domma-cms 1.6.36 → 1.6.38

package/plugins/booking/admin/views/settings.js

@@ -15,6 +15,15 @@ const SECTIONS = [
     {key: 'tools', label: 'Other Tools', icon: 'plug'},
     {key: 'closed', label: 'Closed days', icon: 'ban'}
 ];
+// One spell of closed days.
+const CLOSURE_ROW = `
+<div class="bk-off">
+  <input type="date" class="form-input" data-model="from.value" aria-label="From" data-on-change="$parent.closureFrom($data)"><span>to</span>
+  <input type="date" class="form-input" data-model="to.value" aria-label="To">
+  <input class="form-input" data-model="label.value" placeholder="Bank holiday…" maxlength="80" aria-label="Why">
+  <button type="button" class="btn btn-xs btn-ghost bk-x" title="Remove" aria-label="Remove" data-on-click="$parent.dropClosure($data)"><span data-icon="x" data-icon-size="12"></span></button>
+</div>`;
+
 const BOOL_KEYS = ['askPhone', 'phoneRequired', 'allowCancel', 'allowMove', 'sendConfirmation', 'addToContacts', 'calendarBusy'];
 const FIELD_SECTION = {pageTitle: 'page', bookingPath: 'page', timeZone: 'page', termsUrl: 'page', notifyAddress: 'emails'};
 
@@ -32,13 +41,26 @@ export async function openSettings(ctx, section = 'page') {
     const s = info.settings;
     const f = {};
     for (const [k, v] of Object.entries(s)) if (k !== 'closures') f[k] = M.observable(v);
-    let closures = (s.closures || []).map(c => ({...c}));
+    // Closed days are a keyed list (CLOSURE_ROW); each field is an observable the inputs write through.
+    let seq = 0;
+    const closureRow = (c) => ({id: `c${++seq}`, from: M.observable(c.from || ''), to: M.observable(c.to || ''), label: M.observable(c.label || '')});
+    const closures = M.observable((s.closures || []).map(closureRow));
+    const closuresOut = () => closures.peek().map(o => ({from: o.from.peek(), to: o.to.peek(), label: o.label.peek()}));
     const tab = M.observable(SECTIONS.some(x => x.key === section) ? section : 'page');
     const saving = M.observable(false);
-    const snapshot = () => JSON.stringify([Object.entries(f).map(([k, o]) => [k, o.peek()]), closures]);
+    const snapshot = () => JSON.stringify([Object.entries(f).map(([k, o]) => [k, o.peek()]), closuresOut()]);
     const opened = snapshot();
+    let panel = null;
+    // New rows carry icons; they are drawn once the list has rendered.
+    const rescan = () => { M.flushSync?.(); if (panel) { I.scan(panel.panel); requestAnimationFrame(() => panel?.panel.isConnected && I.scan(panel.panel)); } };
     const model = {
-        ...f, tab, saving,
+        ...f, tab, saving, closures,
+        dropClosure(o) { closures.value = closures.peek().filter(x => x !== o); },
+        // An end before the start is never meant: it follows the start.
+        closureFrom(o, e) {
+            const v = e?.target?.value ?? o.from.peek();
+            if (!o.to.peek() || o.to.peek() < v) o.to.value = v;
+        },
         pageUrl: M.computed(() => `${location.origin}${f.bookingPath.value || '/booking'}`),
         noPhone: M.computed(() => !f.askPhone.value),
         remindText: M.computed(() => (Number(f.reminderHours.value) > 0 ? `${f.reminderHours.value} hours before` : 'off'))
@@ -110,7 +132,8 @@ export async function openSettings(ctx, section = 'page') {
 
   <section data-bind-hidden="!is_closed.value">
     <p class="bk-note">Days the whole business is closed - bank holidays, a closure. Nobody can be booked. (For one person's holiday, use their days off.)</p>
-    <div data-part="closures"></div>
+    <p class="bk-note" data-bind-hidden="closures.value.length">None yet.</p>
+    <div data-each="closures.value key=id">${CLOSURE_ROW}</div>
     <div class="bk-actions bk-actions-start"><button type="button" class="btn btn-xs btn-outline" data-on-click="addClosure"><span data-icon="plus" data-icon-size="12"></span> Add closed days</button></div>
   </section>
 
