domma-cms 1.6.35 → 1.6.36

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.6.35",
+  "version": "1.6.36",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/plugins/_lib/call/ice.js

@@ -6,12 +6,15 @@
  *   {
  *     "stun": ["stun:stun.l.google.com:19302"],
  *     "turn": {"urls": ["turn:turn.example.org:3478?transport=udp", "turn:turn.example.org:3478?transport=tcp"],
- *              "secret": "<coturn static-auth-secret>", "ttlHours": 12}
+ *              "secret": "<coturn static-auth-secret>", "ttlHours": 4}
  *   }
  *
  * TURN credentials are coturn's time-limited kind (use-auth-secret): the
  * username is "<expiry>:<label>" and the password an HMAC of it, so no
  * account is ever stored and a copied credential stops working on its own.
+ * The default life is 4 hours (was 12): it is made when a person is let in,
+ * and a call rarely runs longer; a shorter one limits what a leaked credential
+ * is worth as a relay.
  *
  * @module _lib/call/ice
  */
@@ -32,7 +35,7 @@ export function readCallConfig(root = process.cwd()) {
         const stun = list(raw?.stun);
         const turnUrls = list(raw?.turn?.urls);
         const secret = typeof raw?.turn?.secret === 'string' ? raw.turn.secret : '';
-        const ttlHours = Math.max(1, Math.min(48, Number(raw?.turn?.ttlHours) || 12));
+        const ttlHours = Math.max(1, Math.min(48, Number(raw?.turn?.ttlHours) || 4));
         return {stun: stun.length ? stun : DEFAULT_STUN, turn: turnUrls.length && secret ? {urls: turnUrls, secret, ttlHours} : null};
     } catch {
         return {stun: DEFAULT_STUN, turn: null};

package/plugins/_lib/call/rooms.js

@@ -132,8 +132,11 @@ export function createRooms({now = Date.now, pollMs = POLL_MS, silentMs = SILENT
         const item = quiet ? undefined : system(room, person, 'joined', `${person.name} joined`);
         tell(admitted(room).filter(p => p !== person), {type: 'joined', peer: pub(person), ...(item && {item})});
         // `chat` is the history so far (their own "joined" line included), so a late joiner sees what was said.
+        // The ICE servers (TURN credentials) come HERE, not in the join reply: a guest still waiting, or turned
+        // away, never holds a relay credential. Made at admission, so its life starts now.
+        const ice = typeof person.ice === 'function' ? person.ice() : person.ice;
         push(person, {type: 'admitted', peers: admitted(room).filter(p => p !== person).map(pub), recording: room.recording,
-            chat: room.chat.filter(c => person.seeHistory || c.seq > person.fromSeq).map(c => ({...c}))});
+            chat: room.chat.filter(c => person.seeHistory || c.seq > person.fromSeq).map(c => ({...c})), ...(ice ? {iceServers: ice} : {})});
         tell(hosts(room), {type: 'waiting', waiting: waitingList(room)});
     }
 
@@ -149,9 +152,11 @@ export function createRooms({now = Date.now, pollMs = POLL_MS, silentMs = SILENT
          *   `canInvite`: this person may use the Tool's "Add people" (routes.js decides; see member()), with
          *   `inviteOptions` (what of it). `seeHistory: false`: when let in they get only the chat from their own
          *   "joined" line on - not what was said before (someone added to a conversation's call is not shown it).
+         *   `ice`: the ICE servers for this person (an array, or a function making them) - handed over in their
+         *   `admitted` event, never before: a waiting or turned-away guest holds no TURN credential.
          */
         join(key, {name, host = false, title = '', max = MAX_PEOPLE, recordingAllowed = false, autoAdmit = false, identity = '', history, canInvite = false,
-            inviteOptions = null, seeHistory = true}) {
+            inviteOptions = null, seeHistory = true, ice = null}) {
             let room = rooms.get(key);
             if (!room) {
                 const seeded = (Array.isArray(history) ? history : []).map(cleanItem).filter(Boolean).slice(-HISTORY_MAX);
@@ -177,7 +182,8 @@ export function createRooms({now = Date.now, pollMs = POLL_MS, silentMs = SILENT
             if (admitted(room).length >= room.max && (host || autoAdmit)) throw new CallError('full', `This call is full (${room.max} people).`);
             const id = newId(9);
             const person = {id, secret: newId(24), identity: String(identity || ''), who: whoOf(identity, id), name: String(name || '').trim().slice(0, 60) || (host ? 'Host' : 'Guest'),
-                host: Boolean(host), canInvite: canInvite === true, inviteOptions, seeHistory: seeHistory !== false, fromSeq: room.chatSeq, state: 'waiting', seq: 0, queue: [], waiters: [], seen: now()};
+                host: Boolean(host), canInvite: canInvite === true, inviteOptions, seeHistory: seeHistory !== false, fromSeq: room.chatSeq, state: 'waiting', seq: 0, queue: [], waiters: [], seen: now(),
+                ice: ice || null};
             room.people.set(person.id, person);
             if (host || autoAdmit) {
                 // admit() also tells every host - this one included - who is already waiting.

