domma-cms 0.66.0 → 0.69.4

package/server/services/managerClient.js

@@ -1,93 +1,55 @@
 /**
  * Client for outbound calls from domma-cms → domma-cms-manager.
- * Reads MANAGER_URL and INSTANCE_SECRET from env at call time.
- * All functions return null/[] gracefully if MANAGER_URL is unset.
- */
-
-import {createHmac} from 'node:crypto';
-import {readFile} from 'node:fs/promises';
-import {fileURLToPath} from 'node:url';
-import {dirname, join} from 'node:path';
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-
-/**
- * Read the CMS version from the root package.json.
- * @returns {Promise<string>} The version string, or '0.0.0' on error.
+ *
+ * A MANAGED site is one the manager forked, and the manager tells it so in its
+ * environment: `MANAGER_URL` (where), `SITE_SLUG` (who) and `FLEET_TOKEN` (the
+ * proof, minted per fork and never written down). An unmanaged site has none of
+ * these, every call here returns null/[], and the Marketplace screen points at
+ * Install from File instead - which is the whole of that customer's procedure.
+ *
+ * There used to be a `registerInstance()` handshake: HMAC a fingerprint with a
+ * shared INSTANCE_SECRET, get a licence token back. It never had a caller, and
+ * it was solving a problem this fleet does not have - the manager starts every
+ * child itself, so it already knows which site is on the other end. Replacing
+ * it with a fork-time token removed a shared secret, a distribution problem and
+ * a round trip.
+ *
+ * Nothing here throws. A manager that is down, slow or mid-restart must leave
+ * the site serving pages, so every failure is a warning and an empty answer.
  */
-async function getCmsVersion() {
-    try {
-        const pkgPath = join(__dirname, '../../package.json');
-        const raw = await readFile(pkgPath, 'utf-8');
-        return JSON.parse(raw).version ?? '0.0.0';
-    } catch {
-        return '0.0.0';
-    }
-}
 
 /**
- * Register this CMS instance with domma-cms-manager.
+ * True when this site was started by a manager and can talk to it.
  *
- * @param {string} fingerprint - Unique instance fingerprint.
- * @returns {Promise<{licenseToken: string, instanceId: string}|null>}
+ * @returns {boolean}
  */
-export async function registerInstance(fingerprint) {
-    const MANAGER_URL = process.env.MANAGER_URL;
-    const INSTANCE_SECRET = process.env.INSTANCE_SECRET;
-
-    if (!MANAGER_URL) return null;
-    if (!INSTANCE_SECRET) {
-        console.warn('[managerClient] INSTANCE_SECRET not set - skipping registerInstance');
-        return null;
-    }
-
-    try {
-        const cmsVersion = await getCmsVersion();
-        const hostname = process.env.HOSTNAME ?? 'unknown';
-
-        const token = createHmac('sha256', INSTANCE_SECRET)
-            .update(fingerprint)
-            .digest('hex');
-
-        const res = await fetch(`${MANAGER_URL}/api/instances/register`, {
-            signal: AbortSignal.timeout(10_000),
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'X-Instance-Token': token,
-            },
-            body: JSON.stringify({ fingerprint, cmsVersion, hostname }),
-        });
+export function isManaged() {
+    return Boolean(process.env.MANAGER_URL && process.env.FLEET_TOKEN);
+}
 
-        if (!res.ok) {
-            console.warn(`[managerClient] registerInstance failed: ${res.status} ${res.statusText}`);
-            return null;
-        }
+/** The slug this site is known by in its fleet, or null when unmanaged. */
+export function siteSlug() {
+    return process.env.SITE_SLUG || null;
+}
 
-        return await res.json();
-    } catch (err) {
-        console.warn('[managerClient] registerInstance error:', err.message);
-        return null;
-    }
+/** Bearer the fork-time token. Read per call: a restart mints a new one. */
+function fleetHeaders() {
+    return {Authorization: `Bearer ${process.env.FLEET_TOKEN}`};
 }
 
