domma-cms 1.6.37 → 1.6.39

package/plugins/feedback/admin/lib/settings.js

@@ -0,0 +1,107 @@
+/**
+ * Feedback - the settings cog (1.1.7). Each side shows its own settings only:
+ *
+ *   a site      how often it sends what waits and looks for replies (administrators)
+ *   the manager  how many reports one site may send in how many minutes (`manage`)
+ *
+ * They used to be reachable only through Marketplace > Configure and were read
+ * at boot; the server now reads them when used, so a save here is live.
+ *
+ * @module feedback/admin/lib/settings
+ */
+import {BASE, esc, openPanel} from './kit.js';
+
+/** Ranges - lib/shape.js SETTING_RULES, which the server applies again. */
+const RULES = {
+    syncMinutes: {min: 5, max: 1440},
+    perSiteMax: {min: 1, max: 1000},
+    perSiteMinutes: {min: 1, max: 1440}
+};
+
+const FIELDS = {
+    sender: [
+        {key: 'syncMinutes', label: 'Check for replies every (minutes)',
+            help: 'How often this site sends any feedback still waiting and looks for Domma\'s replies. Opening Feedback always checks at once; this is the background check. 5 to 1440 (a day).'}
+    ],
+    receiver: [
+        {key: 'perSiteMax', label: 'Reports per site',
+            help: 'The most reports one site may send within the window below; more are refused with "try again in a few minutes" and the site retries later. Files have their own allowance: this many reports\' worth.'},
+        {key: 'perSiteMinutes', label: 'Window (minutes)',
+            help: 'The window the limit above counts in, in minutes.'}
+    ]
+};
+
+const wholeIn = (v, {min, max}) => { const n = Number(v); return String(v).trim() !== '' && Number.isInteger(n) && n >= min && n <= max; };
+
+/**
+ * Add the cog when this user may change this side's settings (asked once).
+ *
+ * @param {object} $container
+ * @param {object} kit - loadKit()
+ */
+export async function addSettingsCog($container, kit) {
+    let got = null;
+    // Silent: a site user who is not an administrator gets 403 here, and needs no cog and no error.
+    try { got = await H.request('GET', `${BASE}/settings`, null, {silent: true}); } catch { return; }
+    if (!got?.side) return;
+    kit.addBannerAction($container, {id: 'feedback-settings', icon: 'settings', title: 'Feedback settings', onClick: () => openSettings()});
+}
+
+export async function openSettings() {
+    let got;
+    try { got = await H.get(`${BASE}/settings`); } catch (err) { E.toast(`Settings not loaded: ${esc(err?.message || err)}`, {type: 'error'}); return; }
+    const fields = FIELDS[got.side] || [];
+    const f = Object.fromEntries(fields.map(x => [x.key, M.observable(String(got.settings?.[x.key] ?? ''))]));
+    const values = () => Object.fromEntries(fields.map(x => [x.key, Number(f[x.key].peek())]));
+    const opened = JSON.stringify(values());
+    const saving = M.observable(false);
+    const bad = Object.fromEntries(fields.map(x => [`${x.key}Bad`, M.computed(() => !wholeIn(f[x.key].value, RULES[x.key]))]));
+    const model = {...f, ...bad, saving, cannot: M.computed(() => saving.value || Object.values(bad).some(b => b.value))};
+    const html = `
+<div class="fb-form">
+  ${fields.map(x => `
+  <label class="form-label" for="fb-set-${x.key}">${x.label} <span data-help="${esc(x.help)}"></span></label>
+  <input id="fb-set-${x.key}" type="number" class="form-input" min="${RULES[x.key].min}" max="${RULES[x.key].max}" step="1" data-model="${x.key}.value">
+  <small class="fb-note is-bad" data-bind-hidden="!${x.key}Bad.value">A whole number from ${RULES[x.key].min} to ${RULES[x.key].max}.</small>`).join('')}
+  <p class="fb-note">Saved settings take effect at once - no restart.</p>
+  <div class="fb-actions">
+    <span class="fb-spacer"></span>
+    <button type="button" class="btn btn-sm btn-ghost" data-on-click="cancel">Cancel</button>
+    <button type="button" class="btn btn-sm btn-primary" data-on-click="save" data-bind-disabled="cannot.value">Save</button>
+  </div>
+</div>`;
+    let panel = null;
+    let closed = false;
+    let asking = false;
+    const methods = {
+        cancel: () => panel?.so.close(),
+        async save() {
+            if (model.cannot.peek()) return;
+            saving.value = true;
+            try {
+                await H.put(`${BASE}/settings`, values());
+                E.toast('Feedback settings saved.', {type: 'success'});
+                panel.so.close(true);
+            } catch (err) {
+                E.toast(`Not saved: ${esc(err?.message || err)}`, {type: 'error'});
+            } finally {
+                saving.value = false;
+            }
+        }
+    };
+    panel = await openPanel({title: 'Feedback settings', size: 'sm', html, model, methods});
+    // Closing with a change asks first - once (onceClosed calls close() again, argument-less).
+    const close = panel.so.close.bind(panel.so);
+    panel.so.close = async (force) => {
+        if (!closed && force !== true && JSON.stringify(values()) !== opened) {
+            if (asking) return undefined;
+            asking = true;
+            const ok = await E.confirm('Discard what you have entered?');
+            asking = false;
+            if (!ok) return undefined;
+        }
+        closed = true;
+        return close();
+    };
+    panel.panel.addEventListener('keydown', (e) => { if ((e.ctrlKey || e.metaKey) && e.key === 'Enter') { e.preventDefault(); methods.save(); } });
+}

