domma-cms 1.6.37 → 1.6.39

package/plugins/support/plugin.js

@@ -12,16 +12,20 @@
  *     POST /tickets/:ref/messages  write again
  *     POST /tickets/:ref/close     mark resolved
  *     PUT  /tickets/:ref/seen      Domma's latest reply has been read
+ *     POST /attachments            a file for the message being written (multipart, kept here)
+ *     GET  /attachments/:id        one of this site's attached files
  *     PUT  /tickets/:ref/shelf     archive it, remove it from this site's list, or put it back
  *                                  ({state: archived|removed|null}); removing one that never
  *                                  reached Domma cancels it. Domma keeps its copy either way.
  *
  *   manager  (Site Manager is installed beside it)
  *     POST /fleet/tickets · POST /fleet/messages · GET /fleet/mine   from the sites (Bearer fleet token)
+ *     POST /fleet/attach/:ref/:att one of a request's announced files, raw bytes (Bearer fleet token)
  *     GET  /mode · /meta · /count  the badge counts requests waiting on Domma, red while one is urgent
  *     GET  /tickets · GET /tickets/:id
  *     POST /tickets/:id/reply      answer (and set the status), emailing the customer
  *     PUT  /tickets/:id            status, priority, internal notes, archived
+ *     GET  /tickets/:id/attachments/:att   a file the customer attached
  *     DELETE /tickets/:id
  *
  * A standalone site (not started by a manager) still gets the contact card -
@@ -36,9 +40,11 @@ import path from 'node:path';
 import {fileURLToPath} from 'node:url';
 import defaults from './config.js';
 import {
-    CATEGORIES, PRIORITIES, STATUSES, buildMessagePayload, buildTicketPayload, cleanMessage, cleanRequest, cleanUpdate,
-    contactCard, createThrottle, lastDommaAt, senderView, toCustomerEmail, toDommaEmail
+    ATTACHMENTS, CATEGORIES, PRIORITIES, STATUSES, attachmentsOf, buildMessagePayload, buildTicketPayload, cleanAttachment, cleanMessage,
+    cleanRequest, cleanSettings, cleanUpdate, contactCard, createThrottle, settingsErrors, lastDommaAt, senderView, toCustomerEmail, toDommaEmail
 } from './lib/shape.js';
+import {createStore, readUpload, sendFile} from './lib/attachments.js';
+import {getPluginSettings, getPluginStates, savePluginState} from '../../server/services/plugins.js';
 import {applyShelf, createOutbox, flush, managerApi, managerOf, mergeTickets, newRef} from './lib/sender.js';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
@@ -59,9 +65,22 @@ export default async function supportPlugin(fastify, options) {
     const {authenticate, requirePermission} = options.auth;
     const hooks = options.hooks || {};
     const can = (action) => ({preHandler: [authenticate, requirePermission(NAME, action)]});
-    const settings = {...defaults, ...(options.settings || {})};
     const receiverMod = await import('./lib/receiver.js');
     const mode = options.mode || (receiverMod.isManager() ? 'receiver' : 'sender');
+    // Settings are read when used (1.1.5), not once at boot: the cog's save, and
+    // Marketplace > Configure, take effect without a restart. `allSettings` is the
+    // whole merged object (a site's own contact card is its fallback before the
+    // manager's arrives); `liveSettings` is this side's keys, checked
+    // (lib/shape.js SIDE_SETTINGS). Tests inject a reader and writer.
+    const side = mode === 'receiver' ? 'receiver' : 'sender';
+    const readSettings = typeof options.readSettings === 'function' ? options.readSettings
+        : async () => getPluginSettings(NAME).catch(() => options.settings || {});
+    const writeSettings = typeof options.writeSettings === 'function' ? options.writeSettings
+        // Merged over what is stored: the object holds the other side's keys too.
+        : (next) => savePluginState(NAME, {settings: {...(getPluginStates()[NAME]?.settings || {}), ...next}});
+    const allSettings = async () => ({...defaults, ...(await readSettings().catch(() => ({})))});
+    const liveSettings = async () => cleanSettings(await allSettings(), defaults, side);
+    const settingsHooks = {saved: () => {}};
     const notify = typeof hooks.notify === 'function' ? (n) => { try { hooks.notify(n); } catch { /* a notice is a courtesy */ } } : () => {};
     const mail = options.mail || await import('./lib/mail.js');
     if (typeof hooks.registerNotificationSource === 'function') {
@@ -77,23 +96,51 @@ export default async function supportPlugin(fastify, options) {
     }
 
