domma-cms 0.75.0 → 0.77.0

package/server/routes/api/plugins.js

@@ -1,6 +1,7 @@
 /**
  * Plugins API
  * GET  /api/plugins              - list all discovered plugins + state (admin only)
+ * GET  /api/plugins/_count       - the sidebar badge (`_` is outside the slug alphabet)
  * POST /api/plugins/scaffold     - create a new plugin from plugins/_template (admin only)
  * PUT  /api/plugins/:name        - enable/disable, update settings (admin only)
  * GET  /api/plugins/admin-config - sidebar/routes/views for enabled plugins (authenticated)
@@ -14,6 +15,7 @@ import {
     getAdminPluginConfig,
     getEntitlementStates,
     getLoadedPlugins,
+    getPluginSettings,
     getPluginStates,
     isCorePlugin,
     pluginLicence,
@@ -26,7 +28,8 @@ import {deletePluginFile, listPluginFiles, readPluginFile, writePluginFile} from
 import {getConfig} from '../../config.js';
 import path from 'path';
 import {existsSync, readFileSync} from 'node:fs';
-import {installPlugin} from '../../services/pluginInstaller.js';
+import {compareVersions, installPlugin} from '../../services/pluginInstaller.js';
+import {fetchCatalogue, isManaged} from '../../services/managerClient.js';
 import {packEnvelope, readEnvelope, readManifestFromTarball, tarDirectory} from '../../services/pluginEnvelope.js';
 
