domma-cms 0.70.1 → 0.72.0

package/server/routes/public.js

@@ -213,8 +213,12 @@ export async function publicRoutes(fastify) {
         // response must not reveal that an unpublished page exists there.
         const isDraft = page.status !== 'published';
 
-        // Enforce page visibility - role only resolved for gated pages,
-        // so public pages share a single cache entry keyed `roleanon`.
+        // Enforce page visibility. The viewer is resolved on EVERY request,
+        // not only for gated pages: the navbar, footers, overlays and [menu]
+        // shortcodes on a public page filter their items by role too, and a
+        // signed-in visitor rendered as anonymous never sees the items meant
+        // for them. Resolving is a cookie read plus a JWT verify, and returns
+        // null at once for anonymous traffic, which still shares one entry.
         //
         // `visibility` may be a string ('public' | 'private' | role name) or
         // an array of role names - see checkVisibility() for full semantics.
@@ -222,25 +226,17 @@ export async function publicRoutes(fastify) {
         // 'public') skip viewer resolution entirely so anonymous traffic hits
         // the shared cache without auth cost - unless the page is a draft,
         // which needs the viewer regardless of its visibility.
-        // For per-role cache keying we use the primary role only - multi-role
-        // users still see correctly-gated content (checkVisibility consults
-        // additionalRoles too) but the cache key stays bounded to one entry
-        // per primary role rather than 2^N per role combination. The fallback
-        // is correctness: any user whose access depends on an additional role
-        // is granted, but their served HTML is the variant cached for their
-        // primary role's tier - fine for the public-site use case.
-        let userRole = null;
-        let userObj  = null;
+        // The cache key carries every role the viewer holds (sorted), since
+        // exact-role visibility (`=candidate`) makes an additional role change
+        // what renders. Real sites hold a handful of role combinations, so
+        // the entry count stays bounded by what users actually have.
         const vis      = page.visibility;
         const isPublic = !vis
             || vis === 'public'
             || (Array.isArray(vis) && (vis.length === 0 || vis.includes('public')));
 
-        // A draft always needs the viewer resolved, whatever its visibility.
-        if (isDraft || !isPublic) {
-            userObj  = await resolveViewer(request);
-            userRole = userObj ? userObj.role : null;
-        }
+        const userObj  = await resolveViewer(request);
+        const userRole = userObj ? [...getEffectiveRoles(userObj)].sort().join('+') : null;
 
         if (isDraft && !canPreviewDrafts(userObj)) {
             reply.status(404);
@@ -256,7 +252,7 @@ export async function publicRoutes(fastify) {
 
         // Re-parse with user context so the body's [menu] shortcode sees the
         // visitor's role for visibility filtering. The first getPage() above
-        // was anonymous because we hadn't resolved the viewer yet.
+        // was anonymous - it only needed the page's metadata.
         const render = async () => {
             const pageForRole = await getPage(page.urlPath, {user: userObj}) || page;
             return renderPage(pageForRole, {

