domma-cms 0.88.0 → 0.89.0

package/plugins/seo/config.js

@@ -0,0 +1,7 @@
+/**
+ * SEO - defaults. The site's own choices are saved from the settings
+ * slideover into config/plugins.json (see admin/lib/settings.js).
+ */
+import {DEFAULT_SETTINGS} from './admin/lib/settings.js';
+
+export default DEFAULT_SETTINGS;

package/plugins/seo/plugin.js

@@ -0,0 +1,477 @@
+/**
+ * SEO (free) - how a Domma CMS site looks to search engines, and what to fix.
+ *
+ *  - Audit: every URL in the sitemap fetched in-process and judged (title,
+ *    description, headings, image descriptions, links, focus keyphrase,
+ *    canonical, share image, structured data), plus titles and descriptions
+ *    used on more than one page. Runs every `audit.everyHours`, or on demand.
+ *  - An editor per URL: the search result and share card as they will look,
+ *    the checks, and the fields. Core pages are edited in place (page.seo);
+ *    anything a plugin serves (a blog post) gets an override kept here.
+ *  - Redirects (301/302/307/308, 410 gone; "/old/*" prefixes), added for you
+ *    when a page is renamed, re-aimed so they never chain.
+ *  - The sitemap (core 0.89 sources) and robots.txt, shaped by the settings;
+ *    Organization / LocalBusiness JSON-LD on the home page, BlogPosting on posts.
+ *
+ * Needs core 0.89 (seo:meta, sitemap sources); on an older engine the audit,
+ * redirects and editor work and the rest says it is waiting for an update.
+ *
+ * Global (fastify-plugin): the redirect guard sees every request.
+ *
+ * Routes (/api/plugins/seo; the `seo` permission: read / manage):
+ *   GET /overview · GET /count · GET /audit · POST /audit · GET|PUT /item
+ *   GET|POST /redirects · PUT|DELETE /redirects/:id · POST /redirects/import
+ *   GET /redirects/test · GET /sitemap · GET|PUT /settings · GET /extensions
+ */
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import fp from 'fastify-plugin';
+import defaultConfig from './config.js';
+import {createStore} from './server/store.js';
+import {auditAll, auditOne, AUDIT_UA, fetchLocal, hostOf} from './server/audit.js';
+import {analyse, scanHtml, siteIssues} from './admin/lib/analyse.js';
+import {chains, checkRule, matchRedirect, MAX_RULES, normalisePath, onMoved} from './admin/lib/redirects.js';
+import {applySeo, robotsLines} from './admin/lib/schema.js';
+import {checkSettings, excluded, mergeDefaults} from './admin/lib/settings.js';
+import {seoRegistry} from './server/registry.js';
+import {getConfig, saveConfig} from '../../server/config.js';
+import {getPage, listPages, updatePage} from '../../server/services/content.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const NAME = 'seo';
+const SKIP = /^\/(api|admin)(\/|$)/;
+
+async function seo(fastify, options = {}) {
+    let cfg = mergeDefaults({...defaultConfig, ...(options.settings ?? {})});
+    const hooks = options.hooks ?? {};
+    const log = fastify.log;
+    const store = createStore(path.join(__dirname, 'data'));
+    const hasCore = typeof hooks.registerSitemapSource === 'function';
+    const sitemap = hasCore ? await import('../../server/services/sitemap.js').catch(() => null) : null;
+    const {getBaseUrl} = await import('../../server/routes/public.js').catch(() => ({}));
+    const coreHooks = await import('../../server/services/hooks.js').catch(() => ({}));
+    const sourcesNow = () => { try { return coreHooks.getSitemapSources?.() || []; } catch { return []; } };
+    const site = () => getConfig('site') || {};
+    const originOf = (request) => {
+        try { return String(getBaseUrl?.(request) || site().baseUrl || '').replace(/\/+$/, ''); } catch { return ''; }
+    };
+
+    // ---------------------------------------------------------------------
+    // 1. Redirects - ahead of everything else
+    // ---------------------------------------------------------------------
+    let hitsDirty = false;
+    fastify.addHook('onRequest', async (request, reply) => {
+        try {
+            if (request.method !== 'GET' && request.method !== 'HEAD') return;
+            const url = String(request.url || '');
+            if (SKIP.test(url)) return;
+            const rules = store.rules();
+            if (!rules.length) return;
+            const hit = matchRedirect(rules, url);
