domma-cms 0.55.1 → 0.69.3

package/server/routes/public.js

@@ -18,6 +18,7 @@ import {getEffectiveRoles} from '../services/userRoles.js';
 import {hooks} from '../services/hooks.js';
 import {getConfig} from '../config.js';
 import * as cache from '../services/cache/index.js';
+import {createHash} from 'crypto';
 
 /**
  * Derive the absolute origin for the current request.
@@ -55,6 +56,40 @@ function escapeHtml(str) {
         .replace(/'/g, ''');
 }
 
+/*
+ * Send an HTML page with headers that make a browser CHECK before reusing it.
+ *
+ * Public pages went out with no Cache-Control, no ETag and no Last-Modified at
+ * all. With nothing to go on a browser applies heuristic caching, so an edited
+ * page could keep showing the old content on a normal refresh - the server was
+ * serving the new one the whole time. That is indistinguishable from a CMS bug
+ * and was reported as one.
+ *
+ * `no-cache` does not mean "do not store": it means store it, then revalidate
+ * before every reuse. Paired with an ETag that makes the common case a 304 with
+ * no body rather than a full re-download.
+ *
+ * `private` because these responses are role-dependent - the response cache
+ * keys on role for exactly that reason - and a shared proxy must never hand one
+ * visitor a page rendered for another's permissions.
+ */
+function sendHtml(request, reply, html) {
+    const etag = `"${createHash('sha1').update(html).digest('base64')}"`;
+    reply.header('cache-control', 'private, no-cache');
+    reply.header('etag', etag);
+
+    // If-None-Match may carry a list, and a weak validator's W/ prefix.
+    const seen = String(request.headers['if-none-match'] || '')
+        .split(',')
+        .map((t) => t.trim().replace(/^W\//, ''));
+    if (seen.includes(etag)) return reply.code(304).send();
+
+    // Deliberately no reply.code() here: the 404 handlers have already called
+    // reply.status(404), and forcing 200 would turn every not-found into a
+    // soft 404 that search engines index as a real page.
+    return reply.type('text/html').send(html);
+}
+
 export async function publicRoutes(fastify) {
     // Admin panel: serve index.html for all /admin/* paths (SPA fallback)
     fastify.get('/admin', async (request, reply) => {
@@ -104,13 +139,13 @@ export async function publicRoutes(fastify) {
         const link = await verifyPreviewToken((request.query || {}).token, fastify.jwt);
         if (!link) {
             reply.status(404);
-            return reply.type('text/html').send(await render404('/_preview'));
+            return sendHtml(request, reply, await render404('/_preview'));
         }
 
         const page = await getPage(link.urlPath);
         if (!page) {
             reply.status(404);
-            return reply.type('text/html').send(await render404(link.urlPath));
+            return sendHtml(request, reply, await render404(link.urlPath));
         }
 
         // A disabled project stays a hard kill switch. A share link narrows who
@@ -118,7 +153,7 @@ export async function publicRoutes(fastify) {
         const project = await getProjectForPage(page.urlPath || link.urlPath, page.project);
         if (!(await isProjectEnabled(project))) {
             reply.status(404);
-            return reply.type('text/html').send(await render404(link.urlPath));
+            return sendHtml(request, reply, await render404(link.urlPath));
         }
 
         // Rendered as anonymous on purpose: the recipient has no account, so
@@ -161,7 +196,7 @@ export async function publicRoutes(fastify) {
 
         if (!page) {
             reply.status(404);
-            return reply.type('text/html').send(await render404(urlPath));
+            return sendHtml(request, reply, await render404(urlPath));
         }
 
         // Hard kill-switch: a disabled project takes its pages off the public
@@ -169,7 +204,7 @@ export async function publicRoutes(fastify) {
         const pageProject = await getProjectForPage(page.urlPath || urlPath, page.project);
         if (!(await isProjectEnabled(pageProject))) {
             reply.status(404);
-            return reply.type('text/html').send(await render404(urlPath));
+            return sendHtml(request, reply, await render404(urlPath));
         }
 
