domma-cms 0.75.0 → 0.77.0

package/server/routes/api/forms.js

@@ -14,6 +14,8 @@
  *   GET    /forms/:slug/submissions/export - admin: CSV export from collection
  *   DELETE /forms/:slug/submissions        - admin: clear all submissions
  *   DELETE /forms/:slug/submissions/:id    - admin: delete one submission
+ *   POST   /forms/:slug/submissions/:id/spam - admin: flag / unflag one submission as spam {spam}
+ *   (every submissions route reads and writes submissionsCollectionFor(form))
  *   POST   /forms/submit/:slug             - public: accept submission
  *   POST   /forms/test-email               - admin: send test email
  */
@@ -29,7 +31,9 @@ import {
     createEntry,
     deleteEntry,
     getCollection,
-    listEntries
+    getEntry,
+    listEntries,
+    updateEntry
 } from '../../services/collections.js';
 import {getConfig} from '../../config.js';
 import {authenticate, requireAdmin, requirePermission} from '../../middleware/auth.js';
@@ -243,6 +247,30 @@ export function submissionsCollectionFor(form) {
     return c?.enabled && c.slug ? c.slug : form?.slug;
 }
 
+/**
+ * Whether an entry is one of THIS form's submissions. In the form's own
+ * collection, every entry is. In a collection its action shares with others
+ * (a signup form writing to `members`, two forms writing to `enquiries`), only
+ * the entries it made - submit stamps them `meta.source: 'form:<slug>'` - so
+ * that clearing, deleting, flagging, exporting or counting one form's
+ * submissions never touches the rest of that collection.
+ */
+export function isSubmissionOf(form, entry) {
+    if (submissionsCollectionFor(form) === form?.slug) return true;
+    return entry?.meta?.source === `form:${form?.slug}`;
+}
+
+async function canSeeForm(user, form) {
+    const {canSeeArtefact} = await import('../../services/projects.js');
+    return canSeeArtefact(user, form);
+}
+
+/** This form's submissions, oldest first (listEntries order). */
+async function submissionsOf(form) {
+    const r = await listEntries(submissionsCollectionFor(form), {limit: 0});
+    return (r.entries || []).filter(e => isSubmissionOf(form, e));
+}
+
 const DAY_MS = 86_400_000;
 
 /**
@@ -256,8 +284,7 @@ const DAY_MS = 86_400_000;
  */
 async function submissionStats(form, now = Date.now()) {
     try {
-        const r = await listEntries(submissionsCollectionFor(form), {limit: 0});
-        const entries = r.entries || [];
+        const entries = await submissionsOf(form);
         let week = 0;
         let today = 0;
         let last = null;
@@ -269,7 +296,7 @@ async function submissionStats(form, now = Date.now()) {
             if (now - t <= DAY_MS) today++;
             if (!last || at > last) last = at;
         }
-        return {total: r.total ?? entries.length, week, today, last};
+        return {total: entries.length, week, today, last};
     } catch {
         return {total: 0, week: 0, today: 0, last: null};
     }
@@ -530,8 +557,10 @@ export async function formsRoutes(fastify) {
         } catch {
             return reply.status(404).send({ error: 'Form not found.' });
         }
-        const collectionAction = form.actions?.collection;
-        const targetSlug = (collectionAction?.enabled && collectionAction.slug) ? collectionAction.slug : slug;
+        // The form's project scope, as the form routes check it: a user confined to
+        // other projects must not read or change this form's submissions.
+        if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
+        const targetSlug = submissionsCollectionFor(form);
 
         // A form whose backing collection has not been provisioned yet simply
         // has no submissions - return an empty list rather than a 404 so the
@@ -541,7 +570,7 @@ export async function formsRoutes(fastify) {
 
         // listEntries returns { entries, total, page, limit } - unwrap to the
         // array. Newest-first is the conventional display order.
-        const { entries } = await listEntries(targetSlug, { limit: 0 });
+        const entries = await submissionsOf(form);
         return [...entries].reverse();
     });
 
