domma-cms 0.81.1 → 0.83.0

package/admin/js/views/login.js

@@ -1,4 +1,4 @@
-import{api as o,isAuthenticated as u,setAuthData as l,takePendingLogout as p}from"../api.js";import{themesInDisplayOrder as f}from"../lib/themes.js";const h={name:{type:"string",required:!0,minLength:2,label:"Full Name",formConfig:{placeholder:"Your name",autocomplete:"name"}},email:{type:"email",required:!0,label:"Email Address",formConfig:{placeholder:"admin@example.com",autocomplete:"email"}},password:{type:"password",required:!0,minLength:8,label:"Password",formConfig:{placeholder:"\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",autocomplete:"new-password",tooltip:"Minimum 8 characters"}}},g={email:{type:"email",required:!0,label:"Email Address",formConfig:{placeholder:"you@example.com",autocomplete:"email"}},password:{type:"password",required:!0,label:"Password",formConfig:{placeholder:"\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",autocomplete:"current-password"}}};export const loginView={templateUrl:"/admin/js/templates/login.html",async onMount(e){if(p(),u()){R.navigate("/");return}const a=window.location.hash,t=a.match(/[?&]token=([a-f0-9]{64})/);if(a.startsWith("#/reset-password")&&t){r(e,"reset"),S(e,t[1]),Domma.icons.scan();return}if(a.startsWith("#/reset-password")){R.navigate("/login");return}let s=!1;const i=E.loader(e.get(0),{type:"dots"});try{s=(await o.auth.setupStatus()).needsSetup}catch{E.toast("Could not reach the server.",{type:"error"})}finally{i.destroy()}s?(r(e,"setup"),k(e)):(r(e,"login"),C(e)),Domma.icons.scan()}};const b={email:{type:"email",required:!0,label:"Email Address",formConfig:{placeholder:"you@example.com",autocomplete:"email"}}},w={password:{type:"password",required:!0,minLength:8,label:"New Password",formConfig:{placeholder:"\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",autocomplete:"new-password",tooltip:"Minimum 8 characters"}},confirmPassword:{type:"password",required:!0,label:"Confirm Password",formConfig:{placeholder:"\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",autocomplete:"new-password"}}},y=["setup","onboarding-site","onboarding-theme","onboarding-done","login","forgot","forgot-success","reset"];function r(e,a){y.forEach(t=>e.find(`#${t}-panel`).hide()),e.find(`#${a}-panel`).show(),Domma.icons.scan()}function d(e,a,t){e.find(`#${a}`).text(t).show()}function k(e){F.render("#setup-form-container",h,{},{layout:"stacked",submitText:"Create admin account",onSubmit:async a=>{try{const t=await o.auth.setup(a);l(t),r(e,"onboarding-site"),v(e)}catch(t){return E.toast(t.message||"Setup failed. Please try again.",{type:"error"}),!1}}})}function v(e){e.find("#ob-site-skip").on("click",a=>{a.preventDefault(),r(e,"onboarding-theme"),c(e),m(e)}),e.find("#ob-site-btn").on("click",async()=>{e.find("#ob-site-error").hide();const a=e.find("#ob-title").val().trim(),t=e.find("#ob-tagline").val().trim(),s=e.find("#ob-site-btn").prop("disabled",!0).text("Saving\u2026");try{const i=await o.settings.get();await o.settings.save({...i,title:a||i.title,tagline:t||i.tagline,seo:{...i.seo||{},defaultTitle:a||i.seo&&i.seo.defaultTitle}});const n=await o.navigation.get();await o.navigation.save({...n,brand:{...n.brand||{},text:a||n.brand.text}}),r(e,"onboarding-theme"),c(e),m(e)}catch(i){d(e,"ob-site-error",i.message||"Could not save site details.")}finally{s.prop("disabled",!1).text("Continue")}})}function c(e){const a=e.find("#theme-grid").empty();f().forEach(t=>{const s=$(`
+import{api as i,isAuthenticated as y,setAuthData as m,takePendingLogout as v}from"../api.js";import{themesInDisplayOrder as k}from"../lib/themes.js";const x={name:{type:"string",required:!0,minLength:2,label:"Full Name",formConfig:{placeholder:"Your name",autocomplete:"name"}},email:{type:"email",required:!0,label:"Email Address",formConfig:{placeholder:"admin@example.com",autocomplete:"email"}},password:{type:"password",required:!0,minLength:8,label:"Password",formConfig:{placeholder:"\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",autocomplete:"new-password",tooltip:"Minimum 8 characters"}}},C={email:{type:"email",required:!0,label:"Email Address",formConfig:{placeholder:"you@example.com",autocomplete:"email"}},password:{type:"password",required:!0,label:"Password",formConfig:{placeholder:"\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",autocomplete:"current-password"}}};export const loginView={templateUrl:"/admin/js/templates/login.html",async onMount(e){if(v(),y()){R.navigate("/");return}const s=window.location.hash,t=s.match(/[?&]token=([a-f0-9]{64})/);if(s.startsWith("#/reset-password")&&t){r(e,"reset"),M(e,t[1]),Domma.icons.scan();return}if(s.startsWith("#/reset-password")){R.navigate("/login");return}let o=!1;const a=E.loader(e.get(0),{type:"dots"});try{o=(await i.auth.setupStatus()).needsSetup}catch{E.toast("Could not reach the server.",{type:"error"})}finally{a.destroy()}o?(r(e,"setup"),T(e)):(r(e,"login"),q(e)),Domma.icons.scan()}};const S={email:{type:"email",required:!0,label:"Email Address",formConfig:{placeholder:"you@example.com",autocomplete:"email"}}},P={password:{type:"password",required:!0,minLength:8,label:"New Password",formConfig:{placeholder:"\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",autocomplete:"new-password",tooltip:"Minimum 8 characters"}},confirmPassword:{type:"password",required:!0,label:"Confirm Password",formConfig:{placeholder:"\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",autocomplete:"new-password"}}},D=["setup","onboarding-site","onboarding-theme","onboarding-done","login","forgot","forgot-success","reset","challenge"];function r(e,s){D.forEach(t=>e.find(`#${t}-panel`).hide()),e.find(`#${s}-panel`).show(),Domma.icons.scan()}function h(e,s,t){e.find(`#${s}`).text(t).show()}function T(e){F.render("#setup-form-container",x,{},{layout:"stacked",submitText:"Create admin account",onSubmit:async s=>{try{const t=await i.auth.setup(s);m(t),r(e,"onboarding-site"),L(e)}catch(t){return E.toast(t.message||"Setup failed. Please try again.",{type:"error"}),!1}}})}function L(e){e.find("#ob-site-skip").on("click",s=>{s.preventDefault(),r(e,"onboarding-theme"),g(e),b(e)}),e.find("#ob-site-btn").on("click",async()=>{e.find("#ob-site-error").hide();const s=e.find("#ob-title").val().trim(),t=e.find("#ob-tagline").val().trim(),o=e.find("#ob-site-btn").prop("disabled",!0).text("Saving\u2026");try{const a=await i.settings.get();await i.settings.save({...a,title:s||a.title,tagline:t||a.tagline,seo:{...a.seo||{},defaultTitle:s||a.seo&&a.seo.defaultTitle}});const l=await i.navigation.get();await i.navigation.save({...l,brand:{...l.brand||{},text:s||l.brand.text}}),r(e,"onboarding-theme"),g(e),b(e)}catch(a){h(e,"ob-site-error",a.message||"Could not save site details.")}finally{o.prop("disabled",!1).text("Continue")}})}function g(e){const s=e.find("#theme-grid").empty();k().forEach(t=>{const o=$(`
