domma-cms 0.55.1 → 0.69.3

package/server/routes/api/contacts.js

@@ -0,0 +1,506 @@
+/**
+ * Contacts API - /api/contacts
+ *
+ * Was the `contacts` plugin until 0.67.0. Enabled on every site on the fleet,
+ * which is the case for it being part of the CMS rather than something you go
+ * shopping for.
+ *
+ * **Per-user scope, for contacts only.** A contact carries a `userId` and reads
+ * are filtered to the caller's own. **Groups are not**: `loadGroups()` takes no
+ * user and never has, so a group one person creates is visible to everyone.
+ * That asymmetry is preserved rather than tidied - changing who can see a group
+ * is a behaviour change, and this was a relocation. A test pins it so the next
+ * reader finds it stated rather than inferred.
+ *
+ * Hand-filtered, as the plugin did it, rather than via rowAccess.js - the right
+ * end state, and again not something to smuggle into a move.
+ *
+ * **The slugs are `contacts-contacts` and `contacts-groups`**, not the
+ * directories the schemas used to sit in (`user-contacts`,
+ * `user-contact-groups`). setupPlugin() read `schema.slug`, so those are the
+ * live collections and existing rows are found only if they stay exactly so.
+ *
+ * The plugin called syncPluginSchemas() to keep an existing collection's fields
+ * in step with its schema. Core has no need: seedAll() rewrites every preset's
+ * schema.json on each boot, which is the same job done earlier.
+ */
+import {authenticate as defaultAuthenticate, requirePermission as defaultRequirePermission} from '../../middleware/auth.js';
+import {createEntry, deleteEntry, getEntry, listEntries, updateEntry} from '../../services/collections.js';
+
+const CONTACTS_SLUG = 'contacts-contacts';
+const GROUPS_SLUG = 'contacts-groups';
+
+/**
+ * The fields a contact carries beyond a name and a phone number.
+ *
+ * Kept as one list so the create, update and import paths cannot drift apart -
+ * they each used to spell the field set out by hand, which is how a field gets
+ * added to two of the three and quietly dropped by the other.
+ */
+const TEXT_FIELDS = [
+    'name', 'email', 'phone', 'notes',
+    'company', 'jobTitle', 'website',
+    'vatNumber', 'companyNumber', 'reference', 'billingEmail', 'currency',
+    'accountName', 'bankName', 'sortCode', 'accountNumber', 'iban', 'bic'
+];
+
+/** Repeatable lists, each a array of small objects. */
+const LIST_FIELDS = ['addresses', 'emails', 'phones'];
+
+/** Parse a value that may have been stored as JSON text by an import or the API. */
+function toArray(value) {
+    if (Array.isArray(value)) return value;
+    if (typeof value === 'string' && value.trim()) {
+        try {
+            const parsed = JSON.parse(value);
+            return Array.isArray(parsed) ? parsed : [];
+        } catch {
+            return [];
+        }
+    }
+    return [];
+}
+
+const str = (v) => (typeof v === 'string' ? v.trim() : (v === undefined || v === null ? '' : String(v)));
+
+/**
+ * One address, with every part named.
+ *
+ * Stored as parts rather than a blob because an invoice, a letter and a
+ * delivery note each want them arranged differently - and because a postcode
+ * you cannot read out separately is not much use for anything.
+ */
+function cleanAddress(raw) {
+    return {
+        label:    str(raw?.label) || 'Address',
+        line1:    str(raw?.line1),
+        line2:    str(raw?.line2),
+        city:     str(raw?.city),
+        region:   str(raw?.region),
+        postcode: str(raw?.postcode),
+        country:  str(raw?.country),
+        isBilling: raw?.isBilling === true || raw?.isBilling === 'true'
+    };
+}
+
+function cleanEmail(raw) {
+    return { label: str(raw?.label) || 'Email', address: str(raw?.address) };
+}
+
+function cleanPhone(raw) {
+    return { label: str(raw?.label) || 'Phone', number: str(raw?.number) };
+}
+
+const CLEANERS = { addresses: cleanAddress, emails: cleanEmail, phones: cleanPhone };
+
+/** Coerce a repeatable list, dropping rows with nothing in them. */
+function cleanList(field, value) {
+    const clean = CLEANERS[field];
+    return toArray(value)
+        .map(clean)
+        .filter((row) => Object.entries(row).some(([k, v]) => k !== 'label' && v !== '' && v !== false));
+}
+
+/**
+ * An address as an invoice prints it: one line per part, blanks omitted.
