domma-cms 0.76.0 → 0.77.0

package/server/routes/api/forms.js

@@ -14,6 +14,8 @@
  *   GET    /forms/:slug/submissions/export - admin: CSV export from collection
  *   DELETE /forms/:slug/submissions        - admin: clear all submissions
  *   DELETE /forms/:slug/submissions/:id    - admin: delete one submission
+ *   POST   /forms/:slug/submissions/:id/spam - admin: flag / unflag one submission as spam {spam}
+ *   (every submissions route reads and writes submissionsCollectionFor(form))
  *   POST   /forms/submit/:slug             - public: accept submission
  *   POST   /forms/test-email               - admin: send test email
  */
@@ -29,7 +31,9 @@ import {
     createEntry,
     deleteEntry,
     getCollection,
-    listEntries
+    getEntry,
+    listEntries,
+    updateEntry
 } from '../../services/collections.js';
 import {getConfig} from '../../config.js';
 import {authenticate, requireAdmin, requirePermission} from '../../middleware/auth.js';
@@ -243,6 +247,30 @@ export function submissionsCollectionFor(form) {
     return c?.enabled && c.slug ? c.slug : form?.slug;
 }
 
+/**
+ * Whether an entry is one of THIS form's submissions. In the form's own
+ * collection, every entry is. In a collection its action shares with others
+ * (a signup form writing to `members`, two forms writing to `enquiries`), only
+ * the entries it made - submit stamps them `meta.source: 'form:<slug>'` - so
+ * that clearing, deleting, flagging, exporting or counting one form's
+ * submissions never touches the rest of that collection.
+ */
+export function isSubmissionOf(form, entry) {
+    if (submissionsCollectionFor(form) === form?.slug) return true;
+    return entry?.meta?.source === `form:${form?.slug}`;
+}
+
+async function canSeeForm(user, form) {
+    const {canSeeArtefact} = await import('../../services/projects.js');
+    return canSeeArtefact(user, form);
+}
+
+/** This form's submissions, oldest first (listEntries order). */
+async function submissionsOf(form) {
+    const r = await listEntries(submissionsCollectionFor(form), {limit: 0});
+    return (r.entries || []).filter(e => isSubmissionOf(form, e));
+}
+
 const DAY_MS = 86_400_000;
 
 /**
@@ -256,8 +284,7 @@ const DAY_MS = 86_400_000;
  */
 async function submissionStats(form, now = Date.now()) {
     try {
-        const r = await listEntries(submissionsCollectionFor(form), {limit: 0});
-        const entries = r.entries || [];
+        const entries = await submissionsOf(form);
         let week = 0;
         let today = 0;
         let last = null;
@@ -269,7 +296,7 @@ async function submissionStats(form, now = Date.now()) {
             if (now - t <= DAY_MS) today++;
             if (!last || at > last) last = at;
         }
-        return {total: r.total ?? entries.length, week, today, last};
+        return {total: entries.length, week, today, last};
     } catch {
         return {total: 0, week: 0, today: 0, last: null};
     }
@@ -530,8 +557,10 @@ export async function formsRoutes(fastify) {
         } catch {
             return reply.status(404).send({ error: 'Form not found.' });
         }
-        const collectionAction = form.actions?.collection;
-        const targetSlug = (collectionAction?.enabled && collectionAction.slug) ? collectionAction.slug : slug;
+        // The form's project scope, as the form routes check it: a user confined to
+        // other projects must not read or change this form's submissions.
+        if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
+        const targetSlug = submissionsCollectionFor(form);
 
         // A form whose backing collection has not been provisioned yet simply
         // has no submissions - return an empty list rather than a 404 so the
@@ -541,7 +570,7 @@ export async function formsRoutes(fastify) {
 
         // listEntries returns { entries, total, page, limit } - unwrap to the
         // array. Newest-first is the conventional display order.
-        const { entries } = await listEntries(targetSlug, { limit: 0 });
+        const entries = await submissionsOf(form);
         return [...entries].reverse();
     });
 
