domma-cms 0.91.1 → 0.92.1

package/server/services/search.js

@@ -10,6 +10,8 @@
  * public page carries them inline instead of fetching them.
  */
 import {getConfig, saveConfig} from '../config.js';
+import {checkVisibility} from '../middleware/auth.js';
+import {normalisePath} from '../../admin/js/lib/seo-redirects.js';
 
 /**
  * Settings, and the shape of them.
@@ -363,6 +365,115 @@ export function scorePage(page, query, words) {
     return score;
 }
 
+/**
+ * Site-wide rules that take pages out of search whatever the viewer, which a
+ * page's own frontmatter does not carry - so they are resolved once per
+ * search (async) and handed to the sync checks below:
+ *
+ *  - `offline`: pages in a DISABLED project. The public renderer 404s them
+ *    (routes/public.js: getProjectForPage + isProjectEnabled - the same two
+ *    calls here), so search must not read them out either.
+ *  - `noindex`: pages the SEO screen marked noindex per URL
+ *    (content/seo/overrides.json). The same store, keyed the same way
+ *    (normalisePath), that the robots meta ('seo:meta') and the sitemap
+ *    ('sitemap:entries') read - and, like them, only while SEO is switched on.
+ *
+ * @param {object[]} pages
+ * @param {object} [deps] - DI for tests
+ * @param {Function} [deps.projectOf]    - async (urlPath, frontmatterProject) → slug
+ * @param {Function} [deps.isEnabled]    - async (slug) → boolean
+ * @param {Function} [deps.listProjects] - async () → projects (the shortcut when none is disabled)
+ * @param {Function} [deps.seoOverrides] - () → {"/path": {noindex, ...}}
+ * @returns {Promise<{offline: Set<string>, noindex: Set<string>}>} urlPaths
+ */
+export async function searchExclusions(pages = [], deps = {}) {
+    const offline = new Set();
+    const noindex = new Set();
+
+    const projects = deps.projectOf && deps.isEnabled ? null : await import('./projects.js');
+    const projectOf = deps.projectOf || projects.getProjectForPage;
+    const isEnabled = deps.isEnabled || projects.isProjectEnabled;
+    const listAll = deps.listProjects || projects?.listProjects;
+    // Nothing is disabled on most sites - skip resolving every page's project.
+    let anyDisabled = true;
+    if (listAll) {
+        try { anyDisabled = (await listAll()).some(p => p?.enabled === false); } catch { anyDisabled = true; }
+    }
+    if (anyDisabled) {
+        const enabled = new Map();
+        for (const page of pages) {
+            if (!page?.urlPath) continue;
+            try {
+                const slug = await projectOf(page.urlPath, page.project);
+                if (!enabled.has(slug)) enabled.set(slug, await isEnabled(slug));
+                if (!enabled.get(slug)) offline.add(page.urlPath);
+            } catch { /* project store unreadable - leave the page to the other checks */ }
+        }
+    }
+
+    let overrides;
+    if (deps.seoOverrides) {
+        overrides = deps.seoOverrides() || {};
+    } else {
+        // Null while SEO is switched off - and then no override reaches the
+        // robots meta or the sitemap either.
+        const {seoEngine} = await import('./seo/index.js');
+        overrides = seoEngine()?.store?.overrides?.() || {};
+    }
+    for (const page of pages) {
+        if (!page?.urlPath) continue;
+        const key = normalisePath(page.urlPath) || '/';
+        if (overrides[key]?.noindex === true) noindex.add(page.urlPath);
+    }
+    return {offline, noindex};
+}
+
+/**
+ * Is this page noindex? Its frontmatter (`seo.noindex`, the field core SEO
+ * reads for the robots meta and the sitemap), or the SEO screen's per-URL
+ * override when `exclusions` (searchExclusions()) is given.
+ *
+ * @param {object} page
+ * @param {{noindex?: Set<string>}|null} [exclusions]
+ * @returns {boolean}
+ */
+export function isNoindex(page, exclusions = null) {
+    if (page?.seo?.noindex === true) return true;
+    return Boolean(exclusions?.noindex?.has(page?.urlPath));
+}
+
+/**
+ * Is this page in a disabled project (served as a 404)? Needs `exclusions`
+ * from searchExclusions(); without them nothing is.
+ *
+ * @param {object} page
+ * @param {{offline?: Set<string>}|null} [exclusions]
+ * @returns {boolean}
+ */
+export function isOffline(page, exclusions = null) {
+    return Boolean(exclusions?.offline?.has(page?.urlPath));
+}
+
+/**
+ * May this page appear in this viewer's search results? Drafts never; pages
+ * in a disabled project never; pages that ask not to be indexed (frontmatter
+ * or the SEO screen) never; otherwise exactly when the viewer could open the
+ * page - checkVisibility() is the one visibility rule, the same the public
+ * page renderer applies, so a role-gated page (`member`, `=candidate`,
+ * `private`) is found only by someone it would be served to.
+ *
+ * @param {object} page
+ * @param {object|null} [viewer] - resolved viewer, null for anonymous
+ * @param {{offline?: Set<string>, noindex?: Set<string>}|null} [exclusions] - searchExclusions()
+ * @returns {boolean}
+ */
+export function isSearchable(page, viewer = null, exclusions = null) {
+    if (!page || page.status === 'draft') return false;
+    if (isOffline(page, exclusions)) return false;
+    if (isNoindex(page, exclusions)) return false;
+    return checkVisibility(viewer, page.visibility);
+}
+
 /**
  * Search a set of pages.
  *
@@ -372,19 +483,22 @@ export function scorePage(page, query, words) {
  * 500 to every query on an entire site, which reads to everyone as "search
  * finds nothing".
  *
+ * A result carries the title, description and a snippet of the body, so it
+ * is only ever built for a page the viewer could open - see isSearchable().
+ *
  * @param   {object[]} pages
  * @param   {string} query
- * @param   {{maxResults?: number, onError?: Function}} [options]
+ * @param   {{maxResults?: number, onError?: Function, viewer?: object|null, exclusions?: object|null}} [options]
+ *          viewer - the resolved viewer (resolveViewer()), null for anonymous
+ *          exclusions - searchExclusions(pages): disabled projects, SEO noindex overrides
  * @returns {object[]}
  */
-export function searchPages(pages, query, {maxResults = 10, onError = () => {}} = {}) {
+export function searchPages(pages, query, {maxResults = 10, onError = () => {}, viewer = null, exclusions = null} = {}) {
     const words = query.toLowerCase().split(/\s+/).filter(Boolean);
     const results = [];
 