@@ -556,10 +585,14 @@ export async function formsRoutes(fastify) {
         } catch {
             return reply.status(404).send({ error: 'Form not found.' });
         }
+        // The form's project scope, as the form routes check it: a user confined to
+        // other projects must not read or change this form's submissions.
+        if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
+        // Where the list reads them: a form whose collection action writes elsewhere
+        // exported (and cleared, and deleted from) its own-slug collection instead.
         let entries = [];
         try {
-            const r = await listEntries(slug, { limit: 0 });
-            entries = r.entries || [];
+            entries = await submissionsOf(form);
         } catch {
             // empty collection
         }
@@ -580,10 +613,12 @@ export async function formsRoutes(fastify) {
         } catch {
             return reply.status(404).send({ error: 'Form not found.' });
         }
+        // The form's project scope, as the form routes check it: a user confined to
+        // other projects must not read or change this form's submissions.
+        if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
         let entries = [];
         try {
-            const r = await listEntries(slug, { limit: 0 });
-            entries = r.entries || [];
+            entries = await submissionsOf(form);
         } catch {
             // empty
         }
@@ -597,8 +632,24 @@ export async function formsRoutes(fastify) {
     // -----------------------------------------------------------------------
     fastify.delete('/forms/:slug/submissions', canDelete, async (request, reply) => {
         const { slug } = request.params;
+        let form;
         try {
-            await clearEntries(slug);
+            form = await readForm(slug);
+        } catch {
+            return reply.status(404).send({ error: 'Form not found.' });
+        }
+        // The form's project scope, as the form routes check it: a user confined to
+        // other projects must not read or change this form's submissions.
+        if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
+        const target = submissionsCollectionFor(form);
+        try {
+            // Its own collection: clear it. A shared one: delete only this form's
+            // entries (one at a time - parallel writes to a file collection lose updates).
+            if (target === form.slug) {
+                await clearEntries(target);
+            } else {
+                for (const e of await submissionsOf(form)) await deleteEntry(target, e.id);
+            }
         } catch {
             return reply.status(404).send({ error: 'Collection not found for this form.' });
         }
@@ -610,14 +661,54 @@ export async function formsRoutes(fastify) {
     // -----------------------------------------------------------------------
     fastify.delete('/forms/:slug/submissions/:id', canDelete, async (request, reply) => {
         const { slug, id } = request.params;
+        let form;
         try {
-            await deleteEntry(slug, id);
+            form = await readForm(slug);
+        } catch {
+            return reply.status(404).send({ error: 'Form not found.' });
+        }
+        // The form's project scope, as the form routes check it: a user confined to
+        // other projects must not read or change this form's submissions.
+        if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
+        const target = submissionsCollectionFor(form);
+        try {
+            if (!isSubmissionOf(form, await getEntry(target, id))) return reply.status(404).send({ error: 'Submission not found.' });
+            await deleteEntry(target, id);
         } catch {
             return reply.status(404).send({ error: 'Submission not found.' });
         }
         return { ok: true };
     });
 
+    // -----------------------------------------------------------------------
+    // POST /forms/:slug/submissions/:id/spam - flag or unflag one submission.
+    // Merged server-side (updateEntry replaces `data` wholesale), in the field
+    // the collections spam route and the mark-as-spam context action use: `spam`.
+    // -----------------------------------------------------------------------
+    fastify.post('/forms/:slug/submissions/:id/spam', canUpdate, async (request, reply) => {
+        const { slug, id } = request.params;
+        let form;
+        try {
+            form = await readForm(slug);
+        } catch {
+            return reply.status(404).send({ error: 'Form not found.' });
+        }
+        // The form's project scope, as the form routes check it: a user confined to
+        // other projects must not read or change this form's submissions.
+        if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
+        const target = submissionsCollectionFor(form);
+        const value = request.body?.spam !== false;
+        try {
+            const existing = await getEntry(target, id);
+            if (!existing || !isSubmissionOf(form, existing)) return reply.status(404).send({ error: 'Submission not found.' });
+            const entry = await updateEntry(target, id, {...(existing.data || {}), spam: value});
+            hooks.emit('collection:entryUpdated', {slug: target, entryId: entry.id, data: entry.data, userId: request.user?.id || null});
+            return {entry, spam: value};
+        } catch (err) {
+            return reply.status(/not found/i.test(err.message) ? 404 : 400).send({ error: err.message });
+        }
+    });
+
     /*
      * POST /forms/submit/:slug - public form submission.
      *