     // On the manager the inbox needs it, so `manage` is enough there.
-    fastify.get('/meta', can(mode === 'receiver' ? 'manage' : 'send'), async () => ({categories: CATEGORIES, priorities: PRIORITIES, statuses: STATUSES}));
+    fastify.get('/meta', can(mode === 'receiver' ? 'manage' : 'send'), async () => ({categories: CATEGORIES, priorities: PRIORITIES, statuses: STATUSES,
+        attachments: {max: ATTACHMENTS.max, maxBytes: ATTACHMENTS.maxBytes}}));
+
+    // ---- The settings cog (1.1.5) ----
+    // A site's sync interval is its administrators' (requireAdmin); the manager's card,
+    // notify address and per-site brake are the inbox's (`manage`).
+    const settingsGuard = mode === 'receiver' ? can('manage')
+        : {preHandler: [authenticate, typeof options.auth.requireAdmin === 'function' ? options.auth.requireAdmin : requirePermission(NAME, 'send')]};
+    fastify.get('/settings', settingsGuard, async () => ({side, settings: await liveSettings()}));
+    fastify.put('/settings', settingsGuard, async (request, reply) => {
+        const errors = settingsErrors(request.body, side);
+        if (Object.keys(errors).length) return reply.code(400).send({error: Object.values(errors).join(' '), errors});
+        const next = cleanSettings(request.body, await liveSettings(), side);
+        await writeSettings(next);
+        settingsHooks.saved(next);
+        return {side, settings: next};
+    });
 
-    if (mode === 'receiver') await receiverRoutes(fastify, {can, notify, mail, receiverMod, settings, options});
-    else await senderRoutes(fastify, {can, notify, settings, options});
+    if (mode === 'receiver') await receiverRoutes(fastify, {can, notify, mail, receiverMod, liveSettings, options});
+    else await senderRoutes(fastify, {can, notify, allSettings, liveSettings, settingsHooks, options});
 }
 
 // ---------------------------------------------------------------------------------
 // Site
 // ---------------------------------------------------------------------------------
 
-async function senderRoutes(fastify, {can, notify, settings, options}) {
+async function senderRoutes(fastify, {can, notify, allSettings, liveSettings, settingsHooks, options}) {
     const env = options.env || process.env;
     const manager = managerOf(env);
-    const outbox = createOutbox(options.dataDir || path.join(HERE, 'data'));
+    const dataDir = options.dataDir || path.join(HERE, 'data');
+    const outbox = createOutbox(dataDir);
     const api = manager ? managerApi(manager, options.fetch) : null;
+    // Files attached to messages, kept here as well: they go after their message, a message waiting
+    // to send must still have them, and the thread shows them from here. Never under the public
+    // media folder - they are screenshots of this site's admin.
+    const files = createStore(path.join(dataDir, 'attachments'));
+    /** Files picked in a panel that was then closed: gone after a day. Those a message names stay. */
+    const pruneFiles = () => { try { files.prune({keep: outbox.fileIds()}); } catch { /* tidying only */ } };
+    /** What each attached file is comes from what was uploaded here, never from the form's say-so. */
+    const ownFiles = (list) => {
+        const out = list.map(a => files.meta(a.id));
+        return out.some(a => !a) ? null : out;
+    };
     // The manager's card wins once heard; until then (and standalone) this site's settings.
-    const contact = () => outbox.contact() || contactCard(settings);
+    const contact = async () => outbox.contact() || contactCard(await allSettings());
 
     let lastSync = 0;
     let syncing = null;
@@ -107,7 +154,7 @@ async function senderRoutes(fastify, {can, notify, settings, options}) {
         lastSync = Date.now();
         const seen = outbox.seen();
         if (!api) return {tickets: mergeTickets(outbox.all(), [], seen), reachable: false, error: ''};
-        const pushed = await flush(outbox, api);
+        const pushed = await flush(outbox, api, files);
         const mine = await api.mine();
         const remote = mine.ok ? (mine.body?.tickets || []) : null;
         if (remote) {
@@ -129,15 +176,26 @@ async function senderRoutes(fastify, {can, notify, settings, options}) {
     }
 
     // Every few minutes: waiting messages go, new replies are noticed. Off in tests.
+    // Each wait asks for syncMinutes again, and a save re-arms it (1.1.5).
     if (api && options.timer !== false) {
-        const t = setInterval(() => { sync().catch(() => {}); }, Math.max(1, Number(settings.syncMinutes) || 5) * 60_000);
-        t.unref?.();
+        let t = null;
+        let closed = false;
+        const arm = async () => {
+            clearTimeout(t);
+            if (closed) return;
+            const minutes = Math.max(1, Number((await liveSettings().catch(() => ({}))).syncMinutes) || 5);
+            if (closed) return;
+            t = setTimeout(() => { pruneFiles(); sync().catch(() => {}).finally(() => arm()); }, minutes * 60_000);
+            t.unref?.();
+        };
+        arm();
+        settingsHooks.saved = () => { arm(); };
         const first = setTimeout(() => { sync().catch(() => {}); }, 30_000);
         first.unref?.();
-        fastify.addHook('onClose', async () => { clearInterval(t); clearTimeout(first); });
+        fastify.addHook('onClose', async () => { closed = true; clearTimeout(t); clearTimeout(first); });
     }
 
