domma-cms 0.85.0 → 0.86.0

package/plugins/blog/tests/comment-notices.test.js

@@ -0,0 +1,140 @@
+/**
+ * blog: a comment held for approval raises a notice for the site's staff, and
+ * moderating or deleting it resolves that notice. The plugin runs in Fastify
+ * against the domma-cms checkout's collections; the blog collections'
+ * data files and config/plugins.json are put back byte for byte.
+ */
+import {test, before, after} from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import Fastify from 'fastify';
+import plugin from '../plugin.js';
+import {commentKey} from '../lib/notices.js';
+
+const SLUGS = {posts: 'blog-posts', comments: 'blog-comments', categories: 'blog-categories'};
+// The checkout's content/ carries an old demo blog-comments schema (post_slug, author_name...), not the
+// plugin's: the plugin's own schemas stand in for the run, and every file goes back as it was.
+const KEEP = ['config/plugins.json', ...Object.values(SLUGS).flatMap(c => [`content/collections/${c}/data.json`, `content/collections/${c}/schema.json`])]
+    .map(f => path.resolve(f));
+const HERE = path.dirname(new URL(import.meta.url).pathname);
+const saved = new Map();
+// Registering the plugin seeds its layout blocks into content/blocks: whatever it adds goes again.
+const BLOCKS = path.resolve('content/blocks');
+let blocksBefore = new Set();
+const MIGRATIONS = path.resolve('content/.migrations.json');
+let hadMigrations = true;
+const notes = [];
+const resolved = [];
+const sources = [];
+// Who holds what - as a site that shipped this release would have it.
+const WRITE = ['super-admin', 'admin', 'blog-editor', 'blog-author'];
+const EDIT = ['super-admin', 'admin', 'blog-editor'];
+const HOLDERS = {
+    'blog-posts.read': WRITE, 'blog-posts.create': WRITE, 'blog-posts.update': WRITE, 'blog-categories.read': WRITE,
+    'blog-posts.delete': EDIT, 'blog-posts.publish': EDIT, 'blog-categories.create': EDIT, 'blog-categories.update': EDIT,
+    'blog-categories.delete': EDIT, 'blog-comments.read': EDIT, 'blog-comments.update': EDIT, 'blog-comments.delete': EDIT
+};
+let app;
+
+before(async () => {
+    for (const f of KEEP) saved.set(f, await fs.readFile(f, 'utf8').catch(() => null));
+    blocksBefore = new Set(await fs.readdir(BLOCKS).catch(() => []));
+    const {invalidate} = await import('../../../server/services/adapterRegistry.js').catch(() => ({}));
+    for (const [dir, slug] of Object.entries(SLUGS)) {
+        const target = path.resolve('content/collections', slug);
+        await fs.mkdir(target, {recursive: true});
+        await fs.copyFile(path.join(HERE, '..', 'collections', dir, 'schema.json'), path.join(target, 'schema.json'));
+        await fs.writeFile(path.join(target, 'data.json'), '[]\n');
+        invalidate?.(slug);
+    }
+    hadMigrations = await fs.access(MIGRATIONS).then(() => true, () => false);
+    app = Fastify();
+    const pass = async () => {};
+    await app.register(plugin, {prefix: '/b', settings: {},
+        // Who is asking: the x-as header (a role), super-admin by default.
+        getPermissionsFor: (key) => HOLDERS[key] || ['super-admin'],
+        auth: {authenticate: async (req) => { const r = req.headers['x-as'] || 'super-admin'; req.user = {id: `u-${r}`, role: r, name: r,
+            ...(req.headers['x-also'] ? {additionalRoles: [req.headers['x-also']]} : {})}; }, requireAdmin: pass,
+            requirePermission: () => pass, requireRole: () => pass, requireVisibility: () => pass},
+        hooks: {notify: (p) => { notes.push(p); }, resolveNotification: (k, s) => { resolved.push(`${s}|${k}`); },
+            registerNotificationSource: (d) => { sources.push(d.id); }}});
+    await app.ready();
+});
+
+after(async () => {
+    await app?.close();
+    for (const name of await fs.readdir(BLOCKS).catch(() => [])) {
+        if (!blocksBefore.has(name)) await fs.rm(path.join(BLOCKS, name), {force: true});
+    }
+    if (!hadMigrations) await fs.rm(MIGRATIONS, {force: true});
+    for (const [f, text] of saved) {
+        if (text === null) await fs.rm(f, {force: true});
+        else await fs.writeFile(f, text);
+    }
+});
+
+const call = async (method, url, body, as, also) => {
+    const headers = {...(as ? {'x-as': as} : {}), ...(also ? {'x-also': also} : {})};