package/server/server.js

@@ -280,8 +280,10 @@ try {
 }
 
 try {
-    const {runMigration: runSidebarMigration, ensureSidebarItem, ensureDocumentationSubmenus} = await import('./services/sidebar-migration.js');
+    const {runMigration: runSidebarMigration, ensureSidebarItem, ensureDocumentationSubmenus, ensureFolderKeys} = await import('./services/sidebar-migration.js');
     await runSidebarMigration();
+    // Stable folder keys - what a Tool's default `folder` names.
+    await ensureFolderKeys();
     // Surface admin pages added after first boot on existing installs.
     await ensureSidebarItem({
         groupText: 'System',
@@ -510,19 +512,19 @@ await app.register(contactsRoutes, {prefix: '/api/contacts'});
 // Registered through the same channel plugins use, deliberately. The sidebar
 // menu (config/menus/admin-sidebar.json) is seeded once and file-existence
 // guarded, so adding an entry there would reach new sites only - every existing
-// site would simply never see Notes or Todo. Registered items are merged at
-// render time on every site, and groupPluginItems() files them under Tools,
-// which is exactly where a promoted plugin belongs.
+// site would simply never see Notes or Todo. Registered items are placed at
+// render time on every site (placeTools() in admin/js/lib/sidebar-grouping.js):
+// in the Tools folder by default, or wherever an admin has moved them.
 //
 // `permission` is what hides each one from a role that cannot use it; the
 // renderer filters on it.
 const {registerSidebarItem} = await import('./services/hooks.js');
 // `countUrl` is the badge: the sidebar fetches it and shows {count, label, tone}
 // (see fetchCounts in admin/js/lib/sidebar-renderer.js).
-registerSidebarItem({item: {text: 'Notes', url: '#/notes', icon: 'edit-3', permission: 'notes', countUrl: '/api/notes/count'}});
-registerSidebarItem({item: {text: 'Todo', url: '#/todo', icon: 'check-square', permission: 'todo', countUrl: '/api/todo/count'}});
-registerSidebarItem({item: {text: 'Analytics', url: '#/analytics', icon: 'chart-bar', permission: 'analytics', countUrl: '/api/analytics/active-count'}});
-registerSidebarItem({item: {text: 'Contacts', url: '#/contacts', icon: 'users', permission: 'contacts'}});
+registerSidebarItem({item: {source: 'Built in', text: 'Notes', url: '#/notes', icon: 'edit-3', permission: 'notes', countUrl: '/api/notes/count'}});
+registerSidebarItem({item: {source: 'Built in', text: 'Todo', url: '#/todo', icon: 'check-square', permission: 'todo', countUrl: '/api/todo/count'}});
+registerSidebarItem({item: {source: 'Built in', text: 'Analytics', url: '#/analytics', icon: 'chart-bar', permission: 'analytics', countUrl: '/api/analytics/active-count'}});
+registerSidebarItem({item: {source: 'Built in', text: 'Contacts', url: '#/contacts', icon: 'users', permission: 'contacts'}});
 
 await registerPlugins(app);
 

package/server/services/adminHome.js

@@ -0,0 +1,87 @@
+/**
+ * Admin home - the screen `#/` (Dashboard) opens.
+ *
+ * Every admin screen is a Tool, and "Dashboard" is simply whichever Tool home
+ * points at. Three sources, first answer wins:
+ *
+ *   1. A confined role's own home (roles.getAdminScope) - it is also the only
+ *      place a confined user may land.
+ *   2. The site's `adminHome` (config/site.json, System > Site Settings).
+ *   3. `/` - the built-in dashboard, or the plugin view that replaces it
+ *      (`views.dashboard`).
+ *
+ * The site's choice is skipped when the sidebar does not know that screen (a
+ * Tool whose plugin has been disabled) or the user lacks the permission guarding
+ * it (its sidebar entry's `permission`), so nobody lands on a dead end. The server stays the authority for data either way;
+ * this only decides where the admin opens.
+ */
+import {normaliseAdminPath} from './roles.js';
+
+/**
+ * True if `permissions` grants `resource` - the same test the sidebar uses
+ * (sidebar-renderer.js canAny), so home never opens what the sidebar hides.
+ */
+function holds(permissions, resource) {
+    if (!resource) return true;
+    const p = permissions || [];
+    return p.includes(resource) || ['read', 'create', 'update', 'delete'].some(a => p.includes(`${resource}.${a}`));
+}
+
+const trimUrl = (url) => (typeof url === 'string' ? url.replace(/\/+$/, '') || '#/' : '');
+
+/**
+ * The path, top down, to the first menu entry whose url is `url` - a Tool
+ * placeholder (`ref`) included, since it is where that Tool renders - or null.
+ */
+function pathTo(url, nodes, trail = []) {
+    for (const n of nodes || []) {
+        if (!n) continue;
+        if (trimUrl(n.url) === url) return [...trail, n];
+        const hit = pathTo(url, n.items, [...trail, n]);
+        if (hit) return hit;
+    }
+    return null;
+}
+
+/** True if the menu hides `text` the older way: a url-less, childless hidden item of that name. */
+function hiddenByName(text, nodes) {
+    const t = String(text || '').toLowerCase();
+    for (const n of nodes || []) {
+        if (!n) continue;
+        if (n.hidden && !n.url && !(n.items || []).length && String(n.text || '').toLowerCase() === t) return true;
+        if (hiddenByName(text, n.items)) return true;
+    }
+    return false;
+}
+
+/**
+ * @param {object} o
+ * @param {{home: string}|null} o.scope        the user's admin scope (confinement)
+ * @param {string[]}            o.permissions  what the user holds
+ * @param {unknown}             o.siteHome     site.json `adminHome`
+ * @param {object[]|Function}   [o.registered] registered sidebar items (their `.item`s), or a function returning them
+ * @param {object[]|Function}   [o.menuItems]  the admin-sidebar menu's items, or a function returning them
+ * @param {(visibility: unknown) => boolean} [o.canSee] the sidebar's visibility test for this user
+ * @returns {Promise<string>|string} an admin route path
+ */
+export async function resolveAdminHome({scope, permissions, siteHome, registered = [], menuItems = [], canSee = () => true}) {
+    if (scope?.home) return scope.home;
+    const home = normaliseAdminPath(siteHome);
+    if (!home || home === '/') return '/';
+    const url = `#${home}`;
+    const list = async (v) => (typeof v === 'function' ? await v() : v) || [];
+    // Only a screen the sidebar shows this user: an enabled Tool, or a page in
+    // the menu. Where the menu places it decides whether it is shown - a hidden
+    // entry, or a hidden or gated folder on the way to it, rules it out even
+    // for a registered Tool, exactly as the sidebar leaves it out.
+    const tool = (await list(registered)).find(i => i && !i.hidden && trimUrl(i.url) === url);
+    const items = await list(menuItems);
+    const path = pathTo(url, items);
+    if (!tool && (!path || path.at(-1).ref)) return '/';      // nothing enables it
+    if (tool && !path && hiddenByName(tool.text, items)) return '/';
+    const gates = [...(path || []), ...(tool ? [tool] : [])];
+    const open = gates.every(n => !n.hidden
+        && holds(permissions, n.permission)
+        && (n.visibility == null || canSee(n.visibility)));
+    return open ? home : '/';
+}