package/plugins/feedback/admin/views/feedback.js

@@ -14,9 +14,10 @@
  */
 
 import {api, loadKit, store} from '../lib/kit.js';
+import {addSettingsCog} from '../lib/settings.js';
 
 const ROUTE = /^#\/plugins\/feedback(\/|$)/;
-const V = '1.1.4';
+const V = '1.1.8';
 const TABS = [
     {key: 'inbox', label: 'Inbox', icon: 'inbox'},
     {key: 'mine', label: 'My feedback', icon: 'send'}
@@ -56,6 +57,8 @@ export const feedbackView = {
             return;
         }
         if (!here()) return;
+        // The cog (1.1.7) - this side's settings, for those who may change them. Never blocks the screen.
+        addSettingsCog($container, kit).catch(() => {});
 
         const load = async (screen, into, ctx) => {
             const mod = await import(`/plugins/feedback/admin/views/${screen}.js?v=${V}`);

package/plugins/feedback/admin/views/inbox.js

@@ -8,7 +8,7 @@
  * Right-click (or the row's kebab, or Shift+F10) for the quick moves.
  */
 
-import {api, esc, openPanel, refreshBadge, stamp, store, when} from '../lib/kit.js';
+import {FILES, api, esc, openPanel, refreshBadge, showFiles, stamp, store, when} from '../lib/kit.js';
 
 const ROW = `
 <div class="fb-row" data-id="{{id}}" tabindex="0" role="button">
@@ -67,7 +67,8 @@ export async function mount(root, ctx) {
                 title: r.title,
                 icon: iconOf(r.type),
                 typeLabel: labelOf(r.type),
-                meta: [r.siteName, r.userName, when(r.createdAt), r.severity === 'blocker' ? 'Blocker' : ''].filter(Boolean).join(' · '),
+                meta: [r.siteName, r.userName, when(r.createdAt), r.severity === 'blocker' ? 'Blocker' : '',
+                    (r.attachments || []).length ? `${r.attachments.length} file${r.attachments.length === 1 ? '' : 's'}` : ''].filter(Boolean).join(' · '),
                 statusLabel: statusOf(r.status),
                 tone: `is-${TONE[r.status] || 'muted'}`,
                 issueKey: r.issueKey || ''
@@ -189,14 +190,17 @@ export async function mount(root, ctx) {
             ...(r.cmsVersion ? [['CMS', r.cmsVersion]] : [])
         ];
         let panel = null;
+        let filesView = null;
         panel = await openPanel({
             title: r.title,
             size: 'lg',
             model: f,
+            cleanup: () => filesView?.dispose(),
             html: `<div class="fb-detail">
   <dl class="fb-facts">${facts.map(([a, b]) => `<div><dt>${esc(a)}</dt><dd>${esc(b)}</dd></div>`).join('')}</dl>
   <h4>What they sent</h4>
   <div class="fb-text">${esc(r.description)}</div>
+  ${(r.attachments || []).length ? `<h4>Files <span data-help="What the sender attached. Click one to open it in a new tab. A file still on its way follows its report within the site's next sync."></span></h4><div class="fb-files-host" data-files></div>` : ''}
 
