domma-cms 0.66.0 → 0.69.4

package/server/services/promoted-plugins-migration.js

@@ -0,0 +1,254 @@
+/**
+ * Promoted-plugin migration - one-shot retirement of plugins that became core.
+ *
+ * A plugin that is promoted into the CMS leaves two traces on an existing
+ * install:
+ *
+ *   1. its `plugins.json` entry, which would otherwise offer a toggle for a
+ *      feature that is no longer optional, and
+ *   2. `plugins/<slug>/` itself - the updater replaces the plugins it ships and
+ *      adds new ones, but never removes one that has gone away. Left in place,
+ *      the loader would register a SECOND copy of a feature the CMS now has of
+ *      its own, which for a shortcode means two handlers racing for the same
+ *      tag.
+ *
+ * This is the generic form of `search-migration.js`, which did the same job for
+ * `site-search` alone. Each promotion adds a row to PROMOTED rather than another
+ * near-identical file.
+ *
+ * Idempotent: with no entry and no directory there is nothing to do, which is
+ * the state of every fresh install.
+ */
+import fs from 'fs';
+import path from 'path';
+
+/**
+ * Plugins that are now part of the CMS.
+ *
+ * `author` is checked against the directory's manifest before anything is
+ * deleted. A directory of that name carrying somebody else's work is their
+ * plugin, not our retired one, and is left exactly where it is.
+ *
+ * `defaults` is what the plugin's own config.js shipped. Settings matching it
+ * are dropped silently; anything else is reported, because a site that tuned a
+ * setting deserves to be told where it went rather than have it vanish.
+ *
+ * `lift(settings, enabled)` moves those settings somewhere they still matter.
+ * A row without one is a plugin whose settings core does not need. It runs
+ * BEFORE the entry is deleted, so a throw leaves the entry in place and the
+ * next start tries again rather than losing the values.
+ */
+const PROMOTED = [
+    {
+        slug: 'demo-viewer',
+        author: 'Domma',
+        defaults: {basePath: '/public/demos', defaultHeight: '500px'},
+        note: 'the [demo] shortcode is built in'
+    },
+    {
+        slug: 'notes',
+        author: 'Darryl Waterhouse',
+        defaults: {scope: 'user', maxPerUser: 1000, storage: {adapter: 'mongodb', connection: 'default'}},
+        note: 'Notes is a built-in Tool; its entries are untouched in notes-notes'
+    },
+    {
+        slug: 'todo',
+        author: 'Darryl Waterhouse',
+        defaults: {scope: 'user', defaultPriority: 'medium', maxPerUser: 500, storage: {adapter: 'mongodb', connection: 'default'}},
+        note: 'Todo is a built-in Tool; its entries are untouched in todo-items'
+    },
+    {
+        slug: 'contacts',
+        author: 'Darryl Waterhouse',
+        defaults: {scope: 'user'},
+        note: 'Contacts is a built-in Tool; contacts-contacts and contacts-groups are untouched'
+    },
+    {
+        slug: 'analytics',
+        author: 'Darryl Waterhouse',
+        note: 'analytics is built in; counters moved to content/analytics/',
+        lift: liftAnalyticsCounters
+    },
+    {
+        slug: 'theme-switcher',
+        author: 'Domma',
+        note: 'the switcher is a theme setting now',
+        lift: liftThemeSwitcher
+    }
+];
+
+/**
+ * Move the analytics counters out from under plugins/.
+ *
+ * This is the only lift that moves data a site cannot regenerate: lifetime.json,
+ * daily.json and journeys.json are real traffic history, tens to hundreds of
+ * kilobytes per site. The directory they sit in is about to be deleted, so the
+ * copy has to happen first and has to be verified.
+ *
+ * Copy, re-read, compare, and only then let the caller proceed. A mismatch
+ * throws, which abandons the whole row - the plugin directory stays, the entry
+ * stays, and the next start tries again. A site keeping a duplicate 96K for one
+ * release is not a problem; losing the original is.
+ *
+ * Files already present at the destination are left alone: a second run must not
+ * overwrite counters that have moved on since.
+ *
+ * @returns {string|null} what changed, for the log
+ */
+function liftAnalyticsCounters() {
+    const SRC = path.resolve('plugins', 'analytics', 'data');
+    const DEST = path.resolve('content', 'analytics');
+    if (!fs.existsSync(SRC)) return null;
+
+    fs.mkdirSync(DEST, {recursive: true});
+    const copied = [];
+
+    for (const name of ['lifetime.json', 'daily.json', 'journeys.json', 'stats.json']) {
+        const from = path.join(SRC, name);
+        const to = path.join(DEST, name);
+        if (!fs.existsSync(from) || fs.existsSync(to)) continue;
+
+        const raw = fs.readFileSync(from);
+        fs.writeFileSync(to, raw);
+
+        // Verified by comparing what is now on disk, not by trusting the write.
+        const back = fs.readFileSync(to);
+        if (!back.equals(raw)) {
+            throw new Error(`counters failed to copy intact (${name})`);
+        }
+        copied.push(`${name} (${raw.length} bytes)`);
+    }
+
+    return copied.length
+        ? `copied counters to content/analytics/: ${copied.join(', ')}`
