domma-cms 1.6.37 → 1.6.39

package/plugins/_lib/mail/oauthRoutes.js

@@ -0,0 +1,294 @@
+/**
+ * The OAuth2 sign-in routes for mailboxes: Connect, the provider's callback,
+ * Disconnect and Test. Registered by Email Pro (which feature-detects this
+ * file - an engine without it simply offers no sign-in); the free reader does
+ * not register them, but reads a signed-in mailbox all the same.
+ *
+ * Each customer registers THEIR OWN app with Microsoft or Google - the Docs
+ * Pro cloud-copies design. The admin form shows this site's exact redirect
+ * URI with a guide; the client secret goes in sealed and never comes out.
+ *
+ * The callback is the one route without a session. Its `state` is a one-time
+ * ticket, ten minutes long, naming the person who pressed Connect, and the
+ * callback refuses a browser signed in to this site as somebody else.
+ *
+ * @module _lib/mail/oauthRoutes
+ */
+import {createHash, randomBytes, timingSafeEqual} from 'node:crypto';
+
+import {originOf, trustedOrigin} from '../../../server/services/passwordReset.js';
+import {resolveViewer} from '../../../server/services/viewerSession.js';
+import * as accounts from './accounts.js';
+import {MailKeyError, open, seal} from './secretbox.js';
+import {verifySmtp} from './send.js';
+import {
+    announceConnected, authorizeUrl, cleanTenant, configureOAuth, describeProviders, exchangeCode,
+    mailboxFor, pkcePair, PROVIDERS, revokeAccount
+} from './oauth.js';
+
+const STATE_TTL = 10 * 60 * 1000;
+/** Pending sign-ins kept at once - a ceiling on what a busy (or hostile) admin can pile up. */
+const MAX_PENDING = 200;
+/** Pending sign-ins per person: a new one beyond this replaces their oldest. */
+const MAX_PENDING_PER_USER = 5;
+
+const sha256 = (v) => createHash('sha256').update(String(v)).digest();
+
+/**
+ * The browser-binding cookie's name for one sign-in. Per state, so two
+ * Connects in two tabs do not overwrite each other's cookie.
+ *
+ * @param   {string} state
+ * @returns {string}
+ */
+export function bindCookieName(state) {
+    return `dm_mail_oauth_${sha256(state).toString('hex').slice(0, 16)}`;
+}
+
+/**
+ * One cookie's value from a raw Cookie header (no cookie plugin assumed).
+ *
+ * @param   {string|undefined} header
+ * @param   {string} name
+ * @returns {string}
+ */
+export function readCookie(header, name) {
+    for (const part of String(header ?? '').split(';')) {
+        const at = part.indexOf('=');
+        if (at !== -1 && part.slice(0, at).trim() === name) return part.slice(at + 1).trim();
+    }
+    return '';
+}
+
+const text = (v, max = 300) => String(v ?? '').trim().slice(0, max);
+// JSON inside a <script>: nothing in it can close the element early.
+const js = (v) => JSON.stringify(v).replace(/</g, '\\u003c').replace(/\u2028/g, '\\u2028').replace(/\u2029/g, '\\u2029');
+const esc = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+
+/**
+ * @param {object} fastify
+ * @param {{authenticate: Function, pool: object, pluginName: string, config?: object,
+ *          onNeedsReconnect?: Function, onConnected?: Function, fetch?: Function}} options
+ */
+export function registerOAuthRoutes(fastify, {authenticate, pool, pluginName, config = {}, onNeedsReconnect, onConnected, fetch}) {
+    configureOAuth({fetch, onNeedsReconnect: onNeedsReconnect ?? null, onConnected: onConnected ?? null});
+
+    /** state -> {userId, accountId, provider, clientId, clientSecretSealed, tenant, label, username, verifier, redirectUri, expires} */
+    const pending = new Map();
+    const userId = (request) => request.user?.id ?? request.user?.sub ?? null;
+
+    /** This site's exact return address - what the customer registers with the provider. */
+    async function redirectUriFor(request) {
+        const origin = await trustedOrigin(originOf(request)).catch(() => '') || originOf(request);
+        return `${origin}/api/plugins/${pluginName}/oauth/callback`;
+    }
+
+    function sweep() {
+        const now = Date.now();
+        for (const [k, v] of pending) if (v.expires < now) pending.delete(k);
+    }
+