 /**
  * Fetch the plugin catalogue from domma-cms-manager.
  *
- * @param {string} licenseToken - License token obtained from registerInstance.
- * @returns {Promise<Array<{slug: string, version: string, displayName: string, description: string, price: number, entitled: boolean}>>}
+ * @returns {Promise<Array<{slug: string, version: string, displayName: string,
+ *   description: string, price: number|null, entitled: boolean, licenceStatus: string|null}>>}
  */
-export async function fetchCatalogue(licenseToken) {
-    const MANAGER_URL = process.env.MANAGER_URL;
-
-    if (!MANAGER_URL) return [];
+export async function fetchCatalogue() {
+    if (!isManaged()) return [];
 
     try {
-        const res = await fetch(`${MANAGER_URL}/api/plugins/catalogue`, {
+        const res = await fetch(`${process.env.MANAGER_URL}/api/plugins/catalogue`, {
             signal: AbortSignal.timeout(10_000),
-            headers: {
-                Authorization: `Bearer ${licenseToken}`,
-            },
+            headers: fleetHeaders(),
         });
 
         if (!res.ok) {
@@ -103,80 +65,54 @@ export async function fetchCatalogue(licenseToken) {
 }
 
 /**
- * Fetch a plugin bundle (tarball + signature) from domma-cms-manager.
+ * Fetch a plugin bundle from domma-cms-manager.
+ *
+ * Returns the triple `installPlugin()` takes, plus the entitlement the manager
+ * minted for THIS site. The entitlement travels with the bytes it licenses
+ * rather than arriving separately, because a paid plugin installed without one
+ * is a plugin that will not load - a failure that looks like a broken install
+ * rather than a licensing answer.
  *
- * @param {string} slug - Plugin slug.
- * @param {string} version - Plugin version.
- * @param {string} licenseToken - License token obtained from registerInstance.
- * @returns {Promise<{tarball: Buffer, signature: string, publicKeyId: string}|null>}
+ * @param   {string} slug
+ * @param   {string} version
+ * @returns {Promise<{tarball: Buffer, signature: string, publicKeyId: string,
+ *   entitlement: object|null, version: string}|null>} null when unmanaged or unreachable
+ * @throws  {Error} when the manager refuses - an unlicensed plugin is an answer
+ *          worth showing, not a silent empty result
  */
-export async function fetchPluginBundle(slug, version, licenseToken) {
-    const MANAGER_URL = process.env.MANAGER_URL;
-
-    if (!MANAGER_URL) return null;
+export async function fetchPluginBundle(slug, version) {
+    if (!isManaged()) return null;
 
+    let res;
     try {
-        const res = await fetch(`${MANAGER_URL}/api/plugins/install/${slug}/${version}`, {
-            signal: AbortSignal.timeout(10_000),
-            headers: {
-                Authorization: `Bearer ${licenseToken}`,
-            },
+        res = await fetch(`${process.env.MANAGER_URL}/api/plugins/install/${slug}/${version}`, {
+            signal: AbortSignal.timeout(30_000),
+            headers: fleetHeaders(),
         });
-
-        if (!res.ok) {
-            console.warn(`[managerClient] fetchPluginBundle failed: ${res.status} ${res.statusText}`);
-            return null;
-        }
-
-        const json = await res.json();
-
-        if (typeof json.tarball !== 'string' || json.tarball.length > 100 * 1024 * 1024) {
-            console.warn('[managerClient] fetchPluginBundle: tarball too large or invalid, refusing decode');
-            return null;
-        }
-
-        return {
-            tarball: Buffer.from(json.tarball, 'base64'),
-            signature: json.signature,
-            publicKeyId: json.publicKeyId,
-        };
     } catch (err) {
         console.warn('[managerClient] fetchPluginBundle error:', err.message);
         return null;
     }
-}
 