         // Draft preview: a page that is not published stays invisible to the
@@ -209,7 +244,7 @@ export async function publicRoutes(fastify) {
 
         if (isDraft && !canPreviewDrafts(userObj)) {
             reply.status(404);
-            return reply.type('text/html').send(await render404(urlPath));
+            return sendHtml(request, reply, await render404(urlPath));
         }
 
         if (!isPublic && !checkVisibility(userObj, vis)) {
@@ -249,7 +284,7 @@ export async function publicRoutes(fastify) {
         const cacheTags = [`page:${urlPath}`, ...(page.cacheTags || []), 'nav', 'site'];
         const html = await cache.wrap(cacheKey, render, {tags: cacheTags});
         hooks.emit('content:pageViewed', {urlPath, title: page.title || ''});
-        return reply.type('text/html').send(html);
+        return sendHtml(request, reply, html);
     });
 }
 

package/server/server.js

@@ -9,6 +9,7 @@ import Fastify from 'fastify';
 import jwt from '@fastify/jwt';
 import staticPlugin from '@fastify/static';
 import cors from '@fastify/cors';
+import {isPublicAssetRead, normalisePublicPrefixes} from './services/publicCors.js';
 import multipart from '@fastify/multipart';
 import rateLimit from '@fastify/rate-limit';
 import helmet from '@fastify/helmet';
@@ -119,7 +120,24 @@ await app.register(helmet, {
 });
 
 await app.register(jwt, { secret: process.env.JWT_SECRET });
-await app.register(cors, serverConfig.cors);
+// publicPrefixes is ours, not @fastify/cors's, so it is stripped before the
+// register call rather than passed through as an unknown option.
+const {publicPrefixes: _cfgPublicPrefixes, ...corsOptions} = serverConfig.cors ?? {};
+await app.register(cors, corsOptions);
+
+// Open reads on explicitly listed asset prefixes. @fastify/cors decides per
+// origin and cannot express a path, so a site wanting its own assets
+// hot-linkable (module scripts are fetched in CORS mode) lists them here.
+const publicCorsPrefixes = normalisePublicPrefixes(serverConfig.cors);
+if (publicCorsPrefixes.length) {
+    app.addHook('onSend', async (request, reply, payload) => {
+        if (isPublicAssetRead(request.method, request.url, publicCorsPrefixes)) {
+            reply.header('Access-Control-Allow-Origin', '*');
+        }
+        return payload;
+    });
+    app.log.info(`[cors] open reads on ${publicCorsPrefixes.join(', ')}`);
+}
 await app.register(multipart, { limits: { fileSize: serverConfig.uploads.maxFileSize } });
 await app.register(rateLimit, {
     global: true, // apply default limit to all routes; stricter per-route limits override this
@@ -218,6 +236,42 @@ await refreshComponentTagAllowlist();
 // Menus - one-shot migration from legacy navigation.json + site footer links
 // ---------------------------------------------------------------------------
 
+// ---------------------------------------------------------------------------
+// Theme - one-shot lift of the theme keys out of site.json into theme.json
+// ---------------------------------------------------------------------------
+
+try {
+    const {migrateThemeConfig} = await import('./services/themeSettings.js');
+    if (await migrateThemeConfig()) app.log.info('[theme] Migrated theme settings into config/theme.json');
+} catch (err) {
+    app.log.warn(`[theme] Migration skipped: ${err.message}`);
+}
+
+// ---------------------------------------------------------------------------
+// Plugins promoted into the CMS - one-shot retirement of the directories and
+// plugins.json entries they leave behind. Must run BEFORE registerPlugins(),
+// or the loader registers a second copy of a feature core now has itself.
+// ---------------------------------------------------------------------------
+try {
+    const {migratePromotedPlugins} = await import('./services/promoted-plugins-migration.js');
+    const promoted = migratePromotedPlugins();
+    if (promoted.length) app.log.info(`[plugins] Retired promoted plugins: ${promoted.join('; ')}`);
+} catch (err) {
+    app.log.warn(`[plugins] Promoted-plugin migration skipped: ${err.message}`);
+}
+
+// ---------------------------------------------------------------------------
+// Search - one-shot retirement of the site-search plugin (settings + files)
+// ---------------------------------------------------------------------------
+
+try {
+    const {migrateSiteSearchPlugin} = await import('./services/search-migration.js');
+    const changes = migrateSiteSearchPlugin();
+    if (changes.length) app.log.info(`[search] Migrated from the site-search plugin: ${changes.join(', ')}`);
+} catch (err) {
+    app.log.warn(`[search] Migration skipped: ${err.message}`);
+}
+
 try {
     const {runMigration: runMenusMigration} = await import('./services/menus-migration.js');
     await runMenusMigration();
@@ -237,6 +291,18 @@ try {
         groupText: 'Data',
         item: {text: 'API Builder', url: '#/api-endpoints', icon: 'code', permission: 'api-endpoints'}
     });
+    await ensureSidebarItem({
+        groupText: 'Content',
+        item: {text: 'Context Menus', url: '#/context-menus', icon: 'menu', permission: 'context-menus'}
+    });
+    await ensureSidebarItem({
+        groupText: 'Content',
+        item: {text: 'Theme', url: '#/theme', icon: 'droplet', permission: 'theme'}
+    });
+    await ensureSidebarItem({
+        groupText: 'System',
+        item: {text: 'Search', url: '#/search', icon: 'search', permission: 'settings'}
+    });
     // Restructure Documentation: Tutorials → submenu, add Components reference set.
     await ensureDocumentationSubmenus();
 } catch (err) {
@@ -245,6 +311,39 @@ try {
 