+    /** GET /oauth/status - providers and the redirect URI, for the form's guide. */
+    fastify.get('/oauth/status', {preHandler: [authenticate]}, async (request) => {
+        const redirectUri = await redirectUriFor(request);
+        return {available: true, redirectUri, https: redirectUri.startsWith('https://'), providers: describeProviders()};
+    });
+
+    /**
+     * POST /oauth/start - where to send the person to sign in.
+     * Body: {accountId?, provider, clientId, clientSecret (blank = keep the saved one), tenant?, label?, username?}
+     */
+    fastify.post('/oauth/start', {preHandler: [authenticate], config: {rateLimit: {max: 20, timeWindow: '1 minute'}}}, async (request, reply) => {
+        const uid = userId(request);
+        if (!uid) return reply.code(401).send({error: 'Authentication required.'});
+        const body = request.body ?? {};
+        const provider = text(body.provider, 20);
+        if (!PROVIDERS[provider]) return reply.code(400).send({error: 'Choose Microsoft or Google.'});
+
+        const accountId = body.accountId ? text(body.accountId, 80) : null;
+        const existing = accountId ? await accounts.getAccount(uid, accountId) : null;
+        if (accountId && !existing) return reply.code(404).send({error: 'That mailbox does not exist.'});
+
+        const clientId = text(body.clientId, 200);
+        if (!clientId) return reply.code(400).send({error: PROVIDERS[provider].id === 'microsoft' ? 'The Application (client) ID is needed.' : 'The Client ID is needed.'});
+
+        // Blank secret = the one already saved, but only for the same app.
+        let clientSecret = text(body.clientSecret, 2000);
+        if (!clientSecret) {
+            const o = existing?.oauth;
+            if (o?.clientSecretSealed && o.provider === provider && o.clientId === clientId) {
+                try {
+                    clientSecret = open(o.clientSecretSealed);
+                } catch (err) {
+                    if (err instanceof MailKeyError) return reply.code(409).send({error: 'The saved client secret can no longer be read - type it again.'});
+                    throw err;
+                }
+            }
+        }
+        if (!clientSecret) return reply.code(400).send({error: 'The client secret is needed.'});
+
+        const username = text(body.username, 254).toLowerCase();
+        if (username && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(username)) return reply.code(400).send({error: 'That is not an email address.'});
+
+        sweep();
+        // Per person first: their oldest waiting sign-in makes room. Then the
+        // site-wide ceiling, which only many people at once can reach.
+        const mine = [...pending.entries()].filter(([, v]) => v.userId === uid).sort((a, b) => a[1].expires - b[1].expires);
+        while (mine.length >= MAX_PENDING_PER_USER) pending.delete(mine.shift()[0]);
+        if (pending.size >= MAX_PENDING) return reply.code(429).send({error: 'Too many sign-ins are waiting. Try again in a few minutes.'});
+
+        const state = randomBytes(24).toString('base64url');
+        const {verifier, challenge} = pkcePair();
+        const redirectUri = await redirectUriFor(request);
+        const tenant = PROVIDERS[provider].needsTenant ? cleanTenant(body.tenant) : null;
+        // Binds the sign-in to THIS browser: the callback refuses one that does
+        // not bring the cookie back. Without it, an anonymous browser could
+        // finish a sign-in someone else started (send a colleague the
+        // provider link, and their mailbox lands under your account).
+        // HttpOnly, SameSite=Lax (sent on the provider's top-level redirect
+        // back), scoped to the callback path, gone in ten minutes.
+        const bind = randomBytes(24).toString('base64url');
+        const callbackPath = new URL(redirectUri).pathname;
+        reply.header('Set-Cookie', `${bindCookieName(state)}=${bind}; Path=${callbackPath}; Max-Age=${STATE_TTL / 1000}; HttpOnly; SameSite=Lax`
+            + (redirectUri.startsWith('https://') ? '; Secure' : ''));
