domma-cms 0.82.0 → 0.84.0

package/plugins/security/admin/views/security.js

@@ -0,0 +1,529 @@
+/**
+ * Security - the admin screen: Overview (health score and checks), Sign-ins
+ * (the log) and Blocked (lockouts, blocks for probing, rules). Settings in a
+ * slideover behind the banner cog; Refresh beside it.
+ *
+ * The Tool upgrade path: domma-reactive state (M.observable / computed /
+ * effect, M.applyBindings), context menus on rows (right-click, ⋮, Shift+F10),
+ * help popovers, theme tokens, a sidebar badge (GET /count). Emails, addresses
+ * and browsers come from the public: they reach the DOM through data-bind-text
+ * only, and rows are addressed by index.
+ * `#/plugins/security/<tab>` opens a tab. Pure logic: ../lib/*.js.
+ */
+import {checkSettings, DEFAULT_SETTINGS, mergeDefaults} from '../lib/settings.js';
+import {ipRuleValid} from '../lib/ip.js';
+
+const API = '/plugins/security';
+const ROUTE = /^#\/plugins\/security(\/[a-z]+)?\/?(\?.*)?$/;
+const TABS = ['overview', 'signins', 'blocked'];
+const SIDEBAR_URL = '#/plugins/security';
+const GLYPH = {pass: '✓', warn: '!', fail: '✕', info: 'i'};
+const REASONS = {password: 'Wrong password', unknown: 'No such account', inactive: 'Account switched off', denied: 'Refused (locked)', challenge: 'Wrong code'};
+
+let kit = null;
+async function loadKit() {
+    if (kit) return kit;
+    const [api, chrome, help, tk] = await Promise.all([
+        import('/admin/js/api.js'),
+        import('/admin/js/lib/plugin-chrome.js').catch(() => ({})),
+        import('/admin/js/lib/help-popover.js').catch(() => ({})),
+        import('/admin/js/lib/tool-kit.js')
+    ]);
+    kit = {
+        apiRequest: api.apiRequest,
+        addBannerAction: chrome.addBannerAction || (() => null),
+        helpPopovers: help.helpPopovers || (() => () => {}),
+        onceClosed: tk.onceClosed, openMenuAt: tk.openMenuAt, viewLifetime: tk.viewLifetime
+    };
+    return kit;
+}
+
+const esc = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+function fragment(html) {
+    const t = document.createElement('template');
+    t.innerHTML = html.trim();
+    return t.content.firstElementChild;
+}
+async function copy(text, what) {
+    try { await navigator.clipboard.writeText(text); E.toast(`Copied ${what}.`, {type: 'success'}); }
+    catch { E.toast(`Could not copy - ${text}`, {type: 'warning', duration: 6000}); }
+}
+function refreshBadge() {
+    try { window.dispatchEvent(new CustomEvent('dm:sidebar-count', {detail: {url: SIDEBAR_URL}})); } catch { /* no sidebar */ }
+}
+const when = (iso) => {
+    const d = new Date(iso);
+    const today = new Date().toDateString() === d.toDateString();
+    const t = d.toLocaleTimeString('en-GB', {hour: '2-digit', minute: '2-digit'});
+    return today ? `Today ${t}` : `${d.toLocaleDateString('en-GB', {day: 'numeric', month: 'short'})} ${t}`;
+};
+const until = (ms) => `until ${new Date(ms).toLocaleString('en-GB', {day: 'numeric', month: 'short', hour: '2-digit', minute: '2-digit'})}`;
+/** "Chrome on Windows" from a user-agent - enough to recognise one. */
+function browserOf(ua) {
+    const s = String(ua || '');
+    if (!s) return 'Unknown';
+    const b = /Edg\//.test(s) ? 'Edge' : /OPR\//.test(s) ? 'Opera' : /Firefox\//.test(s) ? 'Firefox' : /Chrome\//.test(s) ? 'Chrome' : /Safari\//.test(s) ? 'Safari' : /curl|python|wget|go-http/i.test(s) ? 'A script' : 'Other';
+    const o = /iPhone|iPad/.test(s) ? 'iOS' : /Android/.test(s) ? 'Android' : /Windows/.test(s) ? 'Windows' : /Mac OS X/.test(s) ? 'macOS' : /Linux/.test(s) ? 'Linux' : '';
+    return o ? `${b} on ${o}` : b;
+}
+/** CSV with formula-leading cells defused (the log holds what strangers typed). */
+function toCsv(rows) {
+    const cell = (v) => {
+        let s = String(v ?? '');
+        if (/^[=+\-@\t\r]/.test(s)) s = `'${s}`;
+        return /[",\n\r]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s;
+    };
+    const cols = Object.keys(rows[0] || {});
+    return `${[cols.join(','), ...rows.map(r => cols.map(c => cell(r[c])).join(','))].join('\r\n')}\r\n`;
+}
+
+const CHECK_ROW = `
+<div class="scx-item">
+    <div class="scx-group" data-bind-hidden="!head" data-bind-text="head"></div>
+    <div class="scx-check" data-bind-hidden="!title" data-bind-data-row="id" tabindex="0">
+        <span class="scx-status" data-bind-data-status="status" data-bind-text="glyph" data-bind-title="statusText"></span>
+        <span class="scx-check-main">
+            <strong data-bind-text="title"></strong>
+            <small data-bind-text="detail"></small>
+            <span class="scx-more" data-bind-hidden="!open">
+                <span><b>Why it matters.</b> <span data-bind-text="why"></span></span>
+                <span><b>How to fix it.</b> <span data-bind-text="fix"></span></span>
+                <a class="btn btn-xs btn-ghost" data-bind-href="link" data-bind-hidden="!link">Go there</a>
+            </span>
+        </span>
