domma-cms 0.78.1 → 0.79.1

package/plugins/_lib/admin/mail/diagnostics-section.js

@@ -50,14 +50,12 @@ export function createDiagnosticsSection(host) {
      * @returns {Promise<void>}
      */
     async function render(container, ctx) {
+        const kit = await import(`./section-kit.js?v=${ctx.assetVersion ?? '1'}`);
         const server = await ctx.api(`${ctx.base}/diagnostics`);
         const loaded = loadedAssetVersions();
 
-        const stamp = document.createElement('div');
-        stamp.className = 'text-sm font-semibold mb-2';
         const entryVersion = loaded['mail.js'] ?? '(unknown)';
-        stamp.textContent = `${server.plugin.name} ${server.plugin.version ?? '?'} · build ${entryVersion}`;
-        container.appendChild(stamp);
+        kit.heading(container, `${server.plugin.name} ${server.plugin.version ?? '?'} \u00b7 build ${entryVersion}`);
 
         // The comparison that matters: the token this page was served under
         // against the token the server would issue now. Comparing a module's
@@ -67,35 +65,18 @@ export function createDiagnosticsSection(host) {
         const running = loaded['mail.js'];
         const stale = running && running !== '(unversioned)' && String(served) !== String(running);
 
-        const verdict = document.createElement('p');
-        verdict.className = 'text-sm mb-3';
-        if (stale) {
-            verdict.className = 'text-sm mb-3 text-danger';
-            verdict.textContent = `This page is running an older build than the server has (${running} vs ${served}). Reload with a hard refresh before reporting anything else.`;
-        } else {
-            verdict.className = 'text-sm mb-3 text-muted';
-            verdict.textContent = 'This page is running the build the server is serving.';
-        }
-        container.appendChild(verdict);
+        const verdict = kit.note(container, stale
+            ? `This page is running an older build than the server has (${running} vs ${served}). Reload with a hard refresh before reporting anything else.`
+            : 'This page is running the build the server is serving.');
+        if (stale) verdict.classList.add('text-danger');
 
         const errors = host.recentErrors();
-        const errorLine = document.createElement('p');
-        errorLine.className = 'text-sm text-muted mb-3';
-        errorLine.textContent = errors.length
+        kit.note(container, errors.length
             ? `${errors.length} error(s) captured since this view opened - included in the report.`
-            : 'No errors captured since this view opened.';
-        container.appendChild(errorLine);
+            : 'No errors captured since this view opened.');
 
-        const actions = document.createElement('div');
-        actions.className = 'flex gap-2 items-center';
-
-        const status = document.createElement('span');
-        status.className = 'flex-1 text-sm text-muted';
-
-        const copy = document.createElement('button');
-        copy.className = 'btn btn-sm btn-primary';
-        copy.textContent = 'Copy diagnostics';
-        copy.addEventListener('click', async () => {
+        const bar = kit.actionBar(container);
+        kit.button(bar.row, 'Copy diagnostics', async () => {
             const report = {
                 page: {
                     url: location.href,
@@ -109,24 +90,16 @@ export function createDiagnosticsSection(host) {
             const text = JSON.stringify(report, null, 2);
             try {
                 await navigator.clipboard.writeText(text);
-                status.className = 'flex-1 text-sm text-success';
-                status.textContent = 'Copied. Paste it into the report.';
+                bar.say('Copied. Paste it into the report.', 'ok');
             } catch {
                 // Clipboard access can be refused; showing the text is still
                 // better than losing it.
-                const box = document.createElement('textarea');
+                const box = kit.box(container, 'form-textarea mail-diag-log', 'textarea');
                 box.value = text;
-                box.className = 'form-textarea mail-diag-log';
-                container.appendChild(box);
                 box.select();
-                status.className = 'flex-1 text-sm text-muted';
-                status.textContent = 'Clipboard unavailable - select and copy the text below.';
+                bar.say('Clipboard unavailable - select and copy the text below.');
             }
-        });
-
-        actions.appendChild(status);
-        actions.appendChild(copy);
-        container.appendChild(actions);
+        }, {variant: 'primary'});
     }
 
