domma-cms 1.6.34 → 1.6.36

package/server/routes/outreach-public.js

@@ -0,0 +1,68 @@
+/**
+ * The one-click unsubscribe page every outreach email links to:
+ *
+ *   GET /campaign-unsubscribe?e=<base64url address>&k=<HMAC>
+ *
+ * Core's, not the sending Tool's, so the link in an email already sent keeps
+ * working when that Tool lapses or is removed (PECR). The address goes on the
+ * shared suppression list (`outreach-unsubscribes`), which every outreach
+ * Tool checks before it sends.
+ *
+ * A Campaigns Pro older than this engine registers the same path itself, and
+ * plugins register before core: then core stands aside rather than collide.
+ *
+ * @module routes/outreach-public
+ */
+import {createCollection, createEntry, deleteEntry, getCollection, listEntries} from '../services/collections.js';
+import {createSuppression} from '../../plugins/_lib/outreach/suppression.js';
+import {UNSUBSCRIBE_PATH, verifyUnsubscribe} from '../../plugins/_lib/outreach/unsubscribe.js';
+import {getUnsubscribeSecret} from '../services/outreachUnsubscribe.js';
+
+const SLUG = 'outreach-unsubscribes';
+
+const esc = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+
+function page(title, bodyHtml) {
+    return `<!DOCTYPE html><html lang="en-GB"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta name="robots" content="noindex"><title>${esc(title)}</title><link rel="stylesheet" href="/dist/domma/domma.css"><style>main{max-width:36rem;margin:4rem auto;padding:0 1.25rem;line-height:1.6}</style></head><body><main>${bodyHtml}</main></body></html>`;
+}
+
+/** The suppression list's collection - made if no outreach Tool ever made it. */
+async function ensureList() {
+    try {
+        await getCollection(SLUG);
+    } catch {
+        await createCollection({
+            title: 'Outreach Unsubscribes', slug: SLUG,
+            description: 'The shared suppression list - addresses no outreach Tool may email.',
+            fields: [
+                {name: 'email', label: 'Email', type: 'text', required: true},
+                {name: 'at', label: 'At', type: 'text', required: false},
+                {name: 'source', label: 'Source', type: 'text', required: false}
+            ]
+        }).catch(() => {});
+    }
+}
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {{col?: object, secret?: string}} [opts] - tests inject a collections service and a secret
+ */
+export async function outreachPublicRoutes(fastify, opts = {}) {
+    if (fastify.hasRoute({method: 'GET', url: UNSUBSCRIBE_PATH})) return;
+    const col = opts.col || {createEntry, deleteEntry, listEntries};
+    const suppression = createSuppression(col);
+
+    fastify.get(UNSUBSCRIBE_PATH, async (req, reply) => {
+        reply.header('Cache-Control', 'no-store').header('Referrer-Policy', 'no-referrer');
+        let email = null;
+        try { email = verifyUnsubscribe(opts.secret || getUnsubscribeSecret(), req.query?.e, req.query?.k); } catch { email = null; }
+        if (!email) {
+            return reply.code(400).type('text/html; charset=utf-8')
+                .send(page('Unsubscribe', '<h1>That link is not right.</h1><p>Use the unsubscribe link from one of our emails.</p>'));
+        }
+        if (!opts.col) await ensureList();
+        await suppression.add(email, 'unsubscribe-link');
+        return reply.type('text/html; charset=utf-8').send(page('Unsubscribed',
+            `<h1>You are unsubscribed.</h1><p>${esc(email)} will get no more campaign or survey emails from this site.</p>`));
+    });
+}

package/server/server.js

@@ -30,6 +30,7 @@ import {seedDefaultComponents} from './services/components.js';
 import {refreshComponentTagAllowlist} from './services/markdown.js';
 import * as cache from './services/cache/index.js';
 import {parseTrustProxy} from './services/network.js';
+import {requestSerializer} from './services/request-log.js';
 import {rateLimitOptions} from './services/rate-limit.js';
 import {frameSources} from './services/embedCsp.js';
 
