domma-cms 1.6.3 → 1.6.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.6.3",
+  "version": "1.6.4",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/middleware/auth.js

@@ -5,10 +5,17 @@
  */
 import {getPermissionsFor, getPermissionsForRole, getRoleHierarchy, getRoleLevel} from '../services/roles.js';
 import {getEffectiveLevel, getEffectiveRoles} from '../services/userRoles.js';
+import {getUserById} from '../services/users.js';
 
 /**
  * Verify JWT Bearer token. Populates request.user on success.
  *
+ * The token does not carry the user's project access scope, so it is read from
+ * the user record on every request and set as `request.user.projects` - every
+ * `canSeeArtefact()` check depends on it, and without it a scoped user looked
+ * unrestricted. Reading it here, not signing it into the token, means a change
+ * to someone's access applies to their next request.
+ *
  * @param {FastifyRequest} request
  * @param {FastifyReply} reply
  * @returns {Promise<void>}
@@ -30,6 +37,8 @@ export async function authenticate(request, reply) {
             message: 'Invalid or missing authentication token'
         });
     }
+    const user = request.user?.id ? await getUserById(request.user.id) : null;
+    request.user.projects = Array.isArray(user?.projects) ? user.projects : [];
 }
 
 /**

package/server/routes/api/pages.js

@@ -23,6 +23,7 @@ import {
 } from '../../services/previewLinks.js';
 import {getVersionCount} from '../../services/versions.js';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
+import {canSeeArtefact, canSeePage} from '../../services/projects.js';
 import {getConfig, saveConfig} from '../../config.js';
 import {relinkItems, relinkMenus} from '../../services/menus.js';
 import {ago, clip, plural} from '../../services/sidebarBadges.js';
@@ -113,7 +114,8 @@ export async function pagesRoutes(fastify) {
 
     fastify.get('/pages/preview-links', canRead, async (request) => {
         const {urlPath} = request.query || {};
-        return {links: await listPreviewLinks(urlPath || undefined)};
+        const links = await listPreviewLinks(urlPath || undefined);
+        return {links: await visibleTo(request.user, links, l => l.urlPath)};
     });
 
     fastify.post('/pages/preview-links', canUpdate, async (request, reply) => {
@@ -123,9 +125,11 @@ export async function pagesRoutes(fastify) {
         }
         // Refuse to mint for a page that does not exist - otherwise a typo
         // produces a link that 404s for the recipient and looks like a bug.
-        if (!(await getPage(urlPath))) {
+        const target = await getPage(urlPath);
+        if (!target) {
             return reply.status(404).send({error: 'Page not found'});
         }
+        if (!(await canSeePage(request.user, urlPath, target.project))) return denied(reply);
         const link = await createPreviewLink({
             urlPath,
             jwt: fastify.jwt,
@@ -141,6 +145,8 @@ export async function pagesRoutes(fastify) {
     });
 
     fastify.delete('/pages/preview-links/:id', canUpdate, async (request, reply) => {
+        const link = (await listPreviewLinks()).find(l => l.id === request.params.id);
+        if (link && !(await canSeePage(request.user, link.urlPath))) return denied(reply);
         const ok = await revokePreviewLink(request.params.id);
         if (!ok) return reply.status(404).send({error: 'Link not found'});
         return {success: true};
@@ -148,7 +154,7 @@ export async function pagesRoutes(fastify) {
 
     // Aggregate unique tags from all pages - must be registered before the wildcard /pages/* route
     fastify.get('/pages/tags', canRead, async (request, reply) => {
-        const pages = await listPages();
+        const pages = (await listPages()).filter(p => inScope(request.user, p));
         const tagSet = new Set();
         pages.forEach(p => {
             if (Array.isArray(p.tags)) p.tags.forEach(t => { if (t) tagSet.add(t); });
@@ -157,11 +163,12 @@ export async function pagesRoutes(fastify) {
     });
 
     // The sidebar badge. Static, so it is matched before the /pages/* wildcard below.
-    fastify.get('/pages/_count', canRead, async () => pagesBadge(await listPages()));
+    fastify.get('/pages/_count', canRead, async (request) =>
+        pagesBadge((await listPages()).filter(p => inScope(request.user, p))));
 