+            if (!hit) return;
+            if (request.headers['x-domma-seo'] !== 'audit') {
+                hit.rule.hits = (hit.rule.hits || 0) + 1;
+                hit.rule.lastHit = new Date().toISOString();
+                hitsDirty = true;
+            }
+            if (hit.code === 410) {
+                reply.code(410).header('content-type', 'text/plain; charset=utf-8').send('Gone');
+                return reply;
+            }
+            reply.code(hit.code).header('location', hit.location).header('cache-control', hit.code === 301 || hit.code === 308 ? 'public, max-age=3600' : 'no-store').send();
+            return reply;
+        } catch (err) {
+            log.warn(`[seo] redirect skipped: ${err.message}`);
+        }
+    });
+    const saveHits = setInterval(() => { if (hitsDirty) { hitsDirty = false; store.setRules(store.rules(), {soon: 0}); } }, 60_000);
+    saveHits.unref?.();
+
+    hooks.on?.('content:pageRenamed', ({from, to} = {}) => {
+        if (!cfg.redirects.onRename || !from || !to) return;
+        try {
+            store.setRules(onMoved(store.rules(), from, to, {id: newId()}));
+            log.info(`[seo] ${from} moved to ${to}: redirect added.`);
+        } catch (err) {
+            log.warn(`[seo] no redirect for the move of ${from}: ${err.message}`);
+        }
+    });
+
+    // ---------------------------------------------------------------------
+    // 2. What search engines are given (core 0.89 transforms)
+    // ---------------------------------------------------------------------
+    if (hasCore && typeof hooks.registerTransform === 'function') {
+        hooks.registerTransform('seo:meta', (meta, ctx) => {
+            try {
+                const origin = String(ctx?.baseUrl || '').replace(/\/+$/, '');
+                return applySeo(meta, {page: ctx?.page, kind: ctx?.kind, origin, siteTitle: ctx?.site?.title || '', settings: cfg,
+                    override: store.override(normalisePath(ctx?.page?.urlPath || '/') || '/')});
+            } catch (err) {
+                log.warn(`[seo] page tags left as they were: ${err.message}`);
+                return meta;
+            }
+        });
+        hooks.registerTransform('sitemap:entries', (entries) => {
+            const rules = store.rules();
+            const over = store.overrides();
+            return entries.filter(e => !excluded(e.urlPath, cfg.sitemap.exclude)
+                && cfg.sitemap.sources[e.source] !== false
+                && over[normalisePath(e.urlPath)]?.noindex !== true
+                && !(rules.length && matchRedirect(rules, e.urlPath)));
+        });
+        hooks.registerTransform('robots:lines', (lines, ctx) => robotsLines(lines, cfg.robots, ctx?.sitemapUrl));
+    } else {
+        log.warn('[seo] this engine has no SEO hooks (needs Domma CMS 0.89+): the sitemap, robots.txt and page tags are core\'s own until it is updated.');
+    }
+    const sitemapChanged = () => { try { hooks.sitemapChanged?.(); } catch { /* next rebuild */ } };
+
+    // ---------------------------------------------------------------------
+    // 3. The audit
+    // ---------------------------------------------------------------------
+    let running = null;
+    let progress = {done: 0, total: 0};
+
+    /** What to audit: the sitemap, plus published pages hidden from search engines (so they show as hidden). */
+    async function auditList(origin) {
+        const list = [];
+        const seen = new Set();
+        if (sitemap?.listSitemapEntries) {
+            for (const e of await sitemap.listSitemapEntries(origin, {log})) {
+                seen.add(e.urlPath);
+                list.push({urlPath: e.urlPath, source: e.source, title: e.title});
+            }
+        }
+        for (const p of await listPages()) {
+            if (seen.has(p.urlPath) || p.status !== 'published' || (p.visibility || 'public') !== 'public' || p.urlPath === '/404') continue;
+            list.push({urlPath: p.urlPath, source: 'pages', title: p.title, noindex: p.seo?.noindex === true, ...(sitemap && {unlisted: true})});
+        }
+        return list;
+    }
+    async function focusMap() {
+        const map = {};
+        for (const p of await listPages()) if (p.seo?.focus) map[p.urlPath] = p.seo.focus;