@@ -556,10 +585,14 @@ export async function formsRoutes(fastify) {
         } catch {
             return reply.status(404).send({ error: 'Form not found.' });
         }
+        // The form's project scope, as the form routes check it: a user confined to
+        // other projects must not read or change this form's submissions.
+        if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
+        // Where the list reads them: a form whose collection action writes elsewhere
+        // exported (and cleared, and deleted from) its own-slug collection instead.
         let entries = [];
         try {
-            const r = await listEntries(slug, { limit: 0 });
-            entries = r.entries || [];
+            entries = await submissionsOf(form);
         } catch {
             // empty collection
         }
@@ -580,10 +613,12 @@ export async function formsRoutes(fastify) {
         } catch {
             return reply.status(404).send({ error: 'Form not found.' });
         }
+        // The form's project scope, as the form routes check it: a user confined to
+        // other projects must not read or change this form's submissions.
+        if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
         let entries = [];
         try {
-            const r = await listEntries(slug, { limit: 0 });
-            entries = r.entries || [];
+            entries = await submissionsOf(form);
         } catch {
             // empty
         }
@@ -597,8 +632,24 @@ export async function formsRoutes(fastify) {
     // -----------------------------------------------------------------------
     fastify.delete('/forms/:slug/submissions', canDelete, async (request, reply) => {
         const { slug } = request.params;
+        let form;
         try {
-            await clearEntries(slug);
+            form = await readForm(slug);
+        } catch {
+            return reply.status(404).send({ error: 'Form not found.' });
+        }
+        // The form's project scope, as the form routes check it: a user confined to
+        // other projects must not read or change this form's submissions.
+        if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
+        const target = submissionsCollectionFor(form);
+        try {
+            // Its own collection: clear it. A shared one: delete only this form's
+            // entries (one at a time - parallel writes to a file collection lose updates).
+            if (target === form.slug) {
+                await clearEntries(target);
+            } else {
+                for (const e of await submissionsOf(form)) await deleteEntry(target, e.id);
+            }
         } catch {
             return reply.status(404).send({ error: 'Collection not found for this form.' });
         }
@@ -610,14 +661,54 @@ export async function formsRoutes(fastify) {
     // -----------------------------------------------------------------------
     fastify.delete('/forms/:slug/submissions/:id', canDelete, async (request, reply) => {
         const { slug, id } = request.params;
+        let form;
         try {
-            await deleteEntry(slug, id);
+            form = await readForm(slug);
+        } catch {
+            return reply.status(404).send({ error: 'Form not found.' });
+        }
+        // The form's project scope, as the form routes check it: a user confined to
+        // other projects must not read or change this form's submissions.
+        if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
+        const target = submissionsCollectionFor(form);
+        try {
+            if (!isSubmissionOf(form, await getEntry(target, id))) return reply.status(404).send({ error: 'Submission not found.' });
+            await deleteEntry(target, id);
         } catch {
             return reply.status(404).send({ error: 'Submission not found.' });
         }
         return { ok: true };
     });
 
+    // -----------------------------------------------------------------------
+    // POST /forms/:slug/submissions/:id/spam - flag or unflag one submission.
+    // Merged server-side (updateEntry replaces `data` wholesale), in the field
+    // the collections spam route and the mark-as-spam context action use: `spam`.
+    // -----------------------------------------------------------------------
+    fastify.post('/forms/:slug/submissions/:id/spam', canUpdate, async (request, reply) => {
+        const { slug, id } = request.params;
+        let form;
+        try {
+            form = await readForm(slug);
+        } catch {
+            return reply.status(404).send({ error: 'Form not found.' });
+        }
+        // The form's project scope, as the form routes check it: a user confined to
+        // other projects must not read or change this form's submissions.
+        if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
+        const target = submissionsCollectionFor(form);
+        const value = request.body?.spam !== false;
+        try {
+            const existing = await getEntry(target, id);
+            if (!existing || !isSubmissionOf(form, existing)) return reply.status(404).send({ error: 'Submission not found.' });
+            const entry = await updateEntry(target, id, {...(existing.data || {}), spam: value});
+            hooks.emit('collection:entryUpdated', {slug: target, entryId: entry.id, data: entry.data, userId: request.user?.id || null});
+            return {entry, spam: value};
+        } catch (err) {
+            return reply.status(/not found/i.test(err.message) ? 404 : 400).send({ error: err.message });
+        }
+    });
+
     /*
      * POST /forms/submit/:slug - public form submission.
      *

package/server/routes/api/users.js

@@ -119,12 +119,22 @@ export async function usersRoutes(fastify) {
             }
         }
 