     return {

package/server/routes/api/contacts.js

@@ -26,6 +26,7 @@
  */
 import {authenticate as defaultAuthenticate, requirePermission as defaultRequirePermission} from '../../middleware/auth.js';
 import {createEntry, deleteEntry, getEntry, listEntries, updateEntry} from '../../services/collections.js';
+import {hooks} from '../../services/hooks.js';
 
 const CONTACTS_SLUG = 'contacts-contacts';
 const GROUPS_SLUG = 'contacts-groups';
@@ -348,6 +349,7 @@ export async function contactsRoutes(fastify, opts = {}) {
             if (uid && entry.data.userId !== uid) continue;
             await deleteEntry(CONTACTS_SLUG, id).catch(() => {
             });
+            hooks.emit('contact:deleted', {id, userId: entry.data.userId ?? null});
             deleted++;
         }
 
@@ -364,6 +366,8 @@ export async function contactsRoutes(fastify, opts = {}) {
         if (uid && entry.data.userId !== uid) return reply.code(404).send({error: 'Contact not found'});
 
         await deleteEntry(CONTACTS_SLUG, id);
+        // Anything pointing at it (Calendar's event links) can let go now (0.79).
+        hooks.emit('contact:deleted', {id, userId: entry.data.userId ?? null});
         return reply.send({ ok: true });
     });
 

package/server/routes/api/notes.js

@@ -18,6 +18,7 @@
 import {ago, clip, plural} from '../../services/sidebarBadges.js';
 import {authenticate as defaultAuthenticate, requirePermission as defaultRequirePermission} from '../../middleware/auth.js';
 import {createEntry, deleteEntry, getEntry, listEntries, updateEntry} from '../../services/collections.js';
+import {hooks} from '../../services/hooks.js';
 
 const SLUG = 'notes-notes';
 
@@ -149,6 +150,8 @@ export async function notesRoutes(fastify, opts = {}) {
         if (uid && entry.data.userId !== uid) return reply.code(404).send({error: 'Note not found'});
 
         await deleteEntry(SLUG, id);
+        // Anything pointing at it (Calendar's event links) can let go now (0.79).
+        hooks.emit('note:deleted', {id, userId: entry.data.userId ?? null});
         return reply.send({ success: true });
     });
 