+        for (const [p, o] of Object.entries(store.overrides())) if (o.focus) map[p] = o.focus;
+        return map;
+    }
+    async function runAudit(origin) {
+        if (running) return running;
+        running = (async () => {
+            const started = Date.now();
+            try {
+                const o = origin || store.audit().origin || String(site().baseUrl || '').replace(/\/+$/, '');
+                const [list, focus] = await Promise.all([auditList(o), focusMap()]);
+                progress = {done: 0, total: list.length};
+                const results = await auditAll(fastify, list, {origin: o, focusOf: (p) => focus[p] || '', limits: cfg.audit,
+                    onProgress: (done, total) => { progress = {done, total}; }});
+                store.setAudit({at: new Date().toISOString(), ms: Date.now() - started, origin: o, results});
+                registry.emit('audit', store.audit());
+                return store.audit();
+            } catch (err) {
+                log.warn(`[seo] audit failed: ${err.message}`);
+                return store.audit();
+            } finally {
+                running = null;
+            }
+        })();
+        return running;
+    }
+    function summary(a = store.audit()) {
+        const rows = a.results || [];
+        const judged = rows.filter(r => typeof r.score === 'number' && !r.noindex);
+        const issues = siteIssues(rows);
+        return {
+            at: a.at, ms: a.ms || 0, origin: a.origin || '', running: Boolean(running), progress,
+            pages: rows.length,
+            score: judged.length ? Math.round(judged.reduce((n, r) => n + r.score, 0) / judged.length) : null,
+            failing: rows.filter(r => r.error || r.failing > 0).length,
+            broken: rows.filter(r => r.error).length,
+            hidden: rows.filter(r => r.noindex).length,
+            duplicates: issues.duplicateTitles.length + issues.duplicateDescriptions.length,
+            issues
+        };
+    }
+
+    // ---------------------------------------------------------------------
+    // 4. Extensions (SEO Pro) - see server/registry.js
+    // ---------------------------------------------------------------------
+    const registry = seoRegistry();
+    Object.assign(registry.services, {
+        version: 1,
+        settings: () => cfg,
+        listEntries: async (origin) => (sitemap?.listSitemapEntries ? sitemap.listSitemapEntries(origin, {log}) : []),
+        auditList,
+        fetchPage: (urlPath, origin) => fetchLocal(fastify, urlPath, hostOf(origin)),
+        scanHtml, analyse,
+        audit: {latest: () => store.audit(), summary: () => summary(), run: (origin) => runAudit(origin)},
+        redirects: {
+            list: () => store.rules(),
+            match: (p) => matchRedirect(store.rules(), p),
+            add: (input) => addRule(input)
+        },
+        auditUserAgent: AUDIT_UA
+    });
+
+    function addRule(input) {
+        const rules = store.rules();
+        if (rules.length >= MAX_RULES) return {errors: {from: `There are ${MAX_RULES} redirects already.`}};
+        const {errors, rule} = checkRule(input, rules);
+        if (Object.keys(errors).length) return {errors};
+        const full = {id: newId(), ...rule, hits: 0, lastHit: null, at: new Date().toISOString()};
+        store.setRules([...rules, full]);
+        sitemapChanged();
+        return {rule: full};
+    }
+
+    // ---------------------------------------------------------------------
+    // 5. The API
+    // ---------------------------------------------------------------------
+    fastify.register(async (routes) => {
+        const {authenticate, requirePermission} = options.auth ?? {};
+        const may = (action) => ({preHandler: [authenticate, requirePermission('seo', action)]});
+
+        routes.get('/overview', may('read'), async (request) => {
+            const s = summary();
+            const rules = store.rules();
+            return {...s, redirects: rules.length, chains: chains(rules).length, hooks: hasCore,
+                origin: s.origin || originOf(request), siteSeo: site().seo || {}};
+        });
+
+        routes.get('/count', may('read'), async () => {
+            const s = summary();
+            if (!s.at) return {count: 0, label: 'Not checked yet'};