+        // Everything the editor sets arrives in this one request: a follow-up PUT that
+        // failed would leave the account unrestricted and switched on.
+        const {projects, meta, isActive, profile} = request.body || {};
+        let user;
         try {
-            const user = await createUser({ name, email, password, role: targetRole, additionalRoles: requestedAdditional });
-            return reply.status(201).send(user);
+            user = await createUser({
+                name, email, password, role: targetRole, additionalRoles: requestedAdditional,
+                ...(Array.isArray(projects) && {projects: projects.filter(p => typeof p === 'string' && p)}),
+                ...(meta && typeof meta === 'object' && !Array.isArray(meta) && {meta}),
+                isActive: isActive !== false
+            });
         } catch (err) {
             return reply.status(409).send({ error: err.message });
         }
+        if (profile && typeof profile === 'object' && !Array.isArray(profile)) await updateProfile(user.id, profile);
+        return reply.status(201).send(user);
     });
 
     // Update user

package/server/routes/api/views.js

@@ -9,16 +9,38 @@
  * PUT    /views/:slug               - Update view config
  * DELETE /views/:slug               - Delete view config
  * GET    /views/:slug/execute       - Execute view (admin)
+ * POST   /views/_preview            - Run an UNSAVED config (the editor's Results): {source, connection, stages, limit}
  * GET    /views/collection/:slug    - List views targeting a collection
  *
  * Public endpoint (role-checked per view access config):
  * GET    /views/:slug/public        - Execute view publicly
  */
-import {createView, deleteView, executeView, getView, listViews, updateView, viewsBadge} from '../../services/views.js';
+import {createView, deleteView, executeView, executeViewConfig, getView, listViews, updateView, viewsBadge} from '../../services/views.js';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
 import {getRoleLevel} from '../../services/roles.js';
 import {getEffectiveLevel} from '../../services/userRoles.js';
 
+/**
+ * Every collection a pipeline's $lookup stages read, as slugs (`cms_` stripped - Mongo-authored views
+ * name collections that way). Takes the editor's `{type: '$lookup', config}` stages and raw Mongo
+ * `{$lookup: {...}}` alike, and walks nested pipelines: a Mongo `$lookup` can carry its own.
+ */
+export function lookupSources(stages) {
+    const out = new Set();
+    const walk = (node) => {
+        if (Array.isArray(node)) { node.forEach(walk); return; }
+        if (!node || typeof node !== 'object') return;
+        const add = (cfg) => { if (typeof cfg?.from === 'string' && cfg.from) out.add(cfg.from.replace(/^cms_/, '')); };
+        if (node.type === '$lookup') add(node.config);
+        for (const [key, value] of Object.entries(node)) {
+            if (key === '$lookup') add(value);
+            walk(value);
+        }
+    };
+    walk(stages);
+    return [...out];
+}
+
 /** Every collection by slug - a missing one is a view whose source was deleted. */
 async function collectionsBySlug() {
     const {listCollections} = await import('../../services/collections.js');
@@ -135,6 +157,38 @@ export async function viewsRoutes(fastify) {
         }
     });
 
+    // -------------------------------------------------------------------------
+    // Preview an unsaved config (the view editor's Results tab)
+    // -------------------------------------------------------------------------
+    //
+    // `update`, not `read`: running an arbitrary pipeline reads the source
+    // collection, which is what making a view does. The source must be one this
+    // user may see (project scope), and it runs as an admin preview - no
+    // row-level filter, the same as executing a saved view from the admin.
+    // `_` is outside the slug alphabet, so no view can shadow the route.
+    fastify.post('/views/_preview', canUpdate, async (request, reply) => {
+        const {source, connection = 'default', stages = [], limit} = request.body || {};
+        if (typeof source !== 'string' || !source) return reply.status(400).send({error: 'Choose a source collection'});
+        if (!Array.isArray(stages)) return reply.status(400).send({error: 'stages must be an array'});
+        const {getCollection} = await import('../../services/collections.js');
+        const {canSeeArtefact} = await import('../../services/projects.js');
+        const schema = await getCollection(source).catch(() => null);
+        if (!schema) return reply.status(404).send({error: `Collection "${source}" not found`});
+        if (!canSeeArtefact(request.user, schema)) return reply.status(403).send({error: 'Forbidden'});
+        // A $lookup reads its `from` collection too - the same project check applies.
+        for (const from of lookupSources(stages)) {
+            const joined = await getCollection(from).catch(() => null);
+            if (joined && !canSeeArtefact(request.user, joined)) return reply.status(403).send({error: 'Forbidden'});
+        }
+        const n = Math.min(Math.max(parseInt(limit, 10) || 10, 1), 50);
+        try {
+            return await executeViewConfig({connection, pipeline: {source, stages}, access: {rowLevel: null}},
+                {page: 1, limit: n, user: request.user || null});
+        } catch (err) {
+            return reply.status(400).send({error: err.message});
+        }
+    });
+
     // -------------------------------------------------------------------------
     // Public execute (role-checked per view access config)
     // -------------------------------------------------------------------------