@@ -85,7 +86,10 @@ function resolveLogLevel() {
 }
 
 const app = Fastify({
-    logger: {level: resolveLogLevel()},
+    // The request serializer redacts query-string credentials (?token=, ?key=,
+    // *secret*, *password*) - see services/request-log.js; everything else is
+    // logged as Fastify would.
+    logger: {level: resolveLogLevel(), serializers: {req: requestSerializer}},
     // Behind a reverse proxy (Apache, domma-cms-manager), trust the proxy so
     // request.ip is the visitor, not the proxy's loopback. TRUST_PROXY=loopback
     // is the right value (right-most X-Forwarded-For entry a local proxy did not
@@ -723,6 +727,11 @@ await app.register(docsPublicRoutes);
 const { callPublicRoutes } = await import('./routes/call-public.js');
 await app.register(callPublicRoutes);
 
+// The outreach unsubscribe link (/campaign-unsubscribe) - core's, so it outlives the Tool that
+// sent the email. After the plugins: an older Campaigns Pro that registers it itself wins.
+const { outreachPublicRoutes } = await import('./routes/outreach-public.js');
+await app.register(outreachPublicRoutes);
+
 // Before the pages: /favicon.* must never reach the page router.
 const { faviconRoutes } = await import('./routes/favicon.js');
 await app.register(faviconRoutes);

package/server/services/authChecks.js

@@ -77,6 +77,14 @@ export async function runLoginChecks(phase, ctx, {start = 0, log = console} = {}
         try {
             out = await c.check(ctx);
         } catch (err) {
+            // A 'before' check that breaks (a breached-password lookup timing out) must not lock
+            // every account out, so it is skipped. An 'after' check is a second factor or a step-up:
+            // skipping one is a bypass (Security Pro's cookie parser threw on one bad cookie and a
+            // password alone signed in), so a throw there refuses the sign-in.
+            if (phase === 'after') {
+                log.error?.(`[auth] login check ${c.id} failed, sign-in refused: ${errOf(err)}`);
+                return {deny: true, message: 'Sign-in could not be completed. Try again.', status: 503, by: c.id};
+            }
             log.warn?.(`[auth] login check ${c.id} failed, skipped: ${errOf(err)}`);
             continue;
         }

