domma-cms 1.6.35 → 1.6.37

package/plugins/_lib/outreach/index.js

@@ -12,4 +12,4 @@ export {createLedger} from './ledger.js';
 export {createSuppression, normaliseEmail} from './suppression.js';
 export {escapeHtml, escapeAttr, outreachBaseUrl, renderInvite, sendBatch} from './sending.js';
 export {dayOf, codeState, closedReason} from './expiry.js';
-export {UNSUBSCRIBE_PATH, mintSecret, signEmail, unsubscribeUrl, verifyUnsubscribe} from './unsubscribe.js';
+export {UNSUBSCRIBE_PATH, mintSecret, signEmail, unsubscribeHeaders, unsubscribeUrl, verifyUnsubscribe} from './unsubscribe.js';

package/plugins/_lib/outreach/ledger.js

@@ -25,8 +25,15 @@ export function createLedger(col, {slug = 'outreach-invites', refField = 'ref',
         return entries;
     }
 
-    async function invitesFor(refId) {
-        return (await allInvites()).filter(e => e.data[refField] === refId);
+    /**
+     * Rows for one campaign/survey/journey. The filter does the narrowing in
+     * the adapter (a Mongo query, or the file adapter's in-memory match) so a
+     * per-hit lookup no longer reads every invite on the site; the in-memory
+     * filter stays because a test's fake store ignores `opts.filter`.
+     */
+    async function invitesFor(refId, extra = {}) {
+        const {entries} = await col.listEntries(slug, {limit: 100000, filter: {[refField]: refId, ...extra}});
+        return entries.filter(e => e.data[refField] === refId);
     }
 
     /** Issue pending invites for contacts that don't already have one. Returns [{id, contactId, token}]. */
@@ -83,7 +90,7 @@ export function createLedger(col, {slug = 'outreach-invites', refField = 'ref',
     /** Find an invite by submitted code (any format). Null if unknown. */
     async function findByCode(refId, code) {
         const hash = hashToken(normaliseCode(code));
-        const invites = await invitesFor(refId);
+        const invites = await invitesFor(refId, {tokenHash: hash});
         return invites.find(e => e.data.tokenHash === hash) ?? null;
     }
 

package/plugins/_lib/outreach/sending.js

@@ -97,11 +97,15 @@ export function renderInvite(template, contact, link, opts = {}) {
  *
  * @param {Array<{invite: {id: string}, contact: {name?: string, email: string}, token: string}>} recipients
  * @param {{subject?: string, body?: string}} template
- * @param {object} deps {sendEmail, transport, from, fromName, linkFor(recipient), suppressed?: Set<string>, render?: opts for renderInvite}
+ * `headersFor(recipient)` returns extra message headers - the List-Unsubscribe
+ * pair (unsubscribe.js unsubscribeHeaders) when the message carries an
+ * unsubscribe link - so a mail client can offer its own opt-out button.
+ *
+ * @param {object} deps {sendEmail, transport, from, fromName, linkFor(recipient), suppressed?: Set<string>, render?: opts for renderInvite, headersFor?: (recipient) => object}
  * @returns {Promise<Array<{inviteId: string, ok: boolean, suppressed?: true}>>}
  */
 export async function sendBatch(recipients, template, deps) {
-    const {sendEmail, transport, from, fromName, linkFor, suppressed = null, render = {}} = deps;
+    const {sendEmail, transport, from, fromName, linkFor, suppressed = null, render = {}, headersFor = null} = deps;
     const results = [];
     for (const r of recipients) {
         if (suppressed && suppressed.has(normaliseEmail(r.contact.email))) {
@@ -110,8 +114,10 @@ export async function sendBatch(recipients, template, deps) {
         }
         const link = linkFor(r);
         const msg = renderInvite(template, r.contact, link, render);
+        const headers = typeof headersFor === 'function' ? headersFor(r) : null;
         try {
-            await sendEmail(transport, {from, fromName, to: r.contact.email, subject: msg.subject, html: msg.html, text: msg.text});
+            await sendEmail(transport, {from, fromName, to: r.contact.email, subject: msg.subject, html: msg.html, text: msg.text,
+                ...(headers && Object.keys(headers).length ? {headers} : {})});
             results.push({inviteId: r.invite.id, ok: true});
         } catch {
             results.push({inviteId: r.invite.id, ok: false});

package/plugins/_lib/outreach/suppression.js

@@ -30,17 +30,28 @@ export function createSuppression(col, {slug = 'outreach-unsubscribes'} = {}) {
         return new Set((await rows()).map(e => normaliseEmail(e.data.email)).filter(Boolean));
     }
 
