domma-cms 0.55.1 → 0.69.3

package/server/routes/api/plugins.js

@@ -12,13 +12,43 @@ import {
 import {
     discoverPlugins,
     getAdminPluginConfig,
+    getEntitlementStates,
+    getLoadedPlugins,
     getPluginStates,
+    isCorePlugin,
+    pluginLicence,
     runLifecycleHook,
     savePluginState
 } from '../../services/plugins.js';
+import {getEffectiveLevel} from '../../services/userRoles.js';
 import {scaffoldPlugin} from '../../services/pluginScaffold.js';
 import {deletePluginFile, listPluginFiles, readPluginFile, writePluginFile} from '../../services/pluginFiles.js';
 import {getConfig} from '../../config.js';
+import path from 'path';
+import {existsSync, readFileSync} from 'node:fs';
+import {installPlugin} from '../../services/pluginInstaller.js';
+import {packEnvelope, readEnvelope, readManifestFromTarball, tarDirectory} from '../../services/pluginEnvelope.js';
+
+/**
+ * The version of a plugin currently on disk, or null if the slug is free.
+ *
+ * Deliberately a directory check rather than `discoverPlugins()`: a half-broken
+ * installation still occupies the slug - that is exactly what the installer
+ * refuses to overwrite - and it would be invisible to discovery. An unreadable
+ * manifest reports an occupied slug with an unknown version, which is honest.
+ *
+ * @param   {string} slug
+ * @returns {string|null|undefined} version, `null` when unreadable, `undefined` when absent
+ */
+function installedVersion(slug) {
+    const dir = path.join(path.resolve('plugins'), slug);
+    if (!existsSync(dir)) return undefined;
+    try {
+        return JSON.parse(readFileSync(path.join(dir, 'plugin.json'), 'utf8')).version ?? null;
+    } catch {
+        return null;
+    }
+}
 
 /**
  * True when something will bring the process back after a clean exit.
@@ -78,9 +108,11 @@ export async function pluginsRoutes(fastify, opts = {}) {
     const canDevelop = { preHandler: [authenticate, requirePermission('plugins', 'develop')] };
 
     // List all plugins with their current state
-    fastify.get('/plugins', canRead, async () => {
+    fastify.get('/plugins', canRead, async (request) => {
         const manifests = await discoverPlugins();
         const states = getPluginStates();
+        const loadedPlugins = getLoadedPlugins();
+        const entitlementStates = getEntitlementStates();
 
         return manifests.map(manifest => ({
             name: manifest.name,
@@ -90,8 +122,27 @@ export async function pluginsRoutes(fastify, opts = {}) {
             author: manifest.author || '',
             date: manifest.date || '',
             icon: manifest.icon || 'package',
-            enabled: !!(states[manifest.name]?.enabled),
-            bundled: !!(states[manifest.name]?.bundled),
+            // A core plugin runs whatever plugins.json says, so reporting its
+            // stored flag would show "Disabled" next to a feature that is
+            // plainly running. It is on because it is built in.
+            core: isCorePlugin(manifest.name),
+            enabled: isCorePlugin(manifest.name) || !!(states[manifest.name]?.enabled),
+            // A licensed plugin is distributed to run, not to be read: the
+            // source endpoints refuse it (pluginFiles.isClosedSource). Sent so
+            // the screen can leave the Code button off rather than offer one
+            // that answers 403 - the refusal is the guard, not the UI.
+            closedSource: manifest.closedSource === true,
+            licence: pluginLicence(manifest),
+            // Why a licensed plugin is not running, when it is not. Null for
+            // anything open-source, which is never asked for an entitlement.
+            entitlement: entitlementStates[manifest.name] ?? null,
+            // Whether the CODE button belongs on this viewer's card. Decided
+            // here rather than in the browser: it is the same answer the file
+            // endpoints will give, from the same two facts.
+            sourceEditable: manifest.closedSource !== true || mayEditLicensed(request),
+            // Enabled but displaced by another plugin that replaces it. Shown
+            // so the screen can explain the inactivity instead of looking broken.
+            supersededBy: loadedPlugins[manifest.name]?.supersededBy ?? null,
             settings: states[manifest.name]?.settings || {}
         }));
     });
@@ -113,17 +164,26 @@ export async function pluginsRoutes(fastify, opts = {}) {
     // Enable/disable or update settings for a plugin
     fastify.put('/plugins/:name', canUpdate, async (request, reply) => {
         const { name } = request.params;
-        const {enabled, settings, bundled} = request.body || {};
+        const {enabled, settings} = request.body || {};
 
         const manifests = await discoverPlugins();
         const manifest = manifests.find(m => m.name === name);
         if (!manifest) return reply.status(404).send({ error: 'Plugin not found' });
 