package/server/services/hooks.js

@@ -71,27 +71,51 @@ export async function registerMenuLocation(slot, def) {
 const _registeredSidebarItems = [];
 
 /**
- * Register a sidebar item from a plugin. Items are merged into the rendered
- * admin sidebar at render time - they are NOT persisted into menu JSON.
- * Plugins re-register on each server boot via their setupPlugin hook.
+ * Register a Tool's sidebar entry. Entries are placed into the rendered admin
+ * sidebar at render time - they are NOT persisted into menu JSON - so plugins
+ * re-register on each server boot.
  *
- * @param {{parent?: string, item: {text: string, url: string, icon?: string, permission?: string, items?: object[]}}} opts
+ * `folder` is the Tool's DEFAULT place: the `key` of an admin-sidebar folder
+ * (`'tools'`, `'content'`, `'data'`, `'system'`, ...). It defaults to `'tools'`,
+ * and an admin who moves the Tool in the menu overrides it - the renderer
+ * places by `url` first (see placeTools in admin/js/lib/sidebar-grouping.js).
+ * `parent` is the older form: any node matched by its text.
+ *
+ * @param {{folder?: string, parent?: string, item: {text: string, url: string, icon?: string, permission?: string, folder?: string, items?: object[]}}} opts
  */
 export function registerSidebarItem(opts) {
     if (!opts || !opts.item || typeof opts.item.text !== 'string') {
         throw new Error('registerSidebarItem: opts.item.text is required');
     }
+    const {folder: itemFolder, ...item} = opts.item;
     _registeredSidebarItems.push({
         parent: opts.parent || null,
-        item:   opts.item
+        folder: opts.folder || itemFolder || DEFAULT_TOOL_FOLDER,
+        item
     });
 }
 