package/plugins/_lib/call/routes.js

@@ -4,7 +4,7 @@
  * nothing: only a Tool that mounts this, and says who may join which room,
  * has calls.
  *
- *   POST {prefix}/:room/join       {name, ...credentials}  -> {id, secret, host, state, iceServers, ...}
+ *   POST {prefix}/:room/join       {name, ...credentials}  -> {id, secret, host, state, ...} (ICE servers come in the `admitted` event)
  *   GET  {prefix}/:room/poll?since=N                         -> {events, state}   (long-poll, 25 s)
  *   POST {prefix}/:room/signal     {to, data}
  *   POST {prefix}/:room/chat       {text}
@@ -118,12 +118,15 @@ export function mountCallRoutes(fastify, {prefix = '/call', ns, resolve, rooms =
         try {
             const canInvite = inviting && (typeof r.mayInvite === 'boolean' ? r.mayInvite : r.host === true);
             const inviteOptions = canInvite ? inviteOptionsOf(r) : null;
+            // The ICE servers (a TURN credential good for ttlHours, when configured) go in this person's `admitted`
+            // event, made at admission - not in this reply, which a guest still waiting, or about to be turned away,
+            // also gets. Before, anyone holding a call link had a relay credential for the TTL.
+            const hostname = request.hostname;
             const joined = rooms.join(key, {name: r.name || body.name, host: r.host, title: r.title, max: r.max,
                 recordingAllowed: r.recordingAllowed === true, autoAdmit: r.autoAdmit === true, identity: r.identity || '', history, canInvite,
-                inviteOptions, seeHistory: r.history !== false});
+                inviteOptions, seeHistory: r.history !== false, ice: () => iceServers(config(), hostname)});
             // What "Add people" offers this person: {search, typed, copyLink, external} (invite.js inviteOptionsOf).
-            return reply.send({...joined, iceServers: iceServers(config(), request.hostname), closesAt: r.closesAt || null,
-                ...(inviteOptions ? {inviteOptions} : {})});
+            return reply.send({...joined, closesAt: r.closesAt || null, ...(inviteOptions ? {inviteOptions} : {})});
         } catch (err) { return fail(reply, err); }
     });
 

package/plugins/_lib/mail/defaults.js

@@ -40,6 +40,18 @@ export default {
      */
     allowInsecureTLS: false,
 
+    /**
+     * Let a mailbox or outgoing server be on a private, loopback or link-local
+     * address.
+     *
+     * Off, deliberately: "test these details" makes this server open TCP to the
+     * host typed in and report refused / no answer / unknown - a port scanner of
+     * the server's own network behind the Email permission. The site's own
+     * configured outgoing server (config/site.json smtp.host) is always allowed.
+     * Turn on only for a site whose mail server really is on its LAN.
+     */
+    allowPrivateMailHosts: false,
+
     /** Largest inline image embedded into a rendered body, in bytes. */
     inlineImageMaxBytes: 2_000_000,
 

