domma-cms 0.70.0 → 0.71.0

package/plugins/blog/CLAUDE.md

@@ -57,7 +57,10 @@ All routes are under `/api/plugins/blog`. All require authentication unless note
 
 ## Public Routes
 
-Registered at the Fastify root (no `/api/plugins/blog` prefix). Base path defaults to `/blog` (overridable via `basePath` config key).
+Served at the site root (no `/api/plugins/blog` prefix), under the base path in the settings (`basePath`,
+default `/blog`). A saved change applies at once - no restart. They are not Fastify routes: one global
+`onRequest` hook in plugin.public.js matches each GET against the live base path (`matchBlogPath()` in
+lib/layouts.js) and answers it; anything it does not claim goes on to the site as usual.
 
 | Method | Path | Purpose |
 |---|---|---|
@@ -67,7 +70,8 @@ Registered at the Fastify root (no `/api/plugins/blog` prefix). Base path defaul
 | GET | `{base}/tag/:tag` | Posts filtered by tag |
 | GET | `{base}/author/:id` | Posts filtered by author user ID |
 | GET | `{base}` | Blog index (page 1) |
-| GET | `{base}/:slug` | Single post page - registered LAST |
+| GET | `{base}/` | 301 to `{base}` (else it would be a post with an empty slug: "Not found") |
+| GET | `{base}/:slug` | Single post page |
 
 ## Data Model
 
@@ -111,7 +115,7 @@ Registered at the Fastify root (no `/api/plugins/blog` prefix). Base path defaul
 
 | Key | Default | Purpose |
 |---|---|---|
-| `basePath` | `'/blog'` | URL prefix for all public blog routes |
+| `basePath` | `'/blog'` | URL prefix for all public blog pages; read live, tidied by `cleanBasePath()` on save |
 | `postsPerPage` | `10` | Archive pagination page size |
 | `commentsEnabled` | `false` | Show comment list and form on post pages |
 | `commentModeration` | `true` | New comments start as `pending`; `false` = auto-approve |
@@ -205,7 +209,8 @@ with `?display=` and swaps the cards, since each display is different block mark
   state - NOT as a marker on the item, because the Menus editor rewrites items with the keys it knows and
   drops the rest. `onDisable` removes a top-level item with that url, and only when `navLink` says the
   plugin added it, so a site's own Blog link is never touched. Sites where the blog was already enabled
-  get no link; there is no enable event for them. A later change of `basePath` does not move the link.
+  get no link; there is no enable event for them. Saving a new `basePath` moves that link (`moveNavLink()`)
+  and updates `navLink.url`; links a site typed into its own pages or menus are left alone.
 
 - **The admin already does Ctrl+S.** app.js clicks the view's primary Save button and calls
   `preventDefault()`. The editor's own handler saved as well, so every Ctrl+S was two PUTs - and on a
@@ -243,7 +248,17 @@ with `?display=` and swaps the cards, since each display is different block mark
 
 - **Named-role publish gate**: `canPublish()` uses `['blog-editor', 'admin', 'super-admin'].includes(user.role)` - NOT a level comparison. Do not refactor this to `getRoleLevel() <= N`; `blog-author` and `blog-editor` are both level 2, so a level check would give blog-authors publish access.
 
-- **Route registration order in plugin.public.js**: Static path segments (`/feed.xml`, `/page/:n`, `/category/:slug`, `/tag/:tag`, `/author/:id`, base index) are all registered **before** `/:slug`. Fastify matches routes in registration order for same-prefix paths, so `/:slug` must be last to avoid swallowing archive routes.
+- **The base path is read per request, so the public pages are an `onRequest` hook, not routes.**
+  Fastify routes are fixed once the server is ready, so pages registered at `/blog` stayed there after
+  Settings saved `/news` - the new path said "Not found" until a restart. The hook is made global with
+  `Symbol.for('skip-override')` (what fastify-plugin sets); without it an encapsulated hook would only
+  see routes inside the plugin, and it has none. It must `return` the reply it sends. Shortcodes, the
+  preview and the navbar link read the base the same way (`liveBase()` in lib/page.js).
+
+- **Blog Pro's posts from its other blogs are never shown here.** Blog Pro (paid, `supersedes: ["blog"]`) uses
+  these same collections and adds `blogId` to a post; this blog is Pro's FIRST blog (`'main'` or no blogId).
+  `isVisible()` (lib/page.js and plugin.js) refuses any other blogId, so if a Pro licence lapses and this plugin
+  loads again, those posts are hidden rather than piled into /blog. The admin list still shows them.
 