+        // A core plugin is a built-in feature, not an add-on. Refusing here
+        // rather than writing the flag and ignoring it keeps the stored state
+        // honest - otherwise plugins.json says disabled while the feature runs.
+        // Settings are still editable; only the on/off switch is not.
+        if (isCorePlugin(name) && enabled === false) {
+            return reply.status(409).send({
+                error: `${manifest.displayName || name} is a built-in feature and cannot be disabled.`
+            });
+        }
+
         const prevState = getPluginStates()[name] || {};
         const update = {};
         if (enabled !== undefined) update.enabled = !!enabled;
         if (settings !== undefined) update.settings = settings;
-        if (bundled !== undefined) update.bundled = !!bundled;
         savePluginState(name, update);
 
         if (!prevState.enabled && !!enabled) {
@@ -158,17 +218,146 @@ export async function pluginsRoutes(fastify, opts = {}) {
 
     const mapErr = (reply, err) => reply.status(err.statusCode || 500).send({ error: err.message });
 
+    /*
+     * May this request read a LICENSED plugin's source?
+     *
+     * Only a super-admin (level 0). On the fleet that role exists on the
+     * manager and nowhere else - every customer-site user is an admin, level 1
+     * - so this opens the source to the people who publish the paid plugins
+     * without opening it on the sites they are distributed to. Level rather
+     * than role name, the same way requireAdmin and canManageUser decide.
+     */
+    const mayEditLicensed = (request) => !!request.user && getEffectiveLevel(request.user) === 0;
+    const licensed = (request) => ({allowLicensed: mayEditLicensed(request)});
+
     // List a plugin's editable files
+    // ---- Export: a plugin leaves as one file ----------------------------
+    //
+    // The same .dcmsplugin envelope a purchase arrives in, so an export can be
+    // installed by the ordinary route rather than a second "just unzip it" path
+    // that would skip the traversal guard and the manifest check.
+    //
+    // Unsigned by construction: the marketplace key is offline and never on this
+    // host. The importing site decides what to do about that.
+    // compress: false - the envelope is ALREADY gzip. @fastify/compress sees the
+    // gzip magic and labels it Content-Encoding: gzip, so the browser unzipped
+    // it on the way in and saved a bare tar; under brotli the download failed
+    // outright ("Decoding failed").
+    fastify.get('/plugins/:name/export', {...canDevelop, compress: false}, async (request, reply) => {
+        const {name} = request.params;
+        if (!/^[a-z0-9][a-z0-9-_]{0,63}$/.test(name)) {
+            return reply.code(400).send({error: 'Invalid plugin name'});
+        }
+
+        const manifests = await discoverPlugins();
+        const manifest = manifests.find(m => m.name === name);
+        if (!manifest) return reply.code(404).send({error: 'Plugin not found'});
+
+        // A licensed plugin is distributed to RUN here, not to be re-emitted as
+        // a redistributable file. Same flag that refuses the source editor, and
+        // the same reason: one click would otherwise turn every customer into a
+        // distribution channel.
+        if (manifest.closedSource === true) {
+            return reply.code(403).send({error: `"${name}" is a licensed plugin and cannot be exported.`});
+        }
+
+        const dir = path.join(path.resolve('plugins'), name);
+        const includeData = request.query?.includeData === '1';
+        const tarball = await tarDirectory(dir, name, {includeData});
+        const envelope = packEnvelope({tarball});
+
+        return reply
+            .header('Content-Type', 'application/octet-stream')
+            .header('Content-Disposition',
+                `attachment; filename="${name}-${manifest.version}.dcmsplugin"`)
+            .send(envelope);
+    });
+
+    // ---- Import: install from an uploaded envelope -----------------------
+    fastify.post('/plugins/install-upload', canCreate, async (request, reply) => {
+        const upload = await request.file().catch(() => null);
+        if (!upload) return reply.code(400).send({error: 'No file uploaded'});
+
+        // Drain the file first. Multipart is a STREAM: `upload.fields` only
+        // holds the parts seen so far, so reading a flag before the file body
+        // is consumed silently misses any field the browser put after it.
+        let body;
