domma-cms 0.55.1 → 0.69.3

package/server/services/managerClient.js

@@ -1,93 +1,55 @@
 /**
  * Client for outbound calls from domma-cms → domma-cms-manager.
- * Reads MANAGER_URL and INSTANCE_SECRET from env at call time.
- * All functions return null/[] gracefully if MANAGER_URL is unset.
- */
-
-import {createHmac} from 'node:crypto';
-import {readFile} from 'node:fs/promises';
-import {fileURLToPath} from 'node:url';
-import {dirname, join} from 'node:path';
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-
-/**
- * Read the CMS version from the root package.json.
- * @returns {Promise<string>} The version string, or '0.0.0' on error.
+ *
+ * A MANAGED site is one the manager forked, and the manager tells it so in its
+ * environment: `MANAGER_URL` (where), `SITE_SLUG` (who) and `FLEET_TOKEN` (the
+ * proof, minted per fork and never written down). An unmanaged site has none of
+ * these, every call here returns null/[], and the Marketplace screen points at
+ * Install from File instead - which is the whole of that customer's procedure.
+ *
+ * There used to be a `registerInstance()` handshake: HMAC a fingerprint with a
+ * shared INSTANCE_SECRET, get a licence token back. It never had a caller, and
+ * it was solving a problem this fleet does not have - the manager starts every
+ * child itself, so it already knows which site is on the other end. Replacing
+ * it with a fork-time token removed a shared secret, a distribution problem and
+ * a round trip.
+ *
+ * Nothing here throws. A manager that is down, slow or mid-restart must leave
+ * the site serving pages, so every failure is a warning and an empty answer.
  */
-async function getCmsVersion() {
-    try {
-        const pkgPath = join(__dirname, '../../package.json');
-        const raw = await readFile(pkgPath, 'utf-8');
-        return JSON.parse(raw).version ?? '0.0.0';
-    } catch {
-        return '0.0.0';
-    }
-}
 
 /**
- * Register this CMS instance with domma-cms-manager.
+ * True when this site was started by a manager and can talk to it.
  *
- * @param {string} fingerprint - Unique instance fingerprint.
- * @returns {Promise<{licenseToken: string, instanceId: string}|null>}
+ * @returns {boolean}
  */
-export async function registerInstance(fingerprint) {
-    const MANAGER_URL = process.env.MANAGER_URL;
-    const INSTANCE_SECRET = process.env.INSTANCE_SECRET;
-
-    if (!MANAGER_URL) return null;
-    if (!INSTANCE_SECRET) {
-        console.warn('[managerClient] INSTANCE_SECRET not set - skipping registerInstance');
-        return null;
-    }
-
-    try {
-        const cmsVersion = await getCmsVersion();
-        const hostname = process.env.HOSTNAME ?? 'unknown';
-
-        const token = createHmac('sha256', INSTANCE_SECRET)
-            .update(fingerprint)
-            .digest('hex');
-
-        const res = await fetch(`${MANAGER_URL}/api/instances/register`, {
-            signal: AbortSignal.timeout(10_000),
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'X-Instance-Token': token,
-            },
-            body: JSON.stringify({ fingerprint, cmsVersion, hostname }),
-        });
+export function isManaged() {
+    return Boolean(process.env.MANAGER_URL && process.env.FLEET_TOKEN);
+}
 
-        if (!res.ok) {
-            console.warn(`[managerClient] registerInstance failed: ${res.status} ${res.statusText}`);
-            return null;
-        }
+/** The slug this site is known by in its fleet, or null when unmanaged. */
+export function siteSlug() {
+    return process.env.SITE_SLUG || null;
+}
 
-        return await res.json();
-    } catch (err) {
-        console.warn('[managerClient] registerInstance error:', err.message);
-        return null;
-    }
+/** Bearer the fork-time token. Read per call: a restart mints a new one. */
+function fleetHeaders() {
+    return {Authorization: `Bearer ${process.env.FLEET_TOKEN}`};
 }
 
