domma-cms 0.9.0 → 0.9.5

package/server/services/collections.js

@@ -37,7 +37,6 @@ function slugify(str) {
 async function readSchema(slug) {
     const raw = await fs.readFile(schemaPath(slug), 'utf8');
     const schema = JSON.parse(raw);
-    // Normalise legacy 'preset' flag — both mean "bundled with fresh installs"
     if (schema.preset && !schema.bundled) {
         schema.bundled = true;
         delete schema.preset;
@@ -139,11 +138,11 @@ export async function createCollection({title, slug, description = '', fields =
         slug: finalSlug,
         title: title.trim(),
         description: description.trim(),
-        ...(bundled ? {bundled: true} : {}),
-        ...(plugin ? {plugin} : {}),
         fields,
         api: { ...defaultApiAccess(), ...api },
         storage: storage || {adapter: 'file'},
+        ...(bundled ? {bundled: true} : {}),
+        ...(plugin ? {plugin} : {}),
         createdAt: now,
         updatedAt: now
     };
@@ -165,20 +164,28 @@ export async function updateCollection(slug, updates) {
     const schema = await getCollection(slug);
     if (!schema) throw new Error(`Collection "${slug}" not found`);
 
-    const { slug: _ignore, createdAt, plugin: _plugin, bundled: _bundled, ...rest } = updates;
+    const {slug: _ignore, createdAt, plugin: _stripPlugin, ...rest} = updates;
     const updated = {
         ...schema,
         ...rest,
-        // bundled is user-editable — set from update, omit if falsy
-        ...(updates.bundled ? {bundled: true} : {}),
-        // plugin is ownership metadata — never overwrite from updates
-        ...(schema.plugin ? {plugin: schema.plugin} : {}),
         slug,
         createdAt: schema.createdAt,
         updatedAt: new Date().toISOString()
     };
-    // Clear bundled from schema if it was unchecked (schema spread may have preserved old value)
-    if (!updates.bundled) delete updated.bundled;
+
+    // Preserve the original plugin field (never overwrite)
+    if (schema.plugin) {
+        updated.plugin = schema.plugin;
+    } else {
+        delete updated.plugin;
+    }
+
+    // Allow bundled to be set or cleared
+    if (updates.bundled) {
+        updated.bundled = true;
+    } else {
+        delete updated.bundled;
+    }
 
     await writeSchema(updated);
 

package/server/services/plugins.js

@@ -233,8 +233,7 @@ export async function getInjectionSnippets() {
 }
 
 /**
- * Recursively collect all .md files under a directory.
- * Returns an empty array if the directory does not exist.
+ * Recursively walk a directory and return all .md file paths.
  *
  * @param {string} dir
  * @returns {Promise<string[]>}
@@ -256,60 +255,65 @@ async function walkMdFiles(dir) {
 }
 
 /**
- * Set up all resources owned by a plugin: collections, forms, and pages.
- * Each resource type is created only if it does not already exist (idempotent).
- * Called automatically before `onEnable`.
+ * Set up plugin-owned resources (collections, forms, pages) when a plugin is enabled.
+ * Only creates resources that do not already exist.
  *
  * @param {string} pluginName
- * @param {object} services - Service map from runLifecycleHook
- * @returns {Promise<{collections: string[], forms: string[], pages: string[]}>}
+ * @param {object} services
+ * @returns {Promise<{ collections: string[], forms: string[], pages: string[] }>}
  */
 export async function setupPlugin(pluginName, services) {
-    const pluginDir = path.join(PLUGINS_DIR, pluginName);
     const result = {collections: [], forms: [], pages: []};
+    const pluginDir = path.join(PLUGINS_DIR, pluginName);
 
     // Collections
     if (services.collections) {
-        let entries = [];
+        const collectionsDir = path.join(pluginDir, 'collections');
+        let collectionDirs;
         try {
-            entries = await fs.readdir(path.join(pluginDir, 'collections'), {withFileTypes: true});
-        } catch { /* no collections dir */ }
-        for (const entry of entries.filter(e => e.isDirectory())) {
-            const schemaPath = path.join(pluginDir, 'collections', entry.name, 'schema.json');
-            let schema;
+            collectionDirs = await fs.readdir(collectionsDir, {withFileTypes: true});
+        } catch {
+            collectionDirs = [];
+        }
+        for (const entry of collectionDirs.filter(e => e.isDirectory())) {
+            const schemaFile = path.join(collectionsDir, entry.name, 'schema.json');
             try {
-                schema = JSON.parse(await fs.readFile(schemaPath, 'utf8'));
+                const raw = await fs.readFile(schemaFile, 'utf8');
+                const schema = JSON.parse(raw);
+                schema.plugin = pluginName;
+                const existing = await services.collections.getCollection(schema.slug).catch(() => null);
+                if (!existing) {
+                    await services.collections.createCollection(schema);
+                    result.collections.push(schema.slug);
+                }
             } catch {
-                continue;
-            }
-            schema.plugin = pluginName;
-            const existing = await services.collections.getCollection(schema.slug).catch(() => null);
-            if (!existing) {
-                await services.collections.createCollection(schema);
-                result.collections.push(schema.slug);
+                // Skip missing or invalid schema files
             }
         }
     }
 