+    const res = await app.inject({method, url: `/b${url}`, payload: body, headers});
+    return {status: res.statusCode, body: res.json()};
+};
+
+test('a held comment notifies; approving it, or deleting one, resolves it', async () => {
+    assert.ok(sources.includes('comments'));
+    assert.equal((await call('PUT', '/settings', {commentsEnabled: true, commentModeration: true})).status, 200, 'comments on, held for approval');
+    const post = (await call('POST', '/posts', {title: 'Spring opening hours', slug: `zz-notice-${Date.now()}`, status: 'published',
+        content: 'Open late.', body: 'Open late.'})).body;
+    assert.ok(post.id, JSON.stringify(post));
+    await call('POST', `/posts/${post.id}/publish`).catch(() => {});
+
+    const say = (text) => call('POST', '/comments', {postId: post.id, authorName: 'Jo', authorEmail: 'jo@example.test', body: text});
+    const first = await say('<b>Great</b> news');
+    assert.equal(first.status, 201, JSON.stringify(first.body));
+    const n = notes.find(x => x.dedupeKey === commentKey(first.body.id));
+    assert.equal(n.title, 'New comment on "Spring opening hours"');
+    assert.match(n.body, /^Jo: <b>Great<\/b> news/, 'kept as text - the screen escapes it');
+    assert.equal(n.source, 'comments');
+    assert.equal(n.link, '#/plugins/blog/comments');
+
+    await call('PUT', `/comments/${first.body.id}`, {status: 'approved'});
+    assert.ok(resolved.includes(`comments|${commentKey(first.body.id)}`));
+
+    const second = await say('Spam?');
+    resolved.length = 0;
+    await call('PUT', `/comments/${second.body.id}`, {status: 'pending'});
+    assert.equal(resolved.length, 0, 'still waiting: nothing to resolve');
+    await call('DELETE', `/comments/${second.body.id}`);
+    assert.ok(resolved.includes(`comments|${commentKey(second.body.id)}`));
+
+    // The honeypot makes nothing, and says nothing.
+    notes.length = 0;
+    await call('POST', '/comments', {postId: post.id, authorName: 'Bot', authorEmail: 'b@x.test', body: 'buy', website: 'http://spam'});
+    assert.equal(notes.length, 0);
+});
+
+test('by permission: a plain account gets nothing; an author only their own; an editor held as an additional role moderates', async () => {
+    const draft = (await call('POST', '/posts', {title: 'Staff draft', slug: `zz-perm-${Date.now()}`})).body;
+    const say = (await call('POST', '/comments', {postId: draft.id, authorName: 'Jo', authorEmail: 'jo@example.test', body: 'x'}));
+    // A plain signed-in account: no drafts, no commenters, no writing, no moderating.
+    for (const [m, u, b] of [['GET', '/posts'], ['GET', `/posts/${draft.id}`], ['POST', '/posts', {title: 'x'}], ['GET', '/comments'],
+        ['GET', '/comments/pending-count'], ['GET', '/settings'], ['GET', '/categories']]) {
+        assert.equal((await call(m, u, b, 'user')).status, 403, `${m} ${u}`);
+    }
+    if (say.body?.id) {
+        assert.equal((await call('PUT', `/comments/${say.body.id}`, {status: 'approved'}, 'user')).status, 403);
+        assert.equal((await call('DELETE', `/comments/${say.body.id}`, null, 'user')).status, 403);
+    }
+    // An author: writes, sees only their own, cannot publish, delete or read comments.
+    const mine = (await call('POST', '/posts', {title: 'Mine', slug: `zz-mine-${Date.now()}`}, 'blog-author')).body;
+    assert.ok(mine.id);
+    const listed = (await call('GET', '/posts', null, 'blog-author')).body.map(p => p.id);
+    assert.ok(listed.includes(mine.id) && !listed.includes(draft.id), 'own posts only');
+    assert.equal((await call('GET', `/posts/${draft.id}`, null, 'blog-author')).status, 404, "someone else's draft is not there");
+    assert.equal((await call('POST', `/posts/${mine.id}/publish`, null, 'blog-author')).status, 403);
+    assert.equal((await call('DELETE', `/posts/${mine.id}`, null, 'blog-author')).status, 403);
+    assert.equal((await call('GET', '/comments', null, 'blog-author')).status, 403);
+    // An editor held as an ADDITIONAL role: role names are not what counts.
+    assert.equal((await call('GET', '/comments', null, 'user', 'blog-editor')).status, 200);
+    if (say.body?.id) assert.equal((await call('PUT', `/comments/${say.body.id}`, {status: 'approved'}, 'user', 'blog-editor')).status, 200);
+});