 - **Lazy scheduled post check**: `plugin.public.js` calls `isVisible(post)` on every `GET /:slug` request. A post transitions from `scheduled` to visible the moment `new Date(post.publishedAt) <= new Date()` - no background job needed, no cron required.
 

package/plugins/blog/admin/views/kit.js

@@ -17,7 +17,7 @@ export function escapeHtml(s) {
 
 /**
  * The blog's public base path (`/blog` unless configured), for links to the
- * live site. Read once per page load; a change needs a restart anyway.
+ * live site. Cleared when Settings saves a new one.
  *
  * @returns {Promise<string>}
  */
@@ -184,13 +184,13 @@ const SETTINGS_PANEL = `
 <div class="blog-panel">
     <div class="blog-field">
         <label class="form-label" for="blog-set-base">Base path
-            <span data-help="The URL every blog page lives under - /blog gives /blog/my-post. Takes effect after a server restart."></span>
+            <span data-help="The URL every blog page lives under - /blog gives /blog/my-post. Applies as soon as you save; the navbar link Blog added moves with it, but links typed into pages do not."></span>
         </label>
         <input id="blog-set-base" type="text" class="form-input font-mono" placeholder="/blog" data-model="basePath.value">
     </div>
     <div class="blog-field">
         <label class="form-label" for="blog-set-ppp">Posts per page
-            <span data-help="How many posts a listing page shows before paging. Takes effect after a server restart."></span>
+            <span data-help="How many posts a listing page shows before paging."></span>
         </label>
         <input id="blog-set-ppp" type="number" min="1" max="100" class="form-input" data-model="postsPerPage.value">
     </div>
@@ -252,7 +252,6 @@ const SETTINGS_PANEL = `
     <button type="button" class="btn btn-sm btn-ghost blog-panel-link" data-on-click="openBlocks">
         <span data-icon="layout" data-icon-size="13"></span> Edit the layouts in Blocks
     </button>
-    <p class="blog-panel-note" data-if="needsRestart.value">Base path and posts per page change after the server restarts.</p>
     <div class="blog-panel-actions">
         <span class="blog-panel-status" data-bind-text="status.value"></span>
         <span class="blog-spacer"></span>
@@ -320,11 +319,7 @@ export async function settingsPanel({onClose = null} = {}) {
         closable: Boolean(onClose),
         layoutOptions: M.observable(withCurrent(layouts.postLayouts ?? [], initial.postLayout)),
         displayOptions: M.observable(withCurrent(layouts.listDisplays ?? [], initial.listDisplay)),
-        dirty: M.computed(() => JSON.stringify(current()) !== JSON.stringify(baseline.value)),
-        needsRestart: M.computed(() => {
-            const b = baseline.value;
-            return String(f.basePath.value).trim() !== b.basePath || Number(f.postsPerPage.value) !== b.postsPerPage;
-        })
+        dirty: M.computed(() => JSON.stringify(current()) !== JSON.stringify(baseline.value))
     };
 
     const el = fragment(SETTINGS_PANEL);
@@ -346,10 +341,13 @@ export async function settingsPanel({onClose = null} = {}) {
                 try {
                     const res = await H.put(`${BASE}/settings`, body);
                     if (res?.error) throw new Error(res.error);
+                    // The server tidies the path ("/news/" is saved as "/news"); show what it kept.
+                    const savedBase = (res?.settings ?? res?.data?.settings)?.basePath;
+                    if (savedBase) f.basePath.value = body.basePath = savedBase;
                     baseline.value = {...body};
                     basePathCache = null;
                     status.value = 'Saved.';
-                    E.toast('Blog settings saved. Display changes are live now.', {type: 'success'});
+                    E.toast('Blog settings saved. They are live now.', {type: 'success'});
                 } catch (err) {
                     E.toast(err?.message ?? 'Failed to save settings.', {type: 'error'});
                 } finally {