     // Forms
     if (services.forms) {
-        let entries = [];
+        const formsDir = path.join(pluginDir, 'forms');
+        let formFiles;
         try {
-            entries = await fs.readdir(path.join(pluginDir, 'forms'));
-        } catch { /* no forms dir */ }
-        for (const file of entries.filter(e => e.endsWith('.json'))) {
-            let data;
+            formFiles = await fs.readdir(formsDir);
+        } catch {
+            formFiles = [];
+        }
+        for (const file of formFiles.filter(f => f.endsWith('.json'))) {
             try {
-                data = JSON.parse(await fs.readFile(path.join(pluginDir, 'forms', file), 'utf8'));
+                const raw = await fs.readFile(path.join(formsDir, file), 'utf8');
+                const data = JSON.parse(raw);
+                data.plugin = pluginName;
+                try {
+                    await services.forms.createForm(data);
+                    result.forms.push(data.slug || file);
+                } catch (err) {
+                    if (err.code !== 'FORM_ALREADY_EXISTS') throw err;
+                }
             } catch {
-                continue;
-            }
-            data.plugin = pluginName;
-            try {
-                await services.forms.createForm(data);
-                result.forms.push(data.slug || data.title);
-            } catch (err) {
-                if (err.code !== 'FORM_ALREADY_EXISTS') throw err;
+                // Skip missing or invalid form files
             }
         }
     }
@@ -317,22 +321,22 @@ export async function setupPlugin(pluginName, services) {
     // Pages
     if (services.content) {
         const pagesDir = path.join(pluginDir, 'pages');
-        const pageFiles = await walkMdFiles(pagesDir);
-        for (const filePath of pageFiles) {
-            let raw;
+        const mdFiles = await walkMdFiles(pagesDir);
+        for (const filePath of mdFiles) {
             try {
-                raw = await fs.readFile(filePath, 'utf8');
+                const raw = await fs.readFile(filePath, 'utf8');
+                const parsed = matter(raw);
+                const rel = path.relative(pagesDir, filePath);
+                let urlPath = '/' + rel.replace(/\\/g, '/').replace(/\.md$/, '').replace(/\/index$/, '');
+                if (urlPath !== '/' && urlPath.endsWith('/')) urlPath = urlPath.slice(0, -1);
+                parsed.data.plugin = pluginName;
+                const existing = await services.content.getPage(urlPath).catch(() => null);
+                if (!existing) {
+                    await services.content.createPage(urlPath, parsed.data, parsed.content.trim());
+                    result.pages.push(urlPath);
+                }
             } catch {
-                continue;
-            }
-            const parsed = matter(raw);
-            const rel = path.relative(pagesDir, filePath).replace(/\\/g, '/');
-            const urlPath = '/' + rel.replace(/\.md$/, '').replace(/\/index$/, '').replace(/^index$/, '');
-            parsed.data.plugin = pluginName;
-            const existing = await services.content.getPage(urlPath);
-            if (!existing) {
-                await services.content.createPage(urlPath, parsed.data, parsed.content.trim());
-                result.pages.push(urlPath);
+                // Skip unreadable or invalid page files
             }
         }
     }
@@ -341,43 +345,52 @@ export async function setupPlugin(pluginName, services) {
 }
 
 /**
- * Remove all pages and forms owned by a plugin.
- * Collections are intentionally preserved to protect stored data.
- * Called automatically before `onDisable`.
+ * Tear down plugin-owned pages and forms when a plugin is disabled.
+ * Collections are NOT deleted to preserve data.
  *
  * @param {string} pluginName
- * @param {object} services - Service map from runLifecycleHook
- * @param {import('fastify').FastifyInstance} [fastify]
- * @returns {Promise<{forms: string[], pages: string[]}>}
+ * @param {object} services
+ * @param {import('fastify').FastifyInstance} fastify
+ * @returns {Promise<{ pages: string[], forms: string[] }>}
  */
 export async function teardownPlugin(pluginName, services, fastify) {
-    const removed = {forms: [], pages: []};
+    const result = {pages: [], forms: []};
 
