domma-cms 0.87.0 → 0.88.0

package/server/services/tools.js

@@ -0,0 +1,259 @@
+/**
+ * Switching Tools on and off - the built-in ones and plugins alike.
+ *
+ * ## Built-in Tools
+ *
+ * Contacts, Notes, Todo and Analytics were plugins until 0.67.0. They are part
+ * of the CMS now and ON unless a site says otherwise, in `config/tools.json`:
+ *
+ *     { "notes": { "enabled": false, "locked": true } }
+ *
+ * A Tool that is off keeps its data. Its API answers 404 (server.js gates the
+ * prefix at request time), its sidebar entry is not registered, and anything
+ * it feeds - notification sources, calendar sources, related items, the
+ * analytics beacon - is left out.
+ *
+ * ## Dependencies
+ *
+ * A plugin's manifest says what it needs:
+ *
+ *     "requires": ["contacts"]                     - cannot work without it
+ *     "uses": {"contacts": "Invite a contact group"} - loses that feature without it
+ *
+ * Either may name a built-in Tool or another plugin. `supersedes` is a
+ * different relationship (a replacement) and is not a dependency.
+ *
+ * `planSwitch()` is the one place that decides what a change does: which
+ * plugins go off with a Tool they require, which requirements come on with a
+ * plugin, what a soft dependant loses, and what is refused. It is pure so the
+ * Manager can run it against a site on disk before writing anything, and the
+ * site runs the same function when its own admin flips a switch. The loader
+ * (`unmetRequirements()`) is the backstop: a plugin whose requirement is off
+ * is not loaded, whatever plugins.json says.
+ *
+ * ## Locks
+ *
+ * `locked: true` - on a tools.json or a plugins.json entry - means the site's
+ * own admin cannot change that switch; only its Manager, which writes the
+ * files directly. A cascade that would move a locked switch is refused.
+ *
+ * @module services/tools
+ */
+import {getConfig, saveConfig} from '../config.js';
+
+/** The built-in Tools that can be switched off. Order is display order. */
+export const CORE_TOOLS = Object.freeze([
+    {name: 'contacts', displayName: 'Contacts', icon: 'users', description: 'An address book for each user, with groups.'},
+    {name: 'notes', displayName: 'Notes', icon: 'edit-3', description: 'Private notes for each user.'},
+    {name: 'todo', displayName: 'Todo', icon: 'check-square', description: 'To-do lists with due dates and reminders.'},
+    {name: 'analytics', displayName: 'Analytics', icon: 'chart-bar', description: 'Page views and visitors, counted on this server.'}
+]);
+
+const CORE_NAMES = new Set(CORE_TOOLS.map(t => t.name));
+
+/** @param {string} name  @returns {boolean} */
+export const isCoreTool = (name) => CORE_NAMES.has(name);
+
+/**
+ * Stored state of the built-in Tools. Missing file or entry = on, unlocked.
+ * Read fresh each call: the Manager writes this file from outside the process.
+ *
+ * @returns {Object.<string, {enabled?: boolean, locked?: boolean}>}
+ */
+export function getToolStates() {
+    try {
+        const raw = getConfig('tools');
+        return raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : {};
+    } catch {
+        return {};
+    }
+}
+
+/** @param {string} name  @returns {boolean} a built-in Tool is on unless tools.json says otherwise */
+export function isToolEnabled(name) {
+    return getToolStates()[name]?.enabled !== false;
+}
+
+/** @param {string} name  @returns {boolean} */
+export function isToolLocked(name) {
+    return getToolStates()[name]?.locked === true;
+}
+
+/**
+ * @param {string} name
+ * @param {{enabled?: boolean, locked?: boolean}} patch
+ */
+export function saveToolState(name, patch) {
+    if (!isCoreTool(name)) throw new Error(`"${name}" is not a built-in Tool`);
+    const states = getToolStates();
+    states[name] = {...states[name], ...patch};
+    saveConfig('tools', states);
+}
+
+/** `requires` from a manifest, as a clean list of names. */
+export function requiresOf(manifest) {
+    const r = manifest?.requires;
+    return Array.isArray(r) ? r.filter(n => typeof n === 'string' && n) : [];
+}
+
+/** `uses` from a manifest, as {name: reason}. An array form is accepted too. */
+export function usesOf(manifest) {