package/plugins/blog/lib/layouts.js

@@ -304,3 +304,39 @@ export function cardMeta(post, {catMap = {}, authorName = ''}) {
 export function byNewest(a, b) {
     return new Date(b.publishedAt || 0) - new Date(a.publishedAt || 0);
 }
+
+/**
+ * A base path as the routes use it: one leading slash, no trailing one, no
+ * spaces or query. Anything that leaves nothing (or just "/", which would
+ * swallow the whole site) is `/blog`.
+ */
+export function cleanBasePath(value) {
+    const path = String(value ?? '').trim().split(/[?#\s]/)[0].replace(/\/{2,}/g, '/').replace(/^\/*/, '/').replace(/\/+$/, '');
+    return path || '/blog';
+}
+
+const ARCHIVE_PARAM = {page: 'n', category: 'slug', tag: 'tag', author: 'id'};
+
+/**
+ * Which public page a path is under `base`, read at request time so a changed
+ * base path applies at once. `null` for anything that is not the blog's.
+ *
+ * @returns {{name: string, params: object}|null} name: index | slash | feed | page | category | tag | author | post
+ */
+export function matchBlogPath(pathname, base) {
+    if (pathname === base) return {name: 'index', params: {}};
+    if (!pathname.startsWith(`${base}/`)) return null;
+    const rest = pathname.slice(base.length + 1);
+    if (rest === '') return {name: 'slash', params: {}};
+    let parts;
+    try {
+        parts = rest.split('/').map(decodeURIComponent);
+    } catch {
+        return null;
+    }
+    if (parts.length === 1) return parts[0] === 'feed.xml' ? {name: 'feed', params: {}} : {name: 'post', params: {slug: parts[0]}};
+    if (parts.length === 2 && parts[1] && Object.hasOwn(ARCHIVE_PARAM, parts[0])) {
+        return {name: parts[0], params: {[ARCHIVE_PARAM[parts[0]]]: parts[1]}};
+    }
+    return null;
+}

package/plugins/blog/lib/nav-link.js

@@ -70,3 +70,25 @@ export async function removeNavLink(added, menus = menuService) {
     await menus.updateMenu(added.menu, {...menu, items: kept});
     return true;
 }
+
+/**
+ * Point the link this plugin added at a new base path, after the setting
+ * changes. Only the top-level item still linking where it was added moves.
+ *
+ * @param   {{menu: string, url: string}|null} added - from addNavLink()
+ * @param   {string} url - the new base path
+ * @param   {object} [menus]
+ * @returns {Promise<boolean>} whether a link was moved
+ */
+export async function moveNavLink(added, url, menus = menuService) {
+    if (!added?.menu || !added?.url) return false;
+    const menu = await menus.getMenu(added.menu);
+    if (!menu) return false;
+    const from = trim(added.url);
+    const items = Array.isArray(menu.items) ? menu.items : [];
+    const at = items.findIndex(it => it && typeof it.url === 'string' && trim(it.url) === from);
+    if (at === -1) return false;
+    const moved = items.map((it, i) => (i === at ? {...it, url: trim(url)} : it));
+    await menus.updateMenu(added.menu, {...menu, items: moved});
+    return true;
+}

package/plugins/blog/lib/page.js

@@ -10,10 +10,17 @@ import {parseMarkdown} from '../../../server/services/markdown.js';
 import {getUserById} from '../../../server/services/users.js';
 import {getPluginStates} from '../../../server/services/plugins.js';
 import defaultConfig from '../config.js';
-import {buildToc, byNewest, cardVars, DEFAULT_POST_LAYOUT, DISPLAY_DEFAULTS, escapeHtml, interpolate, pickPostLayout, relatedPosts, safeImageUrl} from './layouts.js';
+import {buildToc, byNewest, cardVars, cleanBasePath, DEFAULT_POST_LAYOUT, DISPLAY_DEFAULTS, escapeHtml, interpolate, pickPostLayout, relatedPosts, safeImageUrl} from './layouts.js';
 import {catalogue, loadBlock, renderCards, styleTag} from './render.js';
 
+/**
+ * Whether readers see a post. Blog Pro files posts under several blogs
+ * (`blogId`); this blog is its FIRST one ('main', or none). Should a Pro
+ * licence lapse and this plugin take over again, posts from Pro's other blogs
+ * stay out of /blog rather than all landing in one listing - hidden, not lost.
+ */
 export function isVisible(post) {
+    if (post.blogId && post.blogId !== 'main') return false;
     return post.status === 'published' ||
         (post.status === 'scheduled' && post.publishedAt && new Date(post.publishedAt) <= new Date());
 }
@@ -23,6 +30,11 @@ export function liveSettings(registered) {
     return {...defaultConfig, ...DISPLAY_DEFAULTS, ...registered, ...(getPluginStates()?.blog?.settings ?? {})};
 }
 