   <div class="fb-form">
     <label class="form-label" for="fb-status">Status <span data-help="What the site sees. Once a Waypoint issue is linked, the status follows it - except Not planned, which stays until you change it."></span></label>
@@ -272,6 +276,11 @@ export async function mount(root, ctx) {
                 }
             }
         });
+        const host = panel.panel.querySelector('[data-files]');
+        if (host) {
+            host.innerHTML = FILES;
+            filesView = showFiles(host, r.attachments, (a) => api.reportFileUrl(r.id, a.id), 'on its way from the site');
+        }
         // Opening a new report is seeing it.
         if (r.status === 'new') {
             try { const next = await api.update(r.id, {status: 'acknowledged'}); replace(next); f.status.value = next.status; refreshBadge(); }

package/plugins/feedback/admin/views/send.js

@@ -10,7 +10,7 @@
  * the same screen files straight into the inbox: nothing waits, nothing travels.
  */
 
-import {api, esc, openPanel, refreshBadge, stamp, when} from '../lib/kit.js';
+import {FILES, FILE_TYPES, api, esc, fileRow, fileSize, isImage, openPanel, refreshBadge, showFiles, stamp, uploadFile, when} from '../lib/kit.js';
 
 const ROW = `
 <div class="fb-row" data-id="{{key}}" tabindex="0" role="button">
@@ -44,6 +44,7 @@ export async function mount(root, ctx) {
         noReply: 'No reply yet. The status above moves as Domma works on it.'
     };
     const types = meta.types || [];
+    const caps = meta.attachments || {max: 3, maxBytes: 2 * 1024 * 1024};
     const iconOf = (t) => types.find(x => x.key === t)?.icon || 'message-square';
     const labelOf = (t) => types.find(x => x.key === t)?.short || t;
 
