domma-cms 0.9.1 → 0.9.5

package/plugins/todo/admin/views/todo.js

@@ -1,8 +1,7 @@
 // ============================================================
 // Todo plugin admin view
-// Uses auth-aware api() helper for all API calls (Bearer token from S.get('auth_token'))
-// Uses $container.find() for all DOM queries
-// Note: innerHTML usage below escapes all user-supplied text via escapeHtml()
+// Uses auth-aware api() helper for all API calls
+// Uses T.create() for table rendering (Domma Table component)
 // ============================================================
 
 const STATUS = {
@@ -27,15 +26,12 @@ function formatPriority(priority) {
     return priority.charAt(0).toUpperCase() + priority.slice(1);
 }
 
-/** Escape user-supplied text before inserting into HTML markup */
-function escapeHtml(str) {
-    return String(str ?? '')
-        .replace(/&/g, '&')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;')
-        .replace(/'/g, '&#39;');
-}
+const esc = (str) => String(str ?? '')
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
 
 async function api(url, method = 'GET', body) {
     const opts = {method, headers: {'Authorization': 'Bearer ' + (S.get('auth_token') || '')}};
@@ -59,85 +55,134 @@ export const todoView = {
         // ---- State ----
         let todos = [];
         let activeFilter = 'all';
+        let todoTable = null;
 
         // ---- Fetch ----
         async function loadTodos() {
             try {
                 const res = await api('/api/plugins/todo/items');
                 todos = Array.isArray(res) ? res : (res.data ?? []);
-            } catch (err) {
+            } catch {
                 E.toast('Failed to load todos', { type: 'error' });
                 todos = [];
             }
         }
 
-        // ---- Render ----
+        // ---- Render table ----
         function render() {
-            const listEl = $container.find('#todo-list').get(0);
-            const emptyEl = $container.find('#empty-state').get(0);
-
             const filtered = activeFilter === 'all'
                 ? todos
                 : todos.filter((t) => t.status === activeFilter);
 
-            if (filtered.length === 0) {
-                // Safe: no user content, only static markup
-                listEl.textContent = '';
-                emptyEl.style.display = 'block';
+            if (todoTable) {
+                todoTable.setData(filtered);
                 return;
             }
 
