domma-cms 0.87.0 → 0.88.1

package/plugins/security/admin/lib/resets.js

@@ -0,0 +1,82 @@
+/**
+ * Security - password reset requests (core's auth:resetRequested, 0.88). Pure.
+ *
+ * Each "Forgot your password?" goes into the sign-in log as `kind: 'reset'`.
+ * One address asking for resets of many different accounts is someone trying
+ * addresses, or trying to fill inboxes - that is what `recordReset` watches.
+ */
+
+/** What became of a request, as the core reports it in `reason`. */
+export const RESET_REASONS = {
+    sent: 'Link sent',
+    unknown: 'No such account',
+    inactive: 'Account switched off',
+    throttled: 'Held back - 3 an hour already',
+    'no-smtp': 'Not sent - no mail server',
+    'no-origin': 'Not sent - no Site URL',
+    failed: 'Email failed'
+};
+
+/**
+ * When it is worth telling someone. The core lets one address ask 3 times an hour
+ * (a route rate limit), and a person only ever asks about their own account - so
+ * one address using all 3 on different accounts is trying addresses. Someone
+ * rotating addresses gets past that, which is what the site-wide count of
+ * requests for accounts that do not exist is for.
+ */
+export const RESET_PROBE = {threshold: 3, windowMin: 60};
+export const RESET_UNKNOWN = {threshold: 10, windowMin: 60};
+
+/**
+ * Note a reset request from an address and say whether it has just crossed the
+ * line: `threshold` different accounts within `windowMin`. Mutates `recent`
+ * (a Map of address -> [{at, email}]), dropping what is older than the window.
+ *
+ * @returns {{accounts: number, tripped: boolean}} tripped only on the request that reaches the threshold
+ */
+export function recordReset(recent, ip, email, {now = Date.now(), threshold = RESET_PROBE.threshold, windowMin = RESET_PROBE.windowMin} = {}) {
+    if (!ip) return {accounts: 0, tripped: false};
+    const since = now - windowMin * 60_000;
+    const list = (recent.get(ip) || []).filter(r => r.at >= since);
+    const before = new Set(list.map(r => r.email)).size;
+    list.push({at: now, email: String(email || '').trim().toLowerCase()});
+    recent.set(ip, list);
+    const accounts = new Set(list.map(r => r.email)).size;
+    return {accounts, tripped: accounts >= threshold && before < threshold};
+}
+
+/**
+ * Note a request for an account that does not exist, from any address, and say
+ * whether the site has just reached `threshold` of them within `windowMin`.
+ * Mutates `stamps` (an array of times).
+ *
+ * @returns {{count: number, tripped: boolean}} tripped only on the request that reaches the threshold
+ */
+export function recordUnknown(stamps, {now = Date.now(), threshold = RESET_UNKNOWN.threshold, windowMin = RESET_UNKNOWN.windowMin} = {}) {
+    const since = now - windowMin * 60_000;
+    const keep = stamps.filter(t => t >= since);
+    stamps.length = 0;
+    stamps.push(...keep, now);
+    return {count: stamps.length, tripped: stamps.length === threshold};
+}
+
+/** Forget site-wide stamps older than the window. Mutates `stamps`. */
+export function pruneUnknown(stamps, {now = Date.now(), windowMin = RESET_UNKNOWN.windowMin} = {}) {
+    const keep = stamps.filter(t => t >= now - windowMin * 60_000);
+    stamps.length = 0;
+    stamps.push(...keep);
+}
+
+/** Forget addresses with nothing inside the window. */
+export function pruneResets(recent, {now = Date.now(), windowMin = RESET_PROBE.windowMin} = {}) {
+    const since = now - windowMin * 60_000;
+    for (const [ip, list] of recent) {
+        const keep = list.filter(r => r.at >= since);
+        if (keep.length) recent.set(ip, keep); else recent.delete(ip);
+    }
+}
+
+/** One log entry as the Sign-ins list shows it. */
+export function resetRowText(e) {
+    return {okText: 'Reset asked', tone: 'reset', note: RESET_REASONS[e.reason] || e.reason || (e.ok ? 'Link sent' : 'Not sent')};
+}

package/plugins/security/admin/lib/settings.js

@@ -11,7 +11,7 @@ export const DEFAULT_SETTINGS = {
     probes: {enabled: true, blockAfter: 5, withinMin: 10, blockForMin: 60, extra: [], allow: []},
     signinDays: 30,
     staleAdminDays: 90,
-    notify: {lockouts: true, successAfterFails: true, probeBlocks: false}
+    notify: {lockouts: true, successAfterFails: true, probeBlocks: false, resetProbing: true}
 };
 
 const int = (v, min, max) => {

package/plugins/security/admin/templates/security.html

@@ -22,6 +22,7 @@
             <div class="scx-card scx-tile"><small>Failed sign-ins, 24h <span data-help="Failed sign-ins in the last 24 hours: a wrong password, an unknown email, a locked account."></span></small><strong data-bind-text="ov.value.failed">—</strong></div>
             <div class="scx-card scx-tile"><small>Blocked now <span data-help="Addresses blocked by a rule or for probing, and accounts or addresses locked after wrong passwords."></span></small><strong data-bind-text="ov.value.blocked">—</strong></div>
             <div class="scx-card scx-tile"><small>Probes refused today <span data-help="Requests for things no Domma site has - WordPress logins, .env files, database dumps. Scanners send them to every site they find; they are answered with an empty 'not found'."></span></small><strong data-bind-text="ov.value.probes">—</strong></div>
+            <div class="scx-card scx-tile"><small>Reset requests, 24h <span data-help="&quot;Forgot your password?&quot; requests in the last 24 hours, sent or not. Sign-ins › Resets lists them, with what happened and where from."></span></small><strong data-bind-text="ov.value.resets">—</strong></div>
         </div>
 
