domma-cms 0.75.0 → 0.77.0

package/plugins/_lib/mail/readRoutes.js

@@ -38,6 +38,7 @@ import {readPriority} from './priority.js';
 import {listAttachments, renderBody} from './render.js';
 import {readUnsubscribe} from './unsubscribe.js';
 import {MailKeyError} from './secretbox.js';
+import {unreadBadge} from './unreadBadge.js';
 
 /**
  * Flatten an envelope address list into something the browser can render.
@@ -52,7 +53,7 @@ function addresses(list) {
     }));
 }
 
-export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginName, cachedList = null, diagnostics = null}) {
+export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginName, cachedList = null, diagnostics = null, unreadBadge: withUnreadBadge = false}) {
     const {authenticate} = auth;
 
     // A deleted user's stored mailbox passwords must not outlive their
@@ -165,6 +166,47 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
     // Accounts
     // -------------------------------------------------------------------------
 
+    /**
+     * GET /unread - the sidebar badge (the plugin.json countUrl). Opt-in:
+     * Email Pro counts from its store and registers its own. INBOX only, by
+     * STATUS (no select, so nothing can be marked read), and kept a minute
+     * per user - the sidebar asks every minute from every open admin tab.
+     */
+    if (withUnreadBadge) {
+        const badgeCache = new Map();
+        // A mailbox that failed (a changed password, a server down) is not asked
+        // again every minute: that is a failed IMAP login per minute per open tab,
+        // enough to trip fail2ban or a provider lockout. It backs off 5 min, doubling
+        // to an hour; saving the account (a new updatedAt) retries straight away.
+        const failures = new Map();
+        const failKey = (uid, account) => `${uid}:${account.id}:${account.updatedAt || account.createdAt || ''}`;
+        fastify.get('/unread', {preHandler: [authenticate]}, async (request, reply) => {
+            const uid = userId(request);
+            if (!uid) return reply.code(401).send({error: 'Authentication required.'});
+            const hit = badgeCache.get(uid);
+            if (hit && Date.now() - hit.at < 60_000) return hit.value;
+            const boxes = [];
+            for (const account of await accounts.listAccounts(uid)) {
+                const key = failKey(uid, account);
+                const failed = failures.get(key);
+                if (failed && Date.now() < failed.until) { boxes.push({label: account.label, unseen: null}); continue; }
+                try {
+                    const status = await pool.withClient(`${uid}:${account.id}`, accounts.toConnection(account),
+                        client => client.status('INBOX', {unseen: true}));
+                    failures.delete(key);
+                    boxes.push({label: account.label, unseen: status?.unseen ?? 0});
+                } catch {
+                    const wait = Math.min((failed?.wait || 150_000) * 2, 3_600_000);
+                    failures.set(key, {wait, until: Date.now() + wait});
+                    boxes.push({label: account.label, unseen: null});
+                }
+            }
+            const value = unreadBadge(boxes);
+            badgeCache.set(uid, {at: Date.now(), value});
+            return value;
+        });
+    }
+
     /** GET /accounts - every mailbox this user owns, without passwords. */
     fastify.get('/accounts', {preHandler: [authenticate]}, async (request, reply) => {
         const uid = userId(request);