package/plugins/_lib/mail/hostGuard.js

@@ -0,0 +1,86 @@
+/**
+ * May this server open a connection to that mail host?
+ *
+ * `/accounts/test`, saving a mailbox and the outgoing-server routes make the
+ * CMS open TCP to whatever host:port the caller typed, and `describeError()`
+ * answers "refused", "did not respond" or "could not be resolved" - a port
+ * scanner of the server's own network behind the `email` permission
+ * (127.0.0.1:27018 is the site's Mongo, :8192 the manager). So a private,
+ * loopback or link-local host is refused unless it is the host the site's own
+ * outgoing mail already goes to (config/site.json smtp.host - the LAN relay
+ * the admin chose) or `allowPrivateMailHosts` is set for a site whose mail
+ * server really is on its LAN.
+ *
+ * The pure half is `isPrivateAddress` / `isLocalName` in unsubscribe.js; this
+ * module adds the lookup, which the tests inject.
+ *
+ * @module _lib/mail/hostGuard
+ */
+import dns from 'node:dns/promises';
+import net from 'node:net';
+import {isLocalName, isPrivateAddress} from './unsubscribe.js';
+
+const REFUSED = 'That server is on this machine\'s own network, so the site will not connect to it. '
+    + 'Use the mail server\'s public name, or ask the site administrator to allow private mail hosts.';
+
+/**
+ * Normalise a typed host for comparison: case, trailing dot, IPv6 brackets.
+ *
+ * @param   {string} host
+ * @returns {string}
+ */
+export function normaliseHost(host) {
+    return String(host ?? '').trim().toLowerCase().replace(/\.$/, '').replace(/^\[(.*)\]$/, '$1');
+}
+
+/**
+ * Check one host.
+ *
+ * @param   {string} host
+ * @param   {object} [options]
+ * @param   {boolean} [options.allowPrivate]  - the site's `allowPrivateMailHosts` setting
+ * @param   {string}  [options.ownSmtpHost]   - the site's configured outgoing server; always allowed
+ * @param   {(host: string) => Promise<{address: string}[]>} [options.lookup] - DNS, injectable
+ * @returns {Promise<{ok: true} | {ok: false, error: string}>}
+ */
+export async function checkMailHost(host, {allowPrivate = false, ownSmtpHost = '', lookup} = {}) {
+    const name = normaliseHost(host);
+    if (!name) return {ok: false, error: 'A server is required.'};
+    if (allowPrivate) return {ok: true};
+    if (ownSmtpHost && normaliseHost(ownSmtpHost) === name) return {ok: true};
+
+    if (net.isIP(name)) {
+        return isPrivateAddress(name) ? {ok: false, error: REFUSED} : {ok: true};
+    }
+    if (isLocalName(name)) return {ok: false, error: REFUSED};
+
+    let answers;
+    try {
+        answers = await (lookup ?? ((h) => dns.lookup(h, {all: true})))(name);
+    } catch {
+        // Unresolvable: let the connection attempt say so in its own words.
+        // The check is about where a name points, not whether it exists.
+        return {ok: true};
+    }
+    // Every answer must be public: a name with one private A record among
+    // public ones is exactly the rebinding trick the check exists for.
+    const addresses = (answers ?? []).map(a => (typeof a === 'string' ? a : a?.address)).filter(Boolean);
+    if (addresses.some(isPrivateAddress)) return {ok: false, error: REFUSED};
+    return {ok: true};
+}
+
+/**
+ * The site's own outgoing server, from config/site.json `smtp.host` (what
+ * core `createTransport` sends with), read through a getter so a test can
+ * hand in its own.
+ *
+ * @param   {(section: string) => any} getConfig
+ * @returns {string}
+ */
+export function siteSmtpHost(getConfig) {
+    try {
+        return String(getConfig('site')?.smtp?.host ?? '').trim();
+    } catch {
+        return '';
+    }
+}

package/plugins/_lib/mail/readRoutes.js

@@ -28,6 +28,8 @@
 import {simpleParser} from 'mailparser';
 
 import {listUsers} from '../../../server/services/users.js';
+import {getConfig} from '../../../server/config.js';
+import {checkMailHost, siteSmtpHost} from './hostGuard.js';
 import * as accounts from './accounts.js';
 import * as bodyTokens from './bodyTokens.js';
 import {buildDiagnostics} from './diagnostics.js';
@@ -207,6 +209,11 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
         });
     }
 
+    /** Where this server may be asked to connect - see hostGuard.js. */
+    const guardHost = (host) => checkMailHost(host, {allowPrivate: config.allowPrivateMailHosts === true, ownSmtpHost: siteSmtpHost(getConfig)});
+    // Each test is a connection attempt whose answer says what is listening: a few a minute per address is plenty.
+    const testLimit = {config: {rateLimit: {max: 10, timeWindow: '1 minute'}}};
+
     /** GET /accounts - every mailbox this user owns, without passwords. */
     fastify.get('/accounts', {preHandler: [authenticate]}, async (request, reply) => {
         const uid = userId(request);
@@ -221,6 +228,8 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
 
         const result = accounts.validate(request.body ?? {}, null);
         if (!result.ok) return reply.code(400).send({error: result.error});
+        const where = await guardHost(result.value.host);
+        if (!where.ok) return reply.code(400).send({error: where.error});
 