         <div class="scx-card">
@@ -41,6 +42,7 @@
                 <button type="button" data-on-click="res_all" data-bind-class="result.value === 'all' && 'is-on'">All</button>
                 <button type="button" data-on-click="res_failed" data-bind-class="result.value === 'failed' && 'is-on'">Failed</button>
                 <button type="button" data-on-click="res_ok" data-bind-class="result.value === 'ok' && 'is-on'">Succeeded</button>
+                <button type="button" data-on-click="res_resets" data-bind-class="result.value === 'resets' && 'is-on'">Resets</button>
             </div>
             <select class="form-input scx-days" aria-label="Period" data-model="days.value">
                 <option value="1">Last 24 hours</option><option value="7">Last 7 days</option><option value="30">Last 30 days</option><option value="365">All kept</option>
@@ -150,6 +152,7 @@
 .scx-cell { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .scx-pill { display: inline-flex; align-items: center; justify-self: start; font-size: var(--dm-text-xs); font-weight: 600; padding: .05rem .5rem; border-radius: 999px; }
 .scx-pill[data-ok="true"] { color: var(--dm-success); background: color-mix(in srgb, var(--dm-success) 14%, transparent); }
+.scx-pill[data-ok="reset"] { color: var(--dm-info); background: color-mix(in srgb, var(--dm-info) 14%, transparent); }
 .scx-pill[data-ok="false"] { color: var(--dm-danger); background: color-mix(in srgb, var(--dm-danger) 12%, transparent); }
 .scx-kebab { border: 0; background: none; cursor: pointer; font-size: var(--dm-text-lg); line-height: 1; color: var(--dm-text-muted); border-radius: var(--dm-radius-sm); padding: 0 .25rem; }
 .scx-kebab:hover { color: var(--dm-primary); }

package/plugins/security/admin/views/security.js

@@ -10,6 +10,7 @@
  * only, and rows are addressed by index.
  * `#/plugins/security/<tab>` opens a tab. Pure logic: ../lib/*.js.
  */
+import {resetRowText} from '../lib/resets.js';
 import {checkSettings, DEFAULT_SETTINGS, mergeDefaults} from '../lib/settings.js';
 import {ipRuleValid} from '../lib/ip.js';
 
@@ -152,7 +153,8 @@ export const securityView = {
         const asOf = M.computed(() => (health.value?.at ? `Checked ${new Date(health.value.at).toLocaleTimeString('en-GB', {hour: '2-digit', minute: '2-digit'})}` : ''));
         const ov = M.computed(() => {
             const o = overview.value;
-            return o ? {failed: String(o.failed24h), blocked: String(o.blocked + o.locks), probes: String(o.today?.probes || 0)} : {failed: '—', blocked: '—', probes: '—'};
+            return o ? {failed: String(o.failed24h), blocked: String(o.blocked + o.locks), probes: String(o.today?.probes || 0), resets: String(o.resets24h ?? 0)}
+                : {failed: '—', blocked: '—', probes: '—', resets: '—'};
         });
         const blockedCount = M.computed(() => { const b = blocks.value; const n = b.rules.length + b.temp.length + b.locks.length; return n ? String(n) : ''; });
 
