domma-cms 0.74.0 → 0.76.0

package/server/routes/api/roles.js

@@ -0,0 +1,111 @@
+/**
+ * Roles - the screen's own routes. Role records themselves are the preset
+ * `roles` collection and are read and written through the collections API
+ * (`/api/collections/roles/entries`, with keepRoleSystemFields); these add
+ * what that API cannot say.
+ *
+ * GET /api/roles/_holders  - who holds each role: {counts: {name: n}, orphans: [...]}
+ * GET /api/roles/_count    - the sidebar badge on Roles
+ *
+ * The underscore keeps both clear of any role name (role names are slugs).
+ * Guarded like the list they sit beside: `collections` read.
+ */
+import {
+    authenticate as defaultAuthenticate,
+    requirePermission as defaultRequirePermission
+} from '../../middleware/auth.js';
+import {listEntries} from '../../services/collections.js';
+import {listUsers} from '../../services/users.js';
+
+const plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+
+/**
+ * How many users hold each role - primary or additional - and which users
+ * hold a role that no longer exists (they fall back to the least-privileged
+ * role until an admin fixes them).
+ *
+ * @param {object[]} users
+ * @param {string[]} roleNames - the roles that exist
+ * @returns {{counts: Record<string, number>, orphans: {role: string}[]}} - one orphan per user-role pair
+ */
+export function roleHolders(users = [], roleNames = []) {
+    const known = new Set(roleNames);
+    const counts = Object.fromEntries(roleNames.map(n => [n, 0]));
+    const orphans = [];
+    for (const u of users) {
+        const held = [...new Set([u.role, ...(Array.isArray(u.additionalRoles) ? u.additionalRoles : [])].filter(Boolean))];
+        for (const r of held) {
+            if (known.has(r)) counts[r]++;
+            // The role only - who they are is Users' business (users.read), not
+            // something to hand to anyone who can read the roles list.
+            else orphans.push({role: r});
+        }
+    }
+    return {counts, orphans};
+}
+
+/**
+ * The badge: how many roles (an inventory - the number never alarms), red
+ * while any user holds a role that no longer exists. Plain text throughout;
+ * the sidebar popover sets it with textContent.
+ *
+ * @param {{name: string, label?: string, level: number, plugin?: string}[]} roles
+ * @param {{counts: Record<string, number>, orphans: {user: string, role: string}[]}} holders
+ */
+export function rolesBadge(roles = [], {counts = {}, orphans = []} = {}) {
+    const n = roles.length;
+    const fromPlugins = roles.filter(r => r.plugin).length;
+    const unused = roles.filter(r => r.level !== 0 && !counts[r.name]).length;
+    const sorted = [...roles].sort((a, b) => (a.level ?? 99) - (b.level ?? 99) || String(a.name).localeCompare(String(b.name)));
+    return {
+        count: n,
+        label: orphans.length
+            ? `${plural(orphans.length, 'user')} ${orphans.length === 1 ? 'holds' : 'hold'} a role that no longer exists`
+            : `${plural(n, 'role')}${fromPlugins ? `, ${fromPlugins} from plugins` : ''}`,
+        tone: orphans.length ? 'danger' : 'info',
+        details: {
+            title: 'Roles',
+            rows: [
+                {label: 'Roles', value: String(n)},
+                {label: 'From plugins', value: String(fromPlugins)},
+                {label: 'Held by nobody', value: String(unused)},
+                ...(orphans.length ? [{label: 'Users on a missing role', value: String(orphans.length), tone: 'danger'}] : [])
+            ],
+            items: orphans.length
+                ? Object.entries(orphans.reduce((m, o) => ({...m, [o.role]: (m[o.role] || 0) + 1}), {})).slice(0, 8)
+                    .map(([role, k]) => ({text: `"${role}"`, meta: `no longer exists - ${plural(k, 'user')} still ${k === 1 ? 'holds' : 'hold'} it`, tone: 'danger'}))
+                : sorted.slice(0, 8).map(r => ({
+                    text: String(r.label || r.name),
+                    meta: `level ${r.level} · ${plural(counts[r.name] || 0, 'user')}${r.plugin ? ` · ${r.plugin}` : ''}`
+                })),
+            empty: 'No roles.'
+        }
+    };
+}
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {{authenticate?: Function, requirePermission?: Function}} [opts]
+ */
+export async function rolesRoutes(fastify, opts = {}) {
+    const authenticate      = opts.authenticate      || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+    // `plugins`: the permission the Roles sidebar entry (and menu item) asks for, so
+    // whoever sees the entry can read its badge - with `collections` it 403'd every minute.
+    const canRead = {preHandler: [authenticate, requirePermission('plugins', 'read')]};
+
+    const current = async () => {
+        // The collection's entries, not the role cache: the cache drops `plugin`.
+        const {entries} = await listEntries('roles', {limit: 0});
+        const roles = entries.map(e => e.data || {}).filter(r => r.name);
+        const holders = roleHolders(await listUsers().catch(() => []), roles.map(r => r.name));
+        return {roles, holders};
+    };
+
+    fastify.get('/roles/_holders', canRead, async () => (await current()).holders);
+
+    fastify.get('/roles/_count', canRead, async () => {
+        const {roles, holders} = await current();
+        return rolesBadge(roles, holders);
+    });
+}