+        : null;
+}
+
+/**
+ * Move the theme switcher's placement into config/theme.json.
+ *
+ * `enabled` carries across deliberately: a site showing the disc keeps showing
+ * it, and one that never turned the plugin on does not suddenly acquire a
+ * visitor-facing theme picker.
+ *
+ * theme.json is read and written directly rather than through saveThemeConfig(),
+ * which validates and recompiles. Migrations run before the app is up, and a
+ * placement value is not worth pulling that machinery into startup. Written only
+ * when theme.json already exists - migrateThemeConfig() runs first and creates
+ * it, so an absent file means something is wrong enough not to paper over.
+ *
+ * @param   {object}  settings
+ * @param   {boolean} enabled
+ * @returns {string|null} what changed, for the log
+ */
+function liftThemeSwitcher(settings, enabled) {
+    const THEME_CONFIG = path.resolve('config', 'theme.json');
+    if (!fs.existsSync(THEME_CONFIG)) return null;
+
+    let cfg;
+    try {
+        cfg = JSON.parse(fs.readFileSync(THEME_CONFIG, 'utf8'));
+    } catch {
+        return null;
+    }
+    if (cfg.switcher && cfg.switcher.enabled !== undefined) {
+        return null; // already lifted, or configured since
+    }
+
+    const POSITIONS = ['right-center', 'left-center', 'bottom-right', 'bottom-left',
+        'top-left', 'top-right'];
+    const num = (v, fallback) =>
+        (Number.isFinite(Number(v)) && Number(v) >= 0 && Number(v) <= 400) ? Number(v) : fallback;
+
+    cfg.switcher = {
+        enabled,
+        position: POSITIONS.includes(settings.position) ? settings.position : 'right-center',
+        offsetX: num(settings.offsetX, 32),
+        offsetY: num(settings.offsetY, 32),
+        // The plugin's `themes` list was never read by its own markup, which
+        // hardcoded 26 dots. Starting empty means "every theme", which is what
+        // the markup effectively promised and never delivered.
+        themes: []
+    };
+    fs.writeFileSync(THEME_CONFIG, JSON.stringify(cfg, null, 2) + '\n');
+    return `lifted placement into theme.json (enabled: ${enabled})`;
+}
+
+/**
+ * Run the migration.
+ *
+ * Paths are resolved per call rather than at import, so the same process can run
+ * this against more than one install - which the tests do.
+ *
+ * @param   {object[]} [table] - override for testing
+ * @returns {string[]} what changed, for the startup log (empty = nothing to do)
+ */
+export function migratePromotedPlugins(table = PROMOTED) {
+    const PLUGINS_CONFIG = path.resolve('config', 'plugins.json');
+    const changes = [];
+
+    let plugins = null;
+    try {
+        plugins = JSON.parse(fs.readFileSync(PLUGINS_CONFIG, 'utf8'));
+    } catch {
+        // No plugins.json, or a malformed one. Neither is this migration's
+        // business - a broken file is reported loudly elsewhere.
+    }
+
+    let dirty = false;
+
+    for (const {slug, author, defaults = {}, note, lift} of table) {
+        const stored = plugins?.[slug];
+
+        // 1. The entry, and any settings it carried.
+        if (plugins && stored) {
+            const settings = stored.settings || {};
+
+            if (lift) {
+                // A lift that throws must abandon THIS row entirely - entry and
+                // directory both. Deleting either after a failed lift is how a
+                // site loses the thing the lift was moving.
+                let lifted;
+                try {
+                    lifted = lift(settings, stored.enabled === true);
+                } catch (err) {
+                    changes.push(`${slug}: NOT retired - ${err.message}`);
+                    continue;
+                }
+                if (lifted) changes.push(`${slug}: ${lifted}`);
+            } else {
+                const changed = Object.entries(settings)
+                    .filter(([k, v]) => JSON.stringify(v) !== JSON.stringify(defaults[k]));
+                if (changed.length) {
+                    changes.push(
+                        `${slug}: dropped non-default settings (${changed.map(([k]) => k).join(', ')}) - ${note}`
+                    );
+                }
+            }
+
+            delete plugins[slug];
+            dirty = true;
+            changes.push(`${slug}: removed the plugins.json entry`);
+        }
+
+        // 2. The directory - but only if it is the one we shipped.
+        const dir = path.resolve('plugins', slug);
+        if (!fs.existsSync(dir)) continue;
+
+        let ours = false;
+        try {
+            const manifest = JSON.parse(fs.readFileSync(path.join(dir, 'plugin.json'), 'utf8'));
+            ours = manifest.name === slug && manifest.author === author;
+        } catch { /* no readable manifest - leave it alone */ }
+
+        if (ours) {
+            fs.rmSync(dir, {recursive: true, force: true});
+            changes.push(`${slug}: removed plugins/${slug}/`);
+        }
+    }
+
+    if (dirty) {
+        fs.writeFileSync(PLUGINS_CONFIG, JSON.stringify(plugins, null, 2) + '\n');
+    }
+    return changes;
+}

