domma-cms 0.84.1 → 0.86.0

package/plugins/blog/tests/comment-notices.test.js

@@ -0,0 +1,140 @@
+/**
+ * blog: a comment held for approval raises a notice for the site's staff, and
+ * moderating or deleting it resolves that notice. The plugin runs in Fastify
+ * against the domma-cms checkout's collections; the blog collections'
+ * data files and config/plugins.json are put back byte for byte.
+ */
+import {test, before, after} from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import Fastify from 'fastify';
+import plugin from '../plugin.js';
+import {commentKey} from '../lib/notices.js';
+
+const SLUGS = {posts: 'blog-posts', comments: 'blog-comments', categories: 'blog-categories'};
+// The checkout's content/ carries an old demo blog-comments schema (post_slug, author_name...), not the
+// plugin's: the plugin's own schemas stand in for the run, and every file goes back as it was.
+const KEEP = ['config/plugins.json', ...Object.values(SLUGS).flatMap(c => [`content/collections/${c}/data.json`, `content/collections/${c}/schema.json`])]
+    .map(f => path.resolve(f));
+const HERE = path.dirname(new URL(import.meta.url).pathname);
+const saved = new Map();
+// Registering the plugin seeds its layout blocks into content/blocks: whatever it adds goes again.
+const BLOCKS = path.resolve('content/blocks');
+let blocksBefore = new Set();
+const MIGRATIONS = path.resolve('content/.migrations.json');
+let hadMigrations = true;
+const notes = [];
+const resolved = [];
+const sources = [];
+// Who holds what - as a site that shipped this release would have it.
+const WRITE = ['super-admin', 'admin', 'blog-editor', 'blog-author'];
+const EDIT = ['super-admin', 'admin', 'blog-editor'];
+const HOLDERS = {
+    'blog-posts.read': WRITE, 'blog-posts.create': WRITE, 'blog-posts.update': WRITE, 'blog-categories.read': WRITE,
+    'blog-posts.delete': EDIT, 'blog-posts.publish': EDIT, 'blog-categories.create': EDIT, 'blog-categories.update': EDIT,
+    'blog-categories.delete': EDIT, 'blog-comments.read': EDIT, 'blog-comments.update': EDIT, 'blog-comments.delete': EDIT
+};
+let app;
+
+before(async () => {
+    for (const f of KEEP) saved.set(f, await fs.readFile(f, 'utf8').catch(() => null));
+    blocksBefore = new Set(await fs.readdir(BLOCKS).catch(() => []));
+    const {invalidate} = await import('../../../server/services/adapterRegistry.js').catch(() => ({}));
+    for (const [dir, slug] of Object.entries(SLUGS)) {
+        const target = path.resolve('content/collections', slug);
+        await fs.mkdir(target, {recursive: true});
+        await fs.copyFile(path.join(HERE, '..', 'collections', dir, 'schema.json'), path.join(target, 'schema.json'));
+        await fs.writeFile(path.join(target, 'data.json'), '[]\n');
+        invalidate?.(slug);
+    }
+    hadMigrations = await fs.access(MIGRATIONS).then(() => true, () => false);
+    app = Fastify();
+    const pass = async () => {};
+    await app.register(plugin, {prefix: '/b', settings: {},
+        // Who is asking: the x-as header (a role), super-admin by default.
+        getPermissionsFor: (key) => HOLDERS[key] || ['super-admin'],
+        auth: {authenticate: async (req) => { const r = req.headers['x-as'] || 'super-admin'; req.user = {id: `u-${r}`, role: r, name: r,
+            ...(req.headers['x-also'] ? {additionalRoles: [req.headers['x-also']]} : {})}; }, requireAdmin: pass,
+            requirePermission: () => pass, requireRole: () => pass, requireVisibility: () => pass},
+        hooks: {notify: (p) => { notes.push(p); }, resolveNotification: (k, s) => { resolved.push(`${s}|${k}`); },
+            registerNotificationSource: (d) => { sources.push(d.id); }}});
+    await app.ready();
+});
+
+after(async () => {
+    await app?.close();
+    for (const name of await fs.readdir(BLOCKS).catch(() => [])) {
+        if (!blocksBefore.has(name)) await fs.rm(path.join(BLOCKS, name), {force: true});
+    }
+    if (!hadMigrations) await fs.rm(MIGRATIONS, {force: true});
+    for (const [f, text] of saved) {
+        if (text === null) await fs.rm(f, {force: true});
+        else await fs.writeFile(f, text);
+    }
+});
+
+const call = async (method, url, body, as, also) => {
+    const headers = {...(as ? {'x-as': as} : {}), ...(also ? {'x-also': also} : {})};
