domma-cms 0.55.1 → 0.69.3

package/server/routes/api/forms.js

@@ -578,6 +578,24 @@ export async function formsRoutes(fastify) {
             formValues[field.name] = val !== undefined ? (typeof val === 'string' ? val.trim() : val) : '';
         }
 
+        // Triggers, from the same engine the browser ran. A block-submit that
+        // only existed in the browser would be a suggestion: anyone can re-enable
+        // a button. Resolved BEFORE the field pass because a trigger decides
+        // which fields are in play at all.
+        const triggerState = FormLogicEngine.resolveTriggerState(form.fields || [], formValues);
+
+        if (triggerState.blocks.length) {
+            return reply.status(400).send({
+                error: triggerState.blocks.map(b => b.message).join(' ')
+            });
+        }
+
+        // Hidden and disabled are the same thing to a submission: the visitor
+        // was given no way to answer, so the answer is not theirs and is not
+        // required. A value posted for one anyway is dropped below.
+        const triggerOff = new Set([...triggerState.hidden, ...triggerState.disabled]);
+        const triggerRequired = new Set(triggerState.required);
+
         // Evaluate conditional logic
         const missingFields    = [];
         const validationErrors = [];
@@ -587,11 +605,13 @@ export async function formsRoutes(fastify) {
             if (field.type === 'page-break' || field.type === 'spacer') continue;
             const vis = FormLogicEngine.evaluateFieldVisibility(field, formValues);
             if (vis === 'hidden') continue;
+            if (triggerOff.has(field.name)) continue;
             visibleFieldNames.add(field.name);
 
             const value   = formValues[field.name];
             const isEmpty = !value?.toString().trim();
-            const required = FormLogicEngine.evaluateFieldRequirement(field, formValues);
+            const required = FormLogicEngine.evaluateFieldRequirement(field, formValues)
+                || triggerRequired.has(field.name);
             if (required && isEmpty) {
                 missingFields.push(field.label || field.name);
             }
@@ -719,10 +739,29 @@ export async function formsRoutes(fastify) {
             }
         }
 
+        // Trigger events the server owns. Fired after the entry is stored, for
+        // the same reason the other actions are: a failed side effect must not
+        // cost the visitor their submission.
+        let triggerRedirect = null;
+        for (const event of triggerState.events) {
+            if (event.type === 'run-action' && event.action.slug && entry) {
+                try {
+                    await executeAction(event.action.slug, entry.id, {user: submittingUser});
+                } catch (err) {
+                    fastify.log.warn(`[forms] Trigger action "${event.action.slug}" failed for form "${slug}": ${err.message}`);
+                }
+            } else if (event.type === 'redirect' && event.action.url && !triggerRedirect) {
+                // First one wins - two triggers redirecting at once is an
+                // authoring mistake, not a case to resolve cleverly.
+                triggerRedirect = String(event.action.url);
+            }
+        }
+
         hooks.emit('form:submitted', {slug, entryId: entry?.id || null, data, formTitle: form.title});
 
-        // Template interpolation for successRedirect
-        let redirect = settings.successRedirect || null;
+        // Template interpolation for successRedirect. A trigger's redirect is
+        // the more specific instruction, so it wins over the form's default.
+        let redirect = triggerRedirect || settings.successRedirect || null;
         if (redirect && entry?.id) {
             redirect = redirect.replace(/\{\{entryId\}\}/g, entry.id);
         }

package/{plugins/notes/plugin.js → server/routes/api/notes.js}

@@ -1,5 +1,23 @@
-import defaultConfig from './config.js';
-import {createEntry, deleteEntry, getEntry, listEntries, updateEntry} from '../../server/services/collections.js';
+/**
+ * Notes API - /api/notes
+ *
+ * Was the `notes` plugin until 0.67.0. The logic is unchanged; what moved is
+ * where it lives and how it is gated.
+ *
+ * **Per-user scope.** Entries carry a `userId` and every read is filtered to the
+ * caller's own. The plugin made this configurable (`scope: 'user' | 'site'`) and
+ * no install ever set it to anything else, so it is a constant here. Note this
+ * is hand-filtering rather than `rowAccess.js`, which is the mechanism core has
+ * for exactly this - moving onto it is a behaviour change and belongs in its own
+ * task, not smuggled into a relocation.
+ *
+ * **The collection slug is `notes-notes`, not the directory it used to sit in.**
+ * `setupPlugin()` read `schema.slug`, so the live collection has always been
+ * called this, and existing entries are found only if it stays exactly so.
+ */
+import {ago, clip, plural} from '../../services/sidebarBadges.js';
+import {authenticate as defaultAuthenticate, requirePermission as defaultRequirePermission} from '../../middleware/auth.js';
+import {createEntry, deleteEntry, getEntry, listEntries, updateEntry} from '../../services/collections.js';
 
 const SLUG = 'notes-notes';
 