+        <button type="button" class="scx-kebab" aria-label="Actions" title="Actions">⋮</button>
+    </div>
+</div>`;
+const SIGNIN_ROW = `
+<div class="scx-row" data-bind-data-row="id" tabindex="0" data-bind-title="ua">
+    <span class="scx-cell" data-bind-text="when"></span>
+    <span class="scx-pill" data-bind-data-ok="ok" data-bind-text="okText"></span>
+    <span class="scx-cell" data-bind-text="email"></span>
+    <span class="scx-cell scx-mono scx-hide-sm" data-bind-text="ip"></span>
+    <span class="scx-cell scx-muted scx-hide-sm" data-bind-text="note"></span>
+    <button type="button" class="scx-kebab" aria-label="Actions" title="Actions">⋮</button>
+</div>`;
+const PLAIN_ROW = `
+<div class="scx-row" data-bind-data-row="id" tabindex="0">
+    <span class="scx-cell scx-mono" data-bind-text="who" data-bind-title="who"></span>
+    <span class="scx-cell scx-muted" data-bind-text="why" data-bind-title="why"></span>
+    <span class="scx-cell scx-muted" data-bind-text="when"></span>
+    <button type="button" class="scx-kebab" aria-label="Actions" title="Actions">⋮</button>
+</div>`;
+
+export const securityView = {
+    templateUrl: '/plugins/security/admin/templates/security.html',
+
+    async onMount($container) {
+        const k = await loadKit();
+        if (!ROUTE.test(location.hash)) return;
+        const lifetime = (securityView._lifetime ??= k.viewLifetime(ROUTE));
+        lifetime.reset();
+        const root = $container.get(0).querySelector('.scx') || $container.get(0);
+        const here = () => ROUTE.test(location.hash) && root.isConnected;
+        const scope = (fn) => { lifetime.add(fn); return fn; };
+        const api = (path, opts) => k.apiRequest(`${API}${path}`, opts);
+
+        // ---- State ----
+        const fromHash = location.hash.match(/security\/([a-z]+)/)?.[1];
+        const tab = M.observable(TABS.includes(fromHash) ? fromHash : 'overview');
+        const loading = M.observable(true);
+        const error = M.observable('');
+        const health = M.observable(null);
+        const overview = M.observable(null);
+        const signins = M.observable([]);
+        const blocks = M.observable({rules: [], temp: [], locks: [], you: ''});
+        const settings = M.observable(mergeDefaults(DEFAULT_SETTINGS));
+        const checksOk = M.observable(true);
+        const canManage = M.observable(true);
+        const openChecks = M.observable(new Set());
+        const result = M.observable('all');
+        const days = M.observable('7');
+        const query = M.observable('');
+        const newRule = M.observable('');
+        const newNote = M.observable('');
+        const ipFilter = M.observable('');
+
+        // ---- Derived ----
+        const scoreText = M.computed(() => (health.value ? `${health.value.score}%` : '—'));
+        const scoreWidth = M.computed(() => `${health.value?.score ?? 0}%`);
+        const scoreTone = M.computed(() => { const s = health.value?.score; return s === undefined ? '' : s >= 85 ? 'good' : s >= 60 ? 'poor' : 'bad'; });
+        const attentionText = M.computed(() => (health.value ? String(health.value.failing) : '—'));
+        const asOf = M.computed(() => (health.value?.at ? `Checked ${new Date(health.value.at).toLocaleTimeString('en-GB', {hour: '2-digit', minute: '2-digit'})}` : ''));
+        const ov = M.computed(() => {
+            const o = overview.value;
+            return o ? {failed: String(o.failed24h), blocked: String(o.blocked + o.locks), probes: String(o.today?.probes || 0)} : {failed: '—', blocked: '—', probes: '—'};
+        });
+        const blockedCount = M.computed(() => { const b = blocks.value; const n = b.rules.length + b.temp.length + b.locks.length; return n ? String(n) : ''; });
+
+        const checks = M.observable([]);
+        let checkList = [];
+        scope(M.effect(() => {
+            const h = health.value;
+            const open = openChecks.value;
+            const order = {fail: 0, warn: 1, info: 3, pass: 2};
+            const list = [...(h?.checks || [])];
+            const GROUPS = ['Sign-in', 'People', 'Web', 'Server', 'Plugins'];
+            const groups = [...new Set(list.map(c => c.group))].sort((a, b) => (GROUPS.indexOf(a) + 1 || 99) - (GROUPS.indexOf(b) + 1 || 99));
+            checkList = [];
+            const rows = [];
+            for (const g of groups) {
+                rows.push({id: `g-${g}`, head: g, title: '', detail: '', status: '', glyph: '', statusText: '', open: false, why: '', fix: '', link: ''});
+                for (const c of list.filter(x => x.group === g).sort((a, b) => order[a.status] - order[b.status])) {
+                    checkList.push(c);
+                    rows.push({id: `c${checkList.length - 1}`, head: '', title: c.title, detail: c.detail, status: c.status, glyph: GLYPH[c.status] || '?',
+                        statusText: {pass: 'Passes', warn: 'Could be better', fail: 'Failing', info: 'For information'}[c.status] || '',