+    const res = await app.inject({method, url: `/b${url}`, payload: body, headers});
+    return {status: res.statusCode, body: res.json()};
+};
+
+test('a held comment notifies; approving it, or deleting one, resolves it', async () => {
+    assert.ok(sources.includes('comments'));
+    assert.equal((await call('PUT', '/settings', {commentsEnabled: true, commentModeration: true})).status, 200, 'comments on, held for approval');
+    const post = (await call('POST', '/posts', {title: 'Spring opening hours', slug: `zz-notice-${Date.now()}`, status: 'published',
+        content: 'Open late.', body: 'Open late.'})).body;
+    assert.ok(post.id, JSON.stringify(post));
+    await call('POST', `/posts/${post.id}/publish`).catch(() => {});
+
+    const say = (text) => call('POST', '/comments', {postId: post.id, authorName: 'Jo', authorEmail: 'jo@example.test', body: text});
+    const first = await say('<b>Great</b> news');
+    assert.equal(first.status, 201, JSON.stringify(first.body));
+    const n = notes.find(x => x.dedupeKey === commentKey(first.body.id));
+    assert.equal(n.title, 'New comment on "Spring opening hours"');
+    assert.match(n.body, /^Jo: <b>Great<\/b> news/, 'kept as text - the screen escapes it');
+    assert.equal(n.source, 'comments');
+    assert.equal(n.link, '#/plugins/blog/comments');
+
+    await call('PUT', `/comments/${first.body.id}`, {status: 'approved'});
+    assert.ok(resolved.includes(`comments|${commentKey(first.body.id)}`));
+
+    const second = await say('Spam?');
+    resolved.length = 0;
+    await call('PUT', `/comments/${second.body.id}`, {status: 'pending'});
+    assert.equal(resolved.length, 0, 'still waiting: nothing to resolve');
+    await call('DELETE', `/comments/${second.body.id}`);
+    assert.ok(resolved.includes(`comments|${commentKey(second.body.id)}`));
+
+    // The honeypot makes nothing, and says nothing.
+    notes.length = 0;
+    await call('POST', '/comments', {postId: post.id, authorName: 'Bot', authorEmail: 'b@x.test', body: 'buy', website: 'http://spam'});
+    assert.equal(notes.length, 0);
+});
+
+test('by permission: a plain account gets nothing; an author only their own; an editor held as an additional role moderates', async () => {
+    const draft = (await call('POST', '/posts', {title: 'Staff draft', slug: `zz-perm-${Date.now()}`})).body;
+    const say = (await call('POST', '/comments', {postId: draft.id, authorName: 'Jo', authorEmail: 'jo@example.test', body: 'x'}));
+    // A plain signed-in account: no drafts, no commenters, no writing, no moderating.
+    for (const [m, u, b] of [['GET', '/posts'], ['GET', `/posts/${draft.id}`], ['POST', '/posts', {title: 'x'}], ['GET', '/comments'],
+        ['GET', '/comments/pending-count'], ['GET', '/settings'], ['GET', '/categories']]) {
+        assert.equal((await call(m, u, b, 'user')).status, 403, `${m} ${u}`);
+    }
+    if (say.body?.id) {
+        assert.equal((await call('PUT', `/comments/${say.body.id}`, {status: 'approved'}, 'user')).status, 403);
+        assert.equal((await call('DELETE', `/comments/${say.body.id}`, null, 'user')).status, 403);
+    }
+    // An author: writes, sees only their own, cannot publish, delete or read comments.
+    const mine = (await call('POST', '/posts', {title: 'Mine', slug: `zz-mine-${Date.now()}`}, 'blog-author')).body;
+    assert.ok(mine.id);
+    const listed = (await call('GET', '/posts', null, 'blog-author')).body.map(p => p.id);
+    assert.ok(listed.includes(mine.id) && !listed.includes(draft.id), 'own posts only');
+    assert.equal((await call('GET', `/posts/${draft.id}`, null, 'blog-author')).status, 404, "someone else's draft is not there");
+    assert.equal((await call('POST', `/posts/${mine.id}/publish`, null, 'blog-author')).status, 403);
+    assert.equal((await call('DELETE', `/posts/${mine.id}`, null, 'blog-author')).status, 403);
+    assert.equal((await call('GET', '/comments', null, 'blog-author')).status, 403);
+    // An editor held as an ADDITIONAL role: role names are not what counts.
+    assert.equal((await call('GET', '/comments', null, 'user', 'blog-editor')).status, 200);
+    if (say.body?.id) assert.equal((await call('PUT', `/comments/${say.body.id}`, {status: 'approved'}, 'user', 'blog-editor')).status, 200);
+});