+ *
+ * @param   {object} address
+ * @returns {string}
+ */
+export function formatAddress(address) {
+    if (!address) return '';
+    return [address.line1, address.line2, address.city, address.region, address.postcode, address.country]
+        .map(str)
+        .filter(Boolean)
+        .join('\n');
+}
+
+/**
+ * The address to bill to: the one marked for billing, else the first.
+ *
+ * @param   {object[]} addresses
+ * @returns {object|null}
+ */
+export function billingAddress(addresses) {
+    const list = toArray(addresses);
+    return list.find((a) => a?.isBilling) ?? list[0] ?? null;
+}
+
+/**
+ * A contact projected into the shape the Invoice plugin's receivers use.
+ *
+ * This is the join between the two plugins: the field names are Invoice's, not
+ * Contacts', so the caller can post it straight at `/api/plugins/invoice/receivers`.
+ *
+ * @param   {object} contact as returned by toContact()
+ * @returns {object}
+ */
+export function toBillingProfile(contact) {
+    const address = billingAddress(contact.addresses);
+    return {
+        name:      contact.name,
+        company:   contact.company,
+        // The billing address wins over the personal one, which is the whole
+        // point of having both - invoices go to accounts, not to a mobile.
+        email:     contact.billingEmail || contact.email,
+        phone:     contact.phone,
+        address:   formatAddress(address),
+        vatNumber: contact.vatNumber,
+        reference: contact.reference,
+        // An issuer prints these so the invoice can be paid; a receiver simply
+        // has none, and an empty string is what the Invoice plugin stores anyway.
+        bankDetails: formatBankDetails(contact)
+    };
+}
+
+/**
+ * Bank details as an invoice prints them: label and value, one per line,
+ * blanks omitted. Sort code and account number ride together on one line
+ * because that is how anyone reads them off a page.
+ *
+ * @param   {object} contact
+ * @returns {string}
+ */
+export function formatBankDetails(contact) {
+    const lines = [];
+    if (contact.accountName) lines.push(contact.accountName);
+    if (contact.bankName)    lines.push(contact.bankName);
+
+    const sort = str(contact.sortCode);
+    const acct = str(contact.accountNumber);
+    if (sort && acct)      lines.push(`Sort ${sort}  Acc ${acct}`);
+    else if (sort)         lines.push(`Sort ${sort}`);
+    else if (acct)         lines.push(`Acc ${acct}`);
+
+    if (contact.iban) lines.push(`IBAN ${str(contact.iban)}`);
+    if (contact.bic)  lines.push(`BIC ${str(contact.bic)}`);
+    return lines.join('\n');
+}
+
+/** Map a collection entry to the shape the admin view expects. */
+function toContact(entry) {
+    let groups = entry.data.groups;
+    if (typeof groups === 'string') {
+        try {
+            groups = JSON.parse(groups);
+        } catch {
+            groups = [];
+        }
+    }
+    const contact = {
+        id: entry.id,
+        groups: Array.isArray(groups) ? groups : [],
+        favourite: entry.data.favourite === true || entry.data.favourite === 'true',
+        paymentTerms: entry.data.paymentTerms === '' || entry.data.paymentTerms === undefined || entry.data.paymentTerms === null
+            ? null
+            : Number(entry.data.paymentTerms),
+        userId: entry.data.userId ?? null,
+        createdAt: entry.meta.createdAt,
+        updatedAt: entry.meta.updatedAt
+    };
+    for (const field of TEXT_FIELDS) contact[field] = entry.data[field] ?? '';
+    for (const field of LIST_FIELDS) contact[field] = toArray(entry.data[field]);
+    return contact;
+}
+
+function toGroupName(entry) {
+    return entry.data.name ?? '';
+}
+
+/**
+ * Auth is injectable, the shape dashboard.js and plugins.js use.
+ *
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {object} [opts]
+ */
+export async function contactsRoutes(fastify, opts = {}) {
+    const authenticate = opts.authenticate || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+
+
+    function userId(request) {
+        return request.user?.id ?? request.user?.sub ?? null;
+    }
+
+    async function loadContacts(uid) {
+        const {entries} = await listEntries(CONTACTS_SLUG, {limit: 100000, sort: 'createdAt', order: 'asc'});
+        let items = entries.map(toContact);
+        if (uid) items = items.filter(c => c.userId === uid);
+        return items;
+    }
+
+    async function loadGroups() {
+        const {entries} = await listEntries(GROUPS_SLUG, {limit: 10000, sort: 'createdAt', order: 'asc'});
+        return entries.map(e => ({id: e.id, name: toGroupName(e)}));
+    }
+
+    /**
+     * Build the stored shape from whatever a caller sent.
