domma-cms 0.66.0 → 0.69.4

package/plugins/blog/plugin.js

@@ -1,6 +1,12 @@
+import {fileURLToPath} from 'url';
 import defaultConfig from './config.js';
 import {createEntry, deleteEntry, getEntry, listEntries, updateEntry} from '../../server/services/collections.js';
 import {getPluginStates, savePluginState} from '../../server/services/plugins.js';
+import {renderBlogPage} from '../../server/services/renderer.js';
+import {DISPLAY_DEFAULTS, pickDisplaySettings, safeImageUrl} from './lib/layouts.js';
+import {catalogue, seedBlocks} from './lib/render.js';
+import {liveSettings, loadEntries as loadAll, renderPostPage} from './lib/page.js';
+import {SAMPLE_CATEGORIES, samplePosts} from './lib/samples.js';
 
 const POSTS_SLUG      = 'blog-posts';
 const CATEGORIES_SLUG = 'blog-categories';
@@ -16,6 +22,53 @@ function isEditorOrAdmin(user) {
     return canPublish(user);
 }
 
+// Sidebar badge text helpers - kept here rather than imported from core, so the
+// plugin still loads on an engine that predates server/services/sidebarBadges.js.
+const plural = (n, one) => `${n} ${n === 1 ? one : `${one}s`}`;
+function clip(text, max) {
+    const s = String(text ?? '').replace(/\s+/g, ' ').trim();
+    return s.length <= max ? s : `${s.slice(0, max - 1).trimEnd()}…`;
+}
+function ago(iso) {
+    const secs = Math.max(0, Math.round((Date.now() - new Date(iso).getTime()) / 1000));
+    if (!Number.isFinite(secs)) return '';
+    if (secs < 60) return 'just now';
+    if (secs < 3600) return `${Math.round(secs / 60)} min ago`;
+    if (secs < 86400) return `${plural(Math.round(secs / 3600), 'hour')} ago`;
+    return `${plural(Math.round(secs / 86400), 'day')} ago`;
+}
+
+/** '' (the site default) or a post layout's block name. */
+function cleanTemplate(value) {
+    const v = String(value ?? '').trim();
+    return /^blog-post-[a-z0-9-]+$/.test(v) ? v : '';
+}
+
+/**
+ * The fields a caller may set on a post. Status, publish date and authorship
+ * go through the publish / schedule routes, which check who is asking: taken
+ * straight from the body, a blog-author could publish their own post with
+ * `{"status": "published"}` and skip the editor entirely.
+ */
+export function postFields(body, user) {
+    const out = {};
+    if (typeof body.title === 'string') out.title = body.title.trim();
+    if (typeof body.slug === 'string') out.slug = body.slug.trim();
+    if (typeof body.content === 'string') out.content = body.content;
+    if (typeof body.excerpt === 'string') out.excerpt = body.excerpt.trim();
+    if (body.featuredImage !== undefined) out.featuredImage = body.featuredImage ? String(body.featuredImage) : null;
+    if (Array.isArray(body.categories)) out.categories = body.categories.map(String);
+    if (Array.isArray(body.tags)) out.tags = body.tags.map(t => String(t).trim()).filter(Boolean);
+    if (body.seo && typeof body.seo === 'object') {
+        out.seo = {title: String(body.seo.title ?? ''), description: String(body.seo.description ?? '')};
+    }
+    if (body.template !== undefined) out.template = cleanTemplate(body.template);
+    // Only a publisher may move a post out of draft here (Save Draft sends 'draft').
+    if (body.status === 'draft') out.status = 'draft';
+    else if (body.status !== undefined && canPublish(user) && ['scheduled', 'published'].includes(body.status)) out.status = body.status;
+    return out;
+}
+
 /** Derive a URL slug from a title string. */
 function slugify(str) {
     return String(str)
@@ -188,6 +241,120 @@ export default async function blogPlugin(fastify, options) {
         registerEmbedShortcodes(options.hooks.registerShortcode, basePath);
     }
 
