domma-cms 1.6.35 → 1.6.37

package/plugins/shopping-cart/plugin.js

@@ -23,6 +23,7 @@
  */
 
 import {getConfig} from '../../server/config.js';
+import {originOf, trustedOrigin} from '../../server/services/passwordReset.js';
 import {cleanCheckout, orderLabel} from './public/lib/orders.js';
 import {formatMoney} from './public/lib/money.js';
 import {publicProduct, byShelf} from './public/lib/products.js';
@@ -37,24 +38,45 @@ import {badge, summarise} from './lib/summary.js';
 import * as pay from './lib/payments.js';
 import {
     NAME, allOrders, allProducts, annotateOrder, cleanSettings, cleanTracking, createOrder, ensureCollections, extendOrder,
-    getOrder, getProduct, liveSettings, markPaid, maskSettings, methodsOf, moveOrder, publicOrder, removeOrder,
-    refreshShelf, removeProduct, saveProduct, saveSettings, setProviderRef, settingsNow, shelfNow, tokenOk, updateProductExt
+    getOrder, getProduct, liveSettings, markPaid, maskSettings, methodsOf, moveOrder, moveOrderNow, publicOrder, removeOrder,
+    refreshShelf, removeProduct, saveProduct, saveSettings, setProviderRef, settingsNow, shelfNow, tokenOk, updateProductExt, withLock
 } from './lib/shop.js';
 import {cardHtml, esc, gridHtml} from './lib/render.js';
 
-/** The origin shoppers last reached us on - for emails, which have no request. */
-let lastOrigin = '';
-
-/** Where this site lives, for the addresses a payment provider sends shoppers back to. */
-function siteBase(request) {
+/** The Site URL setting as an origin, or ''. */
+function configuredBase() {
     let base = '';
     try { base = String(getConfig('site')?.baseUrl || ''); } catch { /* no site config */ }
-    if (/^https?:\/\/[^/\s]+/i.test(base)) return base.replace(/\/+$/, '');
-    if (!request) return lastOrigin;
-    const origin = `${request.protocol}://${request.host || request.headers.host || request.hostname}`;
-    lastOrigin = origin;
-    return origin;
+    return /^https?:\/\/[^/\s]+/i.test(base) ? base.replace(/\/+$/, '') : '';
+}
+
+/**
+ * Where this site lives, for the addresses a payment provider sends shoppers back to: the Site URL setting,
+ * else the origin of the shopper's own request (they land back where they came from). Never remembered for
+ * later: any request can claim any Host, and a kept one would put a stranger's address - and the receipt
+ * tokens - in every customer email until the next request.
+ */
+function siteBase(request) {
+    return configuredBase() || (request ? `${request.protocol}://${request.host || request.headers.host || request.hostname}` : '');
+}
+
+let warnedNoBase = false;
+let warn = (msg) => console.warn(msg);
+/**
+ * The address for links with no shopper's request behind them (emails, links handed to other Tools): core's
+ * rule as for password resets - the Site URL, else an address someone has really signed in on. '' when the
+ * site knows none; the email then goes without its link, and the log says why once.
+ */
+async function quietBase() {
+    const base = configuredBase() || await trustedOrigin('').catch(() => '');
+    if (!base && !warnedNoBase) {
+        warnedNoBase = true;
+        warn('[shopping-cart] Site URL is not set (Site Settings): emails go out without links to the order until it is.');
+    }
+    return base;
 }
+/** The same rule for an email answering a request (account confirm, forgotten password). */
+const linkBase = (request) => configuredBase() || trustedOrigin(originOf(request)).catch(() => '');
 
 const receiptPath = (s, order) => `${s.shopPath}/order/${order.id}?t=${order.data.token}`;
 