 /**
  * Fetch the plugin catalogue from domma-cms-manager.
  *
- * @param {string} licenseToken - License token obtained from registerInstance.
- * @returns {Promise<Array<{slug: string, version: string, displayName: string, description: string, price: number, entitled: boolean}>>}
+ * @returns {Promise<Array<{slug: string, version: string, displayName: string,
+ *   description: string, price: number|null, entitled: boolean, licenceStatus: string|null}>>}
  */
-export async function fetchCatalogue(licenseToken) {
-    const MANAGER_URL = process.env.MANAGER_URL;
-
-    if (!MANAGER_URL) return [];
+export async function fetchCatalogue() {
+    if (!isManaged()) return [];
 
     try {
-        const res = await fetch(`${MANAGER_URL}/api/plugins/catalogue`, {
+        const res = await fetch(`${process.env.MANAGER_URL}/api/plugins/catalogue`, {
             signal: AbortSignal.timeout(10_000),
-            headers: {
-                Authorization: `Bearer ${licenseToken}`,
-            },
+            headers: fleetHeaders(),
         });
 
         if (!res.ok) {
@@ -103,80 +65,54 @@ export async function fetchCatalogue(licenseToken) {
 }
 
 /**
- * Fetch a plugin bundle (tarball + signature) from domma-cms-manager.
+ * Fetch a plugin bundle from domma-cms-manager.
+ *
+ * Returns the triple `installPlugin()` takes, plus the entitlement the manager
+ * minted for THIS site. The entitlement travels with the bytes it licenses
+ * rather than arriving separately, because a paid plugin installed without one
+ * is a plugin that will not load - a failure that looks like a broken install
+ * rather than a licensing answer.
  *
- * @param {string} slug - Plugin slug.
- * @param {string} version - Plugin version.
- * @param {string} licenseToken - License token obtained from registerInstance.
- * @returns {Promise<{tarball: Buffer, signature: string, publicKeyId: string}|null>}
+ * @param   {string} slug
+ * @param   {string} version
+ * @returns {Promise<{tarball: Buffer, signature: string, publicKeyId: string,
+ *   entitlement: object|null, version: string}|null>} null when unmanaged or unreachable
+ * @throws  {Error} when the manager refuses - an unlicensed plugin is an answer
+ *          worth showing, not a silent empty result
  */
-export async function fetchPluginBundle(slug, version, licenseToken) {
-    const MANAGER_URL = process.env.MANAGER_URL;
-
-    if (!MANAGER_URL) return null;
+export async function fetchPluginBundle(slug, version) {
+    if (!isManaged()) return null;
 
+    let res;
     try {
-        const res = await fetch(`${MANAGER_URL}/api/plugins/install/${slug}/${version}`, {
-            signal: AbortSignal.timeout(10_000),
-            headers: {
-                Authorization: `Bearer ${licenseToken}`,
-            },
+        res = await fetch(`${process.env.MANAGER_URL}/api/plugins/install/${slug}/${version}`, {
+            signal: AbortSignal.timeout(30_000),
+            headers: fleetHeaders(),
         });
-
-        if (!res.ok) {
-            console.warn(`[managerClient] fetchPluginBundle failed: ${res.status} ${res.statusText}`);
-            return null;
-        }
-
-        const json = await res.json();
-
-        if (typeof json.tarball !== 'string' || json.tarball.length > 100 * 1024 * 1024) {
-            console.warn('[managerClient] fetchPluginBundle: tarball too large or invalid, refusing decode');
-            return null;
-        }
-
-        return {
-            tarball: Buffer.from(json.tarball, 'base64'),
-            signature: json.signature,
-            publicKeyId: json.publicKeyId,
-        };
     } catch (err) {
         console.warn('[managerClient] fetchPluginBundle error:', err.message);
         return null;
     }
-}
 