+        pending.set(state, {
+            userId: uid, accountId, provider, clientId, clientSecretSealed: seal(clientSecret), tenant,
+            label: text(body.label, 80), username, verifier, redirectUri, bindHash: sha256(bind), expires: Date.now() + STATE_TTL
+        });
+        return {
+            url: authorizeUrl({provider, clientId, tenant, redirectUri, state, codeChallenge: challenge,
+                loginHint: username || existing?.username || ''}),
+            redirectUri
+        };
+    });
+
+    /**
+     * GET /oauth/callback - the provider sends the person back here. Answers a
+     * small page that tells the mail screen (its opener) and closes itself.
+     */
+    fastify.get('/oauth/callback', {config: {rateLimit: {max: 30, timeWindow: '1 minute'}}}, async (request, reply) => {
+        const q = request.query ?? {};
+        const key = String(q.state ?? '');
+        const ticket = pending.get(key);
+        pending.delete(key);
+
+        const page = (ok, message, origin, accountId = null) => reply
+            .type('text/html; charset=utf-8')
+            .header('Cache-Control', 'no-store')
+            .header('Referrer-Policy', 'no-referrer')
+            .header('X-Robots-Tag', 'noindex')
+            .send(`<!doctype html><meta charset="utf-8"><meta name="robots" content="noindex"><title>${ok ? 'Mailbox connected' : 'Not connected'}</title>`
+                + `<body style="font-family:system-ui,sans-serif;display:grid;place-items:center;min-height:90vh;margin:0"><main style="max-width:30rem;text-align:center;padding:1rem">`
+                + `<h1 style="font-size:1.3rem">${ok ? 'Mailbox connected' : 'Not connected'}</h1><p>${esc(message)}</p><p>You can close this window.</p></main>`
+                + `<script>try{window.opener&&window.opener.postMessage(${js({type: 'domma-mail-oauth', ok, message, accountId})},${js(origin || '')});}catch(e){}${ok ? 'setTimeout(function(){window.close();},1200);' : ''}</script>`);
+
+        if (!ticket || ticket.expires < Date.now()) {
+            return page(false, 'This sign-in link has expired or was already used. Go back to Email and press Connect again.', null);
+        }
+        const origin = new URL(ticket.redirectUri).origin;
+        // Used up either way; clear it.
+        const cookieName = bindCookieName(key);
+        reply.header('Set-Cookie', `${cookieName}=; Path=${new URL(ticket.redirectUri).pathname}; Max-Age=0; HttpOnly; SameSite=Lax`);
+        if (q.error) return page(false, `The sign-in was not completed: ${text(q.error_description || q.error, 200)}`, origin);
+
+        // The browser that pressed Connect, and no other.
+        const bound = readCookie(request.headers.cookie, cookieName);
+        if (!bound || !timingSafeEqual(sha256(bound), ticket.bindHash)) {
+            return page(false, `This sign-in has to be finished in the browser that pressed Connect, with the admin open at ${origin}. Press Connect again there.`, origin);
+        }
+
+        // Signed in to this site as somebody else: refuse - whoever pressed
+        // Connect must be the one who finishes it.
+        const viewer = await resolveViewer(request).catch(() => null);
+        if (viewer?.id && viewer.id !== ticket.userId) {
+            return page(false, 'This sign-in was started by someone else. Press Connect yourself.', origin);
+        }
+        if (ticket.accountId && !(await accounts.getAccount(ticket.userId, ticket.accountId))) {
+            return page(false, 'That mailbox no longer exists.', origin);
+        }
+
+        try {
+            const clientSecret = open(ticket.clientSecretSealed);
+            const got = await exchangeCode({
+                provider: ticket.provider, clientId: ticket.clientId, clientSecret, tenant: ticket.tenant,
+                code: text(q.code, 4000), redirectUri: ticket.redirectUri, codeVerifier: ticket.verifier
+            });
+            const box = mailboxFor(ticket.provider, got.claims);
+            // Typed wins: a Microsoft 365 shared mailbox is signed in to by a