@@ -59,7 +60,8 @@ export async function mount(root, ctx) {
             title: r.title,
             icon: iconOf(r.type),
             typeLabel: labelOf(r.type),
-            meta: [when(r.createdAt), r.userName, r.issueKey ? `Tracked as ${r.issueKey}` : ''].filter(Boolean).join(' · '),
+            meta: [when(r.createdAt), r.userName, r.issueKey ? `Tracked as ${r.issueKey}` : '',
+                (r.attachments || []).length ? `${r.attachments.length} file${r.attachments.length === 1 ? '' : 's'}` : ''].filter(Boolean).join(' · '),
             statusLabel: r.statusLabel,
             tone: `is-${TONE[r.status] || 'muted'}`,
             unread: Boolean(r.unread)
@@ -135,11 +137,18 @@ export async function mount(root, ctx) {
             where: M.observable(''), severity: M.observable('minor'), busy: M.observable(false)
         };
         const isBug = M.computed(() => f.type.value === 'bug');
+        // The files picked so far: uploaded as soon as they are chosen, sent by id with the report.
+        const picked = M.observable([]);
+        const room = M.computed(() => picked.value.length < caps.max);
+        const uploading = M.computed(() => picked.value.some(x => x.busy));
+        const localUrls = [];
+        let filesHandle = null;
         let panel = null;
         openPanel({
             title: COPY.title,
             size: 'md',
-            model: {...f, isBug},
+            model: {...f, isBug, room, uploading},
+            cleanup: () => { filesHandle?.dispose(); for (const u of localUrls.splice(0)) URL.revokeObjectURL(u); },
             html: `<div class="fb-form">
   <label class="form-label">What is it?</label>
   <div class="fb-types" role="radiogroup" aria-label="Type">
@@ -157,20 +166,29 @@ export async function mount(root, ctx) {
   </div>
   <label class="form-label" for="fb-where">Where <span data-help="The screen or page it is about, if there is one - e.g. Pages, the Blog editor, /contact. Optional."></span></label>
   <input id="fb-where" class="form-input" maxlength="300" data-model="where.value" placeholder="Optional">
+  <label class="form-label">Screenshots and files <span data-help="${esc(`Up to ${caps.max} files of ${fileSize(caps.maxBytes)} each: PNG, JPEG, GIF or WebP images, a PDF or a text file. A screenshot of what went wrong helps most. They are seen only by the Domma team.`)}"></span></label>
+  <div class="fb-files-host" data-files></div>
+  <div class="fb-attach" data-bind-hidden="!room.value">
+    <button type="button" class="btn btn-sm btn-outline" data-on-click="pickFiles"><span data-icon="paperclip" data-icon-size="13"></span> Attach a file</button>
+    <span class="fb-hint">Or paste a screenshot into the description.</span>
+    <input type="file" class="fb-file-input" accept="${FILE_TYPES}" multiple hidden>
+  </div>
   <p class="fb-hint">${esc(COPY.hint)}</p>
   <div class="fb-actions"><span class="fb-spacer"></span>
     <button type="button" class="btn btn-sm btn-ghost" data-on-click="cancel">Cancel</button>
-    <button type="button" class="btn btn-sm btn-primary" data-on-click="send" data-bind-disabled="busy.value"><span data-icon="send" data-icon-size="13"></span> Send</button>
+    <button type="button" class="btn btn-sm btn-primary" data-on-click="send" data-bind-disabled="busy.value || uploading.value"><span data-icon="send" data-icon-size="13"></span> Send</button>
   </div>
 </div>`,
             methods: {
                 cancel: () => panel?.close(),
+                pickFiles: () => panel?.panel.querySelector('.fb-file-input')?.click(),
                 async send() {
-                    if (f.busy.peek()) return;
+                    if (f.busy.peek() || uploading.peek()) return;
                     f.busy.value = true;
                     try {
                         const r = await api.send({type: f.type.peek(), title: f.title.peek(), description: f.description.peek(),
-                            where: f.where.peek(), severity: f.type.peek() === 'bug' ? f.severity.peek() : ''});
+                            where: f.where.peek(), severity: f.type.peek() === 'bug' ? f.severity.peek() : '',
+                            attachments: picked.peek().filter(x => x.id && !x.busy).map(x => ({id: x.id, name: x.name, type: x.type, size: x.size}))});
                         E.toast(r.message || 'Sent.', {type: r.state === 'sent' ? 'success' : 'warning'});
                         panel?.close();
                         refreshBadge();
@@ -188,6 +206,45 @@ export async function mount(root, ctx) {
                 const b = e.target.closest('[data-type]');
                 if (b) f.type.value = b.dataset.type;
             });
+            // The file list is bound on its own, after the panel: the panel's model has no `files`.
+            const host = p.panel.querySelector('[data-files]');
+            host.innerHTML = FILES;
+            const files = M.computed(() => picked.value.map(x => fileRow(x, {key: x.key, thumb: x.thumb, removable: !x.busy,
+                meta: x.busy ? 'Uploading...' : fileSize(x.size), title: x.name})));
+            const bound = M.applyBindings({files}, host);
+            filesHandle = {dispose: () => { bound.dispose(); files.dispose?.(); }};
+            host.addEventListener('click', (e) => {
+                const x = e.target.closest('.fb-file-x');
+                if (x) picked.value = picked.peek().filter(r => r.key !== x.closest('.fb-file').dataset.key);
+            });
+            const add = async (list) => {
+                for (const file of list) {
+                    if (picked.peek().length >= caps.max) { E.toast(`Up to ${caps.max} files.`, {type: 'warning'}); break; }
+                    if (file.size > caps.maxBytes) { E.toast(`${esc(file.name)} is too big - up to ${fileSize(caps.maxBytes)} each.`, {type: 'warning'}); continue; }
+                    if (!FILE_TYPES.split(',').includes(file.type)) { E.toast(`${esc(file.name)} cannot be attached - images, PDF or text only.`, {type: 'warning'}); continue; }
+                    const key = `k${Date.now()}${Math.random().toString(16).slice(2)}`;
+                    let thumb = '';
+                    if (isImage(file.type)) { thumb = URL.createObjectURL(file); localUrls.push(thumb); }
+                    picked.value = [...picked.peek(), {key, name: file.name || 'screenshot.png', type: file.type, size: file.size, thumb, busy: true}];
+                    try {
+                        const a = await uploadFile(file);
+                        picked.value = picked.peek().map(r => (r.key === key ? {...r, ...a, key, busy: false} : r));
+                    } catch (err) {
+                        picked.value = picked.peek().filter(r => r.key !== key);
+                        E.toast(esc(err.message || String(err)), {type: 'error'});
+                    }
+                }
+            };
+            const input = p.panel.querySelector('.fb-file-input');
+            input.addEventListener('change', () => { const list = [...input.files]; input.value = ''; add(list); });
+            // A screenshot pasted into the description is the quickest way there is.
+            p.panel.querySelector('#fb-desc')?.addEventListener('paste', (e) => {
+                const list = [...(e.clipboardData?.files || [])];
+                if (!list.length) return;
+                e.preventDefault();
+                add(list.map(file => (file.name && file.name !== 'image.png' ? file
+                    : new File([file], `screenshot-${new Date().toISOString().slice(0, 19).replace(/[:T]/g, '-')}.png`, {type: file.type}))));
+            });
             p.panel.querySelector('#fb-title')?.focus();
         });
     }
@@ -204,16 +261,26 @@ export async function mount(root, ctx) {
             ...(r.issueKey ? [['Tracked as', `${r.issueKey}${r.issueStatus ? ` (${r.issueStatus})` : ''}`]] : []),
             ...(r.lastError ? [['Last try', r.lastError]] : [])
         ];
-        await openPanel({
+        let filesView = null;
+        const p = await openPanel({
             title: r.title,
             size: 'md',
+            cleanup: () => filesView?.dispose(),
             html: `<div class="fb-detail">
   <dl class="fb-facts">${lines.map(([a, b]) => `<div><dt>${esc(a)}</dt><dd>${esc(b)}</dd></div>`).join('')}</dl>
   <h4>What was sent</h4>
   <div class="fb-text">${esc(r.description)}</div>
+  ${(r.attachments || []).length ? '<h4>Files</h4><div class="fb-files-host" data-files></div>' : ''}
   ${r.reply ? `<h4><span data-icon="corner-up-left" data-icon-size="14"></span> ${esc(COPY.replied)} <small>${esc(stamp(r.replyAt))}</small></h4><div class="fb-text fb-reply">${esc(r.reply)}</div>` : `<p class="fb-note">${esc(COPY.noReply)}</p>`}
 </div>`
         });
+        const host = p.panel.querySelector('[data-files]');
+        if (host) {
+            host.innerHTML = FILES;
+            // This site kept its own copy of every file it sent, so they open from here even while
+            // Domma's copy is still on its way. The manager's own reports read theirs in place.
+            filesView = showFiles(host, (r.attachments || []).map(a => ({...a, stored: true})), (a) => api.ownFileUrl(a.id));
+        }
         if (r.unread && r.id) {
             try {
                 await api.seen(r.id, r.replyAt);