     for (const page of pages) {
-        // Drafts and private pages are nobody's business out here.
-        if (page.status === 'draft') continue;
-        if (page.visibility === 'private') continue;
+        if (!isSearchable(page, viewer, exclusions)) continue;
 
         // One page must never be able to fail the whole search. The null-tag
         // crash was exactly this shape and the next malformed field will be
@@ -417,34 +531,45 @@ export function searchPages(pages, query, {maxResults = 10, onError = () => {}}
 // ---------------------------------------------------------------------------
 
 /**
- * Which pages search can return, and which it leaves out - the same rule
- * searchPages() applies (drafts and private pages are never results).
+ * Which pages an anonymous visitor's search can return, and which it leaves
+ * out - the same rule searchPages() applies (isSearchable() with no viewer).
+ * Each page left out is counted once, under the first reason that applies:
+ * a draft, then offline (its project is disabled), then restricted (private
+ * or role-gated), then noindex (frontmatter or the SEO screen). A signed-in
+ * visitor may find more than `searchable` - the gated pages they can open.
  *
  * @param {object[]} pages
- * @returns {{searchable: number, drafts: number, private: number, total: number}}
+ * @param {{offline?: Set<string>, noindex?: Set<string>}|null} [exclusions] - searchExclusions()
+ * @returns {{searchable: number, drafts: number, offline: number, restricted: number, noindex: number, total: number}}
  */
-export function searchCoverage(pages = []) {
+export function searchCoverage(pages = [], exclusions = null) {
     let drafts = 0;
-    let priv = 0;
+    let offline = 0;
+    let restricted = 0;
+    let noindex = 0;
     for (const p of pages) {
         if (p?.status === 'draft') drafts++;
-        else if (p?.visibility === 'private') priv++;
+        else if (isOffline(p, exclusions)) offline++;
+        else if (!checkVisibility(null, p?.visibility)) restricted++;
+        else if (isNoindex(p, exclusions)) noindex++;
     }
-    return {searchable: pages.length - drafts - priv, drafts, private: priv, total: pages.length};
+    return {searchable: pages.length - drafts - offline - restricted - noindex,
+        drafts, offline, restricted, noindex, total: pages.length};
 }
 