+/** The base path as it is saved NOW - a change applies without a restart. */
+export function liveBase(registered) {
+    return cleanBasePath(liveSettings(registered).basePath);
+}
+
 /** Always returns the actual array of entries, regardless of adapter shape. */
 export async function loadEntries(slug) {
     const result = await listEntries(slug, {limit: 100000, sort: 'createdAt', order: 'desc'});

package/plugins/blog/plugin.js

@@ -3,10 +3,10 @@ import defaultConfig from './config.js';
 import {createEntry, deleteEntry, getEntry, listEntries, updateEntry} from '../../server/services/collections.js';
 import {getPluginStates, savePluginState} from '../../server/services/plugins.js';
 import {renderBlogPage} from '../../server/services/renderer.js';
-import {DISPLAY_DEFAULTS, pickDisplaySettings, safeImageUrl} from './lib/layouts.js';
+import {cleanBasePath, DISPLAY_DEFAULTS, pickDisplaySettings, safeImageUrl} from './lib/layouts.js';
 import {catalogue, seedBlocks} from './lib/render.js';
-import {liveSettings, loadEntries as loadAll, renderPostPage} from './lib/page.js';
-import {addNavLink, removeNavLink} from './lib/nav-link.js';
+import {liveBase, liveSettings, loadEntries as loadAll, renderPostPage} from './lib/page.js';
+import {addNavLink, moveNavLink, removeNavLink} from './lib/nav-link.js';
 import {SAMPLE_CATEGORIES, samplePosts} from './lib/samples.js';
 
 const POSTS_SLUG      = 'blog-posts';
@@ -121,7 +121,9 @@ function formatDate(iso) {
     return new Date(iso).toLocaleDateString('en-GB', { day: 'numeric', month: 'short', year: 'numeric' });
 }
 
+/** As lib/page.js isVisible: Blog Pro's other blogs stay out of this one. */
 function isVisible(post) {
+    if (post.blogId && post.blogId !== 'main') return false;
     return post.status === 'published'
         || (post.status === 'scheduled' && post.publishedAt && new Date(post.publishedAt) <= new Date());
 }
@@ -164,8 +166,10 @@ function renderEmbedCard(post, base, { showImage = true } = {}) {
 </article>`;
 }
 
-function registerEmbedShortcodes(registerShortcode, basePath) {
+/** `baseOf()` is read per render, so links follow a changed base path at once. */
+function registerEmbedShortcodes(registerShortcode, baseOf) {
     registerShortcode('blog-list', async (attrStr, _body, ctx) => {
+        const basePath = baseOf();
         const attrs = ctx.parseShortcodeAttrs(attrStr);
         const limit = parseInt(attrs.count ?? attrs.limit ?? '5', 10) || 5;
         const [posts, categories] = await Promise.all([loadPosts(), loadCategories()]);
@@ -182,6 +186,7 @@ function registerEmbedShortcodes(registerShortcode, basePath) {
     });
 
     registerShortcode('blog-grid', async (attrStr, _body, ctx) => {
+        const basePath = baseOf();
         const attrs = ctx.parseShortcodeAttrs(attrStr);
         const limit = parseInt(attrs.count ?? attrs.limit ?? '6', 10) || 6;
         const cols = Math.max(1, Math.min(4, parseInt(attrs.cols ?? '3', 10) || 3));
@@ -194,6 +199,7 @@ function registerEmbedShortcodes(registerShortcode, basePath) {
     });
 
     registerShortcode('blog-featured', async (attrStr, _body, ctx) => {
+        const basePath = baseOf();
         const attrs = ctx.parseShortcodeAttrs(attrStr);
         const posts = await loadPosts();
         let post;
@@ -219,6 +225,7 @@ function registerEmbedShortcodes(registerShortcode, basePath) {
     });
 
     registerShortcode('blog-categories', async (attrStr, _body, ctx) => {
+        const basePath = baseOf();
         const attrs = ctx.parseShortcodeAttrs(attrStr);
         const showCounts = attrs['show-counts'] === 'true' || attrs.counts === 'true';
         const [posts, categories] = await Promise.all([loadPosts(), loadCategories()]);
@@ -236,10 +243,9 @@ function registerEmbedShortcodes(registerShortcode, basePath) {
 export default async function blogPlugin(fastify, options) {
     const { authenticate, requireAdmin } = options.auth;
     const settings = { ...defaultConfig, ...(options.settings || {}) };
-    const basePath = (settings.basePath ?? '/blog').replace(/\/$/, '');
 
     if (options.hooks?.registerShortcode) {
-        registerEmbedShortcodes(options.hooks.registerShortcode, basePath);
+        registerEmbedShortcodes(options.hooks.registerShortcode, () => liveBase(settings));
     }
 