@@ -185,18 +187,25 @@ export const securityView = {
             const q = query.value.trim().toLowerCase();
             const r = result.value;
             const only = ipFilter.value;
-            signinList = signins.value.filter(e => (r === 'all' || (r === 'ok') === Boolean(e.ok))
+            // A reset request is in the log too (kind 'reset'): only under All and Resets.
+            const isReset = (e) => e.kind === 'reset';
+            signinList = signins.value.filter(e => (r === 'all' || (r === 'resets' ? isReset(e) : !isReset(e) && (r === 'ok') === Boolean(e.ok)))
                 && (!only || e.ip === only)
                 && (!q || [e.email, e.ip, e.ua, e.reason].some(v => String(v || '').toLowerCase().includes(q))));
-            signinRows.value = signinList.slice(0, 1000).map((e, i) => ({
-                id: `s${i}`, when: when(e.at), ok: String(Boolean(e.ok)), okText: e.ok ? 'Signed in' : 'Failed',
-                email: e.email || '—', ip: e.ip || '—', ua: e.ua || '',
-                note: e.ok ? browserOf(e.ua) : `${REASONS[e.reason] || e.reason || 'Failed'} · ${browserOf(e.ua)}`
-            }));
+            signinRows.value = signinList.slice(0, 1000).map((e, i) => {
+                const row = {id: `s${i}`, when: when(e.at), email: e.email || '—', ip: e.ip || '—', ua: e.ua || ''};
+                if (isReset(e)) {
+                    const t = resetRowText(e);
+                    return {...row, ok: t.tone, okText: t.okText, note: `${t.note} · ${browserOf(e.ua)}`};
+                }
+                return {...row, ok: String(Boolean(e.ok)), okText: e.ok ? 'Signed in' : 'Failed',
+                    note: e.ok ? browserOf(e.ua) : `${REASONS[e.reason] || e.reason || 'Failed'} · ${browserOf(e.ua)}`};
+            });
         }));
         const signinText = M.computed(() => {
             const n = signinList.length + 0 * signinRows.value.length;
             const f = ipFilter.value ? ` from ${ipFilter.value}` : '';
+            if (result.value === 'resets') return `${n.toLocaleString('en-GB')} reset request${n === 1 ? '' : 's'}${f}`;
             return `${n.toLocaleString('en-GB')} sign-in${n === 1 ? '' : 's'}${f}`;
         });
         const signinEmpty = M.computed(() => (query.value.trim() || ipFilter.value ? 'No sign-ins match.' : 'No sign-ins in this period.'));
@@ -280,7 +289,9 @@ export const securityView = {
         }
         function exportCsv() {
             if (!signinList.length) { E.toast('Nothing to export.', {type: 'info'}); return; }
-            const rows = signinList.map(e => ({time: e.at, result: e.ok ? 'signed in' : 'failed', email: e.email, address: e.ip, reason: e.ok ? '' : (REASONS[e.reason] || e.reason || ''), browser: e.ua}));
+            const rows = signinList.map(e => (e.kind === 'reset'
+                ? {time: e.at, result: 'reset requested', email: e.email, address: e.ip, reason: resetRowText(e).note, browser: e.ua}
+                : {time: e.at, result: e.ok ? 'signed in' : 'failed', email: e.email, address: e.ip, reason: e.ok ? '' : (REASONS[e.reason] || e.reason || ''), browser: e.ua}));
             const url = URL.createObjectURL(new Blob([toCsv(rows)], {type: 'text/csv;charset=utf-8'}));
             const a = Object.assign(document.createElement('a'), {href: url, download: `sign-ins-${location.hostname}-${new Date().toISOString().slice(0, 10)}.csv`});
             document.body.appendChild(a); a.click(); a.remove();
@@ -385,14 +396,14 @@ export const securityView = {
                 probeOn: M.observable(s.probes.enabled), after: M.observable(String(s.probes.blockAfter)), within: M.observable(String(s.probes.withinMin)), forMin: M.observable(String(s.probes.blockForMin)),
                 extra: M.observable(s.probes.extra.join('\n')), allow: M.observable(s.probes.allow.join('\n')),
                 signinDays: M.observable(String(s.signinDays)), staleDays: M.observable(String(s.staleAdminDays)),
-                nLock: M.observable(s.notify.lockouts), nAfter: M.observable(s.notify.successAfterFails), nProbe: M.observable(s.notify.probeBlocks)
+                nLock: M.observable(s.notify.lockouts), nAfter: M.observable(s.notify.successAfterFails), nProbe: M.observable(s.notify.probeBlocks), nReset: M.observable(s.notify.resetProbing)
             };
             const body = () => ({
                 lockout: {enabled: f.lockOn.value, accountThreshold: f.acc.value, addressThreshold: f.addr.value, windowMin: f.win.value, baseMin: f.base.value, maxMin: f.max.value},
                 policy: {enabled: f.polOn.value, minLength: f.minLen.value, blockCommon: f.common.value, blockPersonal: f.personal.value},
                 probes: {enabled: f.probeOn.value, blockAfter: f.after.value, withinMin: f.within.value, blockForMin: f.forMin.value, extra: f.extra.value, allow: f.allow.value},
                 signinDays: f.signinDays.value, staleAdminDays: f.staleDays.value,
-                notify: {lockouts: f.nLock.value, successAfterFails: f.nAfter.value, probeBlocks: f.nProbe.value}
+                notify: {lockouts: f.nLock.value, successAfterFails: f.nAfter.value, probeBlocks: f.nProbe.value, resetProbing: f.nReset.value}
             });
             const opened = JSON.stringify(body());
             const saving = M.observable(false);
@@ -436,6 +447,7 @@ export const securityView = {
                         ${sw('nLock', 'Notify when an account or address is locked')}
                         ${sw('nAfter', 'Notify when someone signs in after many wrong passwords')}
                         ${sw('nProbe', 'Notify when a scanner is blocked', 'Off by default: on a public site this happens daily.')}
+                        ${sw('nReset', 'Notify when password resets look like someone trying addresses', 'One address asking about 3 different accounts within an hour (a person only asks about their own), or 10 requests in an hour for accounts that do not exist, from anywhere. Every request is in the sign-in log either way.')}
                     </div></section>
                     <section><h4>Locked out yourself?</h4>
                         <p class="scx-note">Run this in the site's folder on the server - it clears lockouts and blocks, and the site notices within seconds:</p>
@@ -499,6 +511,7 @@ export const securityView = {
         const model = {tab, loading, error, checksOk, canManage, scoreText, scoreWidth, scoreTone, attentionText, asOf, ov, blockedCount, checks,
             result, days, query, signinRows, signinText, signinEmpty, lockRows, tempRows, ruleRows, newRule, newNote, youText};
         const methods = {
+            res_resets: () => { result.value = 'resets'; },
             tab_overview: () => setTab('overview'), tab_signins: () => setTab('signins'), tab_blocked: () => setTab('blocked'),
             res_all: () => { result.value = 'all'; }, res_failed: () => { result.value = 'failed'; }, res_ok: () => { result.value = 'ok'; },
             exportCsv,