+            // person but addressed as itself (XOAUTH2 user = the shared address).
+            const username = ticket.username || box.email;
+            if (!username) {
+                return page(false, 'The provider did not say which mailbox was signed in to. Type the email address in the form and Connect again.', origin);
+            }
+            const p = PROVIDERS[ticket.provider];
+            const saved = await accounts.saveOAuthAccount(ticket.userId, ticket.accountId, {
+                label: ticket.label || username,
+                username,
+                provider: ticket.provider,
+                clientId: ticket.clientId,
+                tenant: ticket.tenant,
+                clientSecret,
+                refreshToken: got.refreshToken,
+                accessToken: got.accessToken,
+                expiresAt: got.expiresAt,
+                scope: got.scope,
+                imap: p.imap,
+                smtp: box.smtp
+            });
+            if (!saved) return page(false, 'That mailbox no longer exists.', origin);
+            // A connection opened with the old details must not be reused.
+            pool.release(`${ticket.userId}:${saved.id}`);
+            announceConnected(saved);
+            return page(true, `${username} is connected through ${p.short}.`, origin, saved.id);
+        } catch (err) {
+            fastify.log.warn(`[${pluginName}] mailbox sign-in failed: ${err.message}`);
+            return page(false, text(err.message, 300), origin);
+        }
+    });
+
+    /** POST /oauth/:id/disconnect - hand the sign-in back (where the provider allows) and forget it. */
+    fastify.post('/oauth/:id/disconnect', {preHandler: [authenticate]}, async (request, reply) => {
+        const uid = userId(request);
+        if (!uid) return reply.code(401).send({error: 'Authentication required.'});
+        const account = await accounts.getAccount(uid, request.params.id);
+        if (!account) return reply.code(404).send({error: 'That mailbox does not exist.'});
+        if (!accounts.isOAuth(account)) return reply.code(400).send({error: 'This mailbox uses a password, not a sign-in.'});
+
+        const result = await revokeAccount(account);
+        pool.release(`${uid}:${account.id}`);
+        // A new generation: a renewal already on the wire must not write a
+        // working token back over the disconnect (see accounts.updateOAuth).
+        const saved = await accounts.updateOAuth(uid, account.id, {
+            status: 'disconnected',
+            error: 'Disconnected. Reconnect to use this mailbox again.',
+            refreshTokenSealed: null,
+            accessTokenSealed: null,
+            expiresAt: 0
+        }, {bumpGen: true});
+        return {account: accounts.toPublic(saved), revoked: result.revoked, revokeSupported: result.supported};
+    });
+
+    /** POST /oauth/:id/test - sign in to both servers with the stored sign-in. */
+    fastify.post('/oauth/:id/test', {preHandler: [authenticate], config: {rateLimit: {max: 10, timeWindow: '1 minute'}}}, async (request, reply) => {
+        const uid = userId(request);
+        if (!uid) return reply.code(401).send({error: 'Authentication required.'});
+        const account = await accounts.getAccount(uid, request.params.id);
+        if (!account) return reply.code(404).send({error: 'That mailbox does not exist.'});
+        if (!accounts.isOAuth(account)) return reply.code(400).send({error: 'This mailbox uses a password, not a sign-in.'});
+
+        let imap;
+        let smtp;
+        try {
+            imap = await pool.test(accounts.toConnection(account));
+        } catch (err) {
+            imap = {ok: false, error: err.message};
+        }
+        try {
+            const out = accounts.toSmtpConnection(account);
+            smtp = out ? await verifySmtp(out.transport, config.allowInsecureTLS === true) : {ok: false, error: 'No outgoing server.'};
+        } catch (err) {
+            smtp = {ok: false, error: err.message};
+        }
+        return {ok: imap.ok && smtp.ok, imap, smtp};
+    });
+}