package/plugins/feedback/docs/guide.md

@@ -20,7 +20,8 @@ Feedback lets you tell Domma what is broken, missing or good, straight from your
 4. Type a **Title** (one line) and a **Description**.
 5. For something broken, choose **How bad is it?**: Minor - a nuisance, Major - gets in the way, or Blocker - cannot carry on.
 6. Optional: fill in **Where** - the screen or page it is about, for example "Pages" or `/contact`.
-7. Click **Send**.
+7. Optional: click **Attach a file**, or paste a screenshot straight into the description. Up to 3 files of 2 MB each: PNG, JPEG, GIF or WebP images, a PDF or a text file.
+8. Click **Send**.
 
 A good bug report says what you did, what you expected and what happened instead. For a request, say what you are trying to get done.
 
@@ -41,7 +42,9 @@ Each row shows the type, title, when it was sent and by whom, and a status:
 | Waiting to send | Domma could not be reached yet; it goes automatically |
 | Not accepted | Domma's server turned the report down |
 
-A dot on a row means a new reply. Click a row to open it: you see the details, **What was sent**, and **Domma replied** with the reply, or "No reply yet".
+A dot on a row means a new reply. Click a row to open it: you see the details, **What was sent**, any **Files** you attached (click one to open it), and **Domma replied** with the reply, or "No reply yet".
+
+Attached files go to Domma straight after the report. Only the Domma team sees them - they are never put in your Media library or on your website.
 
 If "Tracked as" appears, Domma has filed the report in its own issue tracker, and the status follows that issue.
 
@@ -53,11 +56,7 @@ If the screen says "This site is not connected to Domma", your site was not star
 
 ## Settings
 
-There is no settings screen. Whoever runs the site can change one option in the plugin's configuration file:
-
-| Option | Default | Meaning |
-|---|---|---|
-| `syncMinutes` | 60 | How often the site sends waiting reports and checks for replies |
+Administrators see a **Feedback settings** cog in the banner. It has one setting, **Check for replies every (minutes)** - how often the site sends anything still waiting and looks for Domma's replies in the background (default 60, from 5 to 1440). A change takes effect at once, no restart.
 
 Opening the Feedback screen also sends anything waiting and checks for replies straight away.
 