+    /**
+     * The rows for one address, narrowed by the adapter: `_contains` is
+     * case-insensitive on both adapters (older rows may not be lower-cased),
+     * and the exact comparison here keeps a fake store that ignores the
+     * filter honest. One address, one small read - not the whole list.
+     */
+    async function rowsFor(want) {
+        const {entries} = await col.listEntries(slug, {limit: 100000, filter: {email_contains: want}}).catch(() => ({entries: []}));
+        return entries.filter(e => normaliseEmail(e.data.email) === want);
+    }
+
     async function isSuppressed(email) {
         const want = normaliseEmail(email);
         if (!want) return false;
-        return (await suppressedSet()).has(want);
+        return (await rowsFor(want)).length > 0;
     }
 
     /** Add an address (idempotent). `source` says which Tool took the opt-out. */
     async function add(email, source = 'outreach') {
         const want = normaliseEmail(email);
         if (!want) return null;
-        const existing = (await rows()).find(e => normaliseEmail(e.data.email) === want);
+        const existing = (await rowsFor(want))[0];
         if (existing) return existing;
         return col.createEntry(slug, {email: want, at: new Date().toISOString(), source}, {source});
     }
@@ -49,7 +60,7 @@ export function createSuppression(col, {slug = 'outreach-unsubscribes'} = {}) {
     async function remove(email) {
         if (typeof col.deleteEntry !== 'function') return false;
         const want = normaliseEmail(email);
-        const hits = (await rows()).filter(e => normaliseEmail(e.data.email) === want);
+        const hits = want ? await rowsFor(want) : [];
         for (const e of hits) await col.deleteEntry(slug, e.id).catch(() => {});
         return hits.length > 0;
     }

package/plugins/_lib/outreach/unsubscribe.js

@@ -31,6 +31,19 @@ export function unsubscribeUrl(baseUrl, secret, email) {
     return `${baseUrl}${UNSUBSCRIBE_PATH}?e=${e}&k=${signEmail(secret, email)}`;
 }
 
+/**
+ * The RFC 8058 headers for a message that carries `url`: mail clients show
+ * their own Unsubscribe button and POST `List-Unsubscribe=One-Click` to the
+ * URL, which the engine's route treats as the confirmed opt-out. Gmail and
+ * Yahoo require them of bulk senders.
+ *
+ * @param {string} url - unsubscribeUrl()
+ * @returns {{'List-Unsubscribe': string, 'List-Unsubscribe-Post': string}}
+ */
+export function unsubscribeHeaders(url) {
+    return {'List-Unsubscribe': `<${url}>`, 'List-Unsubscribe-Post': 'List-Unsubscribe=One-Click'};
+}
+
 /** The verified address from ?e=&k=, or null. Constant-time on the signature. */
 export function verifyUnsubscribe(secret, e, k) {
     let email = '';

package/plugins/_lib/public/call/call.js

@@ -569,6 +569,8 @@ function mount(el) {
         switch (e.type) {
             case 'knocking': stage.value = 'waiting'; break;
             case 'admitted':
+                // The ICE servers arrive with admission (not the join reply) - before any peer is connected.
+                if (Array.isArray(e.iceServers)) iceServers = e.iceServers;
                 stage.value = 'in';
                 recording.value = e.recording === true;
                 (e.chat || []).forEach(item => addItem(item, {live: false}));
@@ -868,7 +870,7 @@ function mount(el) {
                 if (r.status === 425 && body.opensAt) { error.value = `This call opens at ${new Date(body.opensAt).toLocaleTimeString([], {hour: '2-digit', minute: '2-digit'})}. Come back then.`; return; }
                 if (!r.ok) { error.value = body.error || 'Could not join the call.'; return; }
                 me = {id: body.id, secret: body.secret, who: body.who || body.id};
-                iceServers = body.iceServers || [];
+                iceServers = body.iceServers || [];   // an older engine's join reply; the admitted event replaces it
                 host.value = body.host === true;
                 if (body.name) name.value = body.name;
                 max.value = body.max || 6;