-    fastify.get('/mode', can('send'), async () => ({mode: 'sender', connected: Boolean(manager), site: manager?.slug || '', contact: contact()}));
+    fastify.get('/mode', can('send'), async () => ({mode: 'sender', connected: Boolean(manager), site: manager?.slug || '', contact: await contact()}));
 
     fastify.get('/count', can('send'), async () => {
         // The badge reads the last sync's copy and never waits on the manager - but it is
@@ -174,18 +232,36 @@ async function senderRoutes(fastify, {can, notify, settings, options}) {
 
     fastify.get('/tickets', can('send'), async () => {
         const r = await withDeadline(sync(), () => offlineView('Domma is slow to answer - showing what we last heard.'));
-        return {connected: Boolean(manager), reachable: r.reachable, error: r.error, contact: contact(), tickets: applyShelf(r.tickets, outbox.shelf())};
+        return {connected: Boolean(manager), reachable: r.reachable, error: r.error, contact: await contact(), tickets: applyShelf(r.tickets, outbox.shelf())};
     });
 
     const notConnected = (reply) => reply.code(409).send({error: 'This site is not connected to Domma, so a request cannot be sent from here. Email us instead.'});
 
+    fastify.post('/attachments', can('send'), async (request, reply) => {
+        if (!manager) return notConnected(reply);
+        const up = await readUpload(request);
+        if (up.error) return reply.code(up.code || 400).send({error: up.error});
+        return reply.code(201).send(files.save({id: randomUUID(), name: up.file.name, type: up.file.type, size: up.file.size}, up.file.buffer));
+    });
+
+    fastify.get('/attachments/:id', can('send'), async (request, reply) => {
+        const a = files.meta(String(request.params.id));
+        const buffer = a && files.read(a);
+        if (!buffer) return reply.code(404).send({error: 'That file is not here.'});
+        return sendFile(reply, a, buffer);
+    });
+
+    const missingFile = (reply) => reply.code(400).send({error: 'An attached file is no longer here - attach it again.'});
+
     fastify.post('/tickets', can('send'), async (request, reply) => {
         if (!manager) return notConnected(reply);
         const {request: req, error} = cleanRequest(request.body || {});
         if (error) return reply.code(400).send({error});
+        req.attachments = ownFiles(req.attachments);
+        if (!req.attachments) return missingFile(reply);
         const payload = buildTicketPayload({request: req, user: request.user, cmsVersion: cmsVersion(), site: manager.slug, ref: newRef()});
         outbox.add('ticket', payload);
-        const r = await withDeadline(flush(outbox, api), () => ({error: 'Domma is slow to answer'}));
+        const r = await withDeadline(flush(outbox, api, files), () => ({error: 'Domma is slow to answer'}));
         const item = outbox.all().find(i => i.ref === payload.ref);
         return reply.code(201).send({ref: payload.ref, state: item?.state || 'waiting',
             message: item?.state === 'sent' ? 'Sent to Domma Support. We will reply here, and by email.'
@@ -198,16 +274,19 @@ async function senderRoutes(fastify, {can, notify, settings, options}) {
         const known = outbox.tickets().some(t => t.ref === ticketRef) || outbox.all().some(i => i.kind === 'ticket' && i.ref === ticketRef);
         if (!known) return reply.code(404).send({error: 'No such request on this site.'});
         let body = '';
+        let attachments = [];
         if (!close) {
             const {message, error} = cleanMessage(request.body || {});
             if (error) return reply.code(400).send({error});
             body = message.body;
+            attachments = ownFiles(message.attachments);
+            if (!attachments) return missingFile(reply);
         }
-        const payload = buildMessagePayload({ticketRef, ref: newRef(), body, close, user: request.user});
+        const payload = buildMessagePayload({ticketRef, ref: newRef(), body, close, user: request.user, attachments});
         outbox.add('message', payload, ticketRef);
         // Writing to an archived request brings it back to the list.
         if (body) outbox.shelve(ticketRef, null);
-        await withDeadline(flush(outbox, api), () => ({}));
+        await withDeadline(flush(outbox, api, files), () => ({}));
         const item = outbox.all().find(i => i.ref === payload.ref);
         return reply.code(201).send({ref: payload.ref, state: item?.state || 'waiting',
             message: item?.state === 'sent' ? (close ? 'Marked as resolved. Thank you.' : 'Sent.') : 'Kept here and sent as soon as Domma answers.'});
@@ -242,11 +321,31 @@ async function senderRoutes(fastify, {can, notify, settings, options}) {
 // Manager
 // ---------------------------------------------------------------------------------
 
