domma-cms 0.87.0 → 0.88.1

package/server/services/siteGitignore.js

@@ -84,9 +84,114 @@ export const PRIVATE_DATA = [
     'contacts', 'contacts-contacts', 'contacts-groups', 'roles', 'user-profiles',
     'user-messages', 'user-message-threads', 'analytics-events', 'enquiries',
     'blog-comments', 'invoices', 'invoice-receivers', 'invoice-issuers',
-    'surveys-contacts', 'surveys-invites'
+    'surveys-contacts', 'surveys-invites',
+    // Paid plugins' visitor and customer records (0.88.1): Cart Pro's orders and
+    // discount codes, Calendar's RSVPs, the job board's people and applications.
+    'shop-orders', 'shop-pro-codes', 'calendar-rsvps',
+    'jb-applications', 'jb-candidate-profiles', 'jb-signups'
 ];
 
+/**
+ * The collection a form stores its submissions in - the same choice as the
+ * submit route (routes/api/forms.js): the collection action's slug when it is
+ * on, otherwise the form's own slug. An action slug set but switched off is
+ * kept out too: ensureCollectionForForm provisions into it.
+ *
+ * @param {object} form - Parsed content/forms/<slug>.json
+ * @returns {string[]} collection slugs
+ */
+export function formDataCollections(form) {
+    const action = form?.actions?.collection;
+    const safe = (v) => (typeof v === 'string' && /^[a-z0-9][a-z0-9_-]*$/i.test(v) ? v : '');
+    return [...new Set([safe(action?.slug), safe(form?.slug)].filter(Boolean))];
+}
+
+/** `[form name="x" /]` (or slug="x") anywhere in a text. */
+function embeddedFormNames(text) {
+    const out = new Set();
+    for (const m of String(text).matchAll(/\[form\b([^\]]*)\]/gi)) {
+        const a = m[1].match(/\b(?:name|slug)\s*=\s*["']?([A-Za-z0-9_-]+)/);
+        if (a) out.add(a[1]);
+    }
+    return out;
+}
+
+function readTree(dir, exts, out = [], depth = 0) {
+    if (depth > 6) return out;
+    let entries = [];
+    try { entries = fs.readdirSync(dir, {withFileTypes: true}); } catch { return out; }
+    for (const e of entries) {
+        const full = path.join(dir, e.name);
+        if (e.isDirectory()) { if (e.name !== 'media' && e.name !== 'collections') readTree(full, exts, out, depth + 1); }
+        else if (exts.some(x => e.name.endsWith(x))) out.push(full);
+    }
+    return out;
+}
+
+/**
+ * The collections this site's VISITORS write to, from what is on disk - like
+ * PRIVATE_DATA, but only the site knows which they are. Before 0.88.1 nothing
+ * did this: a form storing in `find-a-tutor` had every enquiry - names, emails,
+ * phone numbers - committed to the site repo.
+ *
+ * "A form writes there" is not enough: every collection created in the admin
+ * gets a form of its own (ensureFormForCollection), and a content collection
+ * (FAQs, testimonials) must stay tracked. So a collection counts when
+ *   - a form storing in it is EMBEDDED somewhere in content ([form name=...]), or
+ *   - it was made by a form (schema meta.generatedFromForm).
+ * The submit route adds the rest the moment a visitor's entry is stored
+ * (keepFormDataOut) - the one signal that is never wrong.
+ *
+ * @param {string} siteRoot
+ * @returns {string[]} sorted, de-duplicated
+ */
+export function siteFormDataCollections(siteRoot) {
+    const content = path.join(siteRoot, 'content');
+    const embedded = new Set();
+    for (const f of readTree(content, ['.md', '.html', '.json'])) {
+        if (f.startsWith(path.join(content, 'forms') + path.sep)) continue;
+        try { for (const n of embeddedFormNames(fs.readFileSync(f, 'utf8'))) embedded.add(n); } catch { /* skip */ }
+    }
+    const out = new Set();
+    const formsDir = path.join(content, 'forms');
+    let files = [];
