domma-cms 0.87.0 → 0.88.1

package/server/services/passwordReset.js

@@ -0,0 +1,507 @@
+/**
+ * Password reset - "Forgot your password?" and the link it emails.
+ *
+ * Where the link points is the part that matters. It used to be built from
+ * the request - `protocol://hostname:<server port>` - which failed two ways:
+ *   - behind a proxy (every fleet site) the link carried the INTERNAL port,
+ *     `https://example.com:4096/...`, and did not open;
+ *   - the host is whatever the caller claims. Anyone could ask for a reset of
+ *     your account "from" evil.com, and the site mailed YOU a genuine link, with
+ *     a live token, to evil.com.
+ *
+ * So the link goes only to an origin the site trusts:
+ *   1. `site.baseUrl`, when it is set - always, whatever the request says;
+ *   2. otherwise the origin of this request IF someone has signed in there
+ *      (recordOrigin() notes it at setup, sign-in and token refresh - an
+ *      attacker cannot sign in, so cannot add one);
+ *   3. otherwise the origin signed in at most recently;
+ *   4. otherwise none: nothing is sent, and the admins are told why.
+ * Known origins live in content/sessions/origins.json - runtime state, never
+ * committed (siteGitignore.js ignores content/sessions/).
+ *
+ * The route answers before any of this runs (requestReset is not awaited), so
+ * how long it takes cannot tell a caller whether an account exists.
+ *
+ * Also here:
+ *   - a per-account limit on self-service emails (SELF_SERVICE), so nobody
+ *     can fill an inbox from many addresses - the route's limit is per IP;
+ *   - an administrator's reset (Users › ⋮ › Send password reset / Copy a
+ *     reset link) - adminReset(); the admin's own request is signed in, so its
+ *     origin is trusted as it stands;
+ *   - checkResetToken() for the reset screen, which checks the link on
+ *     opening rather than after a new password has been typed twice;
+ *   - the "your password was changed" email on every auth:passwordChanged
+ *     (registerPasswordChangeNotice(), called once at boot by server.js).
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import {config, getConfig} from '../config.js';
+import {hooks} from './hooks.js';
+import {getUserByEmail, getUserById, getUserByResetToken, setResetToken} from './users.js';
+import * as email from './email.js';
+
+export const ORIGINS_FILE = path.resolve(path.dirname(config.content.usersDir), 'sessions', 'origins.json');
+const MAX_ORIGINS = 20;
+const REFRESH_MS = 86_400_000;
+
+// ---------------------------------------------------------------------------
+// Durations
+// ---------------------------------------------------------------------------
+
+/**
+ * '30m' / '1h' / '2d' in milliseconds (anything else is an hour).
+ *
+ * @param {string} str
+ * @returns {number}
+ */
+export function durationMs(str) {
+    const m = String(str ?? '').trim().match(/^(\d+)([mhd])$/);
+    if (!m || Number(m[1]) <= 0) return 3_600_000;
+    return Number(m[1]) * {m: 60_000, h: 3_600_000, d: 86_400_000}[m[2]];
+}
+
+/**
+ * A duration in words: '1 hour', '30 minutes', '2 days'.
+ *
+ * @param {number} ms
+ * @returns {string}
+ */
+export function durationText(ms) {
+    const units = [['day', 86_400_000], ['hour', 3_600_000], ['minute', 60_000]];
+    for (const [name, size] of units) {
+        if (ms >= size && ms % size === 0) {
+            const n = ms / size;
+            return `${n} ${name}${n === 1 ? '' : 's'}`;
+        }
+    }
+    const n = Math.max(1, Math.round(ms / 60_000));
+    return `${n} minute${n === 1 ? '' : 's'}`;
+}
+
+/** How long a reset link lives, from config/auth.json `resetTokenExpiry`. */