 /**
@@ -95,6 +98,111 @@ function autoRestartEnabled() {
     }
 }
 
+/** Entitlement states that stop a plugin running (the loader refuses them). */
+const BLOCKING = new Set(['expired', 'unlicensed']);
+
+/**
+ * The sidebar badge on Plugins (its countUrl, GET /api/plugins/_count). The
+ * number stays what the sidebar always showed there - how many are installed -
+ * and the tone and popover say what needs doing: red while a licensed plugin
+ * that is switched on is not running, amber for an update or a licence in its
+ * grace period. Plain text throughout; the popover sets it with textContent.
+ *
+ * @param {{name, displayName, version, enabled, core, entitlement}[]} plugins
+ * @param {Map<string, string>} [latest] - slug -> newest catalogue version (managed sites only)
+ * @returns {{count, label, tone, details}}
+ */
+export function pluginsBadge(plugins = [], latest = new Map()) {
+    const name = (p) => String(p.displayName || p.name);
+    const stopped = plugins.filter(p => p.enabled && BLOCKING.has(p.entitlement));
+    const grace = plugins.filter(p => p.entitlement === 'grace');
+    const updates = plugins.filter(p => latest.has(p.name) && compareVersions(latest.get(p.name), p.version) > 0);
+    const on = plugins.filter(p => p.enabled || p.core).length;
+    const n = plugins.length;
+    const extra = [
+        stopped.length && `${stopped.length} not running`,
+        updates.length && `${updates.length} update${updates.length === 1 ? '' : 's'}`
+    ].filter(Boolean).join(', ');
+    return {
+        count: n,
+        label: `${n} plugin${n === 1 ? '' : 's'} installed${extra ? `, ${extra}` : ''}`,
+        tone: stopped.length ? 'danger' : (updates.length || grace.length) ? 'attention' : 'info',
+        details: {
+            title: 'Plugins',
+            rows: [
+                {label: 'Switched on', value: String(on)},
+                {label: 'Switched off', value: String(n - on)},
+                ...(latest.size ? [{label: 'Updates available', value: String(updates.length)}] : []),
+                ...(stopped.length ? [{label: 'Not running (licence)', value: String(stopped.length), tone: 'danger'}] : [])
+            ],
+            items: [
+                ...stopped.map(p => ({text: name(p), meta: `not running - licence ${p.entitlement}`, tone: 'danger'})),
+                ...grace.map(p => ({text: name(p), meta: 'licence ended - running in its grace period, renew'})),
+                ...updates.map(p => ({text: name(p), meta: `update ${p.version} → ${latest.get(p.name)}`}))
+            ].slice(0, 8),
+            empty: 'Everything is running and up to date.'
+        }
+    };
+}
+
+/**
+ * The newest catalogue version of each plugin, for a managed site - kept ten
+ * minutes: the badge is asked for every minute from every admin tab, and each
+ * ask would otherwise be a round trip to the manager.
+ */
+let _latest = {at: 0, value: new Map()};
+async function latestVersions() {
+    if (!isManaged()) return new Map();
+    if (Date.now() - _latest.at < 10 * 60_000) return _latest.value;
+    const catalogue = await fetchCatalogue().catch(() => []);
+    _latest = {at: Date.now(), value: new Map((catalogue || []).map(e => [e.slug, e.version]))};
+    return _latest.value;
+}
+
+/**
+ * Plugin settings reach the admin browser (the Marketplace's Configure form), so
+ * a value whose key looks secret - a DVLA key, an SMTP password, a connection
+ * URI - is sent as SETTING_MASK instead. Saving sends the mask back for any
+ * secret left untouched, and restoreMasked() puts the stored value back; a
+ * mask with nothing stored behind it (a config.js default) is dropped, so the
+ * default still applies. Same rule as isSecretKey() in admin/js/lib/plugins-arrange.js.
+ */
+export const SETTING_MASK = '\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022';
+const SECRET_KEY = /pass(word)?|secret|token|api[-_]?key|private|credential|uri$|dsn/i;
+
+/** @param {Set<string>} [secretKeys] - keys a plugin's settingsSchema marks `secret: true` */
+export function maskSettings(value, key = '', secretKeys = new Set()) {
+    // An array's strings are secret when its key is (apiKeys: ['a', 'b']).
+    if (Array.isArray(value)) return value.map(v => maskSettings(v, key, secretKeys));
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, maskSettings(v, k, secretKeys)]));
+    }
+    const secret = SECRET_KEY.test(key) || secretKeys.has(key);
+    return secret && typeof value === 'string' && value !== '' ? SETTING_MASK : value;
+}
+
+const schemaSecrets = (manifest) => new Set((Array.isArray(manifest.settingsSchema) ? manifest.settingsSchema : [])
+    .filter(f => f && f.secret === true && typeof f.key === 'string').map(f => f.key));
+
+export function restoreMasked(incoming, stored) {
+    // Arrays by position: maskSettings masks inside them too ({accounts: [{password}]}),
+    // and returning the array as sent stored the mask over the real value.
+    if (Array.isArray(incoming)) {
+        const before = Array.isArray(stored) ? stored : [];
+        return incoming.map((v, i) => (v === SETTING_MASK ? (before[i] ?? '') : restoreMasked(v, before[i])));
+    }
+    if (incoming && typeof incoming === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(incoming)) {
+            const before = stored && typeof stored === 'object' ? stored[k] : undefined;
+            if (v === SETTING_MASK) { if (before !== undefined) out[k] = before; continue; }
+            out[k] = restoreMasked(v, before);
+        }
+        return out;
+    }
+    return incoming;
+}
+
 export async function pluginsRoutes(fastify, opts = {}) {
     const authenticate      = opts.authenticate      || defaultAuthenticate;
     const requirePermission = opts.requirePermission || defaultRequirePermission;
@@ -114,7 +222,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
         const loadedPlugins = getLoadedPlugins();
         const entitlementStates = getEntitlementStates();
 
-        return manifests.map(manifest => ({
+        return Promise.all(manifests.map(async manifest => ({
             name: manifest.name,
             displayName: manifest.displayName || manifest.name,
             version: manifest.version || '1.0.0',
@@ -143,8 +251,30 @@ export async function pluginsRoutes(fastify, opts = {}) {
             // Enabled but displaced by another plugin that replaces it. Shown
             // so the screen can explain the inactivity instead of looking broken.
             supersededBy: loadedPlugins[manifest.name]?.supersededBy ?? null,
-            settings: states[manifest.name]?.settings || {}
+            settings: maskSettings(states[manifest.name]?.settings || {}, '', schemaSecrets(manifest)),
+            // What Configure edits: an optional plugin.json `settingsSchema`
+            // ([{key, label, type: text|number|select|boolean, options, min,
+            // max, help}]), else the plugin's config.js defaults merged with the
+            // stored overrides (`effectiveSettings`) - so every plugin with a
+            // config.js can be configured, not only one that declared a schema
+            // (none ever had, so the old Settings button never appeared).
+            settingsSchema: Array.isArray(manifest.settingsSchema) ? manifest.settingsSchema : null,
+            effectiveSettings: maskSettings(await getPluginSettings(manifest.name).catch(() => ({})), '', schemaSecrets(manifest))
+        })));
+    });
+
+    // The sidebar badge. Registered with the other static /plugins/* routes;
+    // `_` is outside the plugin slug alphabet, so no plugin can shadow it.
+    fastify.get('/plugins/_count', canRead, async () => {
+        const manifests = await discoverPlugins();
+        const states = getPluginStates();
+        const ent = getEntitlementStates();
+        const plugins = manifests.map(m => ({
+            name: m.name, displayName: m.displayName || m.name, version: m.version || '1.0.0',
+            core: isCorePlugin(m.name), enabled: isCorePlugin(m.name) || !!states[m.name]?.enabled,
+            entitlement: ent[m.name] ?? null
         }));
+        return pluginsBadge(plugins, await latestVersions());
     });
 