-/**
- * Send a heartbeat to domma-cms-manager with the list of installed plugins.
- *
- * @param {string} licenseToken - License token obtained from registerInstance.
- * @param {string[]} installedSlugs - Array of installed plugin slugs.
- * @returns {Promise<boolean>} True on success, false on error.
- */
-export async function heartbeat(licenseToken, installedSlugs) {
-    const MANAGER_URL = process.env.MANAGER_URL;
-
-    if (!MANAGER_URL) return false;
-
-    try {
-        const res = await fetch(`${MANAGER_URL}/api/instances/heartbeat`, {
-            signal: AbortSignal.timeout(10_000),
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                Authorization: `Bearer ${licenseToken}`,
-            },
-            body: JSON.stringify({ installedSlugs, versions: {} }),
-        });
-
-        if (!res.ok) {
-            console.warn(`[managerClient] heartbeat failed: ${res.status} ${res.statusText}`);
-            return false;
-        }
+    if (!res.ok) {
+        // 403 is "you have no licence for this", 409 "your catalogue is stale".
+        // Both are things the admin can act on, so they are raised rather than
+        // logged and swallowed the way an unreachable manager is.
+        const body = await res.json().catch(() => ({}));
+        throw new Error(body.error || `The manager refused that download (${res.status}).`);
+    }
 
-        return true;
-    } catch (err) {
-        console.warn('[managerClient] heartbeat error:', err.message);
-        return false;
+    const json = await res.json();
+    if (typeof json.tarball !== 'string' || json.tarball.length > 100 * 1024 * 1024) {
+        console.warn('[managerClient] fetchPluginBundle: tarball too large or invalid, refusing decode');
+        return null;
     }
+
+    return {
+        tarball: Buffer.from(json.tarball, 'base64'),
+        signature: json.signature,
+        publicKeyId: json.publicKeyId,
+        entitlement: json.entitlement ?? null,
+        version: json.version ?? version,
+    };
 }

package/server/services/markdown.js

@@ -28,6 +28,7 @@ const BUILTIN_SHORTCODES = new Set([
     'banner', 'slideover', 'counter', 'celebrate', 'firework', 'fireworks', 'scribe',
     'reveal', 'breathe', 'pulse', 'shake', 'scramble', 'ripple', 'twinkle',
     'ticker-tape', 'butterflies', 'strobe', 'animate', 'ambient', 'list-group', 'menu',
+    'demo',
 ]);
 
 // Configure marked for safe output
@@ -3423,6 +3424,51 @@ function processIconBlocks(markdown) {
   ));
 }
 
+// ─── [demo] - embed a local demo page ──────────────────────────────────────
+
+/** Where [demo src="..."] looks for its pages, unless the tag says otherwise. */
+const DEMO_BASE_PATH = '/public/demos';
+const DEMO_DEFAULT_HEIGHT = '500px';
+
+/**
+ * [demo src="elements/accordion" /]
+ * [demo src="effects/ambient" height="600px" title="Ambient Effect" base="/public/x" /]
+ *
+ * Was the `demo-viewer` plugin until 2026-09-22. It is a shortcode and nothing
+ * else - no admin screen, no routes, no data - so it belongs here rather than
+ * behind an install.
+ *
+ * The src is a SAME-ORIGIN path, which is why `allowIframeRelativeUrls` matters
+ * in the sanitizer below. `base` exists because the plugin had a configurable
+ * basePath; an attribute serves the one site that set it without inventing a
+ * config key nobody else would ever touch.
+ *
+ * @param   {string} markdown
+ * @returns {string}
+ */
+function processDemoBlocks(markdown) {
+  const {scrubbed, restore} = scrubCodeRegions(markdown);
+  return restore(scrubbed.replace(
+    /\[demo([^\]]*?)\/\]/gi,
+    (_, attrStr) => {
+      const attrs = parseShortcodeAttrs(attrStr);
+      const src = typeof attrs.src === 'string' ? attrs.src.trim() : '';
+      if (!src) return '';
+      // A src is a path fragment under base, never a URL of its own: anything
+      // carrying a scheme or a protocol-relative prefix would escape the site.
+      if (/^[a-z][a-z0-9+.-]*:/i.test(src) || src.startsWith('//')) return '';
+      const base = (typeof attrs.base === 'string' && attrs.base.startsWith('/'))
+        ? attrs.base.replace(/\/+$/, '')
+        : DEMO_BASE_PATH;
+      const height = attrs.height || DEMO_DEFAULT_HEIGHT;
+      const title = attrs.title || '';
+      const iframeSrc = `${base}/${src.replace(/^\/+/, '')}.html`;
+      const titleBar = title ? `<div class="demo-viewer-title">${escapeAttr(title)}</div>` : '';
+      return `<div class="demo-viewer">${titleBar}<iframe src="${escapeAttr(iframeSrc)}" style="width:100%;height:${escapeAttr(height)};border:none;border-radius:var(--dm-radius, 8px);background:var(--dm-surface, #1a1a2e);" loading="lazy" allowfullscreen></iframe></div>`;
+    }
+  ));
+}
+
 // ─── [embed] - video / iframe embeds ───────────────────────────────────────
 