package/plugins/blog/tests/notices.test.js

@@ -0,0 +1,20 @@
+/** The moderation notice (blog/lib/notices.js). */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {commentKey, commentNotice} from '../lib/notices.js';
+
+test('a held comment makes a notice; an approved one does not', () => {
+    const n = commentNotice({id: 'c1', status: 'pending', authorName: 'Sam', body: 'Lovely  post,\nthanks'}, 'Spring hours', '#/plugins/blog/comments');
+    assert.deepEqual(n, {title: 'New comment on "Spring hours"', body: 'Sam: Lovely post, thanks\n\nWaiting for approval.',
+        severity: 'info', link: '#/plugins/blog/comments', source: 'comments', dedupeKey: commentKey('c1')});
+    assert.equal(commentNotice({id: 'c2', status: 'approved', body: 'x'}, 'P', '#/x'), null);
+    assert.equal(commentNotice(null, 'P', '#/x'), null);
+});
+
+test('a long comment is one line, cut short; a missing name is "Someone"', () => {
+    const n = commentNotice({id: 'c3', status: 'pending', body: 'word '.repeat(200)}, 'T'.repeat(100), '#/x');
+    assert.ok(n.title.length <= 100);
+    assert.ok(n.body.startsWith('Someone: word word'));
+    assert.ok(n.body.split('\n')[0].length <= 212);
+    assert.ok(n.body.includes('…'));
+});

package/plugins/blog/tests/public.test.js

@@ -16,7 +16,7 @@ import zlib from 'zlib';
 import Fastify from 'fastify';
 import compress from '@fastify/compress';
 import blogPublicPlugin from '../plugin.public.js';
-import {postFields} from '../plugin.js';
+import {postFields, usePermissionLookup} from '../plugin.js';
 
 async function buildPublic() {
     const app = Fastify();
@@ -54,6 +54,8 @@ test('a display can be asked for, and an unknown one falls back', async () => {
 });
 
 test('an author cannot publish by writing the status - that is what the publish route is for', () => {
+    // Who may publish is a permission: editors and admins hold blog-posts.publish.
+    usePermissionLookup((k) => (k === 'blog-posts.publish' ? ['super-admin', 'admin', 'blog-editor'] : []));
     const author = {id: 'a', role: 'blog-author'};
     const editor = {id: 'e', role: 'blog-editor'};
     assert.equal(postFields({status: 'published'}, author).status, undefined);