     // Scaffold a new plugin from plugins/_template. The plugin is created
@@ -183,7 +313,8 @@ export async function pluginsRoutes(fastify, opts = {}) {
         const prevState = getPluginStates()[name] || {};
         const update = {};
         if (enabled !== undefined) update.enabled = !!enabled;
-        if (settings !== undefined) update.settings = settings;
+        // A secret sent back as the mask keeps its stored value (see maskSettings).
+        if (settings !== undefined) update.settings = restoreMasked(settings, prevState.settings || {});
         savePluginState(name, update);
 
         if (!prevState.enabled && !!enabled) {

package/server/routes/api/roles.js

@@ -0,0 +1,111 @@
+/**
+ * Roles - the screen's own routes. Role records themselves are the preset
+ * `roles` collection and are read and written through the collections API
+ * (`/api/collections/roles/entries`, with keepRoleSystemFields); these add
+ * what that API cannot say.
+ *
+ * GET /api/roles/_holders  - who holds each role: {counts: {name: n}, orphans: [...]}
+ * GET /api/roles/_count    - the sidebar badge on Roles
+ *
+ * The underscore keeps both clear of any role name (role names are slugs).
+ * Guarded like the list they sit beside: `collections` read.
+ */
+import {
+    authenticate as defaultAuthenticate,
+    requirePermission as defaultRequirePermission
+} from '../../middleware/auth.js';
+import {listEntries} from '../../services/collections.js';
+import {listUsers} from '../../services/users.js';
+
+const plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+
+/**
+ * How many users hold each role - primary or additional - and which users
+ * hold a role that no longer exists (they fall back to the least-privileged
+ * role until an admin fixes them).
+ *
+ * @param {object[]} users
+ * @param {string[]} roleNames - the roles that exist
+ * @returns {{counts: Record<string, number>, orphans: {role: string}[]}} - one orphan per user-role pair
+ */
+export function roleHolders(users = [], roleNames = []) {
+    const known = new Set(roleNames);
+    const counts = Object.fromEntries(roleNames.map(n => [n, 0]));
+    const orphans = [];
+    for (const u of users) {
+        const held = [...new Set([u.role, ...(Array.isArray(u.additionalRoles) ? u.additionalRoles : [])].filter(Boolean))];
+        for (const r of held) {
+            if (known.has(r)) counts[r]++;
+            // The role only - who they are is Users' business (users.read), not
+            // something to hand to anyone who can read the roles list.
+            else orphans.push({role: r});
+        }
+    }
+    return {counts, orphans};
+}
+
+/**
+ * The badge: how many roles (an inventory - the number never alarms), red
+ * while any user holds a role that no longer exists. Plain text throughout;
+ * the sidebar popover sets it with textContent.
+ *
+ * @param {{name: string, label?: string, level: number, plugin?: string}[]} roles
+ * @param {{counts: Record<string, number>, orphans: {user: string, role: string}[]}} holders
+ */
+export function rolesBadge(roles = [], {counts = {}, orphans = []} = {}) {
+    const n = roles.length;
+    const fromPlugins = roles.filter(r => r.plugin).length;
+    const unused = roles.filter(r => r.level !== 0 && !counts[r.name]).length;
+    const sorted = [...roles].sort((a, b) => (a.level ?? 99) - (b.level ?? 99) || String(a.name).localeCompare(String(b.name)));
+    return {
+        count: n,
+        label: orphans.length
+            ? `${plural(orphans.length, 'user')} ${orphans.length === 1 ? 'holds' : 'hold'} a role that no longer exists`
+            : `${plural(n, 'role')}${fromPlugins ? `, ${fromPlugins} from plugins` : ''}`,
+        tone: orphans.length ? 'danger' : 'info',
+        details: {
+            title: 'Roles',
+            rows: [
+                {label: 'Roles', value: String(n)},
+                {label: 'From plugins', value: String(fromPlugins)},
+                {label: 'Held by nobody', value: String(unused)},
+                ...(orphans.length ? [{label: 'Users on a missing role', value: String(orphans.length), tone: 'danger'}] : [])
+            ],
+            items: orphans.length
+                ? Object.entries(orphans.reduce((m, o) => ({...m, [o.role]: (m[o.role] || 0) + 1}), {})).slice(0, 8)
+                    .map(([role, k]) => ({text: `"${role}"`, meta: `no longer exists - ${plural(k, 'user')} still ${k === 1 ? 'holds' : 'hold'} it`, tone: 'danger'}))
+                : sorted.slice(0, 8).map(r => ({
+                    text: String(r.label || r.name),
+                    meta: `level ${r.level} · ${plural(counts[r.name] || 0, 'user')}${r.plugin ? ` · ${r.plugin}` : ''}`
+                })),
+            empty: 'No roles.'
+        }
+    };
+}
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {{authenticate?: Function, requirePermission?: Function}} [opts]
+ */
+export async function rolesRoutes(fastify, opts = {}) {
+    const authenticate      = opts.authenticate      || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+    // `plugins`: the permission the Roles sidebar entry (and menu item) asks for, so
+    // whoever sees the entry can read its badge - with `collections` it 403'd every minute.
+    const canRead = {preHandler: [authenticate, requirePermission('plugins', 'read')]};
+
+    const current = async () => {
+        // The collection's entries, not the role cache: the cache drops `plugin`.
+        const {entries} = await listEntries('roles', {limit: 0});
+        const roles = entries.map(e => e.data || {}).filter(r => r.name);
+        const holders = roleHolders(await listUsers().catch(() => []), roles.map(r => r.name));
+        return {roles, holders};
+    };
+
+    fastify.get('/roles/_holders', canRead, async () => (await current()).holders);
+
+    fastify.get('/roles/_count', canRead, async () => {
+        const {roles, holders} = await current();
+        return rolesBadge(roles, holders);
+    });
+}