             <div class="theme-swatch" data-theme="${t.id}" title="${t.id}">
                 <div class="theme-swatch-preview" style="background:${t.bg}">
                     <div class="theme-swatch-accent" style="background:${t.primary}"></div>
@@ -8,4 +8,4 @@ import{api as o,isAuthenticated as u,setAuthData as l,takePendingLogout as p}fro
                     <span class="theme-swatch-mode">${t.dark?"Dark":"Light"}</span>
                 </div>
             </div>
-        `);s.on("click",()=>{e.find(".theme-swatch").removeClass("selected"),s.addClass("selected")}),a.append(s)}),e.find('[data-theme="charcoal-dark"]').addClass("selected")}function m(e){e.find("#ob-theme-skip").on("click",a=>{a.preventDefault(),r(e,"onboarding-done")}),e.find("#ob-theme-btn").on("click",async()=>{e.find("#ob-theme-error").hide();const a=e.find(".theme-swatch.selected").attr("data-theme")||"charcoal-dark",t=e.find("#ob-theme-btn").prop("disabled",!0).text("Applying\u2026");try{const s=await o.settings.get();await o.settings.save({...s,theme:a}),r(e,"onboarding-done")}catch(s){d(e,"ob-theme-error",s.message||"Could not save theme.")}finally{t.prop("disabled",!1).text("Apply theme")}})}function C(e){F.render("#login-form-container",g,{},{layout:"stacked",submitText:"Sign in",onSubmit:async a=>{try{const t=await o.auth.login(a);l(t),R.navigate("/")}catch(t){return E.toast(t.message||"Invalid credentials. Please try again.",{type:"error"}),!1}}}),e.find("#forgot-link").on("click",a=>{a.preventDefault(),r(e,"forgot"),x(e)})}function x(e){F.render("#forgot-form-container",b,{},{layout:"stacked",submitText:"Send reset link",onSubmit:async t=>{try{await o.auth.forgotPassword(t.email)}catch{}r(e,"forgot-success"),Domma.icons.scan()}});const a=t=>{t.preventDefault(),r(e,"login")};e.find("#forgot-back-link").on("click",a),e.find("#forgot-success-back-link").on("click",a)}function S(e,a){F.render("#reset-form-container",w,{},{layout:"stacked",submitText:"Set new password",onSubmit:async t=>{if(t.password!==t.confirmPassword)return E.toast("Passwords do not match.",{type:"error"}),!1;try{await o.auth.resetPassword(a,t.password),E.toast("Password updated. Please sign in.",{type:"success"}),window.location.hash="#/login"}catch(s){return E.toast(s.message||"Link expired or invalid.",{type:"error"}),!1}}})}
+        `);o.on("click",()=>{e.find(".theme-swatch").removeClass("selected"),o.addClass("selected")}),s.append(o)}),e.find('[data-theme="charcoal-dark"]').addClass("selected")}function b(e){e.find("#ob-theme-skip").on("click",s=>{s.preventDefault(),r(e,"onboarding-done")}),e.find("#ob-theme-btn").on("click",async()=>{e.find("#ob-theme-error").hide();const s=e.find(".theme-swatch.selected").attr("data-theme")||"charcoal-dark",t=e.find("#ob-theme-btn").prop("disabled",!0).text("Applying\u2026");try{const o=await i.settings.get();await i.settings.save({...o,theme:s}),r(e,"onboarding-done")}catch(o){h(e,"ob-theme-error",o.message||"Could not save theme.")}finally{t.prop("disabled",!1).text("Apply theme")}})}function q(e){F.render("#login-form-container",C,{},{layout:"stacked",submitText:"Sign in",onSubmit:async s=>{try{const t=await i.auth.login(s);if(t?.challenge&&t.ticket)return w(e,t),!1;m(t),R.navigate("/")}catch(t){return E.toast(t.message||"Invalid credentials. Please try again.",{type:"error"}),!1}}}),e.find("#forgot-link").on("click",s=>{s.preventDefault(),r(e,"forgot"),A(e)})}function w(e,{challenge:s,ticket:t}){let o="code";const a=e.find("#challenge-code"),l=e.find("#challenge-error"),u=e.find("#challenge-recovery"),p=n=>{o=n;const d=n==="recovery";e.find("#challenge-label").text(d?"Recovery code":s.label||"Code"),e.find("#challenge-help").text(d?"Type one of the recovery codes you saved when you set this up. Each works once.":s.help||"Enter the code to finish signing in."),a.val("").attr("inputmode",d||s.inputMode==="text"?"text":"numeric"),u.text(d?"Use the code instead":"Use a recovery code instead"),l.hide(),setTimeout(()=>a.trigger("focus"),0)};e.find("#challenge-trust-wrap").toggle(s.trust===!0),u.toggle(s.recovery===!0),p("code"),r(e,"challenge"),u.off("click").on("click",n=>{n.preventDefault(),p(o==="code"?"recovery":"code")}),e.find("#challenge-back").off("click").on("click",n=>{n.preventDefault(),r(e,"login")}),e.find("#challenge-form").off("submit").on("submit",async n=>{n.preventDefault();const d=e.find("#challenge-submit").prop("disabled",!0);try{const c=await i.auth.verifyLogin({ticket:t,response:String(a.val()||"").trim(),mode:o,trust:e.find("#challenge-trust").prop("checked")===!0});if(c?.challenge&&c.ticket){w(e,c);return}m(c),R.navigate("/")}catch(c){const f=c.message||"That did not match.";l.text(f).show(),/sign in again/i.test(f)&&setTimeout(()=>r(e,"login"),1800)}finally{d.prop("disabled",!1)}})}function A(e){F.render("#forgot-form-container",S,{},{layout:"stacked",submitText:"Send reset link",onSubmit:async t=>{try{await i.auth.forgotPassword(t.email)}catch{}r(e,"forgot-success"),Domma.icons.scan()}});const s=t=>{t.preventDefault(),r(e,"login")};e.find("#forgot-back-link").on("click",s),e.find("#forgot-success-back-link").on("click",s)}function M(e,s){F.render("#reset-form-container",P,{},{layout:"stacked",submitText:"Set new password",onSubmit:async t=>{if(t.password!==t.confirmPassword)return E.toast("Passwords do not match.",{type:"error"}),!1;try{await i.auth.resetPassword(s,t.password),E.toast("Password updated. Please sign in.",{type:"success"}),window.location.hash="#/login"}catch(o){return E.toast(o.message||"Link expired or invalid.",{type:"error"}),!1}}})}