package/plugins/free-tier.lock.json

@@ -1,11 +1,11 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@46444b1",
+  "source": "dcms-marketplace@0335bfa",
   "plugins": {
     "blog": {
-      "version": "1.6.3",
+      "version": "1.8.0",
       "files": {
-        "CLAUDE.md": "63b11d562db0e0003b929320f55f2a6dedf6ba98a20ed6f5c768fa3177286de9",
+        "CLAUDE.md": "026438d4d93f5a637be16ac22d5131e8248e93d2df1bd9b30d5f1cfe357ba2cc",
         "admin/css/index.css": "6142a6b756e1218157842528830b1e84f592f0b84b7d5ce6449db421b6f4b039",
         "admin/templates/blog.html": "a6054c1febe764bb1edf5c9e466d44a9080d9c83ba5486437b7a8244acf5ba54",
         "admin/templates/categories.html": "ab7d6fc2fedd48876c585bc216a1532b3bdd78c946dee976c1171bfe4664feb6",
@@ -41,13 +41,15 @@
         "collections/comments/schema.json": "29cbd289cbfcfc4158c9357a218db4ce06eddc3370bfbf9afb7d7f52065a849e",
         "collections/posts/schema.json": "19a5a770d3eefea73f4117454bd1312a7a7e3d727cfcdfde141139fbc81cabd7",
         "config.js": "ee67396262762f5c31269d258affd75f7392a3e364f72f7792c2f1cdafd94bba",
+        "lib/access.js": "af47440c7233a56000641a3231d7e9ff81b12f40dfb9528aa6dd4e2dd9bca8df",
         "lib/layouts.js": "bbb61ac7ec2e0cecd3d59700e9f3bd1064cd53b2e9f639d28b45ffc2ad80ab27",
         "lib/nav-link.js": "6a8f9368bb8aee1c21e90fb335a691859cb9a9bc250c2b9167a33ca9189fa2ff",
+        "lib/notices.js": "a9a2918ee6f5f7e0bbaeced0d3539584279bdbe68d15472a8615bdddb4ef905b",
         "lib/page.js": "464face32871185368de096ed9a6aa635523bf319af6459308cfceb77d66f82c",
         "lib/render.js": "0e97c6a950bc962c8d8ea4b2f21d06cb73fbcdc738d8942d6935d01309a29b1d",
         "lib/samples.js": "e8cdb77ce22e43937707f6854d3a5cb722437dc584e22ac7b24480bef686cf85",
-        "plugin.js": "ccfd8735838bb6c8c5d45c3c3589d6adcf114a89b560f66e93a1077e9bea3bfb",
-        "plugin.json": "5654242b0fd5d4f6039a87dc429bd69a24355a59c3409be10998410fbe6d019b",
+        "plugin.js": "db93fd831f6ff6762c6768d47e658830b6284b6f4a9efd2bbffaab5966ba0361",
+        "plugin.json": "d6a254e9ec114cbc469e8e2b5a9ca33376c3f88e49c54d42ea589ac883e3dac3",
         "plugin.public.js": "8efc1ff3a2ead68d36fbd545f8ce590f600b293896ba6f4947418b1efcdf2947",
         "public/blog.css": "fd733e6b624190da1e70dc1b6613e2376efd7f7570a28fab311d81006d03d960",
         "public/blog.js": "d01c72a9834dcc7c5241923371f2b164ac30d20ac9f1a5c5dc5b71fa3cb09f08",
@@ -57,23 +59,26 @@
         "public/samples/harbour.svg": "a5f09eafa1406da3c2d017e9bee308a98543df15090ed27227cbbf8341aec460",
         "public/samples/meadow.svg": "90efae21e209b7d48901eed457f47d0a347c58a6b6e1ea81ba98c131c4c559cb",
         "public/samples/rosewood.svg": "0f963fe5633585786271255b7c9df36be67748ae751f9cf7b0bbda6f5b93449d",
-        "roles/blog-author.json": "ccdd4d99296c157ddc839af22ef6e79c47c381dd9d937069f7090a4fb76bb41d",
+        "roles/blog-author.json": "2784a98dd31667bd3aefdf3f8ad3895e6fb200e26a9f1bb7c873f9e9993d4a2b",
         "roles/blog-editor.json": "bea0b673cf9e3da04c5882d51dd33bdcaf035b047c1cfe87624a9f16e6514ffc",
         "templates/index.html": "3c2cf8a4ffde8599d451f6d00b736aeba42fd073b726ada3b0ffe4d56e1ef0f4",