+    // The layouts are blocks; put the shipped ones where the Blocks tool can
+    // edit them. Once each, never over a site's own copy (lib/render.js).
+    try {
+        const copied = await seedBlocks();
+        if (copied.length) fastify.log.info(`[blog] added layout blocks: ${copied.join(', ')}`);
+    } catch (err) {
+        fastify.log.warn(`[blog] could not add the layout blocks: ${err.message}`);
+    }
+
+    // -------------------------------------------------------------------------
+    // Layouts
+    // -------------------------------------------------------------------------
+
+    /** GET /api/plugins/blog/layouts - every post layout and listing display on offer */
+    fastify.get('/layouts', { preHandler: [authenticate] }, async () => {
+        const s = liveSettings(settings);
+        return { ...(await catalogue()), postLayout: s.postLayout, listDisplay: s.listDisplay };
+    });
+
+    /**
+     * POST /api/plugins/blog/preview - a post as the site would show it, from
+     * the editor's UNSAVED fields and in any layout, for the preview panel.
+     * The whole page, chrome and all, so what the author sees is what readers get.
+     */
+    fastify.post('/preview', { preHandler: [authenticate] }, async (request, reply) => {
+        const body = request.body ?? {};
+        const user = request.user;
+        let stored = null;
+        if (body.id) {
+            const entry = await getEntry(POSTS_SLUG, String(body.id));
+            if (entry) {
+                if (!isEditorOrAdmin(user) && entry.data.authorId !== (user?.id ?? user?.sub)) {
+                    return reply.code(403).send({ error: 'Forbidden' });
+                }
+                stored = { id: entry.id, ...entry.data };
+            }
+        }
+        const post = {
+            id: stored?.id ?? '__preview__',
+            status: 'published',
+            publishedAt: stored?.publishedAt ?? new Date().toISOString(),
+            authorId: stored?.authorId ?? (user?.id ?? user?.sub ?? ''),
+            ...(stored ?? {}),
+            ...postFields(body, user)
+        };
+        post.status = 'published';
+        post.slug = post.slug || 'preview';
+        const allPosts = (await loadAll(POSTS_SLUG)).filter(p => p.id !== post.id);
+        const s = liveSettings(settings);
+        const page = await renderPostPage(post, [...allPosts, post], s, {
+            base: basePath, layout: cleanTemplate(body.layout) || null, preview: true
+        });
+        const html = await renderBlogPage(
+            fileURLToPath(new URL('./templates/post.html', import.meta.url)),
+            { post: page.html, assetV: '1.4.4' },
+            { title: post.title || 'Preview', description: post.excerpt || '', ogImage: safeImageUrl(post.featuredImage),
+              usedComponents: page.usedComponents, urlPath: `${basePath}/${post.slug}`, noindex: true }
+        );
+        return reply.send({ html, layout: page.layout });
+    });
+
+    // -------------------------------------------------------------------------
+    // Sample posts
+    // -------------------------------------------------------------------------
+
+    /**
+     * POST /api/plugins/blog/samples - add the sample posts (and any sample
+     * category the site lacks). A sample whose slug is taken is skipped, so
+     * pressing it twice adds nothing the second time.
+     */
+    fastify.post('/samples', { preHandler: [authenticate, requireAdmin] }, async (request) => {
+        const uid = request.user?.id ?? request.user?.sub ?? null;
+        const cats = await loadAll(CATEGORIES_SLUG);
+        const catIds = {};
+        for (const c of SAMPLE_CATEGORIES) {
+            const have = cats.find(x => x.slug === c.slug);
+            catIds[c.slug] = have ? have.id : (await createEntry(CATEGORIES_SLUG, { ...c, sample: true }, { createdBy: uid, source: 'admin' })).id;
+        }
+        const existing = new Set((await loadAll(POSTS_SLUG)).map(p => p.slug));
+        let added = 0;
+        for (const p of samplePosts()) {
+            if (existing.has(p.slug)) continue;
+            await createEntry(POSTS_SLUG, {
+                ...p,
+                categories: p.categories.map(slug => catIds[slug]).filter(Boolean),
+                template: p.template ?? '',
+                status: 'published',
+                authorId: uid,
+                sample: true,
+                seo: { title: '', description: '' }
+            }, { createdBy: uid, source: 'admin' });
+            added++;
+        }
+        return { ok: true, added };
+    });
+
+    /**
+     * DELETE /api/plugins/blog/samples - remove exactly what "Add" put there:
+     * posts marked as samples, and sample categories no remaining post uses.
+     */
+    fastify.delete('/samples', { preHandler: [authenticate, requireAdmin] }, async () => {
+        let posts = 0, categories = 0;
+        for (const p of (await loadAll(POSTS_SLUG)).filter(p => p.sample === true)) {
+            await deleteEntry(POSTS_SLUG, p.id);
+            posts++;
+        }
+        const inUse = new Set((await loadAll(POSTS_SLUG)).flatMap(p => p.categories ?? []));
+        for (const c of (await loadAll(CATEGORIES_SLUG)).filter(c => c.sample === true && !inUse.has(c.id))) {
+            await deleteEntry(CATEGORIES_SLUG, c.id);
+            categories++;
+        }
+        return { ok: true, posts, categories };
+    });
+
     // -------------------------------------------------------------------------
     // Posts
     // -------------------------------------------------------------------------
@@ -212,10 +379,7 @@ export default async function blogPlugin(fastify, options) {
         const uid  = user?.id ?? user?.sub ?? null;
         const body = request.body ?? {};
 