+            const bad = (store.audit().results || []).filter(r => r.error || r.failing > 0);
+            return {
+                count: bad.length,
+                label: bad.length ? `${bad.length} ${bad.length === 1 ? 'page has' : 'pages have'} SEO problems` : 'No SEO problems found',
+                ...(s.broken && {tone: 'danger'}),
+                details: {title: 'SEO', rows: [{label: 'Score', value: s.score === null ? '—' : `${s.score}%`}, {label: 'Pages', value: String(s.pages)}],
+                    items: bad.slice(0, 5).map(r => ({text: r.urlPath, meta: r.error ? 'broken' : `${r.failing} failing`})),
+                    empty: 'Every page passes.'}
+            };
+        });
+
+        routes.get('/audit', may('read'), async () => {
+            const a = store.audit();
+            return {...summary(a), results: (a.results || []).map(r => ({...r, checks: undefined, problems: (r.checks || []).filter(c => c.status === 'fail' || c.status === 'warn').map(c => c.title)}))};
+        });
+
+        routes.post('/audit', may('read'), async (request) => {
+            const origin = originOf(request);
+            const p = runAudit(origin);
+            if (request.body?.wait === true) await p;
+            return summary();
+        });
+
+        routes.get('/item', may('read'), async (request, reply) => {
+            const urlPath = normalisePath(request.query?.path || '') || '/';
+            const origin = originOf(request);
+            const page = await getPage(urlPath).catch(() => null);
+            const override = store.override(urlPath) || {};
+            const fields = page
+                ? {title: page.seo?.title || '', description: page.seo?.description || '', image: page.seo?.image || '', noindex: page.seo?.noindex === true, focus: page.seo?.focus || ''}
+                : {title: override.title || '', description: override.description || '', image: override.image || '', noindex: override.noindex === true, focus: override.focus || ''};
+            const fetched = await fetchLocal(fastify, urlPath, hostOf(origin)).catch(err => ({status: 0, error: err.message}));
+            if (!page && fetched.status === 404) return reply.code(404).send({error: `Nothing is served at ${urlPath}.`});
+            // Only a page that is really served is judged - a draft answers with the 404 page.
+            const facts = fetched.status === 200 && fetched.html ? scanHtml(fetched.html) : null;
+            const judged = facts ? analyse(facts, {urlPath, focus: fields.focus, limits: cfg.audit, origin}) : null;
+            const s = site();
+            return {
+                urlPath, origin, kind: page ? 'page' : 'url',
+                page: page ? {title: page.title, status: page.status, description: page.description || ''} : null,
+                fields,
+                live: facts ? {title: facts.title, description: facts.description || '', image: facts.og.image, h1: facts.headings.find(h => h.level === 1)?.text || '', words: facts.words, canonical: facts.canonical} : null,
+                status: fetched.status || 0,
+                defaults: {separator: s.seo?.titleSeparator || ' | ', siteTitle: s.seo?.defaultTitle || s.title || '', description: s.seo?.defaultDescription || '', image: s.seo?.defaultImage || ''},
+                analysis: judged,
+                limits: cfg.audit,
+                redirect: matchRedirect(store.rules(), urlPath)?.rule || null
+            };
+        });
+
+        routes.put('/item', may('manage'), async (request, reply) => {
+            const b = request.body ?? {};
+            const urlPath = normalisePath(b.path || '') || '/';
+            const clip = (v, n) => String(v ?? '').trim().slice(0, n);
+            const fields = {title: clip(b.title, 200), description: clip(b.description, 400), image: clip(b.image, 500), noindex: b.noindex === true, focus: clip(b.focus, 100)};
+            if (fields.image && !/^(https?:\/\/|\/)/i.test(fields.image)) return reply.code(400).send({error: 'The image: a path like /media/photo.jpg, or a full web address.'});
+            const page = await getPage(urlPath).catch(() => null);
+            if (page) {
+                // Empty means "use the default": sent as null, the core's merge removes the key.