         "templates/post.html": "28e9f06071115ecc4fbba007b35782732bf12ef72528525893d424e3c4f0313f",
+        "tests/access.test.js": "65b760910117c3a44195543acdcff91074f39b4e5567911a2bd8676204152cb2",
+        "tests/comment-notices.test.js": "34026cc9a2a4746cf87bc41df8be849fadaa43091a72ac2aa1d06c1f437bf618",
         "tests/layouts.test.js": "5325aad79a153f1d17f49b27223f50be182a2acce8ee8be7da658ae92ae36fe8",
         "tests/nav-link.test.js": "d36e33ad7483abca27ae6e2098ad2f75bafa18d91f3beba70372ebe6b9b88994",
-        "tests/public.test.js": "0049a6be16c6a8acb44d53ea885909c80563a0afaa3e1e89d3c54d5429feed98"
+        "tests/notices.test.js": "2b02aa84e780dc4c82e6c503fc8fe17c64a63bee0709627866ef97c99cb4e131",
+        "tests/public.test.js": "a6fcdc4ede242aa050ffe5a52f970d6bec1f4a70ae78967eb8a7bdeec73df19d"
       }
     },
     "mail-reader": {
-      "version": "1.1.0",
+      "version": "1.2.0",
       "files": {
         "CLAUDE.md": "7f317e69b560457f2d4c401b466754850afe75f6983bc41414c71d8c276c3583",
         "admin/views/mail.js": "c5c6483f9618c75cac8f4be32d3aea99511db76d4b9d38b8ef43bdc1d35db3c5",
         "config.js": "6e65803ad822a9acda40c203631b8eb32a87cf9d9e5f1c7cb59d01aa406075c6",
-        "plugin.js": "ebe4c41bdd8836fb3128af3a0e789d47f89b00e9e37dc9378bb308aaae8d41b2",
-        "plugin.json": "ed1f02d9405f6ae1257313ea4155ea49e307fb2210650fd247b92e6988aa78d1"
+        "plugin.js": "7f602a60c4eca7d3637659d03d5de9e242584666846b16c9e5a1b758e4856c9f",
+        "plugin.json": "60111616d915be07c8bb53a54b8aeae906e167d157e54295bb440546128acd55"
       }
     },
     "security": {
@@ -99,6 +104,54 @@
         "server/state.js": "1319b322e94a4aec176948990b2d674b28dfece761eef4d5685df474037bfc4a",
         "tests/security.test.js": "951636a0e42ac8dbf78b69ca7e7e2adcd4e29d94a51998e738c3afa742c00866"
       }
+    },
+    "shopping-cart": {
+      "version": "1.0.0",
+      "files": {
+        "CLAUDE.md": "0f89bab23796eba425e26792c952eb00eddb09fb2c74a4a7a1fb3722437dae0b",
+        "admin/css/index.css": "a6bab1d0072e364ee1d94c2d7d7b99c3660ba91c5eba537e269a579f5b17f924",
+        "admin/lib/kit.js": "3e721a53a97f136833975f99d9f985fcec4018b328b4d355267fe11702234fa0",
+        "admin/templates/shop.html": "c5bb03f1f7cbabfbd8202f3533783eb1848103755b1ba25fdcf1fd8e9478cb8e",
+        "admin/views/orders.js": "8255b75a4a0eeccec7cf76982a5f64469ab7a2ad5f742a54afe55bca61ace713",
+        "admin/views/overview.js": "3901dfb9527fed0689bb31098488136471ff081b9fe28979339f39b2d53e3bd3",
+        "admin/views/products.js": "4947de61aa57da59fd0e819ac0f5380bbdee6b73855bd91d3872445fdd6c3e2d",
+        "admin/views/settings.js": "28cb0b5e8d45e3723ffe77e46299bfc13fbad02a2ae8103843c6894dc232387a",
+        "admin/views/shop.js": "a53a1793251b962a87c5d01685f934b6476bcfcdd51e3dea3a319eb8c03a4137",
+        "collections/shop-orders.json": "0bca8eef2d5f9108651f73d273480265c167dc983aa115ce59613d13015ca255",
+        "collections/shop-products.json": "4d4613ecec7b8a5a0744c4f0a57b17a4429b461e060206a4bbdea5ad7c8c75dc",
+        "config.js": "dcb91db2839c1ab9e40bb1811397024fad9e37e3753d17e2baa2b9b31d4a7d7c",
