domma-cms 0.87.0 → 0.88.0

package/server/routes/api/settings.js

@@ -5,6 +5,7 @@
  * POST /api/settings/test-email - send a test email using stored SMTP config
  * GET  /api/settings/_count     - the sidebar badge: what is wrong with the settings
  */
+import {normaliseOrigin} from '../../services/passwordReset.js';
 import {getConfig, saveConfig} from '../../config.js';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
 import {createTransport} from '../../services/email.js';
@@ -89,6 +90,8 @@ export async function settingsRoutes(fastify) {
             'adminBrand',
             // The screen `#/` (Dashboard) opens - see services/adminHome.js.
             'adminHome',
+            // The site's own address - canonical URLs, the sitemap and password reset links.
+            'baseUrl',
             // Keys that legitimately live in site.json (written elsewhere - e.g.
             // `brand` by the menus migration) and are echoed back by GET /settings.
             // They must be accepted here or any client that round-trips the GET
@@ -99,6 +102,15 @@ export async function settingsRoutes(fastify) {
         if (unknownKeys.length > 0) {
             return reply.status(400).send({ error: `Unknown settings keys: ${unknownKeys.join(', ')}` });
         }
+        if ('baseUrl' in data) {
+            // An origin only (https://example.com): a reset link is built on it, so nothing else may pass.
+            const raw = data.baseUrl == null ? '' : String(data.baseUrl).trim();
+            const origin = raw ? normaliseOrigin(raw) : '';
+            if (raw && !origin) {
+                return reply.status(400).send({error: 'Site URL must be an address like https://example.com - no path.'});
+            }
+            data.baseUrl = origin;
+        }
         if ('adminHome' in data) {
             // An admin route, or blank for the built-in dashboard.
             const home = data.adminHome == null || data.adminHome === '' ? '/' : normaliseAdminPath(data.adminHome);