-async function receiverRoutes(fastify, {can, notify, mail, receiverMod, settings, options}) {
+async function receiverRoutes(fastify, {can, notify, mail, receiverMod, liveSettings, options}) {
     const rx = receiverMod;
     const slugOf = options.slugFromToken || rx.slugFromToken;
     const directory = options.siteDirectory || rx.siteDirectory;
-    const allowed = createThrottle({max: Number(settings.perSiteMax) || 20, windowMs: (Number(settings.perSiteMinutes) || 10) * 60_000});
+    // The card every site shows, as set now.
+    const card = async () => contactCard(await liveSettings());
+    // The per-site brakes take their limits at each call (the cog changes them live).
+    const messageThrottle = createThrottle();
+    const fileThrottle = createThrottle();
+    const limits = async () => {
+        const s = await liveSettings().catch(() => ({}));
+        return {max: Number(s.perSiteMax) || 20, windowMs: (Number(s.perSiteMinutes) || 10) * 60_000};
+    };
+    const allowed = async (slug) => messageThrottle(slug, Date.now(), await limits());
+    // Files have their own brake: up to ATTACHMENTS.max per message allowed in the same window.
+    const allowedFile = async (slug) => {
+        const l = await limits();
+        return fileThrottle(slug, Date.now(), {max: l.max * ATTACHMENTS.max, windowMs: l.windowMs});
+    };
+    // A request's files live in data/attachments/<request entry id>/.
+    const files = createStore(path.join(options.dataDir || path.join(HERE, 'data'), 'attachments'));
+    // A site sends a file's bytes raw. Only inside this plugin's scope; the engine has no parser for it.
+    if (!fastify.hasContentTypeParser('application/octet-stream')) {
+        fastify.addContentTypeParser('application/octet-stream', {parseAs: 'buffer', bodyLimit: ATTACHMENTS.maxBytes + 1024}, (req, body, done) => done(null, body));
+    }
     const log = fastify.log;
     if (options.dataDir) rx.setDataDir(options.dataDir);
     try { await rx.ensureCollection(); } catch (err) { log.error(`[support] collection: ${err.message}`); }
@@ -280,9 +379,10 @@ async function receiverRoutes(fastify, {can, notify, mail, receiverMod, settings
         notify({title: `${d.priority === 'urgent' ? 'URGENT - ' : ''}${isNew ? 'Support request' : 'Reply'} from ${name}: ${d.subject}`,
             body: body.slice(0, 300), severity: d.priority === 'urgent' ? 'warning' : 'info', source: 'new-request',
             link: `#/plugins/support/${entry.id}`, dedupeKey: `support:${entry.id}:${d.lastAt}`});
-        if (settings.notifyEmail) {
-            mail.send({to: settings.notifyEmail, ...toDommaEmail({ticket: d, siteName: name, link: inboxLink(entry.id), body, isNew})}, {log});
-        }
+        // The address as set now; read without holding up the request that caused it.
+        liveSettings().then((s) => {
+            if (s.notifyEmail) mail.send({to: s.notifyEmail, ...toDommaEmail({ticket: d, siteName: name, link: inboxLink(entry.id), body, isNew})}, {log});
+        }).catch(() => {});
     }
 
     // ---- From the sites (no session: the fleet token IS the identity) ----
@@ -296,7 +396,7 @@ async function receiverRoutes(fastify, {can, notify, mail, receiverMod, settings
     fastify.post('/fleet/tickets', {bodyLimit: 32 * 1024}, async (request, reply) => {
         const slug = await fleet(request, reply);
         if (!slug) return reply;
-        if (!allowed(slug)) return reply.code(429).send({error: 'That is a lot of requests at once - try again in a few minutes, or email us.'});
+        if (!await allowed(slug)) return reply.code(429).send({error: 'That is a lot of requests at once - try again in a few minutes, or email us.'});
         const r = await rx.open(slug, request.body || {}, undefined, siteOf(slug));
         if (r.missing) return reply.code(404).send({error: r.error});
         if (r.error) return reply.code(400).send({error: r.error});
@@ -307,7 +407,7 @@ async function receiverRoutes(fastify, {can, notify, mail, receiverMod, settings
     fastify.post('/fleet/messages', {bodyLimit: 32 * 1024}, async (request, reply) => {
         const slug = await fleet(request, reply);
         if (!slug) return reply;
-        if (!allowed(slug)) return reply.code(429).send({error: 'That is a lot of messages at once - try again in a few minutes.'});
+        if (!await allowed(slug)) return reply.code(429).send({error: 'That is a lot of messages at once - try again in a few minutes.'});
         const r = await rx.customerTurn(slug, request.body || {});
         if (r.missing) return reply.code(404).send({error: r.error});
         if (r.error) return reply.code(400).send({error: r.error});
@@ -316,10 +416,29 @@ async function receiverRoutes(fastify, {can, notify, mail, receiverMod, settings
         return {id: r.entry.id, status: r.entry.data.status};
     });
 
+    fastify.post('/fleet/attach/:ref/:att', {bodyLimit: ATTACHMENTS.maxBytes + 1024}, async (request, reply) => {
+        const slug = await fleet(request, reply);
+        if (!slug) return reply;
+        if (!await allowedFile(slug)) return reply.code(429).send({error: 'That is a lot of files at once - try again in a few minutes.'});
+        // Looked up in THAT site's requests only: another site's ref is "not found".
+        const e = await rx.ticketByRef(slug, request.params.ref);
+        if (!e) return reply.code(404).send({error: 'No such request.'});
+        // Only a file a message announced, at the size and type it announced.
+        const announced = attachmentsOf(e.data).find(x => x.id === String(request.params.att));
+        const a = cleanAttachment(announced);
+        if (!a) return reply.code(404).send({error: 'That request has no such file.'});
+        if (announced.stored) return {id: a.id, stored: true};
+        const body = request.body;
+        if (!Buffer.isBuffer(body) || body.length !== a.size) return reply.code(400).send({error: 'That file is not the size the message said.'});
+        files.save(a, body, e.id);
+        await rx.markStored(e.id, a.id);
+        return reply.code(201).send({id: a.id, stored: true});
+    });
+
     fastify.get('/fleet/mine', async (request, reply) => {
         const slug = await fleet(request, reply);
         if (!slug) return reply;
-        return {tickets: (await rx.ticketsOf(slug)).map(senderView), contact: contactCard(settings)};
+        return {tickets: (await rx.ticketsOf(slug)).map(senderView), contact: await card()};
     });
 