@@ -138,6 +160,7 @@ function registerShortcodes(hooks) {
 }
 
 export default async function shoppingCart(fastify, options) {
+    warn = (msg) => fastify.log.warn(msg);
     const {authenticate, requirePermission} = options.auth;
     const hooks = options.hooks || {};
     const can = (action) => ({preHandler: [authenticate, requirePermission('shop', action)]});
@@ -181,7 +204,10 @@ export default async function shoppingCart(fastify, options) {
         name: NAME,
         liveSettings, allOrders, getOrder, allProducts, getProduct, extendOrder, publicOrder,
         formatMoney, orderLabel,
+        /** The Site URL as an origin, or '' - sync, for the shopper-facing paths. Email links: `linkBase`. */
         siteBase: () => siteBase(null),
+        /** The address for links in emails (async): the Site URL, else an address someone has really signed in on, else ''. */
+        linkBase: quietBase,
         /** Change only an extension's part of a product, under the order lock (lib/shop.js updateProductExt). */
         updateProductExt,
         /** Move an order on (Shopping Cart Pro fulfils an order with nothing to post), telling every extension. */
@@ -190,7 +216,7 @@ export default async function shoppingCart(fastify, options) {
             announceMove(order, from, order.data.status);
             return order;
         },
-        receiptUrl: (order) => liveSettings().then(s => `${siteBase(null)}${receiptPath(s, order)}`)
+        receiptUrl: async (order) => { const [s, base] = await Promise.all([liveSettings(), quietBase()]); return base ? `${base}${receiptPath(s, order)}` : ''; }
     };
 
     // ---- Admin: overview, badge, extensions ----------------------------------------
@@ -366,26 +392,32 @@ export default async function shoppingCart(fastify, options) {
     /** Refund an order in full (see above). Throws {status, message}. */
     async function refundOrder(id, {restock = false, note = '', viaProvider = true, by = 'admin'} = {}) {
         const bad = (status, message) => Object.assign(new Error(message), {status});
-        const o = await getOrder(id);
-        if (!o) throw bad(404, 'No such order.');
-        const d = o.data;
-        if (!['paid', 'fulfilled'].includes(d.status)) throw bad(409, 'Only a paid order can be refunded.');
-        const s = await liveSettings();
-        let how = 'marked refunded';
-        try {
-            if (viaProvider && d.provider === 'stripe' && d.paymentRef) {
-                if (!s.stripeSecretKey) throw bad(409, 'Stripe is not set up any more - refund it in Stripe, then mark it refunded here.');
-                await pay.stripeRefund({secretKey: s.stripeSecretKey, paymentIntent: d.paymentRef});
-                how = 'refunded through Stripe';
-            } else if (viaProvider && d.provider === 'paypal' && d.paymentRef) {
-                if (!s.paypalClientId || !s.paypalSecret) throw bad(409, 'PayPal is not set up any more - refund it in PayPal, then mark it refunded here.');
-                await pay.paypalRefund({creds: {clientId: s.paypalClientId, secret: s.paypalSecret, mode: s.paypalMode}, captureId: d.paymentRef});
-                how = 'refunded through PayPal';
+        // The whole refund runs under the order lock: two refunds at once would both reach the provider, and a
+        // write landing between the provider's yes and ours would be lost. The provider call carries an
+        // Idempotency-Key from the order id, so a retry after a timeout returns the first refund, not a second.
+        const {order, from, how} = await withLock(async () => {
+            const o = await getOrder(id);
+            if (!o) throw bad(404, 'No such order.');
+            const d = o.data;
+            if (!['paid', 'fulfilled'].includes(d.status)) throw bad(409, 'Only a paid order can be refunded.');
+            const s = await liveSettings();
+            let via = 'marked refunded';
+            try {
+                if (viaProvider && d.provider === 'stripe' && d.paymentRef) {
+                    if (!s.stripeSecretKey) throw bad(409, 'Stripe is not set up any more - refund it in Stripe, then mark it refunded here.');
+                    await pay.stripeRefund({secretKey: s.stripeSecretKey, paymentIntent: d.paymentRef, idempotencyKey: `${NAME}-refund-${o.id}`});
+                    via = 'refunded through Stripe';
+                } else if (viaProvider && d.provider === 'paypal' && d.paymentRef) {
+                    if (!s.paypalClientId || !s.paypalSecret) throw bad(409, 'PayPal is not set up any more - refund it in PayPal, then mark it refunded here.');
+                    await pay.paypalRefund({creds: {clientId: s.paypalClientId, secret: s.paypalSecret, mode: s.paypalMode}, captureId: d.paymentRef});
+                    via = 'refunded through PayPal';
+                }
+            } catch (err) {
+                throw bad(err.status || 502, err.status === 409 ? err.message : `Not refunded: ${err.message}`);
             }
-        } catch (err) {
-            throw bad(err.status || 502, err.status === 409 ? err.message : `Not refunded: ${err.message}`);
-        }
-        const {order, from} = await moveOrder(o.id, 'refunded', {by, note: [how, String(note || '')].filter(Boolean).join(' - '), restock: Boolean(restock)});
+            const moved = await moveOrderNow(o.id, 'refunded', {by, note: [via, String(note || '')].filter(Boolean).join(' - '), restock: Boolean(restock)});
+            return {...moved, how: via};
+        });
         announceMove(order, from, 'refunded');
         return {order, how};
     }
@@ -465,30 +497,35 @@ export default async function shoppingCart(fastify, options) {
     /** `rest` -> an absolute address under the shop, for emails. */
     const shopLink = async (request) => {
         const s = await liveSettings();
-        const base = siteBase(request);
-        return {s, link: (rest) => `${base}${s.shopPath}/${rest}`};
+        const base = await linkBase(request);
+        return {s, base, link: (rest) => `${base}${s.shopPath}/${rest}`};
     };
     const accountFail = (reply, err) => fail(reply, err.status || 500, err.message, err.errors ? {errors: err.errors} : {});
 