package/plugins/blog/CLAUDE.md

@@ -20,7 +20,7 @@ Public-facing blog for the CMS. Supports posts with categories, tags, and option
 - `blocks/*.html|css` - the shipped layouts, copied into content/blocks/ once
 - `public/blog.js`, `public/blog.css` - the browser half (listing, right-click menu, post extras)
 - `public/samples/*.svg` - sample covers
-- `tests/layouts.test.js`, `tests/public.test.js`, `tests/nav-link.test.js`
+- `tests/access.test.js`, `tests/comment-notices.test.js`, `tests/layouts.test.js`, `tests/nav-link.test.js`, `tests/notices.test.js`, `tests/public.test.js`
 - `admin/views/blog.js` - post list (KPIs + status/category/search filters)
 - `admin/views/post-editor.js` - create / edit a post
 - `admin/views/categories.js`, `admin/views/comments.js`, `admin/views/settings.js`
@@ -319,3 +319,13 @@ Declared in plugin.json `permissions` (granted once to `admin`), checked on EVER
 - `usePermissionLookup()` points the checks at a lookup: the plugin passes core's `getPermissionsFor` (or
   `options.getPermissionsFor` in tests).
 
+## 1.9.6 (2026-10-13 Tool sweep)
+
+- **One slug, one post.** `POST /posts` and `PUT /posts/:id` answer 409 when another post (draft or not; a Pro-era post
+  in another blog does not count) holds the slug - `slugHolder()` in lib/page.js. The public post lookup is
+  `publicPost()`: the LIVE post with that slug, not whichever is newest. Before, an author's draft saved with a live
+  post's slug sat first in the newest-first list and the live address answered 404.
+- **POST /comments** has its own `config.rateLimit` (5/min/IP), caps every field (`commentFields()`, exported and
+  tested), needs a plausible email, and refuses a post that does not exist or is not visible (404) - each of those
+  used to raise a staff notification.
+- `ASSET_V` / the preview `assetV` are 1.9.6 (they were 1.6.x while the plugin was 1.9.5 - keep them with the version).

package/plugins/blog/docs/guide.md

@@ -39,7 +39,7 @@ Writers without the Publish permission see only their own posts.
 | Field | What it does |
 |---|---|
 | Title | Required. |
-| Slug | The last part of the post's address, for example `my-first-post`. With **Auto** ticked it follows the title. Changing it on a published post breaks links to the old address. |
+| Slug | The last part of the post's address, for example `my-first-post`. With **Auto** ticked it follows the title. Changing it on a published post breaks links to the old address. Two posts cannot share a slug: saving one with a slug another post already has (a draft included) is refused with a message. |
 | Excerpt | A sentence or two shown in listings. Also used as the search-engine description when **SEO Description** is empty. |
 | Content | Markdown. Every shortcode the site supports works here too. |
 | SEO Title / SEO Description | What search engines and link previews show. Leave empty to use the title and excerpt. |

package/plugins/blog/lib/page.js

@@ -26,6 +26,38 @@ export function isVisible(post) {
         (post.status === 'scheduled' && post.publishedAt && new Date(post.publishedAt) <= new Date());
 }
 
+/** Whether a post is this blog's (a Pro-era post in another blog is not), whatever its status. */
+function inThisBlog(post) {
+    return !post.blogId || post.blogId === 'main';
+}
+
+/**
+ * The post readers get for an address: a LIVE one. The list is newest first,
+ * so `find(slug)` alone picked an author's fresh draft over the published
+ * post with the same slug and answered 404 for the live one.
+ *
+ * @param {object[]} posts
+ * @param {string} slug
+ * @returns {object|null}
+ */
+export function publicPost(posts, slug) {
+    return posts.find((p) => p.slug === slug && isVisible(p)) ?? null;
+}
+
+/**
+ * The post, other than `exceptId`, that already holds a slug - a save that
+ * would make two posts answer one address. Drafts count: the one that is live
+ * today is not always the one that is live tomorrow.
+ *
+ * @param {object[]} posts
+ * @param {string} slug
+ * @param {string|null} [exceptId] - the post being saved
+ * @returns {object|null}
+ */
+export function slugHolder(posts, slug, exceptId = null) {
+    return posts.find((p) => p.slug === slug && p.id !== exceptId && inThisBlog(p)) ?? null;
+}
+
 /** Settings as they are NOW - display choices apply without a restart. */
 export function liveSettings(registered) {
     return {...defaultConfig, ...DISPLAY_DEFAULTS, ...registered, ...(getPluginStates()?.blog?.settings ?? {})};