package/server/services/components.js

@@ -303,6 +303,15 @@ export async function getComponent(name) {
         } catch { /* return malformed source for editing; UI flags it */ }
         return {name, source, props, bundled, ...(meta && {meta})};
     } catch (err) {
+        // A plugin's component has no file: return its source, read-only
+        // (saveComponent/deleteComponent refuse it as PLUGIN_OWNED). The list's
+        // "View source" opened the editor on it and got a 404.
+        const pc = err.code === 'ENOENT' && getPluginComponents().find(c => c.name === name);
+        if (pc) {
+            let props = {};
+            try { props = validatePropsJson(parseDmcSource(pc.source).props); } catch { /* flagged by the UI */ }
+            return {name, source: pc.source, props, bundled: true, origin: 'plugin', readOnly: true};
+        }
         if (err.code === 'ENOENT') {
             const nf = new Error('Component not found');
             nf.code = 'ENOENT';

package/server/services/users.js

@@ -124,7 +124,7 @@ export async function getUserByEmail(email) {
  * @param {object} data - { name, email, password, role }
  * @returns {Promise<object>} Created user (password stripped)
  */
-export async function createUser({ name, email, password, role = 'user', additionalRoles = [], meta, projects }) {
+export async function createUser({ name, email, password, role = 'user', additionalRoles = [], meta, projects, isActive = true }) {
     const existing = await getUserByEmail(email);
     if (existing) throw new Error('A user with that email already exists');
 
@@ -144,7 +144,7 @@ export async function createUser({ name, email, password, role = 'user', additio
         // Project access-scope: when non-empty, the user is restricted to artefacts
         // tagged with one of these project slugs (see canSeeArtefact in projects.js).
         projects: Array.isArray(projects) ? projects.filter(Boolean) : [],
-        isActive: true,
+        isActive: isActive !== false,
         createdAt: now,
         updatedAt: now,
         lastLogin: null,

package/server/services/views.js

@@ -452,7 +452,21 @@ async function executeFileView(view, { page, limit, user }) {
 export async function executeView(slug, {page = 1, limit = 25, user = null} = {}) {
     const view = await getView(slug);
     if (!view) throw new Error(`View "${slug}" not found`);
+    return executeViewConfig(view, {page, limit, user});
+}
 
+/**
+ * Execute a view config that need not be saved - the view editor's live
+ * Results run the pipeline being edited. Same validation and the same two
+ * engines (native aggregation for a MongoDB source, the JS evaluator
+ * otherwise) as executeView.
+ *
+ * @param {{connection?: string, pipeline: {source: string, stages?: object[]}, access?: object}} view
+ * @param {{page?: number, limit?: number, user?: object|null}} [opts]
+ * @returns {Promise<{ results: object[], total: number, page: number, limit: number }>}
+ */
+export async function executeViewConfig(view, {page = 1, limit = 25, user = null} = {}) {
+    if (!view?.pipeline?.source) throw new Error('pipeline.source is required');
     validateStages(view.pipeline?.stages || []);
 
     // Dispatch on the SOURCE collection's storage adapter. A mongodb-declared

package/admin/js/templates/dashboard/activity-feed.html

@@ -1,3 +0,0 @@
-<h3>Recent activity</h3>
-<div data-field="rows"></div>
-<p class="dash-empty" hidden>No recent activity.</p>

