domma-cms 0.84.1 → 0.86.0

package/plugins/shopping-cart/tests/pure.test.js

@@ -0,0 +1,210 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {createHmac} from 'node:crypto';
+import {formatMoney, fromMinor, includedTax, percentOf, toMinor} from '../public/lib/money.js';
+import {available, cleanProduct, priceRange, publicProduct, slugify, unitPrice} from '../public/lib/products.js';
+import {canMove, cleanCheckout} from '../public/lib/orders.js';
+import {cleanLines, priceBasket} from '../lib/pricing.js';
+import {paypalPaid, stripeForm, stripeLineItems, stripeSessionPaid, stripeVerify} from '../lib/payments.js';
+import {badge, summarise} from '../lib/summary.js';
+import {cartRegistry} from '../lib/extensions.js';
+import {matchShopPath} from '../plugin.public.js';
+import {cleanPath, cleanSettings, MASK, maskSettings} from '../lib/shop.js';
+import defaults from '../config.js';
+
+test('money: minor units in, formatted out', () => {
+    assert.equal(toMinor('19.99'), 1999);
+    assert.equal(toMinor('£1,299.50'), 129950);
+    assert.equal(toMinor(12), 1200);
+    assert.equal(toMinor('1000', 'JPY'), 1000);
+    for (const bad of ['', 'abc', '-3', null, '1.2.3']) assert.equal(toMinor(bad), null, String(bad));
+    assert.equal(fromMinor(1999), '19.99');
+    assert.equal(formatMoney(1999, 'GBP'), '£19.99');
+    assert.equal(formatMoney(2000, 'GBP', {compact: true}), '£20');
+    assert.equal(percentOf(1000, 20), 200);
+    assert.equal(includedTax(12000, 20), 2000);
+});
+
+test('products: cleaned, slugged, variants and stock', () => {
+    assert.equal(slugify('Blue Mug (Large) & Saucer!'), 'blue-mug-large-and-saucer');
+    const {data, errors} = cleanProduct({name: 'Tee', price: 2000, trackStock: true,
+        variants: [{name: 'S', stock: 2}, {name: 'M', stock: 0, price: 2200}, {name: 's'}]});
+    assert.ok(errors.variant2, 'a duplicate option name is refused');
+    assert.equal(data.slug, 'tee');
+    assert.equal(data.variants.length, 2);
+    const p = {...data};
+    assert.equal(unitPrice(p, p.variants[1].id), 2200);
+    assert.equal(unitPrice(p, p.variants[0].id), 2000);
+    assert.equal(available(p, p.variants[0].id), 2);
+    assert.equal(available(p, p.variants[1].id), 0);
+    assert.deepEqual(priceRange(p), {min: 2000, max: 2200});
+    assert.equal(available({trackStock: false}), Infinity);
+    const pub = publicProduct({id: 'x', data: p});
+    assert.equal(pub.variants[0].available, 2);
+    assert.equal(cleanProduct({name: '', price: 'x'}, {minor: false}).errors.price, 'Not a price.');
+    assert.equal(cleanProduct({name: 'A', price: '12.50'}, {minor: false}).data.price, 1250);
+    assert.equal(cleanProduct({name: 'A', price: 1000, compareAt: 900}).data.compareAt, null, 'a "was" price below the price is dropped');
+    assert.deepEqual(cleanProduct({name: 'A', price: 1, images: ['javascript:alert(1)', '/media/a.jpg']}).data.images, ['/media/a.jpg']);
+});
+
+test('orders: moves, checkout cleaning', () => {
+    assert.ok(canMove('paid', 'fulfilled'));
+    assert.ok(!canMove('cancelled', 'paid'));
+    assert.ok(!canMove('pending', 'refunded'));
+    const bad = cleanCheckout({customer: {name: '', email: 'nope'}, address: {country: 'FR'}}, {countries: ['GB']});
+    assert.ok(bad.errors.name && bad.errors.email && bad.errors.line1 && bad.errors.country);