+                        open: open.has(c.id), why: c.why || '', fix: c.fix || '', link: c.link || ''});
+                }
+            }
+            checks.value = rows;
+        }));
+
+        const signinRows = M.observable([]);
+        let signinList = [];
+        scope(M.effect(() => {
+            const q = query.value.trim().toLowerCase();
+            const r = result.value;
+            const only = ipFilter.value;
+            signinList = signins.value.filter(e => (r === 'all' || (r === 'ok') === Boolean(e.ok))
+                && (!only || e.ip === only)
+                && (!q || [e.email, e.ip, e.ua, e.reason].some(v => String(v || '').toLowerCase().includes(q))));
+            signinRows.value = signinList.slice(0, 1000).map((e, i) => ({
+                id: `s${i}`, when: when(e.at), ok: String(Boolean(e.ok)), okText: e.ok ? 'Signed in' : 'Failed',
+                email: e.email || '—', ip: e.ip || '—', ua: e.ua || '',
+                note: e.ok ? browserOf(e.ua) : `${REASONS[e.reason] || e.reason || 'Failed'} · ${browserOf(e.ua)}`
+            }));
+        }));
+        const signinText = M.computed(() => {
+            const n = signinList.length + 0 * signinRows.value.length;
+            const f = ipFilter.value ? ` from ${ipFilter.value}` : '';
+            return `${n.toLocaleString('en-GB')} sign-in${n === 1 ? '' : 's'}${f}`;
+        });
+        const signinEmpty = M.computed(() => (query.value.trim() || ipFilter.value ? 'No sign-ins match.' : 'No sign-ins in this period.'));
+
+        const lockRows = M.observable([]);
+        const tempRows = M.observable([]);
+        const ruleRows = M.observable([]);
+        scope(M.effect(() => {
+            const b = blocks.value;
+            lockRows.value = b.locks.map((l, i) => ({id: `l${i}`, who: l.who, why: l.kind === 'account' ? `Account - ${l.locks > 1 ? `locked ${l.locks} times` : 'wrong passwords'}` : 'Address - wrong passwords', when: until(l.until)}));
+            tempRows.value = b.temp.map((t, i) => ({id: `t${i}`, who: t.ip, why: t.reason || 'Probing', when: until(t.until)}));
+            ruleRows.value = b.rules.map((r, i) => ({id: `r${i}`, who: r.rule, why: r.note || (r.by ? `Added by ${r.by}` : 'Blocked by hand'), when: r.at ? `since ${new Date(r.at).toLocaleDateString('en-GB', {day: 'numeric', month: 'short', year: 'numeric'})}` : ''}));
+        }));
+        const youText = M.computed(() => (blocks.value.you ? `You are ${blocks.value.you}` : ''));
+
+        // ---- Server ----
+        async function loadHealth(refresh = false) {
+            try {
+                const h = await api(`/health${refresh ? '?refresh=1' : ''}`);
+                if (here() && h) { health.value = h; error.value = ''; }
+                if (refresh) refreshBadge();
+            } catch (e) {
+                if (here()) error.value = /403|forbidden/i.test(String(e.message)) ? 'You do not have access to Security.' : `Could not run the checks: ${e.message || e}`;
+            }
+        }
+        async function loadOverview() {
+            try {
+                const o = await api('/overview');
+                if (!here() || !o) return;
+                overview.value = o;
+                checksOk.value = o.checks !== false;
+            } catch { /* the health error says enough */ }
+        }
+        async function loadSignins() {
+            try {
+                const r = await api(`/signins?days=${encodeURIComponent(days.peek())}`);
+                if (here() && r) signins.value = r.entries;
+            } catch (e) { E.toast(`Could not load sign-ins: ${e.message || e}`, {type: 'error'}); }
+        }
+        async function loadBlocks() {
+            try {
+                const r = await api('/blocks');
+                if (here() && r) blocks.value = r;
+            } catch { /* shown empty */ }
+        }
+        async function loadAll(refresh = false) {
+            loading.value = true;
+            await Promise.all([loadHealth(refresh), loadOverview(), loadBlocks(), tab.peek() === 'signins' ? loadSignins() : null]);
+            if (here()) loading.value = false;
+        }
+        scope(M.effect(() => { void days.value; if (tab.peek() === 'signins') loadSignins(); }));
+
+        // ---- Actions ----
+        async function act(fn, done) {
+            try {
+                await fn();
+                if (done) E.toast(done, {type: 'success'});
+                await Promise.all([loadBlocks(), loadOverview()]);
+            } catch (e) {
+                if (/403|forbidden/i.test(String(e.message))) { canManage.value = false; E.toast('Only people who may manage Security can change this.', {type: 'warning'}); }
+                else E.toast(`Not done: ${e.message || e}`, {type: 'error'});
+            }
+        }
+        const unlockKey = (key, label) => act(() => api(`/lockouts?key=${encodeURIComponent(key)}`, {method: 'DELETE'}), `${label} unlocked.`);