@@ -121,18 +144,6 @@ export async function openSettings(ctx, section = 'page') {
   </div>
 </div>`;
 
-    const drawClosures = (el) => {
-        const box = el.querySelector('[data-part="closures"]');
-        box.innerHTML = closures.length ? closures.map((o, i) => `<div class="bk-off" data-i="${i}">
-  <input type="date" class="form-input" value="${esc(o.from)}" data-k="from" aria-label="From"><span>to</span>
-  <input type="date" class="form-input" value="${esc(o.to)}" data-k="to" aria-label="To">
-  <input class="form-input" value="${esc(o.label)}" data-k="label" placeholder="Bank holiday…" maxlength="80" aria-label="Why">
-  <button type="button" class="btn btn-xs btn-ghost bk-x" data-drop title="Remove" aria-label="Remove"><span data-icon="x" data-icon-size="12"></span></button></div>`).join('')
-            : '<p class="bk-note">None yet.</p>';
-        I.scan(box);
-    };
-
-    let panel = null;
     panel = await openPanel({
         title: 'Booking settings',
         size: 'md',
@@ -148,27 +159,15 @@ export async function openSettings(ctx, section = 'page') {
                 const b = e.target.closest('[data-tab]');
                 if (b) tab.value = b.dataset.tab;
             });
-            drawClosures(el);
-            const box = el.querySelector('[data-part="closures"]');
-            box.addEventListener('input', (e) => {
-                const row = e.target.closest('[data-i]');
-                if (!row) return;
-                const o = closures[Number(row.dataset.i)];
-                o[e.target.dataset.k] = e.target.value;
-                if (e.target.dataset.k === 'from' && (!o.to || o.to < o.from)) { o.to = o.from; row.querySelector('[data-k="to"]').value = o.from; }
-            });
-            box.addEventListener('click', (e) => {
-                const row = e.target.closest('[data-i]');
-                if (row && e.target.closest('[data-drop]')) { closures.splice(Number(row.dataset.i), 1); drawClosures(el); }
-            });
         },
         methods: {
             cancel: () => panel?.close(),
             copyUrl: () => copy(model.pageUrl.peek(), 'Booking page address copied'),
-            addClosure() { closures = [...closures, {from: ctx.boot.today, to: ctx.boot.today, label: ''}]; drawClosures(panel.panel); },
+            addClosure() { closures.value = [...closures.peek(), closureRow({from: ctx.boot.today, to: ctx.boot.today, label: ''})]; rescan(); },
             async save() {
                 if (saving.peek()) return;
-                for (const o of closures) {
+                const closed = closuresOut();
+                for (const o of closed) {
                     if (!isDate(o.from) || !isDate(o.to) || o.to < o.from) { tab.value = 'closed'; E.toast('Closed days: each needs a start date, and an end on or after it.', {type: 'warning'}); return; }
                 }
                 const out = {};
@@ -176,7 +175,7 @@ export async function openSettings(ctx, section = 'page') {
                 for (const k of BOOL_KEYS) out[k] = Boolean(out[k]);
                 out.changeNoticeHours = Number(out.changeNoticeHours) || 0;
                 out.reminderHours = Number(out.reminderHours) || 0;
-                out.closures = closures;
+                out.closures = closed;
                 saving.value = true;
                 const el = panel.panel;
                 try {

package/plugins/booking/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "booking",
   "displayName": "Booking",
-  "version": "1.6.3",
+  "version": "1.6.4",
   "tier": "free",
   "description": "Let people book appointments with you or your team, and rooms or equipment, from a booking page on your site. Opening hours, days off and buffers; confirmation and reminder emails with a link to change or cancel; a diary in the admin. Book straight from a contact or an email.",
   "author": "Domma CMS",

package/plugins/booking/tests/admin-diary.test.js

@@ -3,7 +3,7 @@
  */
 import {test} from 'node:test';
 import assert from 'node:assert/strict';
-import {datesFor, gridHours, layoutColumn, minuteAt, placeOf, weekStart, dayLabel} from '../admin/lib/diary-layout.js';
+import {datesFor, gridHours, layoutColumn, mergeWindows, minuteAt, placeOf, weekStart, dayLabel} from '../admin/lib/diary-layout.js';
 