+export function resetLifetime() {
+    const ms = durationMs(getConfig('auth')?.resetTokenExpiry || '1h');
+    return {ms, text: durationText(ms)};
+}
+
+// ---------------------------------------------------------------------------
+// Trusted origins
+// ---------------------------------------------------------------------------
+
+const ORIGIN_RE = /^https?:\/\/[a-z0-9.\-]+(:\d{1,5})?$|^https?:\/\/\[[0-9a-f:.]+\](:\d{1,5})?$/;
+
+/**
+ * 'https://example.com' - lower case, no path, no trailing slash; '' when it
+ * does not look like an origin.
+ *
+ * @param {string} value
+ * @returns {string}
+ */
+export function normaliseOrigin(value) {
+    const s = String(value ?? '').trim().toLowerCase().replace(/\/+$/, '');
+    return ORIGIN_RE.test(s) ? s : '';
+}
+
+/**
+ * This request's origin as Fastify resolves it (X-Forwarded-* when trustProxy
+ * is on). `request.host` keeps a non-default port and drops 80/443.
+ *
+ * @param {import('fastify').FastifyRequest} request
+ * @returns {string}
+ */
+export function originOf(request) {
+    const host = request?.host || request?.headers?.host || request?.hostname || '';
+    return normaliseOrigin(`${request?.protocol || 'http'}://${host}`);
+}
+
+let origins = null;
+let queue = Promise.resolve();
+
+async function loadOrigins() {
+    if (origins) return origins;
+    try {
+        const raw = JSON.parse(await fs.readFile(ORIGINS_FILE, 'utf8'));
+        origins = raw && typeof raw.origins === 'object' && raw.origins ? raw.origins : {};
+    } catch {
+        origins = {};
+    }
+    return origins;
+}
+
+/**
+ * Note that someone signed in at this request's origin. Written at most once a
+ * day per origin; the oldest go past MAX_ORIGINS. Never throws - a sign-in must
+ * not fail over this.
+ *
+ * @param {import('fastify').FastifyRequest} request
+ * @returns {Promise<void>}
+ */
+export function recordOrigin(request) {
+    const origin = originOf(request);
+    if (!origin) return Promise.resolve();
+    const run = queue.then(async () => {
+        const known = await loadOrigins();
+        const now = Date.now();
+        if (known[origin] && now - Date.parse(known[origin]) < REFRESH_MS) return;
+        known[origin] = new Date(now).toISOString();
+        const sorted = Object.entries(known).sort((a, b) => Date.parse(b[1]) - Date.parse(a[1]));
+        origins = Object.fromEntries(sorted.slice(0, MAX_ORIGINS));
+        await fs.mkdir(path.dirname(ORIGINS_FILE), {recursive: true});
+        const tmp = `${ORIGINS_FILE}.${process.pid}.tmp`;
+        await fs.writeFile(tmp, JSON.stringify({origins}, null, 2), {mode: 0o600});
+        await fs.rename(tmp, ORIGINS_FILE);
+    });
+    queue = run.catch(() => {});
+    return queue;
+}
+
+/**
+ * The origin a reset link may point at, or '' when the site knows none.
+ *
+ * @param {string} requestOrigin - originOf(request)
+ * @returns {Promise<string>}
+ */
+export async function trustedOrigin(requestOrigin) {
+    const base = normaliseOrigin(getConfig('site')?.baseUrl);
+    if (base) return base;
+    await queue;
+    const known = await loadOrigins();
+    const origin = normaliseOrigin(requestOrigin);
+    if (origin && known[origin]) return origin;
+    const latest = Object.entries(known).sort((a, b) => Date.parse(b[1]) - Date.parse(a[1]))[0];
+    return latest ? latest[0] : '';
+}
+
+/** Tests: forget the cached origins (the file is re-read). */
+export function _resetOrigins() {
+    origins = null;
+}
+
+// ---------------------------------------------------------------------------
+// The email
+// ---------------------------------------------------------------------------
+