package/plugins/blog/plugin.js

@@ -5,7 +5,7 @@ import {getPluginStates, savePluginState} from '../../server/services/plugins.js
 import {renderBlogPage} from '../../server/services/renderer.js';
 import {cleanBasePath, DISPLAY_DEFAULTS, pickDisplaySettings, safeImageUrl} from './lib/layouts.js';
 import {catalogue, seedBlocks} from './lib/render.js';
-import {liveBase, liveSettings, loadEntries as loadAll, renderPostPage} from './lib/page.js';
+import {liveBase, liveSettings, loadEntries as loadAll, renderPostPage, slugHolder} from './lib/page.js';
 import {addNavLink, moveNavLink, removeNavLink} from './lib/nav-link.js';
 import {SAMPLE_CATEGORIES, samplePosts} from './lib/samples.js';
 import {commentKey, commentNotice} from './lib/notices.js';
@@ -81,6 +81,35 @@ export function postFields(body, user) {
     return out;
 }
 
+// What a visitor may say in a comment, and how much of it. The form's
+// `maxlength` is the browser's word only; the route must cap too.
+const COMMENT_CAPS = {authorName: 80, authorEmail: 160, authorUrl: 300, body: 5000};
+const EMAIL_RE = /^[^\s@"<>]+@[^\s@"<>]+\.[^\s@"<>]+$/;
+
+/**
+ * A public comment as the route will store it, or the reason it will not.
+ * Pure, so the caps and the email check can be tested without a server.
+ *
+ * @param {object} body
+ * @returns {{error: string}|{fields: object}}
+ */
+export function commentFields(body = {}) {
+    const {postId, authorName, authorEmail, authorUrl, body: commentBody} = body;
+    if (!postId) return {error: 'postId is required'};
+    if (!authorName) return {error: 'authorName is required'};
+    if (!authorEmail) return {error: 'authorEmail is required'};
+    if (!commentBody) return {error: 'body is required'};
+    const email = String(authorEmail).trim().slice(0, COMMENT_CAPS.authorEmail);
+    if (!EMAIL_RE.test(email)) return {error: 'authorEmail must be an email address'};
+    return {fields: {
+        postId:      String(postId).slice(0, 64),
+        authorName:  String(authorName).trim().slice(0, COMMENT_CAPS.authorName),
+        authorEmail: email,
+        authorUrl:   authorUrl ? String(authorUrl).trim().slice(0, COMMENT_CAPS.authorUrl) : '',
+        body:        String(commentBody).slice(0, COMMENT_CAPS.body)
+    }};
+}
+
 /** Derive a URL slug from a title string. */
 function slugify(str) {
     return String(str)
@@ -363,7 +392,7 @@ export default async function blogPlugin(fastify, options) {
         });
         const html = await renderBlogPage(
             fileURLToPath(new URL('./templates/post.html', import.meta.url)),
-            { post: page.html, assetV: '1.6.0' },
+            { post: page.html, assetV: '1.9.6' },
             { title: post.title || 'Preview', description: post.excerpt || '', ogImage: safeImageUrl(post.featuredImage),
               usedComponents: page.usedComponents, urlPath: `${basePath}/${post.slug}`, noindex: true }
         );
@@ -462,6 +491,12 @@ export default async function blogPlugin(fastify, options) {
         const derivedSlug = slug
             ? String(slug).trim()
             : slugify(title);
+        if (!derivedSlug) return reply.code(400).send({ error: 'slug is required' });
+
+        // One address, one post: a draft saved with a live post's slug sat in
+        // front of it in the newest-first list and took it offline.
+        const taken = slugHolder(await loadAll(POSTS_SLUG), derivedSlug);
+        if (taken) return reply.code(409).send({ error: `Another post already uses the slug "${derivedSlug}" - choose a different one.` });
 
         const fields = postFields(body, user);
         const entry = await createEntry(POSTS_SLUG, {
@@ -503,7 +538,13 @@ export default async function blogPlugin(fastify, options) {
             return reply.code(403).send({ error: 'Forbidden' });
         }
 