+    const ok = cleanCheckout({customer: {name: 'Ann', email: 'Ann@Example.com'}}, {needsAddress: false});
+    assert.deepEqual(ok.errors, {});
+    assert.equal(ok.customer.email, 'ann@example.com');
+    assert.equal(ok.address, null);
+});
+
+const catalogue = new Map([
+    ['p1', {id: 'p1', data: {name: 'Mug', status: 'active', price: 1000, trackStock: true, stock: 3, variants: [], shippable: true}}],
+    ['p2', {id: 'p2', data: {name: 'Ebook', status: 'active', price: 500, trackStock: false, variants: [], shippable: false}}],
+    ['p3', {id: 'p3', data: {name: 'Old', status: 'archived', price: 100, variants: []}}]
+]);
+const S = {...defaults, currency: 'GBP'};
+
+test('pricing: stock caps quantities, archived products drop out', async () => {
+    const lines = cleanLines([{productId: 'p1', qty: 2}, {productId: 'p1', qty: 3}, {productId: 'p3', qty: 1}, {productId: '../x', qty: 1}, {productId: 'p2', qty: 0}]);
+    assert.deepEqual(lines.map(l => [l.productId, l.qty]), [['p1', 5], ['p3', 1]]);
+    const q = await priceBasket({lines, products: catalogue, settings: S});
+    assert.equal(q.lines.length, 1);
+    assert.equal(q.lines[0].qty, 3, 'only three left');
+    assert.equal(q.subtotal, 3000);
+    assert.equal(q.problems.length, 2);
+});
+
+test('pricing: flat delivery, free over a threshold, collection, nothing to ship', async () => {
+    const s = {...S, shippingFlat: 395, freeShippingOver: 2500, allowCollection: true};
+    let q = await priceBasket({lines: [{productId: 'p1', variantId: '', qty: 1}], products: catalogue, settings: s});
+    assert.equal(q.shipping, 395);
+    assert.equal(q.total, 1395);
+    q = await priceBasket({lines: [{productId: 'p1', variantId: '', qty: 3}], products: catalogue, settings: s});
+    assert.equal(q.shipping, 0);
+    assert.equal(q.adjustments[0].label, 'Free delivery');
+    q = await priceBasket({lines: [{productId: 'p1', variantId: '', qty: 1}], products: catalogue, settings: s, input: {delivery: 'collect'}});
+    assert.equal(q.shipping, 0);
+    q = await priceBasket({lines: [{productId: 'p2', variantId: '', qty: 1}], products: catalogue, settings: s});
+    assert.equal(q.requiresShipping, false);
+    assert.equal(q.adjustments.length, 0);
+});
+
+test('pricing: tax inclusive shows, exclusive adds', async () => {
+    const lines = [{productId: 'p1', variantId: '', qty: 1}];
+    let q = await priceBasket({lines, products: catalogue, settings: {...S, taxRate: 20, pricesIncludeTax: true, shippingFlat: 200}});
+    assert.equal(q.total, 1200);
+    assert.equal(q.tax, 200, 'the VAT inside £12');
+    assert.ok(q.taxIncluded);
+    q = await priceBasket({lines, products: catalogue, settings: {...S, taxRate: 10, pricesIncludeTax: false, taxShipping: false, shippingFlat: 200}});
+    assert.equal(q.tax, 100);
+    assert.equal(q.total, 1300);
+});
+
+test('pricing: an extension replaces a stage; a discount never goes below nothing; a failure falls back', async () => {
+    const lines = [{productId: 'p1', variantId: '', qty: 1}];
+    let q = await priceBasket({lines, products: catalogue, settings: S, handlers: {discount: () => [{label: 'Huge', amount: -99999, code: 'X'}]}});
+    assert.equal(q.discount, -1000);
+    assert.equal(q.total, 0);