@@ -14,13 +32,20 @@ function toNote(entry) {
     };
 }
 
-export default async function notesPlugin(fastify, options) {
-    const { authenticate } = options.auth;
-    const config = {...defaultConfig, ...(options.settings || {})};
-    const scope = config.scope ?? 'user';
+/**
+ * Auth is injectable so a test can drive these routes without registering
+ * @fastify/jwt or a role store - the same shape dashboard.js and plugins.js use.
+ *
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {object} [opts]
+ */
+export async function notesRoutes(fastify, opts = {}) {
+    const authenticate = opts.authenticate || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+
 
     function userId(request) {
-        return scope === 'user' ? (request.user?.id ?? request.user?.sub ?? null) : null;
+        return request.user?.id ?? request.user?.sub ?? null;
     }
 
     async function loadAll(uid) {
@@ -30,8 +55,27 @@ export default async function notesPlugin(fastify, options) {
         return items;
     }
 
-    /** GET /api/plugins/notes/items - supports ?q= and ?category= */
-    fastify.get('/items', { preHandler: [authenticate] }, async (request, reply) => {
+    /** GET /api/notes/count - the sidebar badge: how many notes this user has. */
+    fastify.get('/count', {preHandler: [authenticate, requirePermission('notes', 'read')]}, async (request) => {
+        const notes = await loadAll(userId(request));    // newest edit first
+        const categories = new Set(notes.flatMap(n => (Array.isArray(n.categories) ? n.categories : []).map(c => String(c).toLowerCase())));
+        return {
+            count: notes.length, label: plural(notes.length, 'note'), tone: 'info',
+            details: {
+                title: 'Notes',
+                rows: [
+                    {label: 'Notes', value: String(notes.length)},
+                    {label: 'Categories', value: String(categories.size)},
+                    {label: 'Edited this week', value: String(notes.filter(n => Date.now() - new Date(n.updatedAt).getTime() < 7 * 86_400_000).length)}
+                ],
+                items: notes.slice(0, 4).map(n => ({text: clip(n.title || n.content || 'Untitled'), meta: `edited ${ago(n.updatedAt)}`})),
+                empty: 'No notes yet.'
+            }
+        };
+    });
+
+    /** GET /api/notes/items - supports ?q= and ?category= */
+    fastify.get('/items', {preHandler: [authenticate, requirePermission('notes', 'read')]}, async (request, reply) => {
         const uid = userId(request);
         const { q, category } = request.query;
 
@@ -55,8 +99,8 @@ export default async function notesPlugin(fastify, options) {
         return reply.send(items);
     });
 
-    /** POST /api/plugins/notes/items */
-    fastify.post('/items', { preHandler: [authenticate] }, async (request, reply) => {
+    /** POST /api/notes/items */
+    fastify.post('/items', {preHandler: [authenticate, requirePermission('notes', 'create')]}, async (request, reply) => {
         const uid = userId(request);
         const { title, content, categories } = request.body ?? {};
 
@@ -72,8 +116,8 @@ export default async function notesPlugin(fastify, options) {
         return reply.code(201).send(toNote(entry));
     });
 
-    /** PUT /api/plugins/notes/items/:id */
-    fastify.put('/items/:id', { preHandler: [authenticate] }, async (request, reply) => {
+    /** PUT /api/notes/items/:id */
+    fastify.put('/items/:id', {preHandler: [authenticate, requirePermission('notes', 'update')]}, async (request, reply) => {
         const uid = userId(request);
         const { id } = request.params;
         const { title, content, categories } = request.body ?? {};
@@ -95,8 +139,8 @@ export default async function notesPlugin(fastify, options) {
         return reply.send(toNote(updated));
     });
 
-    /** DELETE /api/plugins/notes/items/:id */
-    fastify.delete('/items/:id', { preHandler: [authenticate] }, async (request, reply) => {
+    /** DELETE /api/notes/items/:id */
+    fastify.delete('/items/:id', {preHandler: [authenticate, requirePermission('notes', 'delete')]}, async (request, reply) => {
         const uid = userId(request);
         const { id } = request.params;
 