         const saved = await accounts.saveAccount(uid, null, result.value);
         return {account: accounts.toPublic(saved)};
@@ -236,6 +245,8 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
 
         const result = accounts.validate(request.body ?? {}, existing);
         if (!result.ok) return reply.code(400).send({error: result.error});
+        const where = await guardHost(result.value.host);
+        if (!where.ok) return reply.code(400).send({error: where.error});
 
         const saved = await accounts.saveAccount(uid, request.params.id, result.value);
         // The pooled connection was opened with the old details.
@@ -271,7 +282,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
      * password field is blank and `id` names an existing mailbox, the stored
      * password is used - otherwise editing a hostname would mean retyping it.
      */
-    fastify.post('/accounts/test', {preHandler: [authenticate]}, async (request, reply) => {
+    fastify.post('/accounts/test', {preHandler: [authenticate], ...testLimit}, async (request, reply) => {
         const uid = userId(request);
         if (!uid) return reply.code(401).send({error: 'Authentication required.'});
 
@@ -281,6 +292,8 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
 
         const result = accounts.validate(body, existing);
         if (!result.ok) return reply.code(400).send({error: result.error});
+        const where = await guardHost(result.value.host);
+        if (!where.ok) return reply.code(400).send({error: where.error});
 
         let pass = result.value.password;
         if (!pass) {
@@ -711,6 +724,12 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
                 reply.code(404).send({error: 'That message is no longer in this folder.'});
                 return null;
             }
+            // The same ceiling as /messages/:uid and /body: without it a hostile
+            // 200 MB message cost a 200 MB buffer plus mailparser output per click.
+            if (fetched.source.length > config.maxMessageBytes) {
+                reply.code(413).send({error: 'That message is too large to open its attachments.'});
+                return null;
+            }
 
             const parsed = await simpleParser(fetched.source);
             const attachment = parsed.attachments?.[index];

package/plugins/_lib/public/call/call.js

@@ -569,6 +569,8 @@ function mount(el) {
         switch (e.type) {
             case 'knocking': stage.value = 'waiting'; break;
             case 'admitted':
+                // The ICE servers arrive with admission (not the join reply) - before any peer is connected.
+                if (Array.isArray(e.iceServers)) iceServers = e.iceServers;
                 stage.value = 'in';
                 recording.value = e.recording === true;
                 (e.chat || []).forEach(item => addItem(item, {live: false}));
@@ -868,7 +870,7 @@ function mount(el) {
                 if (r.status === 425 && body.opensAt) { error.value = `This call opens at ${new Date(body.opensAt).toLocaleTimeString([], {hour: '2-digit', minute: '2-digit'})}. Come back then.`; return; }
                 if (!r.ok) { error.value = body.error || 'Could not join the call.'; return; }
                 me = {id: body.id, secret: body.secret, who: body.who || body.id};
-                iceServers = body.iceServers || [];
+                iceServers = body.iceServers || [];   // an older engine's join reply; the admitted event replaces it
                 host.value = body.host === true;
                 if (body.name) name.value = body.name;
                 max.value = body.max || 6;

package/plugins/blog/CLAUDE.md

@@ -20,7 +20,7 @@ Public-facing blog for the CMS. Supports posts with categories, tags, and option
 - `blocks/*.html|css` - the shipped layouts, copied into content/blocks/ once
 - `public/blog.js`, `public/blog.css` - the browser half (listing, right-click menu, post extras)
 - `public/samples/*.svg` - sample covers
-- `tests/layouts.test.js`, `tests/public.test.js`, `tests/nav-link.test.js`
+- `tests/access.test.js`, `tests/comment-notices.test.js`, `tests/layouts.test.js`, `tests/nav-link.test.js`, `tests/notices.test.js`, `tests/public.test.js`
 - `admin/views/blog.js` - post list (KPIs + status/category/search filters)
 - `admin/views/post-editor.js` - create / edit a post
 - `admin/views/categories.js`, `admin/views/comments.js`, `admin/views/settings.js`
@@ -319,3 +319,13 @@ Declared in plugin.json `permissions` (granted once to `admin`), checked on EVER
 - `usePermissionLookup()` points the checks at a lookup: the plugin passes core's `getPermissionsFor` (or
   `options.getPermissionsFor` in tests).
 