 /**
  * The sidebar badge on System > Search (its countUrl, GET /api/search/_count):
- * how many pages a visitor's search can find, with whether search is on at all
+ * how many pages an anonymous visitor's search can find, with whether search is on at all
  * and how it is reached in the popover. An inventory, not a signal - plain text
  * throughout, the popover sets it with textContent.
  *
  * @param {object} settings - normalised search settings
  * @param {object[]} pages
+ * @param {{offline?: Set<string>, noindex?: Set<string>}|null} [exclusions] - searchExclusions()
  */
-export function searchBadge(settings = SEARCH_DEFAULTS, pages = []) {
+export function searchBadge(settings = SEARCH_DEFAULTS, pages = [], exclusions = null) {
     const s = normaliseSearchSettings(settings);
-    const c = searchCoverage(pages);
+    const c = searchCoverage(pages, exclusions);
     const pl = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
     const trigger = s.displayMode === 'floating'
         ? `Floating button, ${s.position.replace('-', ' ')}`
@@ -462,10 +587,13 @@ export function searchBadge(settings = SEARCH_DEFAULTS, pages = []) {
                 {label: 'Trigger', value: s.enabled ? trigger : '-'},
                 {label: 'Keyboard shortcut', value: s.enabled && s.keyboardShortcut ? 'Ctrl+K / ⌘K' : 'Off'},
                 {label: 'Searchable pages', value: String(c.searchable)},
-                {label: 'Left out (drafts, private)', value: String(c.drafts + c.private)}
+                {label: 'Left out (drafts, disabled projects, private or role-gated, noindex)',
+                    value: String(c.drafts + c.offline + c.restricted + c.noindex)}
             ],
             items: [],
-            empty: s.enabled ? 'Visitors can search every published, public page.' : 'Search is switched off - nothing is added to public pages.'
+            empty: s.enabled
+                ? 'Visitors can search every published page they are allowed to open, except noindex pages and pages in a disabled project.'
+                : 'Search is switched off - nothing is added to public pages.'
         }
     };
 }

package/server/services/viewerSession.js

@@ -11,8 +11,8 @@
  * module reads it back.
  *
  * SCOPE - read this before reusing anything here:
- *   The cookie is consulted ONLY by the public page renderer (GET, no side
- *   effects). `authenticate()` in middleware/auth.js stays Bearer-only, so no
+ *   The cookie is consulted ONLY by read-only public GETs with no side
+ *   effects: the public page renderer and the site search (GET /api/search). `authenticate()` in middleware/auth.js stays Bearer-only, so no
  *   state-changing route is reachable with ambient credentials and the CSRF
  *   surface stays at zero. Do not wire `resolveViewer()` into a write path.
  */

package/server/services/views.js

@@ -29,7 +29,9 @@ import fs from 'fs/promises';
 import path from 'path';
 import {fileURLToPath} from 'url';
 import {v4 as uuidv4} from 'uuid';
-import {buildRowLevelMatch} from './rowAccess.js';
+import {buildRowLevelMatch, filterEntriesByAccess, needsEntryCheck} from './rowAccess.js';
+import {checkVisibility} from '../middleware/auth.js';
+import {getEffectiveLevel} from './userRoles.js';
 import {executePipeline} from './viewPipeline.js';
 import * as cache from './cache/index.js';
 
@@ -293,7 +295,11 @@ export async function createView(data, userId = null) {
             block: display?.block || ''
         },
         access: {
-            roles: access?.roles || ['admin', 'super-admin'],
+            // No roles named = the admin tier (effective level 0 or 1), which
+            // canReadView() reads from role LEVELS at request time. Roles are
+            // dynamic, so a default stored by name ('admin') would silently
+            // stop meaning anything once that role is renamed or removed.
+            roles: Array.isArray(access?.roles) ? access.roles : [],
             public: access?.public || false,
             rowLevel: access?.rowLevel || null
         },
@@ -385,9 +391,24 @@ async function executeMongoView(view, { page, limit, user }) {
     const pipeline = buildPipelineStages(view.pipeline?.stages || []);
 