package/admin/js/templates/dashboard/cache.html

@@ -1,32 +0,0 @@
-<div class="dash-card-header">
-    <h3>Response Cache</h3>
-    <label class="dash-cache-toggle" title="Enable / disable cache">
-        <input type="checkbox" data-field="toggle">
-        <span data-field="toggle-label">…</span>
-    </label>
-</div>
-<div class="dash-cache-grid">
-    <div class="dash-cache-stat">
-        <div class="dash-cache-stat-label">Hit rate</div>
-        <div class="dash-cache-stat-value" data-field="hit-rate">-</div>
-        <div class="dash-cache-stat-sub" data-field="hits-misses">no traffic yet</div>
-    </div>
-    <div class="dash-cache-stat">
-        <div class="dash-cache-stat-label">Entries</div>
-        <div class="dash-cache-stat-value" data-field="size">-</div>
-        <div class="dash-cache-stat-sub" data-field="size-bar"><span data-field="size-fill"></span></div>
-    </div>
-    <div class="dash-cache-stat">
-        <div class="dash-cache-stat-label">Writes</div>
-        <div class="dash-cache-stat-value" data-field="writes">0</div>
-        <div class="dash-cache-stat-sub" data-field="invalidations">0 invalidations</div>
-    </div>
-    <div class="dash-cache-stat">
-        <div class="dash-cache-stat-label">Last cleared</div>
-        <div class="dash-cache-stat-value" data-field="last-cleared">never</div>
-        <div class="dash-cache-stat-sub" data-field="driver">driver: -</div>
-    </div>
-</div>
-<div class="dash-cache-actions">
-    <button class="btn btn-sm btn-ghost" data-field="clear-btn"><span data-icon="trash"></span> Clear cache</button>
-</div>

package/admin/js/templates/dashboard/health-detail.html

@@ -1,2 +0,0 @@
-<h3>Health</h3>
-<div data-field="rows"></div>

package/admin/js/templates/dashboard/journeys.html

@@ -1,17 +0,0 @@
-<h3>User journeys - last 7 days</h3>
-<div class="dash-journey-grid">
-    <div>
-        <h4>Top entry pages</h4>
-        <div data-field="entry"></div>
-    </div>
-    <div>
-        <h4>Top exit pages</h4>
-        <div data-field="exit"></div>
-    </div>
-    <div>
-        <h4>Top paths</h4>
-        <div data-field="paths"></div>
-    </div>
-</div>
-<p class="dash-bounce">Bounce rate: <strong data-field="bounce">-</strong></p>
-<p class="dash-empty" hidden>No journey data yet - encourage some traffic and check back.</p>

package/admin/js/templates/dashboard/kpi-strip.html

@@ -1,34 +0,0 @@
-<div class="dash-card dash-kpi">
-    <span class="dash-kpi-icon" data-icon="trending-up"></span>
-    <div>
-        <div class="dash-kpi-value" data-field="hits-today">-</div>
-        <div class="dash-kpi-label">Hits today</div>
-        <div class="dash-kpi-delta" data-field="hits-delta"></div>
-    </div>
-</div>
-<div class="dash-card dash-kpi">
-    <span class="dash-kpi-icon" data-icon="users"></span>
-    <div>
-        <div class="dash-kpi-value" data-field="active-sessions">-</div>
-        <div class="dash-kpi-label">Active sessions (5m)</div>
-    </div>
-</div>
-<div class="dash-card dash-kpi">
-    <span class="dash-kpi-icon" data-icon="inbox"></span>
-    <div>
-        <div class="dash-kpi-value" data-field="submissions-week">-</div>
-        <div class="dash-kpi-label">Submissions this week</div>
-    </div>
-</div>
-<div class="dash-card dash-kpi">
-    <span class="dash-kpi-icon" data-icon="activity"></span>
-    <div>
-        <div class="dash-kpi-value">
-            <span class="dash-health-pill" data-field="health-pill" data-level="ok">
-                <span data-icon="circle"></span>
-                <span data-field="health-label">OK</span>
-            </span>
-        </div>
-        <div class="dash-kpi-label">Site health</div>
-    </div>
-</div>

package/admin/js/templates/dashboard/spike-feed.html

@@ -1,3 +0,0 @@
-<h3>Spikes (last hour)</h3>
-<div data-field="spike-list"></div>
-<p class="dash-empty" hidden>No anomalies detected.</p>

package/admin/js/templates/dashboard/top-pages.html

@@ -1,3 +0,0 @@
-<h3>Top pages - last 7 days</h3>
-<div data-field="rows"></div>
-<p class="dash-empty" hidden>No traffic recorded yet.</p>

package/admin/js/templates/dashboard/traffic-chart.html

@@ -1,3 +0,0 @@
-<h3>Traffic - last 30 days</h3>
-<div class="dash-chart-wrap"><canvas id="dash-traffic-canvas"></canvas></div>
-<p class="dash-empty" hidden>No traffic recorded yet.</p>