+    try { files = fs.readdirSync(formsDir).filter(f => f.endsWith('.json')); } catch { /* no forms */ }
+    for (const f of files) {
+        try {
+            const form = JSON.parse(fs.readFileSync(path.join(formsDir, f), 'utf8'));
+            if (embedded.has(form.slug) || embedded.has(f.replace(/\.json$/, ''))) for (const c of formDataCollections(form)) out.add(c);
+        } catch { /* an unreadable form keeps nothing out - and breaks nothing */ }
+    }
+    const colDir = path.join(content, 'collections');
+    let cols = [];
+    try { cols = fs.readdirSync(colDir); } catch { /* none */ }
+    for (const c of cols) {
+        try {
+            const schema = JSON.parse(fs.readFileSync(path.join(colDir, c, 'schema.json'), 'utf8'));
+            if (schema?.meta?.generatedFromForm) out.add(c);
+        } catch { /* no schema */ }
+    }
+    return [...out].sort();
+}
+
+/** The rule that keeps one collection's entries out. */
+export const collectionDataRule = (slug) => `/content/collections/${slug}/data.json`;
+
+/**
+ * Keep a collection a visitor has just written to out of a managed .gitignore -
+ * called by the submit route once an entry is stored, so submissions never wait
+ * for the next regeneration to stop being committed. Same guard as
+ * allowInGitignore: a missing or hand-written file is left alone.
+ *
+ * @param {string} siteRoot
+ * @param {string} slug - The collection the entry went into
+ * @returns {string[]} The rules actually added
+ */
+export function keepSubmissionsOut(siteRoot, slug) {
+    if (!/^[a-z0-9][a-z0-9_-]*$/i.test(String(slug || '')) || PRIVATE_DATA.includes(slug)) return [];
+    return allowInGitignore(siteRoot, [collectionDataRule(slug)]);
+}
+
 /**
  * Lines bin/update.js appends when it cannot find them VERBATIM. They are
  * already ignored by `/*` and `/plugins/*`, but writing them out keeps the
@@ -151,10 +256,11 @@ export function pluginContentRules(name, rel) {
  * @param {Object<string,string[]>} [opts.pluginContent={}] - Extra content folders in distributed plugins
  * @param {string[]} [opts.sitePublic=[]] - Site-added entries directly under public/
  * @param {string[]} [opts.extras=[]] - Other site-owned top-level entries (docs, tools, README.md)
+ * @param {string[]} [opts.formData=[]] - Collections the site's forms store submissions in (siteFormDataCollections)
  * @param {string[]} [opts.siteRules=[]] - The site-specific section
  * @returns {string}
  */
-export function buildGitignore({sitePlugins = [], pluginContent = {}, sitePublic = [], extras = [], siteRules = []} = {}) {
+export function buildGitignore({sitePlugins = [], pluginContent = {}, sitePublic = [], extras = [], formData = [], siteRules = []} = {}) {
     const L = [
         MANAGED_HEADER,
         '# This repo holds the site\'s CONTENT only. Everything is ignored, then what',
@@ -192,7 +298,12 @@ export function buildGitignore({sitePlugins = [], pluginContent = {}, sitePublic
     L.push('', '# Schemas the CMS rewrites on every boot - engine-owned, not authored');
     for (const c of ENGINE_SCHEMAS) L.push(`/content/collections/${c}/schema.json`);
     L.push('', '# Secrets, visitor-submitted and per-user data, runtime state');
-    for (const c of PRIVATE_DATA) L.push(`/content/collections/${c}/data.json`);
+    for (const c of PRIVATE_DATA) L.push(collectionDataRule(c));
+    const submitted = [...new Set(formData)].filter(c => !PRIVATE_DATA.includes(c)).sort();
+    if (submitted.length) {
+        L.push('', '# Form submissions - what visitors sent (siteFormDataCollections)');
+        for (const c of submitted) L.push(collectionDataRule(c));
+    }
     L.push(
         '/content/users/',
         '/content/sessions/',