@@ -108,8 +152,8 @@ export default async function notesPlugin(fastify, options) {
         return reply.send({ success: true });
     });
 
-    /** GET /api/plugins/notes/categories */
-    fastify.get('/categories', { preHandler: [authenticate] }, async (request, reply) => {
+    /** GET /api/notes/categories */
+    fastify.get('/categories', {preHandler: [authenticate, requirePermission('notes', 'read')]}, async (request, reply) => {
         const uid = userId(request);
         const items = await loadAll(uid);
         const cats = new Set();

package/server/routes/api/notifications.js

@@ -7,13 +7,63 @@
  * POST   /api/system/notifications/:id/dismiss  - Mark dismissed
  * DELETE /api/system/notifications/:id          - Hard delete (admin only)
  */
-import { authenticate, requirePermission } from '../../middleware/auth.js';
+import {
+    authenticate as defaultAuthenticate,
+    requirePermission as defaultRequirePermission
+} from '../../middleware/auth.js';
 import { requireManager } from '../../middleware/managerAuth.js';
 import { getAdapter } from '../../services/adapterRegistry.js';
 
 const SLUG = 'notifications';
 
-export async function notificationsRoutes(fastify) {
+/** Ids already warned about, so one bad record does not fill the log. */
+const warnedMalformed = new Set();
+
+/**
+ * A notification's payload, or null when the record is not a notification.
+ *
+ * Entries are `{id, data, meta}`, but this collection has been written to
+ * directly before now - a form once pointed its submissions at `notifications`
+ * and left flat records behind with no `data` at all. Reading `entry.data.x`
+ * off one of those threw, and because the bell polls on every admin page load,
+ * a single stray record turned into a 500 on every screen in the admin. One
+ * unreadable row is skipped; it is not the rest of the inbox's problem.
+ *
+ * @param {object} entry
+ * @param {object} [log] - Fastify logger, when there is one to warn through.
+ * @returns {object|null}
+ */
+function notificationData(entry, log) {
+    const data = entry && entry.data;
+    if (data && typeof data === 'object') return data;
+    const id = entry?.id || '(no id)';
+    if (log && !warnedMalformed.has(id)) {
+        warnedMalformed.add(id);
+        log.warn(`[notifications] Skipping malformed entry "${id}" - no data object. `
+            + 'Something wrote to the notifications collection directly.');
+    }
+    return null;
+}
+
+/**
+ * Is this notification live for this user right now: not expired, not dismissed.
+ *
+ * @param {object} data - A notification payload.
+ * @param {string} userId
+ * @param {string} now - ISO timestamp.
+ * @returns {boolean}
+ */
+function isActiveFor(data, userId, now) {
+    if (data.expiresAt && data.expiresAt < now) return false;
+    return !(Array.isArray(data.dismissedBy) && data.dismissedBy.includes(userId));
+}
+
+export async function notificationsRoutes(fastify, opts = {}) {
+    // Injectable so tests can supply no-ops rather than a seeded roles cache -
+    // the same DI pattern as menus.js, projects.js and context-menus.js.
+    const authenticate      = opts.authenticate      || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+
     const canRead   = { preHandler: [authenticate, requirePermission('notifications', 'read')]   };
     const canDelete = { preHandler: [authenticate, requirePermission('notifications', 'delete')] };
 
@@ -69,14 +119,12 @@ export async function notificationsRoutes(fastify) {
 
         return all
             .filter(entry => {
-                const d = entry.data;
-                // Exclude expired
-                if (d.expiresAt && d.expiresAt < now) return false;
-                // Exclude dismissed by this user
-                if (Array.isArray(d.dismissedBy) && d.dismissedBy.includes(userId)) return false;
-                return true;
+                const d = notificationData(entry, fastify.log);
+                return !!d && isActiveFor(d, userId, now);
             })
-            .sort((a, b) => b.data.createdAt.localeCompare(a.data.createdAt))
+            // A record with no createdAt sorts last rather than taking the
+            // whole list down with it.
+            .sort((a, b) => String(b.data.createdAt || '').localeCompare(String(a.data.createdAt || '')))
             .map(entry => ({
                 ...entry,
                 unread: !Array.isArray(entry.data.readBy) || !entry.data.readBy.includes(userId)
@@ -91,9 +139,8 @@ export async function notificationsRoutes(fastify) {
         const all = await adapter.all(SLUG);
 
         const count = all.filter(entry => {
-            const d = entry.data;
-            if (d.expiresAt && d.expiresAt < now) return false;
-            if (Array.isArray(d.dismissedBy) && d.dismissedBy.includes(userId)) return false;
+            const d = notificationData(entry, fastify.log);
+            if (!d || !isActiveFor(d, userId, now)) return false;
             return !Array.isArray(d.readBy) || !d.readBy.includes(userId);
         }).length;
 