-            emptyEl.style.display = 'none';
-
-            // Build markup — all user values run through escapeHtml()
-            const rows = filtered.map((todo) => {
-                const isCompleted = todo.status === STATUS.COMPLETED;
-                const safeText = escapeHtml(todo.text);
-                const safeId   = escapeHtml(todo.id);
-
-                const statusClass = `status-pill-${escapeHtml(todo.status)}`;
-                const priorityClass = `priority-pill-${escapeHtml(todo.priority)}`;
-
-                let dueBadge = '';
-                if (todo.dueAt) {
-                    const due = new Date(todo.dueAt);
-                    const today = new Date();
-                    today.setHours(0, 0, 0, 0);
-                    const overdue = !isCompleted && due < today;
-                    const dueLabel = D(todo.dueAt).format('D MMM');
-                    dueBadge = `<span class="badge ${overdue ? 'badge-danger' : 'badge-outline'}" style="font-size:0.68rem;padding:1px 6px;flex-shrink:0;" title="Due ${escapeHtml(dueLabel)}">${overdue ? '⚠ ' : ''}${escapeHtml(dueLabel)}</span>`;
+            todoTable = T.create('#todo-table', {
+                data: filtered,
+                columns: [
+                    {
+                        key: 'status',
+                        title: '',
+                        sortable: false,
+                        render: (status, row) => {
+                            const checked = status === STATUS.COMPLETED ? 'checked' : '';
+                            return `<input type="checkbox" class="form-check-input todo-checkbox" data-id="${esc(row.id)}" ${checked} style="cursor:pointer;" />`;
+                        }
+                    },
+                    {
+                        key: 'text',
+                        title: 'Task',
+                        sortable: true,
+                        render: (text, row) => {
+                            const isCompleted = row.status === STATUS.COMPLETED;
+                            const style = isCompleted ? 'text-decoration:line-through;opacity:0.45;' : '';
+                            let dueBadge = '';
+                            if (row.dueAt) {
+                                const due = new Date(row.dueAt);
+                                const today = new Date();
+                                today.setHours(0, 0, 0, 0);
+                                const overdue = !isCompleted && due < today;
+                                const dueLabel = D(row.dueAt).format('D MMM');
+                                dueBadge = ` <span class="badge ${overdue ? 'badge-danger' : 'badge-outline'}" `
+                                    + `style="font-size:0.68rem;padding:1px 6px;" title="Due ${esc(dueLabel)}">`
+                                    + `${overdue ? '\u26a0 ' : ''}${esc(dueLabel)}</span>`;
+                            }
+                            return `<span style="font-size:0.9rem;${style}">${esc(text)}${dueBadge}</span>`;
+                        }
+                    },
+                    {
+                        key: 'status',
+                        title: 'Status',
+                        sortable: true,
+                        render: (status, row) => {
+                            const opts = [
+                                {v: 'not-started', l: 'Not Started'},
+                                {v: 'in-progress', l: 'In Progress'},
+                                {v: 'completed', l: 'Completed'}
+                            ].map(({v, l}) =>
+                                `<option value="${v}"${status === v ? ' selected' : ''}>${l}</option>`
+                            ).join('');
+                            return `<select class="todo-select-pill status-select status-pill-${esc(status)}" data-id="${esc(row.id)}">${opts}</select>`;
+                        }
+                    },
+                    {
+                        key: 'priority',
+                        title: 'Priority',
+                        sortable: true,
+                        render: (priority, row) => {
+                            const opts = [
+                                {v: 'highest', l: 'Highest'},
+                                {v: 'high', l: 'High'},
+                                {v: 'medium', l: 'Medium'},
+                                {v: 'low', l: 'Low'},
+                                {v: 'lowest', l: 'Lowest'}
+                            ].map(({v, l}) =>
+                                `<option value="${v}"${priority === v ? ' selected' : ''}>${l}</option>`
+                            ).join('');
+                            return `<select class="todo-select-pill priority-select priority-pill-${esc(priority)}" data-id="${esc(row.id)}">${opts}</select>`;
+                        }
+                    },
+                    {
+                        key: 'id',
+                        title: 'Actions',
+                        sortable: false,
+                        render: (id) =>
+                            `<button class="btn btn-sm btn-ghost edit-todo" data-id="${esc(id)}" title="Edit" style="margin-right:3px;">` +
+                            `<span data-icon="edit" data-icon-size="13"></span></button>` +
+                            `<button class="btn btn-sm btn-danger delete-todo" data-id="${esc(id)}" title="Delete">` +
+                            `<span data-icon="trash" data-icon-size="13"></span></button>`
+                    }
+                ],
+                emptyMessage: 'No tasks yet. Add one above to get started.'
+            });
+
+            // Event delegation on the table container
+            const tableContainer = $container.find('#todo-table').get(0);
+
+            tableContainer.addEventListener('change', (e) => {
+                const target = e.target;
+                const id = target.dataset.id;
+                if (!id) return;
+
+                if (target.classList.contains('todo-checkbox')) {
+                    toggleTodo(id);
+                } else if (target.classList.contains('status-select')) {
+                    target.className = target.className.replace(/status-pill-\S+/g, `status-pill-${target.value}`);
+                    updateStatus(id, target.value);
+                } else if (target.classList.contains('priority-select')) {
+                    target.className = target.className.replace(/priority-pill-\S+/g, `priority-pill-${target.value}`);
+                    updatePriority(id, target.value);
                 }
+            });
 