package/plugins/_lib/mail/unreadBadge.js

@@ -0,0 +1,42 @@
+/**
+ * The free reader's sidebar badge - unread mail in each mailbox's INBOX.
+ *
+ * Pure: the route asks IMAP (STATUS, which reads without selecting and so can
+ * never mark anything read) and hands the figures here. Email Pro has its own
+ * badge over the synchronised store; this is the edition without one, so it
+ * counts INBOX only - asking a server about every folder once a minute is
+ * how a mailbox gets rate-limited.
+ *
+ * Plain text throughout: the sidebar popover sets it with textContent.
+ *
+ * @module _lib/mail/unreadBadge
+ */
+
+const plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+
+/**
+ * @param   {{label?: string, unseen: number|null, error?: string}[]} boxes - one per mailbox
+ * @returns {{count: number, label: string, tone: string, details: object}}
+ */
+export function unreadBadge(boxes = []) {
+    const known = boxes.filter(b => Number.isFinite(b.unseen));
+    const count = known.reduce((n, b) => n + b.unseen, 0);
+    const failed = boxes.length - known.length;
+    return {
+        count,
+        label: boxes.length
+            ? `${plural(count, 'unread message')} in the inbox${boxes.length > 1 ? 'es' : ''}${failed ? ` (${plural(failed, 'mailbox', 'mailboxes')} could not be checked)` : ''}`
+            : 'No mailbox set up',
+        tone: 'info',
+        details: {
+            title: 'Mail',
+            rows: boxes.map(b => ({
+                label: String(b.label || 'Mailbox'),
+                value: Number.isFinite(b.unseen) ? plural(b.unseen, 'unread', 'unread') : 'not reachable',
+                ...(Number.isFinite(b.unseen) ? {} : {tone: 'danger'})
+            })),
+            items: [],
+            empty: boxes.length ? 'Nothing unread in the inbox.' : 'Add a mailbox to see unread mail here.'
+        }
+    };
+}

package/plugins/free-tier.lock.json

@@ -1,6 +1,6 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@d9bfe49",
+  "source": "dcms-marketplace@5f64a68",
   "plugins": {
     "blog": {
       "version": "1.6.3",
@@ -67,13 +67,13 @@
       }
     },
     "mail-reader": {
-      "version": "1.0.0",
+      "version": "1.1.0",
       "files": {
-        "CLAUDE.md": "a8dd2cb285e1d24b2f072aa11a644e1c8c1be89013da6f6cc46d9820fe24ccd5",
+        "CLAUDE.md": "7f317e69b560457f2d4c401b466754850afe75f6983bc41414c71d8c276c3583",
         "admin/views/mail.js": "c5c6483f9618c75cac8f4be32d3aea99511db76d4b9d38b8ef43bdc1d35db3c5",
         "config.js": "6e65803ad822a9acda40c203631b8eb32a87cf9d9e5f1c7cb59d01aa406075c6",
-        "plugin.js": "79b17346ed0192b092040460cc8d762d5207ee6e4af7bfc2d1cf654a51e2fa81",
-        "plugin.json": "5f5b98757514aa70d7c7a2be5a1fbfdde8ef21a2ccc7586b3b5aea9b44fbe5e6"
+        "plugin.js": "ebe4c41bdd8836fb3128af3a0e789d47f89b00e9e37dc9378bb308aaae8d41b2",
+        "plugin.json": "ed1f02d9405f6ae1257313ea4155ea49e307fb2210650fd247b92e6988aa78d1"
       }
     }
   }

package/plugins/mail-reader/CLAUDE.md

@@ -24,6 +24,7 @@ All under `/api/plugins/mail-reader`, all requiring authentication.
 
 | Method | Path | Purpose |
 |---|---|---|
+| GET | `/unread` | The sidebar badge: unread in each mailbox's INBOX, by STATUS (never selects, so nothing is marked read), cached a minute per user. `registerReadRoutes({unreadBadge: true})` - Email Pro counts from its store instead. |
 | GET | `/accounts` | Every mailbox this user owns. Never returns passwords, only `hasPassword`. |
 | POST | `/accounts` | Add a mailbox. |
 | PUT | `/accounts/:id` | Update one. A blank password means "keep the stored one". |

package/plugins/mail-reader/plugin.js

@@ -30,7 +30,9 @@ export default async function mailReaderPlugin(fastify, options) {
         hooks: options.hooks,
         config,
         pool,
-        pluginName: 'mail-reader'
+        pluginName: 'mail-reader',
+        // The sidebar badge (plugin.json countUrl): unread in each INBOX.
+        unreadBadge: true
     });
 }
 