-/**
- * Send a heartbeat to domma-cms-manager with the list of installed plugins.
- *
- * @param {string} licenseToken - License token obtained from registerInstance.
- * @param {string[]} installedSlugs - Array of installed plugin slugs.
- * @returns {Promise<boolean>} True on success, false on error.
- */
-export async function heartbeat(licenseToken, installedSlugs) {
-    const MANAGER_URL = process.env.MANAGER_URL;
-
-    if (!MANAGER_URL) return false;
-
-    try {
-        const res = await fetch(`${MANAGER_URL}/api/instances/heartbeat`, {
-            signal: AbortSignal.timeout(10_000),
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                Authorization: `Bearer ${licenseToken}`,
-            },
-            body: JSON.stringify({ installedSlugs, versions: {} }),
-        });
-
-        if (!res.ok) {
-            console.warn(`[managerClient] heartbeat failed: ${res.status} ${res.statusText}`);
-            return false;
-        }
+    if (!res.ok) {
+        // 403 is "you have no licence for this", 409 "your catalogue is stale".
+        // Both are things the admin can act on, so they are raised rather than
+        // logged and swallowed the way an unreachable manager is.
+        const body = await res.json().catch(() => ({}));
+        throw new Error(body.error || `The manager refused that download (${res.status}).`);
+    }
 
-        return true;
-    } catch (err) {
-        console.warn('[managerClient] heartbeat error:', err.message);
-        return false;
+    const json = await res.json();
+    if (typeof json.tarball !== 'string' || json.tarball.length > 100 * 1024 * 1024) {
+        console.warn('[managerClient] fetchPluginBundle: tarball too large or invalid, refusing decode');
+        return null;
     }
+
+    return {
+        tarball: Buffer.from(json.tarball, 'base64'),
+        signature: json.signature,
+        publicKeyId: json.publicKeyId,
+        entitlement: json.entitlement ?? null,
+        version: json.version ?? version,
+    };
 }

package/server/services/markdown.js

@@ -28,6 +28,7 @@ const BUILTIN_SHORTCODES = new Set([
     'banner', 'slideover', 'counter', 'celebrate', 'firework', 'fireworks', 'scribe',
     'reveal', 'breathe', 'pulse', 'shake', 'scramble', 'ripple', 'twinkle',
     'ticker-tape', 'butterflies', 'strobe', 'animate', 'ambient', 'list-group', 'menu',
+    'demo',
 ]);
 
 // Configure marked for safe output
@@ -97,12 +98,44 @@ function buildShortcodeFilter(attrs) {
  * Load a block template by name from content/blocks/{name}.html.
  * Throws if the file does not exist.
  *
+ * The template's HTML comments are DROPPED here, before anything looks at it.
+ * Every block ships with a header comment documenting its parameters and
+ * showing an example call - documentation for whoever opens the file, which
+ * has no business on a public page and, worse, is still live markup by the
+ * time the shortcode processor sees it.
+ *
+ * `plugin-card` is what that costs: its example reads
+ * `[collection slug="plugins" display="block" block="plugin-card" …]` with no
+ * `/]`, so the processor took it for an unclosed tag and swallowed the rest of
+ * the render. Four plugin cards came out as one empty `<div>`, and the block's
+ * stylesheet came out as prose. The card that renders documentation for itself
+ * is not a rare shape - every bundled block has that comment - so this is
+ * fixed at the load point rather than in one template.
+ *
  * @param {string} blockName
  * @returns {Promise<string>}
  */
 async function loadBlockTemplate(blockName) {
     const safe = path.basename(blockName).replace(/[^a-z0-9-]/g, '');
-    return readFile(path.join(BLOCKS_DIR, `${safe}.html`), 'utf8');
+    const raw = await readFile(path.join(BLOCKS_DIR, `${safe}.html`), 'utf8');
+    return stripTemplateComments(raw);
+}
+
+/**
+ * Remove HTML comments from a block template.
+ *
+ * Unterminated (`<!--` with no `-->`) is treated as comment-to-end: a truncated
+ * comment leaking its remainder onto the page is the failure this exists to
+ * prevent, so the safe reading is that everything after it was meant to be one.
+ *
+ * @param {string} tpl
+ * @returns {string}
+ */
+export function stripTemplateComments(tpl) {
+    return String(tpl || '')
+        .replace(/<!--[\s\S]*?-->/g, '')
+        .replace(/<!--[\s\S]*$/, '')
+        .trim();
 }
 