     // ---- The inbox ----
@@ -329,8 +448,10 @@ async function receiverRoutes(fastify, {can, notify, mail, receiverMod, settings
     /** One request for the panel: plus where a reply will be emailed, and why. */
     const detail = async (e) => ({...row(e), replyTo: await replyTarget(e.data)});
 
-    fastify.get('/mode', can('manage'), async () => ({mode: 'receiver', connected: true, contact: contactCard(settings),
-        notifyEmail: settings.notifyEmail || ''}));
+    fastify.get('/mode', can('manage'), async () => {
+        const s = await liveSettings();
+        return {mode: 'receiver', connected: true, contact: contactCard(s), notifyEmail: s.notifyEmail || ''};
+    });
 
     fastify.get('/count', can('manage'), async () => {
         // The archive is out of sight: it counts for nothing (a customer writing again takes it out).
@@ -378,7 +499,7 @@ async function receiverRoutes(fastify, {can, notify, mail, receiverMod, settings
         const target = await replyTarget(d);
         if (target.email && (body || (d.status === 'closed' && e.data.status !== 'closed'))) {
             // From the support mailbox and replying to it: a customer who answers the email reaches Domma Support.
-            const support = contactCard(settings).email;
+            const support = (await card()).email;
             mail.send({to: target.email, ...(support && {from: support, replyTo: support}),
                 ...toCustomerEmail({ticket: d, siteName: siteOf(d.site).name, link: siteLink(d.site, d.ref), body, resolved: d.status === 'closed'})}, {log});
         }
@@ -393,10 +514,19 @@ async function receiverRoutes(fastify, {can, notify, mail, receiverMod, settings
         return row(await rx.patch(e.id, patch, String(request.user?.name || 'Domma Support')));
     });
 
+    fastify.get('/tickets/:id/attachments/:att', can('manage'), async (request, reply) => {
+        const e = await rx.getTicket(request.params.id);
+        const a = e && cleanAttachment(attachmentsOf(e.data).find(x => x.id === String(request.params.att)));
+        const buffer = a && files.read(a, e.id);
+        if (!buffer) return reply.code(404).send({error: 'That file has not arrived, or is gone.'});
+        return sendFile(reply, a, buffer);
+    });
+
     fastify.delete('/tickets/:id', can('manage'), async (request, reply) => {
         const e = await rx.getTicket(request.params.id);
         if (!e) return reply.code(404).send({error: 'No such request.'});
         await rx.removeTicket(e.id);
+        files.removeAll(e.id);
         return {ok: true};
     });
 }

package/plugins/support/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "support",
   "displayName": "Support",
-  "version": "1.1.2",
+  "version": "1.1.6",
   "tier": "free",
   "description": "Get help from Domma straight from your admin: our email, phone and hours always to hand, and a conversation with the Domma team for anything you need - urgent requests first. Right-click a request to archive, resolve or remove it.",
   "author": "Domma CMS",
@@ -61,7 +61,7 @@
     ],
     "views": {
       "plugin-support": {
-        "entry": "support/admin/views/support.js?v=1.1.2",
+        "entry": "support/admin/views/support.js?v=1.1.6",
         "exportName": "supportView"
       }
     }

package/plugins/support/tests/api.test.js

@@ -11,6 +11,7 @@ import os from 'node:os';
 import path from 'node:path';
 import Fastify from 'fastify';
 import support from '../plugin.js';
+import {allTickets, forget} from '../lib/receiver.js';
 import {getEntry, updateEntry} from '../../../server/services/collections.js';
 
 const COLL = path.resolve('content/collections/support-tickets');
@@ -34,12 +35,15 @@ const fetchInto = (app) => async (url, init = {}) => {
 
 const ANN = {id: 'u1', name: 'Ann', email: 'ann@acme.test'};
 