+     *
+     * Used by create AND import so the two cannot drift - a field added to one
+     * and forgotten in the other is the bug this exists to prevent.
+     *
+     * @param   {object} raw
+     * @param   {string|null} uid
+     * @returns {object}
+     */
+    function buildContact(raw, uid) {
+        const data = {
+            groups: Array.isArray(raw.groups) ? raw.groups : [],
+            favourite: raw.favourite === true || raw.favourite === 'true',
+            paymentTerms: raw.paymentTerms === '' || raw.paymentTerms === undefined || raw.paymentTerms === null
+                ? ''
+                : (Number(raw.paymentTerms) || 0),
+            userId: uid ?? null
+        };
+        for (const field of TEXT_FIELDS) data[field] = str(raw[field]);
+        for (const field of LIST_FIELDS) data[field] = cleanList(field, raw[field]);
+        return data;
+    }
+
+    // -------------------------------------------------------------------------
+    // Contacts CRUD
+    // -------------------------------------------------------------------------
+
+    /** GET /api/contacts/contacts - supports ?q=, ?group=, ?favourites=true */
+    fastify.get('/contacts', {preHandler: [authenticate, requirePermission('contacts', 'read')]}, async (request, reply) => {
+        const uid = userId(request);
+        const { q, group, favourites } = request.query;
+
+        let result = await loadContacts(uid);
+
+        if (q) {
+            const query = q.toLowerCase();
+            result = result.filter(c =>
+                c.name.toLowerCase().includes(query) ||
+                c.email.toLowerCase().includes(query) ||
+                c.phone.includes(query)
+            );
+        }
+        if (group) {
+            result = result.filter(c => Array.isArray(c.groups) && c.groups.includes(group));
+        }
+        if (favourites === 'true') {
+            result = result.filter(c => c.favourite === true);
+        }
+
+        result.sort((a, b) => a.name.localeCompare(b.name));
+        return reply.send(result);
+    });
+
+    /** POST /api/contacts/contacts */
+    fastify.post('/contacts', {preHandler: [authenticate, requirePermission('contacts', 'create')]}, async (request, reply) => {
+        const uid = userId(request);
+        const body = request.body ?? {};
+
+        if (!body.name || typeof body.name !== 'string' || !body.name.trim()) {
+            return reply.code(400).send({ error: 'name is required' });
+        }
+
+        const entry = await createEntry(CONTACTS_SLUG, buildContact(body, uid),
+            {createdBy: uid, source: 'admin'});
+
+        return reply.code(201).send(toContact(entry));
+    });
+
+    /** PUT /api/contacts/contacts/:id */
+    fastify.put('/contacts/:id', {preHandler: [authenticate, requirePermission('contacts', 'update')]}, async (request, reply) => {
+        const uid = userId(request);
+        const { id } = request.params;
+        const updates = request.body ?? {};
+
+        const entry = await getEntry(CONTACTS_SLUG, id);
+        if (!entry) return reply.code(404).send({error: 'Contact not found'});
+        if (uid && entry.data.userId !== uid) return reply.code(404).send({error: 'Contact not found'});
+
+        // Coerced exactly as create (buildContact) does: the editor sends
+        // payment terms as the input's string and a PUT used to store "30"
+        // where a POST stores 30 - and a bare `favourite: "false"` was truthy.