+const esc = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+
+/**
+ * @param {string} origin
+ * @param {string} token
+ * @returns {string}
+ */
+export function resetLink(origin, token) {
+    return `${origin}/admin/#/reset-password?token=${token}`;
+}
+
+/**
+ * The reset email. Everything a user or an admin typed is escaped.
+ *
+ * @param {{name: string, link: string, lifetime: string, siteTitle: string, requestedBy?: string|true}} o
+ *   `requestedBy`: an administrator's name (their reset from Users), or true when it is not known
+ * @returns {{subject: string, html: string, text: string}}
+ */
+export function buildResetEmail({name, link, lifetime, siteTitle, requestedBy = ''}) {
+    const site = siteTitle || 'the site';
+    const hi = name ? `Hi ${name},` : 'Hello,';
+    if (requestedBy) return buildAdminResetEmail({hi, site, link, lifetime, requestedBy});
+    return {
+        subject: `Reset your password for ${site}`,
+        html: `
+<!DOCTYPE html>
+<html>
+<body style="font-family:sans-serif;max-width:560px;margin:0 auto;padding:24px;">
+    <h2 style="color:#333;">Reset your password</h2>
+    <p>${esc(hi)}</p>
+    <p>Someone asked to reset the password for your account on ${esc(site)}. Use the button below - it works once and expires in ${esc(lifetime)}.</p>
+    <p style="margin:24px 0;">
+        <a href="${esc(link)}" style="background:#5b8cff;color:#fff;padding:12px 24px;border-radius:6px;text-decoration:none;display:inline-block;">Choose a new password</a>
+    </p>
+    <p style="color:#888;font-size:.85rem;">If it was not you, ignore this email - your password stays as it is.</p>
+    <p style="color:#bbb;font-size:.8rem;">${esc(link)}</p>
+</body>
+</html>`.trim(),
+        text: `${hi}\n\nSomeone asked to reset the password for your account on ${site}.\n\n`
+            + `Choose a new password here (it works once and expires in ${lifetime}):\n${link}\n\n`
+            + 'If it was not you, ignore this email - your password stays as it is.'
+    };
+}
+
+/** The same link, sent by an administrator from Users - it says who asked. */
+function buildAdminResetEmail({hi, site, link, lifetime, requestedBy}) {
+    requestedBy = requestedBy === true ? 'An administrator of' : `${requestedBy}, an administrator of`;
+    return {
+        subject: `Set a new password for ${site}`,
+        html: `
+<!DOCTYPE html>
+<html>
+<body style="font-family:sans-serif;max-width:560px;margin:0 auto;padding:24px;">
+    <h2 style="color:#333;">Set a new password</h2>
+    <p>${esc(hi)}</p>
+    <p>${esc(requestedBy)} ${esc(site)} sent you this link to set a new password for your account. It works once and expires in ${esc(lifetime)}.</p>
+    <p style="margin:24px 0;">
+        <a href="${esc(link)}" style="background:#5b8cff;color:#fff;padding:12px 24px;border-radius:6px;text-decoration:none;display:inline-block;">Choose a new password</a>
+    </p>
+    <p style="color:#888;font-size:.85rem;">Not expecting this? Ignore it - your password stays as it is until the link is used.</p>
+    <p style="color:#bbb;font-size:.8rem;">${esc(link)}</p>
+</body>
+</html>`.trim(),
+        text: `${hi}\n\n${requestedBy} ${site} sent you this link to set a new password for your account `
+            + `(it works once and expires in ${lifetime}):\n${link}\n\n`
+            + 'Not expecting this? Ignore it - your password stays as it is until the link is used.'
+    };
+}
+
+const HOW = {
+    reset: 'using a password reset link',
+    self: 'from your own account (My Profile)',
+    admin: 'by an administrator'
+};
+
+/**
+ * "Your password was changed" - to the account holder, after any change.
+ *