 test('weeks start on Monday', () => {
     assert.equal(weekStart('2031-07-15'), '2031-07-14');
@@ -71,3 +71,11 @@ test('booking details: who, where from, answers, places', () => {
     assert.equal(placesLabel(1), '1 place left');
     assert.equal(placesLabel(3), '3 places left');
 });
+
+test('week bands: windows merged where they touch or overlap, sorted, inputs untouched', () => {
+    const input = [{from: 780, to: 1020}, {from: 540, to: 750}, {from: 600, to: 780}, {from: 1080, to: 1140}];
+    assert.deepEqual(mergeWindows(input), [{from: 540, to: 1020}, {from: 1080, to: 1140}]);
+    assert.deepEqual(input[0], {from: 780, to: 1020}, 'no input is changed');
+    assert.deepEqual(mergeWindows([]), []);
+    assert.deepEqual(mergeWindows(undefined), []);
+});

package/plugins/feedback/CLAUDE.md

@@ -118,3 +118,58 @@ Replying in the inbox to a `_manager` report you filed yourself marks it seen fo
 
 - Cache-busters follow the manifest: `feedback.js?v=1.1.4` in plugin.json and `V = '1.1.4'` for the sub-views - bump
   both with the version. Fleet-token note above corrected (tokens are on disk since 2026-10-04).
+
+## 1.1.5 (2026-10-13 Tool sweep - caching)
+
+- **`allReports()` is cached 30 s** (`lib/cache.js`; promise kept, concurrent reads share one). It served the
+  manager badge (every minute per `manage` tab), every site's `/fleet/mine` and `receive()`'s dedupe. Every write
+  in lib/receiver.js (`receive`, `applyPatch` - and so `issueMoved` - `removeReport`) calls `forget()` after the
+  write, so the inbox and badge show it on the next read. A test that writes the collection directly must call
+  `forget()` itself. Test: `tests/api.test.js` "the inbox memory".
+
+## 1.1.6 (2026-10-13) - attachments
+
+Up to 3 files per report, 2 MB each: PNG, JPEG, GIF, WebP, PDF, plain text (`ATTACHMENTS` / `ATTACHMENT_TYPES` in
+lib/shape.js; no SVG or HTML - they can carry script). Chosen with "Attach a file" or pasted into the description.
+
+- **Not the CMS media API, on purpose.** `/api/media` saves into the PUBLIC media folder (anyone with the URL reads
+  it) and needs `media.create`, which a `feedback.send` user may lack. These are screenshots of admin screens, so the
+  plugin has its own upload route that mirrors media.js's checks (mime whitelist, `request.file()` from the engine's
+  @fastify/multipart, size cap, sanitised name) and keeps files in its own `data/attachments/` (0600 files, 0700
+  folders, `lib/attachments.js createStore`). Every path is built from a cleaned attachment (`cleanAttachment`: id
+  `[A-Za-z0-9-]{8,64}`, made by `randomUUID()` on upload) - nothing from a request reaches `path.join` raw.
+- **Flow.** Site: `POST /attachments` (multipart) -> `{id, name, type, size}` saved with a `<id>.json` sidecar.
+  `POST /send {..., attachments: [{id}]}` takes each file's description from the SIDECAR, never the form, and the
+  payload announces them. `flush()` (now single-flight, like Support's) submits the report, then posts each file RAW to
+  `POST /fleet/attach/:reportId/:attId` (`application/octet-stream`; a plugin-scoped parser, bodyLimit 2 MB + 1 KB;