package/plugins/security/plugin.js

@@ -31,6 +31,7 @@ import {checkSettings, mergeDefaults} from './admin/lib/settings.js';
 import {accountKey, activeLocks, addressKey, lockedUntil, pruneLockouts, recordFailure, recordSuccess, retryText} from './admin/lib/lockout.js';
 import {passwordProblems} from './admin/lib/policy.js';
 import {isProbe} from './admin/lib/probes.js';
+import {pruneResets, pruneUnknown, recordReset, recordUnknown} from './admin/lib/resets.js';
 import {blockedBy, isTrusted, pruneBlocks, recordProbe} from './admin/lib/blocks.js';
 import {ipRuleValid, isLoopbackIp, plainIp} from './admin/lib/ip.js';
 import {getConfig, saveConfig} from '../../server/config.js';
@@ -72,6 +73,7 @@ async function security(fastify, options = {}) {
     const notify = (p) => { try { hooks.notify?.(p); } catch { /* notifications are a courtesy */ } };
     hooks.registerNotificationSource?.({id: 'lockouts', label: 'Sign-in lockouts', description: 'An account or address was locked after repeated wrong passwords.', severity: 'warning', audience: 'admins'});
     hooks.registerNotificationSource?.({id: 'suspicious', label: 'Suspicious sign-ins', description: 'Someone signed in after many wrong passwords.', severity: 'warning', audience: 'admins'});
+    hooks.registerNotificationSource?.({id: 'resets', label: 'Password reset probing', description: 'One address asked for password resets of many different accounts.', severity: 'warning', audience: 'admins'});
     hooks.registerNotificationSource?.({id: 'probes', label: 'Scanners blocked', description: 'An address probing for weaknesses was blocked.', severity: 'info', audience: 'admins', defaultOn: false});
 
     // ---------------------------------------------------------------------
@@ -161,6 +163,38 @@ async function security(fastify, options = {}) {
         }
     });
 
+    // Password reset requests (core 0.88's auth:resetRequested): into the
+    // sign-in log, and a notice when one address asks about many accounts.
+    const recentResets = new Map();
+    const unknownResets = [];
+    hooks.on?.('auth:resetRequested', (e) => {
+        try {
+            const ip = plainIp(e.ip);
+            state.logSignin({at: new Date().toISOString(), kind: 'reset', ok: Boolean(e.sent), email: e.email || '', userId: e.userId || null,
+                ip, ua: e.ua || '', reason: e.reason || ''});
+            if (isLoopbackIp(ip)) return;
+            if (e.reason === 'unknown') {
+                const many = recordUnknown(unknownResets);
+                if (many.tripped && cfg.notify.resetProbing !== false) {
+                    notify({source: 'resets', severity: 'warning', title: `${many.count} password resets for accounts that do not exist`,
+                        dedupeKey: 'reset-unknown',
+                        body: `Within the hour, ${many.count} "Forgot your password?" requests named accounts this site does not have, from ${new Set(state.readSignins(Date.now() - 3_600_000).filter(x => x.kind === 'reset' && x.reason === 'unknown').map(x => x.ip)).size || 'several'} addresses - someone trying email addresses. The sign-in log (Resets) shows which.`,
+                        link: '#/plugins/security/signins'});
+                }
+            }
+            if (!ip) return;
+            const {accounts, tripped} = recordReset(recentResets, ip, e.email);
+            if (tripped && cfg.notify.resetProbing !== false) {
+                notify({source: 'resets', severity: 'warning', title: `Password resets asked for ${accounts} accounts from ${ip}`,
+                    dedupeKey: `reset-probe:${ip}`,
+                    body: `${ip} asked for password resets of ${accounts} different accounts within the hour - a person only ever asks about their own, so this is someone trying email addresses. The log shows which; block the address if it is not someone you know.`,
+                    link: '#/plugins/security/signins'});
+            }
+        } catch (err) {
+            log.warn(`[security] reset request not recorded: ${err.message}`);
+        }
+    });
+
     hooks.on?.('auth:loginSucceeded', (e) => {
         try {
             const ip = plainIp(e.ip);
@@ -217,12 +251,14 @@ async function security(fastify, options = {}) {
         routes.get('/overview', may('read'), async () => {
             const s = state.get();
             const now = Date.now();
-            const day = state.readSignins(now - 86_400_000);
+            const all = state.readSignins(now - 86_400_000);
+            const day = all.filter(e => e.kind !== 'reset');
             const today = s.counters.day === new Date().toISOString().slice(0, 10) ? s.counters : {probes: 0, blocks: 0, failed: 0};
             return {
                 today,
                 failed24h: day.filter(e => !e.ok).length,
                 succeeded24h: day.filter(e => e.ok).length,
+                resets24h: all.length - day.length,
                 locks: activeLocks(s.lockouts, now).length,
                 blocked: Object.values(s.temp).filter(t => t.until > now).length + s.rules.length,
                 checks: canCheck,
@@ -302,6 +338,8 @@ async function security(fastify, options = {}) {
     // ---------------------------------------------------------------------
     const tidy = () => {
         state.change((s) => { pruneLockouts(s.lockouts, {windowMin: cfg.lockout.windowMin}); pruneBlocks(s); });
+        pruneResets(recentResets);
+        pruneUnknown(unknownResets);
         state.pruneSignins(cfg.signinDays);
     };
     const daily = setInterval(tidy, 6 * 3_600_000);