+        const unblockIp = (ip) => act(() => api(`/blocks?ip=${encodeURIComponent(ip)}`, {method: 'DELETE'}), `${ip} unblocked.`);
+        const removeRule = (rule) => act(() => api(`/blocks?rule=${encodeURIComponent(rule)}`, {method: 'DELETE'}), `${rule} may reach the site again.`);
+        async function blockRule(rule, note = '', confirmSelf = false) {
+            try {
+                await api('/blocks', {method: 'POST', body: JSON.stringify({rule, note, confirmSelf})});
+                E.toast(`${rule} is blocked.`, {type: 'success'});
+                await Promise.all([loadBlocks(), loadOverview()]);
+                return true;
+            } catch (e) {
+                if (e.status === 409 && !confirmSelf) {
+                    if (await E.confirm(`${esc(e.message)}<br><br>Block it anyway? You would need the command line to get back in.`)) return blockRule(rule, note, true);
+                    return false;
+                }
+                E.toast(`Not blocked: ${e.message || e}`, {type: 'error'});
+                return false;
+            }
+        }
+        function exportCsv() {
+            if (!signinList.length) { E.toast('Nothing to export.', {type: 'info'}); return; }
+            const rows = signinList.map(e => ({time: e.at, result: e.ok ? 'signed in' : 'failed', email: e.email, address: e.ip, reason: e.ok ? '' : (REASONS[e.reason] || e.reason || ''), browser: e.ua}));
+            const url = URL.createObjectURL(new Blob([toCsv(rows)], {type: 'text/csv;charset=utf-8'}));
+            const a = Object.assign(document.createElement('a'), {href: url, download: `sign-ins-${location.hostname}-${new Date().toISOString().slice(0, 10)}.csv`});
+            document.body.appendChild(a); a.click(); a.remove();
+            setTimeout(() => URL.revokeObjectURL(url), 10_000);
+        }
+
+        // ---- Menus ----
+        const rowIndex = (row) => Number(String(row?.dataset?.row || '').slice(1));
+        function checkItems(row) {
+            const c = checkList[rowIndex(row)];
+            if (!c) return [];
+            const open = openChecks.peek().has(c.id);
+            return [
+                {header: c.title},
+                {label: open ? 'Hide the details' : 'Why, and how to fix it', icon: 'info', action: () => toggleCheck(c)},
+                {label: 'Go there', icon: 'external-link', disabled: !c.link, action: () => { location.hash = c.link; }},
+                {label: 'Run the checks again', icon: 'refresh-cw', action: () => loadAll(true)},
+                {type: 'divider'},
+                {label: 'Copy', icon: 'copy', action: () => copy(`${c.title}: ${c.detail}\nWhy: ${c.why}\nFix: ${c.fix}`, 'the check')}
+            ];
+        }
+        function toggleCheck(c) {
+            const next = new Set(openChecks.peek());
+            if (next.has(c.id)) next.delete(c.id); else next.add(c.id);
+            openChecks.value = next;
+        }
+        function signinItems(row) {
+            const e = signinList[rowIndex(row)];
+            if (!e) return [];
+            return [
+                {header: `${e.email || 'Unknown'} · ${e.ip || 'no address'}`},
+                {label: ipFilter.peek() === e.ip ? 'Show every address' : 'Only this address', icon: 'filter', disabled: !e.ip, action: () => { ipFilter.value = ipFilter.peek() === e.ip ? '' : e.ip; }},
+                {label: 'Unlock this account', icon: 'unlock', disabled: !e.email || !canManage.peek(), action: () => unlockKey(`a:${e.email.toLowerCase()}`, e.email)},
+                {label: 'Block this address…', icon: 'x-circle', disabled: !e.ip || !canManage.peek(), action: async () => {
+                    if (await E.confirm(`Block ${esc(e.ip)}? Nothing from it will reach the site.`)) blockRule(e.ip, `From the sign-in log (${e.email || 'unknown'})`);
+                }},
+                {type: 'divider'},
+                {label: 'Copy the address', icon: 'copy', disabled: !e.ip, action: () => copy(e.ip, 'the address')},
+                {label: 'Copy the browser', icon: 'clipboard', disabled: !e.ua, action: () => copy(e.ua, 'the browser')}
+            ];
+        }
+        function lockItems(row) {
+            const l = blocks.peek().locks[rowIndex(row)];
+            if (!l) return [];
+            return [{header: l.who}, {label: 'Unlock', icon: 'unlock', disabled: !canManage.peek(), action: () => unlockKey(l.key, l.who)},
+                {label: 'Copy', icon: 'copy', action: () => copy(l.who, 'it')}];
+        }
+        function tempItems(row) {
+            const t = blocks.peek().temp[rowIndex(row)];
+            if (!t) return [];
+            return [{header: t.ip}, {label: 'Unblock', icon: 'unlock', disabled: !canManage.peek(), action: () => unblockIp(t.ip)},
+                {label: 'Block for good', icon: 'x-circle', disabled: !canManage.peek(), action: () => blockRule(t.ip, t.reason)},
+                {type: 'divider'}, {label: 'Copy the address', icon: 'copy', action: () => copy(t.ip, 'the address')}];
+        }