+    const u = manifest?.uses;
+    if (Array.isArray(u)) return Object.fromEntries(u.filter(n => typeof n === 'string').map(n => [n, '']));
+    if (!u || typeof u !== 'object') return {};
+    return Object.fromEntries(Object.entries(u).map(([k, v]) => [k, typeof v === 'string' ? v : '']));
+}
+
+/**
+ * Everything that can be switched, as one list the planner reads.
+ *
+ * @param {{manifests?: object[], pluginStates?: object, toolStates?: object}} input
+ * @returns {Map<string, {name: string, kind: 'tool'|'plugin', displayName: string, enabled: boolean,
+ *   locked: boolean, requires: string[], uses: Object.<string,string>, supersedes: string[], closedSource: boolean}>}
+ */
+export function switchableUnits({manifests = [], pluginStates = {}, toolStates = {}} = {}) {
+    const units = new Map();
+    for (const t of CORE_TOOLS) {
+        const s = toolStates[t.name] || {};
+        units.set(t.name, {name: t.name, kind: 'tool', displayName: t.displayName, icon: t.icon,
+            enabled: s.enabled !== false, locked: s.locked === true, requires: [], uses: {}, supersedes: [], closedSource: false});
+    }
+    for (const m of manifests) {
+        if (!m?.name || units.has(m.name)) continue;
+        const s = pluginStates[m.name] || {};
+        units.set(m.name, {name: m.name, kind: 'plugin', displayName: m.displayName || m.name, icon: m.icon || 'package',
+            enabled: s.enabled === true, locked: s.locked === true, requires: requiresOf(m), uses: usesOf(m),
+            supersedes: Array.isArray(m.supersedes) ? m.supersedes : [], closedSource: m.closedSource === true});
+    }
+    return units;
+}
+
+/** The name as people read it. */
+const label = (units, name) => units.get(name)?.displayName || name;
+
+/**
+ * What a set of switch changes would do.
+ *
+ * - Switching off something an enabled plugin REQUIRES switches that plugin
+ *   off too (a cascade), recursively.
+ * - Switching on a plugin switches on what it requires, recursively.
+ * - A soft dependant (`uses`) stays on and the feature it loses is listed.
+ * - A locked switch cannot be moved unless `asManager`; a request or cascade
+ *   that would move one is refused.
+ * - A requirement that is not installed at all refuses the plugin.
+ *
+ * Only dependencies touched by THIS change are followed: a plugin that was
+ * already enabled with a requirement off (a broken state the loader refuses
+ * to run) is left as it is.
+ *
+ * @param {Map} units            from switchableUnits()
+ * @param {Object.<string, boolean>} requested  name -> on/off
+ * @param {{asManager?: boolean}} [opts]
+ * @returns {{ok: boolean, changes: Object.<string, boolean>, cascaded: object[], losses: object[], refused: object[]}}
+ */
+export function planSwitch(units, requested = {}, {asManager = false} = {}) {
+    const next = new Map([...units].map(([n, u]) => [n, u.enabled]));
+    const was = (n) => units.get(n)?.enabled === true;
+    const may = (n) => asManager || !units.get(n)?.locked;
+    const refused = [];
+    const cascaded = [];
+    const cascadeOn = new Set();
+
+    for (const [name, on] of Object.entries(requested)) {
+        const u = units.get(name);
+        if (!u) { refused.push({name, reason: 'is not installed on this site'}); continue; }
+        if (!!on === u.enabled) continue;
+        if (!may(name)) { refused.push({name, reason: 'is locked by the site\'s manager'}); continue; }
+        next.set(name, !!on);
+    }
+    const askedOn = (n) => requested[n] === true || cascadeOn.has(n);
+
+    // Settle to a fixed point: each pass may switch something that changes
+    // what another needs. Bounded - each unit changes direction at most once.
+    for (let pass = 0, changed = true; changed && pass <= units.size + 1; pass++) {
+        changed = false;
+        for (const [name, u] of units) {
+            if (next.get(name) !== true) continue;
+            for (const r of u.requires) {
+                if (next.get(r) === true) continue;
+                const turningOn = !was(name);
+                // Only follow a dependency this change touches.
+                if (!turningOn && !was(r)) continue;
+                if (turningOn && askedOn(name)) {