package/server/services/collectionAccess.js

@@ -0,0 +1,191 @@
+/**
+ * Collection access through the generic Collections API (/api/collections/:slug/...).
+ *
+ * The generic routes are guarded by the `collections` permission, which every
+ * level-1 admin holds. Two kinds of collection need more than that:
+ *
+ *   - The user-data presets (Notes, Todo, Contacts) hold people's private rows.
+ *     Their own Tool routes scope every read and write to the caller
+ *     (`data.userId` for notes, tasks and contacts; `meta.createdBy` for the
+ *     shared contact groups, which anyone may read but only their creator or a
+ *     `contacts.manageGroups` holder may change). The generic API applies the
+ *     same rule, so an admin sees and edits their own rows and nobody else's.
+ *
+ *   - A collection a plugin created (`schema.plugin`) belongs to that plugin.
+ *     When the plugin registers permission resources (plugin.json
+ *     `permissions`, or `resources` in its role files) the caller must hold one
+ *     of them; a plugin that registers none falls back to `collections` alone.
+ *
+ * A level-0 user keeps everything - the same bypass rowAccess.js gives them.
+ */
+import {USER_DATA_PRESET_SLUGS} from './presetCollections.js';
+import {getPermissionsFor} from './roles.js';
+import {getEffectiveLevel, getEffectiveRoles} from './userRoles.js';
+import {getEffectiveRegistry} from './permissionRegistry.js';
+
+/** Where each user-data preset keeps its owner - the field its Tool routes filter on. */
+const OWNER_FIELD = Object.freeze({
+    'notes-notes':       {in: 'data', field: 'userId'},
+    'todo-items':        {in: 'data', field: 'userId'},
+    'contacts-contacts': {in: 'data', field: 'userId'},
+    'contacts-groups':   {in: 'meta', field: 'createdBy'}
+});
+
+/** A row anyone with the Tool may read, whoever made it (ownership gates writes only). */
+const SHARED_READ = new Set(['contacts-groups']);
+
+/**
+ * Whether the slug is one of the Tools' user-data presets.
+ *
+ * @param {string} slug
+ * @returns {boolean}
+ */
+export function isUserDataPreset(slug) {
+    return USER_DATA_PRESET_SLUGS.includes(slug);
+}
+
+/**
+ * The caller's id as the Tools record it (`id`, or `sub` on older tokens).
+ *
+ * @param {object|null} user
+ * @returns {string|null}
+ */
+export function callerId(user) {
+    return user?.id ?? user?.sub ?? null;
+}
+
+/**
+ * Whether the user holds the root (level 0) role, directly or through an
+ * additional role - the one level the scoping never applies to.
+ *
+ * @param {object|null} user
+ * @returns {boolean}
+ */
+export function isRoot(user) {
+    return Boolean(user) && getEffectiveLevel(user) === 0;
+}
+
+/**
+ * Whether any of the user's roles holds the resource (any action) or, with
+ * `action`, that specific action. Plugins name their own actions (`manage`,
+ * `send`, `kitchen`), so the bare resource is what the plugin check asks for.
+ *
+ * @param {object|null} user
+ * @param {string} resource
+ * @param {string} [action]
+ * @returns {boolean}
+ */
+export function holds(user, resource, action) {
+    if (!user) return false;
+    const allowed = getPermissionsFor(resource, action);
+    return getEffectiveRoles(user).some(r => allowed.includes(r));
+}
+
+/**
+ * The permission resources a plugin registered at boot (plugin.json
+ * `permissions` plus `resources` in its role files).
+ *
+ * @param {string} plugin
+ * @param {Array<{key: string, plugin?: string}>} [registry] - injectable for tests
+ * @returns {string[]}
+ */
+export function pluginResources(plugin, registry = getEffectiveRegistry()) {
+    return registry.filter(r => r.plugin === plugin).map(r => r.key);
+}
+
+/**
+ * Why `user` may not touch a plugin's collection through the generic API, or
+ * null when they may: the collection is nobody's, the plugin registered no
+ * permission, the user holds one of them, or the user is root.
+ *
+ * @param {object} schema
+ * @param {object|null} user
+ * @param {Array<{key: string, plugin?: string}>} [registry] - injectable for tests
+ * @returns {string|null}
+ */
+export function pluginDenial(schema, user, registry) {
+    const plugin = schema?.plugin;
+    if (!plugin || isRoot(user)) return null;
+    const resources = pluginResources(plugin, registry);
+    if (!resources.length) return null;
+    if (resources.some(resource => holds(user, resource))) return null;
+    return `This collection belongs to the ${plugin} plugin - its permission is required`;
+}
+
+/**
+ * The owner recorded on a row of a user-data preset.
+ *
+ * @param {string} slug
+ * @param {object} entry
+ * @returns {string|null}
+ */
+export function ownerOf(slug, entry) {
+    const where = OWNER_FIELD[slug];
+    if (!where) return null;
+    return entry?.[where.in]?.[where.field] ?? null;
+}
+
+/**
+ * The list filter that keeps a user-data preset to the caller's own rows, or
+ * null when no filter applies (not a user-data preset, root, or a preset whose
+ * rows everyone may read). `createdBy` is the filter engine's pseudo-field for
+ * `meta.createdBy`; anything else is a `data` field.
+ *
+ * @param {string} slug
+ * @param {object|null} user
+ * @returns {object|null}
+ */
+export function ownRowsFilter(slug, user) {
+    const where = OWNER_FIELD[slug];
+    if (!where || SHARED_READ.has(slug) || isRoot(user)) return null;
+    return {[where.field]: callerId(user)};
+}
+
+/**
+ * Whether `user` may read one row of a user-data preset.
+ *
+ * @param {string} slug
+ * @param {object} entry
+ * @param {object|null} user
+ * @returns {boolean}
+ */
+export function mayReadRow(slug, entry, user) {
+    if (!OWNER_FIELD[slug] || SHARED_READ.has(slug) || isRoot(user)) return true;
+    const uid = callerId(user);
+    return Boolean(uid) && ownerOf(slug, entry) === uid;
+}
+
+/**
+ * Whether `user` may change or remove one row of a user-data preset: its
+ * owner, root, or - for contact groups - a `contacts.manageGroups` holder, as
+ * the Contacts Tool allows.
+ *
+ * @param {string} slug
+ * @param {object} entry
+ * @param {object|null} user
+ * @returns {boolean}
+ */
+export function mayWriteRow(slug, entry, user) {
+    if (!OWNER_FIELD[slug] || isRoot(user)) return true;
+    const uid = callerId(user);
+    if (uid && ownerOf(slug, entry) === uid) return true;
+    return slug === 'contacts-groups' && holds(user, 'contacts', 'manageGroups');
+}
+
+/**
+ * The data to store for a user-data preset row written by `user`: a new row
+ * is theirs, an existing row keeps its owner. Root writes what it sent.
+ * Groups record their owner in meta, so their data passes through.
+ *
+ * @param {string} slug
+ * @param {object} data
+ * @param {object|null} user
+ * @param {object|null} [existing] - the row being replaced, for updates
+ * @returns {object}
+ */
+export function pinOwner(slug, data, user, existing = null) {
+    const where = OWNER_FIELD[slug];
+    if (!where || where.in !== 'data' || isRoot(user)) return data;
+    const owner = existing ? ownerOf(slug, existing) : callerId(user);
+    return {...data, [where.field]: owner ?? null};
+}