package/admin/js/views/my-profile.js

@@ -1 +1 @@
-import{api as V}from"../api.js";import{addBannerAction as fe}from"../lib/plugin-chrome.js";import{helpPopovers as ne}from"../lib/help-popover.js";import{accountFacts as re,buildPayload as he,checkForm as se,draftOf as be,fieldKind as H,fieldOptions as U,formFromMe as W,initials as ye,snapshot as T}from"../lib/my-profile-arrange.js";const z=/^\/my-profile\/?(\?.*)?$/,y=t=>String(t??"").replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;"),Y=t=>{if(!t)return"";try{return D(t).format("D MMM YYYY")}catch{return String(t).slice(0,10)}};let $=null,le=!1;function $e(){le||!window.R?.use||(le=!0,R.use((t,o,r)=>!(z.test(o?.path||"")&&!z.test(t?.path||""))||!$?.dirty()?r():E.confirm("You have unsaved changes to your profile. Leave anyway? They are kept for your next visit - except a new password, which you would type again.").then(i=>{i?r():history.replaceState(null,"","#/my-profile")})),M.subscribe("router:afterChange",({to:t}={})=>{if($&&!z.test(t?.path||"")){const o=$;$=null,o.dispose()}}))}function ge(t,o){const r=H(t.type),m=`mpx-pf-${o}`,i=t.required?' <span class="text-danger">*</span>':"",v=t.help||t.description?` <span data-help="${y(t.help||t.description)}"></span>`:"",u=`<label class="form-label" for="${m}">${y(t.label||t.name)}${i}${v}</label>`,b=`<small class="mpx-err" data-bind-hidden="!pe_${o}.value" data-bind-text="pe_${o}.value"></small>`,s=t.placeholder?` placeholder="${y(t.placeholder)}"`:"";switch(r){case"textarea":return`<div class="mpx-wide">${u}<textarea id="${m}" class="form-input" rows="3"${s} data-model="pf_${o}.value"></textarea>${b}</div>`;case"select":return`<div>${u}<select id="${m}" class="form-input" data-model="pf_${o}.value"><option value="">-</option>${U(t).map(c=>`<option value="${y(c.value)}">${y(c.label)}</option>`).join("")}</select>${b}</div>`;case"checkbox":return`<div><label class="mpx-check"><input id="${m}" type="checkbox" data-model="pf_${o}.value"> ${y(t.label||t.name)}${i}</label>${v}${b}</div>`;case"multi":return`<div class="mpx-wide">${u}<div data-multi="${o}">${U(t).map((c,f)=>`<label class="mpx-check"><input type="checkbox" data-opt="${y(c.value)}" data-bind-checked="po_${o}_${f}.value"> ${y(c.label)}</label>`).join("")}</div>${b}</div>`;default:return`<div>${u}<input id="${m}" type="${r}" class="form-input"${s} data-model="pf_${o}.value">${b}</div>`}}export const myProfileView={templateUrl:"/admin/js/templates/my-profile.html",async onMount(t){if($e(),$){const e=$;$=null,e.dispose()}const o=[],r=e=>(o.push(e),e);let m=!1;const i=t.get(0).querySelector(".mpx")||t.get(0),v=()=>!m&&i.isConnected,u=M.observable(!0),b=M.observable(""),s=M.observable(null),c=M.observable(""),f=M.observable(""),w=M.observable(""),j=M.observable(""),ce=M.observable(!1),P=M.observable(!1),G=M.observable(!1);let p=[];const g=new Map,J=M.observable(0),h=M.observable(W({},[])),ie=()=>(J.value,Object.fromEntries([...g].map(([e,a])=>[e,a.value]))),ue=()=>Object.fromEntries([...g].map(([e,a])=>[e,a.peek()])),Q=()=>({name:c.value,email:f.value,password:w.value,confirm:j.value,profile:ie()}),X=()=>({name:c.peek(),email:f.peek(),password:w.peek(),confirm:j.peek(),profile:ue()}),B=M.computed(()=>se(Q(),p,{saved:h.value})),k=M.computed(()=>!u.value&&T(Q())!==T(h.value)),pe={loading:u,loadError:b,name:c,email:f,password:w,confirm:j,showPw:ce,hasProfile:G,err:B,dirty:k,cannotSave:M.computed(()=>P.value||!k.value||Object.keys(B.value).length>0),emailChanged:M.computed(()=>f.value.trim()!==""&&f.value.trim()!==h.value.email),pwMatch:M.computed(()=>w.value.length>=8&&w.value===j.value),avatar:M.computed(()=>ye(c.value||s.value?.name)),shownName:M.computed(()=>c.value.trim()||s.value?.name||""),shownEmail:M.computed(()=>f.value.trim()||s.value?.email||""),rolesText:M.computed(()=>re(s.value).roles.join(" + ")),accessText:M.computed(()=>re(s.value).access),factsText:M.computed(()=>{const e=s.value;return e?[e.createdAt&&`Member since ${Y(e.createdAt)}`,e.lastLogin&&`last signed in ${Y(e.lastLogin)}`,e.updatedAt&&`changed ${Y(e.updatedAt)}`,e.isActive===!1&&"account disabled"].filter(Boolean).join(" \xB7 "):""})},A=()=>`my-profile.draft.${s.peek()?.id||"me"}`;function N(e){c.value=e.name,f.value=e.email,w.value="",j.value="";for(const[a,l]of g)a in(e.profile||{})&&(l.value=e.profile[a])}async function q(){if(P.peek()||u.peek())return;const e=X();if(Object.keys(se(e,p,{saved:h.peek()})).length){E.toast("Check the fields marked in red first.",{type:"warning"});return}const a=he(h.peek(),e,p);if(!a){E.toast("Nothing has changed.",{type:"info"});return}P.value=!0;try{const l=await V.auth.updateMe(a.payload);if(!v())return;s.value=l;const C=W(l,p);h.value=C,N(C),F();try{S.set("auth_user",{...S.get("auth_user")||{},name:l.name,email:l.email})}catch{}const n=document.getElementById("topbar-user-name");n&&l.name&&(n.textContent=l.name);const d={name:"your name",email:"your email",password:"your password",profile:"your profile"};E.toast(`Saved ${a.parts.map(_=>d[_]).join(", ").replace(/, ([^,]*)$/," and $1")}.`,{type:"success"})}catch(l){E.toast(`Not saved: ${l.message||l}`,{type:"error"})}finally{P.value=!1}}async function de(){k.peek()&&(!await E.confirm("Throw away the changes you have not saved?")||!v()||(N(h.peek()),F()))}function Z(){if(!k.peek())return;const e=be(X());if(T({...e,password:"",confirm:""})!==T(h.peek()))try{S.set(A(),{form:e,at:new Date().toISOString()})}catch{}}function F(){try{S.remove?S.remove(A()):S.set(A(),null)}catch{}}const me=M.applyBindings(pe,i,{methods:{save:q,discard:de}});r(()=>me.dispose()),r(ne(i,{position:"bottom"})),fe(t,{id:"my-profile-save",icon:"save",title:"Save (Ctrl+S)",onClick:()=>q()});const ee=e=>{!(e.ctrlKey||e.metaKey)||e.key.toLowerCase()!=="s"||!v()||(e.preventDefault(),e.stopImmediatePropagation(),q())};document.addEventListener("keydown",ee,!0),r(()=>document.removeEventListener("keydown",ee,!0));const te=e=>{k.peek()&&(Z(),e.preventDefault(),e.returnValue="")};window.addEventListener("beforeunload",te),r(()=>window.removeEventListener("beforeunload",te)),$={dirty:()=>k.peek(),dispose(){m=!0,Z(),o.splice(0).reverse().forEach(e=>{try{e()}catch{}})}},I.scan(i);let ae=null;try{const[e,a]=await Promise.all([V.auth.me(),V.collections.get("user-profiles").catch(()=>null)]);if(!v())return;s.value=e,ae=a}catch(e){if(!v())return;b.value=`Could not load your account: ${e.message||e}`,u.value=!1;return}p=(ae?.fields||[]).filter(e=>e&&e.name);const L=W(s.peek(),p),K=p.map((e,a)=>({f:e,i:a})).filter(({f:e})=>H(e.type)!=="hidden");if(p.forEach((e,a)=>g.set(e.name,M.observable(L.profile[e.name]))),K.length){const e=i.querySelector(".mpx-profile");e.innerHTML=K.map(({f:n,i:d})=>ge(n,d)).join("");const a={};p.forEach((n,d)=>{a[`pf_${d}`]=g.get(n.name),a[`pe_${d}`]=M.computed(()=>B.value[`profile.${n.name}`]||""),H(n.type)==="multi"&&U(n).forEach((_,O)=>{a[`po_${d}_${O}`]=M.computed(()=>(g.get(n.name).value||[]).includes(_.value))})});const l=M.applyBindings(a,e);r(()=>l.dispose());const C=n=>{const d=n.target.closest("[data-multi]");if(!d||!n.target.matches("input[data-opt]"))return;const _=g.get(p[Number(d.dataset.multi)].name),O=n.target.dataset.opt,oe=_.peek()||[];_.value=n.target.checked?[...new Set([...oe,O])]:oe.filter(ve=>ve!==O)};e.addEventListener("change",C),r(()=>e.removeEventListener("change",C)),r(ne(e,{position:"bottom"})),I.scan(e)}G.value=K.length>0,h.value=L,N(L),J.value++,u.value=!1;let x=null;try{x=S.get(A())}catch{}if(x?.form){F();const e=x.at?` (${Y(x.at)})`:"";await E.confirm(`You left unsaved changes to your profile${e}. Restore them?`)&&v()&&N({...L,...x.form,profile:{...L.profile,...x.form.profile||{}}})}}};