package/server/routes/api/search.js

@@ -4,17 +4,35 @@
  * GET  /api/search?q=…      - public: full-text search across published pages
  * GET  /api/search/settings - public: the search UI's own configuration
  * PUT  /api/search/settings - admin-only: save it
+ * GET  /api/search/preview?q=…&max=… - admin-only: the Search screen's "Try it" -
+ *        the same search, run with the max-results being edited (not yet saved)
+ *        and without the minimum length, so a setting can be tried before Save
+ * GET  /api/search/_count   - admin-only: the sidebar badge (searchBadge)
  *
  * The public settings endpoint is kept for anything already calling it (and
  * for a page served from a cache older than the feature), but it is no longer
  * on the critical path: the renderer embeds the same object in the page as
  * `window.__CMS_SEARCH__`, so the overlay can draw itself without a round trip.
  */
-import {authenticate, requireAdmin} from '../../middleware/auth.js';
+import {authenticate as defaultAuthenticate, requireAdmin as defaultRequireAdmin,
+    requirePermission as defaultRequirePermission} from '../../middleware/auth.js';
 import {listPages} from '../../services/content.js';
-import {getSearchSettings, saveSearchSettings, searchPages} from '../../services/search.js';
+import {getSearchSettings, saveSearchSettings, searchBadge, searchCoverage, searchPages} from '../../services/search.js';
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {{authenticate?: Function, requireAdmin?: Function}} [opts] - DI for tests
+ */
+export async function searchRoutes(fastify, opts = {}) {
+    const authenticate = opts.authenticate || defaultAuthenticate;
+    const requireAdmin = opts.requireAdmin || defaultRequireAdmin;
+    const adminOnly = {preHandler: [authenticate, requireAdmin]};
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+    // The badge follows the Search sidebar entry's own permission (settings), so whoever
+    // sees the entry can read it - admin-only, it 403'd every minute for the rest. It
+    // tells nothing a visitor's search does not: public pages only.
+    const canReadBadge = {preHandler: [authenticate, requirePermission('settings', 'read')]};
 
-export async function searchRoutes(fastify) {
     fastify.get('/search', async (request, reply) => {
         const settings = getSearchSettings();
         const q = (request.query.q || '').trim();
@@ -37,7 +55,23 @@ export async function searchRoutes(fastify) {
 
     fastify.get('/search/settings', async () => getSearchSettings());
 
-    fastify.put('/search/settings', {preHandler: [authenticate, requireAdmin]}, async (request) => {
+    fastify.put('/search/settings', adminOnly, async (request) => {
         return {ok: true, settings: saveSearchSettings(request.body || {})};
     });
+
+    fastify.get('/search/preview', adminOnly, async (request, reply) => {
+        const q = String(request.query.q || '').trim().slice(0, 200);
+        if (!q) return reply.status(400).send({error: 'Type something to search for'});
+        const settings = getSearchSettings();
+        const asked = parseInt(request.query.max, 10);
+        const maxResults = Number.isFinite(asked) ? Math.min(50, Math.max(1, asked)) : settings.maxResults;
+        const pages = await listPages();
+        const results = searchPages(pages, q, {
+            maxResults,
+            onError: (err, page) => request.log.warn({err, page: page.urlPath}, '[search] skipped an unreadable page')
+        });
+        return {q, maxResults, results, coverage: searchCoverage(pages)};
+    });
+
+    fastify.get('/search/_count', canReadBadge, async () => searchBadge(getSearchSettings(), await listPages()));
 }