+                const seoFields = Object.fromEntries(Object.entries(fields).map(([k, v]) => [k, v === '' || v === false ? null : v]));
+                await updatePage(urlPath, {seo: seoFields}, undefined, {author: request.user?.email || request.user?.name});
+            } else {
+                store.setOverride(urlPath, fields);
+            }
+            sitemapChanged();
+            // The audit row for this URL, judged again now.
+            const a = store.audit();
+            if (a.results?.length) {
+                const at = a.results.findIndex(r => r.urlPath === urlPath);
+                if (at >= 0) {
+                    const row = await auditOne(fastify, a.results[at], {origin: a.origin || originOf(request), focus: fields.focus, limits: cfg.audit});
+                    const results = [...a.results];
+                    results[at] = row;
+                    store.setAudit({...a, results});
+                }
+            }
+            return {ok: true, kind: page ? 'page' : 'url'};
+        });
+
+        // Redirects
+        routes.get('/redirects', may('read'), async () => {
+            const rules = store.rules();
+            return {rules, chains: chains(rules).map(c => ({id: c.rule.id, via: c.via.id})), max: MAX_RULES, onRename: cfg.redirects.onRename};
+        });
+        routes.post('/redirects', may('manage'), async (request, reply) => {
+            const r = addRule(request.body ?? {});
+            if (r.errors) return reply.code(400).send({error: Object.values(r.errors).join(' '), errors: r.errors});
+            return r;
+        });
+        routes.put('/redirects/:id', may('manage'), async (request, reply) => {
+            const rules = store.rules();
+            const old = rules.find(r => r.id === request.params.id);
+            if (!old) return reply.code(404).send({error: 'No such redirect.'});
+            const others = rules.filter(r => r !== old);
+            const {errors, rule} = checkRule({...old, ...request.body, auto: false}, others);
+            if (Object.keys(errors).length) return reply.code(400).send({error: Object.values(errors).join(' '), errors});
+            const next = {...old, ...rule};
+            delete next.auto;
+            store.setRules(rules.map(r => (r === old ? next : r)));
+            sitemapChanged();
+            return {rule: next};
+        });
+        routes.delete('/redirects/:id', may('manage'), async (request) => {
+            const ids = new Set(String(request.params.id).split(','));
+            store.setRules(store.rules().filter(r => !ids.has(r.id)));
+            sitemapChanged();
+            return {ok: true};
+        });
+        routes.post('/redirects/import', may('manage'), async (request) => {
+            const text = String(request.body?.csv ?? '').slice(0, 1_000_000);
+            const added = [];
+            const skipped = [];
+            for (const [i, line] of text.split(/\r?\n/).entries()) {
+                const cells = line.split(/[,\t]/).map(c => c.trim().replace(/^"|"$/g, ''));
+                if (!cells[0] || cells[0].startsWith('#') || /^(from|source|old)/i.test(cells[0])) continue;
+                const r = addRule({from: cells[0], to: cells[1], code: cells[2] || 301, note: cells[3] || 'Imported'});
+                if (r.errors) skipped.push({line: i + 1, from: cells[0], why: Object.values(r.errors).join(' ')});
+                else added.push(r.rule);
+                if (added.length + skipped.length >= 2000) break;
+            }
+            return {added: added.length, skipped};
+        });
+        routes.get('/redirects/test', may('read'), async (request) => {
+            const hops = [];
+            let at = String(request.query?.path || '');
+            const rules = store.rules();
+            for (let i = 0; i < 10 && at; i++) {
+                const hit = matchRedirect(rules, at);
+                if (!hit) break;
+                hops.push({from: at, to: hit.location, code: hit.code, id: hit.rule.id});
+                if (hit.code === 410 || /^https?:/i.test(hit.location)) break;
+                at = hit.location;
+            }
+            return {hops};
+        });
+
+        // Sitemap and robots
+        routes.get('/sitemap', may('read'), async (request) => {
+            const origin = originOf(request);
+            let entries = [];
+            let raw = [];
+            if (sitemap?.listSitemapEntries) {
+                entries = await sitemap.listSitemapEntries(origin, {log});
+                // Before this plugin's own filter, to show what it leaves out and why.