@@ -81,15 +80,16 @@ Only the **admin** role has them by default. Everyone with **Send** sees every r
 On the Domma server itself (the Manager), the same screen is the **Inbox** of every site's reports, for holders of **Feedback > Manage**:
 
 - Filter by **Open**, each status, or **All**; by site and type; and search title, text, person and site.
-- Open a report to set its **Status**, write a **Reply to the site** (the site sees it and is notified) and keep **Internal notes** (never sent to the site). Click **Save**.
+- Open a report to see any **Files** the site attached (a file still on its way says so), set its **Status**, write a **Reply to the site** (the site sees it and is notified) and keep **Internal notes** (never sent to the site). Click **Save**.
 - With Waypoint Pro installed, **Make a Waypoint issue** files the report in a project with a type and priority. The report then follows the issue: planned, in progress, done. "Not planned" set by hand stays until you change it.
 - Right-click a row to open it, change its status quickly, or **Delete** it. Deleting removes it for the site too.
 - Holders of the most senior role also get **My feedback**, to file their own reports. These appear in the Inbox as "Manager (this server)".
+- The **Feedback settings** cog sets how many reports one site may send in a window (default 10 in 10 minutes); more are turned away for now and the site sends them later. Changes apply to the next report.
 
 ## Limitations
 
 - Only sites started by a Domma server can send. A standalone install cannot.
-- No attachments or screenshots. Describe the problem in words, and use **Where** for the page.
+- Up to 3 files per report, 2 MB each, and only images (PNG, JPEG, GIF, WebP), PDFs and text files.
 - Titles are limited to 140 characters and descriptions to 8,000.
 - The Domma server accepts up to 10 reports from one site in 10 minutes. Any more show as **Waiting to send** and go later.
 - You cannot edit or withdraw a report once sent. Send a follow-up instead.