package/server/services/collections.js

@@ -594,14 +594,20 @@ export async function migrateStorage(slug, storage) {
  *
  * @param {string} slug
  * @param {'json'|'csv'} [format='json']
+ * @param {object} [opts]
+ * @param {Record<string, unknown>|null} [opts.filter] - only the matching rows (filterEngine.js syntax)
  * @returns {Promise<string>}
  */
-export async function exportEntries(slug, format = 'json') {
+export async function exportEntries(slug, format = 'json', {filter = null} = {}) {
     const schema = await getCollection(slug);
     if (!schema) throw new Error(`Collection "${slug}" not found`);
 
     const adapter = await getAdapter(slug);
-    const entries = await adapter.all(slug);
+    // With a filter (the generic API exporting one person's rows of a user-data
+    // preset) only the matching rows go out; otherwise everything, trash included.
+    const entries = filter
+        ? (await adapter.list(slug, {limit: 0, sort: 'createdAt', order: 'asc', filter})).entries
+        : await adapter.all(slug);
 
     if (format === 'csv') {
         const columns = [

package/server/services/markdown.js

@@ -777,7 +777,8 @@ function renderCollectionCarousel(entries, opts, ctxOpts = {}) {
         return `<div class="dm-collection-display dm-collection-empty"><p>${escapeHtmlText(emptyMsg)}</p></div>`;
     }
 
-    const passthrough = ['autoplay', 'interval', 'loop', 'animation', 'animation-duration', 'animation-easing']
+    const passthrough = ['autoplay', 'interval', 'loop', 'animation', 'animation-duration', 'animation-easing', 'arrow-position',
+        'background', 'arrow-background', 'arrow-color']
         .map(k => dataAttrs[k] ? ` data-${k}="${escapeAttr(String(dataAttrs[k]))}"` : '')
         .join('');
 