+## 1.9.6 (2026-10-13 Tool sweep)
+
+- **One slug, one post.** `POST /posts` and `PUT /posts/:id` answer 409 when another post (draft or not; a Pro-era post
+  in another blog does not count) holds the slug - `slugHolder()` in lib/page.js. The public post lookup is
+  `publicPost()`: the LIVE post with that slug, not whichever is newest. Before, an author's draft saved with a live
+  post's slug sat first in the newest-first list and the live address answered 404.
+- **POST /comments** has its own `config.rateLimit` (5/min/IP), caps every field (`commentFields()`, exported and
+  tested), needs a plausible email, and refuses a post that does not exist or is not visible (404) - each of those
+  used to raise a staff notification.
+- `ASSET_V` / the preview `assetV` are 1.9.6 (they were 1.6.x while the plugin was 1.9.5 - keep them with the version).

package/plugins/blog/docs/guide.md

@@ -39,7 +39,7 @@ Writers without the Publish permission see only their own posts.
 | Field | What it does |
 |---|---|
 | Title | Required. |
-| Slug | The last part of the post's address, for example `my-first-post`. With **Auto** ticked it follows the title. Changing it on a published post breaks links to the old address. |
+| Slug | The last part of the post's address, for example `my-first-post`. With **Auto** ticked it follows the title. Changing it on a published post breaks links to the old address. Two posts cannot share a slug: saving one with a slug another post already has (a draft included) is refused with a message. |
 | Excerpt | A sentence or two shown in listings. Also used as the search-engine description when **SEO Description** is empty. |
 | Content | Markdown. Every shortcode the site supports works here too. |
 | SEO Title / SEO Description | What search engines and link previews show. Leave empty to use the title and excerpt. |

package/plugins/blog/lib/page.js

@@ -26,6 +26,38 @@ export function isVisible(post) {
         (post.status === 'scheduled' && post.publishedAt && new Date(post.publishedAt) <= new Date());
 }
 
+/** Whether a post is this blog's (a Pro-era post in another blog is not), whatever its status. */
+function inThisBlog(post) {
+    return !post.blogId || post.blogId === 'main';
+}
+
+/**
+ * The post readers get for an address: a LIVE one. The list is newest first,
+ * so `find(slug)` alone picked an author's fresh draft over the published
+ * post with the same slug and answered 404 for the live one.
+ *
+ * @param {object[]} posts
+ * @param {string} slug
+ * @returns {object|null}
+ */
+export function publicPost(posts, slug) {
+    return posts.find((p) => p.slug === slug && isVisible(p)) ?? null;
+}
+
+/**
+ * The post, other than `exceptId`, that already holds a slug - a save that
+ * would make two posts answer one address. Drafts count: the one that is live
+ * today is not always the one that is live tomorrow.
+ *
+ * @param {object[]} posts
+ * @param {string} slug
+ * @param {string|null} [exceptId] - the post being saved
+ * @returns {object|null}
+ */
+export function slugHolder(posts, slug, exceptId = null) {
+    return posts.find((p) => p.slug === slug && p.id !== exceptId && inThisBlog(p)) ?? null;
+}
+
 /** Settings as they are NOW - display choices apply without a restart. */
 export function liveSettings(registered) {
     return {...defaultConfig, ...DISPLAY_DEFAULTS, ...registered, ...(getPluginStates()?.blog?.settings ?? {})};

package/plugins/blog/plugin.js

@@ -5,7 +5,7 @@ import {getPluginStates, savePluginState} from '../../server/services/plugins.js
 import {renderBlogPage} from '../../server/services/renderer.js';
 import {cleanBasePath, DISPLAY_DEFAULTS, pickDisplaySettings, safeImageUrl} from './lib/layouts.js';
 import {catalogue, seedBlocks} from './lib/render.js';
-import {liveBase, liveSettings, loadEntries as loadAll, renderPostPage} from './lib/page.js';
+import {liveBase, liveSettings, loadEntries as loadAll, renderPostPage, slugHolder} from './lib/page.js';
 import {addNavLink, moveNavLink, removeNavLink} from './lib/nav-link.js';
 import {SAMPLE_CATEGORIES, samplePosts} from './lib/samples.js';
 import {commentKey, commentNotice} from './lib/notices.js';
@@ -81,6 +81,35 @@ export function postFields(body, user) {
     return out;
 }
 