package/plugins/mail-reader/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "mail-reader",
   "displayName": "Mail Reader",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "tier": "free",
   "description": "Read-only IMAP mailbox reader. Connects to a standard IMAP server and reads mail without ever writing to it.",
   "author": "Darryl Waterhouse",
-  "date": "2026-09-19",
+  "date": "2026-09-25",
   "icon": "mail",
   "admin": {
     "sidebar": [
@@ -14,7 +14,8 @@
         "text": "Mail Reader",
         "icon": "mail",
         "url": "#/plugins/mail-reader",
-        "section": "#/plugins/mail-reader"
+        "section": "#/plugins/mail-reader",
+        "countUrl": "/api/plugins/mail-reader/unread"
       }
     ],
     "routes": [
@@ -26,7 +27,7 @@
     ],
     "views": {
       "plugin-mail-reader": {
-        "entry": "mail-reader/admin/views/mail.js?v=1",
+        "entry": "mail-reader/admin/views/mail.js?v=2",
         "exportName": "mailView"
       }
     }

package/server/routes/api/api-tokens.js

@@ -2,6 +2,7 @@
  * API Tokens API
  *
  * GET    /api/api-tokens      - list tokens visible to the caller (sanitised; never the hash)
+ * GET    /api/api-tokens/_count - the sidebar badge: tokens that need attention (expired / expiring)
  * POST   /api/api-tokens      - create; response carries the plaintext ONCE
  * PUT    /api/api-tokens/:id  - rename, enable/disable, edit scopes/expiry
  * DELETE /api/api-tokens/:id  - revoke (immediate)
@@ -23,6 +24,58 @@ import {
 } from '../../services/apiTokens.js';
 import {canSeeArtefact} from '../../services/projects.js';
 
+/** A token this close to its expiry is called out - SOON_DAYS in admin/js/lib/api-tokens-arrange.js. */
+const SOON_DAYS = 14;
+const DAY = 86_400_000;
+
+/**
+ * The sidebar badge on API Tokens (its countUrl, GET /api/api-tokens/_count).
+ *
+ * The number is a signal, not an inventory: the tokens that need someone -
+ * switched on but already expired (every call with one is being refused, and
+ * nothing else says so), and switched on and expiring within SOON_DAYS. Zero is
+ * no badge. Red while any has expired. Plain text - the popover sets it with
+ * textContent; token names are the admin's own, never the secret.
+ *
+ * @param {object[]} tokens - sanitised, as listTokensSanitised returns them
+ * @param {number} [now]
+ */
+export function apiTokensBadge(tokens = [], now = Date.now()) {
+    const on = tokens.filter(t => t.enabled !== false);
+    const at = (t) => (t.expiresAt ? Date.parse(t.expiresAt) : NaN);
+    const expired = on.filter(t => at(t) <= now);
+    const soon = on.filter(t => at(t) > now && at(t) - now <= SOON_DAYS * DAY)
+        .sort((a, b) => at(a) - at(b));
+    const off = tokens.length - on.length;
+    const need = expired.length + soon.length;
+    const plural = (n, one) => `${n} ${one}${n === 1 ? '' : 's'}`;
+    const days = (t) => {
+        const d = Math.ceil((at(t) - now) / DAY);
+        return d <= 0 ? 'today' : d === 1 ? 'tomorrow' : `in ${d} days`;
+    };
+    return {
+        count: need,
+        label: need
+            ? [expired.length && `${plural(expired.length, 'token')} expired`, soon.length && `${soon.length} expiring soon`].filter(Boolean).join(', ')
+            : `${plural(tokens.length, 'token')}, none expiring soon`,
+        tone: expired.length ? 'danger' : 'attention',
+        details: {
+            title: 'API Tokens',
+            rows: [
+                {label: 'Working', value: String(on.length - expired.length)},
+                {label: 'Expiring soon', value: String(soon.length)},
+                {label: 'Expired', value: String(expired.length), ...(expired.length && {tone: 'danger'})},
+                {label: 'Switched off', value: String(off)}
+            ],
+            items: [
+                ...expired.map(t => ({text: String(t.name || '(unnamed)'), meta: `${t.project} · expired - callers are refused`, tone: 'danger'})),
+                ...soon.map(t => ({text: String(t.name || '(unnamed)'), meta: `${t.project} · expires ${days(t)}`}))
+            ].slice(0, 8),
+            empty: 'No token has expired or expires in the next two weeks.'
+        }
+    };
+}
+
 /**
  * Register the api-tokens routes.
  *
@@ -43,6 +96,9 @@ export async function apiTokensRoutes(fastify, opts = {}) {
         return listTokensSanitised(request.user);
     });
 