+        function ruleItems(row) {
+            const r = blocks.peek().rules[rowIndex(row)];
+            if (!r) return [];
+            return [{header: r.rule}, {label: 'Remove the block', icon: 'trash-2', danger: true, disabled: !canManage.peek(), action: async () => {
+                if (await E.confirm(`Let ${esc(r.rule)} reach the site again?`)) removeRule(r.rule);
+            }}, {type: 'divider'}, {label: 'Copy', icon: 'copy', action: () => copy(r.rule, 'the rule')}];
+        }
+
+        function wireList(el, items, main) {
+            const menu = E.contextMenu(el, {cursor: 'glyph', match: '[data-row]', inherit: false, density: 'compact', items: (row) => items(row)});
+            scope(() => menu?.destroy?.());
+            const onClick = (e) => {
+                const row = e.target.closest('[data-row]');
+                if (!row || e.target.closest('a')) return;
+                if (e.target.closest('.scx-kebab')) { k.openMenuAt(row); return; }
+                main?.(row);
+            };
+            const onKey = (e) => {
+                const row = e.target.closest('[data-row]');
+                if (!row) return;
+                if (e.key === 'F10' && e.shiftKey) { e.preventDefault(); k.openMenuAt(row); }
+                else if (e.key === 'Enter' && e.target === row) main?.(row);
+            };
+            el.addEventListener('click', onClick);
+            el.addEventListener('keydown', onKey);
+            scope(() => { el.removeEventListener('click', onClick); el.removeEventListener('keydown', onKey); });
+        }
+
+        // ---- Settings (slideover) ----
+        let settingsOpen = false;
+        async function openSettings() {
+            if (settingsOpen) return;
+            settingsOpen = true;
+            let s;
+            try {
+                const r = await api('/settings');
+                s = r.settings;
+                checksOk.value = r.checks !== false;
+            } catch (e) {
+                settingsOpen = false;
+                E.toast(`Could not load the settings: ${e.message || e}`, {type: 'error'});
+                return;
+            }
+            const f = {
+                lockOn: M.observable(s.lockout.enabled), acc: M.observable(String(s.lockout.accountThreshold)), addr: M.observable(String(s.lockout.addressThreshold)),
+                win: M.observable(String(s.lockout.windowMin)), base: M.observable(String(s.lockout.baseMin)), max: M.observable(String(s.lockout.maxMin)),
+                polOn: M.observable(s.policy.enabled), minLen: M.observable(String(s.policy.minLength)), common: M.observable(s.policy.blockCommon), personal: M.observable(s.policy.blockPersonal),
+                probeOn: M.observable(s.probes.enabled), after: M.observable(String(s.probes.blockAfter)), within: M.observable(String(s.probes.withinMin)), forMin: M.observable(String(s.probes.blockForMin)),
+                extra: M.observable(s.probes.extra.join('\n')), allow: M.observable(s.probes.allow.join('\n')),
+                signinDays: M.observable(String(s.signinDays)), staleDays: M.observable(String(s.staleAdminDays)),
+                nLock: M.observable(s.notify.lockouts), nAfter: M.observable(s.notify.successAfterFails), nProbe: M.observable(s.notify.probeBlocks)
+            };
+            const body = () => ({
+                lockout: {enabled: f.lockOn.value, accountThreshold: f.acc.value, addressThreshold: f.addr.value, windowMin: f.win.value, baseMin: f.base.value, maxMin: f.max.value},
+                policy: {enabled: f.polOn.value, minLength: f.minLen.value, blockCommon: f.common.value, blockPersonal: f.personal.value},
+                probes: {enabled: f.probeOn.value, blockAfter: f.after.value, withinMin: f.within.value, blockForMin: f.forMin.value, extra: f.extra.value, allow: f.allow.value},
+                signinDays: f.signinDays.value, staleAdminDays: f.staleDays.value,
+                notify: {lockouts: f.nLock.value, successAfterFails: f.nAfter.value, probeBlocks: f.nProbe.value}
+            });
+            const opened = JSON.stringify(body());
+            const saving = M.observable(false);
+            const checked = M.computed(() => checkSettings(body(), s));
+            const errText = M.computed(() => Object.values(checked.value.errors).join(' '));
+            const model = {...f, saving, errText, cannot: M.computed(() => saving.value || Boolean(errText.value)), checksOk};
+            const num = (id, key, label, help, min, max) => `<div><label class="form-label" for="scx-s-${id}">${label}${help ? ` <span data-help="${esc(help)}"></span>` : ''}</label>
+                <input id="scx-s-${id}" type="number" min="${min}" max="${max}" class="form-input" data-model="${key}.value"></div>`;
+            const sw = (key, label, help = '') => `<label class="scx-wide" style="display:flex;align-items:center;gap:.5rem"><input type="checkbox" class="form-switch" data-model="${key}.value"> ${label}${help ? ` <span data-help="${esc(help)}"></span>` : ''}</label>`;