+// What a visitor may say in a comment, and how much of it. The form's
+// `maxlength` is the browser's word only; the route must cap too.
+const COMMENT_CAPS = {authorName: 80, authorEmail: 160, authorUrl: 300, body: 5000};
+const EMAIL_RE = /^[^\s@"<>]+@[^\s@"<>]+\.[^\s@"<>]+$/;
+
+/**
+ * A public comment as the route will store it, or the reason it will not.
+ * Pure, so the caps and the email check can be tested without a server.
+ *
+ * @param {object} body
+ * @returns {{error: string}|{fields: object}}
+ */
+export function commentFields(body = {}) {
+    const {postId, authorName, authorEmail, authorUrl, body: commentBody} = body;
+    if (!postId) return {error: 'postId is required'};
+    if (!authorName) return {error: 'authorName is required'};
+    if (!authorEmail) return {error: 'authorEmail is required'};
+    if (!commentBody) return {error: 'body is required'};
+    const email = String(authorEmail).trim().slice(0, COMMENT_CAPS.authorEmail);
+    if (!EMAIL_RE.test(email)) return {error: 'authorEmail must be an email address'};
+    return {fields: {
+        postId:      String(postId).slice(0, 64),
+        authorName:  String(authorName).trim().slice(0, COMMENT_CAPS.authorName),
+        authorEmail: email,
+        authorUrl:   authorUrl ? String(authorUrl).trim().slice(0, COMMENT_CAPS.authorUrl) : '',
+        body:        String(commentBody).slice(0, COMMENT_CAPS.body)
+    }};
+}
+
 /** Derive a URL slug from a title string. */
 function slugify(str) {
     return String(str)
@@ -363,7 +392,7 @@ export default async function blogPlugin(fastify, options) {
         });
         const html = await renderBlogPage(
             fileURLToPath(new URL('./templates/post.html', import.meta.url)),
-            { post: page.html, assetV: '1.6.0' },
+            { post: page.html, assetV: '1.9.6' },
             { title: post.title || 'Preview', description: post.excerpt || '', ogImage: safeImageUrl(post.featuredImage),
               usedComponents: page.usedComponents, urlPath: `${basePath}/${post.slug}`, noindex: true }
         );
@@ -462,6 +491,12 @@ export default async function blogPlugin(fastify, options) {
         const derivedSlug = slug
             ? String(slug).trim()
             : slugify(title);
+        if (!derivedSlug) return reply.code(400).send({ error: 'slug is required' });
+
+        // One address, one post: a draft saved with a live post's slug sat in
+        // front of it in the newest-first list and took it offline.
+        const taken = slugHolder(await loadAll(POSTS_SLUG), derivedSlug);
+        if (taken) return reply.code(409).send({ error: `Another post already uses the slug "${derivedSlug}" - choose a different one.` });
 
         const fields = postFields(body, user);
         const entry = await createEntry(POSTS_SLUG, {
@@ -503,7 +538,13 @@ export default async function blogPlugin(fastify, options) {
             return reply.code(403).send({ error: 'Forbidden' });
         }
 
-        const merged  = { ...entry.data, ...postFields(request.body ?? {}, user) };
+        const fields  = postFields(request.body ?? {}, user);
+        if (fields.slug !== undefined) {
+            if (!fields.slug) return reply.code(400).send({ error: 'slug is required' });
+            const taken = fields.slug !== entry.data.slug && slugHolder(await loadAll(POSTS_SLUG), fields.slug, id);
+            if (taken) return reply.code(409).send({ error: `Another post already uses the slug "${fields.slug}" - choose a different one.` });
+        }
+        const merged  = { ...entry.data, ...fields };
         // `seo` is merged too: the editor sends title and description only, and
         // must not wipe what the SEO Tool set (image, noindex, focus keyword...).
         if (merged.seo && typeof merged.seo === 'object' && entry.data.seo && typeof entry.data.seo === 'object') {
@@ -689,8 +730,12 @@ export default async function blogPlugin(fastify, options) {
         };
     });
 
-    /** POST /api/plugins/blog/comments - public, no authenticate */
-    fastify.post('/comments', async (request, reply) => {
+    /**
+     * POST /api/plugins/blog/comments - public, no authenticate. Its own rate
+     * limit: under the global bucket alone (500/min/IP) a script filed hundreds
+     * of comments a minute, each one a staff notification.
+     */
+    fastify.post('/comments', {config: {rateLimit: {max: 5, timeWindow: '1 minute'}}}, async (request, reply) => {
         const body = request.body ?? {};
 
