domma-cms 0.88.1 → 0.89.0

package/server/services/renderer.js

@@ -292,10 +292,16 @@ export async function renderPage(page, opts = {}) {
     }
     const pageBodyStyle = pageBodyStyleParts.join(';');
 
-    const seoTitle = escapeHtml(page.seo?.title || `${page.title}${site.seo?.titleSeparator || ' | '}${site.seo?.defaultTitle || site.title}`);
-    const seoDescription = escapeHtml(page.seo?.description || site.seo?.defaultDescription || '');
-    const ogImage = escapeHtml(page.seo?.image || site.seo?.defaultImage || '');
-    const seoTags = buildSeoTags({page, site, baseUrl, seoTitle, seoDescription, ogImage});
+    const seoMeta = transformSeoMeta(buildSeoMeta({
+        page, site, baseUrl,
+        title: page.seo?.title || `${page.title}${site.seo?.titleSeparator || ' | '}${site.seo?.defaultTitle || site.title}`,
+        description: page.seo?.description || site.seo?.defaultDescription || '',
+        image: page.seo?.image || site.seo?.defaultImage || ''
+    }), {page, site, baseUrl, kind: 'page'});
+    const seoTitle = escapeHtml(seoMeta.title);
+    const seoDescription = escapeHtml(seoMeta.description);
+    const ogImage = escapeHtml(seoMeta.og?.image || seoMeta.image || '');
+    const seoTags = renderSeoTags(seoMeta);
 
     const dconfig = page.dconfig || null;
     // Escape </script> to prevent injection via dconfig values in the inline script block
@@ -510,63 +516,43 @@ function toTitleCase(str) {
 }
 
 /**
- * Build the consolidated SEO `<meta>` tag block: canonical link, Open Graph,
- * Twitter cards, JSON-LD, and a noindex hint when requested.
+ * The SEO facts of one render, raw (not escaped): what the `<title>`, the
+ * description and the tag block are built from. Plugins change it through the
+ * 'seo:meta' transform (0.89) - the SEO plugin's overrides, JSON-LD presets and
+ * social variants - before anything is escaped.
  *
- * All values are HTML-escaped at the call site (seoTitle/Description/ogImage)
- * or here (canonicalUrl). JSON-LD is JSON.stringify'd and `</script>` is
- * escaped to prevent breaking out of the script context.
+ * Shape: {title, description, image, ogType, noindex, canonical, siteName,
+ *   twitterSite, og: {title?, description?, image?}, twitter: {title?,
+ *   description?, image?, card?}, robots?, jsonLd: object[], extra: [{tag:
+ *   'meta'|'link', attrs}]}
  *
  * @param {object} args
  * @param {object} args.page - Parsed page (urlPath, seo, title)
  * @param {object} args.site - Site config (seo defaults)
- * @param {string} args.baseUrl - Absolute origin for this request, derived by
- *   the route handler. Pass empty string to skip canonical/og:url emission.
- * @param {string} args.seoTitle - Already HTML-escaped
- * @param {string} args.seoDescription - Already HTML-escaped
- * @param {string} args.ogImage - Already HTML-escaped (may be empty)
- * @returns {string}
+ * @param {string} args.baseUrl - Absolute origin for this request. Empty skips
+ *   canonical/og:url and makes no URL absolute.
+ * @param {string} args.title - The document title (raw)
+ * @param {string} args.description - Raw
+ * @param {string} args.image - Raw, may be empty
+ * @returns {object}
  */
-function buildSeoTags({page, site, baseUrl, seoTitle, seoDescription, ogImage}) {
+function buildSeoMeta({page, site, baseUrl, title, description, image}) {
     const origin = (baseUrl || '').toString().trim().replace(/\/+$/, '');
     const urlPath = page.urlPath || '/';
-    const canonicalUrl = origin ? escapeHtml(`${origin}${urlPath}`) : '';
-    const ogType = escapeHtml(page.seo?.ogType || 'article');
-    const siteName = escapeHtml(site.title || '');
-    const twitterHandle = escapeHtml(site.social?.twitter || '');
-    const noindex = page.seo?.noindex === true;
-
-    const tags = [];
-    if (canonicalUrl) tags.push(`<link rel="canonical" href="${canonicalUrl}">`);
-    if (noindex) tags.push('<meta name="robots" content="noindex, nofollow">');
-
-    tags.push(`<meta property="og:title" content="${seoTitle}">`);
-    tags.push(`<meta property="og:description" content="${seoDescription}">`);
-    tags.push(`<meta property="og:type" content="${ogType}">`);
-    if (siteName) tags.push(`<meta property="og:site_name" content="${siteName}">`);
-    if (canonicalUrl) tags.push(`<meta property="og:url" content="${canonicalUrl}">`);
-    if (ogImage) tags.push(`<meta property="og:image" content="${ogImage}">`);
-
-    tags.push(`<meta name="twitter:card" content="${ogImage ? 'summary_large_image' : 'summary'}">`);
-    tags.push(`<meta name="twitter:title" content="${seoTitle}">`);
-    tags.push(`<meta name="twitter:description" content="${seoDescription}">`);
-    if (ogImage) tags.push(`<meta name="twitter:image" content="${ogImage}">`);
-    if (twitterHandle) tags.push(`<meta name="twitter:site" content="${twitterHandle}">`);
+    const canonical = origin ? `${origin}${urlPath}` : '';
+    const absImage = absoluteUrl(image, origin);
 