+            const so = E.slideover({title: 'Security settings', size: 'md', position: 'right'});
+            const panel = fragment(`
+                <div class="scx-form">
+                    <p class="scx-note is-warn" data-bind-hidden="checksOk.value">This version of Domma CMS cannot run sign-in checks: the lockout and password rules below take effect once it is updated (0.83 or later).</p>
+                    <section><h4>Sign-in lockout</h4><div class="scx-form-grid">
+                        ${sw('lockOn', 'Lock after repeated wrong passwords', 'Locks the account and the address for a while - longer each time. The right password does not get in while it is locked, so guessing stops paying.')}
+                        ${num('acc', 'acc', 'Wrong passwords on one account', 'How many, within the time below, lock the account.', 3, 50)}
+                        ${num('addr', 'addr', 'Wrong passwords from one address', 'Higher than for an account: a whole office can share one address.', 5, 500)}
+                        ${num('win', 'win', 'Counted over (minutes)', '', 1, 1440)}
+                        ${num('base', 'base', 'First lock (minutes)', 'Each lock after that is twice as long.', 1, 60)}
+                        ${num('max', 'max', 'Longest lock (minutes)', '', 1, 10080)}
+                    </div></section>
+                    <section><h4>Password rules</h4><div class="scx-form-grid">
+                        ${sw('polOn', 'Check new passwords', 'Applies when a password is set or changed - accounts keep the one they have until then.')}
+                        ${num('minlen', 'minLen', 'Shortest password', 'Length matters most. 10 or more is sensible; 12+ better.', 8, 64)}
+                        ${sw('common', 'Refuse the 10,000 most common passwords')}
+                        ${sw('personal', 'Refuse passwords containing the person\'s name or email')}
+                    </div></section>
+                    <section><h4>Scanners</h4><div class="scx-form-grid">
+                        ${sw('probeOn', 'Refuse probes, and block addresses that keep probing', 'Requests for things no Domma site has (WordPress, .env files, database dumps) get an empty not found. An address someone signed in from in the last week is never blocked.')}
+                        ${num('after', 'after', 'Probes before a block', '', 1, 100)}
+                        ${num('within', 'within', 'Counted over (minutes)', '', 1, 1440)}
+                        ${num('formin', 'forMin', 'Block for (minutes)', '', 1, 10080)}
+                        <div class="scx-wide"><label class="form-label" for="scx-s-extra">Also treat as probes <span data-help="One path per line, starting with /. A trailing / covers everything under it."></span></label>
+                            <textarea id="scx-s-extra" rows="2" class="form-input scx-mono" data-model="extra.value" placeholder="/old-admin/"></textarea></div>
+                        <div class="scx-wide"><label class="form-label" for="scx-s-allow">This site does serve <span data-help="Paths that look like probes but are real here - for example /legacy/ if you host old .php pages. One per line."></span></label>
+                            <textarea id="scx-s-allow" rows="2" class="form-input scx-mono" data-model="allow.value"></textarea></div>
+                    </div></section>
+                    <section><h4>Keeping and telling</h4><div class="scx-form-grid">
+                        ${num('days', 'signinDays', 'Keep the sign-in log (days)', '', 7, 365)}
+                        ${num('stale', 'staleDays', 'Admin unused after (days)', 'The health check flags admins who have not signed in for this long.', 14, 730)}
+                        ${sw('nLock', 'Notify when an account or address is locked')}
+                        ${sw('nAfter', 'Notify when someone signs in after many wrong passwords')}
+                        ${sw('nProbe', 'Notify when a scanner is blocked', 'Off by default: on a public site this happens daily.')}
+                    </div></section>
+                    <section><h4>Locked out yourself?</h4>
+                        <p class="scx-note">Run this in the site's folder on the server - it clears lockouts and blocks, and the site notices within seconds:</p>
+                        <div class="scx-code">node plugins/security/bin/unlock.js --list\nnode plugins/security/bin/unlock.js --all</div>
+                    </section>
+                    <p class="scx-err" data-bind-hidden="!errText.value" data-bind-text="errText.value"></p>
+                    <div class="scx-actions">
+                        <small class="scx-muted">Ctrl+Enter saves.</small><span class="scx-spacer"></span>
+                        <button type="button" class="btn btn-sm btn-ghost" data-on-click="cancel">Cancel</button>
