domma-cms 0.92.1 → 0.94.0

package/server/services/pluginInstaller.js

@@ -12,6 +12,7 @@
 
 import crypto from 'crypto';
 import fs from 'fs/promises';
+import {readFileSync} from 'fs';
 import path from 'path';
 import zlib from 'zlib';
 import {fileURLToPath} from 'url';
@@ -227,6 +228,40 @@ async function extractTar(tarBuffer, slug, destDir) {
     }
 }
 
+/**
+ * The version of the CMS this site runs. The engine's own checkout has it in
+ * package.json; a scaffolded or managed site's package.json is the site's, so
+ * there it comes from the `.domma` marker the scaffolder and updater write
+ * (or the manager's `.cmsVersion`). Null when none says.
+ *
+ * @param {string} [root]
+ * @returns {string|null}
+ */
+export function installedCmsVersion(root = ROOT) {
+    const read = (file) => {
+        try { return JSON.parse(readFileSync(path.join(root, file), 'utf8')); } catch { return null; }
+    };
+    const pkg = read('package.json');
+    if (pkg?.name === 'domma-cms' && pkg.version) return pkg.version;
+    return read('.domma')?.cmsVersion || read('.cmsVersion')?.cmsVersion || null;
+}
+
+/**
+ * The refusal for a manifest whose `minCmsVersion` is newer than this CMS, or
+ * null when it fits (or either version is unknown - an old site without a
+ * marker is not locked out of every plugin that sets the field).
+ *
+ * @param {{name?: string, displayName?: string, minCmsVersion?: string}} manifest
+ * @param {string|null} [cmsVersion]
+ * @returns {string|null}
+ */
+export function cmsVersionShortfall(manifest, cmsVersion = installedCmsVersion()) {
+    const needed = String(manifest?.minCmsVersion ?? '').trim().replace(/^[^\d]+/, '');
+    if (!needed || !cmsVersion) return null;
+    if (compareVersions(cmsVersion, needed) >= 0) return null;
+    return `${manifest.displayName || manifest.name} needs Domma CMS ${needed} or later; this site runs ${cmsVersion}. Update the CMS first.`;
+}
+
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -239,8 +274,10 @@ async function extractTar(tarBuffer, slug, destDir) {
  *   2. Reject if plugins/<slug>/ already exists
  *   3. Extract tarball to plugins/<slug>/ with path traversal guard
  *   4. Validate manifest via discoverPlugins()
+ *   4b. Refuse a plugin whose `minCmsVersion` is newer than this CMS
  *   5. Add { enabled: false, settings: {} } to config/plugins.json
- *   6. Run onEnable lifecycle hook (warn-only on failure)
+ *      (onEnable runs when it is enabled, not here)
+ *   6. Write the envelope's entitlement, if any
  *   7. Append install record to audit log
  *
  * A bundle from the marketplace is signed. One exported from a running CMS
@@ -331,6 +368,11 @@ export async function installPlugin(slug, { tarball, signature, publicKeyId, all
         await fs.rm(destDir, { recursive: true, force: true });
         throw new Error(`Plugin manifest validation failed after extraction: ${slug}`);
     }
+    const tooNew = cmsVersionShortfall(manifest);
+    if (tooNew) {
+        await fs.rm(destDir, { recursive: true, force: true });
+        throw new Error(tooNew);
+    }
 
     // Step 5 - Update config/plugins.json
     const cfg = await readPluginsConfig();
@@ -339,25 +381,19 @@ export async function installPlugin(slug, { tarball, signature, publicKeyId, all
         await writePluginsConfig(cfg);
     }
 
-    // Step 6 - Run onEnable lifecycle hook (warn on failure, do not throw)
-    try {
-        const pluginJsPath = path.join(destDir, 'plugin.js');
-        const mod = await import(pluginJsPath);
-        if (typeof mod.onEnable === 'function') {
-            await mod.onEnable(null);
-        }
-    } catch (err) {
-        console.warn(`[pluginInstaller] onEnable hook for "${slug}" failed: ${err.message}`);
-    }
+    // No onEnable here: the plugin is installed switched OFF (step 5), and
+    // enabling it runs onEnable with its real context ({fastify, services, hooks})
+    // through runLifecycleHook(). Calling it at install too ran it twice, the
+    // first time with null, which threw in any plugin that destructured it.
 