package/server/routes/api/layouts.js

@@ -7,9 +7,16 @@
  * DELETE /api/layouts/:key   - delete a preset (builtin presets cannot be deleted)
  * GET    /api/layouts/options - get layout options
  * PUT    /api/layouts/options - save layout options
+ * GET    /api/layouts/_usage  - which pages use each layout, and which use one that is gone
+ * GET    /api/layouts/_count  - the sidebar badge: pages whose layout no longer exists
+ *
+ * `_` is outside the key alphabet (slugify below), so no layout can shadow the last two.
  */
 import {getConfig, saveConfig} from '../../config.js';
-import {authenticate, requirePermission} from '../../middleware/auth.js';
+import {
+    authenticate as defaultAuthenticate,
+    requirePermission as defaultRequirePermission
+} from '../../middleware/auth.js';
 
 const VALID_WIDTHS = new Set(['narrow', 'normal', 'wide', 'full']);
 const BG_COLOR_RE = /^[a-zA-Z0-9#(),.\s%/-]+$/;
@@ -78,7 +85,74 @@ function sanitisePreset(data) {
     };
 }
 
-export async function layoutsRoutes(fastify) {
+/**
+ * Which pages use each layout. A page names its layout in frontmatter
+ * (`layout: key`); none means `default`. A page naming a layout that no longer
+ * exists is rendered with the default one (renderer.js: presets[page.layout] ||
+ * presets.default) - nothing says so, which is what `missing` is for.
+ *
+ * @param {Record<string, object>} presets
+ * @param {{urlPath: string, title?: string, status?: string, layout?: string}[]} pages
+ * @returns {{byKey: Record<string, {urlPath, title, status}[]>, missing: {urlPath, title, status, layout}[]}}
+ */
+export function layoutUsage(presets = {}, pages = []) {
+    const byKey = Object.fromEntries(Object.keys(presets).map(k => [k, []]));
+    const missing = [];
+    for (const p of pages) {
+        const key = typeof p.layout === 'string' && p.layout.trim() ? p.layout.trim() : 'default';
+        const item = {urlPath: p.urlPath, title: p.title || p.urlPath, status: p.status || 'published'};
+        if (byKey[key]) byKey[key].push(item);
+        else missing.push({...item, layout: key});
+    }
+    return {byKey, missing};
+}
+
+/**
+ * The sidebar badge on Layouts: pages that name a layout which no longer
+ * exists (they quietly show as Default). A count of layouts would be noise -
+ * nothing needs doing about it - so this answers 0 (no badge) until something
+ * is wrong. Plain text throughout: the popover sets it with textContent.
+ *
+ * @param {Record<string, object>} presets
+ * @param {ReturnType<typeof layoutUsage>} usage
+ */
+export function layoutsBadge(presets = {}, usage = {byKey: {}, missing: []}) {
+    const all = Object.values(presets);
+    const builtin = all.filter(p => p.builtin).length;
+    const missing = usage.missing || [];
+    const inUse = Object.values(usage.byKey || {}).filter(list => list.length).length;
+    const n = missing.length;
+    return {
+        count: n,
+        label: n
+            ? `${n} page${n === 1 ? '' : 's'} use${n === 1 ? 's' : ''} a layout that no longer exists`
+            : `${all.length} layout${all.length === 1 ? '' : 's'}, every page's layout exists`,
+        tone: 'attention',
+        details: {
+            title: 'Layouts',
+            rows: [
+                {label: 'Layouts', value: `${all.length} (${builtin} built in)`},
+                {label: 'In use', value: String(inUse)},
+                {label: 'Pages on a missing layout', value: String(n), ...(n && {tone: 'danger'})}
+            ],
+            items: missing.slice(0, 8).map(p => ({
+                text: String(p.title || p.urlPath),
+                meta: `${p.urlPath} · "${p.layout}" is gone - showing as Default`,
+                tone: 'danger'
+            })),
+            empty: "Every page's layout exists."
+        }
+    };
+}
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {{authenticate?: Function, requirePermission?: Function, listPages?: Function}} [opts] - DI for tests
+ */
+export async function layoutsRoutes(fastify, opts = {}) {
+    const authenticate      = opts.authenticate      || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+    const listPages = opts.listPages || (async () => (await import('../../services/content.js')).listPages());
     // ── Merge-in seeding: ensure built-in presets exist ──────────────────────
     const existing = getConfig('presets') || {};
     let seeded = false;
@@ -174,6 +248,23 @@ export async function layoutsRoutes(fastify) {
         return {success: true};
     });
 