+    q = await priceBasket({lines, products: catalogue, settings: {...S, shippingFlat: 300}, handlers: {shipping: () => { throw new Error('boom'); }}});
+    assert.equal(q.shipping, 300, 'the built-in rate stands in');
+    assert.equal(q.internalNotes.length, 1);
+    assert.equal(q.notes.length, 0, 'the shopper is not told about our fault');
+});
+
+test('registry: stages, tabs, and emit that never throws', async () => {
+    const reg = cartRegistry();
+    reg.register('test-ext', {stages: {discount: () => []}, tabs: [{key: 'x', label: 'X', module: '/plugins/test-ext/admin/x.js'}, {key: 'bad', module: 'https://evil/x.js'}],
+        on: {paid: () => { throw new Error('nope'); }}, checkout: {codes: true}});
+    assert.equal(typeof reg.handlers().discount, 'function');
+    assert.deepEqual(reg.tabs().map(t => t.key), ['x']);
+    assert.deepEqual(reg.checkoutFeatures(), {codes: true});
+    reg.emit('paid', {});
+    await new Promise(r => setTimeout(r, 5));
+    reg.unregister('test-ext');
+    assert.equal(reg.list().length, 0);
+});
+
+test('stripe: form encoding, itemising, signature, paid check', () => {
+    assert.equal(stripeForm({a: {b: [{c: 1}]}, d: 'x', e: null}).toString(), 'a%5Bb%5D%5B0%5D%5Bc%5D=1&d=x');
+    const order = {id: 'o1', number: 1001, currency: 'GBP', total: 1395,
+        lines: [{name: 'Mug', variantName: '', unitPrice: 1000, qty: 1, image: ''}],
+        adjustments: [{stage: 'shipping', label: 'Delivery', amount: 395}, {stage: 'tax', label: 'Incl VAT', amount: 232, included: true}]};
+    assert.equal(stripeLineItems(order).length, 2, 'the mug and delivery; included tax is not a line');
+    assert.equal(stripeLineItems({...order, adjustments: [{stage: 'discount', label: 'X', amount: -100}]}).length, 1, 'discounted: one line');
+    const body = '{"x":1}';
+    const t = 1_700_000_000;
+    const sig = createHmac('sha256', 'whsec_test').update(`${t}.${body}`).digest('hex');
+    assert.ok(stripeVerify(Buffer.from(body), `t=${t},v1=${sig}`, 'whsec_test', 300, t + 10));
+    assert.ok(!stripeVerify(Buffer.from(body), `t=${t},v1=${sig}`, 'whsec_test', 300, t + 1000), 'too old');
+    assert.ok(!stripeVerify(Buffer.from('{"x":2}'), `t=${t},v1=${sig}`, 'whsec_test', 300, t));
+    const session = {payment_status: 'paid', client_reference_id: 'o1', currency: 'gbp', amount_total: 1395, id: 'cs_1', payment_intent: 'pi_1'};
+    assert.deepEqual(stripeSessionPaid(session, order), {ref: 'cs_1', payment: 'pi_1'});
+    assert.equal(stripeSessionPaid({...session, amount_total: 1}, order), null, 'the wrong amount is not a payment');
+});
+
+test('paypal: only a completed capture of the right amount counts', () => {
+    const order = {id: 'o1', currency: 'GBP', total: 1395};
+    const pp = {id: 'PP1', status: 'COMPLETED', purchase_units: [{reference_id: 'o1', payments: {captures: [{id: 'CAP1', status: 'COMPLETED', amount: {currency_code: 'GBP', value: '13.95'}}]}}]};
+    assert.deepEqual(paypalPaid(pp, order), {ref: 'PP1', payment: 'CAP1'});
+    assert.equal(paypalPaid({...pp, status: 'APPROVED'}, order), null);
+    assert.equal(paypalPaid(pp, {...order, total: 2000}), null);
+});
+
+test('storefront addresses', () => {
+    assert.deepEqual(matchShopPath('/shop', '/shop'), {name: 'index', params: {}});
+    assert.equal(matchShopPath('/shop/cart', '/shop').name, 'cart');