-                return `<li class="todo-item${isCompleted ? ' completed' : ''}" data-id="${safeId}">
-                    <input type="checkbox" class="form-check-input todo-checkbox" ${isCompleted ? 'checked' : ''} />
-                    <span class="todo-text">${safeText}${dueBadge ? ' ' + dueBadge : ''}</span>
-                    <div class="todo-selects">
-                        <select class="todo-select-pill status-select ${statusClass}" data-id="${safeId}" title="Status">
-                            <option value="not-started"${todo.status === 'not-started' ? ' selected' : ''}>Not Started</option>
-                            <option value="in-progress"${todo.status === 'in-progress' ? ' selected' : ''}>In Progress</option>
-                            <option value="completed"${todo.status === 'completed' ? ' selected' : ''}>Completed</option>
-                        </select>
-                        <select class="todo-select-pill priority-select ${priorityClass}" data-id="${safeId}" title="Priority">
-                            <option value="highest"${todo.priority === 'highest' ? ' selected' : ''}>Highest</option>
-                            <option value="high"${todo.priority === 'high' ? ' selected' : ''}>High</option>
-                            <option value="medium"${todo.priority === 'medium' ? ' selected' : ''}>Medium</option>
-                            <option value="low"${todo.priority === 'low' ? ' selected' : ''}>Low</option>
-                            <option value="lowest"${todo.priority === 'lowest' ? ' selected' : ''}>Lowest</option>
-                        </select>
-                    </div>
-                    <div class="todo-actions">
-                        <button class="btn btn-sm btn-ghost edit-todo" data-id="${safeId}" title="Edit">
-                            <span data-icon="edit" data-icon-size="13"></span>
-                        </button>
-                        <button class="btn btn-sm btn-danger delete-todo" data-id="${safeId}" title="Delete">
-                            <span data-icon="trash" data-icon-size="13"></span>
-                        </button>
-                    </div>
-                </li>`;
-            }).join('');
-
-            listEl.innerHTML = rows;
-            Domma.icons.scan(listEl);
+            tableContainer.addEventListener('click', (e) => {
+                const editBtn = e.target.closest('.edit-todo');
+                const deleteBtn = e.target.closest('.delete-todo');
+                if (editBtn) editTodo(editBtn.dataset.id);
+                if (deleteBtn) deleteTodo(deleteBtn.dataset.id);
+            });
         }
 
         // ---- Add todo ----
@@ -167,7 +212,7 @@ export const todoView = {
                 if ($due.get(0)) $due.get(0).value = '';
                 render();
                 E.toast('Task added', { type: 'success' });
-            } catch (err) {
+            } catch {
                 E.toast('Failed to add task', { type: 'error' });
             }
         }
@@ -183,7 +228,7 @@ export const todoView = {
                 Object.assign(todo, updated);
                 render();
                 E.toast(newStatus === STATUS.COMPLETED ? 'Task completed' : 'Task reopened', { type: 'success' });
-            } catch (err) {
+            } catch {
                 E.toast('Failed to update task', { type: 'error' });
             }
         }
@@ -201,7 +246,7 @@ export const todoView = {
                 Object.assign(todo, updated);
                 render();
                 E.toast('Task updated', { type: 'success' });
-            } catch (err) {
+            } catch {
                 E.toast('Failed to update task', { type: 'error' });
             }
         }
@@ -216,7 +261,7 @@ export const todoView = {
                 todos = todos.filter((t) => t.id !== id);
                 render();
                 E.toast('Task deleted', { type: 'success' });
-            } catch (err) {
+            } catch {
                 E.toast('Failed to delete task', { type: 'error' });
             }
         }
@@ -231,7 +276,7 @@ export const todoView = {
                 Object.assign(todo, updated);
                 render();
                 E.toast(`Status: ${formatStatus(status)}`, { type: 'success' });
-            } catch (err) {
+            } catch {
                 E.toast('Failed to update status', { type: 'error' });
             }
         }
@@ -246,7 +291,7 @@ export const todoView = {
                 Object.assign(todo, updated);
                 render();
                 E.toast(`Priority: ${formatPriority(priority)}`, { type: 'success' });
-            } catch (err) {
+            } catch {
                 E.toast('Failed to update priority', { type: 'error' });
             }
         }
@@ -267,7 +312,7 @@ export const todoView = {
                 todos = todos.filter((t) => t.status !== STATUS.COMPLETED);
                 render();
                 E.toast('Completed tasks cleared', { type: 'success' });
-            } catch (err) {
+            } catch {
                 E.toast('Failed to clear completed tasks', { type: 'error' });
             }
         }
@@ -282,7 +327,6 @@ export const todoView = {
 
         $container.find('#clear-completed-btn').get(0).addEventListener('click', clearCompleted);
 
-        // Filter buttons — direct addEventListener to avoid namespaced delegation issues
         $container.find('#filter-bar').get(0).querySelectorAll('.filter-btn').forEach((btn) => {
             btn.addEventListener('click', () => {
                 activeFilter = btn.dataset.filter;
@@ -292,34 +336,6 @@ export const todoView = {
             });
         });
 