package/server/routes/api/search.js

@@ -4,17 +4,35 @@
  * GET  /api/search?q=…      - public: full-text search across published pages
  * GET  /api/search/settings - public: the search UI's own configuration
  * PUT  /api/search/settings - admin-only: save it
+ * GET  /api/search/preview?q=…&max=… - admin-only: the Search screen's "Try it" -
+ *        the same search, run with the max-results being edited (not yet saved)
+ *        and without the minimum length, so a setting can be tried before Save
+ * GET  /api/search/_count   - admin-only: the sidebar badge (searchBadge)
  *
  * The public settings endpoint is kept for anything already calling it (and
  * for a page served from a cache older than the feature), but it is no longer
  * on the critical path: the renderer embeds the same object in the page as
  * `window.__CMS_SEARCH__`, so the overlay can draw itself without a round trip.
  */
-import {authenticate, requireAdmin} from '../../middleware/auth.js';
+import {authenticate as defaultAuthenticate, requireAdmin as defaultRequireAdmin,
+    requirePermission as defaultRequirePermission} from '../../middleware/auth.js';
 import {listPages} from '../../services/content.js';
-import {getSearchSettings, saveSearchSettings, searchPages} from '../../services/search.js';
+import {getSearchSettings, saveSearchSettings, searchBadge, searchCoverage, searchPages} from '../../services/search.js';
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {{authenticate?: Function, requireAdmin?: Function}} [opts] - DI for tests
+ */
+export async function searchRoutes(fastify, opts = {}) {
+    const authenticate = opts.authenticate || defaultAuthenticate;
+    const requireAdmin = opts.requireAdmin || defaultRequireAdmin;
+    const adminOnly = {preHandler: [authenticate, requireAdmin]};
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+    // The badge follows the Search sidebar entry's own permission (settings), so whoever
+    // sees the entry can read it - admin-only, it 403'd every minute for the rest. It
+    // tells nothing a visitor's search does not: public pages only.
+    const canReadBadge = {preHandler: [authenticate, requirePermission('settings', 'read')]};
 