 // Initialise response cache (Memory/None/Redis driver per config.cache).
 await cache.initCache(config.cache);
+
+/*
+ * An admin change clears the response cache.
+ *
+ * Every service that mutates something is meant to invalidate the tags its
+ * change affects, and mostly they do - but a miss is INVISIBLE. The cache is
+ * off in development and on in production, so a missed invalidation works
+ * perfectly on the machine it was written on and serves stale HTML live until
+ * the TTL expires an hour later. Context menus shipped that way for three
+ * releases: the call named a function the cache module does not export AND a
+ * tag nothing is ever stored with, and a try/catch ate the evidence.
+ *
+ * This is the safety net, not the mechanism. The targeted invalidations stay -
+ * they are what stops one collection edit clearing every unrelated page - and
+ * this catches whatever they missed.
+ *
+ * Scoped to AUTHENTICATED mutations on purpose. A public form submission is
+ * not an admin change, and clearing on each of those would cold-start the
+ * cache on a busy site; entry writes already invalidate their own collection
+ * tag. Runs on onResponse, after the reply has gone, so it costs the caller
+ * nothing - and a memory-driver clear is two Map resets.
+ */
+const CACHE_CLEARING_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+app.addHook('onResponse', async (request, reply) => {
+    if (!CACHE_CLEARING_METHODS.has(request.method)) return;
+    if (reply.statusCode >= 400) return;
+    if (!request.user) return;
+    try {
+        await cache.clear();
+    } catch (err) {
+        app.log.warn(`[cache] Admin change did not clear the cache: ${err.message}`);
+    }
+});
 console.log(`[cache] driver=${cache.isEnabled() ? config.cache.driver : 'disabled'}`);
 
 // Docs are rendered at request time from the shipped admin templates; clear any
@@ -332,9 +431,11 @@ await app.register(authRoutes, { prefix: '/api' });
 