+import{api as G,apiRequest as Le,getToken as Te,refreshAccessToken as Ae}from"../api.js";import{avatarUrl as F,showTopbarAvatar as me}from"../lib/avatar.js";import{addBannerAction as _e}from"../lib/plugin-chrome.js";import{helpPopovers as fe}from"../lib/help-popover.js";import{accountFacts as he,buildPayload as De,checkForm as ye,draftOf as je,fieldKind as J,fieldOptions as Q,formFromMe as X,initials as Ce,snapshot as K}from"../lib/my-profile-arrange.js";const Z=/^\/my-profile\/?(\?.*)?$/,w=t=>String(t??"").replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;"),U=t=>{if(!t)return"";try{return D(t).format("D MMM YYYY")}catch{return String(t).slice(0,10)}};let $=null,ge=!1;function Pe(){ge||!window.R?.use||(ge=!0,R.use((t,s,l)=>!(Z.test(s?.path||"")&&!Z.test(t?.path||""))||!$?.dirty()?l():E.confirm("You have unsaved changes to your profile. Leave anyway? They are kept for your next visit - except a new password, which you would type again.").then(c=>{c?l():history.replaceState(null,"","#/my-profile")})),M.subscribe("router:afterChange",({to:t}={})=>{if($&&!Z.test(t?.path||"")){const s=$;$=null,s.dispose()}}))}function Ne(t,s){const l=J(t.type),m=`mpx-pf-${s}`,c=t.required?' <span class="text-danger">*</span>':"",u=t.help||t.description?` <span data-help="${w(t.help||t.description)}"></span>`:"",d=`<label class="form-label" for="${m}">${w(t.label||t.name)}${c}${u}</label>`,g=`<small class="mpx-err" data-bind-hidden="!pe_${s}.value" data-bind-text="pe_${s}.value"></small>`,r=t.placeholder?` placeholder="${w(t.placeholder)}"`:"";switch(l){case"textarea":return`<div class="mpx-wide">${d}<textarea id="${m}" class="form-input" rows="3"${r} data-model="pf_${s}.value"></textarea>${g}</div>`;case"select":return`<div>${d}<select id="${m}" class="form-input" data-model="pf_${s}.value"><option value="">-</option>${Q(t).map(p=>`<option value="${w(p.value)}">${w(p.label)}</option>`).join("")}</select>${g}</div>`;case"checkbox":return`<div><label class="mpx-check"><input id="${m}" type="checkbox" data-model="pf_${s}.value"> ${w(t.label||t.name)}${c}</label>${u}${g}</div>`;case"multi":return`<div class="mpx-wide">${d}<div data-multi="${s}">${Q(t).map((p,f)=>`<label class="mpx-check"><input type="checkbox" data-opt="${w(p.value)}" data-bind-checked="po_${s}_${f}.value"> ${w(p.label)}</label>`).join("")}</div>${g}</div>`;default:return`<div>${d}<input id="${m}" type="${l}" class="form-input"${r} data-model="pf_${s}.value">${g}</div>`}}export const myProfileView={templateUrl:"/admin/js/templates/my-profile.html",async onMount(t){if(Pe(),$){const e=$;$=null,e.dispose()}const s=[],l=e=>(s.push(e),e);let m=!1;const c=t.get(0).querySelector(".mpx")||t.get(0),u=()=>!m&&c.isConnected,d=M.observable(!0),g=M.observable(""),r=M.observable(null),p=M.observable(""),f=M.observable(""),x=M.observable(""),j=M.observable(""),be=M.observable(!1),N=M.observable(!1),ee=M.observable(!1);let v=[];const k=new Map,te=M.observable(0),h=M.observable(X({},[])),b=M.observable(!1),O=M.observable(!1),we=()=>(te.value,Object.fromEntries([...k].map(([e,a])=>[e,a.value]))),$e=()=>Object.fromEntries([...k].map(([e,a])=>[e,a.peek()])),ae=()=>({name:p.value,email:f.value,password:x.value,confirm:j.value,profile:we()}),re=()=>({name:p.peek(),email:f.peek(),password:x.peek(),confirm:j.peek(),profile:$e()}),H=M.computed(()=>ye(ae(),v,{saved:h.value})),L=M.computed(()=>!d.value&&K(ae())!==K(h.value)),ke={loading:d,loadError:g,name:p,email:f,password:x,confirm:j,showPw:be,hasProfile:ee,err:H,dirty:L,cannotSave:M.computed(()=>N.value||!L.value||Object.keys(H.value).length>0),emailChanged:M.computed(()=>f.value.trim()!==""&&f.value.trim()!==h.value.email),pwMatch:M.computed(()=>x.value.length>=8&&x.value===j.value),avatar:M.computed(()=>Ce(p.value||r.value?.name)),avatarUrl:M.computed(()=>F(r.value)),avatarAction:M.computed(()=>b.value?"Uploading\u2026":F(r.value)?"Change picture":"Add a picture"),uploading:b,dropping:O,shownName:M.computed(()=>p.value.trim()||r.value?.name||""),shownEmail:M.computed(()=>f.value.trim()||r.value?.email||""),rolesText:M.computed(()=>he(r.value).roles.join(" + ")),accessText:M.computed(()=>he(r.value).access),factsText:M.computed(()=>{const e=r.value;return e?[e.createdAt&&`Member since ${U(e.createdAt)}`,e.lastLogin&&`last signed in ${U(e.lastLogin)}`,e.updatedAt&&`changed ${U(e.updatedAt)}`,e.isActive===!1&&"account disabled"].filter(Boolean).join(" \xB7 "):""})},Y=()=>`my-profile.draft.${r.peek()?.id||"me"}`;function q(e){p.value=e.name,f.value=e.email,x.value="",j.value="";for(const[a,o]of k)a in(e.profile||{})&&(o.value=e.profile[a])}async function V(){if(N.peek()||d.peek())return;const e=re();if(Object.keys(ye(e,v,{saved:h.peek()})).length){E.toast("Check the fields marked in red first.",{type:"warning"});return}const a=De(h.peek(),e,v);if(!a){E.toast("Nothing has changed.",{type:"info"});return}N.value=!0;try{const o=await G.auth.updateMe(a.payload);if(!u())return;r.value=o;const y=X(o,v);h.value=y,q(y),z();try{S.set("auth_user",{...S.get("auth_user")||{},name:o.name,email:o.email})}catch{}const n=document.getElementById("topbar-user-name");n&&o.name&&(n.textContent=o.name);const i={name:"your name",email:"your email",password:"your password",profile:"your profile"};E.toast(`Saved ${a.parts.map(_=>i[_]).join(", ").replace(/, ([^,]*)$/," and $1")}.`,{type:"success"})}catch(o){E.toast(`Not saved: ${o.message||o}`,{type:"error"})}finally{N.value=!1}}async function Me(){L.peek()&&(!await E.confirm("Throw away the changes you have not saved?")||!u()||(q(h.peek()),z()))}function oe(){if(!L.peek())return;const e=je(re());if(K({...e,password:"",confirm:""})!==K(h.peek()))try{S.set(Y(),{form:e,at:new Date().toISOString()})}catch{}}function z(){try{S.remove?S.remove(Y()):S.set(Y(),null)}catch{}}const C=c.querySelector(".mpx-avatar-file");async function ne(e){if(!(!e||b.peek())){if(!/^image\//.test(e.type)&&!/\.(heic|heif|avif)$/i.test(e.name)){E.toast("Choose an image file.",{type:"warning"});return}if(e.size>8*1024*1024){E.toast("That image is too large - at most 8 MB.",{type:"warning"});return}b.value=!0;try{const a=n=>{const i=new FormData;return i.append("file",e,e.name),fetch("/api/auth/me/avatar",{method:"POST",body:i,headers:n?{Authorization:`Bearer ${n}`}:{}})};let o=await a(Te());o.status===401&&(o=await a(await Ae()));const y=await o.json().catch(()=>({}));if(!o.ok)throw new Error(y.error||`HTTP ${o.status}`);if(!u())return;r.value={...r.peek(),avatar:y.avatar},me(F(y)),E.toast("Your picture is saved.",{type:"success"})}catch(a){E.toast(`Not saved: ${a.message||a}`,{type:"error"})}finally{b.value=!1,C.value=""}}}async function Ee(){if(!(!F(r.peek())||b.peek())&&!(!await E.confirm("Remove your picture? Your initials show instead.")||!u())){b.value=!0;try{if(await Le("/auth/me/avatar",{method:"DELETE"}),!u())return;r.value={...r.peek(),avatar:""},me(""),E.toast("Picture removed.",{type:"success"})}catch(e){E.toast(`Not removed: ${e.message||e}`,{type:"error"})}finally{b.value=!1}}}const se=()=>ne(C.files?.[0]);C.addEventListener("change",se),l(()=>C.removeEventListener("change",se));const T=c.querySelector(".mpx-avatar"),le=e=>{[...e.dataTransfer?.types||[]].includes("Files")&&(e.preventDefault(),O.value=!0)},ie=()=>{O.value=!1},ce=e=>{e.preventDefault(),O.value=!1,ne(e.dataTransfer?.files?.[0])};T.addEventListener("dragover",le),T.addEventListener("dragleave",ie),T.addEventListener("drop",ce),l(()=>{T.removeEventListener("dragover",le),T.removeEventListener("dragleave",ie),T.removeEventListener("drop",ce)});const xe=M.applyBindings(ke,c,{methods:{save:V,discard:Me,removeAvatar:Ee,pickAvatar:()=>C.click()}});l(()=>xe.dispose()),l(fe(c,{position:"bottom"})),_e(t,{id:"my-profile-save",icon:"save",title:"Save (Ctrl+S)",onClick:()=>V()});const ue=e=>{!(e.ctrlKey||e.metaKey)||e.key.toLowerCase()!=="s"||!u()||(e.preventDefault(),e.stopImmediatePropagation(),V())};document.addEventListener("keydown",ue,!0),l(()=>document.removeEventListener("keydown",ue,!0));const pe=e=>{L.peek()&&(oe(),e.preventDefault(),e.returnValue="")};window.addEventListener("beforeunload",pe),l(()=>window.removeEventListener("beforeunload",pe)),$={dirty:()=>L.peek(),dispose(){m=!0,oe(),s.splice(0).reverse().forEach(e=>{try{e()}catch{}})}},I.scan(c);let de=null;try{const[e,a]=await Promise.all([G.auth.me(),G.collections.get("user-profiles").catch(()=>null)]);if(!u())return;r.value=e,de=a}catch(e){if(!u())return;g.value=`Could not load your account: ${e.message||e}`,d.value=!1;return}v=(de?.fields||[]).filter(e=>e&&e.name);const P=X(r.peek(),v),W=v.map((e,a)=>({f:e,i:a})).filter(({f:e})=>J(e.type)!=="hidden");if(v.forEach((e,a)=>k.set(e.name,M.observable(P.profile[e.name]))),W.length){const e=c.querySelector(".mpx-profile");e.innerHTML=W.map(({f:n,i})=>Ne(n,i)).join("");const a={};v.forEach((n,i)=>{a[`pf_${i}`]=k.get(n.name),a[`pe_${i}`]=M.computed(()=>H.value[`profile.${n.name}`]||""),J(n.type)==="multi"&&Q(n).forEach((_,B)=>{a[`po_${i}_${B}`]=M.computed(()=>(k.get(n.name).value||[]).includes(_.value))})});const o=M.applyBindings(a,e);l(()=>o.dispose());const y=n=>{const i=n.target.closest("[data-multi]");if(!i||!n.target.matches("input[data-opt]"))return;const _=k.get(v[Number(i.dataset.multi)].name),B=n.target.dataset.opt,ve=_.peek()||[];_.value=n.target.checked?[...new Set([...ve,B])]:ve.filter(Se=>Se!==B)};e.addEventListener("change",y),l(()=>e.removeEventListener("change",y)),l(fe(e,{position:"bottom"})),I.scan(e)}ee.value=W.length>0,h.value=P,q(P),te.value++,d.value=!1;let A=null;try{A=S.get(Y())}catch{}if(A?.form){z();const e=A.at?` (${U(A.at)})`:"";await E.confirm(`You left unsaved changes to your profile${e}. Restore them?`)&&u()&&q({...P,...A.form,profile:{...P.profile,...A.form.profile||{}}})}}};