     // JSON-LD WebPage schema - gives search engines a structured summary.
     // Omit `url` when no baseUrl, since a relative URL in JSON-LD is invalid.
-    const jsonLd = {
+    const webPage = {
         '@context': 'https://schema.org',
         '@type': 'WebPage',
         name: page.title || '',
         description: page.seo?.description || site.seo?.defaultDescription || ''
     };
-    if (canonicalUrl) jsonLd.url = origin + urlPath;
-    if (page.seo?.image || site.seo?.defaultImage) {
-        jsonLd.image = page.seo?.image || site.seo?.defaultImage;
-    }
-    const jsonLdString = JSON.stringify(jsonLd).replace(/<\/script>/gi, '<\\/script>');
-    tags.push(`<script type="application/ld+json">${jsonLdString}</script>`);
+    if (canonical) webPage.url = canonical;
+    if (absImage) webPage.image = absImage;
+    const jsonLd = [webPage];
 
     // BreadcrumbList JSON-LD - emit whenever the page has a non-trivial path
     // and an origin is known (Schema.org requires absolute URLs in `item`).
@@ -574,7 +560,7 @@ function buildSeoTags({page, site, baseUrl, seoTitle, seoDescription, ogImage})
     // even when the on-page nav hides it.
     const breadcrumbItems = buildBreadcrumbItems(page, site);
     if (origin && breadcrumbItems.length > 1) {
-        const breadcrumbJsonLd = {
+        jsonLd.push({
             '@context': 'https://schema.org',
             '@type': 'BreadcrumbList',
             itemListElement: breadcrumbItems.map((item, i) => ({
@@ -583,9 +569,96 @@ function buildSeoTags({page, site, baseUrl, seoTitle, seoDescription, ogImage})
                 name: item.name,
                 item: origin + item.urlPath
             }))
-        };
-        const breadcrumbString = JSON.stringify(breadcrumbJsonLd).replace(/<\/script>/gi, '<\\/script>');
-        tags.push(`<script type="application/ld+json">${breadcrumbString}</script>`);
+        });
+    }
+
+    return {
+        title,
+        description,
+        image: absImage,
+        ogType: page.seo?.ogType || 'article',
+        noindex: page.seo?.noindex === true,
+        canonical,
+        siteName: site.title || '',
+        twitterSite: site.social?.twitter || '',
+        og: {},
+        twitter: {},
+        jsonLd,
+        extra: []
+    };
+}
+
+/** An absolute URL for og:image and JSON-LD: crawlers ignore relative ones. */
+function absoluteUrl(url, origin) {
+    const u = String(url || '').trim();
+    if (!u || !origin || /^[a-z][a-z0-9+.-]*:/i.test(u) || u.startsWith('//')) return u;
+    return `${origin}${u.startsWith('/') ? '' : '/'}${u}`;
+}
+
+/**
+ * Run the 'seo:meta' transforms. A transform that throws is logged and
+ * skipped: SEO extras never take a page down.
+ */
+function transformSeoMeta(meta, context) {
+    try {
+        const out = applyTransforms('seo:meta', meta, context);
+        return out && typeof out === 'object' ? out : meta;
+    } catch (err) {
+        console.warn(`[seo] a seo:meta transform failed, using the page's own: ${err.message}`);
+        return meta;
+    }
+}
+
+const SAFE_ATTR = /^[a-z][a-z0-9:_-]*$/i;
+
+/**
+ * Build the consolidated SEO `<meta>` tag block from buildSeoMeta()'s model:
+ * canonical link, Open Graph, Twitter cards, JSON-LD, and a robots hint.
+ *
+ * Every value is escaped here. JSON-LD is JSON.stringify'd with `<` escaped,
+ * so no `</script>` or `<!--` can break out of the script context.
+ *
+ * @param {object} meta
+ * @returns {string}
+ */
+function renderSeoTags(meta) {
+    const e = escapeHtml;
+    const ogTitle = meta.og?.title || meta.title;
+    const ogDescription = meta.og?.description ?? meta.description;
+    const ogImage = meta.og?.image || meta.image;
+    const twTitle = meta.twitter?.title || ogTitle;
+    const twDescription = meta.twitter?.description ?? ogDescription;