 const { pagesRoutes }      = await import('./routes/api/pages.js');
 const { settingsRoutes }   = await import('./routes/api/settings.js');
+const { themeRoutes }      = await import('./routes/api/theme.js');
 const { layoutsRoutes }    = await import('./routes/api/layouts.js');
 const { navigationRoutes } = await import('./routes/api/navigation.js');
 const {menusRoutes}         = await import('./routes/api/menus.js');
+const {contextMenusRoutes}  = await import('./routes/api/context-menus.js');
 const {menuLocationsRoutes} = await import('./routes/api/menu-locations.js');
 const {projectsRoutes}      = await import('./routes/api/projects.js');
 const {apiTokensRoutes}     = await import('./routes/api/api-tokens.js');
@@ -344,6 +445,10 @@ const {sidebarRoutes}       = await import('./routes/api/sidebar.js');
 const { mediaRoutes }      = await import('./routes/api/media.js');
 const { usersRoutes }      = await import('./routes/api/users.js');
 const { pluginsRoutes }            = await import('./routes/api/plugins.js');
+const { notesRoutes }              = await import('./routes/api/notes.js');
+const { todoRoutes }               = await import('./routes/api/todo.js');
+const { analyticsRoutes }          = await import('./routes/api/analytics.js');
+const { contactsRoutes }           = await import('./routes/api/contacts.js');
 const { pluginMarketplaceRoutes }  = await import('./routes/api/plugin-marketplace.js');
 const { collectionsRoutes } = await import('./routes/api/collections.js');
 const { formsRoutes }       = await import('./routes/api/forms.js');
@@ -353,6 +458,7 @@ const {blocksRoutes} = await import('./routes/api/blocks.js');
 const {componentsRoutes} = await import('./routes/api/components.js');
 const {versionsRoutes} = await import('./routes/api/versions.js');
 const {effectsRoutes} = await import('./routes/api/effects.js');
+const {searchRoutes} = await import('./routes/api/search.js');
 const {notificationsRoutes} = await import('./routes/api/notifications.js');
 const {dashboardRoutes} = await import('./routes/api/dashboard.js');
 const {cacheRoutes} = await import('./routes/api/cache.js');
@@ -363,6 +469,8 @@ await app.register(settingsRoutes,    { prefix: '/api' });
 await app.register(layoutsRoutes,     { prefix: '/api' });
 await app.register(navigationRoutes,  { prefix: '/api' });
 await app.register(menusRoutes,         {prefix: '/api'});
+await app.register(contextMenusRoutes,  {prefix: '/api'});
+await app.register(themeRoutes,         {prefix: '/api'});
 await app.register(menuLocationsRoutes, {prefix: '/api'});
 await app.register(projectsRoutes,      {prefix: '/api'});
 await app.register(apiTokensRoutes,     {prefix: '/api'});
@@ -381,15 +489,41 @@ await app.register(blocksRoutes, {prefix: '/api'});
 await app.register(componentsRoutes, {prefix: '/api'});
 await app.register(versionsRoutes, {prefix: '/api'});
 await app.register(effectsRoutes, {prefix: '/api'});
+await app.register(searchRoutes, {prefix: '/api'});
 await app.register(notificationsRoutes, {prefix: '/api'});
 await app.register(dashboardRoutes, {prefix: '/api'});
 await app.register(cacheRoutes, {prefix: '/api'});
 await app.register(scaffoldRoutes, {prefix: '/api'});
+// Tools promoted out of plugins/ - their own prefixes, not /api/plugins/*.
+await app.register(notesRoutes, {prefix: '/api/notes'});
+await app.register(todoRoutes, {prefix: '/api/todo'});
+await app.register(analyticsRoutes, {prefix: '/api/analytics'});
+await app.register(contactsRoutes, {prefix: '/api/contacts'});
 
 // ---------------------------------------------------------------------------
 // CMS Plugins (server-side Fastify plugins from plugins/ directory)
 // ---------------------------------------------------------------------------
 
+// ---------------------------------------------------------------------------
+// Core Tools in the sidebar
+// ---------------------------------------------------------------------------
+// Registered through the same channel plugins use, deliberately. The sidebar
+// menu (config/menus/admin-sidebar.json) is seeded once and file-existence
+// guarded, so adding an entry there would reach new sites only - every existing
+// site would simply never see Notes or Todo. Registered items are merged at
+// render time on every site, and groupPluginItems() files them under Tools,
+// which is exactly where a promoted plugin belongs.
+//
+// `permission` is what hides each one from a role that cannot use it; the
+// renderer filters on it.
+const {registerSidebarItem} = await import('./services/hooks.js');
+// `countUrl` is the badge: the sidebar fetches it and shows {count, label, tone}
+// (see fetchCounts in admin/js/lib/sidebar-renderer.js).
+registerSidebarItem({item: {text: 'Notes', url: '#/notes', icon: 'edit-3', permission: 'notes', countUrl: '/api/notes/count'}});
+registerSidebarItem({item: {text: 'Todo', url: '#/todo', icon: 'check-square', permission: 'todo', countUrl: '/api/todo/count'}});
+registerSidebarItem({item: {text: 'Analytics', url: '#/analytics', icon: 'chart-bar', permission: 'analytics', countUrl: '/api/analytics/active-count'}});
+registerSidebarItem({item: {text: 'Contacts', url: '#/contacts', icon: 'users', permission: 'contacts'}});
+
 await registerPlugins(app);
 