+    // There is no GET /api-tokens/:id, and ids are uuids - nothing can shadow this.
+    fastify.get('/api-tokens/_count', canRead, async (request) => apiTokensBadge(await listTokensSanitised(request.user)));
+
     fastify.post('/api-tokens', canCreate, async (request, reply) => {
         const {name, project, scopes, expiresAt} = request.body || {};
         if (project && !canSeeArtefact(request.user, {meta: {project}})) {

package/server/routes/api/auth.js

@@ -170,7 +170,13 @@ export async function authRoutes(fastify) {
         if (email) coreUpdates.email = email;
         if (password) coreUpdates.password = password;
 
-        const user = await updateUser(id, coreUpdates);
+        let user;
+        try {
+            user = await updateUser(id, coreUpdates);
+        } catch (err) {
+            if (err.code === 'EMAIL_TAKEN') return reply.status(409).send({error: err.message});
+            throw err;
+        }
 
         if (profile && typeof profile === 'object') {
             await updateProfile(id, profile);

package/server/routes/api/collections.js

@@ -54,7 +54,7 @@ import {
     updateEntry
 } from '../../services/collections.js';
 import {authenticate, requireAdmin, requirePermission} from '../../middleware/auth.js';
-import {getRoleLevel, invalidate as invalidateRoles} from '../../services/roles.js';
+import {getRoleLevel, invalidate as invalidateRoles, isBaseRole} from '../../services/roles.js';
 import {getEffectiveLevel} from '../../services/userRoles.js';
 import {getConfig, saveConfig} from '../../config.js';
 import {PRESET_COLLECTION_SLUGS} from '../../services/presetCollections.js';
@@ -262,6 +262,9 @@ async function keepRoleSystemFields(id, data) {
         if (existing[field] !== undefined) out[field] = existing[field];
         else delete out[field];
     }
+    // A built-in role keeps its name: renaming `admin` and then deleting it went round
+    // the delete guard (and every user and route that names it would lose it).
+    if (isBaseRole(existing.name)) out.name = existing.name;
     return out;
 }
 
@@ -494,6 +497,11 @@ export async function collectionsRoutes(fastify) {
             if (entry?.data?.level === 0) {
                 return reply.status(403).send({ error: 'Cannot delete the root admin role' });
             }
+            // admin and user too: removeRole() refused them by name, but this route did not,
+            // and the old Roles screen offered Delete on both.
+            if (isBaseRole(entry?.data?.name)) {
+                return reply.status(403).send({ error: `Cannot delete the built-in role '${entry.data.name}'` });
+            }
         }
         try {
             await deleteEntry(request.params.slug, request.params.id);
@@ -507,6 +515,10 @@ export async function collectionsRoutes(fastify) {
 