-        const {
-            title, content, excerpt, featuredImage,
-            categories, tags, status, slug
-        } = body;
+        const { title, slug } = body;
 
         // The schema marks title, slug, authorId and status required, so an
         // empty title reaches createEntry and throws - a 500 where the
@@ -228,15 +392,18 @@ export default async function blogPlugin(fastify, options) {
             ? String(slug).trim()
             : slugify(title);
 
+        const fields = postFields(body, user);
         const entry = await createEntry(POSTS_SLUG, {
+            content:       '',
+            excerpt:       '',
+            featuredImage: null,
+            categories:    [],
+            tags:          [],
+            template:      '',
+            ...fields,
             title:         title.trim(),
             slug:          derivedSlug,
-            content:       typeof content === 'string' ? content : '',
-            excerpt:       typeof excerpt === 'string' ? excerpt.trim() : '',
-            featuredImage: featuredImage ?? null,
-            categories:    Array.isArray(categories) ? categories : [],
-            tags:          Array.isArray(tags) ? tags : [],
-            status:        status ?? 'draft',
+            status:        fields.status ?? 'draft',
             authorId:      uid
         }, { createdBy: uid, source: 'admin' });
 
@@ -263,8 +430,7 @@ export default async function blogPlugin(fastify, options) {
             return reply.code(403).send({ error: 'Forbidden' });
         }
 
-        const updates = request.body ?? {};
-        const merged  = { ...entry.data, ...updates };
+        const merged  = { ...entry.data, ...postFields(request.body ?? {}, user) };
 
         const updated = await updateEntry(POSTS_SLUG, id, merged);
         return reply.send(toPost(updated));
@@ -408,10 +574,49 @@ export default async function blogPlugin(fastify, options) {
         return reply.send(comments);
     });
 
+    /** GET /api/plugins/blog/comments/pending-count - the sidebar badge on Blog: comments waiting for approval */
+    fastify.get('/comments/pending-count', { preHandler: [authenticate] }, async () => {
+        const [comments, posts] = await Promise.all([loadAll(COMMENTS_SLUG), loadAll(POSTS_SLUG)]);
+        const pending = comments.filter(c => c.status === 'pending')
+            .sort((a, b) => String(b.createdAt ?? '').localeCompare(String(a.createdAt ?? '')));
+        const titleOf = new Map(posts.map(p => [p.id, p.title || 'Untitled']));
+        const count = (status) => posts.filter(p => p.status === status).length;
+        const next = posts.filter(p => p.status === 'scheduled' && p.publishedAt)
+            .sort((a, b) => String(a.publishedAt).localeCompare(String(b.publishedAt)))[0];
+        const n = pending.length;
+        return {
+            count: n,
+            label: `${plural(n, 'comment')} waiting for approval`,
+            tone: 'attention',
+            details: {
+                title: 'Blog',
+                rows: [
+                    { label: 'Waiting for approval', value: String(n) },
+                    { label: 'Published', value: String(count('published')) },
+                    { label: 'Drafts', value: String(count('draft')) },
+                    { label: 'Scheduled', value: next ? `${count('scheduled')} · next ${String(next.publishedAt).slice(0, 10)}` : String(count('scheduled')) }
+                ],
+                // Plain text: the popover sets it with textContent, so a comment is never markup.
+                items: pending.slice(0, 4).map(c => ({
+                    text: `${clip(c.authorName, 24)}: "${clip(c.body, 50)}"`,
+                    meta: `on ${clip(titleOf.get(c.postId) ?? 'a deleted post', 36)} · ${ago(c.createdAt)}`
+                })),
+                empty: 'No comments waiting.'
+            }
+        };
+    });
+
     /** POST /api/plugins/blog/comments - public, no authenticate */
     fastify.post('/comments', async (request, reply) => {
         const body = request.body ?? {};
 