 /**
@@ -4135,7 +4181,8 @@ export async function parseMarkdown(raw, opts = {}) {
     const withSpacer = processSpacerBlocks(withListGroup);
     const withCenter = processCenterBlocks(withSpacer);
     const withIcon = processIconBlocks(withCenter);
-    const withEmbed = processEmbedBlocks(withIcon);
+    const withDemo = processDemoBlocks(withIcon);
+    const withEmbed = processEmbedBlocks(withDemo);
   const withForm = await processFormBlocks(withEmbed, tagSet);
   const withHero = processHeroBlocks(withForm);
   const withTable = processTableBlocks(withHero);
@@ -4163,6 +4210,12 @@ export async function parseMarkdown(raw, opts = {}) {
       'player.vimeo.com',
       ...getEmbedAllowedHosts(),
     ],
+    // sanitize-html drops a RELATIVE iframe src whenever allowedIframeHostnames
+    // is set, because it cannot match a hostname it has not been given. That
+    // silently emptied every [demo] iframe. A relative src is same-origin by
+    // definition, so the hostname gate has nothing to say about it: the gate
+    // exists to stop embedding somebody else's site, not your own page.
+    allowIframeRelativeUrls: true,
     allowedTags: sanitizeHtml.defaults.allowedTags.concat([
       'img', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
       'form', 'input', 'textarea', 'select', 'option', 'optgroup',

package/server/services/permissionRegistry.js

@@ -202,6 +202,56 @@ export const REGISTRY = [
             {key: 'delete', label: 'Delete', description: 'Remove settings'}
         ]
     },
+    {
+        key: 'contacts',
+        label: 'Contacts',
+        description: 'Address book with groups, favourites and import/export. Each user sees only their own.',
+        icon: 'users',
+        group: 'Tools',
+        actions: [
+            {key: 'read', label: 'View', description: 'View own contacts'},
+            {key: 'create', label: 'Create', description: 'Add contacts and groups'},
+            {key: 'update', label: 'Edit', description: 'Edit own contacts'},
+            {key: 'delete', label: 'Delete', description: 'Delete own contacts'}
+        ]
+    },
+    {
+        key: 'analytics',
+        label: 'Analytics',
+        description: 'Page-view analytics: trends, top pages, journeys and export.',
+        icon: 'chart-bar',
+        group: 'Tools',
+        actions: [
+            {key: 'read', label: 'View', description: 'View analytics'},
+            {key: 'delete', label: 'Reset', description: 'Reset all counters'}
+        ]
+    },
+    {
+        key: 'notes',
+        label: 'Notes',
+        description: 'Personal notes. Each user sees only their own.',
+        icon: 'edit-3',
+        group: 'Tools',
+        actions: [
+            {key: 'read', label: 'View', description: 'View own notes'},
+            {key: 'create', label: 'Create', description: 'Write a note'},
+            {key: 'update', label: 'Edit', description: 'Edit own notes'},
+            {key: 'delete', label: 'Delete', description: 'Delete own notes'}
+        ]
+    },
+    {
+        key: 'todo',
+        label: 'Todo',
+        description: 'Personal task list. Each user sees only their own.',
+        icon: 'check-square',
+        group: 'Tools',
+        actions: [
+            {key: 'read', label: 'View', description: 'View own tasks'},
+            {key: 'create', label: 'Create', description: 'Add a task'},
+            {key: 'update', label: 'Edit', description: 'Edit own tasks'},
+            {key: 'delete', label: 'Delete', description: 'Delete own tasks'}
+        ]
+    },
     {
         key: 'plugins',
         label: 'Plugins',