         // Read the settings as they are NOW. `settings` above is captured when
@@ -705,27 +750,24 @@ export default async function blogPlugin(fastify, options) {
             return reply.code(201).send({ ok: true });
         }
 
-        const { postId, authorName, authorEmail, authorUrl, body: commentBody } = body;
+        const checked = commentFields(body);
+        if (checked.error) return reply.code(400).send({ error: checked.error });
+        const { fields } = checked;
 
-        if (!postId)      return reply.code(400).send({ error: 'postId is required' });
-        if (!authorName)  return reply.code(400).send({ error: 'authorName is required' });
-        if (!authorEmail) return reply.code(400).send({ error: 'authorEmail is required' });
-        if (!commentBody) return reply.code(400).send({ error: 'body is required' });
+        // Only a post readers can see takes comments - not a draft, not an id
+        // that never existed (each of those still raised a notification).
+        const post = await getEntry(POSTS_SLUG, fields.postId).catch(() => null);
+        if (!post || !isVisible(post.data)) return reply.code(404).send({ error: 'No such post' });
 
         const commentStatus = live.commentModeration !== false ? 'pending' : 'approved';
 
         const entry = await createEntry(COMMENTS_SLUG, {
-            postId:      String(postId),
-            authorName:  String(authorName).trim(),
-            authorEmail: String(authorEmail).trim(),
-            authorUrl:   authorUrl ? String(authorUrl).trim() : '',
-            body:        String(commentBody),
+            ...fields,
             status:      commentStatus,
             createdAt:   new Date().toISOString()
         }, { source: 'public' });
 
         const made = toComment(entry);
-        const post = await getEntry(POSTS_SLUG, String(postId)).catch(() => null);
         const notice = commentNotice(made, post?.data?.title, '#/plugins/blog/comments');
         if (notice) notify(notice);
         return reply.code(201).send(made);

package/plugins/blog/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "blog",
   "displayName": "Blog",
-  "version": "1.9.5",
+  "version": "1.9.6",
   "tier": "free",
   "description": "Public-facing blog with posts, categories and comments - layouts and listings built from editable blocks.",
   "author": "Domma CMS",
-  "date": "2026-09-27",
+  "date": "2026-10-13",
   "icon": "file-text",
   "admin": {
     "css": [

package/plugins/blog/plugin.public.js

@@ -18,13 +18,13 @@ import {renderBlogPage} from '../../server/services/renderer.js';
 import {getConfig} from '../../server/config.js';
 import {byNewest, escapeHtml, matchBlogPath, pickDisplay, safeImageUrl} from './lib/layouts.js';
 import {catalogue, renderCards} from './lib/render.js';
-import {authorNamesFor, isVisible, liveBase, liveSettings, loadEntries, renderPostPage, resolveAuthorName} from './lib/page.js';
+import {authorNamesFor, isVisible, liveBase, liveSettings, loadEntries, publicPost, renderPostPage, resolveAuthorName} from './lib/page.js';
 
 const __dirname = fileURLToPath(new URL('.', import.meta.url));
 const TEMPLATES_DIR = path.join(__dirname, 'templates');
 
 /** Bumped with the plugin, so a release is never served a stale script. */
-const ASSET_V = '1.6.3';
+const ASSET_V = '1.9.6';
 
 /**
  * Above this many posts a listing pages on the server instead: the browser
@@ -210,8 +210,9 @@ ${items}
         /** Individual post */
         async post(request, reply, {slug}, base) {
             const allPosts = await loadEntries('blog-posts');
-            const post = allPosts.find((p) => p.slug === slug);
-            if (!post || !isVisible(post)) return reply.code(404).send('Not found');
+            // The live post with this slug, not whichever is newest (a draft may share it).
+            const post = publicPost(allPosts, slug);
+            if (!post) return reply.code(404).send('Not found');
 
             const siteUrl = (config?.site?.url || `${request.protocol}://${request.hostname}`).replace(/\/$/, '');
             const page = await renderPostPage(post, allPosts, liveSettings(settings), {base, siteUrl});

package/plugins/blog/tests/public.test.js

@@ -16,7 +16,8 @@ import zlib from 'zlib';
 import Fastify from 'fastify';
 import compress from '@fastify/compress';
 import blogPublicPlugin from '../plugin.public.js';
-import {postFields, usePermissionLookup} from '../plugin.js';
+import {commentFields, postFields, usePermissionLookup} from '../plugin.js';
+import {publicPost, slugHolder} from '../lib/page.js';
 
