a5cb722437dc584e22ac7b24480bef686cf85",
+        "plugin.js": "32e223ff46bfc72a4db6904425ef9488538a901d73c67be41a0fc0cc037e457b",
+        "plugin.json": "16104f855c0afa2912d5a96465d6388e4090d56fabbf566401942d8160ea2d1b",
+        "plugin.public.js": "053bbc0322ba205640fdbb834340883d0698600e7a637c8165ecac9d49c8d040",
+        "public/blog.css": "fd733e6b624190da1e70dc1b6613e2376efd7f7570a28fab311d81006d03d960",
+        "public/blog.js": "d01c72a9834dcc7c5241923371f2b164ac30d20ac9f1a5c5dc5b71fa3cb09f08",
+        "public/samples/aurora.svg": "feb29e2b46465913fc29de9eda221b00b1541f1fa3ea7120f0c1d1cd11a9a4f6",
+        "public/samples/dusk.svg": "92469dcfe2e78ed9bfa6ddeb9f9c4726ec64e04c6e9b40260523a825b582b580",
+        "public/samples/ember.svg": "754cb6e1cc2d26274f24bf86baa7658a402448944dcfb10709c658abad9b29d0",
+        "public/samples/harbour.svg": "a5f09eafa1406da3c2d017e9bee308a98543df15090ed27227cbbf8341aec460",
+        "public/samples/meadow.svg": "90efae21e209b7d48901eed457f47d0a347c58a6b6e1ea81ba98c131c4c559cb",
+        "public/samples/rosewood.svg": "0f963fe5633585786271255b7c9df36be67748ae751f9cf7b0bbda6f5b93449d",
+        "roles/blog-author.json": "ccdd4d99296c157ddc839af22ef6e79c47c381dd9d937069f7090a4fb76bb41d",
+        "roles/blog-editor.json": "bea0b673cf9e3da04c5882d51dd33bdcaf035b047c1cfe87624a9f16e6514ffc",
+        "templates/index.html": "3c2cf8a4ffde8599d451f6d00b736aeba42fd073b726ada3b0ffe4d56e1ef0f4",
+        "templates/post.html": "28e9f06071115ecc4fbba007b35782732bf12ef72528525893d424e3c4f0313f",
+        "tests/layouts.test.js": "70e0e462985d14618838c3897ffff7c453b711b64c6fc9277023268b0755377c",
+        "tests/public.test.js": "ef04ba271d03cee86adac332c6834bb51102b20d892d5f84d30eb04507605de5"
+      }
+    },
+    "mail-reader": {
+      "version": "1.0.0",
+      "files": {
+        "CLAUDE.md": "a8dd2cb285e1d24b2f072aa11a644e1c8c1be89013da6f6cc46d9820fe24ccd5",
+        "admin/views/mail.js": "c5c6483f9618c75cac8f4be32d3aea99511db76d4b9d38b8ef43bdc1d35db3c5",
+        "config.js": "6e65803ad822a9acda40c203631b8eb32a87cf9d9e5f1c7cb59d01aa406075c6",
+        "plugin.js": "79b17346ed0192b092040460cc8d762d5207ee6e4af7bfc2d1cf654a51e2fa81",
+        "plugin.json": "5f5b98757514aa70d7c7a2be5a1fbfdde8ef21a2ccc7586b3b5aea9b44fbe5e6"
+      }
+    }
+  }
+}