+        const shaped = buildContact({...entry.data, ...updates}, entry.data.userId ?? null);
+        const merged = {...entry.data};
+        for (const key of TEXT_FIELDS) {
+            if (key in updates) merged[key] = shaped[key];
+        }
+        for (const key of ['groups', 'favourite', 'paymentTerms']) {
+            if (key in updates) merged[key] = shaped[key];
+        }
+        for (const key of LIST_FIELDS) {
+            if (key in updates) merged[key] = cleanList(key, updates[key]);
+        }
+
+        const updated = await updateEntry(CONTACTS_SLUG, id, merged);
+        return reply.send(toContact(updated));
+    });
+
+    /** DELETE /api/contacts/contacts/bulk - must be before /:id */
+    fastify.delete('/contacts/bulk', {preHandler: [authenticate, requirePermission('contacts', 'delete')]}, async (request, reply) => {
+        const uid = userId(request);
+        const { ids } = request.body ?? {};
+
+        if (!Array.isArray(ids) || ids.length === 0) {
+            return reply.code(400).send({ error: 'ids array is required' });
+        }
+
+        let deleted = 0;
+        for (const id of ids) {
+            const entry = await getEntry(CONTACTS_SLUG, id).catch(() => null);
+            if (!entry) continue;
+            if (uid && entry.data.userId !== uid) continue;
+            await deleteEntry(CONTACTS_SLUG, id).catch(() => {
+            });
+            deleted++;
+        }
+
+        return reply.send({ deleted });
+    });
+
+    /** DELETE /api/contacts/contacts/:id */
+    fastify.delete('/contacts/:id', {preHandler: [authenticate, requirePermission('contacts', 'delete')]}, async (request, reply) => {
+        const uid = userId(request);
+        const { id } = request.params;
+
+        const entry = await getEntry(CONTACTS_SLUG, id);
+        if (!entry) return reply.code(404).send({error: 'Contact not found'});
+        if (uid && entry.data.userId !== uid) return reply.code(404).send({error: 'Contact not found'});
+
+        await deleteEntry(CONTACTS_SLUG, id);
+        return reply.send({ ok: true });
+    });
+
+    /**
+     * GET /api/contacts/contacts/:id/billing
+     *
+     * The contact as the Invoice plugin wants a receiver: same field names, so
+     * the body can go straight to POST /api/plugins/invoice/receivers. Nothing
+     * in the CMS calls this yet - it is the seam, put where the data is.
+     */
+    fastify.get('/contacts/:id/billing', {preHandler: [authenticate, requirePermission('contacts', 'read')]}, async (request, reply) => {
+        const uid = userId(request);
+        const entry = await getEntry(CONTACTS_SLUG, request.params.id);
+        if (!entry) return reply.code(404).send({error: 'Contact not found'});
+        if (uid && entry.data.userId !== uid) return reply.code(404).send({error: 'Contact not found'});
+        return reply.send(toBillingProfile(toContact(entry)));
+    });
+
+    // -------------------------------------------------------------------------
+    // Groups CRUD
+    // -------------------------------------------------------------------------
+
+    /** GET /api/contacts/groups */
+    fastify.get('/groups', {preHandler: [authenticate, requirePermission('contacts', 'read')]}, async (request, reply) => {
+        const groups = await loadGroups();
+        return reply.send(groups.map(g => g.name));
+    });
+
+    /** POST /api/contacts/groups */
+    fastify.post('/groups', {preHandler: [authenticate, requirePermission('contacts', 'create')]}, async (request, reply) => {
+        const { name } = request.body ?? {};
+
+        if (!name || typeof name !== 'string' || !name.trim()) {
+            return reply.code(400).send({ error: 'name is required' });
+        }
+
+        const trimmed = name.trim();
+        const existing = await loadGroups();
+        if (existing.some(g => g.name === trimmed)) {
+            return reply.code(400).send({ error: 'Group already exists' });
+        }
+
+        await createEntry(GROUPS_SLUG, {name: trimmed}, {source: 'admin'});
+        return reply.code(201).send({ name: trimmed });
+    });
+
+    /** PUT /api/contacts/groups/:name - rename + cascade */
+    fastify.put('/groups/:name', {preHandler: [authenticate, requirePermission('contacts', 'update')]}, async (request, reply) => {
+        const oldName = decodeURIComponent(request.params.name);
+        const { newName } = request.body ?? {};
+
+        if (!newName || typeof newName !== 'string' || !newName.trim()) {
+            return reply.code(400).send({ error: 'newName is required' });
+        }
+
+        const groups = await loadGroups();
+        const grpEntry = groups.find(g => g.name === oldName);
+        if (!grpEntry) return reply.code(404).send({error: 'Group not found'});
+
+        const trimmed = newName.trim();
+        if (groups.some(g => g.name === trimmed)) {