-        const merged  = { ...entry.data, ...postFields(request.body ?? {}, user) };
+        const fields  = postFields(request.body ?? {}, user);
+        if (fields.slug !== undefined) {
+            if (!fields.slug) return reply.code(400).send({ error: 'slug is required' });
+            const taken = fields.slug !== entry.data.slug && slugHolder(await loadAll(POSTS_SLUG), fields.slug, id);
+            if (taken) return reply.code(409).send({ error: `Another post already uses the slug "${fields.slug}" - choose a different one.` });
+        }
+        const merged  = { ...entry.data, ...fields };
         // `seo` is merged too: the editor sends title and description only, and
         // must not wipe what the SEO Tool set (image, noindex, focus keyword...).
         if (merged.seo && typeof merged.seo === 'object' && entry.data.seo && typeof entry.data.seo === 'object') {
@@ -689,8 +730,12 @@ export default async function blogPlugin(fastify, options) {
         };
     });
 
-    /** POST /api/plugins/blog/comments - public, no authenticate */
-    fastify.post('/comments', async (request, reply) => {
+    /**
+     * POST /api/plugins/blog/comments - public, no authenticate. Its own rate
+     * limit: under the global bucket alone (500/min/IP) a script filed hundreds
+     * of comments a minute, each one a staff notification.
+     */
+    fastify.post('/comments', {config: {rateLimit: {max: 5, timeWindow: '1 minute'}}}, async (request, reply) => {
         const body = request.body ?? {};
 
         // Read the settings as they are NOW. `settings` above is captured when
@@ -705,27 +750,24 @@ export default async function blogPlugin(fastify, options) {
             return reply.code(201).send({ ok: true });
         }
 
-        const { postId, authorName, authorEmail, authorUrl, body: commentBody } = body;
+        const checked = commentFields(body);
+        if (checked.error) return reply.code(400).send({ error: checked.error });
+        const { fields } = checked;
 
-        if (!postId)      return reply.code(400).send({ error: 'postId is required' });
-        if (!authorName)  return reply.code(400).send({ error: 'authorName is required' });
-        if (!authorEmail) return reply.code(400).send({ error: 'authorEmail is required' });
-        if (!commentBody) return reply.code(400).send({ error: 'body is required' });
+        // Only a post readers can see takes comments - not a draft, not an id
+        // that never existed (each of those still raised a notification).
+        const post = await getEntry(POSTS_SLUG, fields.postId).catch(() => null);
+        if (!post || !isVisible(post.data)) return reply.code(404).send({ error: 'No such post' });
 
         const commentStatus = live.commentModeration !== false ? 'pending' : 'approved';
 
         const entry = await createEntry(COMMENTS_SLUG, {
-            postId:      String(postId),
-            authorName:  String(authorName).trim(),
-            authorEmail: String(authorEmail).trim(),
-            authorUrl:   authorUrl ? String(authorUrl).trim() : '',
-            body:        String(commentBody),
+            ...fields,
             status:      commentStatus,
             createdAt:   new Date().toISOString()
         }, { source: 'public' });
 
         const made = toComment(entry);
-        const post = await getEntry(POSTS_SLUG, String(postId)).catch(() => null);
         const notice = commentNotice(made, post?.data?.title, '#/plugins/blog/comments');
         if (notice) notify(notice);
         return reply.code(201).send(made);

package/plugins/blog/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "blog",
   "displayName": "Blog",
-  "version": "1.9.5",
+  "version": "1.9.6",
   "tier": "free",
   "description": "Public-facing blog with posts, categories and comments - layouts and listings built from editable blocks.",
   "author": "Domma CMS",
-  "date": "2026-09-27",
+  "date": "2026-10-13",
   "icon": "file-text",
   "admin": {
     "css": [

package/plugins/blog/plugin.public.js

@@ -18,13 +18,13 @@ import {renderBlogPage} from '../../server/services/renderer.js';
 import {getConfig} from '../../server/config.js';
 import {byNewest, escapeHtml, matchBlogPath, pickDisplay, safeImageUrl} from './lib/layouts.js';
 import {catalogue, renderCards} from './lib/render.js';
-import {authorNamesFor, isVisible, liveBase, liveSettings, loadEntries, renderPostPage, resolveAuthorName} from './lib/page.js';
+import {authorNamesFor, isVisible, liveBase, liveSettings, loadEntries, publicPost, renderPostPage, resolveAuthorName} from './lib/page.js';
 
 const __dirname = fileURLToPath(new URL('.', import.meta.url));
 const TEMPLATES_DIR = path.join(__dirname, 'templates');
 