-export async function searchRoutes(fastify) {
     fastify.get('/search', async (request, reply) => {
         const settings = getSearchSettings();
         const q = (request.query.q || '').trim();
@@ -37,7 +55,23 @@ export async function searchRoutes(fastify) {
 
     fastify.get('/search/settings', async () => getSearchSettings());
 
-    fastify.put('/search/settings', {preHandler: [authenticate, requireAdmin]}, async (request) => {
+    fastify.put('/search/settings', adminOnly, async (request) => {
         return {ok: true, settings: saveSearchSettings(request.body || {})};
     });
+
+    fastify.get('/search/preview', adminOnly, async (request, reply) => {
+        const q = String(request.query.q || '').trim().slice(0, 200);
+        if (!q) return reply.status(400).send({error: 'Type something to search for'});
+        const settings = getSearchSettings();
+        const asked = parseInt(request.query.max, 10);
+        const maxResults = Number.isFinite(asked) ? Math.min(50, Math.max(1, asked)) : settings.maxResults;
+        const pages = await listPages();
+        const results = searchPages(pages, q, {
+            maxResults,
+            onError: (err, page) => request.log.warn({err, page: page.urlPath}, '[search] skipped an unreadable page')
+        });
+        return {q, maxResults, results, coverage: searchCoverage(pages)};
+    });
+
+    fastify.get('/search/_count', canReadBadge, async () => searchBadge(getSearchSettings(), await listPages()));
 }

package/server/routes/api/settings.js

@@ -3,6 +3,7 @@
  * GET  /api/settings            - get site settings
  * PUT  /api/settings            - save site settings
  * POST /api/settings/test-email - send a test email using stored SMTP config
+ * GET  /api/settings/_count     - the sidebar badge: what is wrong with the settings
  */
 import {getConfig, saveConfig} from '../../config.js';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
@@ -18,6 +19,50 @@ const CUSTOM_CSS_FILE = path.resolve(__dirname, '../../../content/custom.css');
 const CONNECTIONS_FILE = path.resolve(__dirname, '../../../config/connections.json');
 const CUSTOM_CSS_MAX = 100 * 1024; // 100 KB
 
+/**
+ * The sidebar badge on Site Settings (its countUrl): the settings that are
+ * quietly wrong, worst first - chiefly no SMTP host, where the CMS sends every
+ * mail to a throwaway test inbox that accepts it and reports success, so
+ * nothing else in the admin looks wrong. Nothing wrong = no badge. The same
+ * rules as settingsProblems() in admin/js/lib/site-settings-arrange.js.
+ * Plain text throughout - the popover sets it with textContent.
+ *
+ * @param {object} site - config/site.json
+ * @param {{enabled?: boolean, driver?: string}} [cacheStats]
+ */
+export function settingsBadge(site = {}, cacheStats = {}) {
+    const smtp = site.smtp || {};
+    const cc = site.cookieConsent || {};
+    const problems = [];
+    if (!String(smtp.host || '').trim()) {
+        problems.push({tone: 'danger', text: 'No SMTP host', meta: 'mail goes to a test inbox and reaches no one'});
+    } else if (!String(smtp.fromAddress || '').trim()) {
+        problems.push({tone: 'warn', text: 'No From address', meta: 'mail has no sender; many servers refuse it'});
+    }
+    if (cc.enabled !== false && !String(cc.privacyPolicyUrl || '').trim()) {
+        problems.push({tone: 'warn', text: 'Cookie banner without a privacy policy', meta: 'it links to nothing'});
+    }
+    const danger = problems.some(p => p.tone === 'danger');
+    const n = problems.length;
+    return {
+        count: n,
+        label: n ? `${n} setting${n === 1 ? '' : 's'} need${n === 1 ? 's' : ''} attention` : 'Settings look fine',
+        tone: danger ? 'danger' : 'attention',
+        details: {
+            title: 'Site Settings',
+            rows: [
+                {label: 'Site title', value: String(site.title || '-')},
+                {label: 'Admin home', value: String(site.adminHome || '/')},
+                {label: 'Email', value: smtp.host ? String(smtp.host) : 'not configured', ...(!smtp.host && {tone: 'danger'})},
+                {label: 'Cookie banner', value: cc.enabled !== false ? 'on' : 'off'},
+                {label: 'Cache', value: cacheStats.enabled ? `on (${cacheStats.driver || 'memory'})` : 'off'}
+            ],
+            items: problems.map(p => ({text: p.text, meta: p.meta, ...(p.tone === 'danger' && {tone: 'danger'})})),
+            empty: 'Nothing needs attention.'
+        }
+    };
+}
+
 export async function settingsRoutes(fastify) {
     const canRead = {preHandler: [authenticate, requirePermission('settings', 'read')]};
     const canUpdate = {preHandler: [authenticate, requirePermission('settings', 'update')]};
@@ -112,6 +157,13 @@ export async function settingsRoutes(fastify) {
         }
     });
 