package/plugins/_lib/mail/readRoutes.js

@@ -140,7 +140,10 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
             };
         } catch (err) {
             if (err instanceof MailKeyError) {
-                reply.code(409).send({error: err.message, needsPassword: true, accountId: account.id});
+                // needsPassword stays true for a dead sign-in too: older
+                // screens already open settings on it, which is the right place.
+                reply.code(409).send({error: err.message, needsPassword: true,
+                    ...(err.needsReconnect ? {needsReconnect: true} : {}), accountId: account.id});
                 return null;
             }
             throw err;
@@ -245,7 +248,8 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
 
         const result = accounts.validate(request.body ?? {}, existing);
         if (!result.ok) return reply.code(400).send({error: result.error});
-        const where = await guardHost(result.value.host);
+        // A signed-in mailbox's servers are the provider's and cannot be edited here.
+        const where = result.value.oauth ? {ok: true} : await guardHost(result.value.host);
         if (!where.ok) return reply.code(400).send({error: where.error});
 
         const saved = await accounts.saveAccount(uid, request.params.id, result.value);
@@ -270,8 +274,15 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
         if (!uid) return reply.code(401).send({error: 'Authentication required.'});
 
         pool.release(`${uid}:${request.params.id}`);
+        const existing = await accounts.getAccount(uid, request.params.id);
         const deleted = await accounts.deleteAccount(uid, request.params.id);
         if (!deleted) return reply.code(404).send({error: 'That mailbox does not exist.'});
+        // A signed-in mailbox hands its sign-in back where the provider allows
+        // it (Google). Best-effort and after the delete: forgetting it here
+        // must not wait on, or fail because of, the provider.
+        if (accounts.isOAuth?.(existing)) {
+            import('./oauth.js').then(m => m.revokeAccount(existing)).catch(() => {});
+        }
         return {deleted: true};
     });
 
@@ -292,6 +303,16 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
 
         const result = accounts.validate(body, existing);
         if (!result.ok) return reply.code(400).send({error: result.error});
+        // A signed-in mailbox is tested as stored: the provider's own server,
+        // its token renewed if need be. Nothing typed is involved.
+        if (result.value.oauth) {
+            try {
+                return await pool.test(accounts.toConnection(existing));
+            } catch (err) {
+                if (err instanceof MailKeyError) return {ok: false, error: err.message};
+                throw err;
+            }
+        }
         const where = await guardHost(result.value.host);
         if (!where.ok) return reply.code(400).send({error: where.error});
 

package/plugins/_lib/mail/scheduler.js

@@ -40,6 +40,17 @@ const MAX_ATTEMPTS = 3;
 /** How long to wait before trying a failed send again. */
 const RETRY_MS = 120_000;
 
+/**
+ * The reason recorded on a queued item whose mailbox needs signing in again.
+ *
+ * @param   {Error} err
+ * @returns {string}
+ */
+export function reconnectReason(err) {
+    if (!err?.needsReconnect) return err?.message || 'The mailbox could not be used.';
+    return `The mailbox needs signing in again (Mail Settings > Mailboxes > Reconnect): ${err.message}`;
+}
+
 /**
  * Create the scheduler.
  *
@@ -70,7 +81,16 @@ export function createScheduler({store, pool, config, logger, tickMs = TICK_MS})
             return;
         }
 
-        const smtp = accounts.toSmtpConnection(account, item.identityId ?? null);
+        // Built INSIDE the try: a signed-in mailbox whose sign-in is dead throws
+        // here (OAuthReconnectError), and escaping would leave the claimed item
+        // `sending` with no finishSend - picked up again on every reclaim.
+        let smtp;
+        try {
+            smtp = accounts.toSmtpConnection(account, item.identityId ?? null);
+        } catch (err) {
+            await store.finishSend(item._id, {status: 'failed', error: reconnectReason(err)});
+            return;
+        }
         if (!smtp) {
             await store.finishSend(item._id, {
                 status: 'failed',
@@ -94,9 +114,11 @@ export function createScheduler({store, pool, config, logger, tickMs = TICK_MS})
             });
             await store.finishSend(item._id, {status: 'sent', result, error: null});
         } catch (err) {
-            const giveUp = (item.attempts ?? 1) >= MAX_ATTEMPTS;
+            // A dead sign-in will not fix itself between retries: fail now, so
+            // the sender is told (the send-failed notice) instead of waiting.
+            const giveUp = err?.needsReconnect || (item.attempts ?? 1) >= MAX_ATTEMPTS;
             await store.finishSend(item._id, giveUp
-                ? {status: 'failed', error: err.message}
+                ? {status: 'failed', error: err?.needsReconnect ? reconnectReason(err) : err.message}
                 // Back to pending, a little later. `finishedAt` is set either
                 // way, which is harmless on a retry and is what tells a
                 // screen when the last attempt was.
@@ -126,9 +148,11 @@ export function createScheduler({store, pool, config, logger, tickMs = TICK_MS})
         }
 