+    const twImage = meta.twitter?.image || ogImage;
+    const robots = meta.robots || (meta.noindex ? 'noindex, nofollow' : '');
+
+    const tags = [];
+    if (meta.canonical) tags.push(`<link rel="canonical" href="${e(meta.canonical)}">`);
+    if (robots) tags.push(`<meta name="robots" content="${e(robots)}">`);
+
+    tags.push(`<meta property="og:title" content="${e(ogTitle)}">`);
+    tags.push(`<meta property="og:description" content="${e(ogDescription)}">`);
+    tags.push(`<meta property="og:type" content="${e(meta.ogType)}">`);
+    if (meta.siteName) tags.push(`<meta property="og:site_name" content="${e(meta.siteName)}">`);
+    if (meta.canonical) tags.push(`<meta property="og:url" content="${e(meta.canonical)}">`);
+    if (ogImage) tags.push(`<meta property="og:image" content="${e(ogImage)}">`);
+
+    tags.push(`<meta name="twitter:card" content="${e(meta.twitter?.card || (twImage ? 'summary_large_image' : 'summary'))}">`);
+    tags.push(`<meta name="twitter:title" content="${e(twTitle)}">`);
+    tags.push(`<meta name="twitter:description" content="${e(twDescription)}">`);
+    if (twImage) tags.push(`<meta name="twitter:image" content="${e(twImage)}">`);
+    if (meta.twitterSite) tags.push(`<meta name="twitter:site" content="${e(meta.twitterSite)}">`);
+
+    for (const x of Array.isArray(meta.extra) ? meta.extra : []) {
+        if (!x || (x.tag !== 'meta' && x.tag !== 'link') || !x.attrs || typeof x.attrs !== 'object') continue;
+        const attrs = Object.entries(x.attrs).filter(([k, v]) => SAFE_ATTR.test(k) && v !== undefined && v !== null)
+            .map(([k, v]) => `${k}="${e(v)}"`).join(' ');
+        if (attrs) tags.push(`<${x.tag} ${attrs}>`);
+    }
+
+    for (const block of Array.isArray(meta.jsonLd) ? meta.jsonLd : []) {
+        if (!block || typeof block !== 'object') continue;
+        const json = JSON.stringify(block).replace(/</g, '\\u003c');
+        tags.push(`<script type="application/ld+json">${json}</script>`);
     }
 
     return tags.join('\n    ');
@@ -926,11 +999,9 @@ export async function renderBlogPage(templatePath, data = {}, seoMeta = {}) {
         return String(val);
     });
 
-    const seoTitle = escapeHtml(seoMeta.title ?? site.seo?.defaultTitle ?? site.title ?? 'Blog');
-    const seoDescription = escapeHtml(seoMeta.description ?? site.seo?.defaultDescription ?? '');
-    const ogImage = escapeHtml(seoMeta.ogImage ?? '');
-
     // Plugin fragments use the unified SEO builder with a synthetic page object.
+    // `item` ({type, id}) lets the 'seo:meta' transform know WHAT is being
+    // shown, not just where - optional; the SEO plugin keys its overrides by URL.
     const syntheticPage = {
         urlPath: seoMeta.urlPath || '/',
         title: seoMeta.title || site.title || '',
@@ -939,9 +1010,19 @@ export async function renderBlogPage(templatePath, data = {}, seoMeta = {}) {
             image: seoMeta.ogImage,
             ogType: seoMeta.ogType || 'website',
             noindex: seoMeta.noindex === true
-        }
+        },
+        ...(seoMeta.item && {item: seoMeta.item})
     };
-    const seoTags = buildSeoTags({page: syntheticPage, site, baseUrl, seoTitle, seoDescription, ogImage});
+    const meta = transformSeoMeta(buildSeoMeta({
+        page: syntheticPage, site, baseUrl,
+        title: seoMeta.title ?? site.seo?.defaultTitle ?? site.title ?? 'Blog',
+        description: seoMeta.description ?? site.seo?.defaultDescription ?? '',
+        image: seoMeta.ogImage ?? ''
+    }), {page: syntheticPage, site, baseUrl, kind: 'plugin'});
+    const seoTitle = escapeHtml(meta.title);
+    const seoDescription = escapeHtml(meta.description);
+    const ogImage = escapeHtml(meta.og?.image || meta.image || '');
+    const seoTags = renderSeoTags(meta);
 