package/server/services/publicCors.js

@@ -0,0 +1,46 @@
+/**
+ * Public asset CORS
+ *
+ * A module script is fetched in CORS mode, so `import … from
+ * 'https://this-site/public/whatever/index.js'` on another origin fails without
+ * Access-Control-Allow-Origin. A site that deliberately wants some of its own
+ * assets hot-linkable - engine source, demo code, a shared bundle - needs that
+ * header on those paths and nowhere else.
+ *
+ * `@fastify/cors` is registered once with `config/server.json`'s `cors` block and
+ * decides per ORIGIN, not per path, so it cannot express "open reads under this
+ * one prefix". Hence `cors.publicPrefixes`.
+ *
+ * Reads only. This never widens a write, and it never applies to a path that was
+ * not explicitly listed.
+ */
+
+/**
+ * Read and sanitise the configured prefixes.
+ *
+ * A prefix must be an absolute path. Anything else is dropped rather than
+ * corrected: a typo that silently matched everything would be the one mistake
+ * here with real consequences.
+ *
+ * @param   {object} [corsConfig] - the `cors` block from config/server.json
+ * @returns {string[]}
+ */
+export function normalisePublicPrefixes(corsConfig) {
+    const raw = corsConfig?.publicPrefixes;
+    if (!Array.isArray(raw)) return [];
+    return raw.filter(p => typeof p === 'string' && p.startsWith('/') && p.length > 1);
+}
+
+/**
+ * Does this request qualify for the open-read header?
+ *
+ * @param   {string}   method
+ * @param   {string}   url      - request URL, path first (query is ignored by startsWith)
+ * @param   {string[]} prefixes - from normalisePublicPrefixes()
+ * @returns {boolean}
+ */
+export function isPublicAssetRead(method, url, prefixes) {
+    if (method !== 'GET' && method !== 'HEAD') return false;
+    if (!prefixes.length || typeof url !== 'string') return false;
+    return prefixes.some(p => url.startsWith(p));
+}

package/server/services/renderer.js

@@ -12,7 +12,7 @@ import {resolveLocation, resolveMenuDecorations, resolveOverlaysForPage} from '.
 import {buildMenuNav} from './menuRender.js';
 import {getProjectForPage} from './projects.js';
 import {resolveContextMenusForPage} from './contextMenus.js';
-import {buildOverrideStyleTag, loadThemeConfig} from './themeSettings.js';
+import {buildOverrideStyleTag, getThemeTokenMap, listThemeIds, loadThemeConfig} from './themeSettings.js';
 import {getSearchSettings} from './search.js';
 
 const VALID_LAYOUT_WIDTHS = new Set(['narrow', 'normal', 'wide', 'full']);
@@ -74,6 +74,80 @@ function buildSearchAssets() {
     };
 }
 