+/** Where a Tool's sidebar entry goes when it names no folder. */
+export const DEFAULT_TOOL_FOLDER = 'tools';
+
+/** Sidebar URLs taken off the sidebar - a built-in Tool a plugin has taken over. */
+const _hiddenSidebarUrls = new Set();
+
+/**
+ * Leave the item with this URL out of the sidebar. For a core Tool whose entry
+ * is registered before the plugins load, so it cannot simply not be registered.
+ *
+ * @param {string} url - e.g. '#/contacts'
+ */
+export function hideSidebarUrl(url) {
+    _hiddenSidebarUrls.add(url);
+}
+
 /**
  * @returns {Array<{parent: string|null, item: object}>}
  */
 export function getRegisteredSidebarItems() {
-    return _registeredSidebarItems.slice();
+    return _registeredSidebarItems.filter(entry => !_hiddenSidebarUrls.has(entry?.item?.url));
 }
 
 // ---------------------------------------------------------------------------

package/server/services/menus.js

@@ -714,15 +714,22 @@ export function validateMenu(menu) {
                 return;
             }
 
-            if (!item.text || typeof item.text !== 'string') {
+            // A Tool placeholder (`ref`, admin-sidebar) takes its label from the
+            // Tool's registration unless the admin gave it one of its own.
+            if (item.ref === true && item.url && !item.text) {
+                // fine - the url is checked below like any leaf
+            } else if (!item.text || typeof item.text !== 'string') {
                 errors.push(`Item ${path}: text is required`);
             }
             // url is only required for LEAF items (no children). Folder items
             // - those with their own `items` array - are pure groupings and
             // don't need a navigation target. The admin sidebar uses this
             // shape extensively (Content / Data / System headings etc.).
+            // A keyed item is an admin-sidebar folder (see sidebar-migration.js)
+            // even while empty - the Tools folder is, until a Tool is enabled.
             const hasChildren = Array.isArray(item.items) && item.items.length > 0;
-            if (!hasChildren) {
+            const isKeyedFolder = typeof item.key === 'string' && item.key !== '' && !item.url;
+            if (!hasChildren && !isKeyedFolder) {
                 if (!item.url || typeof item.url !== 'string' || !URL_PREFIX_RE.test(item.url)) {
                     errors.push(`Item ${path}: url must start with /, #, http(s)://, or mailto:`);
                 }
@@ -1082,15 +1089,38 @@ export async function resolveOverlaysForPage(ctx = {}, user = null) {
         .sort((a, b) => String(a.slug).localeCompare(String(b.slug)));
 }
 
-function filterItemsForUser(items, user) {
+/**
+ * The admin sidebar's stand-in for an item this user may not see: only its
+ * url (or folder key) and `hidden`, so Tool placement still knows the admin put
+ * a Tool there - it must not fall back into Tools for exactly the users it was
+ * restricted from - while the label never reaches them.
+ */
+function restrictedStub(item) {
+    const children = Array.isArray(item.items) ? item.items.map(restrictedStub).filter(Boolean) : [];
+    if (!item.url && !item.key && !children.length) return null;
+    return {
+        ...(item.url && {url: item.url}),
+        ...(item.key && {key: item.key}),
+        hidden: true,
+        // Marks a role gate, as opposed to an admin's hide, for ensureLockedTools.
+        restricted: true,
+        ...(children.length && {items: children})
+    };
+}
+
+export function filterItemsForUser(items, user, {keepHidden = false} = {}) {
     const out = [];
     for (const item of items) {
-        if (item.hidden) continue;
+        if (item.hidden && !keepHidden) continue;
         if (item.visibility != null) {
-            if (!checkVisibility(user, item.visibility)) continue;
+            if (!checkVisibility(user, item.visibility)) {
+                const stub = keepHidden ? restrictedStub(item) : null;
+                if (stub) out.push(stub);
+                continue;
+            }
         }
         const children = Array.isArray(item.items)
-            ? filterItemsForUser(item.items, user)
+            ? filterItemsForUser(item.items, user, {keepHidden})
             : [];
         out.push({...item, items: children});
     }

package/server/services/permissionRegistry.js

@@ -322,21 +322,24 @@ const _pluginContributed = [];
  * @param {string} plugin - Plugin name that owns this resource
  */
 export function registerPluginResource(resource, plugin) {
+    if (!resource || typeof resource.key !== 'string' || !resource.key) return;
     const effective = getEffectiveRegistry();
     if (effective.some(r => r.key === resource.key)) return;
 