+    // The sidebar badge. `_count` sits beside fixed paths only - nothing can shadow it.
+    fastify.get('/settings/_count', canRead, async () => {
+        let stats = {};
+        try { stats = cache.getStats(); } catch { /* no cache - reported off */ }
+        return settingsBadge(getConfig('site') || {}, stats);
+    });
+
     // GET /api/settings/db-status - returns whether MongoDB connections are configured
     fastify.get('/settings/db-status', canRead, async () => {
         try {

package/server/routes/api/users.js

@@ -1,6 +1,7 @@
 /**
  * Users API
  * GET    /api/users      - list all users (admin, manager)
+ * GET    /api/users/_count - the sidebar badge (ids are uuids - nothing can shadow it)
  * GET    /api/users/:id  - single user (admin, manager, or self)
  * POST   /api/users      - create user (admin, manager - manager cannot create admin)
  * PUT    /api/users/:id  - update user (admin, manager - manager cannot edit admin)
@@ -10,6 +11,45 @@ import {authenticate, canManageUser, requirePermission} from '../../middleware/a
 import {getPermissionsFor} from '../../services/roles.js';
 import {createUser, deleteUser, getUserById, listUsers, updateUser} from '../../services/users.js';
 import {getProfile, listProfiles, updateProfile} from '../../services/userProfiles.js';
+import {ago, clip, plural} from '../../services/sidebarBadges.js';
+
+/**
+ * The sidebar badge on Users (its countUrl, GET /api/users/_count). The number
+ * stays what the sidebar has always shown there - the users this reader can
+ * see - and the popover says who is inactive, who has never signed in, and
+ * who signed in last. Plain text throughout (the popover uses textContent);
+ * never anything from the password or tokens.
+ *
+ * @param {object[]} users - as the list route returns them (password stripped)
+ * @param {number} [now]
+ */
+export function usersBadge(users = [], now = Date.now()) {
+    const list = users || [];
+    const inactive = list.filter(u => u.isActive === false);
+    const never = list.filter(u => !u.lastLogin);
+    const week = list.filter(u => u.lastLogin && now - new Date(u.lastLogin).getTime() < 7 * 86_400_000);
+    const recent = list.filter(u => u.lastLogin)
+        .sort((a, b) => String(b.lastLogin).localeCompare(String(a.lastLogin)));
+    return {
+        count: list.length,
+        label: `${plural(list.length, 'user')}${inactive.length ? `, ${inactive.length} inactive` : ''}`,
+        tone: 'info',
+        details: {
+            title: 'Users',
+            rows: [
+                {label: 'Active', value: String(list.length - inactive.length)},
+                {label: 'Inactive', value: String(inactive.length)},
+                {label: 'Signed in this week', value: String(week.length)},
+                {label: 'Never signed in', value: String(never.length)}
+            ],
+            items: recent.slice(0, 6).map(u => ({
+                text: clip(u.name || u.email || 'User'),
+                meta: [u.role, `signed in ${ago(u.lastLogin, now)}`].filter(Boolean).join(' · ')
+            })),
+            empty: 'Nobody has signed in yet.'
+        }
+    };
+}
 
 export async function usersRoutes(fastify) {
     const canRead = [authenticate, requirePermission('users', 'read')];
@@ -27,6 +67,12 @@ export async function usersRoutes(fastify) {
             .map(u => ({...u, profile: profiles.get(u.id) || {}}));
     });
 
+    // The sidebar badge - the same users the list shows this reader. Before /users/:id.
+    fastify.get('/users/_count', {preHandler: canRead}, async (request) => {
+        const {canSeeArtefact} = await import('../../services/projects.js');
+        return usersBadge((await listUsers()).filter(u => canSeeArtefact(request.user, u)));
+    });
+
     // Get single user (admin, manager, or the user themselves)
     fastify.get('/users/:id', { preHandler: [authenticate] }, async (request, reply) => {
         const { id } = request.params;
@@ -73,12 +119,22 @@ export async function usersRoutes(fastify) {
             }
         }
 