package/plugins/mail-reader/CLAUDE.md

@@ -0,0 +1,78 @@
+# mail-reader — AI Assistant Guide
+
+## Purpose
+
+Read-only IMAP mailbox reader. Connects to a **standard IMAP server** and displays mail. It
+deliberately cannot write: no mark-as-read, no flagging, no move, no delete, no send.
+
+Full mail (sending, flags, drafts, search, sync) is **`email-pro`** — a separate Pro-tier plugin
+that requires MongoDB. Nothing here should grow toward it by accident — phase 1 keeps **no message store at
+all**, which is what makes the Pro sync layer a clean addition rather than a migration.
+
+## Files
+
+- `plugin.json`, `config.js`, `plugin.js` — manifest, defaults, routes
+- `admin/views/mail.js`, `admin/templates/mail.html`, `admin/css/mail.css`
+
+The IMAP core — crypto, account store, connection pool, renderer — is **not here**. It lives in
+`plugins/_lib/mail/`, shared with `email-pro`, with its state at `plugins/_lib/data/`. See
+`plugins/_lib/mail/CLAUDE.md` before changing anything about credentials or connections.
+
+## Routes
+
+All under `/api/plugins/mail-reader`, all requiring authentication.
+
+| Method | Path | Purpose |
+|---|---|---|
+| GET | `/accounts` | Every mailbox this user owns. Never returns passwords, only `hasPassword`. |
+| POST | `/accounts` | Add a mailbox. |
+| PUT | `/accounts/:id` | Update one. A blank password means "keep the stored one". |
+| DELETE | `/accounts/:id` | Forget a mailbox and its password. |
+| POST | `/accounts/test` | Try details without saving. With `id` and a blank password, uses the stored one. |
+| GET | `/folders` | Folder list, `\Noselect` filtered out. `?account=` |
+| GET | `/messages` | One page of envelopes, newest first. `?account=&folder=&page=&limit=` |
+| GET | `/messages/:uid` | One message, rendered. `?account=&folder=&images=load` |
+| GET | `/messages/:uid/attachments/:index` | Streams one part as a download. `?account=&folder=` |
+
+A user may hold several mailboxes. Omitting `?account=` selects their first one, so the reader can
+open on something rather than asking which before it has shown anything.
+
+## Gotchas
+
+- **Read-only is enforced, not merely omitted.** Mailboxes open `{readOnly: true}` and ImapFlow
+  fetches with `BODY.PEEK[]`. Drop either and the server sets `\Seen` as a side effect of *reading*
+  a message — the user's phone then shows mail they never opened. There is no route that writes;
+  keep it that way until mark-as-read is a deliberate, visible action.
+- **No permission resource, on purpose.** Access control is ownership: every route resolves the
+  account from `request.user`, and no route takes someone else's id. Registering a `mail-reader` resource
+  would 403 every user *including super-admin* (no bypass since 0.22) from the moment the plugin was
+  enabled, because a new resource belongs to no role and nothing back-fills it.
+- **Credentials are not a collection.** `schema.plugin` is a badge, not a visibility gate — a
+  plugin-owned collection still appears in admin Collections with a working Entries link, is
+  reachable via `/api/v1`, and can be pointed at a shared Mongo. Hence `data/accounts.json`, 0600,
+  gitignored, and excluded from the npm `files` list.
+- **Key resolution is a chain**, not a single source: `MAIL_SECRET` → `INSTANCE_SECRET` →
+  generated `data/.mailkey`. `INSTANCE_SECRET` only exists on sites that ran setup or registered
+  with the manager, so relying on it alone breaks every older site. The sealing source is recorded
+  in each token so a key change fails with a sentence, not a bare auth error.
+- **Never derive from `JWT_SECRET`.** Rotating it logs everyone out, which is recoverable; silently
+  bricking every stored mailbox password at the same time is not.
+- **`transformTags` runs BEFORE attribute filtering** in sanitize-html. `target` and `rel` must be
+  on `allowedAttributes.a` or the values the transform just set are stripped straight back off, and
+  links inside the sandboxed iframe silently do nothing. This has already been fixed once.
+- **Remote images are blocked by default** and the per-message override is never persisted — it
+  lives in a `Set` in the view. Loading a remote image reports the open back to the sender; that
+  decision should be per message, not a preference someone forgets they set.
+- **The iframe sandbox has neither `allow-scripts` nor `allow-same-origin`.** That pair is the whole
+  defence. `allow-popups` is there only so links can open in a new tab.
+- **Attachment downloads go through `fetch` + blob**, not a plain `<a href>` — the route needs the
+  bearer token, which a link cannot carry.
+- **Single-process only.** The connection pool is module state, like the messages plugin's SSE
+  registry. Multiple workers would each open their own connections and hit per-user server limits.
+
+## Testing
+
+`services/secretbox.js` and `services/render.js` are pure and unit-tested. Connection behaviour
+should be checked against a **real IMAP server** — `mail.dommajs.org` answers on 993 (TLS) and 143
+(STARTTLS). A wrong-credentials attempt is enough to verify TLS, auth-failure mapping and that the
+pool leaves nothing open; it does not verify folder listing or rendering, which need a real mailbox.