package/plugins/security/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "security",
   "displayName": "Security",
-  "version": "1.0.3",
+  "version": "1.1.0",
   "tier": "free",
   "description": "Keeps a Domma CMS site safe: a health check of what is weak and how to fix it, sign-in lockout after repeated wrong passwords, password rules, a log of every sign-in, and blocking of the scanners that probe every site for WordPress, .env files and the like.",
   "author": "Domma CMS",
-  "date": "2026-09-26",
+  "date": "2026-09-27",
   "icon": "shield",
   "permissions": [
     {

package/plugins/security/tests/security.test.js

@@ -132,3 +132,37 @@ test('health: facts become checks; unknown is info, never a pass; the score coun
     assert.equal(unknown.checks.find(c => c.id === 'certificate').status, 'info');
     assert.equal(unknown.checks.find(c => c.id === 'headers').status, 'info');
 });
+
+test('resets: one address asking about 3 different accounts in an hour trips once', async () => {
+    const {recordReset, pruneResets, resetRowText} = await import('../admin/lib/resets.js');
+    const recent = new Map();
+    const now = Date.now();
+    const at = (m) => ({now: now + m * MIN});
+    assert.deepEqual(recordReset(recent, '1.2.3.4', 'a@x.test', at(0)), {accounts: 1, tripped: false});
+    // The same account again is not another account.
+    assert.equal(recordReset(recent, '1.2.3.4', 'A@x.test', at(1)).accounts, 1);
+    assert.equal(recordReset(recent, '1.2.3.4', 'b@x.test', at(2)).tripped, false);
+    assert.deepEqual(recordReset(recent, '1.2.3.4', 'c@x.test', at(3)), {accounts: 3, tripped: true});
+    assert.equal(recordReset(recent, '1.2.3.4', 'd@x.test', at(4)).tripped, false, 'only on crossing');
+    // Another address is counted on its own; an hour later the first starts again.
+    assert.equal(recordReset(recent, '5.6.7.8', 'a@x.test', at(5)).accounts, 1);
+    assert.equal(recordReset(recent, '1.2.3.4', 'z@x.test', at(70)).accounts, 1);
+    pruneResets(recent, {now: now + 200 * MIN});
+    assert.equal(recent.size, 0);
+    assert.equal(recordReset(recent, '', 'a@x.test').tripped, false);
+    assert.equal(resetRowText({reason: 'no-smtp'}).note, 'Not sent - no mail server');
+    assert.equal(resetRowText({reason: 'odd'}).note, 'odd');
+});
+
+test('resets: 10 requests for unknown accounts in an hour, from anywhere, trip once', async () => {
+    const {recordUnknown, pruneUnknown} = await import('../admin/lib/resets.js');
+    const stamps = [];
+    const now = Date.now();
+    for (let i = 0; i < 9; i++) assert.equal(recordUnknown(stamps, {now: now + i * MIN}).tripped, false);
+    assert.deepEqual(recordUnknown(stamps, {now: now + 9 * MIN}), {count: 10, tripped: true});
+    assert.equal(recordUnknown(stamps, {now: now + 10 * MIN}).tripped, false, 'only on reaching it');
+    // An hour on, the early ones have gone.
+    assert.equal(recordUnknown(stamps, {now: now + 65 * MIN}).count, 7, 'minutes 5-10 still inside the hour, and this one');
+    pruneUnknown(stamps, {now: now + 200 * MIN});
+    assert.equal(stamps.length, 0);
+});