     // The layouts are blocks; put the shipped ones where the Blocks tool can
@@ -291,6 +297,7 @@ export default async function blogPlugin(fastify, options) {
         post.slug = post.slug || 'preview';
         const allPosts = (await loadAll(POSTS_SLUG)).filter(p => p.id !== post.id);
         const s = liveSettings(settings);
+        const basePath = liveBase(settings);
         const page = await renderPostPage(post, [...allPosts, post], s, {
             base: basePath, layout: cleanTemplate(body.layout) || null, preview: true
         });
@@ -705,7 +712,7 @@ export default async function blogPlugin(fastify, options) {
         const merged = {
             ...defaultConfig,
             ...stored,
-            ...(body.basePath          !== undefined && { basePath: String(body.basePath) }),
+            ...(body.basePath          !== undefined && { basePath: cleanBasePath(body.basePath) }),
             ...(body.postsPerPage      !== undefined && { postsPerPage: Number(body.postsPerPage) || defaultConfig.postsPerPage }),
             ...(body.commentsEnabled   !== undefined && { commentsEnabled: Boolean(body.commentsEnabled) }),
             ...(body.commentModeration !== undefined && { commentModeration: Boolean(body.commentModeration) }),
@@ -714,6 +721,19 @@ export default async function blogPlugin(fastify, options) {
         };
 
         savePluginState('blog', { settings: merged });
+
+        // The public pages follow the new base path at once (plugin.public.js);
+        // so does the navbar link, if enabling put it there.
+        const added = getPluginStates()?.blog?.navLink ?? null;
+        if (added && added.url !== merged.basePath) {
+            try {
+                if (await moveNavLink(added, merged.basePath)) {
+                    savePluginState('blog', { navLink: { ...added, url: merged.basePath } });
+                }
+            } catch (err) {
+                request.log.warn(`[blog] could not move the navbar link: ${err.message}`);
+            }
+        }
         return reply.send({ ok: true, settings: merged });
     });
 }
@@ -724,8 +744,7 @@ export default async function blogPlugin(fastify, options) {
 
 /** The blog's base path from its saved settings, as the routes will use it. */
 function currentBasePath() {
-    const saved = getPluginStates()?.blog?.settings ?? {};
-    return String(saved.basePath ?? defaultConfig.basePath ?? '/blog').replace(/\/+$/, '') || '/blog';
+    return liveBase({});
 }
 
 /**

package/plugins/blog/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "blog",
   "displayName": "Blog",
-  "version": "1.6.0",
+  "version": "1.6.3",
   "tier": "free",
   "description": "Public-facing blog with posts, categories and comments - layouts and listings built from editable blocks.",
   "author": "Domma CMS",
@@ -34,11 +34,11 @@
       { "path": "/plugins/blog/settings",   "view": "plugin-blog-settings",    "title": "Blog Settings - Domma CMS" }
     ],
     "views": {
-      "plugin-blog-posts":       { "entry": "blog/admin/views/blog.js?v=8",        "exportName": "blogView" },
-      "plugin-blog-post-editor": { "entry": "blog/admin/views/post-editor.js?v=8", "exportName": "postEditorView" },
-      "plugin-blog-categories":  { "entry": "blog/admin/views/categories.js?v=8",  "exportName": "categoriesView" },
-      "plugin-blog-comments":    { "entry": "blog/admin/views/comments.js?v=8",    "exportName": "commentsView" },
-      "plugin-blog-settings":    { "entry": "blog/admin/views/settings.js?v=8",    "exportName": "settingsView" }
+      "plugin-blog-posts":       { "entry": "blog/admin/views/blog.js?v=9",        "exportName": "blogView" },
+      "plugin-blog-post-editor": { "entry": "blog/admin/views/post-editor.js?v=9", "exportName": "postEditorView" },
+      "plugin-blog-categories":  { "entry": "blog/admin/views/categories.js?v=9",  "exportName": "categoriesView" },
+      "plugin-blog-comments":    { "entry": "blog/admin/views/comments.js?v=9",    "exportName": "commentsView" },
+      "plugin-blog-settings":    { "entry": "blog/admin/views/settings.js?v=9",    "exportName": "settingsView" }
     }
   }
 }

package/plugins/blog/plugin.public.js

@@ -7,19 +7,23 @@
  * over - search, category pills, sort, display switching and a right-click
  * menu - and adds reading progress, contents tracking, sharing and in-page
  * comments to a post.
+ *
+ * The pages are not fixed routes: one onRequest hook matches the path against
+ * the base path as it is saved NOW, so changing it in Settings moves the blog
+ * without a restart. See the Gotchas in CLAUDE.md.
  */
 import path from 'path';
 import {fileURLToPath} from 'url';
 import {renderBlogPage} from '../../server/services/renderer.js';
-import {byNewest, escapeHtml, pickDisplay, safeImageUrl} from './lib/layouts.js';
+import {byNewest, escapeHtml, matchBlogPath, pickDisplay, safeImageUrl} from './lib/layouts.js';
 import {catalogue, renderCards} from './lib/render.js';
-import {authorNamesFor, isVisible, liveSettings, loadEntries, renderPostPage, resolveAuthorName} from './lib/page.js';
+import {authorNamesFor, isVisible, liveBase, liveSettings, loadEntries, renderPostPage, resolveAuthorName} from './lib/page.js';
 
 const __dirname = fileURLToPath(new URL('.', import.meta.url));
 const TEMPLATES_DIR = path.join(__dirname, 'templates');
 