+    assert.deepEqual(matchShopPath('/shop/blue-mug', '/shop'), {name: 'product', params: {slug: 'blue-mug'}});
+    assert.deepEqual(matchShopPath('/shop/order/0f8c3a2e-1111', '/shop'), {name: 'order', params: {id: '0f8c3a2e-1111'}});
+    assert.equal(matchShopPath('/shopping', '/shop'), null);
+    assert.equal(matchShopPath('/shop/a/b/c', '/shop'), null);
+    assert.equal(cleanPath('Store/'), '/store');
+    assert.equal(cleanPath('/admin'), '/shop', 'never over the admin');
+});
+
+test('settings: secrets masked, a mask keeps the stored value, bad keys refused', () => {
+    const current = {...defaults, stripeSecretKey: 'sk_test_abcdefghijklmnop'};
+    assert.equal(maskSettings(current).stripeSecretKey, MASK);
+    assert.equal(maskSettings(current).paypalSecret, '');
+    let r = cleanSettings({stripeSecretKey: MASK, taxRate: '20'}, current);
+    assert.equal(r.settings.stripeSecretKey, current.stripeSecretKey);
+    assert.equal(r.settings.taxRate, 20);
+    r = cleanSettings({stripeSecretKey: 'pk_test_wrong', stripeEnabled: true}, current);
+    assert.ok(r.errors.stripeSecretKey);
+    r = cleanSettings({paypalEnabled: true}, current);
+    assert.ok(r.errors.paypalEnabled);
+});
+
+test('summary and badge', () => {
+    const now = Date.parse('2026-09-26T12:00:00Z');
+    const o = (status, total, daysAgo, extra = {}) => ({id: `${status}${total}`, meta: {createdAt: new Date(now - daysAgo * 864e5).toISOString()},
+        data: {status, total, number: 1000 + total, paidAt: ['paid', 'fulfilled'].includes(status) ? new Date(now - daysAgo * 864e5).toISOString() : undefined,
+            lines: [{productId: 'p1', name: 'Mug', qty: 1, lineTotal: total}], customer: {name: 'Ann'}, ...extra}});
+    const orders = [o('paid', 500, 0), o('fulfilled', 1500, 3), o('pending', 900, 1), o('refunded', 700, 2), o('paid', 100, 40)];
+    const s = summarise(orders, [{id: 'p1', data: {status: 'active', trackStock: true, stock: 1, name: 'Mug'}}], {...S, lowStockAt: 3}, now);
+    assert.equal(s.days30.revenue, 2000);
+    assert.equal(s.days30.orders, 2);
+    assert.equal(s.toFulfil, 2);
+    assert.equal(s.abandoned, 1);
+    assert.equal(s.lowStockCount, 1);
+    assert.equal(s.series.length, 30);
+    const b = badge(orders, S, now);
+    assert.equal(b.count, 2);
+    assert.equal(b.tone, 'danger', 'one has waited 40 days');
+});
+
+test('pricing: a shipping handler can offer services to choose between', async () => {
+    const lines = [{productId: 'p1', variantId: '', qty: 1}];
+    const shipping = ({input}) => {
+        const choices = [{id: 'std', label: 'Standard', amount: 300}, {id: 'exp', label: 'Express', amount: 900}];
+        const pick = choices.find(c => c.id === input.service) || choices[0];
+        return {adjustments: [{label: pick.label, amount: pick.amount, ref: pick.id}], choices};
+    };
+    let q = await priceBasket({lines, products: catalogue, settings: S, handlers: {shipping}});
+    assert.deepEqual(q.shippingChoices.map(c => c.id), ['std', 'exp']);
+    assert.equal(q.shippingChoice, 'std');
+    q = await priceBasket({lines, products: catalogue, settings: S, input: {service: 'exp'}, handlers: {shipping}});
+    assert.equal(q.shipping, 900);
+    assert.equal(q.shippingChoice, 'exp');
+});