+    // ── Usage and the sidebar badge ──────────────────────────────────────────
+    const usageNow = async () => layoutUsage(getConfig('presets') || {}, await listPages().catch(() => []));
+
+    fastify.get('/layouts/_usage', canRead, async () => usageNow());
+
+    // Polled every minute from every open admin tab, and reading every page is not
+    // free: the answer is kept a minute (the screen's own _usage always reads afresh).
+    let badgeCache = {at: 0, key: '', value: null};
+    fastify.get('/layouts/_count', canRead, async () => {
+        const presets = getConfig('presets') || {};
+        const key = Object.keys(presets).sort().join('|');
+        if (!badgeCache.value || badgeCache.key !== key || Date.now() - badgeCache.at > 60_000) {
+            badgeCache = {at: Date.now(), key, value: layoutsBadge(presets, await usageNow())};
+        }
+        return badgeCache.value;
+    });
+
     // ── Layout options ────────────────────────────────────────────────────────
     fastify.get('/layouts/options', canRead, async () => {
         return getConfig('site')?.layoutOptions ?? {spacerSize: 8};

package/server/routes/api/notifications.js

@@ -3,7 +3,11 @@
  * POST   /api/system/notifications              - Manager push (requireManager)
  * GET    /api/system/notifications              - List active notifications (admin/manager)
  * GET    /api/system/notifications/unread-count - Unread count for bell badge
+ * GET    /api/system/notifications/_count       - The sidebar badge (unread, with a popover)
  * POST   /api/system/notifications/:id/read     - Mark read (idempotent)
+ * POST   /api/system/notifications/:id/unread   - Mark unread again (idempotent)
+ * POST   /api/system/notifications/dismiss-all  - Dismiss every active one, for this user
+ * POST   /api/system/notifications/read-all     - Mark every active one read, for this user
  * POST   /api/system/notifications/:id/dismiss  - Mark dismissed
  * DELETE /api/system/notifications/:id          - Hard delete (admin only)
  */
@@ -12,6 +16,7 @@ import {
     requirePermission as defaultRequirePermission
 } from '../../middleware/auth.js';
 import { requireManager } from '../../middleware/managerAuth.js';
+import { randomUUID } from 'crypto';
 import { getAdapter } from '../../services/adapterRegistry.js';
 
 const SLUG = 'notifications';
@@ -45,6 +50,18 @@ function notificationData(entry, log) {
     return null;
 }
 
+/**
+ * Write a notification's payload back as a whole entry - `{id, data, meta}`.
+ *
+ * The adapter's update() REPLACES the stored entry with what it is given, and
+ * until 0.76.0 these routes gave it the bare payload: marking a notification
+ * read turned it into a flat record with no id and no `data`, which the list
+ * then skipped as malformed - read once, gone for good.
+ */
+async function saveData(adapter, entry, data) {
+    return adapter.update(SLUG, entry.id, {...entry, data, meta: {...(entry.meta || {}), updatedAt: new Date().toISOString()}});
+}
+
 /**
  * Is this notification live for this user right now: not expired, not dismissed.
  *
@@ -58,6 +75,43 @@ function isActiveFor(data, userId, now) {
     return !(Array.isArray(data.dismissedBy) && data.dismissedBy.includes(userId));
 }
 