package/server/routes/api/related.js

@@ -0,0 +1,76 @@
+/**
+ * Related items - /api/related (0.79)
+ *
+ * What plugins show beside a core record - Calendar's "Events" on a contact or
+ * a note. Core never names the plugin: providers register through
+ * `registerRelatedItems` (services/hooks.js) and this route asks them.
+ *
+ * Core does the one check a provider cannot: that the viewer may see the
+ * record at all. Contacts and Notes are per-user, so a record that is not the
+ * viewer's answers 404 exactly as its own API does - no provider is asked.
+ *
+ *   GET /api/related/providers?kind=contact   who can add to a contact: [{id, label, icon, actions}]
+ *   GET /api/related?kind=contact&id=<id>     {providers: [{id, label, icon, items, error?}]}
+ */
+import {authenticate as defaultAuthenticate} from '../../middleware/auth.js';
+import {getEntry} from '../../services/collections.js';
+import {getRelatedProviders, RELATED_KINDS} from '../../services/hooks.js';
+import {getPermissionsFor} from '../../services/roles.js';
+import {getEffectiveRoles} from '../../services/userRoles.js';
+
+/** Each kind: its Tool's permission resource and its collection. */
+const KINDS = {
+    contact: {resource: 'contacts', slug: 'contacts-contacts'},
+    note: {resource: 'notes', slug: 'notes-notes'}
+};
+
+/** How long one provider may take before it is left out of the answer. */
+export const PROVIDER_TIMEOUT_MS = 1500;
+
+const withTimeout = (promise, ms) => Promise.race([
+    promise,
+    new Promise((_, reject) => setTimeout(() => reject(new Error('took too long')), ms))
+]);
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {{authenticate?: Function}} [opts] - injectable for tests
+ */
+export async function relatedRoutes(fastify, opts = {}) {
+    const authenticate = opts.authenticate || defaultAuthenticate;
+
+    const viewer = (request) => {
+        const roles = getEffectiveRoles(request.user);
+        return {id: request.user?.id ?? request.user?.sub ?? null, role: request.user?.role ?? null, roles};
+    };
+    const mayRead = (user, kind) => user.roles.some(r => getPermissionsFor(KINDS[kind].resource, 'read').includes(r));
+
+    fastify.get('/providers', {preHandler: [authenticate]}, async (request, reply) => {
+        const kind = String(request.query?.kind ?? '');
+        if (!RELATED_KINDS.includes(kind)) return reply.code(400).send({error: `kind must be one of ${RELATED_KINDS.join(', ')}`});
+        if (!mayRead(viewer(request), kind)) return reply.code(403).send({error: 'Forbidden'});
+        return getRelatedProviders(kind).map(({id, label, icon, actions}) => ({id, label, icon, actions}));
+    });
+
+    fastify.get('/', {preHandler: [authenticate]}, async (request, reply) => {
+        const kind = String(request.query?.kind ?? '');
+        const id = String(request.query?.id ?? '');
+        if (!RELATED_KINDS.includes(kind) || !id) return reply.code(400).send({error: 'kind and id are required'});
+        const user = viewer(request);
+        if (!mayRead(user, kind)) return reply.code(403).send({error: 'Forbidden'});
+
+        const entry = await getEntry(KINDS[kind].slug, id).catch(() => null);
+        if (!entry || (user.id && entry.data?.userId !== user.id)) return reply.code(404).send({error: 'Not found'});
+
+        const providers = await Promise.all(getRelatedProviders(kind).map(async (p) => {
+            try {
+                const items = await withTimeout(Promise.resolve(p.list({id, user})), PROVIDER_TIMEOUT_MS);
+                return {id: p.id, label: p.label, icon: p.icon, items: Array.isArray(items) ? items : []};
+            } catch (err) {
+                request.log?.warn?.({err, provider: p.id}, '[related] provider failed');
+                return {id: p.id, label: p.label, icon: p.icon, items: [], error: 'Could not be loaded just now.'};
+            }
+        }));
+        return {providers};
+    });
+}

package/server/routes/api/todo.js

@@ -18,6 +18,8 @@
 import {clip, plural} from '../../services/sidebarBadges.js';
 import {authenticate as defaultAuthenticate, requirePermission as defaultRequirePermission} from '../../middleware/auth.js';
 import {createEntry, deleteEntry, getEntry, listEntries, updateEntry} from '../../services/collections.js';
+import {registerCalendarSource} from '../../services/hooks.js';
+import {getPermissionsFor} from '../../services/roles.js';
 
 const SLUG = 'todo-items';
 
@@ -37,6 +39,38 @@ function toTodo(entry) {
     };
 }
 
+/** 'YYYY-MM-DD' + n days, by the calendar. */
+const addDays = (day, n) => new Date(Date.parse(`${day}T00:00:00Z`) + n * 86400000).toISOString().slice(0, 10);
+
+/**
+ * The Calendar's "To-dos" layer (0.79): the viewer's OPEN to-dos with a due
+ * day, as all-day items on that day (UTC midnights, end exclusive - the
+ * Calendar's all-day shape). Completed ones stay off: the calendar shows what
+ * is still to do. Only for someone who may read Todo at all.
+ *
+ * @param {{from: string, to: string, user: {id: string, roles?: string[], role?: string}}} q
+ */
+export async function todoCalendarItems({from, to, user}) {
+    const roles = Array.isArray(user?.roles) ? user.roles : [user?.role].filter(Boolean);
+    if (!user?.id || !roles.some(r => getPermissionsFor('todo', 'read').includes(r))) return [];
+    const {entries} = await listEntries(SLUG, {limit: 10000});
+    return entries.map(toTodo)
+        .filter(t => t.userId === user.id && t.status !== 'completed')
+        .map(t => ({t, day: /^(\d{4}-\d{2}-\d{2})/.exec(String(t.dueAt ?? ''))?.[1]}))
+        .filter(({day}) => day && day >= from && day < to)
+        .map(({t, day}) => ({
+            id: t.id,
+            title: String(t.text || 'To-do').trim() || 'To-do',
+            startAt: `${day}T00:00:00.000Z`,
+            endAt: `${addDays(day, 1)}T00:00:00.000Z`,
+            allDay: true,
+            url: '#/todo',
+            meta: t.priority === 'high' ? 'high priority' : ''
+        }));
+}
+
+registerCalendarSource({id: 'todo', label: 'To-dos', icon: 'check-square', tone: 'warning', list: todoCalendarItems});
+
 /**
  * Auth is injectable so a test can drive these routes without registering
  * @fastify/jwt or a role store - the same shape dashboard.js and plugins.js use.