+                raw = await rawEntries(origin);
+            }
+            const kept = new Set(entries.map(e => e.urlPath));
+            const sources = {};
+            for (const e of raw) {
+                sources[e.source] ??= {id: e.source, count: 0, listed: 0, on: cfg.sitemap.sources[e.source] !== false};
+                sources[e.source].count++;
+                if (kept.has(e.urlPath)) sources[e.source].listed++;
+            }
+            const rules = store.rules();
+            const over = store.overrides();
+            const left = raw.filter(e => !kept.has(e.urlPath)).map(e => ({...e,
+                why: cfg.sitemap.sources[e.source] === false ? 'Its source is switched off'
+                    : excluded(e.urlPath, cfg.sitemap.exclude) ? 'Excluded in the settings'
+                        : over[e.urlPath]?.noindex ? 'Hidden from search engines'
+                            : matchRedirect(rules, e.urlPath) ? 'Redirected' : 'Left out'}));
+            const {buildRobotsTxt} = sitemap || {};
+            return {hooks: hasCore, origin, entries, left, sources: Object.values(sources),
+                labels: {pages: 'Pages', ...Object.fromEntries(sourcesNow().map(s => [s.id, s.label]))},
+                robots: buildRobotsTxt ? buildRobotsTxt(origin) : ''};
+        });
+
+        routes.get('/settings', may('read'), async () => ({settings: cfg, hooks: hasCore}));
+        routes.put('/settings', may('manage'), async (request, reply) => {
+            const {errors, settings} = checkSettings(request.body ?? {}, cfg);
+            if (Object.keys(errors).length) return reply.code(400).send({error: Object.values(errors).join(' '), errors});
+            const plugins = getConfig('plugins') ?? {};
+            plugins[NAME] ??= {};
+            plugins[NAME].settings = settings;
+            saveConfig('plugins', plugins);
+            cfg = settings;
+            sitemapChanged();
+            schedule();
+            return {settings: cfg, hooks: hasCore};
+        });
+
+        routes.get('/extensions', may('read'), async () => ({
+            tabs: registry.list().flatMap(x => x.tabs.map(t => ({...t, owner: x.owner, ownerLabel: x.label})))
+        }));
+    }, {prefix: `/api/plugins/${NAME}`});
+
+    /** The sitemap entries before this plugin's filter (core's sources + pages). */
+    async function rawEntries(origin) {
+        const pages = (await listPages()).filter(p => p.status === 'published' && (p.visibility || 'public') === 'public' && p.urlPath !== '/404' && !p.seo?.noindex)
+            .map(p => ({urlPath: p.urlPath, title: p.title, source: 'pages'}));
+        const seen = new Set(pages.map(p => p.urlPath));
+        const out = [...pages];
+        for (const s of sourcesNow()) {
+            try {
+                for (const e of (await s.list({baseUrl: origin})) || []) {
+                    if (!e?.urlPath || seen.has(e.urlPath)) continue;
+                    seen.add(e.urlPath);
+                    out.push({urlPath: e.urlPath, title: e.title || '', source: s.id});
+                }
+            } catch { /* shown as nothing from that source */ }
+        }
+        return out;
+    }
+
+    // ---------------------------------------------------------------------
+    // 6. On a schedule
+    // ---------------------------------------------------------------------
+    let timer = null;
+    function schedule() {
+        if (timer) clearInterval(timer);
+        timer = null;
+        const hours = cfg.audit.everyHours;
+        if (!hours) return;
+        timer = setInterval(() => { runAudit().catch(() => {}); }, hours * 3_600_000);
+        timer.unref?.();
+    }
+    schedule();
+    // The first audit a few minutes after start, if the last is older than the interval.