+        // Read the settings as they are NOW. `settings` above is captured when
+        // the plugin registers, so switching comments off - or moderation -
+        // did nothing until a restart, and a closed blog kept taking comments
+        // from anyone who posted straight to this route.
+        const live = { ...defaultConfig, ...(getPluginStates()?.blog?.settings ?? {}) };
+        if (!live.commentsEnabled) return reply.code(403).send({ error: 'Comments are closed' });
+
         // Honeypot: non-empty `website` field = bot, silently discard
         if (body.website) {
             return reply.code(201).send({ ok: true });
@@ -424,7 +629,7 @@ export default async function blogPlugin(fastify, options) {
         if (!authorEmail) return reply.code(400).send({ error: 'authorEmail is required' });
         if (!commentBody) return reply.code(400).send({ error: 'body is required' });
 
-        const commentStatus = settings.commentModeration !== false ? 'pending' : 'approved';
+        const commentStatus = live.commentModeration !== false ? 'pending' : 'approved';
 
         const entry = await createEntry(COMMENTS_SLUG, {
             postId:      String(postId),
@@ -482,7 +687,7 @@ export default async function blogPlugin(fastify, options) {
     /** GET /api/plugins/blog/settings */
     fastify.get('/settings', { preHandler: [authenticate] }, async (request, reply) => {
         const stored = getPluginStates()?.blog?.settings ?? {};
-        return reply.send({ ...defaultConfig, ...stored });
+        return reply.send({ ...defaultConfig, ...DISPLAY_DEFAULTS, ...stored });
     });
 
     /** PUT /api/plugins/blog/settings */
@@ -493,13 +698,18 @@ export default async function blogPlugin(fastify, options) {
 
         // Whitelist rather than merge: every key here is read back by the
         // public routes, and storing whatever was posted invites surprises.
+        // Over what is stored, not over the defaults: a PUT carrying one field
+        // used to reset every other setting to its default.
+        const stored = getPluginStates()?.blog?.settings ?? {};
         const merged = {
             ...defaultConfig,
+            ...stored,
             ...(body.basePath          !== undefined && { basePath: String(body.basePath) }),
             ...(body.postsPerPage      !== undefined && { postsPerPage: Number(body.postsPerPage) || defaultConfig.postsPerPage }),
             ...(body.commentsEnabled   !== undefined && { commentsEnabled: Boolean(body.commentsEnabled) }),
             ...(body.commentModeration !== undefined && { commentModeration: Boolean(body.commentModeration) }),
-            ...(body.feedLength        !== undefined && { feedLength: Number(body.feedLength) || defaultConfig.feedLength })
+            ...(body.feedLength        !== undefined && { feedLength: Number(body.feedLength) || defaultConfig.feedLength }),
+            ...pickDisplaySettings(body)
         };
 
         savePluginState('blog', { settings: merged });