     // List all pages
     fastify.get('/pages', canRead, async (request, reply) => {
-        const pages = await listPages();
+        const pages = (await listPages()).filter(p => inScope(request.user, p));
         const counts = await Promise.all(pages.map(p => getVersionCount(p.urlPath)));
         return pages.map((p, i) => ({
             urlPath: p.urlPath,
@@ -191,6 +198,7 @@ export async function pagesRoutes(fastify) {
         const urlPath = '/' + request.params['*'];
         const page = await getPage(urlPath);
         if (!page) return reply.status(404).send({ error: 'Page not found' });
+        if (!(await canSeePage(request.user, urlPath, page.project))) return denied(reply);
         return page;
     });
 
@@ -214,6 +222,7 @@ export async function pagesRoutes(fastify) {
             });
         }
 
+        if (!(await canSeePage(request.user, urlPath, frontmatter?.project))) return denied(reply);
         const page = await createPage(urlPath, frontmatter || {}, body || '');
         return reply.status(201).send(page);
     });
@@ -225,6 +234,10 @@ export async function pagesRoutes(fastify) {
 
         const existing = await getPage(urlPath);
         if (!existing) return reply.status(404).send({ error: 'Page not found' });
+        if (!(await canSeePage(request.user, urlPath, existing.project))) return denied(reply);
+        // Nor may a save move the page into a project outside the user's scope.
+        const project = frontmatter && 'project' in frontmatter ? frontmatter.project : existing.project;
+        if (!(await canSeePage(request.user, newUrlPath || urlPath, project))) return denied(reply);
 
         if (newUrlPath && newUrlPath !== urlPath) {
             const conflict = await getPage(newUrlPath);
@@ -249,6 +262,7 @@ export async function pagesRoutes(fastify) {
         const urlPath = '/' + request.params['*'];
         const existing = await getPage(urlPath);
         if (!existing) return reply.status(404).send({ error: 'Page not found' });
+        if (!(await canSeePage(request.user, urlPath, existing.project))) return denied(reply);
 
         await deletePage(urlPath);
         // A share link must not outlive the page it pointed at.
@@ -257,6 +271,45 @@ export async function pagesRoutes(fastify) {
     });
 }
 
+/**
+ * A listed page's project is already resolved (listPages sets resolvedProject).
+ *
+ * @param {object} user
+ * @param {object} page
+ * @returns {boolean}
+ */
+function inScope(user, page) {
+    return canSeeArtefact(user, {meta: {project: page.resolvedProject}});
+}
+
+/**
+ * Keep the items whose page `user` may see.
+ *
+ * @param {object} user
+ * @param {object[]} items
+ * @param {function(object): string} urlOf
+ * @returns {Promise<object[]>}
+ */
+async function visibleTo(user, items, urlOf) {
+    const out = [];
+    for (const item of items) {
+        const page = await getPage(urlOf(item));
+        if (await canSeePage(user, urlOf(item), page?.project)) out.push(item);
+    }
+    return out;
+}
+
+/**
+ * The refusal every page route gives for a page outside the user's projects -
+ * the same wording as the collection routes.
+ *
+ * @param {FastifyReply} reply
+ * @returns {FastifyReply}
+ */
+function denied(reply) {
+    return reply.status(403).send({error: 'Access denied for this project'});
+}
+
 /**
  * A page moved: re-aim the menu links that pointed at it. Menus replaced
  * config/navigation.json; a site that still has the legacy file gets it rewritten

package/server/routes/api/projects.js

@@ -50,6 +50,16 @@ export async function projectsRoutes(fastify, opts = {}) {
     const canUpdate = {preHandler: [authenticate, requirePermission('projects', 'update')]};
     const canDelete = {preHandler: [authenticate, requirePermission('projects', 'delete')]};
 
+    // A project outside the user's access scope is not there for them: the same
+    // 404 the list's absence implies, as remove-contents already answers.
+    const inScope = async (request, reply) => {
+        const visible = await listProjectsForUser(request.user);
+        if (!visible.some(p => p.slug === request.params.slug)) {
+            return reply.status(404).send({error: 'Project not found'});
+        }
+    };
+    const scoped = (guard) => ({preHandler: [...guard.preHandler, inScope]});
+
     fastify.get('/projects', canRead, async (request) => {
         const list = await listProjectsForUser(request.user);
         if (request.query?.counts !== '1') return list;
@@ -64,7 +74,7 @@ export async function projectsRoutes(fastify, opts = {}) {
     // Registered before /projects/:slug; `_` is outside the slug alphabet, so no project can shadow it.
     fastify.get('/projects/_count', canRead, async (request) => projectsBadge(await listProjectsForUser(request.user)));
 