package/plugins/feedback/lib/attachments.js

@@ -0,0 +1,133 @@
+/**
+ * Feedback - attachments on disk, and reading one out of an upload.
+ *
+ * A site keeps the files it attached under data/attachments/<id>.<ext> (with a
+ * <id>.json beside each saying what it is); the manager keeps a report's files
+ * under data/attachments/<report entry id>/. Files are 0600 in 0700 folders:
+ * they are screenshots of admin screens, nothing a web server should ever list.
+ * Nothing here is served from a public path - a route reads and sends them.
+ *
+ * @module feedback/lib/attachments
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import {ATTACHMENTS, ATTACHMENT_TYPES, cleanAttachment, extOf} from './shape.js';
+
+/** A folder name that is safe to join: a collection entry id, or our own staging name. */
+const SUB_RE = /^[A-Za-z0-9_-]{1,80}$/;
+
+/**
+ * Read ONE file out of a multipart request, within the caps. The whole file is
+ * held in memory - it is at most ATTACHMENTS.maxBytes.
+ *
+ * @returns {Promise<{file?: {name: string, type: string, size: number, buffer: Buffer}, error?: string, code?: number}>}
+ */
+export async function readUpload(request) {
+    if (typeof request.isMultipart !== 'function' || !request.isMultipart()) return {error: 'Send the file as a form upload.', code: 400};
+    let part;
+    try { part = await request.file(); } catch (err) { return {error: `That upload could not be read: ${err.message}`, code: 400}; }
+    if (!part) return {error: 'No file was sent.', code: 400};
+    const type = String(part.mimetype || '').toLowerCase().split(';')[0].trim();
+    const drain = async () => { for await (const _ of part.file) { /* a refused part must still be consumed */ } };
+    if (!ATTACHMENT_TYPES[type]) {
+        await drain();
+        return {error: `That kind of file (${type || 'unknown'}) cannot be attached. Attach a PNG, JPEG, GIF or WebP image, a PDF or a text file.`, code: 400};
+    }
+    const chunks = [];
+    let size = 0;
+    let over = false;
+    for await (const chunk of part.file) {
+        size += chunk.length;
+        // Keep reading so the request completes, but keep nothing more.
+        if (size > ATTACHMENTS.maxBytes) { over = true; continue; }
+        chunks.push(chunk);
+    }
+    if (over || part.file.truncated) return {error: `That file is too big - up to ${Math.round(ATTACHMENTS.maxBytes / 1024 / 1024)} MB each.`, code: 413};
+    if (!size) return {error: 'That file is empty.', code: 400};
+    return {file: {name: part.filename, type, size, buffer: Buffer.concat(chunks)}};
+}
+
+/**
+ * Send a stored file: its own type, shown inline, never sniffed into anything else.
+ * Private cache only - it needs the session that fetched it.
+ */
+export function sendFile(reply, a, buffer) {
+    return reply
+        .type(a.type)
+        .header('content-disposition', `inline; filename="${a.name.replace(/["\\]/g, '_')}"`)
+        .header('x-content-type-options', 'nosniff')
+        .header('cache-control', 'private, max-age=300')
+        .send(buffer);
+}
+
+/**
+ * The files under one root. Every path is built from a cleaned attachment and a
+ * checked sub-folder name - nothing from a request reaches `path.join` raw.
+ *
+ * @param {string} root - e.g. <plugin data dir>/attachments
+ */
+export function createStore(root) {
+    const dirOf = (sub) => {
+        if (sub && !SUB_RE.test(sub)) throw new Error('bad attachment folder');
+        return sub ? path.join(root, sub) : root;
+    };
+    const ensure = (sub) => fs.mkdirSync(dirOf(sub), {recursive: true, mode: 0o700});
+    const clean = (a) => { const c = cleanAttachment(a); if (!c) throw new Error('bad attachment'); return c; };
+    const fileOf = (sub, a) => path.join(dirOf(sub), `${a.id}.${extOf(a.type)}`);
+    const metaOf = (sub, id) => path.join(dirOf(sub), `${id}.json`);
+    return {
+        root,
+        /** Keep a file and what it is. */
+        save(att, buffer, sub = '') {
+            const a = clean(att);
+            ensure(sub);
+            fs.writeFileSync(fileOf(sub, a), buffer, {mode: 0o600});
+            fs.writeFileSync(metaOf(sub, a.id), JSON.stringify({id: a.id, name: a.name, type: a.type, size: a.size, at: new Date().toISOString()}), {mode: 0o600});
+            return a;
+        },
+        /** What a kept file is, from its sidecar - null when unknown. */
+        meta(id, sub = '') {
+            if (!/^[A-Za-z0-9-]{8,64}$/.test(String(id))) return null;
+            try { return cleanAttachment(JSON.parse(fs.readFileSync(metaOf(sub, id), 'utf8'))); } catch { return null; }
+        },
+        /** The bytes, or null. */
+        read(att, sub = '') {
+            try { return fs.readFileSync(fileOf(sub, clean(att))); } catch { return null; }
+        },
+        /** A staged file becomes a report's (the manager's own feedback). */
+        move(att, from, to) {
+            const a = clean(att);
+            ensure(to);
+            fs.renameSync(fileOf(from, a), fileOf(to, a));
+            try { fs.unlinkSync(metaOf(from, a.id)); } catch { /* no sidecar */ }
+        },
+        /** A report went: so do its files. */
+        removeAll(sub) {
+            if (!sub) return;
+            try { fs.rmSync(dirOf(sub), {recursive: true, force: true}); } catch { /* already gone */ }
+        },
+        /**
+         * Files picked but never sent (the panel was closed) are dropped once they are older
+         * than `maxAgeMs` and no outbox item names them.
+         */
+        prune({maxAgeMs = 24 * 3600_000, keep = new Set(), sub = ''} = {}) {
+            let dir;
+            try { dir = fs.readdirSync(dirOf(sub)); } catch { return 0; }
+            let dropped = 0;
+            const cutoff = Date.now() - maxAgeMs;
+            for (const f of dir) {
+                const m = f.match(/^([A-Za-z0-9-]{8,64})\.json$/);
+                if (!m || keep.has(m[1])) continue;
+                const a = this.meta(m[1], sub);
+                const at = new Date(a?.at || 0).getTime();
+                let stat;
+                try { stat = fs.statSync(metaOf(sub, m[1])); } catch { continue; }
+                if (Math.max(at || 0, stat.mtimeMs) > cutoff) continue;
+                try { if (a) fs.unlinkSync(fileOf(sub, a)); } catch { /* gone */ }
+                try { fs.unlinkSync(metaOf(sub, m[1])); } catch { /* gone */ }
+                dropped++;
+            }
+            return dropped;
+        }
+    };
+}

