domma-cms 1.10.30 → 1.10.31

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [1.10.31] - 2026-10-26
+
+- **Plugins can fetch user-chosen addresses safely.** `hooks.safeFetch(url, opts)` hands plugins the CMS's own outbound guard: public addresses only, the connection pinned to the checked address, redirects re-checked, ports 80 and 443, and the site's `outboundAllowPrivate` rule (ignored on hosted sites). Through the hook a plugin cannot pass in its own policy or resolver, and may raise the size, time and redirect limits only to 25 MB, 60 s and 5. It guards against plugin mistakes; on hosted sites plugin signing is what keeps out hostile code.
+
 ## [1.10.30] - 2026-10-26
 
 - Admin navigation keeps My Profile in the top account menu, removing its redundant System entry. Search defaults to Content, and existing System entries move there once while retaining saved settings and renamed folders.

package/CLAUDE.md

@@ -132,7 +132,7 @@ Collection entry I/O is delegated to a storage adapter. Schema management is alw
   `$graphLookup`, server-state stages, a `$lookup` not into a site `cms_<slug>` collection) and `__proto__`/`constructor`/
   `prototype`. A new path that hands user input to `find`/`aggregate` must go through one of the two
 - **Outbound requests to user-chosen URLs go through `services/outbound.js` `safeFetch()`** (Actions' webhook step,
-  form webhooks; plugins fetching a user's URL should too) - never bare `fetch`. Public addresses only after DNS, the
+  form webhooks; plugins use `hooks.safeFetch` - `pluginSafeFetch()`, which drops any policy/resolver they pass) - never bare `fetch`. Public addresses only after DNS, the
   connection pinned to the checked address, never this server's own addresses, redirects re-checked, ports 80/443.
   `server.json` `outboundAllowPrivate` (`true` or a list of hosts/addresses/CIDRs) lifts it for self-hosters and is
   ignored when `codePolicy.signedOnly()`. `wpImport/fetch.js` shares its address rules and pinned request

package/docs/plugin-development.md

@@ -356,6 +356,7 @@ roles and notifications are stamped with it). The sections below cover the main
 | `registerNotificationSource({id, label, severity, defaultOn, every, atBoot, check, audience})` | A switchable notification source, optionally scheduled (`boot`, `15m`, `hourly`, `daily`) (0.80.0) |
 | `registerLoginCheck({id, phase, check, verify?})` | A sign-in check: `phase: 'before'` (e.g. lockout, before the password is checked) or `'after'` (e.g. two-factor, can ask one more question) (0.83.0) |
 | `registerPasswordCheck({id, check})` | A password rule applied wherever a password is set (0.83.0) |
+| `safeFetch(url, {method, headers, body, timeoutMs, maxBytes, maxRedirects, truncate, signal})` | Fetch an address a site user chose, under the site's outbound rules (`services/outbound.js`): public addresses only, the connection pinned to the checked address, redirects re-checked, ports 80/443; `outboundAllowPrivate` applies on a self-hosted site and never on a signed-only one. Limits default to 1 MB / 15 s / 3 redirects and may be raised to 25 MB / 60 s / 5. Resolves `{ok, status, headers, buffer, text(), json(), url, truncated}`; a refusal rejects with `err.code === 'EREFUSED_SSRF'`. `body` is a string, Buffer or Uint8Array and `headers` a plain object or `Headers`; anything else rejects with a TypeError rather than going out empty. Use it instead of `fetch` for any user-chosen URL. Call it with `?.` - older cores lack it (1.10.31) |
 | `registerComponent({name, source})` | Add a Domma component from a `.dmc` source string, used on pages as `<dm-name>` or `[component]`; it is listed read-only in Components (0.92.2) |
 
 `onEnable` / `onDisable` exports receive `{fastify, services, hooks}` where `hooks` holds only the role and notification

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.10.30",
+  "version": "1.10.31",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/services/outbound.js