package/scripts/setup.js

@@ -46,6 +46,7 @@ const THEMES = [
     'unicorn-dark', 'unicorn-light',
     'dreamy-dark', 'dreamy-light',
     'wedding-dark', 'wedding-light',
+    'corporate-dark', 'corporate-light',
 ];
 
 const SERVER_CONFIG = path.join(ROOT, 'config', 'server.json');

package/server/routes/api/notifications.js

@@ -116,9 +116,10 @@ export function notificationsBadge(active = []) {
  *
  * @param {Date} now
  * @param {string} origin - the site's own address, for the one sample with a link
+ * @param {string|null} [forUser] - the id of whoever asked: only they see them
  * @returns {object[]} entries, `{id, data, meta}`
  */
-export function sampleNotifications(now = new Date(), origin = '') {
+export function sampleNotifications(now = new Date(), origin = '', forUser = null) {
     const expiresAt = new Date(now.getTime() + 7 * 86_400_000).toISOString();
     const note = `\n\n(A sample - it goes by itself on ${expiresAt.slice(0, 10)}.)`;
     const samples = [
@@ -138,7 +139,7 @@ export function sampleNotifications(now = new Date(), origin = '') {
         return {
             id: randomUUID(),
             data: {title: x.title, body: x.body + note, severity: x.severity, source: 'sample', link: x.link || null,
-                createdAt: at, expiresAt, readBy: [], dismissedBy: []},
+                createdAt: at, expiresAt, readBy: [], dismissedBy: [], audience: forUser ? {userIds: [String(forUser)]} : null},
             meta: {createdAt: at, updatedAt: at, source: 'sample'}
         };
     });
@@ -354,7 +355,7 @@ export async function notificationsRoutes(fastify, opts = {}) {
     fastify.post('/system/notifications/samples', canDelete, async (request, reply) => {
         const adapter = await getAdapter(SLUG);
         const origin = `${request.protocol}://${request.host || request.hostname}`;
-        const made = sampleNotifications(new Date(), origin);
+        const made = sampleNotifications(new Date(), origin, request.user?.id);
         // A second click replaces the samples rather than stacking another set.
         for (const e of await adapter.all(SLUG)) if (e?.data?.source === 'sample') await adapter.remove(SLUG, e.id);
         for (const entry of made) await adapter.insert(SLUG, entry);

package/server/services/notify.js

@@ -64,13 +64,15 @@ export function cleanLink(link) {
 
 /**
  * May this user see a notification with this audience. None (manager pushes,
- * everything before 0.80) is everyone who can read notifications, as before.
+ * everything before 0.80) is admins and up: roles a plugin gives the bell to
+ * (Job Board's company, agent and candidate - people from outside, who may have
+ * signed themselves up) must never see what was meant for the site's staff.
  *
  * @param {object|null|undefined} audience - {roles: string[]} | {userIds: string[]}
  * @param {object} user - request.user: {id, role, additionalRoles}
  */
 export function inAudience(audience, user) {
-    if (!audience || typeof audience !== 'object') return true;
+    if (!audience || typeof audience !== 'object') audience = AUDIENCES.admins;
     if (Array.isArray(audience.userIds)) return audience.userIds.includes(user?.id);
     if (Array.isArray(audience.roles)) {
         const held = getEffectiveRoles(user || {});