package/server/routes/api/auth.js

@@ -7,13 +7,17 @@
  * POST /api/auth/me/avatar     - upload your picture (multipart `file`); DELETE removes it
  * GET  /api/auth/avatar/:name  - an avatar image (public: an <img> cannot send the token)
  * POST /api/auth/login/verify  - { ticket, response } → tokens, when a sign-in check asked a question (2FA)
+ * POST /api/auth/forgot-password - { email } → { ok, expiresIn } - emails a reset link (services/passwordReset.js)
+ * POST /api/auth/reset-password/check - { token, password? } → { email, expiresAt, minutesLeft, problems }
+ * POST /api/auth/reset-password - { token, password } → { ok } - signs the account out everywhere
  * POST /api/auth/refresh       - { refreshToken } → { token } - only while its session is live
  * POST /api/auth/logout        - { refreshToken } → { ok: true } - ends the session
  * GET  /api/auth/sessions      - your sessions; DELETE /api/auth/sessions/:sid; POST /api/auth/sessions/revoke-others
  *
  * Sign-in checks and password checks come from plugins (services/authChecks.js);
  * sessions live in services/sessions.js. Events: auth:loginFailed, auth:loginSucceeded,
- * auth:loggedOut, auth:passwordChanged, auth:rateLimited (and user:loggedIn, as before).
+ * auth:loggedOut, auth:passwordChanged, auth:rateLimited, auth:resetRequested (and user:loggedIn, as before).
+ * Password reset (the link, where it may point, the email) is services/passwordReset.js.
  */
 import crypto from 'node:crypto';
 import {config, getConfig} from '../../config.js';
@@ -30,8 +34,6 @@ import {
     createUser,
     getUserByEmail,
     getUserById,
-    getUserByResetToken,
-    setResetToken,
     touchLastLogin,
     updateUser,
     validatePassword
@@ -41,7 +43,8 @@ import {acceptedType, AVATAR_DIR, AVATAR_FILE, AVATAR_MAX_BYTES, removeAvatar, s
 import fsp from 'node:fs/promises';
 import nodePath from 'node:path';
 import {buildClearedSessionCookie, buildSessionCookie} from '../../services/viewerSession.js';
-import {createTransport, sendEmail} from '../../services/email.js';
+import {checkResetToken, originOf, recordOrigin, requestReset, resetLifetime} from '../../services/passwordReset.js';
+import {isSmtpConfigured} from '../../services/email.js';
 import {loginFailed, loginRateLimited} from '../../services/notification-sources.js';
 import {afterIndexOf, checkPassword, runLoginChecks, verifyChallenge} from '../../services/authChecks.js';
 import {createSession, isLegacyTokenRevoked, listSessions, revokeLegacyToken, revokeSession, revokeUserSessions, useSession} from '../../services/sessions.js';
@@ -67,9 +70,12 @@ const passwordProblems = (problems) => problems.join(' ');
 
 export async function authRoutes(fastify) {
     // GET /api/auth/setup-status
+    // `resetByEmail`: whether "Forgot your password?" can work here at all (a mail server is set up).
     fastify.get('/auth/setup-status', async () => {
         const count = await countUsers();
-        return { needsSetup: count === 0 };
+        const site = getConfig('site') || {};
+        return {needsSetup: count === 0, siteTitle: String(site.title || ''), resetByEmail: isSmtpConfigured(site.smtp),
+            resetExpiresIn: resetLifetime().text};
     });
 
     // POST /api/auth/setup - create the very first admin (only allowed when no users exist)
@@ -100,6 +106,7 @@ export async function authRoutes(fastify) {
         try {
             const user = await createUser({name, email, password, role: 'super-admin'});
             const sid = await createSession({userId: user.id, ip: request.ip, ua: uaOf(request), ttlMs: parseDuration(refreshTokenExpiry)});
+            await recordOrigin(request);
             const {token, refreshToken} = signTokens(fastify, user, sid);
             return reply.status(201).send({token, refreshToken, user});
         } finally {
@@ -179,6 +186,7 @@ export async function authRoutes(fastify) {
         const ua = uaOf(request);
         await touchLastLogin(user.id);
         const sid = await createSession({userId: user.id, ip, ua, ttlMs: parseDuration(refreshTokenExpiry)});
+        await recordOrigin(request);
         const safeUser = { id: user.id, name: user.name, email: user.email, role: user.role, additionalRoles: user.additionalRoles || [], level: getRoleLevel(user.role) };
         hooks.emit('user:loggedIn', {userId: user.id, email: user.email, role: user.role});
         hooks.emit('auth:loginSucceeded', {userId: user.id, email: user.email, role: user.role, ip, ua, sid});
@@ -386,86 +394,55 @@ export async function authRoutes(fastify) {
             .send(data);
     });
 