-        // Todo list — native event delegation on the list element
-        const listEl = $container.find('#todo-list').get(0);
-
-        listEl.addEventListener('change', (e) => {
-            const target = e.target;
-            const id = target.dataset.id ?? target.closest('.todo-item')?.dataset.id;
-            if (!id) return;
-
-            if (target.classList.contains('todo-checkbox')) {
-                toggleTodo(id);
-            } else if (target.classList.contains('status-select')) {
-                // Update pill colour immediately
-                target.className = target.className.replace(/status-pill-\S+/, `status-pill-${target.value}`);
-                updateStatus(id, target.value);
-            } else if (target.classList.contains('priority-select')) {
-                target.className = target.className.replace(/priority-pill-\S+/, `priority-pill-${target.value}`);
-                updatePriority(id, target.value);
-            }
-        });
-
-        listEl.addEventListener('click', (e) => {
-            const editBtn   = e.target.closest('.edit-todo');
-            const deleteBtn = e.target.closest('.delete-todo');
-
-            if (editBtn)   editTodo(editBtn.dataset.id);
-            if (deleteBtn) deleteTodo(deleteBtn.dataset.id);
-        });
-
         // ---- Initial load ----
         await loadTodos();
         render();

package/plugins/todo/collections/todos/schema.json

@@ -54,6 +54,7 @@
     }
   },
   "storage": {
-    "adapter": "file"
+    "adapter": "mongodb",
+    "connection": "default"
   }
 }

package/plugins/todo/plugin.json

@@ -15,7 +15,7 @@
     ],
     "views": {
       "plugin-todo": {
-        "entry": "todo/admin/views/todo.js",
+        "entry": "todo/admin/views/todo.js?v=2",
         "exportName": "todoView"
       }
     }