package/server/routes/api/tools.js

@@ -0,0 +1,116 @@
+/**
+ * Built-in Tool switches - Contacts, Notes, Todo, Analytics (services/tools.js).
+ *
+ * GET  /api/tools          - each built-in Tool, on/off, locked, and the plugins that depend on it (plugins.read)
+ * GET  /api/tools/enabled  - {name: boolean}, for any signed-in user (plugin screens hide what needs a Tool that is off)
+ * PUT  /api/tools/:name    - {enabled, cascade?} (plugins.update). Answers 423 when the site's manager has
+ *                            locked it, and 409 with the plan when the switch moves other Tools too - repeat
+ *                            with `cascade: true` to apply. Restarts the site like a plugin switch does.
+ */
+import {
+    authenticate as defaultAuthenticate,
+    requirePermission as defaultRequirePermission
+} from '../../middleware/auth.js';
+import {discoverPlugins, getPluginStates, runLifecycleHook, savePluginState} from '../../services/plugins.js';
+import {CORE_TOOLS, getToolStates, isCoreTool, isToolEnabled, planSwitch, saveToolState, switchableUnits} from '../../services/tools.js';
+import {autoRestartEnabled, hasSupervisor, scheduleRestart} from './plugins.js';
+
+/**
+ * Write the other switches a plan moved: a plugin's enabled flag (with its
+ * lifecycle hook, as a direct switch gets) or a built-in Tool's.
+ *
+ * @param {{name: string, enabled: boolean}[]} cascaded
+ * @param {import('fastify').FastifyInstance} fastify
+ */
+export async function applyCascade(cascaded, fastify) {
+    for (const {name, enabled} of cascaded) {
+        if (isCoreTool(name)) {
+            saveToolState(name, {enabled});
+            continue;
+        }
+        savePluginState(name, {enabled});
+        await runLifecycleHook(name, enabled ? 'onEnable' : 'onDisable', fastify);
+    }
+}
+
+/**
+ * A built-in Tool's routes behind its switch: 404 while it is off, read per
+ * request so the API stops the moment the switch is saved. Register it with
+ * the Tool's prefix; the inner routes must NOT be given it again, or every
+ * route lands at /api/notes/api/notes/... (0.88.0 did exactly that on dcm).
+ *
+ * @param {string} name        the Tool (services/tools.js CORE_TOOLS)
+ * @param {Function} routes    its Fastify plugin
+ * @param {(name: string) => boolean} [isEnabled]
+ */
+export function toolGate(name, routes, isEnabled = isToolEnabled) {
+    const displayName = CORE_TOOLS.find(t => t.name === name)?.displayName || name;
+    return async (scope) => {
+        scope.addHook('onRequest', async (request, reply) => {
+            if (!isEnabled(name)) return reply.code(404).send({error: `${displayName} is switched off on this site.`});
+        });
+        await scope.register(routes);
+    };
+}
+
+export async function toolsRoutes(fastify, opts = {}) {
+    const authenticate = opts.authenticate || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+    const exit = opts.exit || (() => process.exit(0));
+
+    const canRead = {preHandler: [authenticate, requirePermission('plugins', 'read')]};
+    const canUpdate = {preHandler: [authenticate, requirePermission('plugins', 'update')]};
+
+    const unitsNow = async () => switchableUnits({
+        manifests: await discoverPlugins(), pluginStates: getPluginStates(), toolStates: getToolStates()
+    });
+
+    fastify.get('/tools', canRead, async () => {
+        const units = await unitsNow();
+        const plugins = [...units.values()].filter(u => u.kind === 'plugin');
+        return CORE_TOOLS.map(t => {
+            const u = units.get(t.name);
+            return {
+                ...t,
+                enabled: u.enabled,
+                locked: u.locked,
+                // Enabled plugins that stop, or lose something, if this goes off.
+                requiredBy: plugins.filter(p => p.enabled && p.requires.includes(t.name)).map(p => ({name: p.name, displayName: p.displayName})),
+                usedBy: plugins.filter(p => p.enabled && t.name in p.uses).map(p => ({name: p.name, displayName: p.displayName, reason: p.uses[t.name]}))
+            };
+        });
+    });
+
+    fastify.get('/tools/enabled', {preHandler: [authenticate]}, async () => {
+        const states = getToolStates();
+        return Object.fromEntries(CORE_TOOLS.map(t => [t.name, states[t.name]?.enabled !== false]));
+    });
+
+    fastify.put('/tools/:name', canUpdate, async (request, reply) => {
+        const {name} = request.params;
+        if (!isCoreTool(name)) return reply.status(404).send({error: 'No such built-in Tool'});
+        const {enabled, cascade} = request.body || {};
+        if (typeof enabled !== 'boolean') return reply.status(400).send({error: 'enabled must be true or false'});
+
+        const plan = planSwitch(await unitsNow(), {[name]: enabled});
+        if (!plan.ok) {
+            const r = plan.refused[0];
+            const who = CORE_TOOLS.find(t => t.name === r.name)?.displayName || r.name;
+            return reply.status(r.reason.includes('locked') ? 423 : 409).send({error: `${who} ${r.reason}.`, plan});
+        }
+        if (!Object.keys(plan.changes).length) return {success: true};
+        if ((plan.cascaded.length || plan.losses.length) && cascade !== true) {
+            return reply.status(409).send({error: 'This switch changes other Tools too.', needsConfirm: true, plan});
+        }
+
+        saveToolState(name, {enabled});
+        await applyCascade(plan.cascaded, fastify);
+
+        // Sidebar entries, notification and calendar sources are registered at
+        // boot, so the switch takes a restart - the same rule as a plugin's.
+        const supervised = hasSupervisor();
+        const restarting = supervised && autoRestartEnabled();
+        if (restarting) scheduleRestart(exit);
+        return {success: true, restartRequired: true, supervised, restarting, plan};
+    });
+}