package/server/services/tools.js

@@ -0,0 +1,259 @@
+/**
+ * Switching Tools on and off - the built-in ones and plugins alike.
+ *
+ * ## Built-in Tools
+ *
+ * Contacts, Notes, Todo and Analytics were plugins until 0.67.0. They are part
+ * of the CMS now and ON unless a site says otherwise, in `config/tools.json`:
+ *
+ *     { "notes": { "enabled": false, "locked": true } }
+ *
+ * A Tool that is off keeps its data. Its API answers 404 (server.js gates the
+ * prefix at request time), its sidebar entry is not registered, and anything
+ * it feeds - notification sources, calendar sources, related items, the
+ * analytics beacon - is left out.
+ *
+ * ## Dependencies
+ *
+ * A plugin's manifest says what it needs:
+ *
+ *     "requires": ["contacts"]                     - cannot work without it
+ *     "uses": {"contacts": "Invite a contact group"} - loses that feature without it
+ *
+ * Either may name a built-in Tool or another plugin. `supersedes` is a
+ * different relationship (a replacement) and is not a dependency.
+ *
+ * `planSwitch()` is the one place that decides what a change does: which
+ * plugins go off with a Tool they require, which requirements come on with a
+ * plugin, what a soft dependant loses, and what is refused. It is pure so the
+ * Manager can run it against a site on disk before writing anything, and the
+ * site runs the same function when its own admin flips a switch. The loader
+ * (`unmetRequirements()`) is the backstop: a plugin whose requirement is off
+ * is not loaded, whatever plugins.json says.
+ *
+ * ## Locks
+ *
+ * `locked: true` - on a tools.json or a plugins.json entry - means the site's
+ * own admin cannot change that switch; only its Manager, which writes the
+ * files directly. A cascade that would move a locked switch is refused.
+ *
+ * @module services/tools
+ */
+import {getConfig, saveConfig} from '../config.js';
+
+/** The built-in Tools that can be switched off. Order is display order. */
+export const CORE_TOOLS = Object.freeze([
+    {name: 'contacts', displayName: 'Contacts', icon: 'users', description: 'An address book for each user, with groups.'},
+    {name: 'notes', displayName: 'Notes', icon: 'edit-3', description: 'Private notes for each user.'},
+    {name: 'todo', displayName: 'Todo', icon: 'check-square', description: 'To-do lists with due dates and reminders.'},
+    {name: 'analytics', displayName: 'Analytics', icon: 'chart-bar', description: 'Page views and visitors, counted on this server.'}
+]);
+
+const CORE_NAMES = new Set(CORE_TOOLS.map(t => t.name));
+
+/** @param {string} name  @returns {boolean} */
+export const isCoreTool = (name) => CORE_NAMES.has(name);
+
+/**
+ * Stored state of the built-in Tools. Missing file or entry = on, unlocked.
+ * Read fresh each call: the Manager writes this file from outside the process.
+ *
+ * @returns {Object.<string, {enabled?: boolean, locked?: boolean}>}
+ */
+export function getToolStates() {
+    try {
+        const raw = getConfig('tools');
+        return raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : {};
+    } catch {
+        return {};
+    }
+}
+
+/** @param {string} name  @returns {boolean} a built-in Tool is on unless tools.json says otherwise */
+export function isToolEnabled(name) {
+    return getToolStates()[name]?.enabled !== false;
+}
+
+/** @param {string} name  @returns {boolean} */
+export function isToolLocked(name) {
+    return getToolStates()[name]?.locked === true;
+}
+
+/**
+ * @param {string} name
+ * @param {{enabled?: boolean, locked?: boolean}} patch
+ */
+export function saveToolState(name, patch) {
+    if (!isCoreTool(name)) throw new Error(`"${name}" is not a built-in Tool`);
+    const states = getToolStates();
+    states[name] = {...states[name], ...patch};
+    saveConfig('tools', states);
+}
+
+/** `requires` from a manifest, as a clean list of names. */
+export function requiresOf(manifest) {
+    const r = manifest?.requires;
+    return Array.isArray(r) ? r.filter(n => typeof n === 'string' && n) : [];
+}
+
+/** `uses` from a manifest, as {name: reason}. An array form is accepted too. */
+export function usesOf(manifest) {
+    const u = manifest?.uses;