         const poolKey = `${item.userId}:${item.accountId}`;
-        const connection = accounts.toConnection(account);
+        let connection;
 
         try {
+            // Inside the try for the same reason as runSend: a dead sign-in throws here.
+            connection = accounts.toConnection(account);
             // The UID the move reported, when the server has UIDPLUS. Without
             // it the message is found by its Message-ID instead - a snooze on
             // such a server is still a snooze, and refusing to bring it back
@@ -160,9 +184,9 @@ export function createScheduler({store, pool, config, logger, tickMs = TICK_MS})
             // does not read, absent from the list that was supposed to bring
             // it back.
             const attempts = (item.attempts ?? 0) + 1;
-            const giveUp = attempts >= MAX_ATTEMPTS;
+            const giveUp = err?.needsReconnect || attempts >= MAX_ATTEMPTS;
             await store.finishSnooze(item._id, giveUp
-                ? {status: 'failed', error: err.message, attempts}
+                ? {status: 'failed', error: err?.needsReconnect ? `${reconnectReason(err)} The message is still in ${item.folder}.` : err.message, attempts}
                 : {status: 'pending', at: new Date(Date.now() + RETRY_MS), error: err.message, attempts});
             logger.warn(
                 `[mail] could not wake snoozed message ${item._id} (attempt ${attempts}): ${err.message}`

package/plugins/blog/CLAUDE.md

@@ -20,7 +20,8 @@ Public-facing blog for the CMS. Supports posts with categories, tags, and option
 - `blocks/*.html|css` - the shipped layouts, copied into content/blocks/ once
 - `public/blog.js`, `public/blog.css` - the browser half (listing, right-click menu, post extras)
 - `public/samples/*.svg` - sample covers
-- `tests/access.test.js`, `tests/comment-notices.test.js`, `tests/layouts.test.js`, `tests/nav-link.test.js`, `tests/notices.test.js`, `tests/public.test.js`
+- `tests/access.test.js`, `tests/comment-notices.test.js`, `tests/layouts.test.js`, `tests/nav-link.test.js`, `tests/notices.test.js`, `tests/public.test.js`, `tests/cache.test.js`
+- `lib/cache.js` - PURE: the 30 s read cache (forgotten on every write route)
 - `admin/views/blog.js` - post list (KPIs + status/category/search filters)
 - `admin/views/post-editor.js` - create / edit a post
 - `admin/views/categories.js`, `admin/views/comments.js`, `admin/views/settings.js`
@@ -329,3 +330,12 @@ Declared in plugin.json `permissions` (granted once to `admin`), checked on EVER
   tested), needs a plausible email, and refuses a post that does not exist or is not visible (404) - each of those
   used to raise a staff notification.
 - `ASSET_V` / the preview `assetV` are 1.9.6 (they were 1.6.x while the plugin was 1.9.5 - keep them with the version).
+
+## 1.9.7 (2026-10-13 Tool sweep - caching)
+
+- **Whole-collection reads are cached 30 s** (`lib/cache.js`, pure, `tests/cache.test.js`): `loadEntries()` in
+  lib/page.js (public pages, shortcodes, the sitemap source, the `/comments/pending-count` badge) and
+  `resolveAuthorName()` (one user lookup per author per window). The promise is kept, so concurrent misses share one
+  read. **Every non-GET route of this plugin forgets it in an `onSend` hook** - before the writer's response leaves -
+  so the admin's own next read, and the public POST /comments, are fresh. The TTL only covers writes made outside
+  the plugin (Collections tool, Blog Pro). Callers share the cached array: filter/sort copies, never mutate it.