+ * @param {{name: string, how: 'reset'|'self'|'admin', when: string, siteTitle: string, signInUrl?: string}} o
+ * @returns {{subject: string, html: string, text: string}}
+ */
+export function buildChangedEmail({name, how, when, siteTitle, signInUrl = ''}) {
+    const site = siteTitle || 'the site';
+    const hi = name ? `Hi ${name},` : 'Hello,';
+    const line = `The password for your account on ${site} was changed ${HOW[how] || HOW.self} at ${when}.`;
+    const notYou = signInUrl
+        ? `If that was not you, choose a new password now with "Forgot your password?" at ${signInUrl}, and tell an administrator.`
+        : 'If that was not you, tell an administrator of the site at once.';
+    return {
+        subject: `Your password for ${site} was changed`,
+        html: `
+<!DOCTYPE html>
+<html>
+<body style="font-family:sans-serif;max-width:560px;margin:0 auto;padding:24px;">
+    <h2 style="color:#333;">Your password was changed</h2>
+    <p>${esc(hi)}</p>
+    <p>${esc(line)} Anywhere else you were signed in has been signed out.</p>
+    <p>If it was you, there is nothing more to do.</p>
+    <p style="color:#888;font-size:.85rem;">${esc(notYou)}</p>
+</body>
+</html>`.trim(),
+        text: `${hi}\n\n${line} Anywhere else you were signed in has been signed out.\n\n`
+            + `If it was you, there is nothing more to do.\n\n${notYou}`
+    };
+}
+
+// ---------------------------------------------------------------------------
+// Issuing
+// ---------------------------------------------------------------------------
+
+/** Tests swap the mailer so nothing touches the network (email.js always does). */
+let mailer = email;
+export function _setMailer(m) {
+    mailer = m ? {...email, ...m} : email;
+}
+
+/**
+ * Self-service emails per account: the route's own limit is per address, so
+ * without this anyone with a few addresses could fill someone's inbox (and
+ * keep replacing the link they are about to use). An administrator's reset is
+ * not counted.
+ */
+export const SELF_SERVICE = {max: 3, windowMs: 3_600_000};
+const recent = new Map();
+
+function throttled(userId, now = Date.now()) {
+    const list = (recent.get(userId) || []).filter(t => now - t < SELF_SERVICE.windowMs);
+    const over = list.length >= SELF_SERVICE.max;
+    if (!over) list.push(now);
+    recent.set(userId, list);
+    return over;
+}
+
+/** Tests: forget the per-account counts. */
+export function _resetThrottle() {
+    recent.clear();
+}
+
+function fromOf(site) {
+    const smtp = site.smtp || {};
+    return {from: smtp.fromAddress || 'noreply@example.com', fromName: smtp.fromName || site.title || 'Domma CMS'};
+}
+
+/**
+ * A new reset token for a user; replaces any earlier one.
+ *
+ * @param {string} userId
+ * @returns {Promise<{token: string, expiresAt: string}>}
+ */
+export async function issueResetToken(userId) {
+    const token = crypto.randomBytes(32).toString('hex');
+    const hash = crypto.createHash('sha256').update(token).digest('hex');
+    const expiresAt = new Date(Date.now() + resetLifetime().ms).toISOString();
+    await setResetToken(userId, hash, expiresAt);
+    return {token, expiresAt};
+}
+
+/**
+ * Mail a reset link to the account behind `email`, if there is an active one.
+ * Emits `auth:resetRequested` {email, userId, ip, ua, sent, reason} every time,
+ * whatever the outcome.
+ *
+ * @param {{email: string, origin: string, ip?: string, ua?: string, log?: object}} o
+ *   `origin` is originOf(request), taken before the route answered.
+ * @returns {Promise<{sent: boolean, reason: string}>}
+ *   reason: 'sent' | 'unknown' | 'inactive' | 'throttled' | 'no-smtp' | 'no-origin' | 'failed'