+    if (Array.isArray(u)) return Object.fromEntries(u.filter(n => typeof n === 'string').map(n => [n, '']));
+    if (!u || typeof u !== 'object') return {};
+    return Object.fromEntries(Object.entries(u).map(([k, v]) => [k, typeof v === 'string' ? v : '']));
+}
+
+/**
+ * Everything that can be switched, as one list the planner reads.
+ *
+ * @param {{manifests?: object[], pluginStates?: object, toolStates?: object}} input
+ * @returns {Map<string, {name: string, kind: 'tool'|'plugin', displayName: string, enabled: boolean,
+ *   locked: boolean, requires: string[], uses: Object.<string,string>, supersedes: string[], closedSource: boolean}>}
+ */
+export function switchableUnits({manifests = [], pluginStates = {}, toolStates = {}} = {}) {
+    const units = new Map();
+    for (const t of CORE_TOOLS) {
+        const s = toolStates[t.name] || {};
+        units.set(t.name, {name: t.name, kind: 'tool', displayName: t.displayName, icon: t.icon,
+            enabled: s.enabled !== false, locked: s.locked === true, requires: [], uses: {}, supersedes: [], closedSource: false});
+    }
+    for (const m of manifests) {
+        if (!m?.name || units.has(m.name)) continue;
+        const s = pluginStates[m.name] || {};
+        units.set(m.name, {name: m.name, kind: 'plugin', displayName: m.displayName || m.name, icon: m.icon || 'package',
+            enabled: s.enabled === true, locked: s.locked === true, requires: requiresOf(m), uses: usesOf(m),
+            supersedes: Array.isArray(m.supersedes) ? m.supersedes : [], closedSource: m.closedSource === true});
+    }
+    return units;
+}
+
+/** The name as people read it. */
+const label = (units, name) => units.get(name)?.displayName || name;
+
+/**
+ * What a set of switch changes would do.
+ *
+ * - Switching off something an enabled plugin REQUIRES switches that plugin
+ *   off too (a cascade), recursively.
+ * - Switching on a plugin switches on what it requires, recursively.
+ * - A soft dependant (`uses`) stays on and the feature it loses is listed.
+ * - A locked switch cannot be moved unless `asManager`; a request or cascade
+ *   that would move one is refused.
+ * - A requirement that is not installed at all refuses the plugin.
+ *
+ * Only dependencies touched by THIS change are followed: a plugin that was
+ * already enabled with a requirement off (a broken state the loader refuses
+ * to run) is left as it is.
+ *
+ * @param {Map} units            from switchableUnits()
+ * @param {Object.<string, boolean>} requested  name -> on/off
+ * @param {{asManager?: boolean}} [opts]
+ * @returns {{ok: boolean, changes: Object.<string, boolean>, cascaded: object[], losses: object[], refused: object[]}}
+ */
+export function planSwitch(units, requested = {}, {asManager = false} = {}) {
+    const next = new Map([...units].map(([n, u]) => [n, u.enabled]));
+    const was = (n) => units.get(n)?.enabled === true;
+    const may = (n) => asManager || !units.get(n)?.locked;
+    const refused = [];
+    const cascaded = [];
+    const cascadeOn = new Set();
+
+    for (const [name, on] of Object.entries(requested)) {
+        const u = units.get(name);
+        if (!u) { refused.push({name, reason: 'is not installed on this site'}); continue; }
+        if (!!on === u.enabled) continue;
+        if (!may(name)) { refused.push({name, reason: 'is locked by the site\'s manager'}); continue; }
+        next.set(name, !!on);
+    }
+    const askedOn = (n) => requested[n] === true || cascadeOn.has(n);
+
+    // Settle to a fixed point: each pass may switch something that changes
+    // what another needs. Bounded - each unit changes direction at most once.
+    for (let pass = 0, changed = true; changed && pass <= units.size + 1; pass++) {
+        changed = false;
+        for (const [name, u] of units) {
+            if (next.get(name) !== true) continue;
+            for (const r of u.requires) {
+                if (next.get(r) === true) continue;
+                const turningOn = !was(name);
+                // Only follow a dependency this change touches.
+                if (!turningOn && !was(r)) continue;
+                if (turningOn && askedOn(name)) {