 /** Bumped with the plugin, so a release is never served a stale script. */
-const ASSET_V = '1.6.3';
+const ASSET_V = '1.9.6';
 
 /**
  * Above this many posts a listing pages on the server instead: the browser
@@ -210,8 +210,9 @@ ${items}
         /** Individual post */
         async post(request, reply, {slug}, base) {
             const allPosts = await loadEntries('blog-posts');
-            const post = allPosts.find((p) => p.slug === slug);
-            if (!post || !isVisible(post)) return reply.code(404).send('Not found');
+            // The live post with this slug, not whichever is newest (a draft may share it).
+            const post = publicPost(allPosts, slug);
+            if (!post) return reply.code(404).send('Not found');
 
             const siteUrl = (config?.site?.url || `${request.protocol}://${request.hostname}`).replace(/\/$/, '');
             const page = await renderPostPage(post, allPosts, liveSettings(settings), {base, siteUrl});

package/plugins/blog/tests/public.test.js

@@ -16,7 +16,8 @@ import zlib from 'zlib';
 import Fastify from 'fastify';
 import compress from '@fastify/compress';
 import blogPublicPlugin from '../plugin.public.js';
-import {postFields, usePermissionLookup} from '../plugin.js';
+import {commentFields, postFields, usePermissionLookup} from '../plugin.js';
+import {publicPost, slugHolder} from '../lib/page.js';
 
 async function buildPublic() {
     const app = Fastify();
@@ -92,3 +93,31 @@ test('the pages live at the base path in the settings, not a fixed /blog', async
     assert.equal(other.body, 'site page', 'the old path is the site\'s again');
     assert.equal((await app.inject({method: 'POST', url: '/news'})).statusCode, 404, 'GET only');
 });
+
+test('a draft that shares a live post\'s slug neither takes it offline nor gets saved', () => {
+    // Newest first, as loadEntries sorts: the draft sits in front of the live post.
+    const posts = [
+        {id: 'd', slug: 'hello', status: 'draft'},
+        {id: 'p', slug: 'hello', status: 'published'},
+        {id: 'o', slug: 'other', status: 'published', blogId: 'second'}
+    ];
+    assert.equal(publicPost(posts, 'hello')?.id, 'p', 'readers get the live post, not the newest');
+    assert.equal(publicPost(posts, 'missing'), null);
+    assert.equal(publicPost(posts, 'other'), null, 'a Pro-era post in another blog is not this blog\'s');
+    assert.equal(slugHolder(posts, 'hello')?.id, 'd', 'a new post may not take a slug in use, draft or not');
+    assert.equal(slugHolder(posts, 'hello', 'd')?.id, 'p', 'saving the draft itself still meets the live post');
+    assert.equal(slugHolder(posts, 'fresh'), null);
+    assert.equal(slugHolder(posts, 'other'), null, 'another blog\'s post is at another base');
+});
+
+test('a public comment is capped, needs an email, and names its post', () => {
+    const ok = commentFields({postId: 'p1', authorName: ' Jo ', authorEmail: ' jo@example.com ', body: 'x'.repeat(6000), authorUrl: 'https://jo.example'});
+    assert.equal(ok.fields.authorName, 'Jo');
+    assert.equal(ok.fields.authorEmail, 'jo@example.com');
+    assert.equal(ok.fields.body.length, 5000, 'the form\'s maxlength is the browser\'s word only');
+    assert.equal(commentFields({postId: 'p1', authorName: 'x'.repeat(200), authorEmail: 'a@b.co', body: 'hi'}).fields.authorName.length, 80);
+    assert.match(commentFields({postId: 'p1', authorName: 'Jo', authorEmail: 'not-an-email', body: 'hi'}).error, /email/);
+    assert.match(commentFields({postId: 'p1', authorName: 'Jo', authorEmail: 'a@b.co"<x>', body: 'hi'}).error, /email/);
+    assert.match(commentFields({authorName: 'Jo', authorEmail: 'a@b.co', body: 'hi'}).error, /postId/);
+    assert.match(commentFields({postId: 'p1', authorName: 'Jo', authorEmail: 'a@b.co'}).error, /body/);
+});