-    // Step 7 - Entitlement, if the envelope carried one. Written beside the
+    // Step 6 - Entitlement, if the envelope carried one. Written beside the
     // plugin so it travels with it and a renewal is a file drop.
     if (entitlement) {
         await fs.writeFile(path.join(destDir, '.entitlement.json'),
             JSON.stringify(entitlement, null, 2) + '\n', 'utf8');
     }
 
-    // Step 8 - Audit log. An unsigned install is recorded as such: it is the one
+    // Step 7 - Audit log. An unsigned install is recorded as such: it is the one
     // that was a judgement call rather than a verified fact.
     await writeAuditLog({
         action: unsigned ? 'install:unsigned' : 'install',
@@ -412,6 +448,11 @@ async function upgradePlugin(slug, {tarball, unsigned, entitlement, allowDowngra
         await fs.rm(incoming, {recursive: true, force: true});
         throw new Error(`Refusing to upgrade ${slug}: the new version is ${next.reason}`);
     }
+    const tooNew = cmsVersionShortfall(next.manifest);
+    if (tooNew) {
+        await fs.rm(incoming, {recursive: true, force: true});
+        throw new Error(tooNew);
+    }
 
     const from = current.manifest?.version;
     const to = next.manifest.version;

package/server/services/plugins.js

@@ -25,6 +25,7 @@ import {
     registerSanitizeRules,
     registerShortcode,
     hideSidebarUrl,
+    registerComponent,
     registerSidebarItem,
     registerTransform
 } from './hooks.js';
@@ -80,6 +81,23 @@ export async function validatePluginDir(dir, slug) {
     return {ok: true, manifest};
 }
 
+/**
+ * `hooks.registerComponent({name, source})` as plugins get it: registers the
+ * component (read-only in the Components list) and refreshes the sanitiser's
+ * `dm-*` tag allowlist, which was built at boot before any plugin ran - without
+ * the refresh a plugin's `<dm-name>` tag would be stripped from every page.
+ *
+ * @param {{name: string, source: string}} component
+ * @returns {Promise<void>}
+ */
+export async function pluginComponentHook(component) {
+    registerComponent(component);
+    try {
+        const {refreshComponentTagAllowlist} = await import('./markdown.js');
+        await refreshComponentTagAllowlist();
+    } catch { /* the allowlist is refreshed again on the next component save */ }
+}
+
 const failedLoads = [];
 
 /**
@@ -530,7 +548,9 @@ export async function registerPlugins(fastify) {
                   ...notifierFor(manifest.name, manifest.displayName || manifest.name),
                   // Sign-in and password checks (0.83) - Security / Security Pro. services/authChecks.js.
                   registerLoginCheck: (def) => registerLoginCheck(manifest.name, def),
-                  registerPasswordCheck: (def) => registerPasswordCheck(manifest.name, def)},
+                  registerPasswordCheck: (def) => registerPasswordCheck(manifest.name, def),
+                  // A Domma component (.dmc source) usable as <dm-name> / [component] on pages (0.92.2).
+                  registerComponent: pluginComponentHook},
               settings,
               config: {}
           });
@@ -586,6 +606,14 @@ export async function registerPlugins(fastify) {
         }
     }
 
+    // User guides (docs/*.md) of the plugins that loaded, under Documentation > Plugins.
+    try {
+        const {registerPluginGuides} = await import('./pluginGuides.js');
+        await registerPluginGuides(manifests.filter(m => loaded.includes(m.name)), PLUGINS_DIR);
+    } catch (err) {
+        fastify.log.warn(`[plugins] Plugin guides skipped: ${err.message}`);
+    }
+
     if (loaded.length) {
         fastify.log.info(`[plugins] Loaded ${loaded.length} plugin${loaded.length === 1 ? '' : 's'}: ${loaded.join(', ')}`);
     } else {

package/server/services/presetCollections.js

@@ -122,10 +122,10 @@ const PRESETS = [
     // them exactly preserves every existing entry; changing one would seed an
     // empty collection beside a site's real one.
     //
-    // seedAll() rewrites schema.json on every boot, so `storage` is declared
-    // exactly as the plugins declared it - a site that had these in Mongo must
-    // not silently switch to files and lose sight of its rows. Sites with no
-    // connections.json fall back to the file adapter as they always did.
+    // `storage` is declared exactly as the plugins declared it. It is used
+    // only where the site has a working MongoDB connection and no notes or
+    // todos already in files (adapterRegistry.js resolveUserDataPreset); a
+    // site's own storage block, once written, is kept by seedAll().
     {
         "slug": "notes-notes",
         "title": "Notes",
@@ -464,6 +464,28 @@ const PRESETS = [
 /** Slugs exported for use in adapterRegistry and the delete guard. */
 export const PRESET_COLLECTION_SLUGS = PRESETS.map(p => p.slug);
 
+/**
+ * The presets that hold people's own data - the Notes, Todo and Contacts
+ * Tools - rather than the site's workings. These, and only these, may live in
+ * MongoDB: a site that declares it for one and has a working connection gets
+ * it (adapterRegistry.js), and their `storage` block survives the reseed below
+ * so a storage move sticks. Every other preset (roles, user profiles,
+ * projects, notifications, api tokens and endpoints) is files, always.
+ */
+export const USER_DATA_PRESET_SLUGS = Object.freeze(['notes-notes', 'todo-items', 'contacts-contacts', 'contacts-groups']);
+
+const USER_DATA = new Set(USER_DATA_PRESET_SLUGS);
+
+/** A storage block worth keeping from an existing schema.json, or null. */
+async function keptStorage(schemaPath) {
+    try {
+        const storage = JSON.parse(await fs.readFile(schemaPath, 'utf8'))?.storage;
+        if (storage?.adapter === 'file') return {adapter: 'file'};
+        if (storage?.adapter === 'mongodb') return {adapter: 'mongodb', connection: storage.connection || 'default'};
+    } catch { /* new, or unreadable - the preset's own block it is */ }
+    return null;
+}
+
 /**
  * Seed all preset collections at boot.
  * Always overwrites schema.json; only creates data.json if absent.
@@ -477,7 +499,11 @@ export async function seedAll() {
         const dataPath = path.join(dir, 'data.json');
 