package/plugins/mail-reader/admin/views/mail.js

@@ -0,0 +1,19 @@
+/**
+ * Mail Reader admin view.
+ *
+ * The three-pane reader is shared with the other edition and lives in
+ * `plugins/_lib/admin/mail/reader-view.js`. It is imported dynamically so the
+ * loader's cache-busting token reaches it: a static specifier is fixed, so the
+ * shared code would keep being served from cache after an update while this
+ * file was refetched.
+ *
+ * @module mail-reader/admin/views/mail
+ */
+const ASSET_VERSION = new URL(import.meta.url).searchParams.get('v') ?? '1';
+
+const {createReaderView} = await import(`/plugins/_lib/admin/mail/reader-view.js?v=${ASSET_VERSION}`);
+
+export const mailView = createReaderView({
+    pluginName: 'mail-reader',
+    assetVersion: ASSET_VERSION
+});

package/plugins/mail-reader/config.js

@@ -0,0 +1,7 @@
+/**
+ * Mail Reader - default configuration.
+ *
+ * The reading defaults are shared with `email-pro` and live in
+ * `plugins/_lib/mail/defaults.js`. The free edition uses them unchanged.
+ */
+export {default} from '../_lib/mail/defaults.js';

package/plugins/mail-reader/plugin.js

@@ -0,0 +1,48 @@
+/**
+ * Mail Reader plugin - read-only IMAP mailbox reader.
+ *
+ * Almost nothing lives here. The routes are `registerReadRoutes()` from
+ * `plugins/_lib/mail/`, shared with `email-pro`, which registers the same
+ * surface and adds writing, sending and a synchronised store on top. This file
+ * is the free edition's wiring: its defaults, its connection pool, and the
+ * decision to register the read surface and nothing else.
+ *
+ * Routes mount at /api/plugins/mail-reader. See
+ * `plugins/_lib/mail/readRoutes.js` for what they do and why they are
+ * read-only at the protocol level rather than merely by omission.
+ *
+ * @module mail-reader/plugin
+ */
+import {createPool} from '../_lib/mail/imapPool.js';
+import {registerReadRoutes} from '../_lib/mail/readRoutes.js';
+import defaultConfig from './config.js';
+
+export default async function mailReaderPlugin(fastify, options) {
+    const config = {...defaultConfig, ...(options.settings || {})};
+    const pool = createPool(config);
+
+    // Connections are process state; a reload or shutdown should close them
+    // rather than leave the mail server holding dead sessions.
+    fastify.addHook('onClose', async () => pool.closeAll());
+
+    registerReadRoutes(fastify, {
+        auth: options.auth,
+        hooks: options.hooks,
+        config,
+        pool,
+        pluginName: 'mail-reader'
+    });
+}
+
+/**
+ * Nothing to provision - the plugin's only state is the shared mail store,
+ * which is created on first save.
+ *
+ * @returns {Promise<void>}
+ */
+export async function onEnable() {}
+
+/**
+ * @returns {Promise<void>}
+ */
+export async function onDisable() {}

package/plugins/mail-reader/plugin.json

@@ -0,0 +1,34 @@
+{
+  "name": "mail-reader",
+  "displayName": "Mail Reader",
+  "version": "1.0.0",
+  "tier": "free",
+  "description": "Read-only IMAP mailbox reader. Connects to a standard IMAP server and reads mail without ever writing to it.",
+  "author": "Darryl Waterhouse",
+  "date": "2026-09-19",
+  "icon": "mail",
+  "admin": {
+    "sidebar": [
+      {
+        "id": "mail-reader",
+        "text": "Mail Reader",
+        "icon": "mail",
+        "url": "#/plugins/mail-reader",
+        "section": "#/plugins/mail-reader"
+      }
+    ],
+    "routes": [
+      {
+        "path": "/plugins/mail-reader",
+        "view": "plugin-mail-reader",
+        "title": "Mail Reader - Domma CMS"
+      }
+    ],
+    "views": {
+      "plugin-mail-reader": {
+        "entry": "mail-reader/admin/views/mail.js?v=1",
+        "exportName": "mailView"
+      }
+    }
+  }
+}