     fastify.post('/account/register', {config: {rateLimit: {max: 5, timeWindow: '10 minutes'}}}, async (request, reply) => {
         if (await accountsOff(reply)) return undefined;
-        const {s, link} = await shopLink(request);
+        const {s, base, link} = await shopLink(request);
+        // A confirm link needs an address the site trusts; the Host header is not one.
+        if (!base) return fail(reply, 409, 'Accounts cannot be made just now - please check out as a guest.');
         try {
             return await accounts.register(request.body || {}, {link, shopTitle: s.shopTitle || 'the shop', log: request.log});
         } catch (err) { return accountFail(reply, err); }
     });
 
     fastify.post('/account/confirm', {config: {rateLimit: {max: 20, timeWindow: '10 minutes'}}}, async (request, reply) => {
+        if (await accountsOff(reply)) return undefined;
         try {
-            const user = await accounts.confirm(request.body?.u, request.body?.t);
-            return {confirmed: true, email: user.email};
+            // Nothing about the account comes back - not even its email: `u` is a user id, and those are public.
+            await accounts.confirm(request.body?.u, request.body?.t);
+            return {confirmed: true};
         } catch (err) { return accountFail(reply, err); }
     });
 
     fastify.post('/account/forgot', {config: {rateLimit: {max: 5, timeWindow: '10 minutes'}}}, async (request, reply) => {
         if (await accountsOff(reply)) return undefined;
-        const {s, link} = await shopLink(request);
-        await accounts.forgot(request.body?.email, {link, shopTitle: s.shopTitle || 'the shop', log: request.log}).catch(() => null);
+        const {s, base, link} = await shopLink(request);
+        if (base) await accounts.forgot(request.body?.email, {link, shopTitle: s.shopTitle || 'the shop', log: request.log}).catch(() => null);
+        else request.log.warn('[shopping-cart] password reset not sent: the site has no trusted address (set the Site URL)');
         // The same answer whoever asked: the form must not tell anyone who has an account.
         return {ok: true};
     });
@@ -531,7 +568,6 @@ export default async function shoppingCart(fastify, options) {
     });
 