 /** Bumped with the plugin, so a release is never served a stale script. */
-const ASSET_V = '1.6.0';
+const ASSET_V = '1.6.3';
 
 /**
  * Above this many posts a listing pages on the server instead: the browser
@@ -56,7 +60,6 @@ function scriptJson(value) {
 
 export default async function blogPublicPlugin(fastify, options) {
     const {settings, config} = options;
-    const base = (settings?.basePath ?? '/blog').replace(/\/$/, '');
 
     /**
      * A listing: the index, a page of it, or a category / tag / author archive.
@@ -64,9 +67,9 @@ export default async function blogPublicPlugin(fastify, options) {
      * @param {object}   request
      * @param {object}   reply
      * @param {object[]} posts   - candidates; drafts are dropped here
-     * @param {object}   opts    - {title, intro, page, pageBase, filter}
+     * @param {object}   opts    - {base, title, intro, page, filter}
      */
-    async function renderArchive(request, reply, posts, {title, intro = '', page = 1, pageBase = base, filter = null}) {
+    async function renderArchive(request, reply, posts, {base, title, intro = '', page = 1, filter = null}) {
         const s = liveSettings(settings);
         const perPage = Math.max(1, Number(s.postsPerPage) || 10);
         const {listDisplays} = await catalogue();
@@ -115,7 +118,7 @@ ${items || ''}
                 archiveTitle: escapeHtml(title),
                 archiveIntro: intro ? `<p class="blog-archive-intro">${escapeHtml(intro)}</p>` : '',
                 archive,
-                pagination: interactive ? '' : buildPagination(safePage, totalPages, pageBase, requested),
+                pagination: interactive ? '' : buildPagination(safePage, totalPages, base, requested),
                 assetV: ASSET_V
             },
             {title, urlPath: request.url.split('?')[0]}
@@ -123,16 +126,18 @@ ${items || ''}
         return reply.type('text/html').send(html);
     }
 
-    // 1. RSS feed
-    fastify.get(`${base}/feed.xml`, async (request, reply) => {
-        const s = liveSettings(settings);
-        const allPosts = await loadEntries('blog-posts');
-        const posts = allPosts.filter(isVisible).sort(byNewest).slice(0, s.feedLength ?? 20);
+    /** One handler per page; `matchBlogPath()` (lib/layouts.js) picks which. */
+    const pages = {
+        /** RSS feed */
+        async feed(request, reply, params, base) {
+            const s = liveSettings(settings);
+            const allPosts = await loadEntries('blog-posts');
+            const posts = allPosts.filter(isVisible).sort(byNewest).slice(0, s.feedLength ?? 20);
 
-        const siteTitle = config?.site?.title ?? 'Blog';
-        const siteUrl = (config?.site?.url ?? '').replace(/\/$/, '');
+            const siteTitle = config?.site?.title ?? 'Blog';
+            const siteUrl = (config?.site?.url ?? '').replace(/\/$/, '');
 
-        const items = posts.map((post) => `  <item>
+            const items = posts.map((post) => `  <item>
     <title>${escapeHtml(post.title)}</title>
     <link>${siteUrl}${base}/${escapeHtml(post.slug)}</link>
     <description>${escapeHtml(post.excerpt || '')}</description>
@@ -140,7 +145,7 @@ ${items || ''}
     <guid>${siteUrl}${base}/${escapeHtml(post.slug)}</guid>
   </item>`).join('\n');
 