package/plugins/blog/tests/notices.test.js

@@ -0,0 +1,20 @@
+/** The moderation notice (blog/lib/notices.js). */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {commentKey, commentNotice} from '../lib/notices.js';
+
+test('a held comment makes a notice; an approved one does not', () => {
+    const n = commentNotice({id: 'c1', status: 'pending', authorName: 'Sam', body: 'Lovely  post,\nthanks'}, 'Spring hours', '#/plugins/blog/comments');
+    assert.deepEqual(n, {title: 'New comment on "Spring hours"', body: 'Sam: Lovely post, thanks\n\nWaiting for approval.',
+        severity: 'info', link: '#/plugins/blog/comments', source: 'comments', dedupeKey: commentKey('c1')});
+    assert.equal(commentNotice({id: 'c2', status: 'approved', body: 'x'}, 'P', '#/x'), null);
+    assert.equal(commentNotice(null, 'P', '#/x'), null);
+});
+
+test('a long comment is one line, cut short; a missing name is "Someone"', () => {
+    const n = commentNotice({id: 'c3', status: 'pending', body: 'word '.repeat(200)}, 'T'.repeat(100), '#/x');
+    assert.ok(n.title.length <= 100);
+    assert.ok(n.body.startsWith('Someone: word word'));
+    assert.ok(n.body.split('\n')[0].length <= 212);
+    assert.ok(n.body.includes('…'));
+});

package/plugins/blog/tests/public.test.js

@@ -16,7 +16,7 @@ import zlib from 'zlib';
 import Fastify from 'fastify';
 import compress from '@fastify/compress';
 import blogPublicPlugin from '../plugin.public.js';
-import {postFields} from '../plugin.js';
+import {postFields, usePermissionLookup} from '../plugin.js';
 
 async function buildPublic() {
     const app = Fastify();
@@ -54,6 +54,8 @@ test('a display can be asked for, and an unknown one falls back', async () => {
 });
 
 test('an author cannot publish by writing the status - that is what the publish route is for', () => {
+    // Who may publish is a permission: editors and admins hold blog-posts.publish.
+    usePermissionLookup((k) => (k === 'blog-posts.publish' ? ['super-admin', 'admin', 'blog-editor'] : []));
     const author = {id: 'a', role: 'blog-author'};
     const editor = {id: 'e', role: 'blog-editor'};
     assert.equal(postFields({status: 'published'}, author).status, undefined);