package/server/routes/api/media.js

@@ -1,118 +1,127 @@
-/**
- * Media API
- * GET    /api/media       - list media files
- * POST   /api/media       - upload a file
- * DELETE /api/media/:name - delete a file
- */
-import path from 'path';
-import {deleteMedia, listMedia, renameMedia, saveMedia} from '../../services/content.js';
-import {getImageInfo, isEditableImage, transformImage} from '../../services/images.js';
-import {authenticate, requirePermission} from '../../middleware/auth.js';
-
-const ALLOWED_MIME_TYPES = new Set([
-  // Images
-  'image/jpeg', 'image/jpg', 'image/png', 'image/gif', 'image/webp',
-  'image/svg+xml', 'image/x-icon', 'image/bmp', 'image/tiff',
-  // Documents
-  'application/pdf', 'text/plain', 'text/csv',
-  'application/msword',
-  'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
-  'application/vnd.ms-excel',
-  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
-  // Video
-  'video/mp4', 'video/webm', 'video/ogg',
-  // Audio
-  'audio/mpeg', 'audio/mp3', 'audio/ogg', 'audio/wav', 'audio/webm',
-]);
-
-// Safe filename: strip path traversal and restrict to alphanumeric + safe chars
-function sanitiseFilename(name) {
-    return path.basename(name).replace(/[^a-zA-Z0-9._-]/g, '_');
-}
-
-export async function mediaRoutes(fastify) {
-    const canRead = {preHandler: [authenticate, requirePermission('media', 'read')]};
-    const canCreate = {preHandler: [authenticate, requirePermission('media', 'create')]};
-    const canUpdate = {preHandler: [authenticate, requirePermission('media', 'update')]};
-    const canDelete = {preHandler: [authenticate, requirePermission('media', 'delete')]};
-
-    fastify.get('/media', canRead, async () => {
-        return listMedia();
-    });
-
-    fastify.post('/media', canCreate, async (request, reply) => {
-      const results = [];
-      for await (const data of request.files()) {
-        const filename = sanitiseFilename(data.filename);
-        if (!ALLOWED_MIME_TYPES.has(data.mimetype)) {
-          // Drain the stream to avoid leaving it open
-          for await (const _ of data.file) { /* drain */ }
-          return reply.code(400).send({
-            error: `File type '${data.mimetype}' is not allowed. Allowed types: images, documents, audio, video.`,
-          });
-        }
-        const chunks = [];
-        for await (const chunk of data.file) {
-          chunks.push(chunk);
-        }
-        results.push(await saveMedia(filename, Buffer.concat(chunks)));
-      }
-      if (!results.length) return reply.status(400).send({error: 'No file uploaded'});
-      return reply.status(201).send(results.length === 1 ? results[0] : results);
-    });
-
-    fastify.patch('/media/:name', canUpdate, async (request, reply) => {
-    const oldName = sanitiseFilename(request.params.name);
-    const newName = sanitiseFilename(request.body?.newName ?? '');
-    if (!newName) return reply.status(400).send({error: 'newName is required.'});
-    if (oldName === newName) return reply.status(400).send({error: 'New name is the same as the current name.'});
-    try {
-      return await renameMedia(oldName, newName);
-    } catch (err) {
-      return reply.status(409).send({error: err.message});
-    }
-  });
-
-    fastify.delete('/media/:name', canDelete, async (request, reply) => {
-        const name = sanitiseFilename(request.params.name);
-        await deleteMedia(name);
-        return { success: true };
-    });
-
-    fastify.get('/media/:name/info', canRead, async (request, reply) => {
-    const name = sanitiseFilename(request.params.name);
-    if (!isEditableImage(name)) {
-      return reply.status(400).send({error: 'Not an editable image format'});
-    }
-    try {
-      return await getImageInfo(name);
-    } catch {
-      return reply.status(404).send({error: 'File not found'});
-    }
-  });
-
-    fastify.post('/media/:name/transform', canUpdate, async (request, reply) => {
-    const name = sanitiseFilename(request.params.name);
-    if (!isEditableImage(name)) {
-      return reply.status(400).send({error: 'Not an editable image format'});
-    }
-
-    const {operations = {}, saveAs} = request.body ?? {};
-
-    // Sanitise fields that reference filesystem paths
-    if (operations.watermark?.image) {
-      operations.watermark.image = sanitiseFilename(operations.watermark.image);
-    }
-    if (operations._deleteOriginal) {
-      operations._deleteOriginal = sanitiseFilename(operations._deleteOriginal);
-    }
-
-    const outputFilename = saveAs ? sanitiseFilename(saveAs) : null;
-
-    try {
-      return await transformImage(name, operations, outputFilename);
-    } catch (err) {
-      return reply.status(500).send({error: err.message});
-    }
-  });
-}
+/**
+ * Media API
+ * GET    /api/media       - list media files
+ * POST   /api/media       - upload a file
+ * DELETE /api/media/:name - delete a file
+ */
+import path from 'path';
+import {deleteMedia, listMedia, renameMedia, saveMedia} from '../../services/content.js';
+import {getImageInfo, isEditableImage, transformImage} from '../../services/images.js';
+import {authenticate, requirePermission} from '../../middleware/auth.js';
+
+const ALLOWED_MIME_TYPES = new Set([
+  // Images
+  'image/jpeg', 'image/jpg', 'image/png', 'image/gif', 'image/webp',
+  'image/svg+xml', 'image/x-icon', 'image/bmp', 'image/tiff',
+  // Documents
+  'application/pdf', 'text/plain', 'text/csv',
+  'application/msword',
+  'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  'application/vnd.ms-excel',
+  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+  // Video
+  'video/mp4', 'video/webm', 'video/ogg',
+  // Audio
+  'audio/mpeg', 'audio/mp3', 'audio/ogg', 'audio/wav', 'audio/webm',
+]);
+
+// Safe filename: strip path traversal and restrict to alphanumeric + safe chars
+function sanitiseFilename(name) {
+    return path.basename(name).replace(/[^a-zA-Z0-9._-]/g, '_');
+}
+
+export async function mediaRoutes(fastify) {
+    const canRead = {preHandler: [authenticate, requirePermission('media', 'read')]};
+    const canCreate = {preHandler: [authenticate, requirePermission('media', 'create')]};
+    const canUpdate = {preHandler: [authenticate, requirePermission('media', 'update')]};
+    const canDelete = {preHandler: [authenticate, requirePermission('media', 'delete')]};
+
+    fastify.get('/media', canRead, async () => {
+        return listMedia();
+    });
+
+    fastify.post('/media', canCreate, async (request, reply) => {
+      const results = [];
+      for await (const data of request.files()) {
+        const filename = sanitiseFilename(data.filename);
+          if (filename.length > 200) {
+              for await (const _ of data.file) { /* drain */
+              }
+              return reply.code(400).send({error: 'Filename is too long (max 200 characters).'});
+          }
+        if (!ALLOWED_MIME_TYPES.has(data.mimetype)) {
+          // Drain the stream to avoid leaving it open
+          for await (const _ of data.file) { /* drain */ }
+          return reply.code(400).send({
+            error: `File type '${data.mimetype}' is not allowed. Allowed types: images, documents, audio, video.`,
+          });
+        }
+        const chunks = [];
+        for await (const chunk of data.file) {
+          chunks.push(chunk);
+        }
+          try {
+              results.push(await saveMedia(filename, Buffer.concat(chunks)));
+          } catch {
+              return reply.status(500).send({error: 'Upload failed.'});
+          }
+      }
+      if (!results.length) return reply.status(400).send({error: 'No file uploaded'});
+      return reply.status(201).send(results.length === 1 ? results[0] : results);
+    });
+
+    fastify.patch('/media/:name', canUpdate, async (request, reply) => {
+    const oldName = sanitiseFilename(request.params.name);
+    const newName = sanitiseFilename(request.body?.newName ?? '');
+    if (!newName) return reply.status(400).send({error: 'newName is required.'});
+    if (oldName === newName) return reply.status(400).send({error: 'New name is the same as the current name.'});
+    try {
+      return await renameMedia(oldName, newName);
+    } catch (err) {
+      return reply.status(409).send({error: err.message});
+    }
+  });
+
+    fastify.delete('/media/:name', canDelete, async (request, reply) => {
+        const name = sanitiseFilename(request.params.name);
+        await deleteMedia(name);
+        return { success: true };
+    });
+
+    fastify.get('/media/:name/info', canRead, async (request, reply) => {
+    const name = sanitiseFilename(request.params.name);
+    if (!isEditableImage(name)) {
+      return reply.status(400).send({error: 'Not an editable image format'});
+    }
+    try {
+      return await getImageInfo(name);
+    } catch {
+      return reply.status(404).send({error: 'File not found'});
+    }
+  });
+
+    fastify.post('/media/:name/transform', canUpdate, async (request, reply) => {
+    const name = sanitiseFilename(request.params.name);
+    if (!isEditableImage(name)) {
+      return reply.status(400).send({error: 'Not an editable image format'});
+    }
+
+    const {operations = {}, saveAs} = request.body ?? {};
+
+    // Sanitise fields that reference filesystem paths
+    if (operations.watermark?.image) {
+      operations.watermark.image = sanitiseFilename(operations.watermark.image);
+    }
+    if (operations._deleteOriginal) {
+      operations._deleteOriginal = sanitiseFilename(operations._deleteOriginal);
+    }
+
+    const outputFilename = saveAs ? sanitiseFilename(saveAs) : null;
+
+    try {
+      return await transformImage(name, operations, outputFilename);
+    } catch (err) {
+      return reply.status(500).send({error: err.message});
+    }
+  });
+}