     fastify.post('/quote', async (request) => {
-        siteBase(request);
         const s = await liveSettings();
         const {quote} = await quoteFor(request.body, s);
         return shopperQuote(quote, s);
@@ -690,7 +726,7 @@ export default async function shoppingCart(fastify, options) {
         const methods = methodsOf(s).map(m => m.id);
         const via = quote.total === 0 ? 'free' : (provider || methods[0] || '');
         if (via !== 'free' && !methods.includes(via)) throw bad(409, 'The Shop has no way to take payment set up yet.');
-        const origin = /^https?:\/\/[^/\s]+$/i.test(base) ? base.replace(/\/+$/, '') : siteBase(null);
+        const origin = configuredBase() || (/^https?:\/\/[^/\s]+$/i.test(base) ? base.replace(/\/+$/, '') : await quietBase());
         const back = /^\/(?!\/)/.test(String(returnTo)) ? `${origin}${returnTo}` : '';
         const order = await createOrder({quote, checkout, provider: via, delivery: deliver ? 'ship' : delivery === 'collect' ? 'collect' : 'none',
             code: String(code || '').slice(0, 60), ref, returnTo: back, ownEmails: ownEmails === true, payNote});

package/plugins/shopping-cart/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "shopping-cart",
   "displayName": "Shopping Cart",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "tier": "free",
   "description": "Sell from your site: products with options, stock and pictures, a storefront and a cart that follows shoppers from page to page, and checkout with Stripe, PayPal or payment offline. Orders to fulfil in the sidebar, refunds from the order.",
   "author": "Domma CMS",
-  "date": "2026-10-12",
+  "date": "2026-10-13",
   "icon": "shopping-bag",
   "permissions": [
     {

package/plugins/shopping-cart/public/account.js

@@ -208,9 +208,9 @@ function signedInView(body, me) {
 
 async function confirmView(body) {
     try {
-        const r = await account.confirm(params.get('u'), params.get('t'));
+        await account.confirm(params.get('u'), params.get('t'));
         document.querySelector('.shop-account h1').textContent = 'Your account';
-        signedOutView(body, {email: r.email, notice: 'Thank you - your account is confirmed. Sign in to carry on.'});
+        signedOutView(body, {notice: 'Thank you - your account is confirmed. Sign in to carry on.'});
     } catch (err) {
         document.querySelector('.shop-account h1').textContent = 'That link did not work';
         body.innerHTML = `<p class="shop-co-error">${esc(err.message)}</p><p><a class="shop-linkbtn" href="${esc(shopPath)}/account">Sign in or create an account</a></p>`;

package/plugins/shopping-cart/tests/accounts.test.js

@@ -62,6 +62,7 @@ const linkIn = (m) => /https?:\/\/\S+/.exec(m.text)?.[0] || '';
 
 test('accounts: off by default; create, confirm by email, details, addresses, orders by email, reset, delete', async () => {
     assert.equal((await call('POST', '/account/register', {name: 'Ann', email: EMAILS[0], password: 'a-long-password'})).status, 404, 'off until switched on');
+    assert.equal((await call('POST', '/account/confirm', {u: '00000000-0000-4000-8000-000000000000', t: '0'.repeat(48)})).status, 404, 'confirm is off too');
     const put = await call('PUT', '/settings', {accounts: true, offlineEnabled: true, countries: ['GB']});
     assert.equal(put.status, 200, JSON.stringify(put.body));
     assert.equal(put.body.settings?.accounts ?? put.body.accounts, true, JSON.stringify(put.body).slice(0, 300));
@@ -81,11 +82,19 @@ test('accounts: off by default; create, confirm by email, details, addresses, or
     assert.equal(mail.length, 1, 'still pending: no second email, no second account');
 