+  its own throttle, perSiteMax x 3). The manager takes only a file the report announced, at the announced size, on a
+  report of the token's site (else 404), saves it under `data/attachments/<report id>/` and sets `stored: true`
+  (`rx.markStored`). Outbox items record `filesSent` / `filesRefused` (a 4xx other than 401/408/429, or a file this
+  site no longer has), so a file is retried until it lands or is refused for good.
+- **Reading them.** Inbox: `GET /reports/:id/attachments/:att` (`manage`). Site: `GET /attachments/:id` - its own
+  copy, so a file shows before Domma's copy lands. Served with the stored type, `nosniff`, inline, private cache.
+  The admin fetches with the session token into a `blob:` URL (`kit.blobUrl`) for thumbnails and "open in a new tab".
+- The level-0 role's own feedback: uploads stage in `data/attachments/_staging/`, `POST /send` moves them into the
+  report's folder and marks them stored; `GET /attachments/:id` finds staged or filed ones.
+- Deleting a report deletes its folder. A site drops files never sent (no outbox item names them) after a day, on the
+  sync timer; the manager prunes `_staging` on each upload.
+- UI: `kit.FILES` (data-each row template, bound on its own host AFTER the panel's bindings - the panel model has no
+  `files`; no icons in rows because they land after the icon scan) and `kit.showFiles()` for detail panels.
+- Also: `GET /meta` asks for `manage` on the manager (a manage-only role used to 403 and the screen failed), and
+  answers the attachment caps; `text()` strips all control characters (as Support's).
+- Tests: shape.test.js (cleanAttachment, caps, store perms and prune), api.test.js (upload -> travel -> inbox
+  download, refusals, offline wait then both go). Not covered by tests: the level-0 role's own attachments.
+
+## 1.1.7 (2026-10-13) - settings cog
+
+- Settings are read when used, per side (`cleanSettings(raw, current, side)`, `SIDE_SETTINGS` in lib/shape.js):
+  the site's `syncMinutes`, the manager's `perSiteMax` / `perSiteMinutes`. `GET/PUT /settings` answers this side
+  only - a site's for `requireAdmin` (from `options.auth`; `send` on an engine without it), the manager's for
+  `manage`; the save merges over the stored object (the other side's keys and `storage` survive). Tests inject
+  `options.readSettings` / `options.writeSettings` (tests/api.test.js passes the test's limits that way).
+- The sync timer is a self-re-arming `setTimeout` that asks for `syncMinutes` before each wait, and a save
+  re-arms it. The two throttles (`createThrottle()` now takes `{max, windowMs}` per call) get the live limits on
+  each report or file. Before, all three were read at boot and needed a restart.
+- `admin/lib/settings.js`: the banner cog, added by `feedback.js` once the mode is known, only when the silent
+  `GET /settings` answers; a slideover through kit's `openPanel` with M bindings, data-help per field, discard
+  guard, Ctrl+Enter. Tests: tests/settings.test.js, and "the per-site throttle" in tests/api.test.js (live limit).