package/public/css/forms.css

@@ -1 +1 @@
-.fb-form-wrapper{max-width:600px;margin:2rem auto}.fb-form-honeypot{position:absolute;left:-9999px;top:-9999px;width:0;height:0;overflow:hidden;opacity:0;z-index:-1}.fb-form-success{padding:1rem 1.25rem;border-radius:var(--dm-radius-md, 6px);background:color-mix(in srgb,var(--dm-success) 12%,transparent);border:1px solid color-mix(in srgb,var(--dm-success) 30%,transparent);color:var(--dm-success);font-size:.95rem;margin-top:.5rem}.fb-form-error{padding:.75rem 1rem;border-radius:var(--dm-radius-md, 6px);background:color-mix(in srgb,var(--dm-danger) 10%,transparent);border:1px solid color-mix(in srgb,var(--dm-danger) 25%,transparent);color:var(--dm-danger);font-size:.875rem;margin-top:.75rem}.fb-form-loading{opacity:.6;pointer-events:none}.wizard-progress{height:4px;background:var(--dm-border);border-radius:2px;margin-bottom:1rem}.wizard-progress-bar{height:100%;background:var(--dm-primary);border-radius:2px;transition:width .3s ease}.wizard-step-title{font-size:1.1rem;font-weight:600;margin-bottom:.25rem}.wizard-step-description{font-size:.875rem;color:var(--dm-text-muted);margin-bottom:1rem}.wizard-nav{display:flex;justify-content:space-between;gap:.5rem;margin-top:1rem}.fb-field-hidden{display:none!important}.fb-validation-error{color:var(--dm-danger);font-size:.8rem;margin-top:.25rem}.fb-form-wrapper .domma-form-field{margin-bottom:2rem}.fb-form-wrapper .form-group:not(.form-buttons){margin-bottom:2rem}.fb-spacer{height:2rem}.fb-field-required .picker-label:after,.fb-field-required>.form-label:after{content:" *";color:var(--dm-danger)}.fb-field-required .picker-label .picker-required{display:none}.fb-field-invalid>.form-label,.fb-field-invalid .picker-label{color:var(--dm-danger)}.fb-field-invalid .form-input,.fb-field-invalid .form-select,.fb-field-invalid textarea,.fb-field-invalid .picker-options{border-color:var(--dm-danger)}@media(max-width:700px){.fb-form-wrapper form.grid,[data-form-inline] form.grid,.fb-form-wrapper .wizard form.grid,[data-form-inline] .wizard form.grid{grid-template-columns:1fr!important}.fb-form-wrapper form.grid>[class*=col-span-],[data-form-inline] form.grid>[class*=col-span-]{grid-column:span 1 / span 1!important}}.wizard-nav{gap:1rem;flex-wrap:wrap}.wizard-nav .btn{min-width:7.5rem}@media(max-width:480px){.wizard-nav{flex-direction:column-reverse}.wizard-nav .btn{width:100%}}.fb-form-wrapper .form-buttons,[data-form-inline] .form-buttons{display:flex;gap:1rem;flex-wrap:wrap;margin-top:1.25rem}
+.fb-form-wrapper{max-width:600px;margin:2rem auto}.fb-form-honeypot{position:absolute;left:-9999px;top:-9999px;width:0;height:0;overflow:hidden;opacity:0;z-index:-1}.fb-form-success{padding:1rem 1.25rem;border-radius:var(--dm-radius-md, 6px);background:color-mix(in srgb,var(--dm-success) 12%,transparent);border:1px solid color-mix(in srgb,var(--dm-success) 30%,transparent);color:var(--dm-success);font-size:.95rem;margin-top:.5rem}.fb-form-error{padding:.75rem 