+        // Everything the editor sets arrives in this one request: a follow-up PUT that
+        // failed would leave the account unrestricted and switched on.
+        const {projects, meta, isActive, profile} = request.body || {};
+        let user;
         try {
-            const user = await createUser({ name, email, password, role: targetRole, additionalRoles: requestedAdditional });
-            return reply.status(201).send(user);
+            user = await createUser({
+                name, email, password, role: targetRole, additionalRoles: requestedAdditional,
+                ...(Array.isArray(projects) && {projects: projects.filter(p => typeof p === 'string' && p)}),
+                ...(meta && typeof meta === 'object' && !Array.isArray(meta) && {meta}),
+                isActive: isActive !== false
+            });
         } catch (err) {
             return reply.status(409).send({ error: err.message });
         }
+        if (profile && typeof profile === 'object' && !Array.isArray(profile)) await updateProfile(user.id, profile);
+        return reply.status(201).send(user);
     });
 
     // Update user
@@ -119,7 +175,13 @@ export async function usersRoutes(fastify) {
 
         // Strip profile from core updates and handle separately
         const {profile, ...coreUpdates} = updates;
-        const user = await updateUser(id, coreUpdates);
+        let user;
+        try {
+            user = await updateUser(id, coreUpdates);
+        } catch (err) {
+            if (err.code === 'EMAIL_TAKEN') return reply.status(409).send({error: err.message});
+            throw err;
+        }
 
         if (profile && typeof profile === 'object') {
             await updateProfile(id, profile);

package/server/routes/api/views.js

@@ -9,16 +9,38 @@
  * PUT    /views/:slug               - Update view config
  * DELETE /views/:slug               - Delete view config
  * GET    /views/:slug/execute       - Execute view (admin)
+ * POST   /views/_preview            - Run an UNSAVED config (the editor's Results): {source, connection, stages, limit}
  * GET    /views/collection/:slug    - List views targeting a collection
  *
  * Public endpoint (role-checked per view access config):
  * GET    /views/:slug/public        - Execute view publicly
  */
-import {createView, deleteView, executeView, getView, listViews, updateView, viewsBadge} from '../../services/views.js';
+import {createView, deleteView, executeView, executeViewConfig, getView, listViews, updateView, viewsBadge} from '../../services/views.js';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
 import {getRoleLevel} from '../../services/roles.js';
 import {getEffectiveLevel} from '../../services/userRoles.js';
 
+/**
+ * Every collection a pipeline's $lookup stages read, as slugs (`cms_` stripped - Mongo-authored views
+ * name collections that way). Takes the editor's `{type: '$lookup', config}` stages and raw Mongo
+ * `{$lookup: {...}}` alike, and walks nested pipelines: a Mongo `$lookup` can carry its own.
+ */
+export function lookupSources(stages) {
+    const out = new Set();
+    const walk = (node) => {
+        if (Array.isArray(node)) { node.forEach(walk); return; }
+        if (!node || typeof node !== 'object') return;
+        const add = (cfg) => { if (typeof cfg?.from === 'string' && cfg.from) out.add(cfg.from.replace(/^cms_/, '')); };
+        if (node.type === '$lookup') add(node.config);
+        for (const [key, value] of Object.entries(node)) {
+            if (key === '$lookup') add(value);
+            walk(value);
+        }
+    };
+    walk(stages);
+    return [...out];
+}
+
 /** Every collection by slug - a missing one is a view whose source was deleted. */
 async function collectionsBySlug() {
     const {listCollections} = await import('../../services/collections.js');
@@ -135,6 +157,38 @@ export async function viewsRoutes(fastify) {
         }
     });
 