package/plugins/feedback/admin/css/index.css

@@ -1,7 +1,7 @@
 /* Feedback - admin styles. Theme tokens only (every one below is defined by every Domma theme). */
 
 /* data-bind-hidden sets [hidden]; any display rule below would otherwise beat it. */
-.fb [hidden], .fb-detail [hidden], .fb-form [hidden] { display: none !important; }
+.fb [hidden], .fb-detail [hidden], .fb-form [hidden], .fb-files-host [hidden] { display: none !important; }
 
 .fb { max-width: 60rem; }
 .fb-card { background: var(--dm-surface); border: 1px solid var(--dm-border); border-radius: var(--dm-radius-lg); padding: 1rem 1.1rem; }
@@ -74,6 +74,21 @@
 .fb-history li { display: flex; justify-content: space-between; gap: 1rem; padding: .3rem 0; border-top: 1px solid var(--dm-border); }
 .fb-history small { color: var(--dm-text-secondary); }
 
+/* Attached files: a thumbnail or the file's kind, its name and size */
+.fb-attach { display: flex; align-items: center; gap: .6rem; flex-wrap: wrap; }
+.fb-files { list-style: none; margin: .3rem 0; padding: 0; display: grid; grid-template-columns: repeat(auto-fill, minmax(13rem, 1fr)); gap: .4rem; }
+.fb-file { display: flex; align-items: center; gap: .55rem; padding: .35rem .5rem; border: 1px solid var(--dm-border); border-radius: var(--dm-radius-md);
+  background: var(--dm-background); cursor: pointer; min-width: 0; }
+.fb-file:hover, .fb-file:focus-visible { border-color: var(--dm-primary); outline: none; }
+.fb-thumb { width: 2.6rem; height: 2.6rem; object-fit: cover; border-radius: var(--dm-radius-md); flex: none; }
+.fb-file-ext { width: 2.6rem; height: 2.6rem; display: inline-flex; align-items: center; justify-content: center; flex: none; font-size: var(--dm-font-size-xs);
+  font-weight: 700; color: var(--dm-text-secondary); background: var(--dm-hover-bg); border-radius: var(--dm-radius-md); }
+.fb-file-main { flex: 1; min-width: 0; display: flex; flex-direction: column; }
+.fb-file-main strong { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-size: var(--dm-font-size-sm); }
+.fb-file-main small { color: var(--dm-text-secondary); font-size: var(--dm-font-size-xs); }
+.fb-file-x { border: 0; background: none; color: var(--dm-text-secondary); cursor: pointer; font-size: 1.1rem; line-height: 1; padding: .1rem .35rem; border-radius: var(--dm-radius-md); }
+.fb-file-x:hover { background: var(--dm-hover-bg); color: var(--dm-danger); }
+
 @media (max-width: 640px) {
   .fb-grid3 { grid-template-columns: 1fr; }
   .fb-row { flex-wrap: wrap; }

package/plugins/feedback/admin/lib/kit.js

@@ -46,9 +46,115 @@ export const api = {
     update: (id, d) => H.put(`${BASE}/reports/${seg(id)}`, d),
     remove: (id) => H.delete(`${BASE}/reports/${seg(id)}`),
     waypoint: () => H.get(`${BASE}/waypoint`),
+    /** Where a file is read from: this site's (or the manager's own) copy, or a report's in the inbox. */
+    ownFileUrl: (id) => `${BASE}/attachments/${seg(id)}`,
+    reportFileUrl: (id, att) => `${BASE}/reports/${seg(id)}/attachments/${seg(att)}`,
     promote: (id, d) => H.post(`${BASE}/reports/${seg(id)}/promote`, d)
 };
 