+    const first = setTimeout(() => {
+        const at = Date.parse(store.audit().at || 0) || 0;
+        if (cfg.audit.everyHours && Date.now() - at > cfg.audit.everyHours * 3_600_000) runAudit().catch(() => {});
+    }, 3 * 60_000);
+    first.unref?.();
+
+    fastify.addHook('onClose', (_i, done) => {
+        clearInterval(timer); clearInterval(saveHits); clearTimeout(first);
+        if (hitsDirty) store.setRules(store.rules(), {soon: 0});
+        store.close();
+        done();
+    });
+}
+
+function newId() {
+    return `r${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`;
+}
+
+export default fp(seo, {name: 'seo'});

package/plugins/seo/plugin.json

@@ -0,0 +1,64 @@
+{
+  "name": "seo",
+  "displayName": "SEO",
+  "version": "1.0.0",
+  "tier": "free",
+  "description": "How the site looks to search engines, and what to fix: an audit of every page (titles, descriptions, headings, image descriptions, links, a focus keyphrase), the search result and share card as they will look, redirects that are added for you when a page moves, and control of the sitemap, robots.txt and structured data.",
+  "author": "Domma CMS",
+  "date": "2026-09-27",
+  "icon": "search",
+  "permissions": [
+    {
+      "key": "seo",
+      "label": "SEO",
+      "group": "Plugins",
+      "description": "See the audit, redirects and sitemap (read) or change titles, descriptions, redirects and settings (manage).",
+      "actions": [
+        {
+          "key": "read",
+          "label": "View",
+          "description": "See the audit, redirects and sitemap; run the audit"
+        },
+        {
+          "key": "manage",
+          "label": "Manage",
+          "description": "Change page titles and descriptions, redirects and settings"
+        }
+      ],
+      "grant": [
+        "admin"
+      ]
+    }
+  ],
+  "admin": {
+    "sidebar": [
+      {
+        "id": "seo",
+        "text": "SEO",
+        "icon": "search",
+        "url": "#/plugins/seo",
+        "section": "#/plugins/seo",
+        "permission": "seo",
+        "countUrl": "/api/plugins/seo/count"
+      }
+    ],
+    "routes": [
+      {
+        "path": "/plugins/seo",
+        "view": "seo-main",
+        "title": "SEO"
+      },
+      {
+        "path": "/plugins/seo/:tab",
+        "view": "seo-main",
+        "title": "SEO"
+      }
+    ],
+    "views": {
+      "seo-main": {
+        "entry": "seo/admin/views/seo.js",
+        "exportName": "seoView"
+      }
+    }
+  }
+}

package/plugins/seo/server/audit.js

@@ -0,0 +1,106 @@
+/**
+ * SEO - the audit: every URL in the sitemap (and every published page hidden
+ * from search engines), fetched INSIDE the process with fastify.inject - no
+ * network, no certificate, the same HTML a visitor gets - and judged by
+ * admin/lib/analyse.js.
+ *
+ * The requests carry `user-agent: DommaSEO/1 (audit)` and `x-domma-seo: audit`
+ * so analytics and SEO Pro's 404 log can leave them out.