package/admin/js/views/block-editor-enhance.js

@@ -1 +0,0 @@
-import{blockEditorView as r}from"./block-editor.js";import{createSimpleEditor as u}from"../lib/simple-editor.js";const p=r.onMount;r.onMount=async function(e){await p.call(this,e);const n=e.find(".editor-pane--write").get(0),l=e.find("#block-line-numbers").get(0),t=e.find("#block-content").get(0);if(!n||!t||n.dataset.dmEnhanced==="1")return;n.dataset.dmEnhanced="1",l&&(l.style.display="none"),t.style.display="none",n.style.display="block",n.style.position="relative",n.style.overflow="hidden";const i=document.createElement("div");i.style.cssText="width:100%;height:100%;",n.appendChild(i);const a=u(i,{initialValue:t.value,onChange:o=>{t.value!==o&&(t.value=o,t.dispatchEvent(new Event("input",{bubbles:!0})))}}),d=Object.getPrototypeOf(t),c=Object.getOwnPropertyDescriptor(d,"value");Object.defineProperty(t,"value",{configurable:!0,get(){return c.get.call(this)},set(o){c.set.call(this,o),a.getValue()!==o&&a.setValue(o??"")}});const s=e.find(".card.editor-card").get(0);s&&(s.style.height="min(78vh, 900px)",s.style.minHeight="520px"),g(e)};const f={icon:"box","facebook-icon":"facebook","instagram-icon":"instagram"};function g(e){const n=e.get?e.get(0):e;if(!n)return;const l=n.querySelectorAll("input[data-placeholder]");for(const t of l){const i=(t.dataset.placeholder||"").toLowerCase(),a=f[i];a&&(t.value&&!/^Sample /i.test(t.value)||(t.value=a,t.dispatchEvent(new Event("input",{bubbles:!0}))))}}

package/admin/js/views/dashboard/lib/escape.js

@@ -1 +0,0 @@
-export function escapeHtml(t){return t==null?"":String(t).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}export function safeHref(t){if(t==null)return"#";const r=String(t).trim();if(r==="")return"#";if(r.startsWith("/"))return escapeHtml(r);const e=r.toLowerCase();return e.startsWith("http://")||e.startsWith("https://")||e.startsWith("mailto:")?escapeHtml(r):"#"}

package/admin/js/views/dashboard/widgets/activity-feed.js

@@ -1 +0,0 @@
-import{escapeHtml as s}from"../lib/escape.js";const p={edit:"edited",publish:"published",form:"received submission"};function f(e,n){e&&(e.innerHTML=n)}export default function m(e,n){const r=Array.isArray(n?.activity)?n.activity:[];r.length===0?e.find(".dash-empty").removeAttr("hidden"):e.find(".dash-empty").attr("hidden","hidden");const i=r.map(t=>{const o=t.at?D(t.at).fromNow():"",a=t.target||t.form||"",d=t.actor?"<strong>"+s(t.actor)+"</strong> ":"",c=s(p[t.type]||t.type||"");return'<div class="dash-spike-row"><span>'+d+c+" <code>"+s(a)+"</code></span><span>"+s(o)+"</span></div>"});f(e.find('[data-field="rows"]').get(0),i.join(""))}