+    // Pages
     if (services.content) {
         try {
             const pages = await services.content.listPages();
             for (const page of pages.filter(p => p.plugin === pluginName)) {
-                await services.content.deletePage(page.urlPath);
-                removed.pages.push(page.urlPath);
+                try {
+                    await services.content.deletePage(page.urlPath);
+                    result.pages.push(page.urlPath);
+                } catch (err) {
+                    fastify.log.warn(`[plugins] Could not remove page "${page.urlPath}" for "${pluginName}": ${err.message}`);
+                }
             }
         } catch (err) {
-            fastify?.log.warn(`[plugins] Could not remove pages for "${pluginName}": ${err.message}`);
+            fastify.log.warn(`[plugins] Could not list pages during teardown of "${pluginName}": ${err.message}`);
         }
     }
 
+    // Forms
     if (services.forms) {
         try {
             const forms = await services.forms.listForms();
             for (const form of forms.filter(f => f.plugin === pluginName)) {
-                await services.forms.deleteForm(form.slug);
-                removed.forms.push(form.slug);
+                try {
+                    await services.forms.deleteForm(form.slug);
+                    result.forms.push(form.slug);
+                } catch (err) {
+                    fastify.log.warn(`[plugins] Could not remove form "${form.slug}" for "${pluginName}": ${err.message}`);
+                }
             }
         } catch (err) {
-            fastify?.log.warn(`[plugins] Could not remove forms for "${pluginName}": ${err.message}`);
+            fastify.log.warn(`[plugins] Could not list forms during teardown of "${pluginName}": ${err.message}`);
         }
     }
 
-    return removed;
+    return result;
 }
 
 /**
@@ -390,7 +403,6 @@ export async function teardownPlugin(pluginName, services, fastify) {
  * @param {import('fastify').FastifyInstance} fastify
  * @returns {Promise<void>}
  */
-
 export async function runLifecycleHook(name, hook, fastify) {
     // Validate hook name
     if (!['onEnable', 'onDisable'].includes(hook)) return;
@@ -398,7 +410,6 @@ export async function runLifecycleHook(name, hook, fastify) {
     const pluginJsPath = path.join(PLUGINS_DIR, name, 'plugin.js');
     try {
         const mod = await import(pluginJsPath);
-        if (typeof mod[hook] !== 'function') return;
 
         // Use Promise.allSettled to prevent total failure if any service import rejects
         // (e.g. MongoDB-dependent modules like actions.js or views.js)
@@ -441,7 +452,6 @@ export async function runLifecycleHook(name, hook, fastify) {
             if (setup.forms.length) fastify.log.info(`[plugins] Created forms for "${name}": ${setup.forms.join(', ')}`);
             if (setup.pages.length) fastify.log.info(`[plugins] Created pages for "${name}": ${setup.pages.join(', ')}`);
         }
-
         if (hook === 'onDisable') {
             const torn = await teardownPlugin(name, services, fastify);
             if (torn.pages.length) fastify.log.info(`[plugins] Removed pages for "${name}": ${torn.pages.join(', ')}`);

package/server/services/renderer.js

@@ -68,9 +68,9 @@ export async function renderPage(page) {
 
     const preset = presets[page.layout] || presets['default'] || {};
 
-    const seoTitle = page.seo?.title || `${page.title}${site.seo?.titleSeparator || ' | '}${site.seo?.defaultTitle || site.title}`;
-    const seoDescription = page.seo?.description || site.seo?.defaultDescription || '';
-    const ogImage = page.seo?.image || site.seo?.defaultImage || '';
+    const seoTitle = escapeHtml(page.seo?.title || `${page.title}${site.seo?.titleSeparator || ' | '}${site.seo?.defaultTitle || site.title}`);
+    const seoDescription = escapeHtml(page.seo?.description || site.seo?.defaultDescription || '');
+    const ogImage = escapeHtml(page.seo?.image || site.seo?.defaultImage || '');
 
     const dconfig = page.dconfig || null;
     // Escape </script> to prevent injection via dconfig values in the inline script block

package/plugins/docs/data/documents/452f49b7-9c93-4a67-874d-27f882891ad2.json

@@ -1,11 +0,0 @@
-{
-  "id": "452f49b7-9c93-4a67-874d-27f882891ad2",
-  "title": "Untitled",
-  "content": "",
-  "folderId": null,
-  "tags": [],
-  "userId": "2421ad8e-060d-4548-8878-af7011d5e08b",
-  "wordCount": 0,
-  "createdAt": "2026-03-24T16:48:26.074Z",
-  "updatedAt": "2026-03-24T16:49:05.067Z"
-}