+        try {
+            body = await upload.toBuffer();
+        } catch (err) {
+            return reply.code(400).send({error: err.message});
+        }
+
+        // Checkboxes on the form, not defaults. Installing an unsigned plugin
+        // runs its code on this server; replacing one that is already here
+        // swaps out code that is running. Both should be decisions rather than
+        // side effects of dragging a file onto a page.
+        const flag = (name) => upload.fields?.[name]?.value === 'true';
+        const confirmUnsigned  = flag('confirmUnsigned');
+        const confirmUpgrade   = flag('confirmUpgrade');
+        const confirmDowngrade = flag('confirmDowngrade');
+
+        let parts;
+        try {
+            parts = readEnvelope(body);
+        } catch (err) {
+            return reply.code(400).send({error: err.message});
+        }
+
+        // The slug comes from the manifest inside, never from the filename: a
+        // file can be renamed by anyone, a manifest is what the installer then
+        // validates against what was actually extracted.
+        const manifest = readManifestFromTarball(parts.tarball);
+        const slug = manifest?.name;
+        if (!slug) return reply.code(400).send({error: 'No readable plugin manifest inside that file'});
+
+        const installed = installedVersion(slug);
+        if (installed !== undefined && !confirmUpgrade) {
+            return reply.code(409).send({
+                error: `${slug} ${installed ?? ''} is already installed.`.replace('  ', ' '),
+                code: 'already-installed',
+                name: slug,
+                installedVersion: installed,
+                incomingVersion: manifest.version ?? null
+            });
+        }
+
+        let result;
+        try {
+            result = await installPlugin(slug, {
+                tarball: parts.tarball,
+                signature: parts.signature,
+                publicKeyId: parts.signature ? (request.body?.keyId || 'marketplace-1') : null,
+                allowUnsigned: confirmUnsigned,
+                entitlement: parts.entitlement,
+                allowUpgrade: confirmUpgrade,
+                allowDowngrade: confirmDowngrade
+            });
+        } catch (err) {
+            fastify.log.warn({err}, '[plugins] upload install failed');
+            return reply.code(400).send({error: err.message});
+        }
+
+        return reply.send({
+            success: true,
+            name: slug,
+            action: result?.action ?? 'install',
+            from: result?.from ?? null,
+            version: result?.version ?? manifest.version ?? null,
+            restartRequired: true
+        });
+    });
+
     fastify.get('/plugins/:name/files', canDevelop, async (request, reply) => {
         try {
-            return { files: await listPluginFiles(request.params.name) };
+            return { files: await listPluginFiles(request.params.name, licensed(request)) };
         } catch (err) { return mapErr(reply, err); }
     });
 
     // Read one file (?path=admin/views/index.js)
     fastify.get('/plugins/:name/file', canDevelop, async (request, reply) => {
         try {
-            return await readPluginFile(request.params.name, request.query.path);
+            return await readPluginFile(request.params.name, request.query.path, licensed(request));
         } catch (err) { return mapErr(reply, err); }
     });
 
@@ -176,7 +365,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
     fastify.put('/plugins/:name/file', canDevelop, async (request, reply) => {
         const { path: relPath, content } = request.body || {};
         try {
-            const result = await writePluginFile(request.params.name, relPath, content);
+            const result = await writePluginFile(request.params.name, relPath, content, licensed(request));
             return { success: true, ...result };
         } catch (err) { return mapErr(reply, err); }
     });
@@ -184,7 +373,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
     // Delete one file (?path=admin/views/extra.js)
     fastify.delete('/plugins/:name/file', canDevelop, async (request, reply) => {
         try {
-            const result = await deletePluginFile(request.params.name, request.query.path);
+            const result = await deletePluginFile(request.params.name, request.query.path, licensed(request));
             return { success: true, ...result };
         } catch (err) { return mapErr(reply, err); }
     });