package/server/services/pluginEntitlement.js

@@ -0,0 +1,171 @@
+/**
+ * Entitlement verification - may this plugin run here?
+ *
+ * Only asked of a plugin declaring `closedSource: true`. A plugin the user wrote
+ * has no entitlement, needs none, and must never be asked for one: the gate keys
+ * on a flag WE set on OUR paid plugins, so the free builder is untouched by all
+ * of this.
+ *
+ * The two commercial models expire in completely different ways, and getting it
+ * backwards is the mistake with real consequences:
+ *
+ *   rental     a managed site pays monthly. Past its term plus grace, it stops.
+ *   perpetual  bought outright. It NEVER stops. What lapses is support and
+ *              updates - so a customer who paid a large sum once and declined
+ *              the renewal keeps what they bought, forever, offline.
+ *
+ * A wildcard entitlement (`slug: "*"`) satisfies any slug. That is how an owner
+ * instance works: the manager is where plugins are written, so a plugin being
+ * built today has no slug in any ledger and a per-slug entitlement could not
+ * name it.
+ *
+ * @module server/services/pluginEntitlement
+ */
+import {createPublicKey, verify as cryptoVerify} from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import {trustedKey} from './pluginInstaller.js';
+
+/**
+ * Canonical JSON: keys sorted at every depth, no whitespace, undefined dropped.
+ *
+ * A deliberate verbatim copy of the signer's, in dcms-marketplace's
+ * scripts/entitlement.js. The signature is over bytes, and a verifier that
+ * disagrees by one space rejects everything for a reason nobody can see. It is
+ * duplicated rather than shared because the signer is not, and must not be, a
+ * dependency of the CMS.
+ *
+ * @param   {unknown} value
+ * @returns {string}
+ */
+export function canonicalise(value) {
+    if (Array.isArray(value)) {
+        return '[' + value.map(canonicalise).join(',') + ']';
+    }
+    if (value && typeof value === 'object') {
+        const keys = Object.keys(value).filter(k => value[k] !== undefined).sort();
+        return '{' + keys.map(k => JSON.stringify(k) + ':' + canonicalise(value[k])).join(',') + '}';
+    }
+    return JSON.stringify(value);
+}
+
+/** Does this entitlement cover the named plugin? */
+export function coversSlug(entitlement, slug) {
+    return entitlement?.slug === '*' || entitlement?.slug === slug;
+}
+
+/**
+ * Find the entitlement covering a plugin.
+ *
+ * Two places, in order:
+ *
+ *   1. `plugins/<slug>/.entitlement.json` - what an envelope carried in. One
+ *      plugin, one licence, sitting beside the thing it licenses.
+ *   2. `config/entitlements/*.json` - INSTANCE level. This is where an owner
+ *      wildcard lives, and it has to be here rather than in a plugin directory:
+ *      a wildcard filed under one plugin would cover that plugin only, which
+ *      defeats the whole point of it.
+ *
+ * A per-plugin file wins. It is the more specific claim, and it is the one a
+ * renewal writes.
+ *
+ * @param   {string} slug
+ * @returns {object|null}
+ */
+export function readEntitlement(slug) {
+    const own = path.join(path.resolve('plugins'), slug, '.entitlement.json');
+    try {
+        return JSON.parse(fs.readFileSync(own, 'utf8'));
+    } catch { /* fall through to the instance level */ }
+
+    const dir = path.resolve('config', 'entitlements');
+    let names;
+    try {