package/plugins/blog/lib/cache.js

@@ -0,0 +1,43 @@
+/**
+ * A short memory for whole-collection reads.
+ *
+ * Every public page view and every sidebar badge poll (once a minute from
+ * every open admin tab) read ALL posts, categories and comments from the
+ * adapter. The data changes only when someone writes, so a read is kept for a
+ * little while and every write route of this plugin throws the memory away
+ * (`forget()`, from an onSend hook in plugin.js - before the writer's own
+ * response leaves, so their next read is fresh). The TTL is the safety net
+ * for writes this plugin never sees (the Collections tool, a Pro take-over).
+ *
+ * PURE - no I/O of its own; the loader is handed in. Tested in tests/cache.test.js.
+ *
+ * @module blog/lib/cache
+ */
+
+export const CACHE_MS = 30_000;
+
+/**
+ * @param {{ttl?: number, clock?: () => number}} [opts]
+ * @returns {{get: (key: string, load: () => Promise<any>) => Promise<any>, forget: () => void, size: number}}
+ */
+export function createCache({ttl = CACHE_MS, clock = Date.now} = {}) {
+    // key -> {at, value: Promise}. The PROMISE is kept, not the result, so
+    // concurrent misses share one read, and a write landing while a read is in
+    // flight clears the map before that read can be stored - nothing stale
+    // survives a forget().
+    const kept = new Map();
+    return {
+        get(key, load) {
+            const hit = kept.get(key);
+            if (hit && clock() - hit.at < ttl) return hit.value;
+            const value = Promise.resolve().then(load);
+            const entry = {at: clock(), value};
+            kept.set(key, entry);
+            // A failed read is not remembered: the next caller tries again.
+            value.catch(() => { if (kept.get(key) === entry) kept.delete(key); });
+            return value;
+        },
+        forget() { kept.clear(); },
+        get size() { return kept.size; }
+    };
+}

package/plugins/blog/lib/page.js

@@ -13,6 +13,13 @@ import defaultConfig from '../config.js';
 import {fmtDate} from '../../_lib/admin/ui/dates.js';
 import {buildToc, byNewest, cardVars, cleanBasePath, DEFAULT_POST_LAYOUT, DISPLAY_DEFAULTS, escapeHtml, interpolate, pickPostLayout, relatedPosts, safeImageUrl} from './layouts.js';
 import {catalogue, loadBlock, renderCards, styleTag} from './render.js';
+import {createCache} from './cache.js';
+
+// Whole-collection reads and author names, kept a short while (lib/cache.js):
+// every public page view and every badge poll read all posts, categories and
+// comments. plugin.js calls forgetEntries() on every write route of this plugin.
+const remembered = createCache();
+export const forgetEntries = () => remembered.forget();
 
 /**
  * Whether readers see a post. Blog Pro files posts under several blogs
@@ -69,12 +76,21 @@ export function liveBase(registered) {
 }
 
 /** Always returns the actual array of entries, regardless of adapter shape. */
-export async function loadEntries(slug) {
+async function readEntries(slug) {
     const result = await listEntries(slug, {limit: 100000, sort: 'createdAt', order: 'desc'});
     const arr = Array.isArray(result) ? result : (Array.isArray(result?.entries) ? result.entries : []);
     return arr.map((entry) => ({id: entry.id, ...(entry.data ?? entry)}));
 }
 
+/**
+ * A collection's entries, newest first - from the cache when a read is fresh.
+ * Callers get the SAME array, so none may change it in place (they filter and
+ * sort copies, as before).
+ */
+export function loadEntries(slug) {
+    return remembered.get(`entries:${slug}`, () => readEntries(slug));
+}
+
 /** Render a post body through the full Markdown + shortcode pipeline. */
 export async function renderPostBody(content) {
     if (!content) return {html: '', usedComponents: []};
@@ -87,14 +103,17 @@ export async function renderPostBody(content) {
     }
 }
 
-export async function resolveAuthorName(authorId) {
-    if (!authorId) return 'Unknown';
-    try {
-        const user = await getUserById(authorId);
-        return user?.name || user?.email || 'Unknown';
-    } catch {
-        return 'Unknown';
-    }
+/** A user's display name - one lookup per author per cache window, not per card. */
+export function resolveAuthorName(authorId) {
+    if (!authorId) return Promise.resolve('Unknown');
+    return remembered.get(`author:${authorId}`, async () => {
+        try {
+            const user = await getUserById(authorId);
+            return user?.name || user?.email || 'Unknown';
+        } catch {
+            return 'Unknown';
+        }
+    });
 }
 