+                    const ru = units.get(r);
+                    if (!ru) {
+                        refused.push({name, reason: `needs ${r}, which is not installed`});
+                    } else if (requested[r] === false) {
+                        refused.push({name, reason: `needs ${label(units, r)}, which is being switched off`});
+                    } else if (!may(r)) {
+                        refused.push({name, reason: `needs ${label(units, r)}, which is locked off`});
+                    } else {
+                        next.set(r, true);
+                        cascadeOn.add(r);
+                        cascaded.push({name: r, displayName: label(units, r), enabled: true, because: name, becauseName: label(units, name)});
+                        changed = true;
+                        continue;
+                    }
+                    next.set(name, false);
+                    changed = true;
+                    break;
+                }
+                // r is going off (or never came on): name has to follow it.
+                if (!may(name)) {
+                    refused.push({name: r, reason: `${label(units, name)} needs it and is locked on`});
+                    next.set(r, true);
+                } else {
+                    next.set(name, false);
+                    cascaded.push({name, displayName: label(units, name), enabled: false, because: r, becauseName: label(units, r)});
+                }
+                changed = true;
+                break;
+            }
+        }
+    }
+
+    // A cascade may have been undone by a later refusal; keep only real moves.
+    const changes = {};
+    for (const [n, on] of next) if (on !== was(n)) changes[n] = on;
+    const real = cascaded.filter(c => changes[c.name] === c.enabled);
+
+    const losses = [];
+    for (const [name, u] of units) {
+        if (next.get(name) !== true) continue;
+        for (const [t, reason] of Object.entries(u.uses)) {
+            if (was(t) && next.get(t) === false) {
+                losses.push({name, displayName: u.displayName, tool: t, toolName: label(units, t), reason});
+            }
+        }
+    }
+
+    return {ok: refused.length === 0, changes, cascaded: real, losses, refused};
+}
+
+/**
+ * Which enabled plugins cannot run because something they require is not
+ * running. `active` is the set that would load (after entitlement and
+ * supersession); built-in Tools are active when switched on.
+ *
+ * @param {object[]} manifests
+ * @param {Set<string>} active  plugin names that would otherwise load
+ * @param {(name: string) => boolean} toolOn
+ * @returns {Map<string, string>} plugin -> the requirement it is missing
+ */
+export function unmetRequirements(manifests, active, toolOn = isToolEnabled) {
+    const byName = new Map(manifests.map(m => [m.name, m]));
+    const running = new Set(active);
+    const blocked = new Map();
+    for (let changed = true; changed;) {
+        changed = false;
+        for (const name of running) {
+            const missing = requiresOf(byName.get(name)).find(r => (isCoreTool(r) ? !toolOn(r) : !running.has(r)));
+            if (missing) {
+                running.delete(name);
+                blocked.set(name, missing);
+                changed = true;
+            }
+        }
+    }
+    return blocked;
+}

package/server/services/users.js

@@ -28,6 +28,8 @@ async function ensureDir() {
  */
 function stripPassword(user) {
     const {password, resetTokenHash, resetTokenExpiry, ...safe} = user;
+    // When an unused reset link is still open - the time only, never the token.
+    if (resetTokenHash && Date.parse(resetTokenExpiry) > Date.now()) safe.resetLinkExpires = resetTokenExpiry;
     return safe;
 }
 
@@ -182,6 +184,12 @@ export async function updateUser(id, updates) {
         }
     }
 
+    // Reset tokens are written by setResetToken/clearResetToken only - never by an
+    // update, which takes whole records from clients.
+    delete updates.resetTokenHash;
+    delete updates.resetTokenExpiry;
+    delete updates.resetLinkExpires;
+
     if (updates.password) {
         updates.password = await bcrypt.hash(updates.password, config.auth.bcryptRounds);
     }