     // Clear all entries - DELETE /collections/:slug/entries (no :id)
     fastify.delete('/collections/:slug/entries', canDelete, async (request, reply) => {
+        // Clearing roles would leave every user holding a role that no longer exists.
+        if (request.params.slug === 'roles') {
+            return reply.status(403).send({ error: 'Roles cannot be cleared - delete them one at a time' });
+        }
         try {
             await clearEntries(request.params.slug);
             return { success: true };

package/server/routes/api/dashboard.js

@@ -11,6 +11,7 @@ import {fileURLToPath} from 'url';
 import {authenticate as defaultAuthenticate, requireAdmin as defaultRequireAdmin} from '../../middleware/auth.js';
 import {getHealth} from '../../services/health.js';
 import {listVersions} from '../../services/versions.js';
+import {PRESET_COLLECTION_SLUGS} from '../../services/presetCollections.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(__dirname, '..', '..', '..');
@@ -62,6 +63,24 @@ function sumRange(daily, fromKey, toKey) {
     return total;
 }
 
+/**
+ * Daily totals for the last `days` days, oldest first - the traffic chart.
+ * (The chart used to add up the top five pages' 7-day sparklines and call it
+ * "the last 30 days": everything but the last week read 0.)
+ *
+ * @param {object} daily
+ * @param {number} [days]
+ * @returns {{day: string, hits: number}[]}
+ */
+export function buildSeries(daily, days = 30) {
+    const out = [];
+    for (let i = days - 1; i >= 0; i -= 1) {
+        const day = isoDaysAgo(i);
+        out.push({day, hits: sumDay(daily, day)});
+    }
+    return out;
+}
+
 /**
  * Build the top-pages widget data, including a per-day sparkline and a
  * percentage delta versus the previous comparable window.
@@ -212,12 +231,19 @@ async function buildActivity() {
     } catch { /* no versions dir */ }
 
     // Collection entries - each slug has a single data.json with an array of
-    // entries. Take the newest ENTRIES_PER_COLLECTION by meta.createdAt.
+    // entries. Take the newest ENTRIES_PER_COLLECTION by meta.createdAt. The
+    // system's own collections (roles, users' profiles, API tokens, projects…)
+    // are not activity anyone asked to see - they were listed as "received
+    // submission" before. An entry is `type: 'entry'` with its collection.
+    const SYSTEM = new Set(['roles', 'user-profiles', ...PRESET_COLLECTION_SLUGS]);
     const collectionsDir = path.join(ROOT, 'content', 'collections');
     try {
         const slugs = await fs.readdir(collectionsDir, { withFileTypes: true });
         for (const slug of slugs) {
-            if (!slug.isDirectory()) continue;
+            if (!slug.isDirectory() || SYSTEM.has(slug.name)) continue;
+            let title = slug.name;
+            try { title = JSON.parse(await fs.readFile(path.join(collectionsDir, slug.name, 'schema.json'), 'utf8')).title || title; }
+            catch { /* no schema - keep the slug */ }
             const dataFile = path.join(collectionsDir, slug.name, 'data.json');
             let entries = [];
             try { entries = JSON.parse(await fs.readFile(dataFile, 'utf8')); }
@@ -231,9 +257,10 @@ async function buildActivity() {
 
             for (const e of sorted) {
                 items.push({
-                    type: 'form',
+                    type: 'entry',
                     at: e.meta.createdAt,
-                    form: slug.name
+                    collection: slug.name,
+                    title
                 });
             }
         }
@@ -338,6 +365,7 @@ export async function dashboardRoutes(fastify, opts = {}) {
         }
 
         const topPages = buildTopPages(daily);
+        traffic.series = buildSeries(daily);
         const journeys = (await safe('analytics.journeys', () => {
             const end = new Date(); end.setUTCHours(0, 0, 0, 0);
             const start = new Date(end); start.setUTCDate(start.getUTCDate() - 6);

package/server/routes/api/effects.js

@@ -2,22 +2,77 @@
  * Effects API Routes
  * GET  /api/effects/settings  - public (read by public site IIFE)
  * PUT  /api/effects/settings  - admin-only (save user overrides)
+ *
+ * The PUT whitelists and checks what it stores (normaliseEffectsSettings): it
+ * used to write the request body to config/effects.json verbatim, and GET
+ * hands that file to every public page. Keys this route does not know are
+ * left as they are in the file, never added from a request.
  */
-import {authenticate, requireAdmin} from '../../middleware/auth.js';
+import {
+    authenticate as defaultAuthenticate,
+    requireAdmin as defaultRequireAdmin
+} from '../../middleware/auth.js';
 import {getConfig, saveConfig} from '../../config.js';
 