package/bin/update.js

@@ -436,8 +436,12 @@ export default async function update(_positional, flags) {
     done();
 
     // -------------------------------------------------------------------------
-    // 8. Register new plugins in plugins.json (disabled by default)
+    // 8. Register new plugins in plugins.json (disabled by default - except the
+    //    ones that protect the site, which arrive switched on: a security tool
+    //    left off protects nobody. Only the FIRST time: a site that switched it
+    //    off keeps it off.)
     // -------------------------------------------------------------------------
+    const ON_ARRIVAL = new Set(['security']);
 
     const pluginsJsonPath = path.join(cwd, 'config/plugins.json');
     if (newPlugins.length > 0 && existsSync(pluginsJsonPath)) {
@@ -445,7 +449,7 @@ export default async function update(_positional, flags) {
             const pluginsCfg = readJson(pluginsJsonPath);
             for (const name of newPlugins) {
                 if (!(name in pluginsCfg)) {
-                    pluginsCfg[name] = {enabled: false, settings: {}};
+                    pluginsCfg[name] = {enabled: ON_ARRIVAL.has(name), settings: {}};
                 }
             }
             writeJson(pluginsJsonPath, pluginsCfg);
@@ -579,7 +583,7 @@ export default async function update(_positional, flags) {
     }
 
     if (newPlugins.length > 0) {
-        info(`New plugins added (disabled by default): ${newPlugins.join(', ')}`);
+        info(`New plugins added: ${newPlugins.join(', ')}`);
     }
 
     const allMergedKeys = Object.entries(mergedKeys);

package/config/plugins.json

@@ -26,5 +26,10 @@
     "enabled": false,
     "bundled": true,
     "settings": {}
+  },
+  "security": {
+    "enabled": true,
+    "bundled": true,
+    "settings": {}
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "0.81.1",
+  "version": "0.83.0",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",
@@ -25,6 +25,7 @@
     "!plugins/notes/data",
     "!plugins/todo/data",
     "!plugins/mail-reader/data",
+    "!plugins/security/data",
     "!plugins/_lib/data",
     "scripts/",
     "docs/",

package/plugins/free-tier.lock.json

@@ -1,6 +1,6 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@5f64a68",
+  "source": "dcms-marketplace@83880c0",
   "plugins": {
     "blog": {
       "version": "1.6.3",
@@ -75,6 +75,30 @@
         "plugin.js": "ebe4c41bdd8836fb3128af3a0e789d47f89b00e9e37dc9378bb308aaae8d41b2",
         "plugin.json": "ed1f02d9405f6ae1257313ea4155ea49e307fb2210650fd247b92e6988aa78d1"
       }
+    },
+    "security": {
+      "version": "1.0.0",
+      "files": {
+        "CLAUDE.md": "ae819fd418724c202ec618aae0adb936d2bcebee94afcb40d9944687a335be7e",
+        "admin/lib/blocks.js": "5ef346b7de751518f8beb9212e3b89b270ae236560ae3d8a1f40d129c50918ff",
+        "admin/lib/health.js": "3b233a3d29b2d69c333321602c13233b8221cfe1114aa03903739d9ae8ad65d5",
+        "admin/lib/ip.js": "cf33be4fa2e2cad37bafd12ebec17f293891a88de402caad1bf9c9a57ce87680",
+        "admin/lib/lockout.js": "c5e5e4b2934296f81ae8ed013725485bc269a0ef3cf3bdf3c16c53936635a1ee",
+        "admin/lib/policy.js": "a4aedfd28f992e0e7759bbdac6344681eebe617c27849e91fa4405f6190f8462",
+        "admin/lib/probes.js": "d56318903cb645a39f56e7762eddb7411941a72e1f446c1f9d79e35157f1d31b",
+        "admin/lib/settings.js": "9b6c2fb3b54a1dcb642e3af6f584f93375f824fce67717a1ee56bebee9c35645",
+        "admin/templates/security.html": "e96060b4849a1ef7691a918b9a77aff05ea3a2182a6093001454d04eb58c648d",
+        "admin/views/security.js": "dcd38e07c5e83bbe013f5d764c52edef76d28ed4c3fe1cba8c5a59ce1b93e962",
+        "bin/unlock.js": "5fcc3c0ef3ba3c424a366aa62896f51abad578183dfde283aa838a86549ca785",
+        "config.js": "e6a00f7816637687d6a68ebbac65a71489246a926c28523c2a78d859e75b7ae0",
+        "plugin.js": "1561f1ed79c919e6e95407a159a3b151aa7cd867893ba17d62a8761a7fbd383b",
+        "plugin.json": "01160560c8b0df5661859a1cdaf9ab81ee6b13735f06cce48602bf6700acb686",
+        "server/common-passwords.NOTICE": "3b148a49a569bfa24feaa7879db602da8f0607fa61ab6c52b7a62391fc7c009a",
+        "server/common-passwords.txt": "68782d6a4a19a4768d5f15dd66bd534e7a33055cc755411e33f16d18c50fdcce",
+        "server/facts.js": "fc07b1d697d2d8dc28accbba133c0f407a4ec522597fb8e146c475d0fc0fcde5",
+        "server/state.js": "1319b322e94a4aec176948990b2d674b28dfece761eef4d5685df474037bfc4a",
+        "tests/security.test.js": "951636a0e42ac8dbf78b69ca7e7e2adcd4e29d94a51998e738c3afa742c00866"
+      }
     }
   }
 }