package/server/routes/api/search.js

@@ -0,0 +1,43 @@
+/**
+ * Search API Routes
+ *
+ * GET  /api/search?q=…      - public: full-text search across published pages
+ * GET  /api/search/settings - public: the search UI's own configuration
+ * PUT  /api/search/settings - admin-only: save it
+ *
+ * The public settings endpoint is kept for anything already calling it (and
+ * for a page served from a cache older than the feature), but it is no longer
+ * on the critical path: the renderer embeds the same object in the page as
+ * `window.__CMS_SEARCH__`, so the overlay can draw itself without a round trip.
+ */
+import {authenticate, requireAdmin} from '../../middleware/auth.js';
+import {listPages} from '../../services/content.js';
+import {getSearchSettings, saveSearchSettings, searchPages} from '../../services/search.js';
+
+export async function searchRoutes(fastify) {
+    fastify.get('/search', async (request, reply) => {
+        const settings = getSearchSettings();
+        const q = (request.query.q || '').trim();
+
+        if (q.length < settings.minQueryLength) {
+            return reply.status(400).send({
+                error: `Query must be at least ${settings.minQueryLength} characters`
+            });
+        }
+
+        const pages = await listPages();
+        const results = searchPages(pages, q, {
+            maxResults: settings.maxResults,
+            onError: (err, page) =>
+                request.log.warn({err, page: page.urlPath}, '[search] skipped an unreadable page')
+        });
+
+        return {results};
+    });
+
+    fastify.get('/search/settings', async () => getSearchSettings());
+
+    fastify.put('/search/settings', {preHandler: [authenticate, requireAdmin]}, async (request) => {
+        return {ok: true, settings: saveSearchSettings(request.body || {})};
+    });
+}

package/server/routes/api/theme.js

@@ -0,0 +1,69 @@
+/**
+ * Theme API
+ *
+ * GET  /api/theme          - the theme config (themes, fonts, overrides)
+ * PUT  /api/theme          - replace it
+ * GET  /api/theme/catalog  - theme ids and --dm-* token names the shipped
+ *                            stylesheet actually defines
+ * POST /api/theme/compile  - compile a candidate config to CSS without saving,
+ *                            so the admin previews exactly what the page gets
+ *
+ * Auth middlewares are injectable so tests can pass no-ops, the same DI pattern
+ * as menus.js and context-menus.js.
+ */
+import {
+    authenticate as defaultAuthenticate,
+    requirePermission as defaultRequirePermission
+} from '../../middleware/auth.js';
+import {
+    compileOverrideCss,
+    getThemeTokenMap,
+    listThemeIds,
+    listThemeTokens,
+    loadThemeConfig,
+    saveThemeConfig,
+    validateThemeConfig
+} from '../../services/themeSettings.js';
+
+export async function themeRoutes(fastify, opts = {}) {
+    const authenticate      = opts.authenticate      || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+
+    const canRead   = {preHandler: [authenticate, requirePermission('theme', 'read')]};
+    const canUpdate = {preHandler: [authenticate, requirePermission('theme', 'update')]};
+
+    fastify.get('/theme', canRead, async () => loadThemeConfig());
+
+    // The editor's theme picker and token picker build themselves from this
+    // rather than from a hardcoded list that would drift from the CSS.
+    fastify.get('/theme/catalog', canRead, async () => ({
+        themes: listThemeIds(),
+        tokens: listThemeTokens()
+    }));
+
+    /*
+     * One theme's token values. Fetched on demand rather than folded into
+     * /catalog: 32 themes x ~245 tokens is a payload nobody needs on a page
+     * load, and the admin only wants the one being considered.
+     */
+    fastify.get('/theme/themes/:id', canRead, async (request, reply) => {
+        const tokens = getThemeTokenMap(request.params.id);
+        if (!tokens) return reply.code(404).send({error: 'Unknown theme'});
+        return {id: request.params.id, tokens};
+    });
+
+    fastify.put('/theme', canUpdate, async (request, reply) => {
+        try {
+            return await saveThemeConfig(request.body || {});
+        } catch (err) {
+            return reply.code(400).send({error: err.message, validation: err.validation || null});
+        }
+    });
+
+    fastify.post('/theme/compile', canRead, async (request, reply) => {
+        const candidate = request.body || {};
+        const errors = validateThemeConfig(candidate);
+        if (errors.length) return reply.code(400).send({error: errors.join('; '), validation: errors});
+        return {css: compileOverrideCss(candidate)};
+    });
+}