package/server/routes/api/settings.js

@@ -3,6 +3,7 @@
  * GET  /api/settings            - get site settings
  * PUT  /api/settings            - save site settings
  * POST /api/settings/test-email - send a test email using stored SMTP config
+ * GET  /api/settings/_count     - the sidebar badge: what is wrong with the settings
  */
 import {getConfig, saveConfig} from '../../config.js';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
@@ -18,6 +19,50 @@ const CUSTOM_CSS_FILE = path.resolve(__dirname, '../../../content/custom.css');
 const CONNECTIONS_FILE = path.resolve(__dirname, '../../../config/connections.json');
 const CUSTOM_CSS_MAX = 100 * 1024; // 100 KB
 
+/**
+ * The sidebar badge on Site Settings (its countUrl): the settings that are
+ * quietly wrong, worst first - chiefly no SMTP host, where the CMS sends every
+ * mail to a throwaway test inbox that accepts it and reports success, so
+ * nothing else in the admin looks wrong. Nothing wrong = no badge. The same
+ * rules as settingsProblems() in admin/js/lib/site-settings-arrange.js.
+ * Plain text throughout - the popover sets it with textContent.
+ *
+ * @param {object} site - config/site.json
+ * @param {{enabled?: boolean, driver?: string}} [cacheStats]
+ */
+export function settingsBadge(site = {}, cacheStats = {}) {
+    const smtp = site.smtp || {};
+    const cc = site.cookieConsent || {};
+    const problems = [];
+    if (!String(smtp.host || '').trim()) {
+        problems.push({tone: 'danger', text: 'No SMTP host', meta: 'mail goes to a test inbox and reaches no one'});
+    } else if (!String(smtp.fromAddress || '').trim()) {
+        problems.push({tone: 'warn', text: 'No From address', meta: 'mail has no sender; many servers refuse it'});
+    }
+    if (cc.enabled !== false && !String(cc.privacyPolicyUrl || '').trim()) {
+        problems.push({tone: 'warn', text: 'Cookie banner without a privacy policy', meta: 'it links to nothing'});
+    }
+    const danger = problems.some(p => p.tone === 'danger');
+    const n = problems.length;
+    return {
+        count: n,
+        label: n ? `${n} setting${n === 1 ? '' : 's'} need${n === 1 ? 's' : ''} attention` : 'Settings look fine',
+        tone: danger ? 'danger' : 'attention',
+        details: {
+            title: 'Site Settings',
+            rows: [
+                {label: 'Site title', value: String(site.title || '-')},
+                {label: 'Admin home', value: String(site.adminHome || '/')},
+                {label: 'Email', value: smtp.host ? String(smtp.host) : 'not configured', ...(!smtp.host && {tone: 'danger'})},
+                {label: 'Cookie banner', value: cc.enabled !== false ? 'on' : 'off'},
+                {label: 'Cache', value: cacheStats.enabled ? `on (${cacheStats.driver || 'memory'})` : 'off'}
+            ],
+            items: problems.map(p => ({text: p.text, meta: p.meta, ...(p.tone === 'danger' && {tone: 'danger'})})),
+            empty: 'Nothing needs attention.'
+        }
+    };
+}
+
 export async function settingsRoutes(fastify) {
     const canRead = {preHandler: [authenticate, requirePermission('settings', 'read')]};
     const canUpdate = {preHandler: [authenticate, requirePermission('settings', 'update')]};
@@ -112,6 +157,13 @@ export async function settingsRoutes(fastify) {
         }
     });
 