+/**
+ * The sidebar badge on Notifications (its countUrl): the unread ones - the same
+ * number the sidebar always showed there - red while any of them is critical.
+ * Plain text throughout: the popover sets it with textContent.
+ *
+ * @param {object[]} active - this user's active entries, each with `unread`
+ * @returns {{count: number, label: string, tone: string, details: object}}
+ */
+export function notificationsBadge(active = []) {
+    const unread = active.filter(e => e.unread)
+        .sort((a, b) => String(b.data.createdAt || '').localeCompare(String(a.data.createdAt || '')));
+    const sev = (e) => e.data?.severity || 'info';
+    const critical = unread.filter(e => sev(e) === 'critical').length;
+    const warning = unread.filter(e => sev(e) === 'warning').length;
+    const n = unread.length;
+    return {
+        count: n,
+        label: n ? `${n} unread notification${n === 1 ? '' : 's'}${critical ? `, ${critical} critical` : ''}` : 'No unread notifications',
+        tone: critical ? 'danger' : 'info',
+        details: {
+            title: 'Notifications',
+            rows: [
+                {label: 'Unread', value: String(n)},
+                {label: 'Critical', value: String(critical), ...(critical && {tone: 'danger'})},
+                {label: 'Warnings', value: String(warning)},
+                {label: 'In the inbox', value: String(active.length)}
+            ],
+            items: unread.slice(0, 6).map(e => ({
+                text: String(e.data.title || '(no title)').slice(0, 80),
+                meta: [sev(e), String(e.data.createdAt || '').slice(0, 10)].filter(Boolean).join(' · '),
+                ...(sev(e) === 'critical' && {tone: 'danger'})
+            })),
+            empty: 'Nothing unread.'
+        }
+    };
+}
+
 export async function notificationsRoutes(fastify, opts = {}) {
     // Injectable so tests can supply no-ops rather than a seeded roles cache -
     // the same DI pattern as menus.js, projects.js and context-menus.js.
@@ -94,17 +148,25 @@ export async function notificationsRoutes(fastify, opts = {}) {
             }
         }
 
+        // A whole entry, {id, data, meta}: the adapter stores what it is given, and
+        // before 0.76.0 this handed it the bare payload - no id, no `data` - so the
+        // list skipped every pushed notification as malformed and none ever showed.
         const adapter = await getAdapter(SLUG);
+        const now = new Date().toISOString();
         const entry = await adapter.insert(SLUG, {
-            title: title.trim(),
-            body: body.trim(),
-            severity,
-            source: 'manager',
-            link: link || null,
-            createdAt: new Date().toISOString(),
-            expiresAt: expiresAt || null,
-            readBy: [],
-            dismissedBy: []
+            id: randomUUID(),
+            data: {
+                title: title.trim(),
+                body: body.trim(),
+                severity,
+                source: 'manager',
+                link: link || null,
+                createdAt: now,
+                expiresAt: expiresAt || null,
+                readBy: [],
+                dismissedBy: []
+            },
+            meta: {createdAt: now, updatedAt: now, source: 'manager'}
         });
 
         return reply.code(201).send(entry);
@@ -147,6 +209,73 @@ export async function notificationsRoutes(fastify, opts = {}) {
         return { count };
     });
 