+// The manager's settings as stored; the plugin reads them per request (1.1.5).
+const managerSettings = {perSiteMax: 30, perSiteMinutes: 10, phone: '+44 1234 567890', hours: 'Always', notifyEmail: 'support@dommajs.test'};
+
 async function site({token, user = ANN, settings = {}, env, screenWaitMs} = {}) {
     const app = Fastify();
     await app.register(support, {
         ...(screenWaitMs && {screenWaitMs}),
         auth: {authenticate: async (req) => { req.user = user; }, requirePermission: () => async () => {}},
-        settings, mode: 'sender', timer: false, dataDir: await fs.mkdtemp(path.join(dataDir, 'site-')),
+        settings, readSettings: async () => ({...settings}), mode: 'sender', timer: false, dataDir: await fs.mkdtemp(path.join(dataDir, 'site-')),
         env: env ?? {MANAGER_URL: 'http://127.0.0.1:8192/', FLEET_TOKEN: token, SITE_SLUG: TOKENS[token] || 'x'},
         fetch: fetchInto(manager),
         hooks: {notify: (n) => siteNotices.push(n), registerNotificationSource() {}}
@@ -63,7 +67,7 @@ before(async () => {
         prefix: '/api/plugins/support', mode: 'receiver', mail,
         // acme was bought (an owner on the manager); beta was made by hand.
         ownerEmail: async (slug) => (slug === 'acme' ? 'owner@acme.test' : null), dataDir: await fs.mkdtemp(path.join(dataDir, 'manager-')),
-        settings: {perSiteMax: 30, perSiteMinutes: 10, phone: '+44 1234 567890', hours: 'Always', notifyEmail: 'support@dommajs.test'},
+        settings: {...managerSettings}, readSettings: async () => ({...managerSettings}),
         slugFromToken: async (h) => TOKENS[String(h || '').replace(/^Bearer\s+/i, '')] || null,
         siteDirectory: () => SITES,
         hooks: {notify: (n) => notices.push(n), registerNotificationSource() {}}
@@ -197,6 +201,11 @@ test('one site cannot flood the inbox', async () => {
         codes.push(r.status);
     }
     assert.deepEqual(codes.filter(c => c === 429).length, 2);
+    // A higher limit saved in the cog applies to the next message - no restart.
+    managerSettings.perSiteMax = 31;
+    const more = await call(manager, 'POST', '/api/plugins/support/fleet/tickets', {ref: 'f-live', subject: 's', body: 'b'}, {authorization: 'Bearer tok-flood'});
+    assert.equal(more.status, 201, 'live limit');
+    managerSettings.perSiteMax = 30;
     void flood;
 });
 