+    // The sidebar badge. `_count` sits beside fixed paths only - nothing can shadow it.
+    fastify.get('/settings/_count', canRead, async () => {
+        let stats = {};
+        try { stats = cache.getStats(); } catch { /* no cache - reported off */ }
+        return settingsBadge(getConfig('site') || {}, stats);
+    });
+
     // GET /api/settings/db-status - returns whether MongoDB connections are configured
     fastify.get('/settings/db-status', canRead, async () => {
         try {

package/server/routes/api/theme.js

@@ -10,6 +10,7 @@
  *                            user - everyone's admin needs one)
  * POST /api/theme/compile  - compile a candidate config to CSS without saving,
  *                            so the admin previews exactly what the page gets
+ * GET  /api/theme/count    - the sidebar badge on Theme (themeBadge below)
  *
  * Auth middlewares are injectable so tests can pass no-ops, the same DI pattern
  * as menus.js and context-menus.js.
@@ -32,6 +33,57 @@ import {
     validateThemeConfig
 } from '../../services/themeSettings.js';
 
+/**
+ * The sidebar badge on Content › Theme. It REPLACES the core count the sidebar
+ * shows there (how many element overrides - a registered countUrl wins), so it
+ * keeps that number, and adds two things: a popover saying what is live where,
+ * and a red count when a theme in use no longer exists (a custom theme whose
+ * plugin went away - the page keeps its base, but the look it was given is
+ * gone). Plain text throughout.
+ *
+ * Mirrors themeProblems() in admin/js/lib/theme-settings-arrange.js.
+ *
+ * @param {object} cfg
+ * @param {string[]} builtins - listThemeIds()
+ * @param {string[]} custom   - ids of the custom themes plugins offer now
+ */
+/** Themes Domma knows without the stylesheet declaring them (resolveThemeClasses passes them through). */
+export const DOMMA_OWN_THEMES = ['core-light', 'core-dark'];
+
+export function themeBadge(cfg = {}, builtins = [], custom = []) {
+    // No catalogue (the stylesheet did not load) means nothing can be judged -
+    // the same rule as themeProblems() in admin/js/lib/theme-settings-arrange.js.
+    const known = builtins.length ? new Set([...builtins, ...custom, ...DOMMA_OWN_THEMES]) : null;
+    const auto = cfg.autoTheme?.enabled ? cfg.autoTheme : null;
+    const problems = [];
+    const check = (where, id) => { if (known && id && !known.has(id)) problems.push({where, id}); };
+    if (auto) { check('Day theme', auto.dayTheme); check('Night theme', auto.nightTheme); }
+    else check('Site theme', cfg.theme);
+    check('Admin theme', cfg.adminTheme);
+    const overrides = Array.isArray(cfg.overrides) ? cfg.overrides : [];
+    overrides.forEach((o, i) => check(`Override "${o.label || o.scope || i + 1}"`, o.theme));
+    const on = overrides.filter(o => o.enabled !== false).length;
+    const n = problems.length;
+    const plural = (k, one) => `${k} ${one}${k === 1 ? '' : 's'}`;
+    return {
+        count: n || overrides.length,
+        label: n ? `${plural(n, 'theme')} in use no longer available` : plural(overrides.length, 'element override'),
+        tone: n ? 'danger' : 'info',
+        details: {
+            title: 'Theme',
+            rows: [
+                auto
+                    ? {label: 'Site (day / night)', value: `${auto.dayTheme} / ${auto.nightTheme}`}
+                    : {label: 'Site theme', value: String(cfg.theme || '-')},
+                {label: 'Admin theme', value: String(cfg.adminTheme || '-')},
+                {label: 'Element overrides', value: `${on} on${overrides.length - on ? `, ${overrides.length - on} off` : ''}`}
+            ],
+            items: problems.slice(0, 8).map(p => ({text: `${p.where}: ${p.id}`, meta: 'no longer available - showing its base', tone: 'danger'})),
+            empty: 'Every theme in use is available.'
+        }
+    };
+}
+
 export async function themeRoutes(fastify, opts = {}) {
     const authenticate      = opts.authenticate      || defaultAuthenticate;
     const requirePermission = opts.requirePermission || defaultRequirePermission;
@@ -41,6 +93,9 @@ export async function themeRoutes(fastify, opts = {}) {
 
     fastify.get('/theme', canRead, async () => loadThemeConfig());
 