+// ---------------------------------------------------------------------------------
+// Attachments
+// ---------------------------------------------------------------------------------
+
+const authHeaders = () => { const t = (() => { try { return S.get('auth_token'); } catch { return ''; } })(); return t ? {Authorization: `Bearer ${t}`} : {}; };
+
+/** Upload one file for the report being written. H has no multipart helper, so this is the admin's own upload pattern. */
+export async function uploadFile(file) {
+    const fd = new FormData();
+    fd.append('file', file, file.name);
+    const res = await fetch(`${BASE}/attachments`, {method: 'POST', headers: authHeaders(), body: fd});
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(body.error || `Upload failed (${res.status}).`);
+    return body;
+}
+
+/** A file behind the session as a blob: URL (an <img src> or a new tab cannot send the token). Revoke it when done. */
+export async function blobUrl(url) {
+    const res = await fetch(url, {headers: authHeaders()});
+    if (!res.ok) throw new Error((await res.json().catch(() => ({}))).error || `Could not open the file (${res.status}).`);
+    return URL.createObjectURL(await res.blob());
+}
+
+export const FILE_TYPES = 'image/png,image/jpeg,image/gif,image/webp,application/pdf,text/plain';
+export const isImage = (type) => /^image\//.test(String(type || ''));
+const EXT = {'image/png': 'PNG', 'image/jpeg': 'JPG', 'image/gif': 'GIF', 'image/webp': 'WEBP', 'application/pdf': 'PDF', 'text/plain': 'TXT'};
+
+/** 812 B, 14 KB, 1.2 MB. */
+export function fileSize(n) {
+    const b = Number(n) || 0;
+    if (b < 1024) return `${b} B`;
+    if (b < 1024 * 1024) return `${Math.round(b / 1024)} KB`;
+    return `${(b / 1024 / 1024).toFixed(1)} MB`;
+}
+
+/**
+ * A list of files, bound to a `files` observable of fileRow()s. Text bindings only;
+ * the thumbnail is a blob: URL or nothing. No icons in the row - rows arrive after
+ * the panel's icon scan.
+ */
+export const FILES = `
+<ul class="fb-files" data-bind-hidden="!files.value.length" data-each="files.value key=key"><li class="fb-file" data-key="{{key}}" tabindex="0" role="button" data-bind-title="title">
+  <img class="fb-thumb" alt="" data-bind-src="thumb || false" data-bind-hidden="!thumb">
+  <span class="fb-file-ext" data-bind-hidden="thumb" data-bind-text="ext"></span>
+  <span class="fb-file-main"><strong data-bind-text="name"></strong><small data-bind-text="meta"></small></span>
+  <button type="button" class="fb-file-x" data-bind-hidden="!removable" aria-label="Remove this file" title="Remove">&times;</button>
+</li></ul>`;
+
+/** One row for FILES. */
+export function fileRow(a, extra = {}) {
+    return {key: a.id || a.key, id: a.id || '', name: a.name, type: a.type, ext: EXT[a.type] || 'FILE', thumb: '',
+        meta: fileSize(a.size), title: `Open ${a.name}`, removable: false, ...extra};
+}
+
+/**
+ * Show a report's attached files in a panel: thumbnails for the images that are
+ * there, and click (or Enter) to open one in a new tab.
+ *
+ * @param {HTMLElement} host - an element holding FILES
+ * @param {object[]} list - attachments {id, name, type, size, stored?}
+ * @param {(a) => string} urlOf - where the file is fetched from
+ * @param {string} [missing] - said of a file that has not arrived yet
+ * @returns {{files, dispose: () => void}}
+ */
+export function showFiles(host, list, urlOf, missing = 'not arrived yet') {
+    const urls = [];
+    const files = M.observable((list || []).map(a => fileRow(a, {meta: [fileSize(a.size), a.stored === false ? missing : ''].filter(Boolean).join(' · ')})));
+    const handle = M.applyBindings({files}, host);
+    let live = true;
+    for (const a of list || []) {
+        if (!isImage(a.type) || a.stored === false) continue;
+        blobUrl(urlOf(a)).then((u) => {
+            if (!live) { URL.revokeObjectURL(u); return; }
+            urls.push(u);
+            files.value = files.peek().map(r => (r.key === a.id ? {...r, thumb: u} : r));
+        }).catch(() => { /* no thumbnail; the row still opens */ });
+    }
+    const openOne = async (key) => {
+        const a = (list || []).find(x => x.id === key);
+        if (!a) return;
+        if (a.stored === false) { E.toast(`${a.name} has not arrived yet - it follows its report.`, {type: 'info'}); return; }
+        try {
+            const u = await blobUrl(urlOf(a));
+            urls.push(u);
+            window.open(u, '_blank', 'noopener');
+        } catch (err) { E.toast(err.message || String(err), {type: 'error'}); }
+    };
+    const onClick = (e) => { const li = e.target.closest('.fb-file'); if (li) openOne(li.dataset.key); };
+    const onKey = (e) => { const li = e.target.closest('.fb-file'); if (li && (e.key === 'Enter' || e.key === ' ')) { e.preventDefault(); openOne(li.dataset.key); } };
+    host.addEventListener('click', onClick);
+    host.addEventListener('keydown', onKey);
+    return {
+        files,
+        dispose() {
+            live = false;
+            host.removeEventListener('click', onClick);
+            host.removeEventListener('keydown', onKey);
+            handle.dispose();
+            for (const u of urls.splice(0)) URL.revokeObjectURL(u);
+        }
+    };
+}
+
 /** E.confirm and slideover titles render HTML: user text goes in escaped. */
 export const esc = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 