 /**
@@ -258,9 +291,23 @@ function blockTemplateFields(tpl) {
     return [...names].map(n => ({name: n, label: n}));
 }
 
-function buildBlockStyleTag(blockName, css) {
+/**
+ * Wrap a block's CSS in a `<style>` scoped to that block.
+ *
+ * BLANK LINES ARE REMOVED, and that is the whole of the second bug here. A
+ * block rendered inside another shortcode's wrapper - `[reveal]`, a `[col]`,
+ * anything - arrives mid-HTML-block as far as Markdown is concerned, and a
+ * blank line ENDS an HTML block: everything after the first one in the
+ * stylesheet came back wrapped in `<p>` and was printed on the page as text.
+ * Readable CSS is not worth a stylesheet in the body copy, so the blank lines
+ * go and the line breaks stay.
+ */
+export function buildBlockStyleTag(blockName, css) {
     if (!css || !css.trim()) return '';
-    const body = String(css).replace(/<\/style/gi, '<\\/style');
+    const body = String(css)
+        .replace(/<\/style/gi, '<\\/style')
+        .replace(/\n\s*\n+/g, '\n')
+        .trim();
     return `<style>[data-block="${escapeAttr(blockName)}"] {\n${body}\n}</style>\n`;
 }
 
@@ -1940,8 +1987,14 @@ export async function refreshComponentTagAllowlist() {
 export function collectAndRewriteComponents(source) {
     const used = new Set();
 
+    // Scrub first: a `[component …/]` or a `<dm-x>` tag written inside a fenced
+    // block is documentation showing the syntax, not a component to mount.
+    // Rewriting it turns the example into the thing it was explaining, and
+    // counting it pulls that component's script onto a page that never uses it.
+    const {scrubbed, restore} = scrubCodeRegions(source);
+
     // Rewrite shortcode form → raw tag form.
-    const rewritten = source.replace(
+    const rewritten = scrubbed.replace(
         /\[component\s+([^\]]+?)\s*\/?\]/g,
         (_, attrs) => {
             const nameMatch = attrs.match(/name\s*=\s*["']([a-z][a-z0-9-]*)["']/);
@@ -1957,7 +2010,7 @@ export function collectAndRewriteComponents(source) {
         used.add(m[1]);
     }
 
-    return {output: rewritten, used};
+    return {output: restore(rewritten), used};
 }
 
 export function escapeAttr(str) {
@@ -3371,6 +3424,51 @@ function processIconBlocks(markdown) {
   ));
 }
 
+// ─── [demo] - embed a local demo page ──────────────────────────────────────
+
+/** Where [demo src="..."] looks for its pages, unless the tag says otherwise. */
+const DEMO_BASE_PATH = '/public/demos';
+const DEMO_DEFAULT_HEIGHT = '500px';
+
+/**
+ * [demo src="elements/accordion" /]
+ * [demo src="effects/ambient" height="600px" title="Ambient Effect" base="/public/x" /]
+ *
+ * Was the `demo-viewer` plugin until 2026-09-22. It is a shortcode and nothing
+ * else - no admin screen, no routes, no data - so it belongs here rather than
+ * behind an install.
+ *
+ * The src is a SAME-ORIGIN path, which is why `allowIframeRelativeUrls` matters
+ * in the sanitizer below. `base` exists because the plugin had a configurable
+ * basePath; an attribute serves the one site that set it without inventing a
+ * config key nobody else would ever touch.
+ *
+ * @param   {string} markdown
+ * @returns {string}
+ */
+function processDemoBlocks(markdown) {
+  const {scrubbed, restore} = scrubCodeRegions(markdown);
+  return restore(scrubbed.replace(
+    /\[demo([^\]]*?)\/\]/gi,
+    (_, attrStr) => {
+      const attrs = parseShortcodeAttrs(attrStr);
+      const src = typeof attrs.src === 'string' ? attrs.src.trim() : '';
+      if (!src) return '';
+      // A src is a path fragment under base, never a URL of its own: anything
+      // carrying a scheme or a protocol-relative prefix would escape the site.
+      if (/^[a-z][a-z0-9+.-]*:/i.test(src) || src.startsWith('//')) return '';
+      const base = (typeof attrs.base === 'string' && attrs.base.startsWith('/'))
+        ? attrs.base.replace(/\/+$/, '')
+        : DEMO_BASE_PATH;
+      const height = attrs.height || DEMO_DEFAULT_HEIGHT;
+      const title = attrs.title || '';
+      const iframeSrc = `${base}/${src.replace(/^\/+/, '')}.html`;
+      const titleBar = title ? `<div class="demo-viewer-title">${escapeAttr(title)}</div>` : '';
+      return `<div class="demo-viewer">${titleBar}<iframe src="${escapeAttr(iframeSrc)}" style="width:100%;height:${escapeAttr(height)};border:none;border-radius:var(--dm-radius, 8px);background:var(--dm-surface, #1a1a2e);" loading="lazy" allowfullscreen></iframe></div>`;
+    }
+  ));
+}
+
 // ─── [embed] - video / iframe embeds ───────────────────────────────────────
 