package/plugins/free-tier.lock.json

@@ -1,11 +1,11 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@9bdfedf",
+  "source": "dcms-marketplace@0335bfa",
   "plugins": {
     "blog": {
-      "version": "1.6.3",
+      "version": "1.8.0",
       "files": {
-        "CLAUDE.md": "63b11d562db0e0003b929320f55f2a6dedf6ba98a20ed6f5c768fa3177286de9",
+        "CLAUDE.md": "026438d4d93f5a637be16ac22d5131e8248e93d2df1bd9b30d5f1cfe357ba2cc",
         "admin/css/index.css": "6142a6b756e1218157842528830b1e84f592f0b84b7d5ce6449db421b6f4b039",
         "admin/templates/blog.html": "a6054c1febe764bb1edf5c9e466d44a9080d9c83ba5486437b7a8244acf5ba54",
         "admin/templates/categories.html": "ab7d6fc2fedd48876c585bc216a1532b3bdd78c946dee976c1171bfe4664feb6",
@@ -41,13 +41,15 @@
         "collections/comments/schema.json": "29cbd289cbfcfc4158c9357a218db4ce06eddc3370bfbf9afb7d7f52065a849e",
         "collections/posts/schema.json": "19a5a770d3eefea73f4117454bd1312a7a7e3d727cfcdfde141139fbc81cabd7",
         "config.js": "ee67396262762f5c31269d258affd75f7392a3e364f72f7792c2f1cdafd94bba",
+        "lib/access.js": "af47440c7233a56000641a3231d7e9ff81b12f40dfb9528aa6dd4e2dd9bca8df",
         "lib/layouts.js": "bbb61ac7ec2e0cecd3d59700e9f3bd1064cd53b2e9f639d28b45ffc2ad80ab27",
         "lib/nav-link.js": "6a8f9368bb8aee1c21e90fb335a691859cb9a9bc250c2b9167a33ca9189fa2ff",
+        "lib/notices.js": "a9a2918ee6f5f7e0bbaeced0d3539584279bdbe68d15472a8615bdddb4ef905b",
         "lib/page.js": "464face32871185368de096ed9a6aa635523bf319af6459308cfceb77d66f82c",
         "lib/render.js": "0e97c6a950bc962c8d8ea4b2f21d06cb73fbcdc738d8942d6935d01309a29b1d",
         "lib/samples.js": "e8cdb77ce22e43937707f6854d3a5cb722437dc584e22ac7b24480bef686cf85",
-        "plugin.js": "ccfd8735838bb6c8c5d45c3c3589d6adcf114a89b560f66e93a1077e9bea3bfb",
-        "plugin.json": "5654242b0fd5d4f6039a87dc429bd69a24355a59c3409be10998410fbe6d019b",
+        "plugin.js": "db93fd831f6ff6762c6768d47e658830b6284b6f4a9efd2bbffaab5966ba0361",
+        "plugin.json": "d6a254e9ec114cbc469e8e2b5a9ca33376c3f88e49c54d42ea589ac883e3dac3",
         "plugin.public.js": "8efc1ff3a2ead68d36fbd545f8ce590f600b293896ba6f4947418b1efcdf2947",
         "public/blog.css": "fd733e6b624190da1e70dc1b6613e2376efd7f7570a28fab311d81006d03d960",
         "public/blog.js": "d01c72a9834dcc7c5241923371f2b164ac30d20ac9f1a5c5dc5b71fa3cb09f08",
@@ -57,23 +59,26 @@
         "public/samples/harbour.svg": "a5f09eafa1406da3c2d017e9bee308a98543df15090ed27227cbbf8341aec460",
         "public/samples/meadow.svg": "90efae21e209b7d48901eed457f47d0a347c58a6b6e1ea81ba98c131c4c559cb",
         "public/samples/rosewood.svg": "0f963fe5633585786271255b7c9df36be67748ae751f9cf7b0bbda6f5b93449d",
-        "roles/blog-author.json": "ccdd4d99296c157ddc839af22ef6e79c47c381dd9d937069f7090a4fb76bb41d",
+        "roles/blog-author.json": "2784a98dd31667bd3aefdf3f8ad3895e6fb200e26a9f1bb7c873f9e9993d4a2b",
         "roles/blog-editor.json": "bea0b673cf9e3da04c5882d51dd33bdcaf035b047c1cfe87624a9f16e6514ffc",
         "templates/index.html": "3c2cf8a4ffde8599d451f6d00b736aeba42fd073b726ada3b0ffe4d56e1ef0f4",
         "templates/post.html": "28e9f06071115ecc4fbba007b35782732bf12ef72528525893d424e3c4f0313f",
+        "tests/access.test.js": "65b760910117c3a44195543acdcff91074f39b4e5567911a2bd8676204152cb2",
+        "tests/comment-notices.test.js": "34026cc9a2a4746cf87bc41df8be849fadaa43091a72ac2aa1d06c1f437bf618",
         "tests/layouts.test.js": "5325aad79a153f1d17f49b27223f50be182a2acce8ee8be7da658ae92ae36fe8",
         "tests/nav-link.test.js": "d36e33ad7483abca27ae6e2098ad2f75bafa18d91f3beba70372ebe6b9b88994",
-        "tests/public.test.js": "0049a6be16c6a8acb44d53ea885909c80563a0afaa3e1e89d3c54d5429feed98"
+        "tests/notices.test.js": "2b02aa84e780dc4c82e6c503fc8fe17c64a63bee0709627866ef97c99cb4e131",
+        "tests/public.test.js": "a6fcdc4ede242aa050ffe5a52f970d6bec1f4a70ae78967eb8a7bdeec73df19d"
       }
     },
     "mail-reader": {
-      "version": "1.1.0",
+      "version": "1.2.0",
       "files": {
         "CLAUDE.md": "7f317e69b560457f2d4c401b466754850afe75f6983bc41414c71d8c276c3583",
         "admin/views/mail.js": "c5c6483f9618c75cac8f4be32d3aea99511db76d4b9d38b8ef43bdc1d35db3c5",
         "config.js": "6e65803ad822a9acda40c203631b8eb32a87cf9d9e5f1c7cb59d01aa406075c6",
-        "plugin.js": "ebe4c41bdd8836fb3128af3a0e789d47f89b00e9e37dc9378bb308aaae8d41b2",
-        "plugin.json": "ed1f02d9405f6ae1257313ea4155ea49e307fb2210650fd247b92e6988aa78d1"
+        "plugin.js": "7f602a60c4eca7d3637659d03d5de9e242584666846b16c9e5a1b758e4856c9f",
+        "plugin.json": "60111616d915be07c8bb53a54b8aeae906e167d157e54295bb440546128acd55"
       }
     },
     "security": {