package/plugins/security/CLAUDE.md

@@ -0,0 +1,41 @@
+# Security (free) - AI Assistant Guide
+
+Ships with the engine (free tier, `make sync-free-tier`); switched ON when it first arrives (bin/update.js
+`ON_ARRIVAL`). Security Pro (paid) will supersede it. Plan: dcms-marketplace/docs/security-plan.md.
+
+## What it does
+- **Guard** (global `onRequest`; `fastify-plugin`, like Analytics Pro): a blocked address gets a bare 403; a probe path
+  (`admin/lib/probes.js` - WordPress, .env, .git, *.php...) a bare 404 before any rendering; N probes in M minutes from
+  one address = a temporary block. Genuinely local calls (loopback socket, no X-Forwarded-For) are never touched; an
+  address someone signed in from in the last 7 days is never auto-blocked (a manual rule still applies). Fails OPEN.
+- **Sign-in lockout**: a 'before' login check (core 0.83 `registerLoginCheck`) refuses while the account or the address
+  is locked (429, "Try again in N minutes" - never says whether the account exists). Counted from `auth:loginFailed`
+  (not the lockout's own refusals); progressive (`admin/lib/lockout.js`); a success clears the account.
+- **Password rules**: `registerPasswordCheck` - min length (10), not in `server/common-passwords.txt` (SecLists 10k,
+  MIT - see the NOTICE), not containing the name/email, not one or two characters repeated.
+- **Sign-in log**: `data/signins.jsonl`, kept `signinDays`; notifications (sources `security:lockouts`,
+  `security:suspicious`, `security:probes` - the last off by default).
+- **Health check**: `server/facts.js` gathers (users, engine vs npm latest, certificate via tls, security headers of the
+  public home page, private paths fetched LOCALLY, TRUST_PROXY, bind, SMTP, licences); `admin/lib/health.js` judges.
+  Unknown = 'info', never a pass. Cached 10 min; the sidebar badge (`/count`) = checks needing attention, red only
+  when a failing check is critical.
+- Engines before 0.83 have no sign-in checks: the plugin logs it, the screen says so, lockout/rules are off.
+
+## Data (plugins/security/data - kept by updates, never bundled)
+`state.json` = {lockouts, rules, temp, trusted, counters}, in memory + debounced writes; RE-READ when changed on disk
+(the CLI). `signins.jsonl`.
+
+## Emergency
+`node plugins/security/bin/unlock.js --list | --all | --ip X | --user email` in the site folder; the site picks it up
+within ~3 s. It must always work - keep it dependency-free.
+
+## Permission
+`security` (read / manage), granted to admin. Routes: /health /count /overview /signins /blocks (GET/POST/DELETE)
+/lockouts (DELETE) /settings (GET/PUT).
+
+## Admin
+`admin/views/security.js` + `admin/templates/security.html`: Overview / Sign-ins / Blocked, settings slideover
+(cog), Refresh. Public data (emails, addresses, user-agents) only through data-bind-text; rows by index.
+
+## Tests
+`tests/security.test.js` (pure). Headless: throwaway CMS with TRUST_PROXY=loopback and X-Forwarded-For.

package/plugins/security/admin/lib/blocks.js

@@ -0,0 +1,46 @@
+/**
+ * Security - blocking an address: manual rules (ip.js syntax) and temporary
+ * blocks (an address that kept probing). An address that signed in recently is
+ * "trusted": probing never blocks it (an admin mistyping /wp-admin must not lock
+ * themselves out) - a manual rule still does. Loopback is never blocked. Pure.
+ */
+import {ipMatches, isLoopbackIp, plainIp} from './ip.js';
+
+export const TRUST_DAYS = 7;
+
+/**
+ * Why an address is blocked, or null.
+ *
+ * @param {{rules: {rule: string}[], temp: Object<string, {until: number, reason: string}>}} state
+ */
+export function blockedBy(state, ip, now = Date.now()) {
+    const a = plainIp(ip);
+    if (!a || isLoopbackIp(a)) return null;
+    const rule = (state.rules || []).find(r => ipMatches(a, [r.rule]));
+    if (rule) return {kind: 'rule', rule: rule.rule, reason: rule.note || 'Blocked by hand'};
+    const t = state.temp?.[a];
+    if (t && t.until > now) return {kind: 'temp', until: t.until, reason: t.reason};
+    return null;
+}
+
+export const isTrusted = (state, ip, now = Date.now()) => (state.trusted?.[plainIp(ip)] || 0) > now - TRUST_DAYS * 86_400_000;
+
+/**
+ * Count a probe from an address (in `recent`, a Map kept in memory). True when
+ * it should now be blocked.
+ */
+export function recordProbe(recent, ip, {now = Date.now(), blockAfter = 5, withinMin = 10} = {}) {
+    const a = plainIp(ip);
+    const list = (recent.get(a) || []).filter(t => t > now - withinMin * 60_000);
+    list.push(now);
+    recent.set(a, list);
+    if (recent.size > 10_000) recent.delete(recent.keys().next().value);
+    return list.length >= blockAfter;
+}
+
+/** Forget ended temporary blocks and old trust. */
+export function pruneBlocks(state, now = Date.now()) {
+    for (const [ip, t] of Object.entries(state.temp || {})) if (t.until < now) delete state.temp[ip];
+    for (const [ip, at] of Object.entries(state.trusted || {})) if (at < now - TRUST_DAYS * 86_400_000) delete state.trusted[ip];
+    return state;
+}