1rem;border-radius:var(--dm-radius-md, 6px);background:color-mix(in srgb,var(--dm-danger) 10%,transparent);border:1px solid color-mix(in srgb,var(--dm-danger) 25%,transparent);color:var(--dm-danger);font-size:.875rem;margin-top:.75rem}.fb-form-loading{opacity:.6;pointer-events:none}.wizard-progress{height:4px;background:var(--dm-border);border-radius:2px;margin-bottom:1rem}.wizard-progress-bar{height:100%;background:var(--dm-primary);border-radius:2px;transition:width .3s ease}.wizard-step-title{font-size:1.1rem;font-weight:600;margin-bottom:.25rem}.wizard-step-description{font-size:.875rem;color:var(--dm-text-muted);margin-bottom:1rem}.wizard-nav{display:flex;justify-content:space-between;gap:.5rem;margin-top:1rem}.fb-field-hidden{display:none!important}.fb-validation-error{color:var(--dm-danger);font-size:.8rem;margin-top:.25rem}.fb-field-trigger-hidden{display:none!important}.fb-field-disabled{opacity:.55;pointer-events:none}.fb-trigger-banner{display:flex;align-items:flex-start;gap:.75rem;margin:.75rem 0;padding:.7rem .9rem;border-radius:var(--dm-radius-md);border-left:3px solid var(--dm-info);background:var(--dm-surface-raised);color:var(--dm-text);font-size:.9rem}.fb-trigger-banner--success{border-left-color:var(--dm-success)}.fb-trigger-banner--warning{border-left-color:var(--dm-warning)}.fb-trigger-banner--error{border-left-color:var(--dm-danger)}.fb-trigger-banner-text{flex:1 1 auto}.fb-trigger-banner-close{flex:0 0 auto;background:none;border:0;color:var(--dm-text-muted);font-size:1.1rem;line-height:1;cursor:pointer;padding:0 .15rem}.fb-trigger-banner-close:hover{color:var(--dm-text)}.fb-trigger-block-note{color:var(--dm-danger);font-size:.85rem;margin:.5rem 0 0}.fb-form-wrapper .grid>.fb-trigger-banner,.cms-form-embed .grid>.fb-trigger-banner{grid-column:1 / -1}.fb-form-wrapper .domma-form-field{margin-bottom:2rem}.fb-form-wrapper .form-group:not(.form-buttons){margin-bottom:2rem}.fb-spacer{height:2rem}.fb-field-required .picker-label:after,.fb-field-required>.form-label:after{content:" *";color:var(--dm-danger)}.fb-field-required .picker-label .picker-required{display:none}.fb-field-invalid>.form-label,.fb-field-invalid .picker-label{color:var(--dm-danger)}.fb-field-invalid .form-input,.fb-field-invalid .form-select,.fb-field-invalid textarea,.fb-field-invalid .picker-options{border-color:var(--dm-danger)}@media(max-width:700px){.fb-form-wrapper form.grid,[data-form-inline] form.grid,.fb-form-wrapper .wizard form.grid,[data-form-inline] .wizard form.grid{grid-template-columns:1fr!important}.fb-form-wrapper form.grid>[class*=col-span-],[data-form-inline] form.grid>[class*=col-span-]{grid-column:span 1 / span 1!important}}.wizard-nav{gap:1rem;flex-wrap:wrap}.wizard-nav .btn{min-width:7.5rem}@media(max-width:480px){.wizard-nav{flex-direction:column-reverse}.wizard-nav .btn{width:100%}}.fb-form-wrapper .form-buttons,[data-form-inline] .form-buttons{display:flex;gap:1rem;flex-wrap:wrap;margin-top:1.25rem}