 /**
@@ -3652,7 +3750,12 @@ async function processFormBlocks(markdown, tagSet) {
       const raw = await readFile(filePath, 'utf8');
       const form = JSON.parse(raw);
       await expandReferenceFields(form);
-      const encoded = Buffer.from(JSON.stringify(form)).toString('base64');
+      // `actions` holds the notification email recipients and the webhook URL.
+      // The embed is base64 in the page source, which is not a secret keeping
+      // measure, so strip them exactly as GET /forms/:slug/public does - the
+      // browser never reads them, the submit route resolves them server-side.
+      const {actions: _actions, ...publicForm} = form;
+      const encoded = Buffer.from(JSON.stringify(publicForm)).toString('base64');
         const extraClass = attrs.class ? ` ${escapeAttr(attrs.class)}` : '';
         const idAttr = attrs.id ? ` id="${escapeAttr(attrs.id)}"` : '';
         replacement = `<div class="cms-form-embed${extraClass}" data-form-inline="${escapeAttr(encoded)}"${idAttr}></div>`;
@@ -3868,11 +3971,15 @@ function processSlideoverBlocks(markdown) {
  * @returns {Promise<string>}
  */
 async function processMenuBlocks(markdown, user, ctx = {}) {
+    // Scrub first, or a `[menu …/]` written inside a fenced block as an example
+    // of the syntax is rendered into a real nav and then escaped into the code
+    // block - the docs page shows the output instead of the shortcode.
+    const {scrubbed, restore} = scrubCodeRegions(markdown);
     const re = /\[menu(\s+[^\]]*?)?\s*\/\]/gi;
-    const matches = [...markdown.matchAll(re)];
+    const matches = [...scrubbed.matchAll(re)];
     if (!matches.length) return markdown;
 
-    let out = markdown;
+    let out = scrubbed;
     for (const m of matches) {
         const attrs = parseShortcodeAttrs(m[1] || '');
         // A bare `slug` / `location` with no value parses as the boolean `true`
@@ -3925,7 +4032,7 @@ async function processMenuBlocks(markdown, user, ctx = {}) {
         });
         out = out.replace(m[0], html);
     }
-    return out;
+    return restore(out);
 }
 
 /** Visible diagnostic for an unusable [menu] shortcode - mirrors [form]'s. */
@@ -4074,7 +4181,8 @@ export async function parseMarkdown(raw, opts = {}) {
     const withSpacer = processSpacerBlocks(withListGroup);
     const withCenter = processCenterBlocks(withSpacer);
     const withIcon = processIconBlocks(withCenter);
-    const withEmbed = processEmbedBlocks(withIcon);
+    const withDemo = processDemoBlocks(withIcon);
+    const withEmbed = processEmbedBlocks(withDemo);
   const withForm = await processFormBlocks(withEmbed, tagSet);
   const withHero = processHeroBlocks(withForm);
   const withTable = processTableBlocks(withHero);
@@ -4102,6 +4210,12 @@ export async function parseMarkdown(raw, opts = {}) {
       'player.vimeo.com',
       ...getEmbedAllowedHosts(),
     ],
+    // sanitize-html drops a RELATIVE iframe src whenever allowedIframeHostnames
+    // is set, because it cannot match a hostname it has not been given. That
+    // silently emptied every [demo] iframe. A relative src is same-origin by
+    // definition, so the hostname gate has nothing to say about it: the gate
+    // exists to stop embedding somebody else's site, not your own page.
+    allowIframeRelativeUrls: true,
     allowedTags: sanitizeHtml.defaults.allowedTags.concat([
       'img', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
       'form', 'input', 'textarea', 'select', 'option', 'optgroup',