+        "inject/body.html": "de20f92c83229545d20e5186fd37ef0046a8820881bff34e7df5391cd7a2c75d",
+        "lib/extensions.js": "2cba90efef5b437ace557c7265fe7363ac7923d155681087a63e31e1168f6601",
+        "lib/payments.js": "84ad14813688de1f38448b4935180a786cda8af2f7f4b8890a8f1d426982d1aa",
+        "lib/pricing.js": "94953075062e9b36cdbd6ea149662d013d97ee12359a9ff7459669beff99ab99",
+        "lib/render.js": "3eacb4f7bf62376873e6fe59e2fe55e72a97fda8ed6bff73b93791f568cceffd",
+        "lib/samples.js": "912b3d5bd543dffa5f870caf3c2b873f642fd55e3ebf3f97e1b31eeaaac77d3b",
+        "lib/shop.js": "36e1cea342e23f1a53b9fac63b993f860afc1bcb74b25bef9f7bf8eaf07d2d85",
+        "lib/summary.js": "a510386e28eb19d9617f488551d1057819ae9f76fc85c744f2e5dbce492607fe",
+        "plugin.js": "594c2174e36566f90ac1e9ff11cb76656ad111dc392dc8e9556d731b7dd0a41a",
+        "plugin.json": "d5a3aeebb422cde97ac30605e8706acfb39e69601e7e6ae5d626c3744d49093c",
+        "plugin.public.js": "176383dfa7af913c433e0397584c46a67a21ab3307b80a08f0aaf50da2634f9e",
+        "public/cart.js": "fcc706773a36e4bfd02ea235bcdad629137e996218e0a0e23892e33c689f2a6e",
+        "public/lib/money.js": "d22b2b6f80dde6f7887b69e24188c05ea93c02217aba639b5331aa3bd616f4fc",
+        "public/lib/orders.js": "09478e20d238adc8e387b3d9efcb13c441898fab18387ce6a1a8a92304ac4c5b",
+        "public/lib/products.js": "c698dcb509dfc09a135e4039ec085dda8a3606e7f9f9586ea0fcf068f9147438",
+        "public/samples/candle-2.svg": "aca5691b9168467caf6feb7622ab154ee92504be8b887ac6c818db22476e7bed",
+        "public/samples/candle.svg": "ef75e95a53ce13e88928004c6f1290c45a1094765e2ba741ae1fc55d404b881f",
+        "public/samples/mug-2.svg": "5f37d23e90b7e79e42d38009a56b3ea26adae03586830a0cd418565491bd4532",
+        "public/samples/mug.svg": "e29e268fae300b95e38021443aa6df57e6a4dcb14c4058e5ef7106eb9bc1be6c",
+        "public/samples/notebook-2.svg": "21fbeaaab182485b3b9dde4e3b9d83cf3f9cadd5825225632cda14f0453c9538",
+        "public/samples/notebook.svg": "ff659345f465324199858f992e779aa7e0c4308e3cc39f15f7d5a0d4618b21d0",
+        "public/samples/print-2.svg": "09385dc66f5902caa399c6a4cc11ae320a779cbd355b7965d573483af9ccb818",
+        "public/samples/print.svg": "47e0f0960231b81b2d03f205c9b86e03f7c22011a2f243cfa915d08a73de377d",
+        "public/samples/tee-2.svg": "aaec073d128b3ea90e58225dd34daca8cbc39aa0f3112d2bc65119284718b5e4",
+        "public/samples/tee.svg": "287a82d7fc00acb1543b3209927ae20dcbe3d4b2a2b3de03574ab0c463385f3c",
+        "public/samples/tote-2.svg": "9c7f41cc57866e71973e413a6c87f46be48f7488d3490ceea58e24559c334813",
+        "public/samples/tote.svg": "01de817a32c8d3d8ea47ff491049f439ca3e4d4fce943dbdc62a4187139e016c",
+        "public/shop.css": "277904382e491f0ecc76aad916126970b87e161ef06ac6deeff193358b4e4c31",
+        "templates/shop.html": "4649e57d23458833a157799dc80141824eb0f658d96734bd1859c68e0ba9a8b9",
+        "tests/api.test.js": "a806df62981574a98d435eefc98143b2b03071b5f58a4e7db3cab93850c0e8ae",
+        "tests/pure.test.js": "dbe35ed7e94cea2f96d42d5abe7d41173393180ff5764c0539799329aa61bfa0"
+      }
     }
   }
 }