package/plugins/feedback/admin/lib/settings.js

@@ -0,0 +1,107 @@
+/**
+ * Feedback - the settings cog (1.1.7). Each side shows its own settings only:
+ *
+ *   a site      how often it sends what waits and looks for replies (administrators)
+ *   the manager  how many reports one site may send in how many minutes (`manage`)
+ *
+ * They used to be reachable only through Marketplace > Configure and were read
+ * at boot; the server now reads them when used, so a save here is live.
+ *
+ * @module feedback/admin/lib/settings
+ */
+import {BASE, esc, openPanel} from './kit.js';
+
+/** Ranges - lib/shape.js SETTING_RULES, which the server applies again. */
+const RULES = {
+    syncMinutes: {min: 5, max: 1440},
+    perSiteMax: {min: 1, max: 1000},
+    perSiteMinutes: {min: 1, max: 1440}
+};
+
+const FIELDS = {
+    sender: [
+        {key: 'syncMinutes', label: 'Check for replies every (minutes)',
+            help: 'How often this site sends any feedback still waiting and looks for Domma\'s replies. Opening Feedback always checks at once; this is the background check. 5 to 1440 (a day).'}
+    ],
+    receiver: [
+        {key: 'perSiteMax', label: 'Reports per site',
+            help: 'The most reports one site may send within the window below; more are refused with "try again in a few minutes" and the site retries later. Files have their own allowance: this many reports\' worth.'},
+        {key: 'perSiteMinutes', label: 'Window (minutes)',
+            help: 'The window the limit above counts in, in minutes.'}
+    ]
+};
+
+const wholeIn = (v, {min, max}) => { const n = Number(v); return String(v).trim() !== '' && Number.isInteger(n) && n >= min && n <= max; };
+
+/**
+ * Add the cog when this user may change this side's settings (asked once).
+ *
+ * @param {object} $container
+ * @param {object} kit - loadKit()
+ */
+export async function addSettingsCog($container, kit) {
+    let got = null;
+    // Silent: a site user who is not an administrator gets 403 here, and needs no cog and no error.
+    try { got = await H.request('GET', `${BASE}/settings`, null, {silent: true}); } catch { return; }
+    if (!got?.side) return;
+    kit.addBannerAction($container, {id: 'feedback-settings', icon: 'settings', title: 'Feedback settings', onClick: () => openSettings()});
+}
+
+export async function openSettings() {
+    let got;
+    try { got = await H.get(`${BASE}/settings`); } catch (err) { E.toast(`Settings not loaded: ${esc(err?.message || err)}`, {type: 'error'}); return; }
+    const fields = FIELDS[got.side] || [];
+    const f = Object.fromEntries(fields.map(x => [x.key, M.observable(String(got.settings?.[x.key] ?? ''))]));
+    const values = () => Object.fromEntries(fields.map(x => [x.key, Number(f[x.key].peek())]));
+    const opened = JSON.stringify(values());
+    const saving = M.observable(false);
+    const bad = Object.fromEntries(fields.map(x => [`${x.key}Bad`, M.computed(() => !wholeIn(f[x.key].value, RULES[x.key]))]));
+    const model = {...f, ...bad, saving, cannot: M.computed(() => saving.value || Object.values(bad).some(b => b.value))};
+    const html = `
+<div class="fb-form">
+  ${fields.map(x => `
+  <label class="form-label" for="fb-set-${x.key}">${x.label} <span data-help="${esc(x.help)}"></span></label>
+  <input id="fb-set-${x.key}" type="number" class="form-input" min="${RULES[x.key].min}" max="${RULES[x.key].max}" step="1" data-model="${x.key}.value">
+  <small class="fb-note is-bad" data-bind-hidden="!${x.key}Bad.value">A whole number from ${RULES[x.key].min} to ${RULES[x.key].max}.</small>`).join('')}
+  <p class="fb-note">Saved settings take effect at once - no restart.</p>
+  <div class="fb-actions">
+    <span class="fb-spacer"></span>
+    <button type="button" class="btn btn-sm btn-ghost" data-on-click="cancel">Cancel</button>
+    <button type="button" class="btn btn-sm btn-primary" data-on-click="save" data-bind-disabled="cannot.value">Save</button>
+  </div>
+</div>`;
+    let panel = null;
+    let closed = false;
+    let asking = false;
+    const methods = {
+        cancel: () => panel?.so.close(),
+        async save() {
+            if (model.cannot.peek()) return;
+            saving.value = true;
+            try {
+                await H.put(`${BASE}/settings`, values());
+                E.toast('Feedback settings saved.', {type: 'success'});
+                panel.so.close(true);
+            } catch (err) {
+                E.toast(`Not saved: ${esc(err?.message || err)}`, {type: 'error'});
+            } finally {
+                saving.value = false;
+            }
+        }
+    };
+    panel = await openPanel({title: 'Feedback settings', size: 'sm', html, model, methods});
+    // Closing with a change asks first - once (onceClosed calls close() again, argument-less).
+    const close = panel.so.close.bind(panel.so);
+    panel.so.close = async (force) => {
+        if (!closed && force !== true && JSON.stringify(values()) !== opened) {
+            if (asking) return undefined;
+            asking = true;
+            const ok = await E.confirm('Discard what you have entered?');
+            asking = false;
+            if (!ok) return undefined;
+        }
+        closed = true;
+        return close();
+    };
+    panel.panel.addEventListener('keydown', (e) => { if ((e.ctrlKey || e.metaKey) && e.key === 'Enter') { e.preventDefault(); methods.save(); } });
+}