@@ -392,3 +392,62 @@ export async function safeFetch(url, opts = {}) {
     }
     throw new FetchRefused('Too many redirects.');
 }
+
+/** The most a plugin may raise safeFetch's limits to. */
+export const PLUGIN_FETCH_CAPS = Object.freeze({maxBytes: 25 * 1024 * 1024, timeoutMs: 60_000, maxRedirects: 5});
+
+/** A Headers instance or a plain object, as a plain object; anything else is refused. */
+function pluginHeaders(h) {
+    if (h == null) return undefined;
+    if (typeof Headers !== 'undefined' && h instanceof Headers) return Object.fromEntries(h.entries());
+    if (typeof h === 'object' && !Array.isArray(h)) return h;
+    throw new TypeError('safeFetch: headers must be an object or a Headers instance.');
+}
+
+/** A string, Buffer or byte array; anything else is refused rather than sent empty. */
+function pluginBody(b) {
+    if (b == null) return undefined;
+    if (typeof b === 'string' || Buffer.isBuffer(b)) return b;
+    if (b instanceof Uint8Array) return Buffer.from(b.buffer, b.byteOffset, b.byteLength);
+    throw new TypeError('safeFetch: body must be a string, Buffer or Uint8Array.');
+}
+
+/**
+ * The options a plugin's safeFetch call keeps: the request's own. `policy`,
+ * `lookup` and `own` are dropped - the site's policy is always read fresh (so
+ * `outboundAllowPrivate` still applies on a self-hosted site and is still
+ * ignored on a signed-only one) and a plugin cannot hand in its own resolver.
+ * The limits may be raised up to PLUGIN_FETCH_CAPS, never past them.
+ *
+ * @param {object} [opts] - method, headers, body, timeoutMs, maxBytes, maxRedirects, truncate, signal
+ * @returns {object}
+ */
+export function pluginFetchOptions(opts = {}) {
+    const o = opts && typeof opts === 'object' ? opts : {};
+    const capped = (key) => {
+        const n = Number(o[key]);
+        return o[key] != null && Number.isFinite(n) && n >= 0 ? Math.min(n, PLUGIN_FETCH_CAPS[key]) : undefined;
+    };
+    return {
+        method: typeof o.method === 'string' ? o.method : undefined,
+        headers: pluginHeaders(o.headers),
+        body: pluginBody(o.body),
+        timeoutMs: capped('timeoutMs'),
+        maxBytes: capped('maxBytes'),
+        maxRedirects: capped('maxRedirects'),
+        truncate: o.truncate === true,
+        signal: o.signal instanceof AbortSignal ? o.signal : undefined
+    };
+}
+
+/**
+ * `hooks.safeFetch(url, opts)` as plugins get it - see pluginFetchOptions().
+ * A refusal rejects with FetchRefused (`err.code === 'EREFUSED_SSRF'`); a body or
+ * headers of the wrong type reject with a TypeError.
+ *
+ * @param {string} url
+ * @param {object} [opts]
+ */
+export async function pluginSafeFetch(url, opts = {}) {
+    return safeFetch(String(url), pluginFetchOptions(opts));
+}

package/server/services/plugins.js

@@ -39,6 +39,7 @@ import {registerThemeProvider} from './themeSettings.js';
 import {classifyEntitlement, mayLoad} from './pluginEntitlement.js';
 import {notifierFor} from './notify.js';
 import {disableInstantCalls, enableInstantCalls, grantInstantCallsOnce} from './instantCalls.js';
+import {pluginSafeFetch} from './outbound.js';
 import {disableDashboardPro, enableDashboardPro, registerWidget, unregisterWidgetsFrom} from './widgets.js';
 import {createCollection, getCollection} from './collections.js';
 import * as defaultRolesService from './roles.js';
@@ -570,7 +571,9 @@ export async function registerPlugins(fastify) {
                   // Who may read a contact that is not their own (Contacts Pro's sharing) - hooks.js 7b.
                   registerContactAccess: (fn) => registerContactAccess(manifest.name, fn),
                   // Direct messages between team members (Messages) - hooks.js 7c; a call's "Add people" uses it.
-                  registerDirectMessenger: (fn) => registerDirectMessenger(manifest.name, fn)},
+                  registerDirectMessenger: (fn) => registerDirectMessenger(manifest.name, fn),
+                  // Fetching an address a site user chose (services/outbound.js) - the site's policy, never the plugin's.
+                  safeFetch: pluginSafeFetch},
               settings,
               config: {}
           });