     _pluginContributed.push({
         key: resource.key,
-        label: resource.label,
-        description: resource.description || `${resource.label} (${plugin} plugin)`,
+        label: resource.label || resource.key,
+        description: resource.description || `${resource.label || resource.key} (${plugin} plugin)`,
         icon: resource.icon || 'box',
         group: resource.group || 'Plugins',
         plugin,
-        actions: resource.actions?.map(a => ({
-            key: a.key,
-            label: a.label,
-            description: a.description || a.label
-        })) ?? ACTIONS.map(key => ({key, label: key, description: key}))
+        // Actions may be objects or bare keys (`["read", "create"]`) - the
+        // short form is what plugin role files have always shipped.
+        actions: Array.isArray(resource.actions) && resource.actions.length
+            ? resource.actions.map(a => typeof a === 'string'
+                ? {key: a, label: a, description: a}
+                : {key: a.key, label: a.label || a.key, description: a.description || a.label || a.key})
+            : ACTIONS.map(key => ({key, label: key, description: key}))
     });
 }
 

package/server/services/pluginInstaller.js

@@ -16,7 +16,7 @@ import path from 'path';
 import zlib from 'zlib';
 import {fileURLToPath} from 'url';
 import {getConfig} from '../config.js';
-import {discoverPlugins, validatePluginDir} from './plugins.js';
+import {discoverPlugins, pluginRoleHooks, unregisterAllRolesForPlugin, validatePluginDir} from './plugins.js';
 import {allowInGitignore, manifestContentPaths, pluginContentRules} from './siteGitignore.js';
 
 // ---------------------------------------------------------------------------
@@ -476,10 +476,11 @@ async function upgradePlugin(slug, {tarball, unsigned, entitlement, allowDowngra
  * Uninstall a plugin by slug.
  *
  * Steps:
- *   1. Run onDisable lifecycle hook (warn-only on failure)
- *   2. Remove plugins/<slug>/ directory
- *   3. Remove entry from config/plugins.json
- *   4. Append uninstall record to audit log
+ *   1. Run onDisable lifecycle hook (warn-only on failure), with `uninstall: true`
+ *   2. Remove the roles the plugin registered, moving their users to `user`
+ *   3. Remove plugins/<slug>/ directory
+ *   4. Remove entry from config/plugins.json
+ *   5. Append uninstall record to audit log
  *
  * @param {string} slug
  * @returns {Promise<void>}
@@ -496,23 +497,36 @@ export async function uninstallPlugin(slug) {
         const pluginJsPath = path.join(destDir, 'plugin.js');
         const mod = await import(pluginJsPath);
         if (typeof mod.onDisable === 'function') {
-            await mod.onDisable(null);
+            // Same shape as an ordinary disable (it used to be null, which
+            // threw in any onDisable that destructured its argument), plus
+            // `uninstall` so a plugin can tell removal from a pause.
+            await mod.onDisable({fastify: null, services: {}, hooks: pluginRoleHooks(slug), uninstall: true});
         }
     } catch (err) {
         console.warn(`[pluginInstaller] onDisable hook for "${slug}" failed: ${err.message}`);
     }
 
-    // Step 2 - Remove plugin directory
+    // Step 2 - Roles. A disable keeps them so a pause demotes nobody; an
+    // uninstall removes whatever the plugin still owns, whether it called
+    // unregisterRole itself or not.
+    try {
+        const removed = await unregisterAllRolesForPlugin(slug);
+        if (removed.length) console.log(`[pluginInstaller] Removed roles for "${slug}": ${removed.join(', ')}`);
+    } catch (err) {
+        console.warn(`[pluginInstaller] Role removal for "${slug}" failed: ${err.message}`);
+    }
+
+    // Step 3 - Remove plugin directory
     await fs.rm(destDir, { recursive: true, force: true });
 
-    // Step 3 - Remove from config/plugins.json
+    // Step 4 - Remove from config/plugins.json
     const cfg = await readPluginsConfig();
     if (slug in cfg) {
         delete cfg[slug];
         await writePluginsConfig(cfg);
     }
 
-    // Step 4 - Audit log
+    // Step 5 - Audit log
     await writeAuditLog({
         action: 'uninstall',
         slug,