+            return reply.code(400).send({ error: 'A group with that name already exists' });
+        }
+
+        // Rename the group entry
+        await updateEntry(GROUPS_SLUG, grpEntry.id, {name: trimmed});
+
+        // Cascade rename across all contacts
+        const {entries} = await listEntries(CONTACTS_SLUG, {limit: 100000});
+        for (const entry of entries) {
+            const grps = Array.isArray(entry.data.groups) ? entry.data.groups : [];
+            if (grps.includes(oldName)) {
+                await updateEntry(CONTACTS_SLUG, entry.id, {
+                    ...entry.data,
+                    groups: grps.map(g => (g === oldName ? trimmed : g))
+                });
+            }
+        }
+
+        return reply.send({ name: trimmed });
+    });
+
+    /** DELETE /api/contacts/groups/:name - delete + cascade */
+    fastify.delete('/groups/:name', {preHandler: [authenticate, requirePermission('contacts', 'delete')]}, async (request, reply) => {
+        const name = decodeURIComponent(request.params.name);
+
+        const groups = await loadGroups();
+        const grpEntry = groups.find(g => g.name === name);
+        if (!grpEntry) return reply.code(404).send({error: 'Group not found'});
+
+        // Remove the group entry
+        await deleteEntry(GROUPS_SLUG, grpEntry.id);
+
+        // Cascade: strip group from all contacts
+        const {entries} = await listEntries(CONTACTS_SLUG, {limit: 100000});
+        for (const entry of entries) {
+            const grps = Array.isArray(entry.data.groups) ? entry.data.groups : [];
+            if (grps.includes(name)) {
+                await updateEntry(CONTACTS_SLUG, entry.id, {
+                    ...entry.data,
+                    groups: grps.filter(g => g !== name)
+                });
+            }
+        }
+
+        return reply.send({ ok: true });
+    });
+
+    // -------------------------------------------------------------------------
+    // Import / Export
+    // -------------------------------------------------------------------------
+
+    /** GET /api/contacts/export */
+    fastify.get('/export', {preHandler: [authenticate, requirePermission('contacts', 'read')]}, async (request, reply) => {
+        const uid = userId(request);
+        const contacts = await loadContacts(uid);
+        return reply
+            .header('Content-Disposition', 'attachment; filename="contacts.json"')
+            .send(contacts);
+    });
+
+    /** POST /api/contacts/import */
+    fastify.post('/import', {preHandler: [authenticate, requirePermission('contacts', 'create')]}, async (request, reply) => {
+        const uid = userId(request);
+        const { contacts: incoming } = request.body ?? {};
+
+        if (!Array.isArray(incoming)) {
+            return reply.code(400).send({ error: 'contacts array is required' });
+        }
+
+        let imported = 0;
+        for (const raw of incoming) {
+            if (!raw || typeof raw.name !== 'string') continue;
+            await createEntry(CONTACTS_SLUG, buildContact(raw, uid), {source: 'import'});
+            imported++;
+        }
+
+        return reply.send({ imported });
+    });
+}

package/server/routes/api/context-menus.js

@@ -0,0 +1,104 @@
+/**
+ * Context menus API
+ *
+ * GET    /api/context-menus                  - list (metadata only)
+ * GET    /api/context-menus/:slug            - full menu
+ * POST   /api/context-menus                  - create
+ * PUT    /api/context-menus/:slug            - replace
+ * DELETE /api/context-menus/:slug            - delete
+ * POST   /api/context-menus/:slug/duplicate  - copy as <slug>-copy
+ *
+ * Auth middlewares are accepted as options so tests can supply no-ops without
+ * needing @fastify/jwt and a seeded roles cache - the same DI pattern as
+ * menus.js and projects.js.
+ */
+import {
+    authenticate as defaultAuthenticate,
+    requirePermission as defaultRequirePermission
+} from '../../middleware/auth.js';
+import {
+    ACTION_TYPES,
+    createContextMenu,
+    deleteContextMenu,
+    duplicateContextMenu,
+    getContextMenu,
+    listContextMenus,
+    updateContextMenu
+} from '../../services/contextMenus.js';
+
+export async function contextMenusRoutes(fastify, opts = {}) {
+    const authenticate      = opts.authenticate      || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+
+    const canRead   = {preHandler: [authenticate, requirePermission('context-menus', 'read')]};
+    const canCreate = {preHandler: [authenticate, requirePermission('context-menus', 'create')]};
+    const canUpdate = {preHandler: [authenticate, requirePermission('context-menus', 'update')]};
+    const canDelete = {preHandler: [authenticate, requirePermission('context-menus', 'delete')]};
+
+    // The editor builds its action picker from this rather than hardcoding a
+    // list that would drift from the server's validation.