+    fastify.get('/theme/count', canRead, async () =>
+        themeBadge(await loadThemeConfig(), listThemeIds(), listCustomThemes().map(t => t.id)));
+
     // The editor's theme picker and token picker build themselves from this
     // rather than from a hardcoded list that would drift from the CSS.
     fastify.get('/theme/catalog', canRead, async () => ({

package/server/routes/api/users.js

@@ -1,6 +1,7 @@
 /**
  * Users API
  * GET    /api/users      - list all users (admin, manager)
+ * GET    /api/users/_count - the sidebar badge (ids are uuids - nothing can shadow it)
  * GET    /api/users/:id  - single user (admin, manager, or self)
  * POST   /api/users      - create user (admin, manager - manager cannot create admin)
  * PUT    /api/users/:id  - update user (admin, manager - manager cannot edit admin)
@@ -10,6 +11,45 @@ import {authenticate, canManageUser, requirePermission} from '../../middleware/a
 import {getPermissionsFor} from '../../services/roles.js';
 import {createUser, deleteUser, getUserById, listUsers, updateUser} from '../../services/users.js';
 import {getProfile, listProfiles, updateProfile} from '../../services/userProfiles.js';
+import {ago, clip, plural} from '../../services/sidebarBadges.js';
+
+/**
+ * The sidebar badge on Users (its countUrl, GET /api/users/_count). The number
+ * stays what the sidebar has always shown there - the users this reader can
+ * see - and the popover says who is inactive, who has never signed in, and
+ * who signed in last. Plain text throughout (the popover uses textContent);
+ * never anything from the password or tokens.
+ *
+ * @param {object[]} users - as the list route returns them (password stripped)
+ * @param {number} [now]
+ */
+export function usersBadge(users = [], now = Date.now()) {
+    const list = users || [];
+    const inactive = list.filter(u => u.isActive === false);
+    const never = list.filter(u => !u.lastLogin);
+    const week = list.filter(u => u.lastLogin && now - new Date(u.lastLogin).getTime() < 7 * 86_400_000);
+    const recent = list.filter(u => u.lastLogin)
+        .sort((a, b) => String(b.lastLogin).localeCompare(String(a.lastLogin)));
+    return {
+        count: list.length,
+        label: `${plural(list.length, 'user')}${inactive.length ? `, ${inactive.length} inactive` : ''}`,
+        tone: 'info',
+        details: {
+            title: 'Users',
+            rows: [
+                {label: 'Active', value: String(list.length - inactive.length)},
+                {label: 'Inactive', value: String(inactive.length)},
+                {label: 'Signed in this week', value: String(week.length)},
+                {label: 'Never signed in', value: String(never.length)}
+            ],
+            items: recent.slice(0, 6).map(u => ({
+                text: clip(u.name || u.email || 'User'),
+                meta: [u.role, `signed in ${ago(u.lastLogin, now)}`].filter(Boolean).join(' · ')
+            })),
+            empty: 'Nobody has signed in yet.'
+        }
+    };
+}
 
 export async function usersRoutes(fastify) {
     const canRead = [authenticate, requirePermission('users', 'read')];
@@ -27,6 +67,12 @@ export async function usersRoutes(fastify) {
             .map(u => ({...u, profile: profiles.get(u.id) || {}}));
     });
 
+    // The sidebar badge - the same users the list shows this reader. Before /users/:id.
+    fastify.get('/users/_count', {preHandler: canRead}, async (request) => {
+        const {canSeeArtefact} = await import('../../services/projects.js');
+        return usersBadge((await listUsers()).filter(u => canSeeArtefact(request.user, u)));
+    });
+
     // Get single user (admin, manager, or the user themselves)
     fastify.get('/users/:id', { preHandler: [authenticate] }, async (request, reply) => {
         const { id } = request.params;
@@ -119,7 +165,13 @@ export async function usersRoutes(fastify) {
 