+const THEME_SWITCHER_ASSET_V = '20260922-ts';
+const ANALYTICS_ASSET_V = '20260922-analytics';
+
+/**
+ * The page-view beacon.
+ *
+ * Always emitted: analytics was a CORE_PLUGINS member, meaning it could not be
+ * switched off, and promotion should not quietly change that. What it counts is
+ * decided in the browser - Do-Not-Track, per-session dedup and preview renders
+ * all opt out there, where the facts are.
+ *
+ * Both render paths, the standing trap in this file.
+ *
+ * @returns {string} the body tag
+ */
+function buildAnalyticsTag() {
+    return `<script src="/public/js/analytics.js?v=${ANALYTICS_ASSET_V}"></script>`;
+}
+
+/**
+ * The public theme switcher: stylesheet, theme list, script.
+ *
+ * The theme LIST is built here from listThemeIds() rather than being written
+ * out anywhere. The plugin this replaced shipped 26 hand-written dots against a
+ * stylesheet carrying 32 themes, and nothing made the gap visible - deriving it
+ * means a theme added to domma-themes.css simply appears.
+ *
+ * Each dot's colours are that theme's own --dm-primary and --dm-secondary, for
+ * the same reason: no second list of colours to drift.
+ *
+ * Both render paths need this, the same standing trap buildThemeView() and
+ * buildSearchAssets() carry.
+ *
+ * @returns {{headTag: string, bodyTag: string}} Empty strings when it is off
+ */
+function buildThemeSwitcherAssets(themeCfg) {
+    const sw = themeCfg?.switcher;
+    if (!sw || sw.enabled !== true) return {headTag: '', bodyTag: ''};
+
+    let ids;
+    try {
+        ids = listThemeIds();
+    } catch {
+        return {headTag: '', bodyTag: ''};
+    }
+    const wanted = Array.isArray(sw.themes) && sw.themes.length
+        ? ids.filter(id => sw.themes.includes(id))
+        : ids;
+    if (!wanted.length) return {headTag: '', bodyTag: ''};
+
+    const themes = wanted.map(id => {
+        const tokens = getThemeTokenMap(id) || {};
+        return {
+            id,
+            label: id.split('-').map(w => w.charAt(0).toUpperCase() + w.slice(1)).join(' '),
+            from: tokens['--dm-primary'] || tokens['--dm-surface'] || '#888',
+            to: tokens['--dm-secondary'] || tokens['--dm-background'] || '#888'
+        };
+    });
+
+    const payload = {
+        position: sw.position || 'right-center',
+        offsetX: sw.offsetX ?? 32,
+        offsetY: sw.offsetY ?? 32,
+        themes
+    };
+    const json = JSON.stringify(payload).replace(/<\/script>/gi, '<\\/script>');
+    return {
+        headTag: `<link rel="stylesheet" href="/public/css/theme-switcher.css?v=${THEME_SWITCHER_ASSET_V}">`,
+        bodyTag: `<script>window.__CMS_THEME_SWITCHER__ = ${json};</script>\n`
+            + `<script src="/public/js/theme-switcher.js?v=${THEME_SWITCHER_ASSET_V}"></script>`
+    };
+}
+
 /**
  * Strip hidden items from the navigation config before public injection.
  * Returns a shallow clone - never mutates the cached config object.
@@ -233,6 +307,7 @@ export async function renderPage(page, opts = {}) {
 
     const themeView = await buildThemeView(page);
     const searchAssets = buildSearchAssets();
+    const switcherAssets = buildThemeSwitcherAssets(themeView.cfg);
     const {fontLink, fontStyleTag, autoTheme, activeTheme, dommaTheme, customThemeClass} = themeView;
 