+ */
+export async function requestReset({email: address, origin, ip = '', ua = '', log = console}) {
+    const addr = String(address ?? '').trim().toLowerCase();
+    let user = null;
+    let outcome;
+    try {
+        user = addr ? await getUserByEmail(addr) : null;
+        outcome = await send(user, origin, log);
+    } catch (err) {
+        log.error?.(`[auth] password reset failed: ${err.message}`);
+        outcome = {sent: false, reason: 'failed'};
+    }
+    hooks.emit('auth:resetRequested', {email: addr, userId: user?.id ?? null, ip, ua, ...outcome});
+    return outcome;
+}
+
+async function send(user, origin, log) {
+    if (!user) return {sent: false, reason: 'unknown'};
+    if (!user.isActive) return {sent: false, reason: 'inactive'};
+
+    const site = getConfig('site') || {};
+    const smtp = site.smtp || {};
+    const {resetNotSent} = await import('./notification-sources.js');
+    // Without a mail server the message would go to a throwaway test inbox:
+    // the user would wait for an email that never comes. Say so instead.
+    if (!mailer.isSmtpConfigured(smtp)) {
+        resetNotSent('no-smtp', user.email);
+        return {sent: false, reason: 'no-smtp'};
+    }
+    const trusted = await trustedOrigin(origin);
+    if (!trusted) {
+        resetNotSent('no-origin', user.email);
+        log.warn?.('[auth] password reset not sent: no trusted site address (set site.baseUrl, or sign in once)');
+        return {sent: false, reason: 'no-origin'};
+    }
+
+    if (throttled(user.id)) {
+        log.warn?.(`[auth] password reset for ${user.email} not sent: over ${SELF_SERVICE.max} in an hour`);
+        return {sent: false, reason: 'throttled'};
+    }
+
+    const {token} = await issueResetToken(user.id);
+    const message = buildResetEmail({name: user.name, link: resetLink(trusted, token), lifetime: resetLifetime().text,
+        siteTitle: site.title});
+    const transport = await mailer.createTransport(smtp);
+    await mailer.sendEmail(transport, {...fromOf(site), to: user.email, ...message});
+    return {sent: true, reason: 'sent'};
+}
+
+// ---------------------------------------------------------------------------
+// An administrator's reset
+// ---------------------------------------------------------------------------
+
+/**
+ * The origin for a link an administrator makes: site.baseUrl, else the
+ * address the admin is signed in at (their request is authenticated - it is
+ * recorded as known, too).
+ *
+ * @param {import('fastify').FastifyRequest} request
+ * @returns {Promise<string>}
+ */
+export async function adminOrigin(request) {
+    await recordOrigin(request);
+    return normaliseOrigin(getConfig('site')?.baseUrl) || originOf(request);
+}
+
+/**
+ * A reset from Users: email the link, or hand it back to copy. The caller has
+ * already checked the admin may manage this user.
+ *
+ * @param {{user: object, origin: string, via: 'email'|'link', by: {id: string, name?: string, email?: string}}} o
+ * @returns {Promise<{expiresAt: string, expiresIn: string, link?: string, sent?: boolean}>}
+ * @throws {Error} code 'NO_SMTP' (email asked, no mail server) | 'INACTIVE' | 'NO_ORIGIN'
+ */
+export async function adminReset({user, origin, via, by}) {
+    const fail = (code, message) => Object.assign(new Error(message), {code});
+    if (!user.isActive) throw fail('INACTIVE', 'This account is inactive - make it active first, or it cannot sign in with the new password.');
+    const site = getConfig('site') || {};
+    if (via === 'email' && !mailer.isSmtpConfigured(site.smtp)) {
+        throw fail('NO_SMTP', 'No mail server is set up (Settings › Email), so the link cannot be emailed. Copy it instead.');