     assert.equal((await call('POST', '/account/confirm', {u: user.id, t: '0'.repeat(48)})).status, 404);
+    assert.equal((await call('POST', '/account/confirm', {u: user.id})).status, 404, 'no token, no answer');
     r = await call('POST', '/account/confirm', {u: confirmLink.searchParams.get('u'), t: confirmLink.searchParams.get('t')});
-    assert.deepEqual(r.body, {confirmed: true, email: EMAILS[0]});
+    assert.deepEqual(r.body, {confirmed: true}, 'confirms, and says nothing about the account - not even its email');
     user = await getUserById(user.id);
     assert.equal(user.isActive, true);
     assert.ok(!user.meta.shop.pending);
+    // The link is spent: a second click, or any guess at an active user's id, learns nothing (ids are public).
+    r = await call('POST', '/account/confirm', {u: confirmLink.searchParams.get('u'), t: confirmLink.searchParams.get('t')});
+    assert.equal(r.status, 404);
+    assert.equal(JSON.stringify(r.body).includes(EMAILS[0]), false);
+    r = await call('POST', '/account/confirm', {u: user.id, t: 'x'});
+    assert.equal(r.status, 404);
+    assert.equal(JSON.stringify(r.body).includes(EMAILS[0]), false);
     r = await call('POST', '/account/register', {name: 'Ann', email: EMAILS[0], password: 'a-long-password'});
     assert.match(mail.at(-1).subject, /already have an account/);
 

package/plugins/shopping-cart/tests/api.test.js

@@ -302,3 +302,26 @@ test('sales: the report and its CSV over the API', async () => {
     assert.match(csv.headers['content-disposition'], /attachment; filename="sales-2020-01-01-to-2030-12-31\.csv"/);
     assert.ok(csv.body.startsWith('Order,Paid,Status'));
 });
+
+test('review: links for emails never come from a request\'s Host header; two refunds at once have one winner', async () => {
+    const reg = globalThis[Symbol.for('domma.shopping-cart')];
+    await call('PUT', '/settings', {offlineEnabled: true, countries: ['GB'], taxRate: 0, shippingFlat: 0});
+    const pen = (await call('POST', '/products', {name: 'Pen', price: 500, status: 'active', shippable: false})).body;
+    // A forged Host on a public request must not become the address in anyone's email.
+    const forged = await app.inject({method: 'POST', url: '/quote', headers: {host: 'evil.example'}, payload: {lines: [{productId: pen.id, qty: 1}]}});
+    assert.equal(forged.statusCode, 200);
+    assert.equal(String(reg.services.siteBase()).includes('evil.example'), false);
+    const placed = await call('POST', '/checkout', {lines: [{productId: pen.id, qty: 1}], provider: 'offline', customer: {name: 'Eve', email: 'eve@example.com'}});
+    assert.equal(placed.status, 200, JSON.stringify(placed.body));
+    const order = await reg.services.getOrder(placed.body.orderId);
+    const receipt = await reg.services.receiptUrl(order);
+    assert.equal(receipt.includes('evil.example'), false, `receipt link: ${receipt}`);
+    assert.equal((await reg.services.linkBase()).includes('evil.example'), false);
+    if (receipt) assert.match(receipt, /^https?:\/\/[^/]+\/shop\/order\//);
+
+    // Paid, then refunded twice in the same instant: one refund, one "only a paid order" refusal.
+    await call('PUT', `/orders/${order.id}/status`, {status: 'paid'});
+    const both = await Promise.all([call('POST', `/orders/${order.id}/refund`, {}), call('POST', `/orders/${order.id}/refund`, {})]);
+    assert.deepEqual(both.map(r => r.status).sort(), [200, 409], JSON.stringify(both.map(r => r.body)));
+    assert.equal((await reg.services.getOrder(order.id)).data.history.filter(h => h.status === 'refunded').length, 1);
+});