 async function buildPublic() {
     const app = Fastify();
@@ -92,3 +93,31 @@ test('the pages live at the base path in the settings, not a fixed /blog', async
     assert.equal(other.body, 'site page', 'the old path is the site\'s again');
     assert.equal((await app.inject({method: 'POST', url: '/news'})).statusCode, 404, 'GET only');
 });
+
+test('a draft that shares a live post\'s slug neither takes it offline nor gets saved', () => {
+    // Newest first, as loadEntries sorts: the draft sits in front of the live post.
+    const posts = [
+        {id: 'd', slug: 'hello', status: 'draft'},
+        {id: 'p', slug: 'hello', status: 'published'},
+        {id: 'o', slug: 'other', status: 'published', blogId: 'second'}
+    ];
+    assert.equal(publicPost(posts, 'hello')?.id, 'p', 'readers get the live post, not the newest');
+    assert.equal(publicPost(posts, 'missing'), null);
+    assert.equal(publicPost(posts, 'other'), null, 'a Pro-era post in another blog is not this blog\'s');
+    assert.equal(slugHolder(posts, 'hello')?.id, 'd', 'a new post may not take a slug in use, draft or not');
+    assert.equal(slugHolder(posts, 'hello', 'd')?.id, 'p', 'saving the draft itself still meets the live post');
+    assert.equal(slugHolder(posts, 'fresh'), null);
+    assert.equal(slugHolder(posts, 'other'), null, 'another blog\'s post is at another base');
+});
+
+test('a public comment is capped, needs an email, and names its post', () => {
+    const ok = commentFields({postId: 'p1', authorName: ' Jo ', authorEmail: ' jo@example.com ', body: 'x'.repeat(6000), authorUrl: 'https://jo.example'});
+    assert.equal(ok.fields.authorName, 'Jo');
+    assert.equal(ok.fields.authorEmail, 'jo@example.com');
+    assert.equal(ok.fields.body.length, 5000, 'the form\'s maxlength is the browser\'s word only');
+    assert.equal(commentFields({postId: 'p1', authorName: 'x'.repeat(200), authorEmail: 'a@b.co', body: 'hi'}).fields.authorName.length, 80);
+    assert.match(commentFields({postId: 'p1', authorName: 'Jo', authorEmail: 'not-an-email', body: 'hi'}).error, /email/);
+    assert.match(commentFields({postId: 'p1', authorName: 'Jo', authorEmail: 'a@b.co"<x>', body: 'hi'}).error, /email/);
+    assert.match(commentFields({authorName: 'Jo', authorEmail: 'a@b.co', body: 'hi'}).error, /postId/);
+    assert.match(commentFields({postId: 'p1', authorName: 'Jo', authorEmail: 'a@b.co'}).error, /body/);
+});

package/plugins/booking/CLAUDE.md

@@ -162,6 +162,9 @@ only to roles that hold it.
 ## Gotchas
 
 - Add `return reply.send(...)` / return a value in every async route (compressed responses come back empty).
-- `siteBase()` uses `site.baseUrl` when set, else the last request's origin (emails from reminders have no request).
+- `siteBase()` is `site.baseUrl` or '' - NEVER a request's Host (1.6.3): without a Site URL emails go out with no
+  links and the log warns once. Before, a booker with a chosen Host header got the owner an email whose "Start the
+  call" button went to their domain carrying the host key. tests/api.test.js sets `baseUrl` in config/site.json for
+  the run (restored after) and forges a Host to prove it.
 - The API tests create contacts in domma-cms's `content/collections/contacts-contacts/data.json` (tracked) - they
   snapshot and restore it; a crashed run can leave it changed: `git checkout` it in domma-cms.

package/plugins/booking/docs/guide.md

@@ -22,7 +22,7 @@ Let people book time with you, your team, or a room or piece of equipment, strai
 4. Open the settings (the cog in the Booking banner) and check the booking page's address, your time zone and the emails.
 5. Share the booking page link, or put the booking form on any page with the `[booking /]` shortcode.
 
-Booking emails need the site's outgoing email (SMTP) to be set up in **Settings**. Without it, bookings still work, but no emails are sent, and the Booking settings will warn you.
+Booking emails need the site's outgoing email (SMTP) to be set up in **Settings**. Without it, bookings still work, but no emails are sent, and the Booking settings will warn you. The links in those emails (change or cancel, join the call) use the **Site URL** in **Settings > Site**; until it is set, emails go out without links.
 
 ## Booking from Contacts and Email