package/server/server.js

@@ -464,6 +464,7 @@ const { notesRoutes }              = await import('./routes/api/notes.js');
 const { todoRoutes }               = await import('./routes/api/todo.js');
 const { analyticsRoutes }          = await import('./routes/api/analytics.js');
 const { contactsRoutes }           = await import('./routes/api/contacts.js');
+const { relatedRoutes }            = await import('./routes/api/related.js');
 const { pluginMarketplaceRoutes }  = await import('./routes/api/plugin-marketplace.js');
 const { collectionsRoutes } = await import('./routes/api/collections.js');
 const { formsRoutes }       = await import('./routes/api/forms.js');
@@ -515,6 +516,8 @@ await app.register(notesRoutes, {prefix: '/api/notes'});
 await app.register(todoRoutes, {prefix: '/api/todo'});
 await app.register(analyticsRoutes, {prefix: '/api/analytics'});
 await app.register(contactsRoutes, {prefix: '/api/contacts'});
+// What plugins show beside a contact or a note (Calendar's Events) - 0.79.
+await app.register(relatedRoutes, {prefix: '/api/related'});
 
 // ---------------------------------------------------------------------------
 // CMS Plugins (server-side Fastify plugins from plugins/ directory)

package/server/services/hooks.js

@@ -207,3 +207,101 @@ export function registerComponent({name, source} = {}) {
 export function getPluginComponents() {
   return [..._pluginComponents.values()];
 }
+
+// ---------------------------------------------------------------------------
+// 6. Calendar sources (0.79) - dated items other Tools show on the Calendar
+// ---------------------------------------------------------------------------
+//
+// The Calendar plugin ASKS for these when it draws a range; nothing is copied
+// into it, so nothing can fall out of step. A source returns only the viewer's
+// own items - Notes, Contacts and Todo are per-user. Core never imports the
+// Calendar: with it not installed, sources are registered and never asked.
+
+const _calendarSources = new Map(); // id -> {id, label, icon, tone, list, owner}
+
+/**
+ * Register a calendar source.
+ *
+ * `list({from, to, user})` - `from`/`to` are 'YYYY-MM-DD' (from inclusive, to
+ * exclusive); `user` is `{id, role, roles}` (roles = primary + additional).
+ * Resolves to `[{id, title, startAt, endAt?, allDay?, url?, meta?}]`. An
+ * all-day item's times are UTC midnights, `endAt` exclusive - as Calendar's own.
+ *
+ * @param {{id: string, label: string, icon?: string, tone?: string, list: Function, owner?: string}} source
+ * @returns {boolean} false when the source is malformed (it is then ignored)
+ */
+export function registerCalendarSource(source = {}) {
+  const {id, label, list} = source;
+  if (typeof id !== 'string' || !/^[a-z0-9][a-z0-9-]*$/.test(id) || typeof list !== 'function') return false;
+  _calendarSources.set(id, {
+    id,
+    label: typeof label === 'string' && label.trim() ? label.trim() : id,
+    icon: typeof source.icon === 'string' ? source.icon : 'calendar',
+    tone: typeof source.tone === 'string' ? source.tone : 'info',
+    owner: typeof source.owner === 'string' ? source.owner : 'core',
+    list
+  });
+  return true;
+}
+
+/** @param {string} id */
+export function unregisterCalendarSource(id) {
+  _calendarSources.delete(id);
+}
+
+/** Every registered calendar source, in registration order. */
+export function getCalendarSources() {
+  return [..._calendarSources.values()];
+}
+
+// ---------------------------------------------------------------------------