package/admin/js/views/dashboard/widgets/cache.js

@@ -1 +0,0 @@
-import{apiRequest as r}from"../../../api.js";function h(t){if(!t)return"never";const e=Date.now()-new Date(t).getTime();if(e<0)return"just now";const a=Math.floor(e/1e3);if(a<60)return`${a}s ago`;const i=Math.floor(a/60);if(i<60)return`${i}m ago`;const n=Math.floor(i/60);return n<24?`${n}h ago`:`${Math.floor(n/24)}d ago`}function d(t,e){const a=e.hits+e.misses,i=e.hitRate;t.find('[data-field="hit-rate"]').text(i===null?"-":(i*100).toFixed(1)+"%"),t.find('[data-field="hits-misses"]').text(a===0?"no traffic yet":`${e.hits.toLocaleString()} hits \xB7 ${e.misses.toLocaleString()} misses`);const n=e.size??0,c=e.maxItems??0;t.find('[data-field="size"]').text(c?`${n} / ${c}`:String(n));const l=c?Math.min(100,n/c*100):0,o=t.find('[data-field="size-fill"]').get(0);o&&(o.style.width=l+"%"),t.find('[data-field="writes"]').text(e.writes.toLocaleString()),t.find('[data-field="invalidations"]').text(`${e.invalidations.toLocaleString()} invalidations`),t.find('[data-field="last-cleared"]').text(h(e.lastClearedAt)),t.find('[data-field="driver"]').text("driver: "+e.driver);const f=t.find('[data-field="toggle"]').get(0);f&&(f.checked=!!e.enabled),t.find('[data-field="toggle-label"]').text(e.enabled?"On":"Off")}async function s(t){try{const e=await r("/cache/status");d(t,e),t.data("cache-stats",e)}catch(e){console.warn("[cache widget] failed to refresh:",e)}}export default async function g(t){await s(t);const e=t.find('[data-field="toggle"]');e.on("change",async()=>{const a=e.get(0).checked;try{const i=await r("/cache/toggle",{method:"POST",body:JSON.stringify({enabled:a})});d(t,i),E.toast(`Cache ${i.enabled?"enabled":"disabled"}.`,{type:"success"})}catch(i){e.get(0).checked=!a,E.toast(i.message||"Failed to toggle cache.",{type:"error"})}}),t.find('[data-field="clear-btn"]').on("click",async()=>{if(await E.confirm("Clear the entire response cache?"))try{const a=await r("/cache/clear",{method:"POST"});d(t,a),E.toast("Cache cleared.",{type:"success"})}catch(a){E.toast(a.message||"Failed to clear cache.",{type:"error"})}}),window.Domma&&Domma.icons&&Domma.icons.scan()}export{s as refreshCacheWidget};

package/admin/js/views/dashboard/widgets/health-detail.js

@@ -1 +0,0 @@
-const p={ok:"check-circle",warn:"warning",fail:"x-circle"};export default function h(o,s){const r=s?.health?.checks||[],l=o.find('[data-field="rows"]');l.empty();const a=l.get(0);if(a){for(const e of r){const n=document.createElement("div");n.className="dash-spike-row dash-health-pill",n.setAttribute("data-level",e.level);const c=document.createElement("span"),i=document.createElement("span");i.setAttribute("data-icon",p[e.level]||"circle"),c.appendChild(i),c.appendChild(document.createTextNode(" "+(e.label||e.id)));const d=document.createElement("span");if(d.textContent=String(e.value),n.appendChild(c),n.appendChild(d),a.appendChild(n),Array.isArray(e.detail)&&e.detail.length>0){const t=document.createElement("div");t.className="dash-health-detail",t.style.fontSize="12px",t.style.opacity="0.75",t.style.padding="4px 0 8px",t.textContent=e.detail.slice(0,5).join(", "),a.appendChild(t)}}window.Domma&&Domma.icons&&Domma.icons.scan()}}

package/admin/js/views/dashboard/widgets/journeys.js

@@ -1 +0,0 @@
-import{escapeHtml as r}from"../lib/escape.js";function s(n,a){return n.map(e=>'<div class="dash-spike-row">'+a(e)+"</div>").join("")}function i(n,a){n&&(n.innerHTML=a)}export default function f(n,a){const e=a?.journeys,d=n.find(".dash-empty"),o=n.find('[data-field="entry"]'),p=n.find('[data-field="exit"]'),u=n.find('[data-field="paths"]'),c=n.find('[data-field="bounce"]');if(!e||!e.totalSessions){d.removeAttr("hidden"),o.empty(),p.empty(),u.empty(),c.text("-");return}d.attr("hidden","hidden"),i(o.get(0),s(e.entry||[],t=>"<span>"+r(t.url)+"</span><span>"+(Number(t.count)|0)+"</span>")),i(p.get(0),s(e.exit||[],t=>"<span>"+r(t.url)+"</span><span>"+(Number(t.count)|0)+"</span>")),i(u.get(0),s(e.paths||[],t=>"<span>"+r(t.from)+" &rarr; "+r(t.to)+"</span><span>"+(Number(t.count)|0)+"</span>")),c.text((Number(e.bounceRate)*100).toFixed(1)+"%")}

package/admin/js/views/dashboard/widgets/kpi-strip.js

@@ -1 +0,0 @@
-export default function n(e,t){const d=t?.traffic?.today??0,a=t?.traffic?.deltaPct;e.find('[data-field="hits-today"]').text(d);const s=e.find('[data-field="hits-delta"]');a==null?s.text("").removeClass("up down"):a>=0?s.text("+"+a+"% vs yesterday").removeClass("down").addClass("up"):s.text(a+"% vs yesterday").removeClass("up").addClass("down"),e.find('[data-field="active-sessions"]').text(t?.realtime?.activeSessions??0),e.find('[data-field="submissions-week"]').text(t?._submissionsWeek??"-");const i=t?.health?.status||"ok",l={ok:"OK",warn:"Attention",fail:"Failing"};e.find('[data-field="health-pill"]').attr("data-level",i),e.find('[data-field="health-label"]').text(l[i])}