package/server/routes/api/users.js

@@ -6,16 +6,20 @@
  * POST   /api/users      - create user (admin, manager - manager cannot create admin)
  * PUT    /api/users/:id  - update user (admin, manager - manager cannot edit admin)
  * DELETE /api/users/:id  - delete user (admin, manager - manager cannot delete admin, no self-delete)
+ * POST   /api/users/:id/password-reset - {via: 'email'|'link'} - email them a reset link, or return one to copy
+ * DELETE /api/users/:id/password-reset - withdraw an unused reset link
+ *   Both: users.update and a more senior role than theirs (canManageUser); never your own account.
  */
 import {authenticate, canManageUser, requirePermission} from '../../middleware/auth.js';
 import {getPermissionsFor} from '../../services/roles.js';
-import {createUser, deleteUser, getUserById, listUsers, updateUser} from '../../services/users.js';
+import {clearResetToken, createUser, deleteUser, getUserById, listUsers, updateUser} from '../../services/users.js';
 import {getProfile, listProfiles, updateProfile} from '../../services/userProfiles.js';
 import {ago, clip, plural} from '../../services/sidebarBadges.js';
 import * as notices from '../../services/notification-sources.js';
 import {checkPassword} from '../../services/authChecks.js';
 import {revokeUserSessions} from '../../services/sessions.js';
 import {hooks} from '../../services/hooks.js';
+import {adminOrigin, adminReset} from '../../services/passwordReset.js';
 
 /**
  * The sidebar badge on Users (its countUrl, GET /api/users/_count). The number
@@ -31,6 +35,7 @@ export function usersBadge(users = [], now = Date.now()) {
     const list = users || [];
     const inactive = list.filter(u => u.isActive === false);
     const never = list.filter(u => !u.lastLogin);
+    const resets = list.filter(u => u.resetLinkExpires && Date.parse(u.resetLinkExpires) > now);
     const week = list.filter(u => u.lastLogin && now - new Date(u.lastLogin).getTime() < 7 * 86_400_000);
     const recent = list.filter(u => u.lastLogin)
         .sort((a, b) => String(b.lastLogin).localeCompare(String(a.lastLogin)));
@@ -44,7 +49,8 @@ export function usersBadge(users = [], now = Date.now()) {
                 {label: 'Active', value: String(list.length - inactive.length)},
                 {label: 'Inactive', value: String(inactive.length)},
                 {label: 'Signed in this week', value: String(week.length)},
-                {label: 'Never signed in', value: String(never.length)}
+                {label: 'Never signed in', value: String(never.length)},
+                ...(resets.length ? [{label: 'Reset links open', value: String(resets.length)}] : [])
             ],
             items: recent.slice(0, 6).map(u => ({
                 text: clip(u.name || u.email || 'User'),
@@ -221,6 +227,47 @@ export async function usersRoutes(fastify) {
         return {...user, profile: profileEntry?.data || {}};
     });
 
+    // An administrator's password reset - email the user a link, or get one to pass on yourself
+    // (a site without email, a mailbox that is not receiving). Your own password is changed in My Profile.
+    const resetTarget = async (request, reply) => {
+        const {id} = request.params;
+        if (request.user.id === id) {
+            reply.code(403).send({error: 'Change your own password in My Profile.'});
+            return null;
+        }
+        const target = await getUserById(id);
+        if (!target) {
+            reply.status(404).send({error: 'User not found'});
+            return null;
+        }
+        if (!canManageUser(request.user, target)) {
+            reply.code(403).send({error: 'Your role is not senior to theirs.'});
+            return null;
+        }
+        return target;
+    };
+
+    fastify.post('/users/:id/password-reset', {preHandler: canUpdate, config: {rateLimit: {max: 20, timeWindow: '10 minutes'}}}, async (request, reply) => {
+        const via = request.body?.via === 'link' ? 'link' : 'email';
+        const target = await resetTarget(request, reply);
+        if (!target) return reply;
+        try {
+            const actor = await getUserById(request.user.id).catch(() => null);
+            return await adminReset({user: target, origin: await adminOrigin(request), via, by: actor || request.user});
+        } catch (err) {
+            if (err.code) return reply.status(409).send({error: err.message, code: err.code});
+            request.log.error(`[users] password reset for ${target.email} failed: ${err.message}`);
+            return reply.status(502).send({error: `The email could not be sent: ${err.message}`});
+        }
+    });
+
+    fastify.delete('/users/:id/password-reset', {preHandler: canUpdate}, async (request, reply) => {
+        const target = await resetTarget(request, reply);
+        if (!target) return reply;
+        await clearResetToken(target.id);
+        return {ok: true};
+    });
+
     // Delete user
     fastify.delete('/users/:id', {preHandler: canDelete}, async (request, reply) => {
         const { id } = request.params;