package/server/routes/api/todo.js

@@ -0,0 +1,178 @@
+/**
+ * Todo API - /api/todo
+ *
+ * Was the `todo` plugin until 0.67.0. The logic is unchanged; what moved is
+ * where it lives and how it is gated.
+ *
+ * **Per-user scope.** Entries carry a `userId` and every read is filtered to the
+ * caller's own. The plugin made this configurable (`scope: 'user' | 'site'`) and
+ * no install ever set it to anything else, so it is a constant here. Note this
+ * is hand-filtering rather than `rowAccess.js`, which is the mechanism core has
+ * for exactly this - moving onto it is a behaviour change and belongs in its own
+ * task, not smuggled into a relocation.
+ *
+ * **The collection slug is `todo-items`, not the directory it used to sit in.**
+ * `setupPlugin()` read `schema.slug`, so the live collection has always been
+ * called this, and existing entries are found only if it stays exactly so.
+ */
+import {clip, plural} from '../../services/sidebarBadges.js';
+import {authenticate as defaultAuthenticate, requirePermission as defaultRequirePermission} from '../../middleware/auth.js';
+import {createEntry, deleteEntry, getEntry, listEntries, updateEntry} from '../../services/collections.js';
+
+const SLUG = 'todo-items';
+
+/** 'YYYY-MM-DD' of a date, in the server's local time. */
+function localDay(d) {
+    const pad = (n) => String(n).padStart(2, '0');
+    return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
+}
+
+/** Flatten a collection entry into the shape the admin view expects. */
+function toTodo(entry) {
+    return {
+        id: entry.id,
+        ...entry.data,
+        createdAt: entry.meta.createdAt,
+        updatedAt: entry.meta.updatedAt
+    };
+}
+
+/**
+ * Auth is injectable so a test can drive these routes without registering
+ * @fastify/jwt or a role store - the same shape dashboard.js and plugins.js use.
+ *
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {object} [opts]
+ */
+export async function todoRoutes(fastify, opts = {}) {
+    const authenticate = opts.authenticate || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+
+
+    function userId(request) {
+        return request.user?.id ?? request.user?.sub ?? null;
+    }
+
+    async function loadAll(uid) {
+        const {entries} = await listEntries(SLUG, {limit: 10000, sort: 'createdAt', order: 'asc'});
+        let items = entries.map(toTodo);
+        if (uid) items = items.filter(t => t.userId === uid);
+        return items;
+    }
+
+    /**
+     * GET /api/todo/count - the sidebar badge: open tasks, and how many are
+     * overdue. `?today=YYYY-MM-DD` is the BROWSER's calendar day - due dates
+     * are local days, and the server's today is not the reader's near midnight.
+     * Answers {count, label, tone}; tone is 'danger' while anything is overdue.
+     */
+    fastify.get('/count', {preHandler: [authenticate, requirePermission('todo', 'read')]}, async (request) => {
+        const given = String(request.query?.today ?? '');
+        const today = /^\d{4}-\d{2}-\d{2}$/.test(given) ? given : localDay(new Date());
+        const open = (await loadAll(userId(request))).filter(t => t.status !== 'completed');
+        const dayOf = (t) => /^(\d{4}-\d{2}-\d{2})/.exec(String(t.dueAt ?? ''))?.[1] ?? null;
+        const daysBetween = (a, b) => Math.round((Date.parse(a) - Date.parse(b)) / 86_400_000);
+        const overdue = open.filter(t => dayOf(t) && dayOf(t) < today);
+        const dueToday = open.filter(t => dayOf(t) === today);
+        const PRIORITY = {high: 0, medium: 1, low: 2};
+
+        // Most urgent first: overdue (oldest first), due today, then by due day, then priority.
+        const urgent = [...open].sort((a, b) =>
+            (dayOf(a) ?? '9999') .localeCompare(dayOf(b) ?? '9999')
+            || (PRIORITY[a.priority] ?? 1) - (PRIORITY[b.priority] ?? 1));
+        const items = urgent.slice(0, 5).map(t => {
+            const day = dayOf(t);
+            const d = day ? daysBetween(day, today) : null;
+            const when = d === null ? '' : d < 0 ? `${plural(-d, 'day')} overdue` : d === 0 ? 'due today' : d === 1 ? 'due tomorrow' : `due in ${d} days`;