package/server/services/pluginScope.js

@@ -0,0 +1,85 @@
+/**
+ * Plugin APIs and the admin scope.
+ *
+ * A role can confine its holders to a few admin screens (`role.admin =
+ * {home, allow}` - Job Board's company, agent and candidate roles, say, which
+ * people outside the business can sign themselves up for). The admin's router
+ * keeps them on those screens (admin/js/lib/admin-scope.js), but that is the
+ * browser: every plugin's API was open to ANY signed-in user whose route only
+ * asked `authenticate`, and most plugins' write routes asked nothing more. So
+ * a job seeker could publish, edit or delete blog posts through the API.
+ *
+ * The rule here: a user whose roles confine them may call a plugin's
+ * authenticated routes only if their scope admits at least one of that
+ * plugin's admin screens. An unconfined user (every staff role, the level-0
+ * role) is untouched, and so is every route that does not authenticate (the
+ * public side). Core's own APIs are guarded by permissions, as before.
+ *
+ * Pure except for the role lookup, which is passed in.
+ *
+ * @module services/pluginScope
+ */
+
+/** Does an allowed prefix cover a path? The admin's own rule (admin-scope.js). */
+export function covers(allowed, path) {
+    if (allowed === '/') return path === '/';
+    return path === allowed || path.startsWith(`${allowed}/`);
+}
+
+/**
+ * The admin screens a plugin owns: its routes, and where its sidebar entries
+ * point (`#/plugins/blog` -> `/plugins/blog`).
+ *
+ * @param {object} manifest - plugin.json
+ * @returns {string[]}
+ */
+export function pluginAdminPaths(manifest) {
+    const admin = manifest?.admin || {};
+    const paths = [];
+    for (const r of Array.isArray(admin.routes) ? admin.routes : []) if (typeof r?.path === 'string') paths.push(r.path);
+    const walk = (items) => {
+        for (const it of Array.isArray(items) ? items : []) {
+            for (const u of [it?.url, it?.section]) if (typeof u === 'string' && u.startsWith('#/')) paths.push(u.slice(1));
+            walk(it?.children);
+        }
+    };
+    walk(admin.sidebar);
+    return [...new Set(paths.map(p => p.split('?')[0].replace(/\/:[^/]+/g, '').replace(/\/+$/, '') || '/'))];
+}
+
+/**
+ * May a user with this admin scope call this plugin's authenticated API?
+ *
+ * @param {{home: string, allow: string[]}|null} scope - null = the whole admin
+ * @param {object} manifest
+ * @returns {boolean}
+ */
+export function pluginInScope(scope, manifest) {
+    if (!scope) return true;
+    const allow = Array.isArray(scope.allow) ? scope.allow : [];
+    return pluginAdminPaths(manifest).some(p => allow.some(a => covers(a, p)));
+}
+
+/**
+ * The `authenticate` a plugin is handed: core's, then the scope rule.
+ *
+ * @param {Function} authenticate - core's preHandler
+ * @param {object} manifest
+ * @param {(user: object) => ({home: string, allow: string[]}|null)} scopeOf - the user's admin scope
+ * @returns {Function} a preHandler
+ */
+export function authenticateFor(authenticate, manifest, scopeOf) {
+    return async function authenticateInScope(request, reply) {
+        const out = await authenticate(request, reply);
+        if (reply.sent) return out;
+        let scope = null;
+        try { scope = scopeOf(request.user); } catch { scope = null; }
+        if (!pluginInScope(scope, manifest)) {
+            return reply.code(403).send({
+                statusCode: 403, error: 'Forbidden',
+                message: `Your account cannot use ${manifest?.displayName || manifest?.name || 'this plugin'}.`
+            });
+        }
+        return out;
+    };
+}

package/server/services/plugins.js

@@ -33,7 +33,9 @@ import {classifyEntitlement, mayLoad} from './pluginEntitlement.js';
 import {notifierFor} from './notify.js';
 import {createCollection, getCollection} from './collections.js';
 import * as defaultRolesService from './roles.js';
-import {normaliseAdminScope} from './roles.js';
+import {getAdminScope, normaliseAdminScope} from './roles.js';
+import {authenticateFor} from './pluginScope.js';
+import {getEffectiveRoles} from './userRoles.js';
 import * as defaultUsersService from './users.js';
 import {registerLoginCheck, registerPasswordCheck} from './authChecks.js';
 
@@ -473,7 +475,10 @@ export async function registerPlugins(fastify) {
           const prefix = `/api/plugins/${manifest.name}`;
           await fastify.register(plugin, {
             prefix,
-            auth: {authenticate, requireRole, requireAdmin, requireVisibility, requirePermission},
+            // A user confined to some admin screens (role.admin) may call this plugin's
+            // authenticated routes only if one of its screens is among them - see pluginScope.js.
+            auth: {authenticate: authenticateFor(authenticate, manifest, (user) => getAdminScope(getEffectiveRoles(user || {}))),
+                requireRole, requireAdmin, requireVisibility, requirePermission},
               hooks: {registerShortcode, registerSanitizeRules, registerTransform, registerMenuLocation,
                   // Stamped with the plugin's name, so the Menus editor can say where a Tool came from.
                   registerSidebarItem: (opts) => registerSidebarItem({...opts, item: {source: manifest.displayName || manifest.name, ...opts?.item}}),