package/plugins/feedback/admin/views/feedback.js

@@ -14,9 +14,10 @@
  */
 
 import {api, loadKit, store} from '../lib/kit.js';
+import {addSettingsCog} from '../lib/settings.js';
 
 const ROUTE = /^#\/plugins\/feedback(\/|$)/;
-const V = '1.1.4';
+const V = '1.1.7';
 const TABS = [
     {key: 'inbox', label: 'Inbox', icon: 'inbox'},
     {key: 'mine', label: 'My feedback', icon: 'send'}
@@ -56,6 +57,8 @@ export const feedbackView = {
             return;
         }
         if (!here()) return;
+        // The cog (1.1.7) - this side's settings, for those who may change them. Never blocks the screen.
+        addSettingsCog($container, kit).catch(() => {});
 
         const load = async (screen, into, ctx) => {
             const mod = await import(`/plugins/feedback/admin/views/${screen}.js?v=${V}`);

package/plugins/feedback/admin/views/inbox.js

@@ -8,7 +8,7 @@
  * Right-click (or the row's kebab, or Shift+F10) for the quick moves.
  */
 
-import {api, esc, openPanel, refreshBadge, stamp, store, when} from '../lib/kit.js';
+import {FILES, api, esc, openPanel, refreshBadge, showFiles, stamp, store, when} from '../lib/kit.js';
 
 const ROW = `
 <div class="fb-row" data-id="{{id}}" tabindex="0" role="button">
@@ -67,7 +67,8 @@ export async function mount(root, ctx) {
                 title: r.title,
                 icon: iconOf(r.type),
                 typeLabel: labelOf(r.type),
-                meta: [r.siteName, r.userName, when(r.createdAt), r.severity === 'blocker' ? 'Blocker' : ''].filter(Boolean).join(' · '),
+                meta: [r.siteName, r.userName, when(r.createdAt), r.severity === 'blocker' ? 'Blocker' : '',
+                    (r.attachments || []).length ? `${r.attachments.length} file${r.attachments.length === 1 ? '' : 's'}` : ''].filter(Boolean).join(' · '),
                 statusLabel: statusOf(r.status),
                 tone: `is-${TONE[r.status] || 'muted'}`,
                 issueKey: r.issueKey || ''
@@ -189,14 +190,17 @@ export async function mount(root, ctx) {
             ...(r.cmsVersion ? [['CMS', r.cmsVersion]] : [])
         ];
         let panel = null;
+        let filesView = null;
         panel = await openPanel({
             title: r.title,
             size: 'lg',
             model: f,
+            cleanup: () => filesView?.dispose(),
             html: `<div class="fb-detail">
   <dl class="fb-facts">${facts.map(([a, b]) => `<div><dt>${esc(a)}</dt><dd>${esc(b)}</dd></div>`).join('')}</dl>
   <h4>What they sent</h4>
   <div class="fb-text">${esc(r.description)}</div>
+  ${(r.attachments || []).length ? `<h4>Files <span data-help="What the sender attached. Click one to open it in a new tab. A file still on its way follows its report within the site's next sync."></span></h4><div class="fb-files-host" data-files></div>` : ''}
 
   <div class="fb-form">
     <label class="form-label" for="fb-status">Status <span data-help="What the site sees. Once a Waypoint issue is linked, the status follows it - except Not planned, which stays until you change it."></span></label>
@@ -272,6 +276,11 @@ export async function mount(root, ctx) {
                 }
             }
         });
+        const host = panel.panel.querySelector('[data-files]');
+        if (host) {
+            host.innerHTML = FILES;
+            filesView = showFiles(host, r.attachments, (a) => api.reportFileUrl(r.id, a.id), 'on its way from the site');
+        }
         // Opening a new report is seeing it.
         if (r.status === 'new') {
             try { const next = await api.update(r.id, {status: 'acknowledged'}); replace(next); f.status.value = next.status; refreshBadge(); }