package/admin/js/views/dashboard/widgets/spike-feed.js

@@ -1,6 +0,0 @@
-import{escapeHtml as a,safeHref as d}from"../lib/escape.js";export default function p(i,r){const t=Array.isArray(r?.spikes)?r.spikes:[];t.length===0?i.find(".dash-empty").removeAttr("hidden"):i.find(".dash-empty").attr("hidden","hidden");const s=t.map(e=>`
-        <div class="dash-spike-row">
-            <span><a href="${d(e.url)}">${a(e.url)}</a></span>
-            <span><strong>${Number(e.hits)|0}</strong> \xB7 \xD7${Number(e.ratio)||0}</span>
-        </div>
-    `).join(""),n=i.find('[data-field="spike-list"]').get(0);n&&(n.innerHTML=s)}

package/admin/js/views/dashboard/widgets/top-pages.js

@@ -1 +0,0 @@
-import{escapeHtml as l,safeHref as i}from"../lib/escape.js";function c(n,s,e){if(s=s||80,e=e||24,!n||n.length===0)return"";const a=n.map(p=>Number(p)||0),o=Math.max.apply(null,a.concat([1])),t=s/Math.max(a.length-1,1),r=a.map((p,d)=>(d*t).toFixed(1)+","+(e-p/o*e).toFixed(1)).join(" ");return'<svg class="dash-spark" viewBox="0 0 '+s+" "+e+'" xmlns="http://www.w3.org/2000/svg" preserveAspectRatio="none"><polyline fill="none" stroke="currentColor" stroke-width="1.5" points="'+r+'"/></svg>'}export default function m(n,s){const e=Array.isArray(s?.topPages)?s.topPages:[];e.length===0?n.find(".dash-empty").removeAttr("hidden"):n.find(".dash-empty").attr("hidden","hidden");const a=e.map(t=>{const r=t.deltaPct==null?"":'<span class="'+(t.deltaPct>=0?"up":"down")+' dash-kpi-delta">'+(t.deltaPct>=0?"+":"")+(Number(t.deltaPct)||0)+"%</span>";return'<div class="dash-spike-row"><span><a href="'+i(t.url)+'">'+l(t.url)+"</a> "+c(t.spark)+"</span><span><strong>"+(Number(t.hits)|0)+"</strong> "+r+"</span></div>"}).join(""),o=n.find('[data-field="rows"]').get(0);o&&(o.innerHTML=a)}

package/admin/js/views/dashboard/widgets/traffic-chart.js

@@ -1 +0,0 @@
-const p="https://cdn.jsdelivr.net/npm/chart.js@4/dist/chart.umd.js";let s=null;function u(){return window.Chart?Promise.resolve(window.Chart):s||(s=new Promise((r,n)=>{const e=document.createElement("script");e.src=p,e.onload=()=>r(window.Chart),e.onerror=n,document.head.appendChild(e)}),s)}let i=null;export default async function m(r,n){const e=await u(),o=30,a=[];for(let t=o-1;t>=0;t-=1)a.push({label:D().subtract(t,"days").format("MM-DD"),hits:0});if(Array.isArray(n?.topPages))for(const t of n.topPages){if(!Array.isArray(t.spark))continue;const l=o-t.spark.length;t.spark.forEach((f,h)=>{a[l+h].hits+=f})}const d=a.every(t=>t.hits===0);d?r.find(".dash-empty").removeAttr("hidden"):r.find(".dash-empty").attr("hidden","hidden");const c=r.find("#dash-traffic-canvas").get(0);c&&(i&&(i.destroy(),i=null),!d&&(i=new e(c,{type:"line",data:{labels:a.map(t=>t.label),datasets:[{data:a.map(t=>t.hits),borderColor:"rgba(37, 99, 235, 1)",backgroundColor:"rgba(37, 99, 235, 0.15)",fill:!0,tension:.3,pointRadius:0}]},options:{responsive:!0,maintainAspectRatio:!1,plugins:{legend:{display:!1}},scales:{x:{ticks:{maxTicksLimit:8}},y:{beginAtZero:!0}}}})))}