@@ -3157,7 +3158,11 @@ function processCarouselBlocks(markdown) {
         attrs.loop ? ` data-loop="${escapeAttr(attrs.loop)}"` : '',
         attrs.animation ? ` data-animation="${escapeAttr(attrs.animation)}"` : '',
         attrs['animation-duration'] ? ` data-animation-duration="${escapeAttr(attrs['animation-duration'])}"` : '',
-        attrs['animation-easing'] ? ` data-animation-easing="${escapeAttr(attrs['animation-easing'])}"` : ''
+        attrs['animation-easing'] ? ` data-animation-easing="${escapeAttr(attrs['animation-easing'])}"` : '',
+        ['top', 'middle', 'bottom'].includes(attrs['arrow-position']) ? ` data-arrow-position="${escapeAttr(attrs['arrow-position'])}"` : '',
+        attrs.background ? ` data-background="${escapeAttr(attrs.background)}"` : '',
+        attrs['arrow-background'] ? ` data-arrow-background="${escapeAttr(attrs['arrow-background'])}"` : '',
+        attrs['arrow-color'] ? ` data-arrow-color="${escapeAttr(attrs['arrow-color'])}"` : ''
       ].join('');
       const idAttr = attrs.id ? ` id="${escapeAttr(attrs.id)}"` : '';
 

package/server/services/outreachUnsubscribe.js

@@ -0,0 +1,54 @@
+/**
+ * The site's outreach unsubscribe secret - the key every emailed unsubscribe
+ * link is signed with (plugins/_lib/outreach/unsubscribe.js).
+ *
+ * It belongs to the engine, not to the Tool that sends, so the links in emails
+ * already sent keep verifying after that Tool's licence lapses or it is
+ * removed: UK marketing email (PECR) needs the opt-out to keep working.
+ * Kept in `config/outreach.json`.
+ *
+ * Before the engine owned it a sending Tool kept it in its own
+ * config/plugins.json entry as `unsubscribeSecret`. The first read adopts such
+ * a secret (any entry - core does not name Tools), so links signed with it
+ * still verify; only a site that never had one gets a fresh secret.
+ *
+ * @module services/outreachUnsubscribe
+ */
+import {getConfig, saveConfig} from '../config.js';
+import {mintSecret} from '../../plugins/_lib/outreach/unsubscribe.js';
+import {getPluginStates} from './plugins.js';
+
+let cached = null;
+
+/** A secret a Tool left in config/plugins.json before the engine kept one, or null. */
+export function legacySecret(states = getPluginStates()) {
+    for (const state of Object.values(states || {})) {
+        const s = state && typeof state === 'object' ? state.unsubscribeSecret : null;
+        if (typeof s === 'string' && s.length >= 32) return s;
+    }
+    return null;
+}
+
+/**
+ * The secret, minted (or adopted) and stored on first use.
+ *
+ * @returns {string}
+ */
+export function getUnsubscribeSecret() {
+    if (cached) return cached;
+    let stored = null;
+    try { stored = getConfig('outreach'); } catch { /* no file yet */ }
+    if (typeof stored?.unsubscribeSecret === 'string' && stored.unsubscribeSecret) {
+        cached = stored.unsubscribeSecret;
+        return cached;
+    }
+    const secret = legacySecret() || mintSecret();
+    saveConfig('outreach', {...(stored || {}), unsubscribeSecret: secret});
+    cached = secret;
+    return cached;
+}
+
+/** Tests only: forget the cached secret. */
+export function _resetUnsubscribeSecretForTest() {
+    cached = null;
+}