package/plugins/booking/CLAUDE.md

@@ -162,6 +162,9 @@ only to roles that hold it.
 ## Gotchas
 
 - Add `return reply.send(...)` / return a value in every async route (compressed responses come back empty).
-- `siteBase()` uses `site.baseUrl` when set, else the last request's origin (emails from reminders have no request).
+- `siteBase()` is `site.baseUrl` or '' - NEVER a request's Host (1.6.3): without a Site URL emails go out with no
+  links and the log warns once. Before, a booker with a chosen Host header got the owner an email whose "Start the
+  call" button went to their domain carrying the host key. tests/api.test.js sets `baseUrl` in config/site.json for
+  the run (restored after) and forges a Host to prove it.
 - The API tests create contacts in domma-cms's `content/collections/contacts-contacts/data.json` (tracked) - they
   snapshot and restore it; a crashed run can leave it changed: `git checkout` it in domma-cms.

package/plugins/booking/docs/guide.md

@@ -22,7 +22,7 @@ Let people book time with you, your team, or a room or piece of equipment, strai
 4. Open the settings (the cog in the Booking banner) and check the booking page's address, your time zone and the emails.
 5. Share the booking page link, or put the booking form on any page with the `[booking /]` shortcode.
 
-Booking emails need the site's outgoing email (SMTP) to be set up in **Settings**. Without it, bookings still work, but no emails are sent, and the Booking settings will warn you.
+Booking emails need the site's outgoing email (SMTP) to be set up in **Settings**. Without it, bookings still work, but no emails are sent, and the Booking settings will warn you. The links in those emails (change or cancel, join the call) use the **Site URL** in **Settings > Site**; until it is set, emails go out without links.
 
 ## Booking from Contacts and Email
 

package/plugins/booking/plugin.js

@@ -48,21 +48,23 @@ import {
 } from './lib/store.js';
 
 /**
- * The origin staff last used the admin on - for emails sent with no request
- * (reminders) when `site.baseUrl` is not set. Only signed-in requests set it:
- * a customer's Host header is theirs to choose, and must not decide where
- * everyone else's reminder links point.
+ * The site's address for links in emails and the admin: `site.baseUrl` (Settings > Site), else '' - a link is then
+ * left out and the log says so once. Until 1.6.3 a request's Host header stood in when the setting was empty, so a
+ * booker who could reach the server with a Host of their choosing (default vhost, direct IP, misconfigured proxy)
+ * got the owner an email whose "Start the call" button went to their domain carrying the host key. A Host header
+ * is the caller's to choose; it never decides where anyone's link points. `request` is accepted for the registry's
+ * callers (Pro) and ignored.
  */
-let lastOrigin = '';
-
-function siteBase(request) {
+let warnedNoBase = false;
+function siteBase(request = null, log = null) {
     let base = '';
     try { base = String(getConfig('site')?.baseUrl || ''); } catch { /* no site config */ }
     if (/^https?:\/\/[^/\s]+/i.test(base)) return base.replace(/\/+$/, '');
-    if (!request) return lastOrigin;
-    const origin = `${request.protocol}://${request.host || request.headers.host || request.hostname}`;
-    if (request.user) lastOrigin = origin;
-    return origin;
+    if (log && !warnedNoBase) {
+        warnedNoBase = true;
+        log.warn?.('[booking] Site URL is not set (Settings > Site): booking emails go out without links until it is.');
+    }
+    return '';
 }
 
 const manageUrl = (s, b, base) => `${base}${s.bookingPath}/manage/${b.id}?t=${b.token}`;
@@ -209,7 +211,7 @@ export default async function booking(fastify, options) {
     async function tell(b, what, {request = null, toCustomer = true, toOwner = true} = {}) {
         try {
             const s = await liveSettings();
-            const base = siteBase(request);
+            const base = siteBase(request, log);
             const title = siteTitle();
             const link = base && b.token ? manageUrl(s, b, base) : '';
             const may = customerMayChange(b, s) && (s.allowCancel || s.allowMove);
@@ -282,7 +284,7 @@ export default async function booking(fastify, options) {
     registry.services = {
         name: NAME, liveSettings, allBookings, allServices, allBookables, getBooking, getService, getBookable,
         changeBooking, sendReminders,
-        /** The site's address: `site.baseUrl`, else the request's origin (a signed-in one), else the last admin's. */
+        /** The site's address: `site.baseUrl`, else '' (never a request's Host). */
         siteBase: (request = null) => siteBase(request),
         /** A booking as the admin may see it (no customer token; an online one's host key as `hostUrl`). */
         adminBooking,
@@ -352,7 +354,6 @@ export default async function booking(fastify, options) {
             const id = await linkContact(customer, bk?.userId || s.contactsOwnerId, contactsOn()).catch(() => '');
             if (id) Object.assign(b, (await changeBooking(b.id, {contactId: id})).booking);
         }
-        if (request) siteBase(request);
         if (notify) tell(b, 'made', {request, toOwner: source !== 'admin'});
         registry.emit('made', b);
         return b;
@@ -411,7 +412,7 @@ export default async function booking(fastify, options) {
         };
     }
 