+    }
+    if (!origin) throw fail('NO_ORIGIN', 'The site does not know its own address. Set the Site URL in Settings › General.');
+    const {token, expiresAt} = await issueResetToken(user.id);
+    const link = resetLink(origin, token);
+    const expiresIn = resetLifetime().text;
+    hooks.emit('auth:resetIssued', {userId: user.id, by: by?.id ?? null, via});
+    if (via === 'link') return {link, expiresAt, expiresIn};
+    const message = buildResetEmail({name: user.name, link, lifetime: expiresIn, siteTitle: site.title,
+        requestedBy: by?.name || by?.email || true});
+    const transport = await mailer.createTransport(site.smtp);
+    await mailer.sendEmail(transport, {...fromOf(site), to: user.email, ...message});
+    return {sent: true, expiresAt, expiresIn};
+}
+
+// ---------------------------------------------------------------------------
+// The reset screen
+// ---------------------------------------------------------------------------
+
+/**
+ * The account a reset token belongs to, while it may still be used: known,
+ * unexpired and the account active. null otherwise - the caller says
+ * "invalid or expired" either way.
+ *
+ * @param {string} token - the 64-hex token from the link
+ * @returns {Promise<object|null>} the full user record (callers pick fields)
+ */
+export async function checkResetToken(token) {
+    if (typeof token !== 'string' || !/^[a-f0-9]{64}$/.test(token)) return null;
+    const hash = crypto.createHash('sha256').update(token).digest('hex');
+    const user = await getUserByResetToken(hash);
+    if (!user || !user.isActive) return null;
+    if (!(Date.parse(user.resetTokenExpiry) > Date.now())) return null;
+    return user;
+}
+
+// ---------------------------------------------------------------------------
+// "Your password was changed"
+// ---------------------------------------------------------------------------
+
+/**
+ * Tell the account holder their password changed. Never to a test inbox:
+ * without a mail server it is skipped.
+ *
+ * @param {{userId: string, by: string}} e - auth:passwordChanged; `by` is 'reset' or the actor's id
+ * @returns {Promise<{sent: boolean, reason: string}>}
+ */
+export async function passwordChangedNotice({userId, by}) {
+    const user = userId ? await getUserById(userId) : null;
+    if (!user?.email) return {sent: false, reason: 'unknown'};
+    const site = getConfig('site') || {};
+    if (!mailer.isSmtpConfigured(site.smtp)) return {sent: false, reason: 'no-smtp'};
+    const how = by === 'reset' ? 'reset' : by === userId ? 'self' : 'admin';
+    const origin = await trustedOrigin('');
+    const when = new Date().toISOString().replace('T', ' ').slice(0, 16) + ' UTC';
+    const message = buildChangedEmail({name: user.name, how, when, siteTitle: site.title,
+        signInUrl: origin ? `${origin}/admin/#/login` : ''});
+    const transport = await mailer.createTransport(site.smtp);
+    await mailer.sendEmail(transport, {...fromOf(site), to: user.email, ...message});
+    return {sent: true, reason: 'sent'};
+}
+
+let noticeRegistered = false;
+
+/**
+ * Send passwordChangedNotice() on every auth:passwordChanged. Once, at boot -
+ * not on import, or every test that changes a password would send mail.
+ *
+ * @param {{log?: object}} [opts]
+ */
+export function registerPasswordChangeNotice({log = console} = {}) {
+    if (noticeRegistered) return;
+    noticeRegistered = true;
+    hooks.on('auth:passwordChanged', (e) => {
+        passwordChangedNotice(e || {}).catch(err => log.warn?.(`[auth] password-changed email not sent: ${err.message}`));
+    });
+}