@@ -107,13 +154,15 @@ export async function notificationsRoutes(fastify) {
         const adapter = await getAdapter(SLUG);
         const entry = await adapter.get(SLUG, id);
 
-        if (!entry) return reply.code(404).send({ error: 'Notification not found.' });
+        const data = notificationData(entry, fastify.log);
+        // A record the list never showed is not one this route can mark read.
+        if (!data) return reply.code(404).send({ error: 'Notification not found.' });
 
-        const readBy = Array.isArray(entry.data.readBy) ? entry.data.readBy : [];
+        const readBy = Array.isArray(data.readBy) ? data.readBy : [];
         if (readBy.includes(userId)) return { ok: true }; // already read - idempotent
 
         const updated = await adapter.update(SLUG, id, {
-            ...entry.data,
+            ...data,
             readBy: [...readBy, userId]
         });
 
@@ -127,13 +176,14 @@ export async function notificationsRoutes(fastify) {
         const adapter = await getAdapter(SLUG);
         const entry = await adapter.get(SLUG, id);
 
-        if (!entry) return reply.code(404).send({ error: 'Notification not found.' });
+        const data = notificationData(entry, fastify.log);
+        if (!data) return reply.code(404).send({ error: 'Notification not found.' });
 
-        const dismissedBy = Array.isArray(entry.data.dismissedBy) ? entry.data.dismissedBy : [];
-        const readBy = Array.isArray(entry.data.readBy) ? entry.data.readBy : [];
+        const dismissedBy = Array.isArray(data.dismissedBy) ? data.dismissedBy : [];
+        const readBy = Array.isArray(data.readBy) ? data.readBy : [];
 
         const updated = await adapter.update(SLUG, id, {
-            ...entry.data,
+            ...data,
             dismissedBy: dismissedBy.includes(userId) ? dismissedBy : [...dismissedBy, userId],
             readBy: readBy.includes(userId) ? readBy : [...readBy, userId] // dismissing also marks read
         });

package/server/routes/api/plugin-marketplace.js

@@ -1,32 +1,57 @@
 /**
- * Plugin Marketplace API
- * GET    /api/plugins/marketplace         - fetch catalogue from manager (requires MANAGER_URL)
- * POST   /api/plugins/marketplace/install - download + install a plugin bundle
- * DELETE /api/plugins/marketplace/:slug   - uninstall an installed plugin
+ * Plugin Marketplace API - the managed (fleet) path.
+ *
+ * GET    /api/plugins/marketplace          - the catalogue as this site sees it
+ * POST   /api/plugins/marketplace/install  - fetch a bundle and install it
+ * DELETE /api/plugins/marketplace/:slug    - uninstall
+ *
+ * This is delivery path A: a site the manager forked, buying from the fleet's
+ * own catalogue over loopback. The standalone path - buy, download one file,
+ * Install from File - goes through `POST /plugins/install-upload` instead and
+ * shares nothing with this but the installer.
+ *
+ * An unmanaged site has no MANAGER_URL, every route here answers "not
+ * available", and the screen says so in terms that fit that customer.
  *
  * All routes require authentication + admin role.
  */
 import {authenticate, requireAdmin} from '../../middleware/auth.js';
-import {fetchCatalogue, fetchPluginBundle} from '../../services/managerClient.js';
-import {installPlugin, uninstallPlugin} from '../../services/pluginInstaller.js';
+import {fetchCatalogue, fetchPluginBundle, isManaged, siteSlug} from '../../services/managerClient.js';
+import {compareVersions, installPlugin, uninstallPlugin} from '../../services/pluginInstaller.js';
+import {discoverPlugins} from '../../services/plugins.js';
 
 export async function pluginMarketplaceRoutes(fastify) {
     const adminOnly = { preHandler: [authenticate, requireAdmin] };
 