     // Prepend row-level $match if configured
-    const rowFilter = buildRowLevelMatch(user, view.access?.rowLevel);
+    const rowLevel = view.access?.rowLevel;
+    const rowFilter = buildRowLevelMatch(user, rowLevel);
     if (rowFilter) {
         pipeline.unshift({$match: rowFilter});
+    } else if (needsEntryCheck(user, rowLevel)) {
+        // `reference` mode is a join a flat $match cannot express. Decide each
+        // SOURCE entry with checkEntryAccess() - the rule Actions apply - and
+        // restrict the pipeline to the ids that pass. It runs before $count and
+        // $skip/$limit, so the total and the pages describe only rows this
+        // viewer may see.
+        const field = rowLevel.field;
+        const candidates = field
+            ? await db.collection(sourceCollection)
+                .find({}, {projection: {_id: 0, id: 1, [`data.${field}`]: 1}})
+                .toArray()
+            : [];
+        const allowed = await filterEntriesByAccess(candidates, user, rowLevel);
+        pipeline.unshift({$match: {id: {$in: allowed.map(d => d.id)}}});
     }
 
     // Count total without pagination
@@ -420,13 +441,19 @@ async function executeMongoView(view, { page, limit, user }) {
 async function executeFileView(view, { page, limit, user }) {
     const { getAdapter } = await import('./adapterRegistry.js');
     const adapter = await getAdapter(view.pipeline.source);
-    const docs = await adapter.all(view.pipeline.source);
+    let docs = await adapter.all(view.pipeline.source);
 
     const stages = buildPipelineStages(view.pipeline?.stages || []);
 
-    const rowFilter = buildRowLevelMatch(user, view.access?.rowLevel);
+    const rowLevel = view.access?.rowLevel;
+    const rowFilter = buildRowLevelMatch(user, rowLevel);
     if (rowFilter) {
         stages.unshift({$match: rowFilter});
+    } else if (needsEntryCheck(user, rowLevel)) {
+        // `reference` mode (a join) - checkEntryAccess() per source entry,
+        // before the pipeline, so `total` and the pages count only rows this
+        // viewer may see.
+        docs = await filterEntriesByAccess(docs, user, rowLevel);
     }
 
     const all = await executePipeline(docs, stages, {
@@ -438,6 +465,36 @@ async function executeFileView(view, { page, limit, user }) {
     return { results: all.slice(offset, offset + limit), total, page, limit };
 }
 
+/**
+ * May this viewer read a saved view's rows?
+ *
+ * The ONE decision about `view.access` - the `[view]` shortcode (static and
+ * interactive) and `GET /api/views/:slug/public` all ask it, so a page that
+ * embeds a view can never show more than the view's own endpoint would.
+ *
+ * `public: true` lets everyone in. Otherwise `roles` is read with page
+ * visibility semantics (`checkVisibility`): a ladder per role, `=role` exact,
+ * level 0 always passes. A view that names no roles is the admin tier only
+ * (effective level 0 or 1, as `requireAdmin` reads it) - the tier createView
+ * defaults to - never "anyone signed in".
+ *
+ * Row-level scoping is separate: it narrows WHICH rows, and executeView
+ * applies it from the same viewer.
+ *
+ * @param {object|null} user - Resolved viewer (`{role, additionalRoles}`) or null
+ * @param {object|null} view - Saved view config
+ * @returns {boolean}
+ */
+export function canReadView(user, view) {
+    if (!view) return false;
+    const access = view.access || {};
+    if (access.public === true) return true;
+    if (!user?.role) return false;
+    const roles = Array.isArray(access.roles) ? access.roles.filter(r => typeof r === 'string' && r) : [];
+    if (!roles.length) return getEffectiveLevel(user) <= 1;
+    return checkVisibility(user, roles);
+}
+
 /**
  * Execute a view's pipeline and return paginated results.
  *
@@ -469,6 +526,11 @@ export async function executeViewConfig(view, {page = 1, limit = 25, user = null
     if (!view?.pipeline?.source) throw new Error('pipeline.source is required');
     validateStages(view.pipeline?.stages || []);
 
+    // Row-level scoping matches rows to a user. With nobody signed in there is
+    // no one to match, and `{'meta.createdBy': undefined}` would match every
+    // row that lacks an owner - so an anonymous run of a row-scoped view is empty.
+    if (view.access?.rowLevel && !user) return {results: [], total: 0, page, limit};
+
     // Dispatch on the SOURCE collection's storage adapter. A mongodb-declared
     // schema whose connection is unavailable falls back to the JS evaluator -
     // matching adapterRegistry's own file fallback.