         // Strip profile from core updates and handle separately
         const {profile, ...coreUpdates} = updates;
-        const user = await updateUser(id, coreUpdates);
+        let user;
+        try {
+            user = await updateUser(id, coreUpdates);
+        } catch (err) {
+            if (err.code === 'EMAIL_TAKEN') return reply.status(409).send({error: err.message});
+            throw err;
+        }
 
         if (profile && typeof profile === 'object') {
             await updateProfile(id, profile);

package/server/routes/api/views.js

@@ -2,7 +2,8 @@
  * Views API
  *
  * Admin endpoints (authenticated + views permission):
- * GET    /views                     - List all view configs
+ * GET    /views                     - List all view configs (?sources=1 adds `sourceInfo` per view)
+ * GET    /views/_count              - The sidebar badge (the underscore is outside the slug alphabet)
  * POST   /views                     - Create view config
  * GET    /views/:slug               - Get view config
  * PUT    /views/:slug               - Update view config
@@ -13,11 +14,17 @@
  * Public endpoint (role-checked per view access config):
  * GET    /views/:slug/public        - Execute view publicly
  */
-import {createView, deleteView, executeView, getView, listViews, updateView} from '../../services/views.js';
+import {createView, deleteView, executeView, getView, listViews, updateView, viewsBadge} from '../../services/views.js';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
 import {getRoleLevel} from '../../services/roles.js';
 import {getEffectiveLevel} from '../../services/userRoles.js';
 
+/** Every collection by slug - a missing one is a view whose source was deleted. */
+async function collectionsBySlug() {
+    const {listCollections} = await import('../../services/collections.js');
+    return new Map((await listCollections().catch(() => [])).map(c => [c.slug, c]));
+}
+
 export async function viewsRoutes(fastify) {
     const canRead = {preHandler: [authenticate, requirePermission('views', 'read')]};
     const canCreate = {preHandler: [authenticate, requirePermission('views', 'create')]};
@@ -33,7 +40,18 @@ export async function viewsRoutes(fastify) {
             const {canSeeArtefact} = await import('../../services/projects.js');
             const all = await listViews();
             // listViews returns full records with meta inline - filter directly
-            return all.filter(v => canSeeArtefact(request.user, v));
+            const visible = all.filter(v => canSeeArtefact(request.user, v));
+            if (request.query?.sources !== '1') return visible;
+            // The Views screen: what each view reads from - whether that collection still
+            // exists, its title and its storage (MongoDB runs native aggregation, file
+            // collections the JS pipeline). A views user need not hold collections.read.
+            const bySlug = await collectionsBySlug();
+            return visible.map(v => {
+                const c = bySlug.get(v.pipeline?.source);
+                return {...v, sourceInfo: c
+                    ? {exists: true, title: c.title || c.slug, adapter: c.storage?.adapter || 'file'}
+                    : {exists: false}};
+            });
         } catch (err) {
             return reply.status(503).send({ error: err.message });
         }
@@ -49,6 +67,12 @@ export async function viewsRoutes(fastify) {
         }
     });
 
+    fastify.get('/views/_count', canRead, async (request) => {
+        const {canSeeArtefact} = await import('../../services/projects.js');
+        const visible = (await listViews()).filter(v => canSeeArtefact(request.user, v));
+        return viewsBadge(visible, new Set((await collectionsBySlug()).keys()));
+    });
+
     // Static sub-routes must be declared before the parameterised :slug route
     // so Fastify's radix router gives them priority.
     fastify.get('/views/collection/:collectionSlug', canRead, async (request, reply) => {