     // GET /plugins/marketplace
     fastify.get('/plugins/marketplace', adminOnly, async (_request, reply) => {
-        if (!process.env.MANAGER_URL) {
-            return reply.send({ available: false, catalogue: [] });
-        }
+        if (!isManaged()) return reply.send({ available: false, catalogue: [] });
+
+        const catalogue = await fetchCatalogue();
 
-        const licenceToken = process.env.LICENCE_TOKEN;
-        const catalogue = await fetchCatalogue(licenceToken);
-        return reply.send({ available: true, catalogue });
+        // What is on THIS disk is a local fact - the manager's ledger knows
+        // what a site is licensed for, never what it actually has. Joined here
+        // so the card can offer Update rather than an Install that would come
+        // back 409.
+        const installed = new Map((await discoverPlugins()).map(m => [m.name, m.version]));
+        return reply.send({
+            available: true,
+            site: siteSlug(),
+            catalogue: catalogue.map(entry => {
+                const have = installed.get(entry.slug);
+                return {
+                    ...entry,
+                    installed: have !== undefined,
+                    installedVersion: have ?? null,
+                    updatable: have !== undefined && compareVersions(entry.version, have) > 0
+                };
+            })
+        });
     });
 
     // POST /plugins/marketplace/install
     fastify.post('/plugins/marketplace/install', adminOnly, async (request, reply) => {
-        const { slug, version } = request.body || {};
+        const { slug, version, update } = request.body || {};
 
         if (!slug || !/^[a-z0-9][a-z0-9-_]{0,63}$/.test(slug)) {
             return reply.code(400).send({ error: 'Invalid plugin slug.' });
@@ -34,25 +59,55 @@ export async function pluginMarketplaceRoutes(fastify) {
         if (!version || !/^\d+\.\d+\.\d+$/.test(version)) {
             return reply.code(400).send({ error: 'Invalid version format. Expected semver (e.g. 1.0.0).' });
         }
+        if (!isManaged()) {
+            return reply.code(503).send({ error: 'This site is not managed - install from a file instead.' });
+        }
 
-        const licenceToken = process.env.LICENCE_TOKEN;
-        const bundle = await fetchPluginBundle(slug, version, licenceToken);
-
+        let bundle;
+        try {
+            bundle = await fetchPluginBundle(slug, version);
+        } catch (err) {
+            // A refusal from the manager is the answer, not a failure: "this
+            // site has no licence for invoice" is what the admin needs to read.
+            return reply.code(403).send({ error: err.message });
+        }
         if (!bundle) {
-            return reply.code(503).send({ error: 'Manager unavailable' });
+            return reply.code(503).send({ error: 'The manager is not reachable right now.' });
         }
 
         try {
-            await installPlugin(slug, bundle);
+            const result = await installPlugin(slug, {
+                tarball: bundle.tarball,
+                signature: bundle.signature,
+                publicKeyId: bundle.publicKeyId,
+                // Minted for this site by the manager. Without it a paid plugin
+                // installs and then refuses to load, which reads as a broken
+                // install rather than a licensing answer.
+                entitlement: bundle.entitlement,
+                // Same plugin already here means update, which the admin asked
+                // for by pressing Update rather than Install.
+                allowUpgrade: update === true
+            });
+            return reply.send({
+                success: true,
+                name: slug,
+                action: result?.action ?? 'install',
+                from: result?.from ?? null,
+                version: result?.version ?? bundle.version,
+                restartRequired: true
+            });
         } catch (err) {
             fastify.log.error({ err }, '[marketplace] install failed');
-            // Known safe error messages from pluginInstaller (for admin clarity)
-            const safeMessages = ['Plugin already installed', 'Plugin signature invalid', 'Unknown public key', 'Invalid plugin slug'];
-            const safe = safeMessages.some(m => err.message.startsWith(m));
+            // Messages the installer raises deliberately, all of them things an
+            // admin can act on. Anything else is kept vague on purpose - an
+            // unexpected error can carry a path from this server.
+            const safe = [
+                'Plugin already installed', 'Plugin signature invalid', 'Unknown public key',
+                'Invalid plugin slug', 'Refusing to downgrade', 'Refusing to upgrade',
+                'This site accepts signed plugins only'
+            ].some(m => err.message.startsWith(m));
             return reply.code(400).send({ error: safe ? err.message : 'Installation failed.' });
         }
-
-        return reply.send({ success: true });
     });
 
     // DELETE /plugins/marketplace/:slug