@@ -218,9 +227,10 @@ test('review: a customer message lost on the manager is sent again', async () =>
     const s = (await call(acme, 'POST', '/tickets', {subject: 'Lost one', body: 'first'})).body;
     await call(acme, 'POST', `/tickets/${s.ref}/messages`, {body: 'second'});
     const t = (await call(manager, 'GET', '/api/plugins/support/tickets')).body.tickets.find(x => x.ref === s.ref);
-    // Simulate a concurrent write that dropped it.
+    // Simulate a concurrent write that dropped it - behind the plugin's back, so its memory is retired by hand.
     const e = await getEntry('support-tickets', t.id);
     await updateEntry('support-tickets', t.id, {...e.data, messages: e.data.messages.slice(0, 1)});
+    forget();
     await call(acme, 'GET', '/tickets');          // notices it is missing, marks it waiting
     await call(acme, 'GET', '/tickets');          // sends it again
     const after = (await call(manager, 'GET', `/api/plugins/support/tickets/${t.id}`)).body;
@@ -379,3 +389,115 @@ test('review: archiving measures against the reply the customer SAW - a newer on
     assert.equal(now.archived, false, 'the newer reply keeps it in the list');
     assert.equal(now.unread, true);
 });
+
+test('the inbox memory: polls share one read, and every write is seen by the very next read', async () => {
+    const P = '/api/plugins/support';
+    const acme = await site({token: 'tok-acme'});
+    forget();
+    const first = await allTickets();
+    assert.equal(await allTickets(), first, 'a second read inside the window is the same read');
+    await call(manager, 'GET', `${P}/count`);
+    // A site opens a request: the badge and the inbox show it at once, not in 30 s.
+    const s = (await call(acme, 'POST', '/tickets', {subject: 'Cache me', body: 'A fresh read, please.', priority: 'urgent'})).body;
+    assert.notEqual(await allTickets(), first, 'the write retired the memory');
+    const t = (await call(manager, 'GET', `${P}/tickets`)).body.tickets.find(x => x.ref === s.ref);
+    assert.ok(t, 'in the inbox straight away');
+    assert.ok((await call(manager, 'GET', `${P}/count`)).body.details.items.some(i => i.text === 'Cache me'), 'and on the badge');
+    // Domma's reply, a status change and a delete: each on the very next read.
+    await call(manager, 'POST', `${P}/tickets/${t.id}/reply`, {body: 'Here you are.'});
+    assert.equal((await call(manager, 'GET', `${P}/tickets`)).body.tickets.find(x => x.id === t.id).messages.length, 2);
+    await call(manager, 'PUT', `${P}/tickets/${t.id}`, {status: 'closed'});
+    assert.equal((await call(manager, 'GET', `${P}/tickets`)).body.tickets.find(x => x.id === t.id).status, 'closed');
+    assert.equal((await call(acme, 'GET', '/tickets')).body.tickets.find(x => x.ref === s.ref).status, 'closed', 'the site hears it on its next sync');
+    assert.equal((await call(manager, 'DELETE', `${P}/tickets/${t.id}`)).status, 200);
+    assert.ok(!(await call(manager, 'GET', `${P}/tickets`)).body.tickets.some(x => x.id === t.id), 'gone from the very next read');
+});
+
+// ---- Attachments (1.1.4) ----
+
+import multipart from '@fastify/multipart';
+
+/** One file as a multipart form. */
+function form(name, type, content) {
+    const b = '----sp' + Math.random().toString(16).slice(2);
+    return {
+        headers: {'content-type': `multipart/form-data; boundary=${b}`},
+        payload: Buffer.concat([Buffer.from(`--${b}\r\nContent-Disposition: form-data; name="file"; filename="${name}"\r\nContent-Type: ${type}\r\n\r\n`),
+            Buffer.from(content), Buffer.from(`\r\n--${b}--\r\n`)])
+    };
+}
+
+/** A site app that can take uploads (the engine registers multipart for every plugin). */
+async function siteWithUploads(token) {
+    const app = Fastify();
+    await app.register(multipart, {limits: {fileSize: 10 * 1024 * 1024}});
+    await app.register(support, {
+        auth: {authenticate: async (req) => { req.user = ANN; }, requirePermission: () => async () => {}},
+        settings: {}, readSettings: async () => ({}), mode: 'sender', timer: false, dataDir: await fs.mkdtemp(path.join(dataDir, 'site-')),
+        env: {MANAGER_URL: 'http://127.0.0.1:8192/', FLEET_TOKEN: token, SITE_SLUG: TOKENS[token]},
+        fetch: fetchInto(manager), hooks: {}
+    });
+    return app;
+}
+
+test('a screenshot goes with a request, and a log with a follow-up; Domma opens both', async () => {
+    const P = '/api/plugins/support';
+    const acme = await siteWithUploads('tok-acme');
+    const png = Buffer.concat([Buffer.from([0x89, 0x50, 0x4e, 0x47]), Buffer.alloc(5000, 1)]);
+    const up = await acme.inject({method: 'POST', url: '/attachments', ...form('checkout.png', 'image/png', png)});
+    assert.equal(up.statusCode, 201, up.body);
+    const shot = up.json();
+    assert.equal((await acme.inject({method: 'POST', url: '/attachments', ...form('x.html', 'text/html', '<script>')})).statusCode, 400);
+    const big = await acme.inject({method: 'POST', url: '/attachments', ...form('big.png', 'image/png', Buffer.alloc(2 * 1024 * 1024 + 1))});
+    assert.equal(big.statusCode, 413);
+
+    const sent = await call(acme, 'POST', '/tickets', {subject: 'Checkout looks wrong', body: 'See the screenshot.', attachments: [shot]});
+    assert.equal(sent.status, 201, JSON.stringify(sent.body));
+    let t = (await call(manager, 'GET', `${P}/tickets`)).body.tickets.find(x => x.ref === sent.body.ref);
+    assert.deepEqual(t.messages[0].attachments.map(a => [a.name, a.size, a.stored]), [['checkout.png', png.length, true]]);
+    const got = await manager.inject({method: 'GET', url: `${P}/tickets/${t.id}/attachments/${shot.id}`});
+    assert.equal(got.statusCode, 200);
+    assert.equal(got.headers['content-type'], 'image/png');
+    assert.ok(Buffer.compare(got.rawPayload, png) === 0);
+
+    // A follow-up with a log file.
+    const log = (await acme.inject({method: 'POST', url: '/attachments', ...form('console.txt', 'text/plain', 'TypeError: x is undefined')})).json();
+    assert.equal((await call(acme, 'POST', `/tickets/${sent.body.ref}/messages`, {body: 'And the console.', attachments: [log]})).status, 201);
+    t = (await call(manager, 'GET', `${P}/tickets/${t.id}`)).body;
+    assert.equal(t.messages[1].attachments[0].name, 'console.txt');
+    assert.equal((await manager.inject({method: 'GET', url: `${P}/tickets/${t.id}/attachments/${log.id}`})).body, 'TypeError: x is undefined');
+
+    // The site sees its files in the thread and opens its own copy.
+    const mine = (await call(acme, 'GET', '/tickets')).body.tickets.find(x => x.ref === sent.body.ref);
+    assert.equal(mine.messages[0].attachments[0].stored, true);
+    assert.equal((await acme.inject({method: 'GET', url: `/attachments/${shot.id}`})).statusCode, 200);
+
+    // The fleet route: another site's token and an unannounced file are refused; a retry is fine.
+    const raw = (tok, att, body) => manager.inject({method: 'POST', url: `${P}/fleet/attach/${sent.body.ref}/${att}`,
+        headers: {authorization: `Bearer ${tok}`, 'content-type': 'application/octet-stream'}, payload: body});
+    assert.equal((await raw('tok-beta', shot.id, png)).statusCode, 404);
+    assert.equal((await raw('tok-acme', '0f8fad5b-d9cb-469f-a165-000000000000', png)).statusCode, 404);
+    assert.equal((await raw('tok-acme', shot.id, png)).statusCode, 200);
+
+    // Delete the request: its files go too.
+    assert.equal((await call(manager, 'DELETE', `${P}/tickets/${t.id}`)).status, 200);
+    assert.equal((await manager.inject({method: 'GET', url: `${P}/tickets/${t.id}/attachments/${shot.id}`})).statusCode, 404);
+    await acme.close();
+});
+
+test('a file attached while the manager restarts waits with its request, then both go', async () => {
+    const P = '/api/plugins/support';
+    const acme = await siteWithUploads('tok-acme');
+    const shot = (await acme.inject({method: 'POST', url: '/attachments', ...form('down.png', 'image/png', Buffer.alloc(900, 3))})).json();
+    managerUp = false;
+    let ref;
+    try {
+        const r = await call(acme, 'POST', '/tickets', {subject: 'Offline with a picture', body: 'b', attachments: [shot]});
+        assert.equal(r.body.state, 'waiting');
+        ref = r.body.ref;
+    } finally { managerUp = true; }
+    await call(acme, 'GET', '/tickets');
+    const t = (await call(manager, 'GET', `${P}/tickets`)).body.tickets.find(x => x.ref === ref);
+    assert.equal(t.messages[0].attachments[0].stored, true);
+    await acme.close();
+});