package/server/server.js

@@ -440,6 +440,7 @@ const {menusRoutes}         = await import('./routes/api/menus.js');
 const {contextMenusRoutes}  = await import('./routes/api/context-menus.js');
 const {menuLocationsRoutes} = await import('./routes/api/menu-locations.js');
 const {projectsRoutes}      = await import('./routes/api/projects.js');
+const {rolesRoutes}         = await import('./routes/api/roles.js');
 const {apiTokensRoutes}     = await import('./routes/api/api-tokens.js');
 const {apiEndpointsRoutes}  = await import('./routes/api/api-endpoints.js');
 const {endpointsPublicRoutes} = await import('./routes/api/endpoints-public.js');
@@ -475,6 +476,7 @@ await app.register(contextMenusRoutes,  {prefix: '/api'});
 await app.register(themeRoutes,         {prefix: '/api'});
 await app.register(menuLocationsRoutes, {prefix: '/api'});
 await app.register(projectsRoutes,      {prefix: '/api'});
+await app.register(rolesRoutes,         {prefix: '/api'});
 await app.register(apiTokensRoutes,     {prefix: '/api'});
 await app.register(apiEndpointsRoutes,  {prefix: '/api'});
 await app.register(endpointsPublicRoutes, {prefix: '/api'});
@@ -528,7 +530,32 @@ registerSidebarItem({item: {source: 'Built in', text: 'Contacts', url: '#/contac
 // Manage projects lives in the menu (the Projects folder, sidebar-migration.js);
 // registering it here only adds its badge - the renderer merges a registered
 // item into the menu node with the same url rather than adding a second one.
-registerSidebarItem({folder: 'projects', item: {source: 'Built in', text: 'Manage projects', url: '#/projects', icon: 'folder', permission: 'projects', countUrl: '/api/projects/_count'}});
+registerSidebarItem({folder: 'projects', item: {source: 'Built in', text: 'Manage projects', url: '#/projects', icon: 'folder', permission: 'projects', countUrl: '/api/projects/_count', inventory: true}});
+// Content and Data: the same - each merges into its menu entry and brings its badge
+// (which keeps the number the sidebar always showed there; the popover says more).
+// `inventory`: a how-many count, left out of a closed folder's total (sidebar-renderer).
+registerSidebarItem({folder: 'content', item: {source: 'Built in', text: 'Pages', url: '#/pages', icon: 'file-text', permission: 'pages', countUrl: '/api/pages/_count', inventory: true}});
+registerSidebarItem({folder: 'content', item: {source: 'Built in', text: 'Media', url: '#/media', icon: 'image', permission: 'media', countUrl: '/api/media/_count', inventory: true}});
+registerSidebarItem({folder: 'content', item: {source: 'Built in', text: 'Menus', url: '#/menus', icon: 'menu', permission: 'menus', countUrl: '/api/menus/_count', inventory: true}});
+registerSidebarItem({folder: 'content', item: {source: 'Built in', text: 'Context Menus', url: '#/context-menus', icon: 'menu', permission: 'context-menus', countUrl: '/api/context-menus/_count', inventory: true}});
+registerSidebarItem({folder: 'content', item: {source: 'Built in', text: 'Theme', url: '#/theme', icon: 'droplet', permission: 'theme', countUrl: '/api/theme/count', inventory: true}});
+registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'Collections', url: '#/collections', icon: 'database', permission: 'collections', countUrl: '/api/collections/_count', inventory: true}});
+registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'Forms', url: '#/forms', icon: 'layout', permission: 'collections', countUrl: '/api/forms/_count', inventory: true}});
+registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'Views', url: '#/views', icon: 'eye', permission: 'views', countUrl: '/api/views/_count', inventory: true}});
+registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'Actions', url: '#/actions', icon: 'zap', permission: 'actions', countUrl: '/api/actions/_count', inventory: true}});
+registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'API Builder', url: '#/api-endpoints', icon: 'code', permission: 'api-endpoints', countUrl: '/api/api-endpoints/_count', inventory: true}});
+registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'Blocks', url: '#/blocks', icon: 'box', permission: 'pages', countUrl: '/api/blocks/_count', inventory: true}});
+registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'Components', url: '#/components', icon: 'component', permission: 'components', countUrl: '/api/components/_count', inventory: true}});
+// System. Notifications, Site Settings, Layouts and API Tokens are signals (unread, something quietly
+// wrong, pages on a missing layout, tokens expiring), so not `inventory`.
+registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Notifications', url: '#/system/notifications', icon: 'bell', permission: 'notifications', countUrl: '/api/system/notifications/_count'}});
+registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Roles', url: '#/roles', icon: 'shield', permission: 'plugins', countUrl: '/api/roles/_count', inventory: true}});
+registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Users', url: '#/users', icon: 'users', permission: 'users', countUrl: '/api/users/_count', inventory: true}});
+registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Site Settings', url: '#/settings', icon: 'settings', permission: 'settings', countUrl: '/api/settings/_count'}});
+registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Layouts', url: '#/layouts', icon: 'layout', permission: 'layouts', countUrl: '/api/layouts/_count'}});
+registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Plugins', url: '#/plugins', icon: 'package', permission: 'plugins', countUrl: '/api/plugins/_count', inventory: true}});
+registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'API Tokens', url: '#/api-tokens', icon: 'key', permission: 'api-tokens', countUrl: '/api/api-tokens/_count'}});
+registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Search', url: '#/search', icon: 'search', permission: 'settings', countUrl: '/api/search/_count', inventory: true}});
 