package/plugins/security/admin/lib/health.js

@@ -0,0 +1,148 @@
+/**
+ * Security - the health check: facts about the site in, checks out. Pure; the
+ * server gathers the facts (server/facts.js). Each check says what it found,
+ * why it matters and how to fix it - a check that cannot be answered is 'info',
+ * never a pass.
+ *
+ * status: 'pass' | 'warn' | 'fail' | 'info'; `critical` makes a fail red in the badge.
+ */
+
+const DAY = 86_400_000;
+const plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+const names = (list) => (list.length <= 3 ? list.join(', ') : `${list.slice(0, 3).join(', ')} and ${list.length - 3} more`);
+
+function semverBehind(installed, latest) {
+    const a = String(installed || '').split('.').map(Number);
+    const b = String(latest || '').split('.').map(Number);
+    if (a.length < 3 || b.length < 3 || [...a, ...b].some(Number.isNaN)) return null;
+    for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] < b[i] ? {major: i === 0, minor: i === 1, patch: i === 2} : false;
+    return false;
+}
+
+/**
+ * @param {object} f - facts (see server/facts.js)
+ * @param {{now?: number, staleAdminDays?: number}} [opts]
+ * @returns {{checks: object[], score: number, failing: number, critical: number}}
+ */
+export function evaluate(f = {}, {now = Date.now(), staleAdminDays = 90} = {}) {
+    const checks = [];
+    const add = (c) => checks.push({critical: false, link: '', ...c});
+
+    // --- People ---
+    const admins = f.admins || [];
+    const stale = admins.filter(a => !a.lastLogin || Date.parse(a.lastLogin) < now - staleAdminDays * DAY);
+    add({id: 'admins-stale', group: 'People', title: 'Unused admin accounts',
+        status: !admins.length ? 'info' : stale.length ? 'warn' : 'pass',
+        detail: stale.length ? `${plural(stale.length, 'admin')} not signed in for ${staleAdminDays}+ days: ${names(stale.map(a => a.name || a.email))}.` : `Every admin has signed in within ${staleAdminDays} days.`,
+        why: 'An admin account nobody uses is one nobody would notice being used by someone else.',
+        fix: 'Switch off or remove admin accounts that are no longer needed, or lower their role.', link: '#/users'});
+    add({id: 'admins-count', group: 'People', title: 'How many admins',
+        status: admins.length > 5 ? 'warn' : admins.length ? 'pass' : 'info',
+        detail: `${plural(admins.length, 'admin')} (admin or super admin).`,
+        why: 'Every admin can change everything. Fewer admins, fewer ways in.',
+        fix: 'Give people the lowest role that lets them do their job.', link: '#/users'});
+    const never = (f.users || []).filter(u => !u.lastLogin && u.createdAt && Date.parse(u.createdAt) < now - 30 * DAY);
+    add({id: 'users-never', group: 'People', title: 'Accounts never used',
+        status: never.length ? 'warn' : 'pass',
+        detail: never.length ? `${plural(never.length, 'account')} made over 30 days ago and never signed in: ${names(never.map(u => u.name || u.email))}.` : 'Every account older than 30 days has been used.',
+        why: 'An account with a password nobody changed is an easy one to guess.',
+        fix: 'Remove accounts nobody uses.', link: '#/users'});
+
+    // --- Sign-in ---
+    add({id: 'lockout', group: 'Sign-in', title: 'Sign-in lockout',
+        status: f.protections?.checks === false ? 'fail' : f.protections?.lockout ? 'pass' : 'warn', critical: f.protections?.checks === false,
+        detail: f.protections?.checks === false ? 'This engine is too old for sign-in checks (needs Domma CMS 0.83 or later).'
+            : f.protections?.lockout ? 'Repeated wrong passwords lock the account and the address for a while.' : 'Switched off in the settings.',
+        why: 'Without it, a password can be guessed as fast as the rate limit allows, forever.',
+        fix: f.protections?.checks === false ? 'Update the CMS.' : 'Switch it on in the settings (the cog).'});
+    add({id: 'policy', group: 'Sign-in', title: 'Password rules',
+        status: f.protections?.policy ? (f.policyMin >= 10 ? 'pass' : 'warn') : 'warn',
+        detail: f.protections?.policy ? `New passwords: at least ${f.policyMin} characters, not a common one, not your name or email.` : 'Only the CMS minimum (8 characters) applies.',
+        why: 'Most break-ins use passwords that are short, common or guessable from the person.',
+        fix: 'Switch the password rules on, with at least 10 characters.'});
+    add({id: 'two-factor', group: 'Sign-in', title: 'Two-factor sign-in',
+        status: f.twoFactor ? 'pass' : 'info',
+        detail: f.twoFactor ? 'Available.' : 'Not available - Security Pro adds two-factor sign-in with an authenticator app.',
+        why: 'A stolen or guessed password alone is then not enough to get in.',
+        fix: 'Security Pro.'});
+    add({id: 'smtp', group: 'Sign-in', title: 'Email for resets and alerts',
+        status: f.smtp ? 'pass' : 'warn',
+        detail: f.smtp ? 'Email is set up.' : 'No outgoing email: password resets and alerts cannot be sent.',
+        why: 'Without email, a locked-out admin has no self-service way back, and alerts go unseen.',
+        fix: 'Set up email in Settings.', link: '#/settings'});
+
+    // --- Server ---
+    const behind = semverBehind(f.engine?.installed, f.engine?.latest);
+    add({id: 'engine', group: 'Server', title: 'Domma CMS up to date',
+        status: behind === null ? 'info' : behind ? (behind.major || behind.minor ? 'warn' : 'pass') : 'pass',
+        detail: behind === null ? `Running ${f.engine?.installed || 'an unknown version'}; the latest could not be checked.`
+            : behind ? `Running ${f.engine.installed}; ${f.engine.latest} is out.` : `Running ${f.engine.installed}, the latest.`,
+        why: 'Updates carry security fixes.', fix: 'Update the CMS (or ask whoever hosts it).'});
+    add({id: 'production', group: 'Server', title: 'Production mode',
+        status: f.nodeEnv === 'production' ? 'pass' : 'warn',
+        detail: f.nodeEnv === 'production' ? 'NODE_ENV is production.' : `NODE_ENV is "${f.nodeEnv || 'not set'}".`,
+        why: 'Outside production, errors can show more than a visitor should see.',
+        fix: 'Set NODE_ENV=production in the site\'s .env and restart.'});
+    if (f.proxy?.via) {
+        const t = f.proxy.trust;
+        add({id: 'proxy', group: 'Server', title: 'Visitor addresses',
+            status: t === false ? 'fail' : t === true ? 'warn' : 'pass', critical: t === false,
+            detail: t === false ? 'The site is behind a proxy but does not trust it: every visitor looks like the proxy.'
+                : t === true ? 'Every proxy hop is trusted (TRUST_PROXY=1): a visitor can choose the address they appear as.' : `TRUST_PROXY=${t}.`,
+            why: 'Rate limits, lockouts and blocks all go by the visitor\'s address.',
+            fix: 'Set TRUST_PROXY=loopback in the site\'s .env and restart.'});
+    }
+    if (f.bind) {
+        add({id: 'bind', group: 'Server', title: 'Listening address',
+            status: f.bind === '0.0.0.0' && f.proxy?.via ? 'warn' : 'pass',
+            detail: f.bind === '0.0.0.0' && f.proxy?.via ? 'The CMS listens on every network interface although a proxy fronts it.' : `Listening on ${f.bind}.`,
+            why: 'Reached directly, the CMS bypasses the proxy and its protections.',
+            fix: 'Set "host": "127.0.0.1" in config/server.json when a proxy sits in front.'});
+    }
+
+    // --- Web ---
+    if (f.cert) {
+        const d = f.cert.daysLeft;
+        add({id: 'certificate', group: 'Web', title: 'HTTPS certificate',
+            status: d === null || d === undefined ? 'info' : d < 7 ? 'fail' : d < 21 ? 'warn' : 'pass', critical: d !== null && d < 7,
+            detail: d === null || d === undefined ? `Could not read the certificate${f.cert.error ? `: ${f.cert.error}` : ''}.` : d < 0 ? `Expired ${-d} days ago.` : `Valid for ${plural(d, 'more day')}${f.cert.issuer ? ` (${f.cert.issuer})` : ''}.`,
+            why: 'An expired certificate turns every visitor away with a warning.',
+            fix: 'Renew it (Site Manager renews automatically on the fleet).'});
+    }
+    const h = f.headers;
+    if (h) {
+        const missing = [['csp', 'Content-Security-Policy'], ['nosniff', 'X-Content-Type-Options'], ['frame', 'frame protection'],
+            ['referrer', 'Referrer-Policy'], ...(h.https ? [['hsts', 'Strict-Transport-Security']] : [])].filter(([k]) => !h[k]).map(([, n]) => n);
+        add({id: 'headers', group: 'Web', title: 'Security headers',
+            status: h.error ? 'info' : missing.length ? 'warn' : 'pass',
+            detail: h.error ? `Could not fetch the home page: ${h.error}.` : missing.length ? `Missing: ${missing.join(', ')}.` : 'All present.',
+            why: 'They stop pages being framed, content being mis-typed and scripts being injected.',
+            fix: 'The CMS sets them; missing ones are usually stripped by a proxy in front.'});
+        add({id: 'https', group: 'Web', title: 'HTTPS',
+            status: h.error ? 'info' : h.https ? 'pass' : 'warn',
+            detail: h.https ? 'The site is served over HTTPS.' : 'The site was reached over plain HTTP.',
+            why: 'Without it, passwords and sessions cross the network readable.', fix: 'Serve the site over HTTPS only.'});
+    }
+    const exposed = (f.probeFiles || []).filter(p => p.status === 200);
+    add({id: 'exposed', group: 'Web', title: 'Private files not served',
+        status: !(f.probeFiles || []).length ? 'info' : exposed.length ? 'fail' : 'pass', critical: exposed.length > 0,
+        detail: exposed.length ? `Served to anyone: ${exposed.map(p => p.path).join(', ')}.` : `${plural((f.probeFiles || []).length, 'private path')} checked - none served.`,
+        why: 'These hold secrets (keys, passwords, the code\'s history).',
+        fix: 'Remove the file from the site, or block it in the web server.'});
+
+    // --- Plugins ---
+    const lapsed = (f.licences || []).filter(l => !['valid', 'grace', 'support-ended', 'not-required'].includes(l.state));
+    add({id: 'licences', group: 'Plugins', title: 'Plugin licences',
+        status: lapsed.length ? 'warn' : 'pass',
+        detail: lapsed.length ? `Not loaded for want of a licence: ${names(lapsed.map(l => l.name))}.` : 'Every licensed plugin loaded.',
+        why: 'A plugin that does not load does not protect or do what you think it does.', fix: 'Renew or remove it.', link: '#/plugins'});
+
+    const scored = checks.filter(c => c.status !== 'info');
+    const points = scored.reduce((a, c) => a + (c.status === 'pass' ? 1 : c.status === 'warn' ? 0.5 : 0), 0);
+    return {
+        checks,
+        score: scored.length ? Math.round((points / scored.length) * 100) : 0,
+        failing: checks.filter(c => c.status === 'fail' || c.status === 'warn').length,
+        critical: checks.filter(c => c.status === 'fail' && c.critical).length
+    };
+}

