domma-cms 1.6.2 → 1.6.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.6.2",
+  "version": "1.6.3",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/routes/api/analytics.js

@@ -345,6 +345,15 @@ export async function analyticsRoutes(fastify, opts = {}) {
 
     await migrateLegacy();
 
+    // Serialise read/modify/write operations so parallel beacons cannot lose
+    // counts or race over the same atomic-write temporary file.
+    let writeQueue = Promise.resolve();
+    const withAnalyticsWrite = (operation) => {
+        const result = writeQueue.then(operation);
+        writeQueue = result.catch(() => {});
+        return result;
+    };
+
     fastify.decorate('analytics', {
         async getStats({ range = '7d', from, to } = {}) {
             const dates = rangeToDates(range, from, to);
@@ -408,33 +417,35 @@ export async function analyticsRoutes(fastify, opts = {}) {
             }
         }
 
-        const today = todayKey();
-        const [lifetime, daily, journeys] = await Promise.all([
-            readJson(LIFETIME_FILE, {}),
-            readJson(DAILY_FILE, {}),
-            readJson(JOURNEYS_FILE, {})
-        ]);
+        return withAnalyticsWrite(async () => {
+            const today = todayKey();
+            const [lifetime, daily, journeys] = await Promise.all([
+                readJson(LIFETIME_FILE, {}),
+                readJson(DAILY_FILE, {}),
+                readJson(JOURNEYS_FILE, {})
+            ]);
 
-        lifetime[normalised] = (lifetime[normalised] || 0) + 1;
-        if (!daily[today]) daily[today] = {};
-        daily[today][normalised] = (daily[today][normalised] || 0) + 1;
-
-        // Journey event - only if sid is a string of reasonable shape, and under cap
-        const safeSid = typeof sid === 'string' && sid.length > 0 && sid.length <= 64 ? sid : null;
-        const safeRef = typeof ref === 'string' && ref.length <= 512 ? ref : '';
-        if (safeSid) {
-            if (!journeys[today]) journeys[today] = [];
-            if (shouldRecordJourney(journeys[today])) {
-                journeys[today].push({ sid: safeSid, t: Date.now(), url: normalised, ref: safeRef });
+            lifetime[normalised] = (lifetime[normalised] || 0) + 1;
+            if (!daily[today]) daily[today] = {};
+            daily[today][normalised] = (daily[today][normalised] || 0) + 1;
+
+            // Journey event - only if sid is a string of reasonable shape, and under cap
+            const safeSid = typeof sid === 'string' && sid.length > 0 && sid.length <= 64 ? sid : null;
+            const safeRef = typeof ref === 'string' && ref.length <= 512 ? ref : '';
+            if (safeSid) {
+                if (!journeys[today]) journeys[today] = [];
+                if (shouldRecordJourney(journeys[today])) {
+                    journeys[today].push({ sid: safeSid, t: Date.now(), url: normalised, ref: safeRef });
+                }
             }
-        }
 
-        await Promise.all([
-            writeJson(LIFETIME_FILE, lifetime),
-            writeJson(DAILY_FILE, daily),
-            writeJson(JOURNEYS_FILE, journeys)
-        ]);
-        return { ok: true };
+            await Promise.all([
+                writeJson(LIFETIME_FILE, lifetime),
+                writeJson(DAILY_FILE, daily),
+                writeJson(JOURNEYS_FILE, journeys)
+            ]);
+            return { ok: true };
+        });
     });
 
     fastify.get('/stats', { preHandler: [authenticate, requireAdmin] }, async (request) => {
@@ -544,17 +555,19 @@ export async function analyticsRoutes(fastify, opts = {}) {
     });
 
     fastify.delete('/stats', { preHandler: [authenticate, requireAdmin] }, async () => {
-        await Promise.all([
-            writeJson(LIFETIME_FILE, {}),
-            writeJson(DAILY_FILE, {}),
-            writeJson(JOURNEYS_FILE, {})
-        ]);
-        try {
-            await fs.unlink(LEGACY_FILE);
-        } catch {
-            // ignore
-        }
-        return { ok: true };
+        return withAnalyticsWrite(async () => {
+            await Promise.all([
+                writeJson(LIFETIME_FILE, {}),
+                writeJson(DAILY_FILE, {}),
+                writeJson(JOURNEYS_FILE, {})
+            ]);
+            try {
+                await fs.unlink(LEGACY_FILE);
+            } catch {
+                // ignore
+            }
+            return { ok: true };
+        });
     });
 }
 

package/server/services/markdown.js

@@ -1690,6 +1690,8 @@ export function scrubCodeRegions(markdown) {
 
     // HTML <pre><code>...</code></pre> blocks (rendered by earlier marked.parse calls inside accordion/carousel etc.)
     let scrubbed = markdown.replace(/<pre\b[^>]*>[\s\S]*?<\/pre>/gi, placeholder);
+  // Collection bodies may already be HTML: inline examples remain literal too.
+  scrubbed = scrubbed.replace(/<code\b[^>]*>[\s\S]*?<\/code>/gi, placeholder);
   // Fenced code blocks (``` or ~~~, with optional language tag)
     scrubbed = scrubbed.replace(/^(`{3,}|~{3,})[^\n]*\n[\s\S]*?\n\1[ \t]*$/gm, placeholder);
   // Inline code spans (single or multiple backticks, non-greedy)

package/server/services/rate-limit.js

@@ -4,8 +4,8 @@ import {isGenuinelyLocal} from './network.js';
 export function isBrowserAsset(request) {
     if (!['GET', 'HEAD'].includes(request.method)) return false;
     const path = request.url.split('?')[0];
-    return /^\/(?:admin|plugins|dist|public)\//.test(path)
-        && /\.(?:m?js|css|map|png|jpe?g|gif|webp|avif|svg|ico|woff2?|ttf|otf|html)$/i.test(path);
+    return /^\/(?:admin|plugins|dist|public|media)\//.test(path)
+        && /\.(?:m?js|css|map|png|jpe?g|gif|webp|avif|svg|ico|woff2?|ttf|otf|html|pdf|mp4|webm|mp3|wav|ogg)$/i.test(path);
 }
 
 export function rateLimitOptions({publicMax = 500, authenticatedMax = 3000} = {}) {
@@ -28,7 +28,9 @@ export function rateLimitOptions({publicMax = 500, authenticatedMax = 3000} = {}
                     }
                 } catch { /* invalid tokens retain the public limit */ }
             }
-            return request.ip;
+            // Page crawls and their background API calls have separate budgets.
+            const path = request.url.split('?')[0];
+            return path.startsWith('/api/') ? request.ip : `page:${request.ip}`;
         },
         max: request => identities.has(request) ? authenticatedMax : publicMax,
         allowList: request => isGenuinelyLocal(request)