+ */
+import {analyse, scanHtml} from '../admin/lib/analyse.js';
+
+export const AUDIT_UA = 'DommaSEO/1 (audit)';
+const CONCURRENCY = 3;
+const MAX_URLS = 1000;
+
+/**
+ * Fetch one page of this site, in-process.
+ *
+ * @returns {Promise<{status: number, ms: number, html: string, location: string, type: string}>}
+ */
+export async function fetchLocal(fastify, urlPath, {host = 'localhost', proto = 'https'} = {}) {
+    const started = Date.now();
+    const res = await fastify.inject({
+        method: 'GET', url: urlPath,
+        headers: {host, 'x-forwarded-proto': proto, 'user-agent': AUDIT_UA, 'x-domma-seo': 'audit', accept: 'text/html'}
+    });
+    const type = String(res.headers['content-type'] || '');
+    return {
+        status: res.statusCode,
+        ms: Date.now() - started,
+        html: /html/i.test(type) ? res.body : '',
+        location: String(res.headers.location || ''),
+        type
+    };
+}
+
+/** One URL: fetched, scanned and judged - an audit row. */
+export async function auditOne(fastify, entry, {origin, focus = '', limits = {}}) {
+    const {host, proto} = hostOf(origin);
+    const row = {urlPath: entry.urlPath, source: entry.source || 'pages', label: entry.title || '', noindex: Boolean(entry.noindex), focus,
+        ...(entry.unlisted && {unlisted: true})};
+    try {
+        const r = await fetchLocal(fastify, entry.urlPath, {host, proto});
+        row.status = r.status;
+        row.ms = r.ms;
+        if (r.status >= 300 && r.status < 400) {
+            row.error = `Redirects to ${r.location || 'somewhere'} - it should not be in the sitemap.`;
+            return row;
+        }
+        if (r.status !== 200) {
+            row.error = r.status === 404 ? 'Not found - but it is in the sitemap.' : `Answered ${r.status}.`;
+            return row;
+        }
+        if (!r.html) {
+            row.error = `Not a web page (${r.type || 'no type'}).`;
+            return row;
+        }
+        const facts = scanHtml(r.html);
+        const judged = analyse(facts, {urlPath: entry.urlPath, focus, limits, origin});
+        Object.assign(row, {
+            title: facts.title, description: facts.description || '', canonical: facts.canonical,
+            ogImage: facts.og.image, words: facts.words, noindex: /noindex/i.test(facts.robots) || row.noindex,
+            h1: facts.headings.find(h => h.level === 1)?.text || '',
+            links: facts.links.length,
+            score: judged.score, failing: judged.failing, warnings: judged.warnings,
+            checks: judged.checks
+        });
+    } catch (err) {
+        row.error = `Could not be fetched: ${err.message}`;
+    }
+    return row;
+}
+
+/**
+ * Audit a list of entries, a few at a time.
+ *
+ * @param {object} fastify
+ * @param {object[]} entries - {urlPath, source, title, noindex}
+ * @param {object} opts - {origin, focusOf(urlPath), limits, onProgress(done, total)}
+ * @returns {Promise<object[]>}
+ */
+export async function auditAll(fastify, entries, {origin, focusOf = () => '', limits = {}, onProgress = () => {}}) {
+    const list = entries.slice(0, MAX_URLS);
+    const out = new Array(list.length);
+    let next = 0;
+    let done = 0;
+    const worker = async () => {
+        while (next < list.length) {
+            const i = next++;
+            out[i] = await auditOne(fastify, list[i], {origin, focus: focusOf(list[i].urlPath), limits});
+            onProgress(++done, list.length);
+        }
+    };
+    await Promise.all(Array.from({length: Math.min(CONCURRENCY, list.length)}, worker));
+    return out;
+}
+
+/** "https://example.com" -> {host: 'example.com', proto: 'https'}. */
+export function hostOf(origin) {
+    try {
+        const u = new URL(origin);
+        return {host: u.host, proto: u.protocol.replace(':', '')};
+    } catch {
+        return {host: 'localhost', proto: 'http'};
+    }
+}