package/plugins/feedback/lib/cache.js

@@ -0,0 +1,43 @@
+/**
+ * A short memory for whole-collection reads.
+ *
+ * On the manager, the badge (polled once a minute from every open admin tab
+ * with `manage`), every site's hourly `/fleet/mine` and the dedupe in
+ * `receive()` each read EVERY report. The data changes only when someone
+ * writes, so a read is kept for a little while and every write in
+ * lib/receiver.js throws the memory away (`forget()`, right after the write,
+ * so the writer's next read is fresh). The TTL is the safety net for writes
+ * this plugin never sees (the Collections tool).
+ *
+ * PURE - no I/O of its own; the loader is handed in. Tested in tests/cache.test.js.
+ *
+ * @module feedback/lib/cache
+ */
+
+export const CACHE_MS = 30_000;
+
+/**
+ * @param {{ttl?: number, clock?: () => number}} [opts]
+ * @returns {{get: (key: string, load: () => Promise<any>) => Promise<any>, forget: () => void, size: number}}
+ */
+export function createCache({ttl = CACHE_MS, clock = Date.now} = {}) {
+    // key -> {at, value: Promise}. The PROMISE is kept, not the result, so
+    // concurrent misses share one read, and a write landing while a read is in
+    // flight clears the map before that read can be stored - nothing stale
+    // survives a forget().
+    const kept = new Map();
+    return {
+        get(key, load) {
+            const hit = kept.get(key);
+            if (hit && clock() - hit.at < ttl) return hit.value;
+            const value = Promise.resolve().then(load);
+            const entry = {at: clock(), value};
+            kept.set(key, entry);
+            // A failed read is not remembered: the next caller tries again.
+            value.catch(() => { if (kept.get(key) === entry) kept.delete(key); });
+            return value;
+        },
+        forget() { kept.clear(); },
+        get size() { return kept.size; }
+    };
+}

package/plugins/feedback/lib/receiver.js

@@ -17,6 +17,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {fileURLToPath} from 'node:url';
 import {createCollection, createEntry, deleteEntry, getCollection, getEntry, listEntries, updateEntry} from '../../../server/services/collections.js';
+import {createCache} from './cache.js';
 import {receivedReport, statusFromIssue, statusLabel} from './shape.js';
 
 export const COLLECTION = 'feedback-reports';
@@ -59,14 +60,25 @@ export async function ensureCollection() {
     return true;
 }
 
-/** Every report, newest first. */
-export async function allReports() {
-    const {entries} = await listEntries(COLLECTION, {limit: 100000, sort: 'createdAt', order: 'desc'});
-    return entries || [];
+// The whole-collection read, kept a short while (lib/cache.js). Every write
+// below calls forget() so the writer's own next read - and the badge - is fresh.
+const remembered = createCache();
+export const forget = () => remembered.forget();
+
+/** Every report, newest first - the SAME array to every caller inside the cache window: filter, never change it. */
+export function allReports() {
+    return remembered.get('reports', async () => {
+        const {entries} = await listEntries(COLLECTION, {limit: 100000, sort: 'createdAt', order: 'desc'});
+        return entries || [];
+    });
 }
 
 export const getReport = (id) => getEntry(COLLECTION, id);
-export const removeReport = (id) => deleteEntry(COLLECTION, id);
+export async function removeReport(id) {
+    const r = await deleteEntry(COLLECTION, id);
+    forget();
+    return r;
+}
 
 /**
  * A site's report arrived. The same site sending the same `ref` again (a retry
@@ -86,6 +98,7 @@ export async function receive(slug, payload, source = 'fleet') {
     }
     data.history = [{at: new Date().toISOString(), by: data.userName, what: 'Sent'}];
     const entry = await createEntry(COLLECTION, data, {source});
+    forget();
     return {entry, created: true};
 }
 
@@ -112,7 +125,24 @@ export async function applyPatch(id, patch, by) {
     if (patch.reply !== undefined) { d.replyAt = patch.reply ? now : ''; history.push({at: now, by, what: patch.reply ? 'Replied' : 'Reply removed'}); }
     if (patch.issueKey !== undefined && patch.issueKey !== d.issueKey) history.push({at: now, by, what: `Waypoint ${patch.issueKey}`});
     Object.assign(d, patch, {history: history.slice(-100)});
-    return updateEntry(COLLECTION, id, d);
+    const next = await updateEntry(COLLECTION, id, d);
+    forget();
+    return next;
+}
+
+/**
+ * A file announced by a report has arrived: mark it stored. Touches nothing else
+ * on the record, so it adds no history line.
+ *
+ * @returns {Promise<object|null>} the updated entry
+ */
+export async function markStored(id, attId) {
+    const e = await getReport(id);
+    if (!e) return null;
+    const attachments = (e.data.attachments || []).map(a => (a.id === attId ? {...a, stored: true} : a));
+    const next = await updateEntry(COLLECTION, id, {...e.data, attachments});
+    forget();
+    return next;
 }
 
 /**