 // ---------------------------------------------------------------------------

package/server/services/adapters/FileAdapter.js

@@ -86,7 +86,12 @@ export class FileAdapter {
         entries.sort((a, b) => {
             const aVal = sort === 'createdAt' ? a.meta?.createdAt : (a.data?.[sort] ?? '');
             const bVal = sort === 'createdAt' ? b.meta?.createdAt : (b.data?.[sort] ?? '');
-            const cmp  = String(aVal).localeCompare(String(bVal));
+            // Numeric collation, because a plain string compare orders a number
+            // field 1, 10, 11, 2 - so any collection sorted by `order` scrambles
+            // itself the moment it has ten entries. MongoAdapter sorts natively
+            // and has always ordered these correctly, so this also stops the two
+            // adapters disagreeing about the same data.
+            const cmp  = String(aVal).localeCompare(String(bVal), undefined, {numeric: true});
             return order === 'desc' ? -cmp : cmp;
         });
 

package/server/services/collections.js

@@ -131,11 +131,21 @@ export async function createCollection({title, slug, description = '', fields =
     if (!finalSlug) throw new Error('Could not derive a slug from the title');
 
     const dir = collectionDir(finalSlug);
+    // A directory with no schema.json is not a collection - getCollection()
+    // says so - but refusing to create one there made it impossible to ever
+    // have one. That is how dcm's blog lost its collections: three empty
+    // directories left behind, and setupPlugin() re-trying and failing on
+    // every boot. So such a directory is adopted rather than refused, and any
+    // entries it still holds are kept rather than overwritten.
+    let orphanHasData = false;
     try {
         await fs.mkdir(dir, { recursive: false });
     } catch (err) {
-        if (err.code === 'EEXIST') throw new Error(`A collection with slug "${finalSlug}" already exists`);
-        throw err;
+        if (err.code !== 'EEXIST') throw err;
+        if (await getCollection(finalSlug)) {
+            throw new Error(`A collection with slug "${finalSlug}" already exists`);
+        }
+        orphanHasData = await fs.access(path.join(dir, 'data.json')).then(() => true, () => false);
     }
 
     const now = new Date().toISOString();
@@ -154,7 +164,7 @@ export async function createCollection({title, slug, description = '', fields =
     };
 
     await writeSchema(schema);
-    await (await getAdapter(finalSlug)).insertMany(finalSlug, []);
+    if (!orphanHasData) await (await getAdapter(finalSlug)).insertMany(finalSlug, []);
     await cache.invalidateTags([`collection:${finalSlug}`]);
     return schema;
 }

package/server/services/content.js

@@ -122,6 +122,25 @@ export async function buildPreviewPage(urlPath, frontmatter, body, opts = {}) {
  * @param {string} body
  * @returns {Promise<object>}
  */
+/**
+ * Keep a page's tag list to actual tags.
+ *
+ * An empty tag input has a way of arriving as `[null]` - which is an array,
+ * passes every `Array.isArray` guard, and then throws the moment anything
+ * calls a string method on the contents. It reached disk on dozens of pages
+ * and took the whole of site search down with it, so it is cleaned on the way
+ * IN rather than defended against at each of the places that read it.
+ *
+ * @param   {unknown} tags
+ * @returns {string[]}
+ */
+function cleanTags(tags) {
+    if (!Array.isArray(tags)) return [];
+    return [...new Set(
+        tags.filter(tag => typeof tag === 'string' && tag.trim()).map(tag => tag.trim())
+    )];
+}
+
 export async function createPage(urlPath, frontmatter, body) {
     const filePath = urlPathToFilePath(urlPath);
     await fs.mkdir(path.dirname(filePath), { recursive: true });
@@ -138,6 +157,7 @@ export async function createPage(urlPath, frontmatter, body) {
         sortOrder: frontmatter.sortOrder ?? defaults.sortOrder,
         showInNav: frontmatter.showInNav ?? false,
         sidebar: frontmatter.sidebar ?? false,
+        tags: cleanTags(frontmatter.tags),
         seo: frontmatter.seo || {},
         dconfig: frontmatter.dconfig || null,
         createdAt: now,
@@ -172,6 +192,12 @@ export async function updatePage(urlPath, frontmatter, body, {author} = {}) {
         updatedAt: new Date().toISOString()
     };
 
+    // Cleaned on every save, so an existing page carrying `[null]` is repaired
+    // the next time anyone touches it rather than staying broken for ever.
+    // Only when tags are part of this save: a caller that sends no tags is not
+    // asking for the page's tags to be emptied.
+    if ('tags' in meta) meta.tags = cleanTags(meta.tags);
+
     if (existingMeta.createdAt) meta.createdAt = existingMeta.createdAt;
 
     // '' is the editor's "inherit by rootUrl" choice - drop the key so the