package/server/server.js

@@ -539,10 +539,16 @@ await app.register(dashboardRoutes, {prefix: '/api'});
 await app.register(cacheRoutes, {prefix: '/api'});
 await app.register(scaffoldRoutes, {prefix: '/api'});
 // Tools promoted out of plugins/ - their own prefixes, not /api/plugins/*.
-await app.register(notesRoutes, {prefix: '/api/notes'});
-await app.register(todoRoutes, {prefix: '/api/todo'});
-await app.register(analyticsRoutes, {prefix: '/api/analytics'});
-await app.register(contactsRoutes, {prefix: '/api/contacts'});
+// Each can be switched off (config/tools.json, services/tools.js): the gate is
+// read per request, so an API stops answering the moment the switch is saved,
+// before the restart that takes its sidebar entry and sources away.
+const {isToolEnabled} = await import('./services/tools.js');
+const {toolGate, toolsRoutes} = await import('./routes/api/tools.js');
+await app.register(toolGate('notes', notesRoutes), {prefix: '/api/notes'});
+await app.register(toolGate('todo', todoRoutes), {prefix: '/api/todo'});
+await app.register(toolGate('analytics', analyticsRoutes), {prefix: '/api/analytics'});
+await app.register(toolGate('contacts', contactsRoutes), {prefix: '/api/contacts'});
+await app.register(toolsRoutes, {prefix: '/api'});
 // What plugins show beside a contact or a note (Calendar's Events) - 0.79.
 await app.register(relatedRoutes, {prefix: '/api/related'});
 
@@ -565,10 +571,21 @@ await app.register(relatedRoutes, {prefix: '/api/related'});
 const {registerSidebarItem} = await import('./services/hooks.js');
 // `countUrl` is the badge: the sidebar fetches it and shows {count, label, tone}
 // (see fetchCounts in admin/js/lib/sidebar-renderer.js).
-registerSidebarItem({item: {source: 'Built in', text: 'Notes', url: '#/notes', icon: 'edit-3', permission: 'notes', countUrl: '/api/notes/count'}});
-registerSidebarItem({item: {source: 'Built in', text: 'Todo', url: '#/todo', icon: 'check-square', permission: 'todo', countUrl: '/api/todo/count'}});
-registerSidebarItem({item: {source: 'Built in', text: 'Analytics', url: '#/analytics', icon: 'chart-bar', permission: 'analytics', countUrl: '/api/analytics/active-count'}});
-registerSidebarItem({item: {source: 'Built in', text: 'Contacts', url: '#/contacts', icon: 'users', permission: 'contacts'}});
+// A built-in Tool switched off gets no entry (its switch restarts the site).
+const coreToolItems = [
+    {text: 'Notes', url: '#/notes', icon: 'edit-3', permission: 'notes', countUrl: '/api/notes/count'},
+    {text: 'Todo', url: '#/todo', icon: 'check-square', permission: 'todo', countUrl: '/api/todo/count'},
+    {text: 'Analytics', url: '#/analytics', icon: 'chart-bar', permission: 'analytics', countUrl: '/api/analytics/active-count'},
+    {text: 'Contacts', url: '#/contacts', icon: 'users', permission: 'contacts'}
+];
+for (const item of coreToolItems) {
+    if (isToolEnabled(item.permission)) registerSidebarItem({item: {source: 'Built in', ...item}});
+}
+// Todo's to-dos on the calendar (registered when routes/api/todo.js loads).
+if (!isToolEnabled('todo')) {
+    const {unregisterCalendarSource} = await import('./services/hooks.js');
+    unregisterCalendarSource('todo');
+}
 // Manage projects lives in the menu (the Projects folder, sidebar-migration.js);
 // registering it here only adds its badge - the renderer merges a registered
 // item into the menu node with the same url rather than adding a second one.
@@ -606,6 +623,8 @@ registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Search'
 // Core's notification sources, before plugins add theirs (0.80).
 const {registerCoreSources} = await import('./services/notification-sources.js');
 await registerCoreSources();
+// "Your password was changed" to the account holder, on every change (services/passwordReset.js).
+(await import('./services/passwordReset.js')).registerPasswordChangeNotice({log: app.log});
 