package/public/css/search.css

@@ -0,0 +1 @@
+.site-search-trigger{display:inline-flex;align-items:center;justify-content:center;background:none;border:none;cursor:pointer;padding:6px 8px;border-radius:var(--dm-radius, 6px);color:inherit;opacity:.75;transition:opacity .15s,background .15s;font-size:var(--dm-font-size-sm, 14px)}.site-search-trigger:hover{opacity:1;background:var(--dm-hover-bg, rgba(128, 128, 128, .14))}.site-search-trigger svg,.site-search-trigger span[data-icon]{width:18px;height:18px}.site-search-shortcut-hint{display:inline-block;font-size:11px;line-height:1;padding:2px 5px;border-radius:4px;border:1px solid var(--dm-border, rgba(0, 0, 0, .15));color:var(--dm-text-muted, #888);margin-left:4px;vertical-align:middle;font-family:var(--dm-font-mono, monospace)}.site-search-overlay{position:fixed;inset:0;z-index:10000;background:#00000073;backdrop-filter:blur(3px);-webkit-backdrop-filter:blur(3px);display:flex;align-items:flex-start;justify-content:center;padding-top:10vh;animation:ss-overlay-in .15s ease}@keyframes ss-overlay-in{0%{opacity:0}to{opacity:1}}.site-search-panel{width:100%;max-width:600px;margin:0 16px;border-radius:var(--dm-radius-lg, 10px);background:#1e2030;color:#e8eaf0;border:1px solid rgba(255,255,255,.1);box-shadow:0 24px 64px #0009;overflow:hidden;animation:ss-panel-in .15s ease}@keyframes ss-panel-in{0%{transform:translateY(-12px);opacity:0}to{transform:translateY(0);opacity:1}}.site-search-header{display:flex;align-items:center;padding:12px 16px;border-bottom:1px solid rgba(255,255,255,.08);gap:8px}.site-search-header span[data-icon],.site-search-header svg{width:18px;height:18px;flex-shrink:0;opacity:.45;color:#e8eaf0}.site-search-input{flex:1;border:none;outline:none;background:transparent;font-size:var(--dm-font-size-lg, 16px);color:#e8eaf0;font-family:var(--dm-font-sans, sans-serif);padding:0}.site-search-input::placeholder{color:#e8eaf066;opacity:1}.site-search-close-btn{display:inline-flex;align-items:center;justify-content:center;background:none;border:1px solid rgba(255,255,255,.15);cursor:pointer;color:#e8eaf080;border-radius:var(--dm-radius, 6px);padding:4px 8px;font-size:12px;font-family:var(--dm-font-mono, monospace);transition:color .15s,border-color .15s;flex-shrink:0}.site-search-close-btn:hover{color:#e8eaf0;border-color:#ffffff4d}.site-search-results{max-height:60vh;overflow-y:auto;padding:8px 0}.site-search-result{display:block;padding:10px 16px;text-decoration:none;color:inherit;border-left:3px solid transparent;transition:background .1s,border-color .1s;cursor:pointer}.site-search-result:hover,.site-search-result.active{background:#ffffff0f;border-left-color:var(--dm-primary, #5b8cff)}.site-search-result-title{font-weight:600;font-size:var(--dm-font-size-sm, 14px);margin-bottom:2px;color:#e8eaf0}.site-search-result-snippet{font-size:12px;color:#e8eaf08c;line-height:1.4;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.site-search-result-snippet mark{background:#5b8cff40;color:#e8eaf0;border-radius:2px;padding:0 1px}.site-search-loading,.site-search-empty{padding:24px 16px;text-align:center;color:#e8eaf073;font-size:var(--dm-font-size-sm, 14px)}.site-search-loading-dots{display:inline-flex;gap:4px}.site-search-loading-dots span{width:6px;height:6px;border-radius:50%;background:#e8eaf066;animation:ss-dot-pulse 1.2s ease-in-out infinite}.site-search-loading-dots span:nth-child(2){animation-delay:.2s}.site-search-loading-dots span:nth-child(3){animation-delay:.4s}@keyframes ss-dot-pulse{0%,80%,to{transform:scale(.6);opacity:.4}40%{transform:scale(1);opacity:1}}.site-search-results:not(:empty){border-top:1px solid rgba(255,255,255,.06)}.site-search-footer{padding:6px 16px;border-top:1px solid rgba(255,255,255,.06);display:flex;gap:12px;font-size:11px;color:#e8eaf059}.site-search-footer kbd{display:inline-block;padding:1px 4px;border-radius:3px;border:1px solid rgba(255,255,255,.15);font-family:var(--dm-font-mono, monospace);font-size:10px}@media(max-width:640px){.site-search-overlay{padding-top:5vh;align-items:flex-start}.site-search-panel{margin:0 8px;border-radius:var(--dm-radius, 6px)}.site-search-results{max-height:70vh}.site-search-shortcut-hint{display:none}}.site-search-floating-trigger{position:fixed;z-index:9999;width:52px;height:52px;border-radius:50%;border:1px solid var(--dm-border, rgba(0, 0, 0, .12));cursor:pointer;display:flex;align-items:center;justify-content:center;gap:8px;background:var(--dm-surface, #fff);color:var(--dm-text, #111);box-shadow:0 4px 16px #00000024;transition:background .15s,color .15s,border-color .15s,transform .15s,box-shadow .15s;outline:none;white-space:nowrap}.site-search-floating-trigger:hover{background:var(--dm-primary, #5b8cff);color:#fff;border-color:var(--dm-primary, #5b8cff);box-shadow:0 6px 20px #00000038;transform:scale(1.05)}.site-search-floating-trigger:active{transform:scale(.97)}.site-search-floating-trigger svg,.site-search-floating-trigger [data-icon]{width:var(--ss-icon-glyph, 20px);height:var(--ss-icon-glyph, 20px);flex-shrink:0;pointer-events:none}.site-search-floating-trigger--pill{width:auto;height:44px;border-radius:999px;padding:0 18px 0 14px}.site-search-floating-label{font-size:.875rem;font-weight:500;letter-spacing:.01em;pointer-events:none}