package/plugins/mail-reader/plugin.js

@@ -25,8 +25,19 @@ export default async function mailReaderPlugin(fastify, options) {
     // rather than leave the mail server holding dead sessions.
     fastify.addHook('onClose', async () => pool.closeAll());
 
+    // The Email permission (1.2), shared with Email Pro: every route needs it.
+    // Granted to admin only - a mailbox here opens connections from this server.
+    // Give it to other roles under Roles. An older core keeps the old rule.
+    const {authenticate: signedIn, requirePermission} = options.auth;
+    const mayUse = typeof requirePermission === 'function' ? requirePermission('email', 'read') : async () => {};
+    async function authenticate(request, reply) {
+        const out = await signedIn(request, reply);
+        if (reply.sent) return out;
+        return mayUse(request, reply);
+    }
+
     registerReadRoutes(fastify, {
-        auth: options.auth,
+        auth: {...options.auth, authenticate},
         hooks: options.hooks,
         config,
         pool,

package/plugins/mail-reader/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "mail-reader",
   "displayName": "Mail Reader",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "tier": "free",
   "description": "Read-only IMAP mailbox reader. Connects to a standard IMAP server and reads mail without ever writing to it.",
   "author": "Darryl Waterhouse",
-  "date": "2026-09-25",
+  "date": "2026-09-26",
   "icon": "mail",
   "admin": {
     "sidebar": [
@@ -15,7 +15,8 @@
         "icon": "mail",
         "url": "#/plugins/mail-reader",
         "section": "#/plugins/mail-reader",
-        "countUrl": "/api/plugins/mail-reader/unread"
+        "countUrl": "/api/plugins/mail-reader/unread",
+        "permission": "email"
       }
     ],
     "routes": [
@@ -31,5 +32,23 @@
         "exportName": "mailView"
       }
     }
-  }
+  },
+  "permissions": [
+    {
+      "key": "email",
+      "label": "Email",
+      "group": "Plugins",
+      "description": "Your own mailboxes in the admin: read, and with Email Pro send, from this server.",
+      "actions": [
+        {
+          "key": "read",
+          "label": "Use",
+          "description": "Add your own mailboxes, read and (Email Pro) send mail - from this server's address"
+        }
+      ],
+      "grant": [
+        "admin"
+      ]
+    }
+  ]
 }