 /** One lookup per author, however many posts they wrote. */

package/plugins/blog/plugin.js

@@ -5,7 +5,7 @@ import {getPluginStates, savePluginState} from '../../server/services/plugins.js
 import {renderBlogPage} from '../../server/services/renderer.js';
 import {cleanBasePath, DISPLAY_DEFAULTS, pickDisplaySettings, safeImageUrl} from './lib/layouts.js';
 import {catalogue, seedBlocks} from './lib/render.js';
-import {liveBase, liveSettings, loadEntries as loadAll, renderPostPage, slugHolder} from './lib/page.js';
+import {forgetEntries, liveBase, liveSettings, loadEntries as loadAll, renderPostPage, slugHolder} from './lib/page.js';
 import {addNavLink, moveNavLink, removeNavLink} from './lib/nav-link.js';
 import {SAMPLE_CATEGORIES, samplePosts} from './lib/samples.js';
 import {commentKey, commentNotice} from './lib/notices.js';
@@ -167,17 +167,9 @@ function isVisible(post) {
         || (post.status === 'scheduled' && post.publishedAt && new Date(post.publishedAt) <= new Date());
 }
 
-async function loadPosts() {
-    const result = await listEntries(POSTS_SLUG, { limit: 100000, sort: 'createdAt', order: 'desc' });
-    const arr = Array.isArray(result) ? result : (result?.entries || []);
-    return arr.map((e) => ({ id: e.id, ...(e.data ?? e) }));
-}
-
-async function loadCategories() {
-    const result = await listEntries(CATEGORIES_SLUG, { limit: 10000 });
-    const arr = Array.isArray(result) ? result : (result?.entries || []);
-    return arr.map((e) => ({ id: e.id, ...(e.data ?? e) }));
-}
+// The shortcodes run on public page views: the same cached reads as the pages.
+const loadPosts = () => loadAll(POSTS_SLUG);
+const loadCategories = () => loadAll(CATEGORIES_SLUG);
 
 function selectPosts(posts, { limit, categorySlug, categoryMap }) {
     let filtered = posts.filter(isVisible);
@@ -337,6 +329,15 @@ export default async function blogPlugin(fastify, options) {
         });
     }
 
+    // Every write route of this plugin (posts, categories, comments - the public
+    // POST /comments too - samples) retires the cached reads behind the public
+    // pages, the shortcodes and the badge. onSend, not onResponse: the memory is
+    // gone BEFORE the writer's response leaves, so their very next read is fresh.
+    // The hook is encapsulated - only this plugin's routes reach it.
+    fastify.addHook('onSend', async (request) => {
+        if (request.method !== 'GET' && request.method !== 'HEAD') forgetEntries();
+    });
+
     // The layouts are blocks; put the shipped ones where the Blocks tool can
     // edit them. Once each, never over a site's own copy (lib/render.js).
     try {
@@ -392,7 +393,7 @@ export default async function blogPlugin(fastify, options) {
         });
         const html = await renderBlogPage(
             fileURLToPath(new URL('./templates/post.html', import.meta.url)),
-            { post: page.html, assetV: '1.9.6' },
+            { post: page.html, assetV: '1.9.7' },
             { title: post.title || 'Preview', description: post.excerpt || '', ogImage: safeImageUrl(post.featuredImage),
               usedComponents: page.usedComponents, urlPath: `${basePath}/${post.slug}`, noindex: true }
         );

package/plugins/blog/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "blog",
   "displayName": "Blog",
-  "version": "1.9.6",
+  "version": "1.9.7",
   "tier": "free",
   "description": "Public-facing blog with posts, categories and comments - layouts and listings built from editable blocks.",
   "author": "Domma CMS",

package/plugins/blog/plugin.public.js

@@ -24,7 +24,7 @@ const __dirname = fileURLToPath(new URL('.', import.meta.url));
 const TEMPLATES_DIR = path.join(__dirname, 'templates');
 
 /** Bumped with the plugin, so a release is never served a stale script. */
-const ASSET_V = '1.9.6';
+const ASSET_V = '1.9.7';
 
 /**
  * Above this many posts a listing pages on the server instead: the browser