 await registerPlugins(app);
 

package/server/services/notification-sources.js

@@ -201,7 +201,9 @@ export async function registerCoreSources() {
         }
     });
 
-    registerNotificationSource({
+    // Todo switched off (config/tools.json): no morning notices either.
+    const {isToolEnabled} = await import('./tools.js');
+    if (isToolEnabled('todo')) registerNotificationSource({
         id: 'core:todo', label: 'To-dos overdue or due today', severity: 'warning', every: 'daily', atBoot: true,
         description: "Each morning: a person's overdue to-dos, and those due today - one notice each, to that person.",
         async check({notify: raise, resolve, now}) {
@@ -279,6 +281,8 @@ export async function registerCoreSources() {
             description: 'The site could not send an email, or has no mail server set up (mail goes nowhere). At most once a day.'},
         {id: 'core:logins', label: 'Repeated failed sign-ins', severity: 'warning',
             description: `${LOGIN_FAILURES.count} failed sign-ins to one account within 15 minutes, or the sign-in limit being hit.`},
+        {id: 'core:password-resets', label: 'Password reset not sent', severity: 'warning',
+            description: 'Someone asked for a password reset and no email could go: no mail server, or no known address for the site. At most once a day per account.'},
         {id: 'core:roles', label: 'Admin rights given', severity: 'warning',
             description: 'Someone was given the Admin or Super Admin role.'},
         {id: 'core:forms', label: 'Form actions failing', severity: 'warning',
@@ -340,6 +344,22 @@ export function loginRateLimited(ip) {
         body: `${ip || 'One address'} made more than 5 sign-in attempts in a minute and is being refused for now. Repeated, that is someone guessing passwords.`});
 }
 
+/**
+ * passwordReset.js: a reset was asked for and could not be emailed.
+ *
+ * @param {'no-smtp'|'no-origin'} reason
+ * @param {string} email - the account's address (only ever a real, active account)
+ */
+export function resetNotSent(reason, email) {
+    const why = reason === 'no-smtp'
+        ? 'No mail server is set up (Settings > Email), so the reset link could not be emailed.'
+        : 'The site does not know its own address yet, so it could not build a link it trusts. Set the Site URL in Settings › General, or sign in to the admin once at the usual address.';
+    return notify({source: 'core:password-resets', severity: 'warning', dedupeKey: `reset-not-sent:${String(email).toLowerCase()}:${day()}`,
+        link: reason === 'no-smtp' ? '#/settings' : '#/users',
+        title: `A password reset for ${email} was not sent`,
+        body: `${email} asked for a password reset. ${why}\n\nYou can set a new password for them in Users.`});
+}
+
 /** users route: someone was given admin rights. */
 export function adminRightsGiven(user, roles, by) {
     const which = roles.includes('super-admin') ? 'Super Admin' : 'Admin';