+    // -------------------------------------------------------------------------
+    // Preview an unsaved config (the view editor's Results tab)
+    // -------------------------------------------------------------------------
+    //
+    // `update`, not `read`: running an arbitrary pipeline reads the source
+    // collection, which is what making a view does. The source must be one this
+    // user may see (project scope), and it runs as an admin preview - no
+    // row-level filter, the same as executing a saved view from the admin.
+    // `_` is outside the slug alphabet, so no view can shadow the route.
+    fastify.post('/views/_preview', canUpdate, async (request, reply) => {
+        const {source, connection = 'default', stages = [], limit} = request.body || {};
+        if (typeof source !== 'string' || !source) return reply.status(400).send({error: 'Choose a source collection'});
+        if (!Array.isArray(stages)) return reply.status(400).send({error: 'stages must be an array'});
+        const {getCollection} = await import('../../services/collections.js');
+        const {canSeeArtefact} = await import('../../services/projects.js');
+        const schema = await getCollection(source).catch(() => null);
+        if (!schema) return reply.status(404).send({error: `Collection "${source}" not found`});
+        if (!canSeeArtefact(request.user, schema)) return reply.status(403).send({error: 'Forbidden'});
+        // A $lookup reads its `from` collection too - the same project check applies.
+        for (const from of lookupSources(stages)) {
+            const joined = await getCollection(from).catch(() => null);
+            if (joined && !canSeeArtefact(request.user, joined)) return reply.status(403).send({error: 'Forbidden'});
+        }
+        const n = Math.min(Math.max(parseInt(limit, 10) || 10, 1), 50);
+        try {
+            return await executeViewConfig({connection, pipeline: {source, stages}, access: {rowLevel: null}},
+                {page: 1, limit: n, user: request.user || null});
+        } catch (err) {
+            return reply.status(400).send({error: err.message});
+        }
+    });
+
     // -------------------------------------------------------------------------
     // Public execute (role-checked per view access config)
     // -------------------------------------------------------------------------

package/server/server.js

@@ -440,6 +440,7 @@ const {menusRoutes}         = await import('./routes/api/menus.js');
 const {contextMenusRoutes}  = await import('./routes/api/context-menus.js');
 const {menuLocationsRoutes} = await import('./routes/api/menu-locations.js');
 const {projectsRoutes}      = await import('./routes/api/projects.js');
+const {rolesRoutes}         = await import('./routes/api/roles.js');
 const {apiTokensRoutes}     = await import('./routes/api/api-tokens.js');
 const {apiEndpointsRoutes}  = await import('./routes/api/api-endpoints.js');
 const {endpointsPublicRoutes} = await import('./routes/api/endpoints-public.js');
@@ -475,6 +476,7 @@ await app.register(contextMenusRoutes,  {prefix: '/api'});
 await app.register(themeRoutes,         {prefix: '/api'});
 await app.register(menuLocationsRoutes, {prefix: '/api'});
 await app.register(projectsRoutes,      {prefix: '/api'});
+await app.register(rolesRoutes,         {prefix: '/api'});
 await app.register(apiTokensRoutes,     {prefix: '/api'});
 await app.register(apiEndpointsRoutes,  {prefix: '/api'});
 await app.register(endpointsPublicRoutes, {prefix: '/api'});
@@ -544,6 +546,16 @@ registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'Actions',
 registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'API Builder', url: '#/api-endpoints', icon: 'code', permission: 'api-endpoints', countUrl: '/api/api-endpoints/_count', inventory: true}});
 registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'Blocks', url: '#/blocks', icon: 'box', permission: 'pages', countUrl: '/api/blocks/_count', inventory: true}});
 registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'Components', url: '#/components', icon: 'component', permission: 'components', countUrl: '/api/components/_count', inventory: true}});
+// System. Notifications, Site Settings, Layouts and API Tokens are signals (unread, something quietly
+// wrong, pages on a missing layout, tokens expiring), so not `inventory`.
+registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Notifications', url: '#/system/notifications', icon: 'bell', permission: 'notifications', countUrl: '/api/system/notifications/_count'}});
+registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Roles', url: '#/roles', icon: 'shield', permission: 'plugins', countUrl: '/api/roles/_count', inventory: true}});
+registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Users', url: '#/users', icon: 'users', permission: 'users', countUrl: '/api/users/_count', inventory: true}});
+registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Site Settings', url: '#/settings', icon: 'settings', permission: 'settings', countUrl: '/api/settings/_count'}});
+registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Layouts', url: '#/layouts', icon: 'layout', permission: 'layouts', countUrl: '/api/layouts/_count'}});
+registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Plugins', url: '#/plugins', icon: 'package', permission: 'plugins', countUrl: '/api/plugins/_count', inventory: true}});
+registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'API Tokens', url: '#/api-tokens', icon: 'key', permission: 'api-tokens', countUrl: '/api/api-tokens/_count'}});
+registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Search', url: '#/search', icon: 'search', permission: 'settings', countUrl: '/api/search/_count', inventory: true}});
 
 await registerPlugins(app);