package/server/services/permissionRegistry.js

@@ -87,6 +87,19 @@ export const REGISTRY = [
             {key: 'delete', label: 'Delete', description: 'Delete menus'}
         ]
     },
+    {
+        key: 'context-menus',
+        label: 'Context Menus',
+        description: 'Author right-click menus and the regions they bind to.',
+        icon: 'menu',
+        group: 'Structure',
+        actions: [
+            {key: 'read',   label: 'View',   description: 'View context menus'},
+            {key: 'create', label: 'Create', description: 'Create new context menus'},
+            {key: 'update', label: 'Edit',   description: 'Edit context menus'},
+            {key: 'delete', label: 'Delete', description: 'Delete context menus'}
+        ]
+    },
     {
         key: 'projects',
         label: 'Projects',
@@ -165,6 +178,17 @@ export const REGISTRY = [
             {key: 'delete', label: 'Delete', description: 'Delete users'}
         ]
     },
+    {
+        key: 'theme',
+        label: 'Theme',
+        description: 'Choose the site and admin themes, fonts, and per-element theme overrides.',
+        icon: 'droplet',
+        group: 'Configuration',
+        actions: [
+            {key: 'read', label: 'View', description: 'View theme settings and overrides'},
+            {key: 'update', label: 'Edit', description: 'Change themes, fonts and overrides'}
+        ]
+    },
     {
         key: 'settings',
         label: 'Settings',
@@ -178,6 +202,56 @@ export const REGISTRY = [
             {key: 'delete', label: 'Delete', description: 'Remove settings'}
         ]
     },
+    {
+        key: 'contacts',
+        label: 'Contacts',
+        description: 'Address book with groups, favourites and import/export. Each user sees only their own.',
+        icon: 'users',
+        group: 'Tools',
+        actions: [
+            {key: 'read', label: 'View', description: 'View own contacts'},
+            {key: 'create', label: 'Create', description: 'Add contacts and groups'},
+            {key: 'update', label: 'Edit', description: 'Edit own contacts'},
+            {key: 'delete', label: 'Delete', description: 'Delete own contacts'}
+        ]
+    },
+    {
+        key: 'analytics',
+        label: 'Analytics',
+        description: 'Page-view analytics: trends, top pages, journeys and export.',
+        icon: 'chart-bar',
+        group: 'Tools',
+        actions: [
+            {key: 'read', label: 'View', description: 'View analytics'},
+            {key: 'delete', label: 'Reset', description: 'Reset all counters'}
+        ]
+    },
+    {
+        key: 'notes',
+        label: 'Notes',
+        description: 'Personal notes. Each user sees only their own.',
+        icon: 'edit-3',
+        group: 'Tools',
+        actions: [
+            {key: 'read', label: 'View', description: 'View own notes'},
+            {key: 'create', label: 'Create', description: 'Write a note'},
+            {key: 'update', label: 'Edit', description: 'Edit own notes'},
+            {key: 'delete', label: 'Delete', description: 'Delete own notes'}
+        ]
+    },
+    {
+        key: 'todo',
+        label: 'Todo',
+        description: 'Personal task list. Each user sees only their own.',
+        icon: 'check-square',
+        group: 'Tools',
+        actions: [
+            {key: 'read', label: 'View', description: 'View own tasks'},
+            {key: 'create', label: 'Create', description: 'Add a task'},
+            {key: 'update', label: 'Edit', description: 'Edit own tasks'},
+            {key: 'delete', label: 'Delete', description: 'Delete own tasks'}
+        ]
+    },
     {
         key: 'plugins',
         label: 'Plugins',