-    // POST /api/auth/forgot-password - send a password reset email (no auth)
+    // POST /api/auth/forgot-password - email a reset link (no auth)
+    // Answers at once and the same way for every address: the lookup and the send happen
+    // after the reply, so neither the answer nor how long it took says whether an account exists.
     fastify.post('/auth/forgot-password', { config: { rateLimit: { max: 3, timeWindow: '1 hour' } } }, async (request) => {
         const {email} = request.body || {};
-        if (!email) return {ok: true}; // always ok - prevents enumeration
-
-        try {
-            const user = await getUserByEmail(email);
-            if (!user || !user.isActive) return {ok: true};
-
-            const token = crypto.randomBytes(32).toString('hex');
-            const hash = crypto.createHash('sha256').update(token).digest('hex');
-
-            const authCfg = getConfig('auth');
-            const expiryMs = parseDuration(authCfg.resetTokenExpiry || '1h');
-            const expiry = new Date(Date.now() + expiryMs).toISOString();
-
-            await setResetToken(user.id, hash, expiry);
-
-            const siteConfig = getConfig('site');
-            const smtp = siteConfig.smtp || {};
-            const sitePort = config.server.port || 4096;
-            const resetUrl = `${request.protocol}://${request.hostname}:${sitePort}/admin/#/reset-password?token=${token}`;
-
-            const transport = await createTransport(smtp);
-            const from = smtp.fromAddress || 'noreply@example.com';
-            const fromName = smtp.fromName || siteConfig.title || 'Domma CMS';
-
-            await sendEmail(transport, {
-                from,
-                fromName,
-                to: user.email,
-                subject: 'Reset your password',
-                html: `
-<!DOCTYPE html>
-<html>
-<body style="font-family:sans-serif;max-width:560px;margin:0 auto;padding:24px;">
-    <h2 style="color:#333;">Password Reset</h2>
-    <p>Hi ${user.name},</p>
-    <p>We received a request to reset your password. Click the link below - it expires in 1 hour.</p>
-    <p style="margin:24px 0;">
-        <a href="${resetUrl}" style="background:#5b8cff;color:#fff;padding:12px 24px;border-radius:6px;text-decoration:none;display:inline-block;">Reset Password</a>
-    </p>
-    <p style="color:#888;font-size:.85rem;">If you didn't request this, you can safely ignore this email.</p>
-    <p style="color:#bbb;font-size:.8rem;">${resetUrl}</p>
-</body>
-</html>`.trim(),
-                text: `Hi ${user.name},\n\nReset your password here:\n${resetUrl}\n\nThis link expires in 1 hour.\n\nIf you didn't request this, ignore this email.`
-            });
-        } catch (err) {
-            console.error('[auth] forgot-password error:', err.message);
+        if (typeof email === 'string' && email.trim() && email.length <= 320) {
+            const job = {email, origin: originOf(request), ip: request.ip, ua: uaOf(request), log: fastify.log};
+            setImmediate(() => { requestReset(job).catch(() => {}); });
         }
+        return {ok: true, expiresIn: resetLifetime().text};
+    });
 
-        return {ok: true};
+    // POST /api/auth/reset-password/check - {token, password?}: is the link still good (the screen asks on
+    // opening, so an expired link says so before anything is typed), and - with a password - what the
+    // site's password rules make of it, as it is typed. Only ever for the holder of a live link.
+    fastify.post('/auth/reset-password/check', {config: {rateLimit: {max: 60, timeWindow: '1 minute'}}}, async (request, reply) => {
+        const {token, password} = request.body || {};
+        const user = await checkResetToken(token);
+        if (!user) return reply.status(400).send({error: 'Invalid or expired reset link', expired: true});
+        let problems = [];
+        if (typeof password === 'string' && password) {
+            problems = password.length < 8 ? ['Password must be at least 8 characters.']
+                : await checkPassword(password, {email: user.email, name: user.name, userId: user.id, request}, {log: fastify.log});
+        }
+        const ms = Date.parse(user.resetTokenExpiry) - Date.now();
+        return {email: user.email, expiresAt: user.resetTokenExpiry, minutesLeft: Math.max(1, Math.ceil(ms / 60_000)), problems};
     });
 
     // POST /api/auth/reset-password - consume token and set new password (no auth)
     fastify.post('/auth/reset-password', { config: { rateLimit: { max: 5, timeWindow: '1 minute' } } }, async (request, reply) => {
         const {token, password} = request.body || {};
-        if (!token || !password) {
+        if (typeof token !== 'string' || typeof password !== 'string' || !token || !password) {
             return reply.status(400).send({error: 'token and password are required'});
         }
         if (password.length < 8) {
             return reply.status(400).send({error: 'Password must be at least 8 characters'});
         }
 
-        const hash = crypto.createHash('sha256').update(token).digest('hex');
-        const user = await getUserByResetToken(hash);
+        const user = await checkResetToken(token);
         if (!user) {
-            return reply.status(400).send({error: 'Invalid or expired reset link'});
-        }
-        if (new Date(user.resetTokenExpiry) < new Date()) {
-            await clearResetToken(user.id);
-            return reply.status(400).send({error: 'Invalid or expired reset link'});
+            return reply.status(400).send({error: 'Invalid or expired reset link', expired: true});
         }
 
         const problems = await checkPassword(password, {email: user.email, name: user.name, userId: user.id, request}, {log: fastify.log});
         if (problems.length) return reply.status(400).send({error: passwordProblems(problems), problems});
 
-        await updateUser(user.id, {password});
+        // Used up BEFORE the password is set: two submissions at once must not both get through.
         await clearResetToken(user.id);
+        await updateUser(user.id, {password});
         await revokeUserSessions(user.id);
         hooks.emit('auth:passwordChanged', {userId: user.id, by: 'reset', ip: request.ip, ua: uaOf(request)});
         return {ok: true};
@@ -520,6 +497,7 @@ export async function authRoutes(fastify) {
             return reply.status(401).send({ error: 'User not found or inactive' });
         }
 