package/plugins/mail-reader/plugin.js

@@ -25,8 +25,19 @@ export default async function mailReaderPlugin(fastify, options) {
     // rather than leave the mail server holding dead sessions.
     fastify.addHook('onClose', async () => pool.closeAll());
 
+    // The Email permission (1.2), shared with Email Pro: every route needs it.
+    // Granted to admin only - a mailbox here opens connections from this server.
+    // Give it to other roles under Roles. An older core keeps the old rule.
+    const {authenticate: signedIn, requirePermission} = options.auth;
+    const mayUse = typeof requirePermission === 'function' ? requirePermission('email', 'read') : async () => {};
+    async function authenticate(request, reply) {
+        const out = await signedIn(request, reply);
+        if (reply.sent) return out;
+        return mayUse(request, reply);
+    }
+
     registerReadRoutes(fastify, {
-        auth: options.auth,
+        auth: {...options.auth, authenticate},
         hooks: options.hooks,
         config,
         pool,

package/plugins/mail-reader/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "mail-reader",
   "displayName": "Mail Reader",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "tier": "free",
   "description": "Read-only IMAP mailbox reader. Connects to a standard IMAP server and reads mail without ever writing to it.",
   "author": "Darryl Waterhouse",
-  "date": "2026-09-25",
+  "date": "2026-09-26",
   "icon": "mail",
   "admin": {
     "sidebar": [
@@ -15,7 +15,8 @@
         "icon": "mail",
         "url": "#/plugins/mail-reader",
         "section": "#/plugins/mail-reader",
-        "countUrl": "/api/plugins/mail-reader/unread"
+        "countUrl": "/api/plugins/mail-reader/unread",
+        "permission": "email"
       }
     ],
     "routes": [
@@ -31,5 +32,23 @@
         "exportName": "mailView"
       }
     }
-  }
+  },
+  "permissions": [
+    {
+      "key": "email",
+      "label": "Email",
+      "group": "Plugins",
+      "description": "Your own mailboxes in the admin: read, and with Email Pro send, from this server.",
+      "actions": [
+        {
+          "key": "read",
+          "label": "Use",
+          "description": "Add your own mailboxes, read and (Email Pro) send mail - from this server's address"
+        }
+      ],
+      "grant": [
+        "admin"
+      ]
+    }
+  ]
 }