-export async function effectsRoutes(fastify) {
-    fastify.get('/effects/settings', async () => {
-        try {
-            return getConfig('effects');
-        } catch {
-            return {respectMotion: true, defaultDuration: 600, defaultAnimation: 'fade', defaultThreshold: 0.1};
-        }
-    });
+export const EFFECT_ANIMATIONS = ['fade', 'slide-up', 'slide-down', 'zoom', 'flip'];
+export const EFFECTS_DEFAULTS = {respectMotion: true, defaultDuration: 600, defaultAnimation: 'fade', defaultThreshold: 0.1};
+
+/**
+ * A request body -> {errors, settings}. The same rules as checkSettings() in
+ * admin/js/lib/effects-arrange.js. A duration of 0 is refused: public/js/effects.js
+ * reads `defaultDuration || 600`, so 0 would silently mean 600.
+ *
+ * @param {object} body
+ * @returns {{errors: string[], settings: object}}
+ */
+export function normaliseEffectsSettings(body) {
+    const b = body && typeof body === 'object' ? body : {};
+    const errors = [];
+    const settings = {};
+    if ('respectMotion' in b) settings.respectMotion = b.respectMotion !== false;
+    if ('defaultDuration' in b) {
+        const n = Number(b.defaultDuration);
+        if (!Number.isInteger(n) || n < 1 || n > 10000) errors.push('defaultDuration must be a whole number from 1 to 10000');
+        else settings.defaultDuration = n;
+    }
+    if ('defaultAnimation' in b) {
+        if (!EFFECT_ANIMATIONS.includes(b.defaultAnimation)) errors.push(`defaultAnimation must be one of ${EFFECT_ANIMATIONS.join(', ')}`);
+        else settings.defaultAnimation = b.defaultAnimation;
+    }
+    if ('defaultThreshold' in b) {
+        const n = Number(b.defaultThreshold);
+        if (b.defaultThreshold === '' || b.defaultThreshold === null || !Number.isFinite(n) || n < 0 || n > 1) {
+            errors.push('defaultThreshold must be a number from 0 to 1');
+        } else settings.defaultThreshold = n;
+    }
+    return {errors, settings};
+}
+
+function loadSettings() {
+    try {
+        return {...EFFECTS_DEFAULTS, ...(getConfig('effects') || {})};
+    } catch {
+        return {...EFFECTS_DEFAULTS};
+    }
+}
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {{authenticate?: Function, requireAdmin?: Function}} [opts] - injectable for tests
+ */
+export async function effectsRoutes(fastify, opts = {}) {
+    const authenticate = opts.authenticate || defaultAuthenticate;
+    const requireAdmin = opts.requireAdmin || defaultRequireAdmin;
+
+    fastify.get('/effects/settings', async () => loadSettings());
 
-    fastify.put('/effects/settings', {preHandler: [authenticate, requireAdmin]}, async (request) => {
-        const body = request.body || {};
-        saveConfig('effects', body);
-        return {ok: true};
+    fastify.put('/effects/settings', {preHandler: [authenticate, requireAdmin]}, async (request, reply) => {
+        const {errors, settings} = normaliseEffectsSettings(request.body);
+        if (errors.length) return reply.status(400).send({error: errors.join('; ')});
+        let current = {};
+        try { current = getConfig('effects') || {}; } catch { /* no file yet */ }
+        const next = {...current, ...settings};
+        saveConfig('effects', next);
+        return {ok: true, settings: {...EFFECTS_DEFAULTS, ...next}};
     });
 }