-        return reply.type('application/xml').send(`<?xml version="1.0" encoding="UTF-8"?>
+            return reply.type('application/xml').send(`<?xml version="1.0" encoding="UTF-8"?>
 <rss version="2.0">
   <channel>
     <title>${escapeHtml(siteTitle)}</title>
@@ -149,69 +154,86 @@ ${items || ''}
 ${items}
   </channel>
 </rss>`);
+        },
+
+        /** Paginated index */
+        async page(request, reply, {n}, base) {
+            const page = parseInt(n, 10) || 1;
+            return renderArchive(request, reply, await loadEntries('blog-posts'), {base, title: 'Blog', page});
+        },
+
+        /** Category archive */
+        async category(request, reply, {slug}, base) {
+            const [allPosts, allCategories] = await Promise.all([loadEntries('blog-posts'), loadEntries('blog-categories')]);
+            const category = allCategories.find((c) => c.slug === slug);
+            if (!category) return reply.code(404).send('Category not found');
+            const posts = allPosts.filter((p) => Array.isArray(p.categories) && p.categories.includes(category.id));
+            return renderArchive(request, reply, posts, {
+                base, title: category.name, intro: category.description || '', filter: {type: 'category', value: category.slug}
+            });
+        },
+
+        /** Tag archive */
+        async tag(request, reply, {tag}, base) {
+            const posts = (await loadEntries('blog-posts')).filter((p) => Array.isArray(p.tags) && p.tags.includes(tag));
+            return renderArchive(request, reply, posts, {base, title: `#${tag}`, filter: {type: 'tag', value: tag}});
+        },
+
+        /** Author archive */
+        async author(request, reply, {id}, base) {
+            const posts = (await loadEntries('blog-posts')).filter((p) => p.authorId === id);
+            const authorName = await resolveAuthorName(id);
+            return renderArchive(request, reply, posts, {base, title: `Posts by ${authorName}`, filter: {type: 'author', value: id}});
+        },
+
+        /** Blog index */
+        async index(request, reply, params, base) {
+            return renderArchive(request, reply, await loadEntries('blog-posts'), {base, title: 'Blog'});
+        },
+
+        /** `{base}/` - the index, rather than a post with an empty slug */
+        async slash(request, reply, params, base) {
+            const query = request.url.includes('?') ? request.url.slice(request.url.indexOf('?')) : '';
+            return reply.redirect(`${base}${query}`, 301);
+        },
+
+        /** Individual post */
+        async post(request, reply, {slug}, base) {
+            const allPosts = await loadEntries('blog-posts');
+            const post = allPosts.find((p) => p.slug === slug);
+            if (!post || !isVisible(post)) return reply.code(404).send('Not found');
+
+            const siteUrl = (config?.site?.url || `${request.protocol}://${request.hostname}`).replace(/\/$/, '');
+            const page = await renderPostPage(post, allPosts, liveSettings(settings), {base, siteUrl});
+
+            const html = await renderBlogPage(
+                path.join(TEMPLATES_DIR, 'post.html'),
+                {post: page.html, assetV: ASSET_V},
+                {
+                    title: post.seo?.title || post.title,
+                    description: post.seo?.description || post.excerpt || '',
+                    ogImage: safeImageUrl(post.featuredImage),
+                    ogType: 'article',
+                    usedComponents: page.usedComponents,
+                    urlPath: `${base}/${slug}`
+                }
+            );
+            return reply.type('text/html').send(html);
+        }
+    };
+
+    // Answered here, ahead of routing, because routes are fixed at boot and the
+    // base path is not. The hook is global (skip-override, below); it answers
+    // only what matchBlogPath() claims and lets everything else through.
+    fastify.addHook('onRequest', async (request, reply) => {
+        if (request.method !== 'GET' && request.method !== 'HEAD') return;
+        const base = liveBase(settings);
+        const hit = matchBlogPath(request.url.split('?')[0], base);
+        if (!hit) return;
+        return pages[hit.name](request, reply, hit.params, base);
     });
-
-    // 2. Paginated index
-    fastify.get(`${base}/page/:n`, async (request, reply) => {
-        const page = parseInt(request.params.n, 10) || 1;
-        return renderArchive(request, reply, await loadEntries('blog-posts'), {title: 'Blog', page});
-    });
-
-    // 3. Category archive
-    fastify.get(`${base}/category/:slug`, async (request, reply) => {
-        const {slug} = request.params;
-        const [allPosts, allCategories] = await Promise.all([loadEntries('blog-posts'), loadEntries('blog-categories')]);
-        const category = allCategories.find((c) => c.slug === slug);
-        if (!category) return reply.code(404).send('Category not found');
-        const posts = allPosts.filter((p) => Array.isArray(p.categories) && p.categories.includes(category.id));
-        return renderArchive(request, reply, posts, {
-            title: category.name, intro: category.description || '', filter: {type: 'category', value: category.slug}
-        });
-    });
-
-    // 4. Tag archive
-    fastify.get(`${base}/tag/:tag`, async (request, reply) => {
-        const {tag} = request.params;
-        const posts = (await loadEntries('blog-posts')).filter((p) => Array.isArray(p.tags) && p.tags.includes(tag));
-        return renderArchive(request, reply, posts, {title: `#${tag}`, filter: {type: 'tag', value: tag}});
-    });
-
-    // 5. Author archive
-    fastify.get(`${base}/author/:id`, async (request, reply) => {
-        const {id} = request.params;
-        const posts = (await loadEntries('blog-posts')).filter((p) => p.authorId === id);
-        const authorName = await resolveAuthorName(id);
-        return renderArchive(request, reply, posts, {title: `Posts by ${authorName}`, filter: {type: 'author', value: id}});
-    });
-
-    // 6. Blog index
-    fastify.get(base, async (request, reply) => {
-        return renderArchive(request, reply, await loadEntries('blog-posts'), {title: 'Blog'});
-    });
-
-    // 7. Individual post - registered LAST so the slug match doesn't shadow archives
-    fastify.get(`${base}/:slug`, async (request, reply) => {
-        const {slug} = request.params;
-        const allPosts = await loadEntries('blog-posts');
-        const post = allPosts.find((p) => p.slug === slug);
-        if (!post || !isVisible(post)) return reply.code(404).send('Not found');
-
-        const siteUrl = (config?.site?.url || `${request.protocol}://${request.hostname}`).replace(/\/$/, '');
-        const page = await renderPostPage(post, allPosts, liveSettings(settings), {base, siteUrl});
-
-        const html = await renderBlogPage(
-            path.join(TEMPLATES_DIR, 'post.html'),
-            {post: page.html, assetV: ASSET_V},
-            {
-                title: post.seo?.title || post.title,
-                description: post.seo?.description || post.excerpt || '',
-                ogImage: safeImageUrl(post.featuredImage),
-                ogType: 'article',
-                usedComponents: page.usedComponents,
-                urlPath: `${base}/${slug}`
-            }
-        );
-        return reply.type('text/html').send(html);
-    });
-
 }
+
+// What fastify-plugin sets: the onRequest hook must see every request, not only
+// routes registered inside this plugin (it registers none).
+blogPublicPlugin[Symbol.for('skip-override')] = true;