     const {navbarFontLink, navbarStyleTag} = buildNavbarStyleTag(navigation);
@@ -322,7 +397,7 @@ export async function renderPage(page, opts = {}) {
         // Theme overrides land BEFORE content/custom.css: the overrides are
         // generated, custom.css is hand-written, and the hand-written one stays
         // the last word.
-        headInjectLate: [injection.headLate, searchAssets.headTag, themeView.overrideStyleTag, customCssTag, navbarStyleTag]
+        headInjectLate: [injection.headLate, searchAssets.headTag, switcherAssets.headTag, themeView.overrideStyleTag, customCssTag, navbarStyleTag]
             .filter(Boolean).join('\n'),
         bodyEndInject: [
             // Draft banner - first, so it is the topmost fixed element and a
@@ -335,6 +410,8 @@ export async function renderPage(page, opts = {}) {
             overlayMenus,
             injection.bodyEnd,
             searchAssets.bodyTag,
+            switcherAssets.bodyTag,
+            buildAnalyticsTag(),
             site.backToTop?.enabled    ? '<script src="/public/js/btt.js"></script>'             : '',
             site.cookieConsent?.enabled ? '<script src="/public/js/cookie-consent.js"></script>' : '',
             (page.usedComponents || [])
@@ -853,6 +930,7 @@ export async function renderBlogPage(templatePath, data = {}, seoMeta = {}) {
     // other is the standing trap in this file.
     const themeView = await buildThemeView({});
     const searchAssets = buildSearchAssets();
+    const switcherAssets = buildThemeSwitcherAssets(themeView.cfg);
     const {fontLink, fontStyleTag, activeTheme, dommaTheme, customThemeClass} = themeView;
     const {navbarFontLink, navbarStyleTag} = buildNavbarStyleTag(navigation);
 
@@ -930,12 +1008,14 @@ export async function renderBlogPage(templatePath, data = {}, seoMeta = {}) {
         // Theme overrides land BEFORE content/custom.css: the overrides are
         // generated, custom.css is hand-written, and the hand-written one stays
         // the last word.
-        headInjectLate: [injection.headLate, searchAssets.headTag, themeView.overrideStyleTag, customCssTag, navbarStyleTag]
+        headInjectLate: [injection.headLate, searchAssets.headTag, switcherAssets.headTag, themeView.overrideStyleTag, customCssTag, navbarStyleTag]
             .filter(Boolean).join('\n'),
         bodyEndInject: [
             overlayMenus,
             injection.bodyEnd,
             searchAssets.bodyTag,
+            switcherAssets.bodyTag,
+            buildAnalyticsTag(),
             (seoMeta.usedComponents || [])
                 .map(n => `<script type="module" src="/api/components/${n}.js"></script>`)
                 .join('\n')

package/server/services/sidebarBadges.js

@@ -0,0 +1,37 @@
+/**
+ * Sidebar badges - what a count route answers.
+ *
+ *   {count, label, tone, details: {title, rows: [{label, value, tone?}], items: [{text, meta?, tone?}], empty?}}
+ *
+ * `count` and `tone` draw the badge; `details` fills the popover shown on
+ * hover. Every value is plain text - the popover sets it with textContent, so
+ * a note title or a comment is never markup. See "Live counts" in
+ * admin/js/lib/sidebar-renderer.js.
+ *
+ * @module services/sidebarBadges
+ */
+
+/** "1 task", "3 tasks". */
+export function plural(n, one, many = `${one}s`) {
+    return `${n} ${n === 1 ? one : many}`;
+}
+
+/** "just now", "5 min ago", "3 hours ago", "2 days ago", then the date. */
+export function ago(iso, now = Date.now()) {
+    const t = new Date(iso).getTime();
+    if (!Number.isFinite(t)) return '';
+    const s = Math.max(0, Math.round((now - t) / 1000));
+    if (s < 60) return 'just now';
+    if (s < 3600) return `${Math.round(s / 60)} min ago`;
+    if (s < 86400) return plural(Math.round(s / 3600), 'hour') + ' ago';
+    if (s < 86400 * 14) return plural(Math.round(s / 86400), 'day') + ' ago';
+    return new Date(t).toISOString().slice(0, 10);
+}
+
+/** Shorten to `max` characters on a word boundary, with an ellipsis. */
+export function clip(text, max = 60) {
+    const s = String(text ?? '').replace(/\s+/g, ' ').trim();
+    if (s.length <= max) return s;
+    const cut = s.slice(0, max - 1);
+    return `${cut.slice(0, cut.lastIndexOf(' ') > max * 0.6 ? cut.lastIndexOf(' ') : cut.length)}…`;
+}