package/plugins/blog/plugin.json

@@ -1,15 +1,14 @@
 {
   "name": "blog",
   "displayName": "Blog",
-  "version": "1.1.0",
-  "description": "Public-facing blog with posts, categories, and comments.",
+  "version": "1.4.4",
+  "tier": "free",
+  "description": "Public-facing blog with posts, categories and comments - layouts and listings built from editable blocks.",
   "author": "Domma CMS",
-  "date": "2026-04-07",
+  "date": "2026-09-23",
   "icon": "file-text",
   "admin": {
-    "css": [
-      "admin/css/index.css"
-    ],
+    "css": ["admin/css/index.css"],
     "sidebar": [
       {
         "id": "blog",
@@ -17,88 +16,29 @@
         "icon": "file-text",
         "url": "#/plugins/blog",
         "section": "#/plugins/blog",
+        "countUrl": "/api/plugins/blog/comments/pending-count",
         "children": [
-          {
-            "id": "blog-posts",
-            "text": "Posts",
-            "url": "#/plugins/blog/posts"
-          },
-          {
-            "id": "blog-categories",
-            "text": "Categories",
-            "url": "#/plugins/blog/categories"
-          },
-          {
-            "id": "blog-comments",
-            "text": "Comments",
-            "url": "#/plugins/blog/comments"
-          },
-          {
-            "id": "blog-settings",
-            "text": "Settings",
-            "url": "#/plugins/blog/settings"
-          }
+          { "id": "blog-posts",      "text": "Posts",      "url": "#/plugins/blog/posts" },
+          { "id": "blog-categories", "text": "Categories", "url": "#/plugins/blog/categories" },
+          { "id": "blog-comments",   "text": "Comments",   "url": "#/plugins/blog/comments" }
         ]
       }
     ],
     "routes": [
-      {
-        "path": "/plugins/blog",
-        "view": "plugin-blog-posts",
-        "title": "Blog - Domma CMS"
-      },
-      {
-        "path": "/plugins/blog/posts",
-        "view": "plugin-blog-posts",
-        "title": "Blog Posts - Domma CMS"
-      },
-      {
-        "path": "/plugins/blog/posts/new",
-        "view": "plugin-blog-post-editor",
-        "title": "New Post - Domma CMS"
-      },
-      {
-        "path": "/plugins/blog/posts/:id",
-        "view": "plugin-blog-post-editor",
-        "title": "Edit Post - Domma CMS"
-      },
-      {
-        "path": "/plugins/blog/categories",
-        "view": "plugin-blog-categories",
-        "title": "Blog Categories - Domma CMS"
-      },
-      {
-        "path": "/plugins/blog/comments",
-        "view": "plugin-blog-comments",
-        "title": "Blog Comments - Domma CMS"
-      },
-      {
-        "path": "/plugins/blog/settings",
-        "view": "plugin-blog-settings",
-        "title": "Blog Settings - Domma CMS"
-      }
+      { "path": "/plugins/blog",            "view": "plugin-blog-posts",       "title": "Blog - Domma CMS" },
+      { "path": "/plugins/blog/posts",      "view": "plugin-blog-posts",       "title": "Blog Posts - Domma CMS" },
+      { "path": "/plugins/blog/posts/new",  "view": "plugin-blog-post-editor", "title": "New Post - Domma CMS" },
+      { "path": "/plugins/blog/posts/:id",  "view": "plugin-blog-post-editor", "title": "Edit Post - Domma CMS" },
+      { "path": "/plugins/blog/categories", "view": "plugin-blog-categories",  "title": "Blog Categories - Domma CMS" },
+      { "path": "/plugins/blog/comments",   "view": "plugin-blog-comments",    "title": "Blog Comments - Domma CMS" },
+      { "path": "/plugins/blog/settings",   "view": "plugin-blog-settings",    "title": "Blog Settings - Domma CMS" }
     ],
     "views": {
-      "plugin-blog-posts": {
-        "entry": "blog/admin/views/blog.js?v=01f8b54e",
-        "exportName": "blogView"
-      },
-      "plugin-blog-post-editor": {
-        "entry": "blog/admin/views/post-editor.js?v=58c616ec",
-        "exportName": "postEditorView"
-      },
-      "plugin-blog-categories": {
-        "entry": "blog/admin/views/categories.js?v=17f4038c",
-        "exportName": "categoriesView"
-      },
-      "plugin-blog-comments": {
-        "entry": "blog/admin/views/comments.js?v=55dd8ad9",
-        "exportName": "commentsView"
-      },
-      "plugin-blog-settings": {
-        "entry": "blog/admin/views/settings.js?v=bd2310f3",
-        "exportName": "settingsView"
-      }
+      "plugin-blog-posts":       { "entry": "blog/admin/views/blog.js?v=7",        "exportName": "blogView" },
+      "plugin-blog-post-editor": { "entry": "blog/admin/views/post-editor.js?v=7", "exportName": "postEditorView" },
+      "plugin-blog-categories":  { "entry": "blog/admin/views/categories.js?v=7",  "exportName": "categoriesView" },
+      "plugin-blog-comments":    { "entry": "blog/admin/views/comments.js?v=7",    "exportName": "commentsView" },
+      "plugin-blog-settings":    { "entry": "blog/admin/views/settings.js?v=7",    "exportName": "settingsView" }
     }
   }
 }