package/server/routes/api/plugins.js

@@ -4,8 +4,14 @@
  * PUT /api/plugins/:name        - enable/disable, update settings (admin only)
  * GET /api/plugins/admin-config - sidebar/routes/views for enabled plugins (authenticated)
  */
-import { authenticate, requireAdmin, requirePermission } from '../../middleware/auth.js';
-import { discoverPlugins, getPluginStates, savePluginState, getAdminPluginConfig, runLifecycleHook } from '../../services/plugins.js';
+import {authenticate, requirePermission} from '../../middleware/auth.js';
+import {
+    discoverPlugins,
+    getAdminPluginConfig,
+    getPluginStates,
+    runLifecycleHook,
+    savePluginState
+} from '../../services/plugins.js';
 
 export async function pluginsRoutes(fastify) {
     const canRead   = { preHandler: [authenticate, requirePermission('plugins', 'read')]   };
@@ -25,6 +31,7 @@ export async function pluginsRoutes(fastify) {
             date: manifest.date || '',
             icon: manifest.icon || 'package',
             enabled: !!(states[manifest.name]?.enabled),
+            bundled: !!(states[manifest.name]?.bundled),
             settings: states[manifest.name]?.settings || {}
         }));
     });
@@ -32,14 +39,18 @@ export async function pluginsRoutes(fastify) {
     // Enable/disable or update settings for a plugin
     fastify.put('/plugins/:name', canUpdate, async (request, reply) => {
         const { name } = request.params;
-        const { enabled, settings } = request.body || {};
+        const {enabled, settings, bundled} = request.body || {};
 
         const manifests = await discoverPlugins();
         const manifest = manifests.find(m => m.name === name);
         if (!manifest) return reply.status(404).send({ error: 'Plugin not found' });
 
         const prevState = getPluginStates()[name] || {};
-        savePluginState(name, { enabled: !!enabled, settings: settings || {} });
+        const update = {};
+        if (enabled !== undefined) update.enabled = !!enabled;
+        if (settings !== undefined) update.settings = settings;
+        if (bundled !== undefined) update.bundled = !!bundled;
+        savePluginState(name, update);
 
         if (!prevState.enabled && !!enabled) {
             await runLifecycleHook(name, 'onEnable', fastify);