+                        <button type="button" class="btn btn-sm btn-primary" data-on-click="save" data-bind-disabled="cannot.value"><span data-icon="save" data-icon-size="13"></span> Save</button>
+                    </div>
+                </div>`);
+            async function save() {
+                if (model.cannot.peek()) return;
+                saving.value = true;
+                try {
+                    const r = await api('/settings', {method: 'PUT', body: JSON.stringify(checked.peek().settings)});
+                    settings.value = r.settings;
+                    E.toast('Settings saved.', {type: 'success'});
+                    so.close(true);
+                    loadAll(true);
+                } catch (e) {
+                    E.toast(`Not saved: ${e.message || e}`, {type: 'error'});
+                } finally {
+                    saving.value = false;
+                }
+            }
+            so.element.appendChild(panel);
+            const disposeHelp = k.helpPopovers(panel);
+            const handle = M.applyBindings(model, panel, {methods: {save, cancel: () => so.close()}});
+            panel.addEventListener('keydown', (e) => { if ((e.ctrlKey || e.metaKey) && e.key === 'Enter') { e.preventDefault(); save(); } });
+            k.onceClosed(so, () => { handle.dispose(); disposeHelp(); settingsOpen = false; });
+            const close = so.close.bind(so);
+            let asking = false;
+            so.close = async (force) => {
+                if (force !== true && JSON.stringify(body()) !== opened) {
+                    if (asking) return undefined;
+                    asking = true;
+                    const ok = await E.confirm('Discard the changes you have not saved?');
+                    asking = false;
+                    if (!ok) return undefined;
+                }
+                return close();
+            };
+            scope(() => { try { so.close(true); } catch { /* gone */ } });
+            I.scan(panel);
+            so.open();
+        }
+
+        // ---- Bindings ----
+        root.querySelector('.scx-checks').innerHTML = CHECK_ROW;
+        root.querySelector('.scx-signins').innerHTML = SIGNIN_ROW;
+        for (const sel of ['.scx-locks', '.scx-temps', '.scx-rules']) root.querySelector(sel).innerHTML = PLAIN_ROW;
+        const setTab = (t) => {
+            if (tab.peek() === t) return;
+            tab.value = t;
+            history.replaceState(null, '', `#/plugins/security${t === 'overview' ? '' : `/${t}`}`);
+            if (t === 'signins') loadSignins();
+            if (t === 'blocked') loadBlocks();
+        };
+        const model = {tab, loading, error, checksOk, canManage, scoreText, scoreWidth, scoreTone, attentionText, asOf, ov, blockedCount, checks,
+            result, days, query, signinRows, signinText, signinEmpty, lockRows, tempRows, ruleRows, newRule, newNote, youText};
+        const methods = {
+            tab_overview: () => setTab('overview'), tab_signins: () => setTab('signins'), tab_blocked: () => setTab('blocked'),
+            res_all: () => { result.value = 'all'; }, res_failed: () => { result.value = 'failed'; }, res_ok: () => { result.value = 'ok'; },
+            exportCsv,
+            unlockAll: async () => { if (await E.confirm('Unlock every locked account and address?')) act(() => api('/lockouts?key=*', {method: 'DELETE'}), 'Everything unlocked.'); },
+            addRule: () => {
+                const rule = newRule.peek().trim();
+                if (!ipRuleValid(rule)) { E.toast('Not an address or range - for example 81.2.69.142, 192.168.1.* or 10.0.0.0/8.', {type: 'warning'}); return false; }
+                blockRule(rule, newNote.peek().trim()).then((ok) => { if (ok) { newRule.value = ''; newNote.value = ''; } });
+                return false;
+            }
+        };
+        const bindings = M.applyBindings(model, root, {methods});
+        scope(() => bindings.dispose());
+        scope(k.helpPopovers(root, {position: 'bottom'}));
+        wireList(root.querySelector('.scx-checks'), checkItems, (row) => { const c = checkList[rowIndex(row)]; if (c) toggleCheck(c); });
+        wireList(root.querySelector('.scx-signins'), signinItems);
+        wireList(root.querySelector('.scx-locks'), lockItems);
+        wireList(root.querySelector('.scx-temps'), tempItems);
+        wireList(root.querySelector('.scx-rules'), ruleItems);
+
+        k.addBannerAction($container, {id: 'security-refresh', icon: 'refresh-cw', title: 'Run the checks again', onClick: () => loadAll(true)});
+        k.addBannerAction($container, {id: 'security-settings', icon: 'settings', title: 'Security settings', onClick: openSettings});
+
+        I.scan(root);
+        await loadAll(false);
+        if (here()) I.scan(root);
+    }
+};

package/plugins/security/bin/unlock.js

@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+/**
+ * Security - emergency unlock. Run in the SITE's directory (where config/ and
+ * plugins/ are); the running site picks the change up within a few seconds.