package/server/routes/api/notifications.js

@@ -116,9 +116,10 @@ export function notificationsBadge(active = []) {
  *
  * @param {Date} now
  * @param {string} origin - the site's own address, for the one sample with a link
+ * @param {string|null} [forUser] - the id of whoever asked: only they see them
  * @returns {object[]} entries, `{id, data, meta}`
  */
-export function sampleNotifications(now = new Date(), origin = '') {
+export function sampleNotifications(now = new Date(), origin = '', forUser = null) {
     const expiresAt = new Date(now.getTime() + 7 * 86_400_000).toISOString();
     const note = `\n\n(A sample - it goes by itself on ${expiresAt.slice(0, 10)}.)`;
     const samples = [
@@ -138,7 +139,7 @@ export function sampleNotifications(now = new Date(), origin = '') {
         return {
             id: randomUUID(),
             data: {title: x.title, body: x.body + note, severity: x.severity, source: 'sample', link: x.link || null,
-                createdAt: at, expiresAt, readBy: [], dismissedBy: []},
+                createdAt: at, expiresAt, readBy: [], dismissedBy: [], audience: forUser ? {userIds: [String(forUser)]} : null},
             meta: {createdAt: at, updatedAt: at, source: 'sample'}
         };
     });
@@ -354,7 +355,7 @@ export async function notificationsRoutes(fastify, opts = {}) {
     fastify.post('/system/notifications/samples', canDelete, async (request, reply) => {
         const adapter = await getAdapter(SLUG);
         const origin = `${request.protocol}://${request.host || request.hostname}`;
-        const made = sampleNotifications(new Date(), origin);
+        const made = sampleNotifications(new Date(), origin, request.user?.id);
         // A second click replaces the samples rather than stacking another set.
         for (const e of await adapter.all(SLUG)) if (e?.data?.source === 'sample') await adapter.remove(SLUG, e.id);
         for (const entry of made) await adapter.insert(SLUG, entry);

package/server/services/notify.js

@@ -64,13 +64,15 @@ export function cleanLink(link) {
 
 /**
  * May this user see a notification with this audience. None (manager pushes,
- * everything before 0.80) is everyone who can read notifications, as before.
+ * everything before 0.80) is admins and up: roles a plugin gives the bell to
+ * (Job Board's company, agent and candidate - people from outside, who may have
+ * signed themselves up) must never see what was meant for the site's staff.
  *
  * @param {object|null|undefined} audience - {roles: string[]} | {userIds: string[]}
  * @param {object} user - request.user: {id, role, additionalRoles}
  */
 export function inAudience(audience, user) {
-    if (!audience || typeof audience !== 'object') return true;
+    if (!audience || typeof audience !== 'object') audience = AUDIENCES.admins;
     if (Array.isArray(audience.userIds)) return audience.userIds.includes(user?.id);
     if (Array.isArray(audience.roles)) {
         const held = getEffectiveRoles(user || {});