+    /** This user's active notifications, newest first, each flagged `unread`. */
+    async function activeFor(userId) {
+        const now = new Date().toISOString();
+        const adapter = await getAdapter(SLUG);
+        return (await adapter.all(SLUG))
+            .filter(entry => {
+                const d = notificationData(entry, fastify.log);
+                return !!d && isActiveFor(d, userId, now);
+            })
+            .map(entry => ({...entry, unread: !Array.isArray(entry.data.readBy) || !entry.data.readBy.includes(userId)}));
+    }
+
+    // --- Sidebar badge (static path: GET has no /:id route to shadow) ---
+    fastify.get('/system/notifications/_count', canRead, async (request) => notificationsBadge(await activeFor(request.user.id)));
+
+    // --- Dismiss everything active, for this user ---
+    fastify.post('/system/notifications/dismiss-all', canRead, async (request) => {
+        const userId = request.user.id;
+        const adapter = await getAdapter(SLUG);
+        let dismissed = 0;
+        for (const entry of await activeFor(userId)) {
+            const {unread: _u, ...stored} = entry;
+            const data = stored.data;
+            const dismissedBy = Array.isArray(data.dismissedBy) ? data.dismissedBy : [];
+            const readBy = Array.isArray(data.readBy) ? data.readBy : [];
+            await saveData(adapter, stored, {
+                ...data,
+                dismissedBy: [...dismissedBy, userId],
+                readBy: readBy.includes(userId) ? readBy : [...readBy, userId]
+            });
+            dismissed++;
+        }
+        return {ok: true, dismissed};
+    });
+
+    // --- Mark everything active read, for this user ---
+    // One request, one pass: the screen used to fire a mark-read per notification
+    // at once, and on file storage each read-modify-write overwrote the others -
+    // six marked, one stuck.
+    fastify.post('/system/notifications/read-all', canRead, async (request) => {
+        const userId = request.user.id;
+        const adapter = await getAdapter(SLUG);
+        let marked = 0;
+        for (const entry of await activeFor(userId)) {
+            if (!entry.unread) continue;
+            const {unread: _u, ...stored} = entry;
+            const readBy = Array.isArray(stored.data.readBy) ? stored.data.readBy : [];
+            await saveData(adapter, stored, {...stored.data, readBy: [...readBy, userId]});
+            marked++;
+        }
+        return {ok: true, marked};
+    });
+
+    // --- Mark unread again (idempotent) ---
+    fastify.post('/system/notifications/:id/unread', canRead, async (request, reply) => {
+        const { id } = request.params;
+        const userId = request.user.id;
+        const adapter = await getAdapter(SLUG);
+        const entry = await adapter.get(SLUG, id);
+        const data = notificationData(entry, fastify.log);
+        if (!data) return reply.code(404).send({ error: 'Notification not found.' });
+        const readBy = Array.isArray(data.readBy) ? data.readBy : [];
+        if (!readBy.includes(userId)) return { ok: true };
+        const updated = await saveData(adapter, entry, {...data, readBy: readBy.filter(u => u !== userId)});
+        return { ok: true, entry: updated };
+    });
+
     // --- Mark read (idempotent) ---
     fastify.post('/system/notifications/:id/read', canRead, async (request, reply) => {
         const { id } = request.params;
@@ -161,10 +290,7 @@ export async function notificationsRoutes(fastify, opts = {}) {
         const readBy = Array.isArray(data.readBy) ? data.readBy : [];
         if (readBy.includes(userId)) return { ok: true }; // already read - idempotent
 
-        const updated = await adapter.update(SLUG, id, {
-            ...data,
-            readBy: [...readBy, userId]
-        });
+        const updated = await saveData(adapter, entry, {...data, readBy: [...readBy, userId]});
 
         return { ok: true, entry: updated };
     });
@@ -182,7 +308,7 @@ export async function notificationsRoutes(fastify, opts = {}) {
         const dismissedBy = Array.isArray(data.dismissedBy) ? data.dismissedBy : [];
         const readBy = Array.isArray(data.readBy) ? data.readBy : [];
 
-        const updated = await adapter.update(SLUG, id, {
+        const updated = await saveData(adapter, entry, {
             ...data,
             dismissedBy: dismissedBy.includes(userId) ? dismissedBy : [...dismissedBy, userId],
             readBy: readBy.includes(userId) ? readBy : [...readBy, userId] // dismissing also marks read