package/plugins/blog/tests/layouts.test.js

@@ -95,3 +95,32 @@ test('related posts: shared categories outweigh shared tags; newer breaks a tie'
     assert.deepEqual(relatedPosts(me, all, 3).map(p => p.id), ['cat-new', 'cat-old', 'tag-only']);
     assert.deepEqual(relatedPosts(me, all, 0), []);
 });
+
+test('a base path is tidied, and never the whole site', async () => {
+    const {cleanBasePath} = await import('../lib/layouts.js');
+    assert.equal(cleanBasePath('/news'), '/news');
+    assert.equal(cleanBasePath('news/'), '/news');
+    assert.equal(cleanBasePath('//a//b/'), '/a/b');
+    assert.equal(cleanBasePath('/x?y=1'), '/x');
+    for (const v of ['', '/', ' ', null, undefined]) assert.equal(cleanBasePath(v), '/blog', String(v));
+});
+
+test('matchBlogPath claims the blog\'s pages under whatever base it is given', async () => {
+    const {matchBlogPath} = await import('../lib/layouts.js');
+    assert.deepEqual(matchBlogPath('/news', '/news'), {name: 'index', params: {}});
+    assert.deepEqual(matchBlogPath('/news/', '/news'), {name: 'slash', params: {}});
+    assert.deepEqual(matchBlogPath('/news/feed.xml', '/news'), {name: 'feed', params: {}});
+    assert.deepEqual(matchBlogPath('/news/page/2', '/news'), {name: 'page', params: {n: '2'}});
+    assert.deepEqual(matchBlogPath('/news/category/a%20b', '/news'), {name: 'category', params: {slug: 'a b'}});
+    assert.deepEqual(matchBlogPath('/news/tag/x', '/news'), {name: 'tag', params: {tag: 'x'}});
+    assert.deepEqual(matchBlogPath('/news/author/7', '/news'), {name: 'author', params: {id: '7'}});
+    assert.deepEqual(matchBlogPath('/news/my-post', '/news'), {name: 'post', params: {slug: 'my-post'}});
+    for (const p of ['/blog', '/newsroom', '/news/a/b', '/news/page/', '/news/%E0%A4%A']) assert.equal(matchBlogPath(p, '/news'), null, p);
+});
+
+test('a post Blog Pro filed under another blog is not shown by this one', async () => {
+    const {isVisible} = await import('../lib/page.js');
+    assert.equal(isVisible({status: 'published'}), true);
+    assert.equal(isVisible({status: 'published', blogId: 'main'}), true);
+    assert.equal(isVisible({status: 'published', blogId: 'travel'}), false);
+});