package/plugins/shopping-cart/tests/pure.test.js

@@ -5,7 +5,7 @@ import {formatMoney, fromMinor, includedTax, percentOf, toMinor} from '../public
 import {available, cleanProduct, priceRange, publicProduct, slugify, unitPrice} from '../public/lib/products.js';
 import {canMove, cleanCheckout} from '../public/lib/orders.js';
 import {cleanCharges, cleanCustomLines, cleanLines, priceBasket} from '../lib/pricing.js';
-import {paypalPaid, stripeForm, stripeLineItems, stripeSessionPaid, stripeVerify} from '../lib/payments.js';
+import {paypalPaid, stripeCreateSession, stripeForm, stripeLineItems, stripeRefund, stripeSessionPaid, stripeVerify} from '../lib/payments.js';
 import {badge, summarise} from '../lib/summary.js';
 import {cartRegistry} from '../lib/extensions.js';
 import {matchShopPath} from '../plugin.public.js';
@@ -298,3 +298,18 @@ test('pricing: a shipping handler can offer services to choose between', async (
     assert.equal(q.shipping, 900);
     assert.equal(q.shippingChoice, 'exp');
 });
+
+test('payments: Stripe refunds and sessions carry an Idempotency-Key, so a retry after a timeout is not a second one', async () => {
+    const seen = [];
+    const realFetch = globalThis.fetch;
+    globalThis.fetch = async (url, init) => { seen.push({url, init}); return {ok: true, json: async () => ({id: 'cs_test_1', url: 'https://pay.test/x'})}; };
+    try {
+        await stripeRefund({secretKey: 'sk_test_x', paymentIntent: 'pi_1', idempotencyKey: 'shopping-cart-refund-o1'});
+        assert.equal(seen[0].init.headers['Idempotency-Key'], 'shopping-cart-refund-o1');
+        await stripeRefund({secretKey: 'sk_test_x', paymentIntent: 'pi_1'});
+        assert.equal('Idempotency-Key' in seen[1].init.headers, false, 'none asked for, none sent');
+        await stripeCreateSession({secretKey: 'sk_test_x', order: {id: 'o1', number: 1001, currency: 'GBP', total: 100, lines: [{name: 'Mug', qty: 1, unitPrice: 100, lineTotal: 100}], adjustments: []},
+            successUrl: 'https://s.test/ok', cancelUrl: 'https://s.test/no'});
+        assert.equal(seen[2].init.headers['Idempotency-Key'], 'shop-session-o1');
+    } finally { globalThis.fetch = realFetch; }
+});

package/plugins/support/CLAUDE.md

@@ -76,3 +76,9 @@ manager also "Quote in reply").
 
 Site: new replies (`info`), else open requests as an inventory. Manager: requests waiting on Domma,
 `danger` while any is urgent, `attention` otherwise; nothing waiting = every request, inventory.
+
+## 1.1.2 (2026-10-13 Tool sweep hygiene)
+
+- `docs/guide.md` added (the Documentation > Plugins page Feedback already had). The manifest entry carries
+  `?v=1.1.2` and `V = '1.1.2'` loads the sub-views - bump both with the version. lib/receiver.js header corrected
+  (fleet tokens are on disk since 2026-10-04).

package/plugins/support/admin/views/support.js

@@ -14,7 +14,7 @@
 import {api, loadKit} from '../lib/kit.js';
 
 const ROUTE = /^#\/plugins\/support(\/|$)/;
-const V = '1.1.0';
+const V = '1.1.2';
 let lifetime = null;
 