package/server/services/pluginScope.js

@@ -0,0 +1,85 @@
+/**
+ * Plugin APIs and the admin scope.
+ *
+ * A role can confine its holders to a few admin screens (`role.admin =
+ * {home, allow}` - Job Board's company, agent and candidate roles, say, which
+ * people outside the business can sign themselves up for). The admin's router
+ * keeps them on those screens (admin/js/lib/admin-scope.js), but that is the
+ * browser: every plugin's API was open to ANY signed-in user whose route only
+ * asked `authenticate`, and most plugins' write routes asked nothing more. So
+ * a job seeker could publish, edit or delete blog posts through the API.
+ *
+ * The rule here: a user whose roles confine them may call a plugin's
+ * authenticated routes only if their scope admits at least one of that
+ * plugin's admin screens. An unconfined user (every staff role, the level-0
+ * role) is untouched, and so is every route that does not authenticate (the
+ * public side). Core's own APIs are guarded by permissions, as before.
+ *
+ * Pure except for the role lookup, which is passed in.
+ *
+ * @module services/pluginScope
+ */
+
+/** Does an allowed prefix cover a path? The admin's own rule (admin-scope.js). */
+export function covers(allowed, path) {
+    if (allowed === '/') return path === '/';
+    return path === allowed || path.startsWith(`${allowed}/`);
+}
+
+/**
+ * The admin screens a plugin owns: its routes, and where its sidebar entries
+ * point (`#/plugins/blog` -> `/plugins/blog`).
+ *
+ * @param {object} manifest - plugin.json
+ * @returns {string[]}
+ */
+export function pluginAdminPaths(manifest) {
+    const admin = manifest?.admin || {};
+    const paths = [];
+    for (const r of Array.isArray(admin.routes) ? admin.routes : []) if (typeof r?.path === 'string') paths.push(r.path);
+    const walk = (items) => {
+        for (const it of Array.isArray(items) ? items : []) {
+            for (const u of [it?.url, it?.section]) if (typeof u === 'string' && u.startsWith('#/')) paths.push(u.slice(1));
+            walk(it?.children);
+        }
+    };
+    walk(admin.sidebar);
+    return [...new Set(paths.map(p => p.split('?')[0].replace(/\/:[^/]+/g, '').replace(/\/+$/, '') || '/'))];
+}
+
+/**
+ * May a user with this admin scope call this plugin's authenticated API?
+ *
+ * @param {{home: string, allow: string[]}|null} scope - null = the whole admin
+ * @param {object} manifest
+ * @returns {boolean}
+ */
+export function pluginInScope(scope, manifest) {
+    if (!scope) return true;
+    const allow = Array.isArray(scope.allow) ? scope.allow : [];
+    return pluginAdminPaths(manifest).some(p => allow.some(a => covers(a, p)));
+}
+
+/**
+ * The `authenticate` a plugin is handed: core's, then the scope rule.
+ *
+ * @param {Function} authenticate - core's preHandler
+ * @param {object} manifest
+ * @param {(user: object) => ({home: string, allow: string[]}|null)} scopeOf - the user's admin scope
+ * @returns {Function} a preHandler
+ */
+export function authenticateFor(authenticate, manifest, scopeOf) {
+    return async function authenticateInScope(request, reply) {
+        const out = await authenticate(request, reply);
+        if (reply.sent) return out;
+        let scope = null;
+        try { scope = scopeOf(request.user); } catch { scope = null; }
+        if (!pluginInScope(scope, manifest)) {
+            return reply.code(403).send({
+                statusCode: 403, error: 'Forbidden',
+                message: `Your account cannot use ${manifest?.displayName || manifest?.name || 'this plugin'}.`
+            });
+        }
+        return out;
+    };
+}

package/server/services/plugins.js

@@ -33,7 +33,9 @@ import {classifyEntitlement, mayLoad} from './pluginEntitlement.js';
 import {notifierFor} from './notify.js';
 import {createCollection, getCollection} from './collections.js';
 import * as defaultRolesService from './roles.js';
-import {normaliseAdminScope} from './roles.js';
+import {getAdminScope, normaliseAdminScope} from './roles.js';
+import {authenticateFor} from './pluginScope.js';
+import {getEffectiveRoles} from './userRoles.js';
 import * as defaultUsersService from './users.js';
 import {registerLoginCheck, registerPasswordCheck} from './authChecks.js';
 
@@ -473,7 +475,10 @@ export async function registerPlugins(fastify) {
           const prefix = `/api/plugins/${manifest.name}`;
           await fastify.register(plugin, {
             prefix,
-            auth: {authenticate, requireRole, requireAdmin, requireVisibility, requirePermission},
+            // A user confined to some admin screens (role.admin) may call this plugin's
+            // authenticated routes only if one of its screens is among them - see pluginScope.js.
+            auth: {authenticate: authenticateFor(authenticate, manifest, (user) => getAdminScope(getEffectiveRoles(user || {}))),
+                requireRole, requireAdmin, requireVisibility, requirePermission},
               hooks: {registerShortcode, registerSanitizeRules, registerTransform, registerMenuLocation,
                   // Stamped with the plugin's name, so the Menus editor can say where a Tool came from.
                   registerSidebarItem: (opts) => registerSidebarItem({...opts, item: {source: manifest.displayName || manifest.name, ...opts?.item}}),