     // Both render paths resolve the theme the same way. Wiring one and not the
     // other is the standing trap in this file.

package/server/services/sitemap.js

@@ -1,13 +1,18 @@
 /**
  * Sitemap Service
- * Builds sitemap.xml from the page list. Filter logic lives in
- * shouldIncludeInSitemap() - see the TODO below.
+ * Builds sitemap.xml from the page list plus every plugin sitemap source
+ * (hooks.registerSitemapSource, 0.89). Page filter logic lives in
+ * shouldIncludeInSitemap().
  *
  * Cache: callers should wrap generate() with the 'sitemap' tag so it
  * invalidates whenever a page is created, updated, renamed, or deleted.
  */
 import {listPages} from './content.js';
 import {getConfig} from '../config.js';
+import {applyTransforms, getSitemapSources} from './hooks.js';
+
+const CHANGEFREQ = new Set(['always', 'hourly', 'daily', 'weekly', 'monthly', 'yearly', 'never']);
+const validPriority = (p) => p !== undefined && p !== null && p !== '' && Number(p) >= 0 && Number(p) <= 1;
 
 /**
  * Decide whether a page should appear in sitemap.xml.
@@ -23,30 +28,84 @@ import {getConfig} from '../config.js';
  */
 function shouldIncludeInSitemap(page) {
     return page.status === 'published'
-        && page.visibility === 'public'
+        && (page.visibility || 'public') === 'public'
         && page.urlPath !== '/404'
         && !page.seo?.noindex;
 }
 
+/** The sitemap entry of a core page. */
+function pageEntry(page) {
+    return {urlPath: page.urlPath, title: page.title || '', lastmod: page.updatedAt || null, source: 'pages'};
+}
+
+/**
+ * Every URL the sitemap lists: core pages, then each plugin's sitemap source
+ * (hooks.registerSitemapSource), de-duplicated by path (the first wins), then
+ * the 'sitemap:entries' transform - where the SEO plugin drops or re-weights
+ * entries. Plain objects, so the SEO audit can use the same list.
+ *
+ * @param {string} baseUrl - Absolute origin (trailing slash stripped here)
+ * @param {{log?: {warn: Function}}} [opts]
+ * @returns {Promise<Array<{urlPath: string, title?: string, lastmod?: string|null,
+ *   changefreq?: string, priority?: number, image?: string, source: string}>>}
+ */
+export async function listSitemapEntries(baseUrl, {log = console} = {}) {
+    const normalised = normaliseBaseUrl(baseUrl);
+    const pages = await listPages();
+    const entries = pages.filter(shouldIncludeInSitemap).map(pageEntry);
+    const seen = new Set(entries.map(e => e.urlPath));
+
+    for (const source of getSitemapSources()) {
+        let items = [];
+        try {
+            items = await source.list({baseUrl: normalised});
+        } catch (err) {
+            log.warn?.(`[sitemap] source "${source.id}" skipped: ${err.message}`);
+            continue;
+        }
+        for (const item of Array.isArray(items) ? items : []) {
+            const urlPath = typeof item?.urlPath === 'string' ? item.urlPath.trim() : '';
+            if (!urlPath.startsWith('/') || urlPath.startsWith('//') || seen.has(urlPath)) continue;
+            seen.add(urlPath);
+            entries.push({
+                urlPath,
+                title: typeof item.title === 'string' ? item.title : '',
+                lastmod: item.lastmod || null,
+                ...(CHANGEFREQ.has(item.changefreq) && {changefreq: item.changefreq}),
+                ...(validPriority(item.priority) && {priority: Number(item.priority)}),
+                ...(typeof item.image === 'string' && item.image && {image: item.image}),
+                source: source.id
+            });
+        }
+    }
+
+    try {
+        const out = applyTransforms('sitemap:entries', entries, {baseUrl: normalised});
+        return Array.isArray(out) ? out.filter(e => e && typeof e.urlPath === 'string') : entries;
+    } catch (err) {
+        log.warn?.(`[sitemap] a sitemap:entries transform failed, using the plain list: ${err.message}`);
+        return entries;
+    }
+}
+
 /**
  * Build the full sitemap.xml document as a string.
  *
  * @param {string} baseUrl - Absolute origin (e.g. 'https://example.com'),
  *   typically derived from the incoming request. Trailing slash is stripped.
+ * @param {{log?: {warn: Function}}} [opts]
  * @returns {Promise<string>}
  */
-export async function generate(baseUrl) {
+export async function generate(baseUrl, opts = {}) {
     const normalised = normaliseBaseUrl(baseUrl);
-    const pages = await listPages();
-    const entries = pages
-        .filter(shouldIncludeInSitemap)
-        .map(page => buildUrlEntry(page, normalised));
-
-    return wrapInUrlset(entries);
+    const entries = await listSitemapEntries(normalised, opts);
+    const withImages = entries.some(e => e.image);
+    return wrapInUrlset(entries.map(e => buildUrlEntry(e, normalised)), {withImages});
 }
 