package/plugins/shopping-cart/CLAUDE.md

@@ -0,0 +1,93 @@
+# shopping-cart - AI Assistant Guide
+
+## Purpose
+
+Sell from a Domma CMS site. 1.0.0 (2026-09-26): products with options (size, colour) each with its own price,
+SKU and stock; a storefront at a configurable address (`/shop`) with category chips, search and sort; product
+pages with a gallery; a basket kept in the shopper's browser that follows them round the site (floating
+button + drawer on every page); one-page checkout; Stripe (hosted Checkout), PayPal (Orders v2) or payment
+offline; a receipt page that waits for the payment to be confirmed; orders in the admin with fulfil (tracking),
+refund (through the provider), cancel, packing slips; an Overview with takings and what needs doing; a sidebar
+badge for paid orders to fulfil; sample products with bundled pictures.
+
+`tier: free`. Shopping Cart Pro (plugins/shopping-cart-pro) is an ADD-ON that plugs into this one - it does not
+supersede it (see Extensions).
+
+## The one rule about money
+
+Every amount is an integer in MINOR units (pence) - products, orders, settings (`shippingFlat: 395` = £3.95).
+Only the edges convert: the admin's inputs (`kit.moneyIn/moneyOut`), display (`formatMoney`), PayPal's decimal
+string (`fromMinor`). The browser never sends a price: `POST /quote` and `POST /checkout` take product ids,
+option ids and quantities, and `lib/pricing.js` `priceBasket` is the ONE place a total is worked out. Checkout
+refuses (409, with the new quote) when the basket changed (sold out, fewer left, a code refused) until the
+shopper resubmits with `accept`, and when `expectTotal` differs from what it would charge.
+
+## Files
+
+- `plugin.json`, `config.js` (every setting, documented), `plugin.js` (API, shortcodes, payments' return routes)
+- `plugin.public.js` - storefront pages from ONE onRequest hook on the LIVE shop path (like the Blog), so
+  moving the shop needs no restart. `matchShopPath` is exported and tested.
+- `public/lib/money.js`, `products.js`, `orders.js` - PURE, shared by server, admin and storefront (public/ is
+  served; lib/ is not). Product cleaning, stock (`available`, `totalStock`), order statuses and moves (`NEXT`).
+- `lib/pricing.js` - the basket's price: lines (capped at stock), then stages discount -> shipping -> tax.
+- `lib/extensions.js` - the registry extensions register into (globalThis, Symbol.for('domma.shopping-cart')).
+- `lib/shop.js` - collections I/O, live settings (masking, cleaning), order numbers, `markPaid` / `moveOrder` /
+  refunds with stock, all order writes serialised by `withLock`. `shelfNow`/`settingsNow` for the shortcodes.
+- `lib/payments.js` - Stripe and PayPal over fetch (no SDK). `stripeVerify` checks webhook signatures.
+- `lib/render.js` - the storefront's HTML (server-rendered; everything escaped; descriptions via parseMarkdown).
+- `lib/summary.js` - Overview figures and the badge. `lib/samples.js` + `public/samples/*.svg` - sample products.
+- `public/cart.js`, `public/shop.css` - the browser half, injected on every page (`inject/body.html`).
+- `templates/shop.html` - the fragment every storefront page renders in (`renderBlogPage`).
+- `admin/views/shop.js` - the Tool: tab host (Overview, Orders, Products + extension tabs), banner cog/visit/+.
+  `overview.js`, `orders.js`, `products.js`, `settings.js` (the cog's slideover). `admin/lib/kit.js` - shared.
+- `tests/pure.test.js` (money, products, pricing, registry, payments, paths, settings, summary),
+  `tests/api.test.js` (a whole sale against the real collection service; restores the checkout).
+
+## Data
+
+Collections `shop-products` and `shop-orders` (made at every boot if missing; API access all off - orders hold
+shoppers' details). Settings: `config/plugins.json` `shopping-cart.settings`; the order counter is plugin state
+`shopping-cart.orderSeq` (never below the highest order number, starting 1001).
+
+Order statuses: pending (checkout started) -> awaiting (offline) -> paid -> fulfilled; cancelled; refunded.
+Stock is taken when an order becomes PAID (`stockTaken`), never at checkout, and can go back on a refund.
+A paid or refunded order cannot be deleted. Each order has a random `token`: the receipt URL is
+`<shop>/order/<id>?t=<token>`; without the token it is a 404.
+
+## Payments
+
+- Stripe: `POST /checkout` makes a Checkout Session (itemised; ONE "Order #n" line when there is a discount,
+  since Stripe discounts only through its coupons), success_url = the receipt + `session_id`. The receipt page
+  (and `GET /order/:id`) asks Stripe and marks the order paid when `stripeSessionPaid` agrees on order id,
+  amount and currency. The webhook (`/stripe/webhook`, raw body, `stripeWebhookSecret`) catches a closed tab.
+- PayPal: create order -> approve -> `GET /paypal/return` CAPTURES (ORDER_ALREADY_CAPTURED reads it instead)
+  and checks `paypalPaid`. Sandbox/live by setting.
+- Offline: the order is `awaiting`; the receipt shows `offlineInstructions`. Mark paid from the admin.
+- Refunds: `POST /orders/:id/refund` refunds through Stripe (payment_intent) or PayPal (capture id) FIRST,
+  and only then marks the order refunded. Full refunds only.
+- Secrets never leave the server: GET /settings masks them (`••••••••`); saving the mask keeps the value.
+
+## Extensions (Shopping Cart Pro)
+
+`cartRegistry().register(owner, {stages, on, tabs, checkout})` - see lib/extensions.js. A shipping handler may also
+return `choices: [{id, label, amount}]` - the quote carries them as `shippingChoices` (+ `shippingChoice`, the
+picked one's `ref`) and checkout offers them when there are two or more, sending `service` back. A stage handler that
+throws falls back to the built-in rule (and an internal note), so an extension cannot take checkout down.
+`emit()` never throws or waits. `registry.services` gives extensions the Cart's data functions. Extension tabs
+are dynamic-imported by shop.js from `/plugins/<owner>/...` only, and get the same ctx as the built-in tabs.
+An extension registers from `onReady`; a lapsed licence means it never registers and nothing else changes.
+
+## Shortcodes
+
+`[shop-products category= tag= featured=true limit=8 columns=3 /]`, `[shop-product slug= /]`,
+`[buy-button slug= label= /]`. Rendered from `shelfNow()` (products as last read - shortcodes are synchronous).
+A cached page can show a stale stock flag until it is re-rendered; checkout re-prices regardless.
+
+## Gotchas
+
+- Storefront CSS tokens are defined on `body`, not `:root`: themes set --dm-* on body's dm-theme-* class.
+- The site's own input/link styles reach the storefront: see the "reach in here" block at the end of shop.css.
+- `siteBase()` uses `request.host` (with the port); `request.hostname` drops it under Fastify 5.
+- A test site on a non-standard port needs `site.baseUrl` for Stripe/PayPal return addresses behind a proxy.
+- Admin views: item templates live in JS (a templateUrl goes through _.render); checkboxes are set after render
+  and listened to; slideovers via kit.openPanel (disposed and removed on close).