-    fastify.get('/bootstrap', can('read'), async (request) => { siteBase(request); return bootstrap(); });
+    fastify.get('/bootstrap', can('read'), async () => bootstrap());
 
     fastify.get('/count', can('read'), async () => {
         const s = await liveSettings();
@@ -513,7 +514,6 @@ export default async function booking(fastify, options) {
                 const id = await linkContact(customer, owner, contactsOn()).catch(() => '');
                 if (id) Object.assign(b, (await changeBooking(b.id, {contactId: id})).booking);
             }
-            siteBase(request);
             if (body.notify !== false) tell(b, 'made', {request, toOwner: false});
             registry.emit('made', b);
             return reply.code(201).send(adminBooking(b));
@@ -536,7 +536,6 @@ export default async function booking(fastify, options) {
         try {
             const b = await placeBooking({service, candidates, rules, startAt: startAt.toISOString(), tz: s.timeZone, moveId: current.id,
                 force: body.force === true, fields: {by: request.user?.name || ''}});
-            siteBase(request);
             if (body.notify !== false) tell(b, 'moved', {request, toOwner: false});
             registry.emit('moved', b, current);
             endCall(current).catch(() => {});
@@ -564,7 +563,6 @@ export default async function booking(fastify, options) {
         if (!res) return fail(reply, 404, 'No such booking.');
         const {booking: b, from} = res;
         if (b.status !== from) {
-            siteBase(request);
             if (b.status === 'cancelled' && body.notify !== false) tell(b, 'cancelled', {request, toOwner: false});
             registry.emit(b.status === 'cancelled' ? 'cancelled' : 'status', b, from);
             if (b.status === 'cancelled') endCall(b).catch(() => {});
@@ -754,7 +752,6 @@ export default async function booking(fastify, options) {
                 const id = await linkContact(customer, bk?.userId || s.contactsOwnerId, contactsOn()).catch(() => '');
                 if (id) Object.assign(b, (await changeBooking(b.id, {contactId: id})).booking);
             }
-            siteBase(request);
             tell(b, 'made', {request});
             notice(b, 'made');
             registry.emit('made', b);
@@ -793,7 +790,6 @@ export default async function booking(fastify, options) {
             ? `Bookings can be cancelled here up to ${s.changeNoticeHours} hours before. Please contact us instead.`
             : 'This booking cannot be cancelled here. Please contact us instead.');
         const {booking: done} = await changeBooking(b.id, {status: 'cancelled', reason: String(request.body?.reason || '').slice(0, 300)}, b.name);
-        siteBase(request);
         tell(done, 'cancelled', {request});
         notice(done, 'cancelled');
         registry.emit('cancelled', done, 'confirmed');
@@ -817,7 +813,6 @@ export default async function booking(fastify, options) {
         const {service, candidates, rules} = await candidatesFor(b.serviceId, b.bookableId);
         try {
             const moved = await placeBooking({service, candidates, rules, startAt: offered.start, tz: s.timeZone, moveId: b.id, fields: {by: b.name}});
-            siteBase(request);
             tell(moved, 'moved', {request});
             notice(moved, 'moved');
             registry.emit('moved', moved, b);

package/plugins/booking/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "booking",
   "displayName": "Booking",
-  "version": "1.6.2",
+  "version": "1.6.3",
   "tier": "free",
   "description": "Let people book appointments with you or your team, and rooms or equipment, from a booking page on your site. Opening hours, days off and buffers; confirmation and reminder emails with a link to change or cancel; a diary in the admin. Book straight from a contact or an email.",
   "author": "Domma CMS",
-  "date": "2026-10-03",
+  "date": "2026-10-13",
   "icon": "clipboard-check",
   "uses": {
     "contacts": "Customers become contacts; Book… on a contact and a Bookings panel on the contact card",