+    fastify.get('/context-menus/action-types', canRead, async () => [...ACTION_TYPES]);
+
+    fastify.get('/context-menus', canRead, async (request) => {
+        const {canSeeArtefact} = await import('../../services/projects.js');
+        const all = await listContextMenus();
+        return all.filter((m) => canSeeArtefact(request.user, m));
+    });
+
+    fastify.get('/context-menus/:slug', canRead, async (request, reply) => {
+        const menu = await getContextMenu(request.params.slug);
+        if (!menu) return reply.code(404).send({error: 'Context menu not found'});
+
+        const {canSeeArtefact} = await import('../../services/projects.js');
+        if (!canSeeArtefact(request.user, menu)) {
+            return reply.code(403).send({error: 'Outside your project scope'});
+        }
+        return menu;
+    });
+
+    fastify.post('/context-menus', canCreate, async (request, reply) => {
+        try {
+            return await createContextMenu(request.body || {});
+        } catch (err) {
+            // Validation and collision are both the caller's fault, and the
+            // message already names the field - passing it through is what
+            // makes the editor able to show it.
+            return reply.code(400).send({error: err.message});
+        }
+    });
+
+    fastify.put('/context-menus/:slug', canUpdate, async (request, reply) => {
+        const existing = await getContextMenu(request.params.slug);
+        if (!existing) return reply.code(404).send({error: 'Context menu not found'});
+
+        const {canSeeArtefact} = await import('../../services/projects.js');
+        if (!canSeeArtefact(request.user, existing)) {
+            return reply.code(403).send({error: 'Outside your project scope'});
+        }
+        try {
+            return await updateContextMenu(request.params.slug, request.body || {});
+        } catch (err) {
+            return reply.code(400).send({error: err.message});
+        }
+    });
+
+    fastify.delete('/context-menus/:slug', canDelete, async (request, reply) => {
+        const existing = await getContextMenu(request.params.slug);
+        if (!existing) return reply.code(404).send({error: 'Context menu not found'});
+
+        const {canSeeArtefact} = await import('../../services/projects.js');
+        if (!canSeeArtefact(request.user, existing)) {
+            return reply.code(403).send({error: 'Outside your project scope'});
+        }
+        await deleteContextMenu(request.params.slug);
+        return {deleted: true};
+    });
+
+    fastify.post('/context-menus/:slug/duplicate', canCreate, async (request, reply) => {
+        try {
+            return await duplicateContextMenu(request.params.slug);
+        } catch (err) {
+            return reply.code(400).send({error: err.message});
+        }
+    });
+}

package/server/routes/api/dashboard.js

@@ -281,7 +281,10 @@ export async function dashboardRoutes(fastify, opts = {}) {
         // are recorded. Read the plugin's daily counters straight off disk (same
         // pattern as buildActivity reading versions/collections below).
         const daily = (await safe('analytics.daily', async () => {
-            for (const rel of ['plugins/analytics/data/daily.json', 'plugins/analytics/daily.json']) {
+            // content/analytics/ is where the counters live since analytics became
+            // core. The plugin paths stay as a fallback for one release: a site
+            // that has not restarted yet still has its history under plugins/.
+            for (const rel of ['content/analytics/daily.json', 'plugins/analytics/data/daily.json', 'plugins/analytics/daily.json']) {
                 try { return JSON.parse(await fs.readFile(path.join(ROOT, rel), 'utf8')); }
                 catch { /* try next location */ }
             }
@@ -305,7 +308,10 @@ export async function dashboardRoutes(fastify, opts = {}) {
 
         // Session events read straight off disk too (same reason as daily above).
         const journeysData = (await safe('analytics.journeysData', async () => {
-            for (const rel of ['plugins/analytics/data/journeys.json', 'plugins/analytics/journeys.json']) {
+            // content/analytics/ is where the counters live since analytics became
+            // core. The plugin paths stay as a fallback for one release: a site
+            // that has not restarted yet still has its history under plugins/.
+            for (const rel of ['content/analytics/journeys.json', 'plugins/analytics/data/journeys.json', 'plugins/analytics/journeys.json']) {
                 try { return JSON.parse(await fs.readFile(path.join(ROOT, rel), 'utf8')); }
                 catch { /* try next location */ }
             }