+            const meta = [when, t.priority === 'high' ? 'high priority' : ''].filter(Boolean).join(' · ');
+            return {text: clip(t.text), meta, tone: d !== null && d < 0 ? 'danger' : undefined};
+        });
+
+        const label = `${plural(open.length, 'open task')}${overdue.length ? `, ${overdue.length} overdue` : ''}`;
+        return {
+            count: open.length, label, tone: overdue.length ? 'danger' : 'info',
+            details: {
+                title: 'Todo',
+                rows: [
+                    {label: 'Open', value: String(open.length)},
+                    {label: 'Overdue', value: String(overdue.length), tone: overdue.length ? 'danger' : undefined},
+                    {label: 'Due today', value: String(dueToday.length)},
+                    {label: 'In progress', value: String(open.filter(t => t.status === 'in-progress').length)}
+                ],
+                items,
+                empty: 'Nothing open - all done.'
+            }
+        };
+    });
+
+    /** GET /api/todo/items */
+    fastify.get('/items', {preHandler: [authenticate, requirePermission('todo', 'read')]}, async (request, reply) => {
+        const uid = userId(request);
+        const { status } = request.query;
+        let items = await loadAll(uid);
+        if (status) items = items.filter(t => t.status === status);
+        return reply.send(items);
+    });
+
+    /** POST /api/todo/items */
+    fastify.post('/items', {preHandler: [authenticate, requirePermission('todo', 'create')]}, async (request, reply) => {
+        const uid = userId(request);
+        const { text, priority, status } = request.body ?? {};
+
+        if (!text || typeof text !== 'string' || !text.trim()) {
+            return reply.code(400).send({ error: 'text is required' });
+        }
+
+        const {dueAt} = request.body ?? {};
+        const entry = await createEntry(SLUG, {
+            text: text.trim(),
+            status: status ?? 'not-started',
+            priority: priority ?? 'medium',
+            dueAt: dueAt ?? null,
+            userId: uid ?? null
+        }, {createdBy: uid, source: 'admin'});
+
+        return reply.code(201).send(toTodo(entry));
+    });
+
+    /** PUT /api/todo/items/:id */
+    fastify.put('/items/:id', {preHandler: [authenticate, requirePermission('todo', 'update')]}, async (request, reply) => {
+        const uid = userId(request);
+        const { id } = request.params;
+        const patch = request.body ?? {};
+
+        const entry = await getEntry(SLUG, id);
+        if (!entry) return reply.code(404).send({error: 'Todo not found'});
+        if (uid && entry.data.userId !== uid) return reply.code(404).send({error: 'Todo not found'});
+
+        const merged = {...entry.data};
+        for (const key of ['text', 'status', 'priority', 'dueAt']) {
+            if (key in patch) merged[key] = key === 'text' ? String(patch[key]).trim() : patch[key];
+        }
+
+        const updated = await updateEntry(SLUG, id, merged);
+        return reply.send(toTodo(updated));
+    });
+
+    /** DELETE /api/todo/completed - must be registered before /:id */
+    fastify.delete('/completed', {preHandler: [authenticate, requirePermission('todo', 'delete')]}, async (request, reply) => {
+        const uid = userId(request);
+        const all = await loadAll(uid);
+        const completed = all.filter(t => t.status === 'completed');
+        await Promise.all(completed.map(t => deleteEntry(SLUG, t.id)));
+        return reply.send({success: true, removed: completed.length});
+    });
+
+    /** DELETE /api/todo/items/:id */
+    fastify.delete('/items/:id', {preHandler: [authenticate, requirePermission('todo', 'delete')]}, async (request, reply) => {
+        const uid = userId(request);
+        const { id } = request.params;
+
+        const entry = await getEntry(SLUG, id);
+        if (!entry) return reply.code(404).send({error: 'Todo not found'});
+        if (uid && entry.data.userId !== uid) return reply.code(404).send({error: 'Todo not found'});
+
+        await deleteEntry(SLUG, id);
+        return reply.send({ success: true });
+    });
+}