package/server/services/request-log.js

@@ -0,0 +1,70 @@
+/**
+ * Request log redaction - credentials never reach the pino request line.
+ *
+ * Several routes carry a live credential in the query string: the mail reader's
+ * `/body?token=` grant, the ecards `/ecards/view?token=` link, the call invite's
+ * `?key=`. Fastify's default `req` serializer logs `req.url` whole, so the log
+ * (and anything shipping it) held usable tokens for as long as it was kept.
+ *
+ * Only the VALUES of the sensitive parameters are replaced; the path, the other
+ * parameters and every other field Fastify logs stay exactly as before, so log
+ * greps keep working.
+ */
+
+/** Parameter names redacted whatever their case. */
+const SENSITIVE = new Set(['token', 't', 'key', 'hostkey', 'invitekey']);
+
+/** Anything with secret or password in the name is redacted too. */
+const SENSITIVE_PATTERN = /secret|password|passwd/i;
+
+export const REDACTED = '[redacted]';
+
+/** Is this query parameter a credential? */
+export function isSensitiveParam(name) {
+    const n = String(name ?? '');
+    return SENSITIVE.has(n.toLowerCase()) || SENSITIVE_PATTERN.test(n);
+}
+
+/**
+ * The URL with credential values replaced by `[redacted]`.
+ *
+ * Works on the raw query text rather than URLSearchParams so a URL that does
+ * not re-encode identically still logs as it was requested: only the value
+ * between `=` and the next `&` (or `#`) is replaced.
+ *
+ * @param {string} url
+ * @returns {string}
+ */
+export function redactUrl(url) {
+    if (typeof url !== 'string') return url;
+    const q = url.indexOf('?');
+    if (q === -1) return url;
+    const hash = url.indexOf('#', q);
+    const query = hash === -1 ? url.slice(q + 1) : url.slice(q + 1, hash);
+    if (!query) return url;
+    const cleaned = query.split('&').map((pair) => {
+        if (!pair) return pair;
+        const eq = pair.indexOf('=');
+        const name = eq === -1 ? pair : pair.slice(0, eq);
+        let decoded = name;
+        try { decoded = decodeURIComponent(name); } catch { /* keep as sent */ }
+        if (!isSensitiveParam(decoded)) return pair;
+        return `${name}=${REDACTED}`;
+    }).join('&');
+    return url.slice(0, q + 1) + cleaned + (hash === -1 ? '' : url.slice(hash));
+}
+
+/**
+ * Fastify's default `req` serializer (fastify/lib/logger-pino.js) with the
+ * url redacted. Field for field the same otherwise.
+ */
+export function requestSerializer(req) {
+    return {
+        method: req.method,
+        url: redactUrl(req.url),
+        version: req.headers && req.headers['accept-version'],
+        host: req.host,
+        remoteAddress: req.ip,
+        remotePort: req.socket ? req.socket.remotePort : undefined,
+    };
+}

package/server/templates/page.html

@@ -25,7 +25,7 @@
     <link rel="stylesheet" href="/dist/domma/themes/domma-themes.css">
 
     <!-- Site CSS -->
-    <link rel="stylesheet" href="/public/css/site.css?v=20261012-carousel-centre">
+    <link rel="stylesheet" href="/public/css/site.css?v=20261013-carousel-controls">
     <link rel="stylesheet" href="/public/css/forms.css?v=20260927-submit-btn-css">
     <!-- Menu item hover / current-page effects. Loaded after site.css so a
          menu's own highlight wins over the blanket link styling there. -->
@@ -173,7 +173,7 @@
     </script>
 
     <!-- Site initialisation -->
-    <script src="/public/js/site.js?v=20261012-timeline-icons" type="module"></script>
+    <script src="/public/js/site.js?v=20261013-carousel-colours" type="module"></script>
     <script src="/public/js/collection-context.js?v=20261010-utf8-payloads" type="module"></script>
     {{ctxMenusModule}}
 
@@ -191,7 +191,7 @@
     <script src="/public/js/forms.js?v=20261009-form-classes" type="module"></script>
 
     <!-- Core effects runtime -->
-    <script src="/public/js/effects.js?v=20261012-scribe-typography"></script>
+    <script src="/public/js/effects.js?v=20261013-scribe-fonts"></script>
 
     <!-- Plugin body-end injection -->
     {{bodyEndInject}}