 await registerPlugins(app);
 

package/server/services/contextMenus.js

@@ -475,3 +475,44 @@ export function toClientPayload(menu) {
         items: menu.items || []
     };
 }
+
+/**
+ * The sidebar badge on Context Menus (its countUrl, GET /api/context-menus/_count):
+ * how many menus there are, with the ones switched off and the ones whose
+ * binding matches nothing called out - an enabled menu that never appears is
+ * the one thing here worth a second look. Plain text throughout: the popover
+ * sets it with textContent.
+ *
+ * @param {object[]} menus - as listContextMenus returns them
+ * @returns {{count: number, label: string, tone: string, details: object}}
+ */
+export function contextMenusBadge(menus = []) {
+    const list = [...menus].sort((a, b) => String(a.name || a.slug).localeCompare(String(b.name || b.slug)));
+    const off = list.filter(m => m.enabled === false);
+    const never = list.filter(m => m.enabled !== false && m.binding
+        && !(m.binding.projects || []).length && !(m.binding.pages || []).length);
+    const siteWide = list.filter(m => m.enabled !== false && !m.binding).length;
+    const n = list.length;
+    const bits = [off.length && `${off.length} off`, never.length && `${never.length} never matching`].filter(Boolean);
+    return {
+        count: n,
+        label: `${n} context menu${n === 1 ? '' : 's'}${bits.length ? `, ${bits.join(', ')}` : ''}`,
+        tone: never.length ? 'attention' : 'info',
+        details: {
+            title: 'Context Menus',
+            rows: [
+                {label: 'On', value: String(n - off.length)},
+                {label: 'Off', value: String(off.length)},
+                {label: 'Site-wide', value: String(siteWide)},
+                {label: 'Never matching', value: String(never.length), ...(never.length && {tone: 'danger'})}
+            ],
+            items: list.slice(0, 8).map(m => ({
+                text: String(m.name || m.slug),
+                meta: [m.selector || 'no target', `${m.itemsCount ?? 0} item${m.itemsCount === 1 ? '' : 's'}`,
+                    m.enabled === false ? 'off' : '', never.includes(m) ? 'never matches' : ''].filter(Boolean).join(' · '),
+                ...(never.includes(m) && {tone: 'danger'})
+            })),
+            empty: 'No context menus yet.'
+        }
+    };
+}

package/server/services/plugins.js

@@ -266,6 +266,13 @@ async function loadConfigDefaults(name) {
   if (_configDefaultsCache.has(name)) return _configDefaultsCache.get(name);
   const configJsPath = path.join(PLUGINS_DIR, name, 'config.js');
   let defaults = {};
+  // No config.js is "no defaults", not a failure: the Marketplace asks for every
+  // installed plugin's settings (enabled or not), and recording a load failure for
+  // one without the file would put it on the health report for being looked at.
+  try { await fs.access(configJsPath); } catch {
+    _configDefaultsCache.set(name, defaults);
+    return defaults;
+  }
   try {
     const {default: exported} = await import(configJsPath);
     defaults = exported || {};

package/server/services/roles.js

@@ -26,6 +26,9 @@ const USERS_DIR = path.resolve(path.dirname(COLLECTIONS_DIR), 'users');
 /** Base role slugs that should always exist */
 const BASE_ROLE_NAMES = ['super-admin', 'admin', 'user'];
 
+/** The seeded roles every site relies on - never deletable, whatever route is asked. */
+export const isBaseRole = (name) => BASE_ROLE_NAMES.includes(name);
+
 /** Role slugs that were seeded by the old 4-role system - used to detect legacy data */
 const DEFUNCT_ROLE_NAMES = ['manager', 'editor', 'subscriber'];