         await fs.mkdir(dir, {recursive: true});
-        await fs.writeFile(schemaPath, JSON.stringify(schema, null, 2) + '\n', 'utf8');
+        // A user-data preset keeps the storage the site has (a move to or from
+        // MongoDB); rewriting it would flip the site to the other store.
+        const kept = USER_DATA.has(schema.slug) ? await keptStorage(schemaPath) : null;
+        const written = kept ? {...schema, storage: kept} : schema;
+        await fs.writeFile(schemaPath, JSON.stringify(written, null, 2) + '\n', 'utf8');
 
         try {
             await fs.access(dataPath);

package/server/services/renderer.js

@@ -15,6 +15,7 @@ import {resolveContextMenusForPage} from './contextMenus.js';
 import {buildCustomThemeStyleTag, buildOverrideStyleTag, getThemeTokenMap, listThemeIds, loadThemeConfig, resolveThemeClasses} from './themeSettings.js';
 import {getSearchSettings} from './search.js';
 import {isToolEnabled} from './tools.js';
+import {fmtDateTime} from './dates.js';
 
 const VALID_LAYOUT_WIDTHS = new Set(['narrow', 'normal', 'wide', 'full']);
 const CUSTOM_CSS_PATH = new URL('../../content/custom.css', import.meta.url).pathname;
@@ -783,8 +784,7 @@ function formatExpiry(iso) {
     if (!iso) return '';
     const when = new Date(iso);
     if (Number.isNaN(when.getTime())) return '';
-    const opts = {day: 'numeric', month: 'short', year: 'numeric', hour: '2-digit', minute: '2-digit'};
-    return ` This link expires ${escapeHtml(when.toLocaleString('en-GB', opts))}.`;
+    return ` This link expires ${escapeHtml(fmtDateTime(when))}.`;
 }
 
 function escapeHtml(str) {

package/server/services/sidebarBadges.js

@@ -11,6 +11,8 @@
  * @module services/sidebarBadges
  */
 
+import {fmtDate} from './dates.js';
+
 /** "1 task", "3 tasks". */
 export function plural(n, one, many = `${one}s`) {
     return `${n} ${n === 1 ? one : many}`;
@@ -25,7 +27,7 @@ export function ago(iso, now = Date.now()) {
     if (s < 3600) return `${Math.round(s / 60)} min ago`;
     if (s < 86400) return plural(Math.round(s / 3600), 'hour') + ' ago';
     if (s < 86400 * 14) return plural(Math.round(s / 86400), 'day') + ' ago';
-    return new Date(t).toISOString().slice(0, 10);
+    return fmtDate(t);
 }
 
 /** Shorten to `max` characters on a word boundary, with an ellipsis. */

package/server/services/tools.js

@@ -3,8 +3,10 @@
  *
  * ## Built-in Tools
  *
- * Contacts, Notes, Todo and Analytics were plugins until 0.67.0. They are part
- * of the CMS now and ON unless a site says otherwise, in `config/tools.json`:
+ * Contacts, Notes, Todo and Analytics were plugins until 0.67.0; SEO joined them
+ * in 0.90.0 (CORE_TOOLS below). They are part of the CMS and ON unless a site
+ * says otherwise, in `config/tools.json`, switched at System > Plugins
+ * (#/plugins, the Marketplace screen):
  *
  *     { "notes": { "enabled": false, "locked": true } }
  *

package/server/templates/page.html

@@ -136,7 +136,7 @@
     </script>
 
     <!-- Site initialisation -->
-    <script src="/public/js/site.js?v=20260926-field-limits" type="module"></script>
+    <script src="/public/js/site.js?v=20260927-scope-mine" type="module"></script>
     <script src="/public/js/collection-context.js?v=20260927-ctx" type="module"></script>
     {{ctxMenusModule}}
 
@@ -147,7 +147,7 @@
 
     <!-- Interactive Collection Browser (used by [collection] shortcodes with
          searchable / filterable / sortable / paginate attributes) -->
-    <script src="/public/js/collection-browser.js?v=20260927-browser"></script>
+    <script src="/public/js/collection-browser.js?v=20260927-scope-mine"></script>
 
     <!-- Core Forms (logic engine must load before renderer) -->
     <script src="/public/js/form-logic-engine.js?v=20260926-limits"></script>