-    fastify.get('/projects/:slug', canRead, async (request, reply) => {
+    fastify.get('/projects/:slug', scoped(canRead), async (request, reply) => {
         const project = await getProject(request.params.slug);
         if (!project) return reply.status(404).send({error: 'Project not found'});
         return project;
@@ -82,7 +92,7 @@ export async function projectsRoutes(fastify, opts = {}) {
         }
     });
 
-    fastify.put('/projects/:slug', canUpdate, async (request, reply) => {
+    fastify.put('/projects/:slug', scoped(canUpdate), async (request, reply) => {
         try {
             const project = await updateProject(request.params.slug, request.body || {});
             await cache.invalidateTags(['projects', `project:${request.params.slug}`]);
@@ -93,7 +103,7 @@ export async function projectsRoutes(fastify, opts = {}) {
         }
     });
 
-    fastify.delete('/projects/:slug', canDelete, async (request, reply) => {
+    fastify.delete('/projects/:slug', scoped(canDelete), async (request, reply) => {
         if (request.params.slug === CORE_PROJECT_SLUG) {
             return reply.status(403).send({error: 'Cannot delete the core project'});
         }
@@ -140,14 +150,14 @@ export async function projectsRoutes(fastify, opts = {}) {
         }
     });
 
-    fastify.get('/projects/:slug/artefacts', canRead, async (request, reply) => {
+    fastify.get('/projects/:slug/artefacts', scoped(canRead), async (request, reply) => {
         if (!(await getProject(request.params.slug))) {
             return reply.status(404).send({error: 'Project not found'});
         }
         return getArtefactsForProject(request.params.slug);
     });
 
-    fastify.post('/projects/:slug/untag-all', canDelete, async (request, reply) => {
+    fastify.post('/projects/:slug/untag-all', scoped(canDelete), async (request, reply) => {
         if (request.params.slug === CORE_PROJECT_SLUG) {
             return reply.status(403).send({error: 'Cannot untag the core project - artefacts would immediately resolve back to it'});
         }

package/server/routes/api/versions.js

@@ -18,11 +18,28 @@ import {
     restoreVersion
 } from '../../services/versions.js';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
+import {getPage} from '../../services/content.js';
+import {canSeePage} from '../../services/projects.js';
+
+/**
+ * A page's versions belong to its project: refuse them to a user outside it,
+ * as the page routes do. Every route here ends in the page's path (`*`).
+ *
+ * @param {FastifyRequest} request
+ * @param {FastifyReply} reply
+ */
+async function pageInScope(request, reply) {
+    const urlPath = '/' + request.params['*'];
+    const page = await getPage(urlPath);
+    if (!(await canSeePage(request.user, urlPath, page?.project))) {
+        return reply.status(403).send({error: 'Access denied for this project'});
+    }
+}
 
 export async function versionsRoutes(fastify) {
-    const canRead = {preHandler: [authenticate, requirePermission('pages', 'read')]};
-    const canUpdate = {preHandler: [authenticate, requirePermission('pages', 'update')]};
-    const canDelete = {preHandler: [authenticate, requirePermission('pages', 'delete')]};
+    const canRead = {preHandler: [authenticate, requirePermission('pages', 'read'), pageInScope]};
+    const canUpdate = {preHandler: [authenticate, requirePermission('pages', 'update'), pageInScope]};
+    const canDelete = {preHandler: [authenticate, requirePermission('pages', 'delete'), pageInScope]};
 
     // List versions for a page
     fastify.get('/versions/list/*', canRead, async (request, reply) => {

package/server/services/projects.js

@@ -405,6 +405,21 @@ export async function getProjectForPage(urlPath, explicitProject) {
     return best ?? coreFallback;
 }
 
+/**
+ * Can `user` see the page at `urlPath`? A page's project comes from its front
+ * matter or its address (getProjectForPage), then the same rule as every other
+ * artefact applies.
+ *
+ * @param {object} user
+ * @param {string} urlPath
+ * @param {string|null|undefined} explicitProject - the page's front matter `project`
+ * @returns {Promise<boolean>}
+ */
+export async function canSeePage(user, urlPath, explicitProject) {
+    const project = await getProjectForPage(urlPath, explicitProject);
+    return canSeeArtefact(user, {meta: {project}});
+}
+
 /** The per-type buckets every project's artefacts are grouped into. */
 export function emptyGroups() {
     return {