package/plugins/security/admin/lib/ip.js

@@ -0,0 +1,44 @@
+/**
+ * Security - address rules: an address (81.2.69.142), a trailing wildcard
+ * (192.168.1.*), an IPv4 CIDR (10.0.0.0/8) or an IPv6 prefix (2a00:23c7:*).
+ * Pure. Copied from Analytics Pro (admin/lib/settings.js) - keep them alike.
+ */
+
+/** Is this a rule we understand? */
+export function ipRuleValid(rule) {
+    const r = String(rule).trim();
+    if (/^(\d{1,3}\.){3}\d{1,3}\/(\d|[12]\d|3[0-2])$/.test(r)) return r.split('/')[0].split('.').every(o => +o <= 255);
+    if (/^(\d{1,3}\.){3}\d{1,3}$/.test(r)) return r.split('.').every(o => +o <= 255);
+    if (/^(\d{1,3}\.){1,3}\*$/.test(r)) return true;
+    if (/^[0-9a-f:]+(\*)?$/i.test(r) && r.includes(':')) return true;
+    return false;
+}
+
+const v4num = (ip) => ip.split('.').reduce((n, o) => n * 256 + (+o), 0);
+
+/** The address as rules see it: no IPv4-mapped prefix, lower case. */
+export const plainIp = (ip) => String(ip ?? '').trim().replace(/^::ffff:(?=\d+\.)/i, '').toLowerCase();
+
+/** Does an address match one of the rules? */
+export function ipMatches(ip, rules = []) {
+    const a = plainIp(ip);
+    if (!a) return false;
+    for (const raw of rules) {
+        const r = String(raw).trim().toLowerCase();
+        if (!r) continue;
+        if (r.endsWith('*')) { if (a.startsWith(r.slice(0, -1))) return true; continue; }
+        if (r.includes('/')) {
+            if (!/^(\d{1,3}\.){3}\d{1,3}$/.test(a)) continue;
+            const [base, bits] = r.split('/');
+            const size = 2 ** (32 - Number(bits));
+            if (Math.floor(v4num(a) / size) === Math.floor(v4num(base) / size)) return true;
+            continue;
+        }
+        if (a === r) return true;
+    }
+    return false;
+}
+
+const LOOPBACK = /^(127\.\d+\.\d+\.\d+|::1)$/;
+/** Loopback: this machine. Never blocked or locked out. */
+export const isLoopbackIp = (ip) => LOOPBACK.test(plainIp(ip));

package/plugins/security/admin/lib/lockout.js

@@ -0,0 +1,78 @@
+/**
+ * Security - sign-in lockout. Failures are counted per ACCOUNT and per ADDRESS
+ * inside a window; reaching the threshold locks that key, first for `baseMin`,
+ * each further lock twice as long, up to `maxMin`. A success clears the account
+ * (not the address - an attacker with one right password should not wipe their
+ * address's record). Pure: the state is a plain object the plugin saves.
+ *
+ * state: {[key]: {fails: number[] (ms), locks: number, until: number}}
+ * keys:  'a:<email>' and 'i:<address>'
+ */
+
+export const DEFAULT_LOCKOUT = {
+    accountThreshold: 5,     // failures on one account...
+    addressThreshold: 20,    // ...or from one address (offices share one)...
+    windowMin: 15,           // ...within this many minutes
+    baseMin: 1,              // first lock
+    maxMin: 60               // longest lock
+};
+
+export const accountKey = (email) => `a:${String(email ?? '').trim().toLowerCase()}`;
+export const addressKey = (ip) => `i:${String(ip ?? '').trim().toLowerCase()}`;
+
+/** Until when a key is locked (ms), or 0. */
+export function lockedUntil(state, key, now = Date.now()) {
+    const e = state[key];
+    return e && e.until > now ? e.until : 0;
+}
+
+/**
+ * Count a failure against a key; lock it when the threshold is reached.
+ *
+ * @returns {number} until when it is now locked (ms), or 0
+ */
+export function recordFailure(state, key, {now = Date.now(), threshold, windowMin, baseMin, maxMin} = {}) {
+    const cfg = {...DEFAULT_LOCKOUT, windowMin: windowMin ?? DEFAULT_LOCKOUT.windowMin, baseMin: baseMin ?? DEFAULT_LOCKOUT.baseMin, maxMin: maxMin ?? DEFAULT_LOCKOUT.maxMin};
+    const limit = threshold ?? (key.startsWith('i:') ? cfg.addressThreshold : cfg.accountThreshold);
+    const e = state[key] ??= {fails: [], locks: 0, until: 0};
+    e.fails = e.fails.filter(t => t > now - cfg.windowMin * 60_000);
+    e.fails.push(now);
+    if (e.fails.length >= limit) {
+        const minutes = Math.min(cfg.maxMin, cfg.baseMin * 2 ** e.locks);
+        e.locks++;
+        e.until = now + minutes * 60_000;
+        e.fails = [];
+        return e.until;
+    }
+    return 0;
+}
+
+/** A successful sign-in: the account starts afresh. */
+export function recordSuccess(state, key) {
+    delete state[key];
+}
+
+/** Drop what no longer matters (no recent failure, no lock, locks forgotten after a day). */
+export function pruneLockouts(state, {now = Date.now(), windowMin = DEFAULT_LOCKOUT.windowMin} = {}) {
+    for (const [k, e] of Object.entries(state)) {
+        e.fails = (e.fails || []).filter(t => t > now - windowMin * 60_000);
+        if (!e.fails.length && e.until < now - 24 * 3_600_000) delete state[k];
+    }
+    return state;
+}
+
+/** Live locks, soonest-ending last: [{key, kind, who, until}]. */
+export function activeLocks(state, now = Date.now()) {
+    return Object.entries(state)
+        .filter(([, e]) => e.until > now)
+        .map(([key, e]) => ({key, kind: key.startsWith('a:') ? 'account' : 'address', who: key.slice(2), until: e.until, locks: e.locks}))
+        .sort((a, b) => b.until - a.until);
+}
+
+/** "in 3 minutes" / "in 1 hour" - for the refusal message. */
+export function retryText(until, now = Date.now()) {
+    const min = Math.max(1, Math.ceil((until - now) / 60_000));
+    if (min < 60) return `in ${min} minute${min === 1 ? '' : 's'}`;
+    const h = Math.ceil(min / 60);
+    return `in ${h} hour${h === 1 ? '' : 's'}`;
+}

package/plugins/security/admin/lib/policy.js

@@ -0,0 +1,32 @@
+/**
+ * Security - the password policy. Pure: the common-password list is handed in
+ * (the server loads server/common-passwords.txt once).
+ */
+
+export const DEFAULT_POLICY = {minLength: 10, blockCommon: true, blockPersonal: true};
+
+const norm = (s) => String(s ?? '').toLowerCase();
+
+/**
+ * What is wrong with a password, as sentences ([] = fine).
+ *
+ * @param {string} password
+ * @param {{email?: string, name?: string}} who
+ * @param {{minLength?: number, blockCommon?: boolean, blockPersonal?: boolean, common?: Set<string>}} policy
+ */
+export function passwordProblems(password, {email = '', name = ''} = {}, {minLength = DEFAULT_POLICY.minLength, blockCommon = true, blockPersonal = true, common = new Set()} = {}) {
+    const pw = String(password ?? '');
+    const out = [];
+    if (pw.length < minLength) out.push(`Use at least ${minLength} characters.`);
+    const low = norm(pw);
+    if (blockCommon && (common.has(low) || common.has(low.replace(/[\d!?.]+$/, '')))) {
+        out.push('That password is one of the most common - pick something less guessable.');
+    }
+    if (blockPersonal) {
+        const local = norm(email).split('@')[0];
+        const parts = [local, ...norm(name).split(/\s+/)].filter(p => p && p.length >= 3);
+        if (parts.some(p => low.includes(p))) out.push('Leave your name and email out of your password.');
+    }
+    if (pw.length >= 4 && new Set(pw).size <= 2) out.push('Use more than one or two different characters.');
+    return out;
+}