package/server/services/plugins.js

@@ -38,6 +38,7 @@ import {authenticateFor} from './pluginScope.js';
 import {getEffectiveRoles} from './userRoles.js';
 import * as defaultUsersService from './users.js';
 import {registerLoginCheck, registerPasswordCheck} from './authChecks.js';
+import {CORE_TOOLS, getToolStates, unmetRequirements} from './tools.js';
 
 const PLUGINS_DIR = path.resolve('plugins');
 
@@ -107,6 +108,9 @@ export function getPluginLoadFailures() {
  */
 const _loadedPlugins = {};
 
+/** Enabled plugins not loaded because a requirement is not running: name -> requirement. */
+let _blockedPlugins = new Map();
+
 /**
  * Entitlement state per licensed plugin, as of the last registerPlugins().
  * Reported by GET /api/plugins so the screen can explain an absence rather than
@@ -447,11 +451,26 @@ export async function registerPlugins(fastify) {
         warn: message => fastify.log.warn(`[plugins] ${message}`)
     });
 
+    // A plugin whose requirement is not running - a built-in Tool switched
+    // off, or a required plugin that is off, unlicensed or superseded - is not
+    // loaded. The switch screens prevent this state; this is the backstop for a
+    // hand-edited plugins.json or tools.json, so nothing runs half-wired.
+    const blocked = unmetRequirements(manifests,
+        new Set([...activeNames].filter(n => !superseded.has(n))));
+    _blockedPlugins = blocked;
+
     const loaded = [];
     for (const manifest of manifests) {
         const state = states[manifest.name] || {};
         if (!state.enabled && !CORE_PLUGINS.has(manifest.name)) continue;
 
+        const missing = blocked.get(manifest.name);
+        if (missing) {
+            _loadedPlugins[manifest.name] = {enabled: false, publicEntry: null, blockedBy: missing};
+            fastify.log.warn(`[plugins] "${manifest.name}" not loaded: it requires "${missing}", which is not running.`);
+            continue;
+        }
+
         const displacedBy = superseded.get(manifest.name);
         if (displacedBy) {
             // Recorded rather than merely skipped: the admin Plugins screen
@@ -1242,6 +1261,8 @@ export async function getAdminPluginConfig() {
     for (const manifest of manifests) {
         const state = states[manifest.name] || {};
         if ((!state.enabled && !CORE_PLUGINS.has(manifest.name)) || !manifest.admin) continue;
+        // Not loaded for want of a requirement: its screens would only 404.
+        if (_blockedPlugins.has(manifest.name)) continue;
 
         if (manifest.admin.sidebar) sidebar.push(...manifest.admin.sidebar);
         if (manifest.admin.routes) routes.push(...manifest.admin.routes);
@@ -1303,5 +1324,10 @@ export async function getAdminPluginConfig() {
         }
     }
 
-    return { sidebar, routes, views, css, meta, takeovers: getToolTakeovers() };
+    // Built-in Tools and whether each is on, so the admin can turn a link to a
+    // switched-off one away (services/tools.js).
+    const toolStates = getToolStates();
+    const tools = Object.fromEntries(CORE_TOOLS.map(t => [t.name, {displayName: t.displayName, enabled: toolStates[t.name]?.enabled !== false}]));
+
+    return { sidebar, routes, views, css, meta, takeovers: getToolTakeovers(), tools };
 }

package/server/services/renderer.js

@@ -14,6 +14,7 @@ import {getProjectForPage} from './projects.js';
 import {resolveContextMenusForPage} from './contextMenus.js';
 import {buildCustomThemeStyleTag, buildOverrideStyleTag, getThemeTokenMap, listThemeIds, loadThemeConfig, resolveThemeClasses} from './themeSettings.js';
 import {getSearchSettings} from './search.js';
+import {isToolEnabled} from './tools.js';
 
 const VALID_LAYOUT_WIDTHS = new Set(['narrow', 'normal', 'wide', 'full']);
 const CUSTOM_CSS_PATH = new URL('../../content/custom.css', import.meta.url).pathname;
@@ -80,8 +81,8 @@ const ANALYTICS_ASSET_V = '20260922-analytics';
 /**
  * The page-view beacon.
  *
- * Always emitted: analytics was a CORE_PLUGINS member, meaning it could not be
- * switched off, and promotion should not quietly change that. What it counts is
+ * Emitted while the Analytics Tool is on (it can be switched off since 0.88.0,
+ * config/tools.json - services/tools.js). What it counts is
  * decided in the browser - Do-Not-Track, per-session dedup and preview renders
  * all opt out there, where the facts are.
  *
@@ -90,6 +91,8 @@ const ANALYTICS_ASSET_V = '20260922-analytics';
  * @returns {string} the body tag
  */
 function buildAnalyticsTag() {
+    // Unless the site has switched Analytics off (config/tools.json).
+    if (!isToolEnabled('analytics')) return '';
     return `<script src="/public/js/analytics.js?v=${ANALYTICS_ASSET_V}"></script>`;
 }