+        await recordOrigin(request);
         const safeUser = { id: user.id, name: user.name, email: user.email, role: user.role, additionalRoles: user.additionalRoles || [], level: getRoleLevel(user.role) };
         const token = fastify.jwt.sign({ ...safeUser, type: 'access', ...(payload.sid && {sid: payload.sid}) }, { expiresIn: accessTokenExpiry });
         setSessionCookie(request, reply, token);

package/server/routes/api/forms.js

@@ -19,6 +19,7 @@
  *   POST   /forms/submit/:slug             - public: accept submission
  *   POST   /forms/test-email               - admin: send test email
  */
+import {keepSubmissionsOut} from '../../services/siteGitignore.js';
 import {createRequire} from 'module';
 import {fileURLToPath} from 'url';
 import path from 'path';
@@ -893,6 +894,8 @@ export async function formsRoutes(fastify) {
                     excused,
                     outcome:   ended ? {type: 'ended', trigger: ended.key, field: ended.field} : null
                 });
+                // What a visitor sent is theirs, not the site's content: keep it out of the site repo.
+                try { keepSubmissionsOut(ROOT, targetSlug); } catch { /* never fail a submission over this */ }
             } else {
                 // Could not resolve or provision a target - e.g. collection
                 // storage is explicitly disabled with no slug. Fail loudly

package/server/routes/api/plugins.js

@@ -23,6 +23,8 @@ import {
     savePluginState
 } from '../../services/plugins.js';
 import {getEffectiveLevel} from '../../services/userRoles.js';
+import {getToolStates, planSwitch, requiresOf, switchableUnits, usesOf} from '../../services/tools.js';
+import {applyCascade} from './tools.js';
 import {scaffoldPlugin} from '../../services/pluginScaffold.js';
 import {deletePluginFile, listPluginFiles, readPluginFile, writePluginFile} from '../../services/pluginFiles.js';
 import {getConfig} from '../../config.js';
@@ -83,14 +85,14 @@ let _restartTimer = null;
  * @param {number}   [delayMs]
  * @returns {void}
  */
-function scheduleRestart(exit, delayMs = 1500) {
+export function scheduleRestart(exit, delayMs = 1500) {
     if (_restartTimer) clearTimeout(_restartTimer);
     _restartTimer = setTimeout(exit, delayMs);
     _restartTimer.unref?.();
 }
 
 /** Admins can opt out of automatic restarts in config/server.json. */
-function autoRestartEnabled() {
+export function autoRestartEnabled() {
     try {
         return getConfig('server')?.restartOnPluginToggle !== false;
     } catch {
@@ -251,6 +253,13 @@ export async function pluginsRoutes(fastify, opts = {}) {
             // Enabled but displaced by another plugin that replaces it. Shown
             // so the screen can explain the inactivity instead of looking broken.
             supersededBy: loadedPlugins[manifest.name]?.supersededBy ?? null,
+            // Enabled but not running because something it requires is not
+            // (a built-in Tool switched off, a required plugin that is off).
+            blockedBy: loadedPlugins[manifest.name]?.blockedBy ?? null,
+            // The site's manager holds this switch: the admin here cannot move it.
+            locked: states[manifest.name]?.locked === true,
+            requires: requiresOf(manifest),
+            uses: usesOf(manifest),
             settings: maskSettings(states[manifest.name]?.settings || {}, '', schemaSecrets(manifest)),
             // What Configure edits: an optional plugin.json `settingsSchema`
             // ([{key, label, type: text|number|select|boolean, options, min,
@@ -311,6 +320,27 @@ export async function pluginsRoutes(fastify, opts = {}) {
         }
 
         const prevState = getPluginStates()[name] || {};
+
+        // The switch goes through the same planner the Manager uses: a lock
+        // refuses it, and anything it drags along (a plugin that requires this
+        // one going off, a requirement coming on) is answered as a plan to
+        // confirm - `cascade: true` on the repeat applies it.
+        let cascaded = [];
+        if (enabled !== undefined && !!enabled !== !!prevState.enabled) {
+            const plan = planSwitch(switchableUnits({manifests, pluginStates: getPluginStates(), toolStates: getToolStates()}),
+                {[name]: !!enabled});
+            if (!plan.ok) {
+                const r = plan.refused[0];
+                const who = r.name === name ? (manifest.displayName || name) : r.name;
+                return reply.status(r.reason.includes('locked') ? 423 : 409).send({error: `${who} ${r.reason}.`, plan});
+            }
+            cascaded = plan.cascaded;
+            if ((cascaded.length || plan.losses.length) && request.body?.cascade !== true) {
+                return reply.status(409).send({error: 'This switch changes other Tools too.', needsConfirm: true, plan});
+            }
+            await applyCascade(cascaded, fastify);
+        }
+
         const update = {};
         if (enabled !== undefined) update.enabled = !!enabled;
         // A secret sent back as the mask keeps its stored value (see maskSettings).
@@ -329,7 +359,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
         // but only where a supervisor will bring the process back, and only
         // when the enabled flag actually changed (a settings-only save must not
         // bounce the site).
-        const toggled = enabled !== undefined && !!enabled !== !!prevState.enabled;
+        const toggled = (enabled !== undefined && !!enabled !== !!prevState.enabled) || cascaded.length > 0;
         const supervised = hasSupervisor();
         const restarting = toggled && supervised && autoRestartEnabled();
         if (restarting) scheduleRestart(exit);