+                    const ru = units.get(r);
+                    if (!ru) {
+                        refused.push({name, reason: `needs ${r}, which is not installed`});
+                    } else if (requested[r] === false) {
+                        refused.push({name, reason: `needs ${label(units, r)}, which is being switched off`});
+                    } else if (!may(r)) {
+                        refused.push({name, reason: `needs ${label(units, r)}, which is locked off`});
+                    } else {
+                        next.set(r, true);
+                        cascadeOn.add(r);
+                        cascaded.push({name: r, displayName: label(units, r), enabled: true, because: name, becauseName: label(units, name)});
+                        changed = true;
+                        continue;
+                    }
+                    next.set(name, false);
+                    changed = true;
+                    break;
+                }
+                // r is going off (or never came on): name has to follow it.
+                if (!may(name)) {
+                    refused.push({name: r, reason: `${label(units, name)} needs it and is locked on`});
+                    next.set(r, true);
+                } else {
+                    next.set(name, false);
+                    cascaded.push({name, displayName: label(units, name), enabled: false, because: r, becauseName: label(units, r)});
+                }
+                changed = true;
+                break;
+            }
+        }
+    }
+
+    // A cascade may have been undone by a later refusal; keep only real moves.
+    const changes = {};
+    for (const [n, on] of next) if (on !== was(n)) changes[n] = on;
+    const real = cascaded.filter(c => changes[c.name] === c.enabled);
+
+    const losses = [];
+    for (const [name, u] of units) {
+        if (next.get(name) !== true) continue;
+        for (const [t, reason] of Object.entries(u.uses)) {
+            if (was(t) && next.get(t) === false) {
+                losses.push({name, displayName: u.displayName, tool: t, toolName: label(units, t), reason});
+            }
+        }
+    }
+
+    return {ok: refused.length === 0, changes, cascaded: real, losses, refused};
+}
+
+/**
+ * Which enabled plugins cannot run because something they require is not
+ * running. `active` is the set that would load (after entitlement and
+ * supersession); built-in Tools are active when switched on.
+ *
+ * @param {object[]} manifests
+ * @param {Set<string>} active  plugin names that would otherwise load
+ * @param {(name: string) => boolean} toolOn
+ * @returns {Map<string, string>} plugin -> the requirement it is missing
+ */
+export function unmetRequirements(manifests, active, toolOn = isToolEnabled) {
+    const byName = new Map(manifests.map(m => [m.name, m]));
+    const running = new Set(active);
+    const blocked = new Map();
+    for (let changed = true; changed;) {
+        changed = false;
+        for (const name of running) {
+            const missing = requiresOf(byName.get(name)).find(r => (isCoreTool(r) ? !toolOn(r) : !running.has(r)));
+            if (missing) {
+                running.delete(name);
+                blocked.set(name, missing);
+                changed = true;
+            }
+        }
+    }
+    return blocked;
+}

package/server/services/users.js

@@ -28,6 +28,8 @@ async function ensureDir() {
  */
 function stripPassword(user) {
     const {password, resetTokenHash, resetTokenExpiry, ...safe} = user;
+    // When an unused reset link is still open - the time only, never the token.
+    if (resetTokenHash && Date.parse(resetTokenExpiry) > Date.now()) safe.resetLinkExpires = resetTokenExpiry;
     return safe;
 }
 
@@ -182,6 +184,12 @@ export async function updateUser(id, updates) {
         }
     }
 
+    // Reset tokens are written by setResetToken/clearResetToken only - never by an
+    // update, which takes whole records from clients.
+    delete updates.resetTokenHash;
+    delete updates.resetTokenExpiry;
+    delete updates.resetLinkExpires;
+
     if (updates.password) {
         updates.password = await bcrypt.hash(updates.password, config.auth.bcryptRounds);
     }