package/plugins/support/tests/settings.test.js

@@ -0,0 +1,68 @@
+/**
+ * The settings cog (1.1.5): each side keeps its own keys; emails and the phone
+ * are checked as the contact card checks them; the manager's routes save live.
+ */
+import {test, after} from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import Fastify from 'fastify';
+import support from '../plugin.js';
+import {cleanSettings, settingsErrors} from '../lib/shape.js';
+
+const dirs = [];
+after(async () => { for (const d of dirs) await fs.rm(d, {recursive: true, force: true}); });
+const tmp = async () => { const d = await fs.mkdtemp(path.join(os.tmpdir(), 'support-set-')); dirs.push(d); return d; };
+
+test('cleanSettings: a side\'s own keys, checked, else current, else default', () => {
+    assert.deepEqual(cleanSettings({syncMinutes: '15', email: 'x@y.z'}, {}, 'sender'), {syncMinutes: 15});
+    const cur = {email: 'help@domma.test', phone: '', hours: 'Weekdays', responseTime: 'A day', notifyEmail: 'in@domma.test', perSiteMax: 20, perSiteMinutes: 10};
+    const out = cleanSettings({email: 'not an email', phone: '+44 (0)1234 567890', hours: 'Mon\nto Fri', notifyEmail: '', perSiteMax: 0}, cur, 'receiver');
+    assert.equal(out.email, 'help@domma.test', 'a bad address keeps the current one');
+    assert.equal(out.phone, '+44 (0)1234 567890');
+    assert.equal(out.hours, 'Mon to Fri', 'one line');
+    assert.equal(out.notifyEmail, '', 'empty is allowed: email nobody');
+    assert.equal(out.perSiteMax, 20);
+    assert.deepEqual(Object.keys(settingsErrors({email: 'nope', phone: 'call me', perSiteMinutes: 0, notifyEmail: ''}, 'receiver')).sort(),
+        ['email', 'perSiteMinutes', 'phone']);
+});
+
+async function receiver(store) {
+    const app = Fastify();
+    await app.register(support, {
+        auth: {authenticate: async (req) => { req.user = {id: 'v1', name: 'D'}; }, requirePermission: () => async () => {}},
+        prefix: '/api/plugins/support', mode: 'receiver', mail: {send() {}}, dataDir: await tmp(),
+        readSettings: async () => ({...store}), writeSettings: async (next) => { Object.assign(store, next); },
+        slugFromToken: async () => null, siteDirectory: () => ({}), hooks: {}
+    });
+    return app;
+}
+
+test('the manager saves its card; /mode shows it at once; a bad phone is 400', async () => {
+    const store = {syncMinutes: 5, email: 'a@domma.test', hours: 'Old', notifyEmail: 'in@domma.test', perSiteMax: 20, perSiteMinutes: 10};
+    const app = await receiver(store);
+    const got = (await app.inject({url: '/api/plugins/support/settings'})).json();
+    assert.equal(got.side, 'receiver');
+    assert.equal('syncMinutes' in got.settings, false, 'the site\'s key is not the manager\'s');
+    const put = await app.inject({method: 'PUT', url: '/api/plugins/support/settings', payload: {...got.settings, hours: 'Nine to five'}});
+    assert.equal(put.statusCode, 200);
+    assert.equal(store.hours, 'Nine to five');
+    assert.equal(store.syncMinutes, 5);
+    assert.equal((await app.inject({url: '/api/plugins/support/mode'})).json().contact.hours, 'Nine to five');
+    const bad = await app.inject({method: 'PUT', url: '/api/plugins/support/settings', payload: {phone: 'ring us'}});
+    assert.equal(bad.statusCode, 400);
+    assert.ok(bad.json().errors.phone);
+    await app.close();
+});
+
+test('a site\'s settings route is for administrators', async () => {
+    const app = Fastify();
+    await app.register(support, {
+        auth: {authenticate: async (req) => { req.user = {id: 'u'}; }, requirePermission: () => async () => {},
+            requireAdmin: async (req, reply) => reply.code(403).send({error: 'Forbidden'})},
+        mode: 'sender', timer: false, env: {}, dataDir: await tmp(), readSettings: async () => ({}), hooks: {}
+    });
+    assert.equal((await app.inject({url: '/settings'})).statusCode, 403);
+    await app.close();
+});