 export const supportView = {

package/plugins/support/docs/guide.md

@@ -0,0 +1,90 @@
+---
+title: Guide
+order: 1
+---
+
+Support gets you help from Domma without leaving your admin: our email, phone and hours are always to hand, and a request is a conversation with the Domma team. It is free, on every site.
+
+## What it does
+
+- Shows the **contact card**: Domma's email, phone, hours and how quickly to expect an answer.
+- Sends a request to the Domma team with your name, your site and its CMS version attached, and shows Domma's replies underneath it, newest at the bottom.
+- Tells you when Domma replies, and lets you write back in the same request.
+- Keeps a request safe if Domma cannot be reached, and sends it as soon as it can.
+
+## Getting started
+
+1. Open [Support](#/plugins/support) from the admin sidebar.
+2. Click **Ask for help**.
+3. Pick **What is it about?**: I need help with something, Something is not working, Billing or my account, or Something else.
+4. Type a **Subject** (one line) and your **Message**.
+5. Choose **Normal** (we answer in order, usually within a working day) or **Urgent** (your site is down, or you cannot take orders, bookings or payments).
+6. Optional: fill in **Where** - the screen or page it is about, for example "Pages" or `/contact`.
+7. Click **Send**.
+
+For something that is not working, say what you did, what you expected and what happened instead.
+
+## Screens
+
+### Requests
+
+Each row shows the subject, when it was last written to, and a status:
+
+| Status | Meaning |
+|---|---|
+| Waiting on Domma | Domma has it and has not replied yet |
+| Domma replied | There is a reply - it is your turn |
+| Resolved | Finished. Writing again reopens it |
+| Waiting to send | Domma could not be reached yet; it goes automatically |
+
+A dot on a row means a new reply. Click a row to read the conversation and **Reply**. Right-click a row (or use the row's menu) to **Archive**, **Resolve** or **Remove** it:
+
+- **Archive** tidies a request away under **Archived**. It comes back by itself if Domma writes to it.
+- **Resolve** closes it. You can still write to it, which reopens it.
+- **Remove** takes it off your screen. Domma keeps its copy. Removing a request that has not reached Domma yet cancels it.
+
+### Not connected
+
+If the screen offers the contact card only and says to email us, your site was not started by a Domma server, so there is nowhere to send a request to. Email or phone us instead.
+
+## Settings
+
+There is no settings screen. Whoever runs the site can change one option in the plugin's configuration file:
+
+| Option | Default | Meaning |
+|---|---|---|
+| `syncMinutes` | 5 | How often the site sends waiting requests and checks for replies |
+
+Opening the Support screen also sends anything waiting and checks for replies straight away. The contact card is set by Domma and arrives with the first sync.
+
+## Notifications
+
+When Domma replies, you get an admin notification with the request's subject. The sidebar badge counts replies you have not opened; opening the request clears it. With nothing new, the badge shows how many requests are waiting on Domma.
+
+## Permissions and roles
+
+In System > Roles, Support appears in the **Plugins** group:
+
+| Action | Label | Allows |
+|---|---|---|
+| `support.send` | Send | Ask Domma for help and see this site's requests |
+| `support.manage` | Manage | Only used on the Domma server (see below) |
+
+Only the **admin** role has them by default. Everyone with **Send** sees every request the site has sent, not just their own.
+
+## On the Domma server
+
+On the Domma server itself (the Manager), the same screen is the **Inbox** of every site's requests, for holders of **Support > Manage**:
+
+- Filter by **Open**, **Answered**, **Resolved**, **Archived** or **All**, urgent first; search subject, text, person and site.
+- Open a request to read the conversation, **Reply** (the site sees it and is notified, and the person is emailed), **Resolve**, change its priority, and keep **Internal notes** (never sent to the site).
+- Right-click a row to archive, resolve or **Delete** it. Archiving is Domma's own filing: the site does not see it, and a request comes out of the archive when the customer writes again.
+- A new request or a customer's reply is emailed to the Domma support address, with the customer as Reply-To and `[URGENT]` in the subject when it is urgent.
+
+## Limitations
+
+- Only sites started by a Domma server can send. A standalone install gets the contact card only.
+- No attachments or screenshots. Describe the problem in words, and use **Where** for the page.
+- Subjects are limited to 140 characters and messages to 8,000.
+- The Domma server accepts up to 20 requests and replies from one site in 10 minutes. Any more show as **Waiting to send** and go later.
+- You cannot edit or withdraw a message once sent. Write a follow-up instead.