+        names = fs.readdirSync(dir).filter(n => n.endsWith('.json')).sort();
+    } catch {
+        return null;
+    }
+    for (const name of names) {
+        try {
+            const e = JSON.parse(fs.readFileSync(path.join(dir, name), 'utf8'));
+            if (coversSlug(e, slug)) return e;
+        } catch { /* a malformed file is not an entitlement */ }
+    }
+    return null;
+}
+
+/**
+ * Classify a plugin's entitlement.
+ *
+ * Returns one of:
+ *   'valid'          load it
+ *   'grace'          load it, and say so - a rental just past its term
+ *   'support-ended'  load it - a perpetual licence whose updates have stopped
+ *   'expired'        do NOT load - a rental past its grace period
+ *   'unlicensed'     do NOT load - absent, malformed, or not signed by us
+ *
+ * @param   {string} slug
+ * @param   {object|null} [entitlement] - injectable for testing
+ * @param   {Date}   [now]
+ * @returns {{state: string, reason: string, entitlement: object|null}}
+ */
+export function classifyEntitlement(slug, entitlement = readEntitlement(slug), now = new Date()) {
+    if (!entitlement) {
+        return {state: 'unlicensed', reason: 'no entitlement file', entitlement: null};
+    }
+    if (!coversSlug(entitlement, slug)) {
+        return {state: 'unlicensed', reason: `entitlement is for "${entitlement.slug}"`, entitlement};
+    }
+
+    const pem = trustedKey(entitlement.keyId);
+    if (!pem) {
+        return {state: 'unlicensed', reason: `unknown signing key "${entitlement.keyId}"`, entitlement};
+    }
+
+    const {signature, ...rest} = entitlement;
+    let ok = false;
+    try {
+        ok = cryptoVerify(null, Buffer.from(canonicalise(rest), 'utf8'),
+            createPublicKey(pem), Buffer.from(String(signature), 'base64'));
+    } catch {
+        ok = false;
+    }
+    if (!ok) return {state: 'unlicensed', reason: 'signature does not verify', entitlement};
+
+    const ms = now.getTime();
+    const graceMs = (Number(entitlement.gracePeriodDays) || 0) * 86_400_000;
+
+    if (entitlement.model === 'rental') {
+        const end = Date.parse(entitlement.expiresAt);
+        if (!Number.isFinite(end)) {
+            return {state: 'unlicensed', reason: 'rental with no expiry', entitlement};
+        }
+        if (ms <= end) return {state: 'valid', reason: '', entitlement};
+        if (ms <= end + graceMs) return {state: 'grace', reason: 'rental term ended', entitlement};
+        return {state: 'expired', reason: 'rental term and grace period ended', entitlement};
+    }
+
+    // Perpetual. Support may have lapsed; the licence has not, and never will.
+    const support = Date.parse(entitlement.supportExpiresAt);
+    if (Number.isFinite(support) && ms > support) {
+        return {state: 'support-ended', reason: 'support and updates ended', entitlement};
+    }
+    return {state: 'valid', reason: '', entitlement};
+}
+
+/** The states that let a plugin load. */
+const LOADABLE = new Set(['valid', 'grace', 'support-ended']);
+
+/**
+ * May this plugin load?
+ *
+ * @param   {object} manifest
+ * @returns {{allowed: boolean, state: string, reason: string}}
+ */
+export function mayLoad(manifest) {
+    if (manifest?.closedSource !== true) {
+        return {allowed: true, state: 'not-required', reason: ''};
+    }
+    const {state, reason} = classifyEntitlement(manifest.name);
+    return {allowed: LOADABLE.has(state), state, reason};
+}