 /**
  * Build the robots.txt document. Points at /sitemap.xml on the given base URL.
+ * The 'robots:lines' transform may change the lines (the SEO plugin's editor).
  *
  * @param {string} baseUrl - Absolute origin, typically derived from the
  *   incoming request.
@@ -58,7 +117,7 @@ export function buildRobotsTxt(baseUrl) {
     const sitemapUrl = normalised ? `${normalised}/sitemap.xml` : '/sitemap.xml';
     const extra = (site.seo?.robotsExtra || '').toString().trim();
 
-    const lines = [
+    let lines = [
         'User-agent: *',
         'Allow: /',
         'Disallow: /admin/',
@@ -67,6 +126,12 @@ export function buildRobotsTxt(baseUrl) {
         `Sitemap: ${sitemapUrl}`
     ];
     if (extra) lines.push('', extra);
+    try {
+        const out = applyTransforms('robots:lines', lines, {baseUrl: normalised, sitemapUrl});
+        if (Array.isArray(out)) lines = out.map(l => String(l ?? ''));
+    } catch (err) {
+        console.warn(`[sitemap] a robots:lines transform failed, using the default: ${err.message}`);
+    }
     return lines.join('\n') + '\n';
 }
 
@@ -74,20 +139,26 @@ export function buildRobotsTxt(baseUrl) {
 // Helpers
 // ---------------------------------------------------------------------------
 
-function buildUrlEntry(page, baseUrl) {
-    const loc = escapeXml(baseUrl ? `${baseUrl}${page.urlPath}` : page.urlPath);
-    const lastmod = page.updatedAt
-        ? new Date(page.updatedAt).toISOString()
-        : null;
+function buildUrlEntry(entry, baseUrl) {
+    const loc = escapeXml(baseUrl ? `${baseUrl}${entry.urlPath}` : entry.urlPath);
+    const when = entry.lastmod ? new Date(entry.lastmod) : null;
+    const lastmod = when && !Number.isNaN(when.getTime()) ? when.toISOString() : null;
 
     const parts = [`<loc>${loc}</loc>`];
     if (lastmod) parts.push(`<lastmod>${lastmod}</lastmod>`);
+    if (entry.changefreq) parts.push(`<changefreq>${escapeXml(entry.changefreq)}</changefreq>`);
+    if (validPriority(entry.priority)) parts.push(`<priority>${Number(entry.priority).toFixed(1)}</priority>`);
+    if (entry.image) {
+        const img = /^https?:\/\//i.test(entry.image) ? entry.image : `${baseUrl}${entry.image.startsWith('/') ? '' : '/'}${entry.image}`;
+        parts.push(`<image:image><image:loc>${escapeXml(img)}</image:loc></image:image>`);
+    }
     return `  <url>\n    ${parts.join('\n    ')}\n  </url>`;
 }
 
-function wrapInUrlset(entries) {
+function wrapInUrlset(entries, {withImages = false} = {}) {
+    const ns = withImages ? ' xmlns:image="http://www.google.com/schemas/sitemap-image/1.1"' : '';
     return `<?xml version="1.0" encoding="UTF-8"?>
-<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"${ns}>
 ${entries.join('\n')}
 </urlset>
 `;