package/plugins/support/lib/receiver.js

@@ -6,7 +6,7 @@
  * names, emails and words.
  *
  * A site is who its fleet token says it is (site-manager/services/fleetTokens.js,
- * memory only, minted when the manager forked it). That module only exists where
+ * minted when the manager forked it and kept in site-manager/data/fleet-tokens.json). That module only exists where
  * Site Manager does, which is also how this plugin knows it is on the manager.
  *
  * @module support/lib/receiver

package/plugins/support/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "support",
   "displayName": "Support",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "tier": "free",
   "description": "Get help from Domma straight from your admin: our email, phone and hours always to hand, and a conversation with the Domma team for anything you need - urgent requests first. Right-click a request to archive, resolve or remove it.",
   "author": "Domma CMS",
-  "date": "2026-10-04",
+  "date": "2026-10-13",
   "icon": "headphones",
   "permissions": [
     {
@@ -61,7 +61,7 @@
     ],
     "views": {
       "plugin-support": {
-        "entry": "support/admin/views/support.js",
+        "entry": "support/admin/views/support.js?v=1.1.2",
         "exportName": "supportView"
       }
     }

package/server/routes/api/analytics.js

@@ -56,8 +56,33 @@ const JOURNEYS_FILE = path.join(DATA_DIR, 'journeys.json');
 const EXCLUDE_ADMIN = true;
 const EXCLUDE_PATHS = ['/api'];
 const JOURNEY_DAILY_CAP = 5000;
+const JOURNEY_RETENTION_DAYS = 90; // the longest range the screens offer; older days are never read
 const REALTIME_WINDOW_MS = 5 * 60 * 1000;
 
+/**
+ * The beacon's `url` becomes an object key in lifetime.json and daily.json, so
+ * it must be a site path: starting with '/', no whitespace, at most 2 KB
+ * (anything a browser posts is far shorter; a 1 MB key would otherwise persist
+ * for ever). Prototype names are refused explicitly as well - the '/' rule
+ * already excludes them, but `lifetime["constructor"] + 1` turning every total
+ * into a string is exactly the bug a relaxed rule must not bring back.
+ */
+const URL_MAX = 2048;
+const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+function isBeaconPath(url) {
+    return typeof url === 'string' && url.length <= URL_MAX && url.startsWith('/') && !/\s/.test(url);
+}
+function isSafeKey(key) {
+    return !UNSAFE_KEYS.has(key) && !UNSAFE_KEYS.has(key.replace(/^\/+/, ''));
+}
+
+/** Drop journey days older than the retention - nothing reads them, and the file is rewritten on every hit. */
+function pruneJourneys(journeys, today, days = JOURNEY_RETENTION_DAYS) {
+    const cutoff = todayKey(new Date(Date.parse(today) - days * 86400000));
+    for (const day of Object.keys(journeys)) if (day < cutoff) delete journeys[day];
+    return journeys;
+}
+
 async function readJson(file, fallback) {
     try {
         return JSON.parse(await fs.readFile(file, 'utf8'));
@@ -401,11 +426,17 @@ export async function analyticsRoutes(fastify, opts = {}) {
         if (!url || typeof url !== 'string') {
             return reply.status(400).send({ error: 'url is required' });
         }
+        if (!isBeaconPath(url)) {
+            return reply.status(400).send({ error: 'url must be a site path of 2 KB or less' });
+        }
         if (dnt === true || dnt === '1') {
             return { ok: true, ignored: 'dnt' };
         }
 
         const normalised = url.split('?')[0].split('#')[0].replace(/\/+$/, '') || '/';
+        if (!isSafeKey(normalised)) {
+            return reply.status(400).send({ error: 'url must be a site path of 2 KB or less' });
+        }
         if (EXCLUDE_ADMIN && normalised.startsWith('/admin')) {
             return { ok: true, ignored: 'admin' };
         }
@@ -432,6 +463,7 @@ export async function analyticsRoutes(fastify, opts = {}) {
             // Journey event - only if sid is a string of reasonable shape, and under cap
             const safeSid = typeof sid === 'string' && sid.length > 0 && sid.length <= 64 ? sid : null;
             const safeRef = typeof ref === 'string' && ref.length <= 512 ? ref : '';
+            pruneJourneys(journeys, today);
             if (safeSid) {
                 if (!journeys[today]) journeys[today] = [];
                 if (shouldRecordJourney(journeys[today])) {