+// 7. Related items (0.79) - "Events" on a contact or a note
+// ---------------------------------------------------------------------------
+//
+// A plugin that points AT core records (Calendar's event links) registers a
+// provider per kind; GET /api/related asks each one for what relates to one
+// record, after core has checked the viewer may see that record at all.
+
+export const RELATED_KINDS = ['contact', 'note'];
+const _relatedProviders = new Map(); // kind -> Map(id -> provider)
+
+/**
+ * Register what a plugin can show beside a core record.
+ *
+ * `list({id, user})` resolves to `[{id, title, when?, startAt?, allDay?, meta?, url?, past?}]`
+ * - with `startAt` and no `when`, the admin writes the time in the reader's zone.
+ * `actions` are shown in the record's menu, `{id}` in a url replaced by the
+ * record's id: `[{label, icon?, url}]`.
+ *
+ * @param {'contact'|'note'} kind
+ * @param {{id: string, label: string, icon?: string, list: Function, actions?: object[], owner?: string}} provider
+ * @returns {boolean}
+ */
+export function registerRelatedItems(kind, provider = {}) {
+  if (!RELATED_KINDS.includes(kind)) return false;
+  const {id, list} = provider;
+  if (typeof id !== 'string' || !id || typeof list !== 'function') return false;
+  if (!_relatedProviders.has(kind)) _relatedProviders.set(kind, new Map());
+  const actions = (Array.isArray(provider.actions) ? provider.actions : [])
+    .filter(a => a && typeof a.label === 'string' && typeof a.url === 'string' && a.url.startsWith('#/'))
+    .map(a => ({label: a.label, icon: typeof a.icon === 'string' ? a.icon : 'arrow-right', url: a.url}));
+  _relatedProviders.get(kind).set(id, {
+    id,
+    label: typeof provider.label === 'string' && provider.label.trim() ? provider.label.trim() : id,
+    icon: typeof provider.icon === 'string' ? provider.icon : 'link',
+    owner: typeof provider.owner === 'string' ? provider.owner : 'core',
+    actions,
+    list
+  });
+  return true;
+}
+
+/** @param {string} kind @param {string} id */
+export function unregisterRelatedItems(kind, id) {
+  _relatedProviders.get(kind)?.delete(id);
+}
+
+/** The providers for one kind of record. */
+export function getRelatedProviders(kind) {
+  return [...(_relatedProviders.get(kind)?.values() ?? [])];
+}

package/server/services/plugins.js

@@ -16,7 +16,10 @@ import matter from 'gray-matter';
 import {getConfig, saveConfig} from '../config.js';
 import {authenticate, requireAdmin, requirePermission, requireRole, requireVisibility} from '../middleware/auth.js';
 import {
+    getCalendarSources,
     hooks,
+    registerCalendarSource,
+    registerRelatedItems,
     registerMenuLocation,
     registerSanitizeRules,
     registerShortcode,
@@ -475,6 +478,10 @@ export async function registerPlugins(fastify) {
                   // Custom themes the plugin offers (the Theme Roller) - bound to the
                   // plugin, so one plugin cannot replace another's. See themeSettings.js.
                   registerThemes: (provider) => registerThemeProvider(manifest.name, provider),
+                  // Calendar sources and related items (0.79) - stamped with the plugin's name.
+                  registerCalendarSource: (source) => registerCalendarSource({...source, owner: manifest.name}),
+                  getCalendarSources,
+                  registerRelatedItems: (kind, provider) => registerRelatedItems(kind, {...provider, owner: manifest.name}),
                   on: hooks.on.bind(hooks), ...pluginRoleHooks(manifest.name)},
               settings,
               config: {}