+ *
+ *   node plugins/security/bin/unlock.js --list            what is locked or blocked now
+ *   node plugins/security/bin/unlock.js --all             every lockout and block, gone
+ *   node plugins/security/bin/unlock.js --ip 81.2.69.142  that address: lockout, temporary block, exact rule
+ *   node plugins/security/bin/unlock.js --user sam@x.com  that account's lockout
+ *
+ * (Security Pro's copy also takes --2fa sam@x.com, to switch off a user's two-factor.)
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const file = path.join(here, '..', 'data', 'state.json');
+const args = process.argv.slice(2);
+const flag = (name) => {
+    const i = args.indexOf(name);
+    return i >= 0 ? (args[i + 1] && !args[i + 1].startsWith('--') ? args[i + 1] : true) : null;
+};
+
+let state;
+try {
+    state = JSON.parse(fs.readFileSync(file, 'utf8'));
+} catch {
+    console.log('Nothing is locked or blocked (no state file yet).');
+    process.exit(0);
+}
+state.lockouts ??= {};
+state.rules ??= [];
+state.temp ??= {};
+const now = Date.now();
+
+function list() {
+    const locks = Object.entries(state.lockouts).filter(([, e]) => e.until > now);
+    const temp = Object.entries(state.temp).filter(([, t]) => t.until > now);
+    console.log(`Lockouts (${locks.length}):`);
+    for (const [k, e] of locks) console.log(`  ${k.startsWith('a:') ? 'account' : 'address'} ${k.slice(2)} until ${new Date(e.until).toLocaleString('en-GB')}`);
+    console.log(`Temporary blocks (${temp.length}):`);
+    for (const [ip, t] of temp) console.log(`  ${ip} until ${new Date(t.until).toLocaleString('en-GB')} - ${t.reason}`);
+    console.log(`Rules (${state.rules.length}):`);
+    for (const r of state.rules) console.log(`  ${r.rule}${r.note ? ` - ${r.note}` : ''}`);
+}
+
+if (flag('--list') || !args.length) {
+    list();
+    if (!args.length) console.log('\nUse --all, --ip <address> or --user <email> to unlock.');
+    process.exit(0);
+}
+
+const changes = [];
+if (flag('--all')) {
+    changes.push(`${Object.keys(state.lockouts).length} lockouts and ${Object.keys(state.temp).length} temporary blocks cleared`);
+    state.lockouts = {};
+    state.temp = {};
+}
+const ip = flag('--ip');
+if (typeof ip === 'string') {
+    const a = ip.replace(/^::ffff:/i, '').toLowerCase();
+    delete state.lockouts[`i:${a}`];
+    delete state.temp[a];
+    const before = state.rules.length;
+    state.rules = state.rules.filter(r => r.rule.toLowerCase() !== a);
+    changes.push(`${a}: lockout and temporary block cleared${before !== state.rules.length ? ', its rule removed' : ''}`);
+}
+const user = flag('--user');
+if (typeof user === 'string') {
+    delete state.lockouts[`a:${user.trim().toLowerCase()}`];
+    changes.push(`${user}: lockout cleared`);
+}
+if (!changes.length) {
+    console.log('Nothing to do. Use --list, --all, --ip <address> or --user <email>.');
+    process.exit(1);
+}
+fs.writeFileSync(`${file}.tmp`, JSON.stringify(state));
+fs.renameSync(`${file}.tmp`, file);
+for (const c of changes) console.log(`✓ ${c}`);
+console.log('The site picks this up within a few seconds.');

package/plugins/security/config.js

@@ -0,0 +1,7 @@
+/**
+ * Security - defaults. The site's own choices are saved from the settings
+ * slideover into config/plugins.json (see admin/lib/settings.js).
+ */
+import {DEFAULT_SETTINGS} from './admin/lib/settings.js';
+
+export default DEFAULT_SETTINGS;