domma-cms 1.6.37 → 1.6.39

package/plugins/feedback/lib/sender.js

@@ -69,10 +69,29 @@ export function createOutbox(dataDir, name = 'outbox.json') {
             const s = read();
             s.seen[id] = replyAt;
             write(s);
+        },
+        /**
+         * The manager's full list of this site's reports: a SENT report it no longer has was deleted there,
+         * so this site forgets it too - its copy of the text, and (on the next prune) its files.
+         * @returns {number} how many were forgotten
+         */
+        forgetDropped(remote) {
+            if (!Array.isArray(remote)) return 0;
+            const s = read();
+            const keep = s.items.filter(i => !droppedByManager(i, remote));
+            const gone = s.items.length - keep.length;
+            if (gone) { s.items = keep; write(s); }
+            return gone;
         }
     };
 }
 
+/** A sent report the manager's list (complete, for this site) no longer holds - deleted there. PURE. */
+export function droppedByManager(item, remote) {
+    if (item?.state !== 'sent' || !Array.isArray(remote)) return false;
+    return !remote.some(r => r.ref === item.ref);
+}
+
 export const newRef = () => randomUUID();
 
 /**
@@ -99,20 +118,81 @@ export function managerApi(manager, fetchImpl = globalThis.fetch) {
             return {ok: false, error: `Could not reach the Domma server: ${err.message}`};
         }
     };
+    /** One attached file's bytes, after its report: raw, so the JSON route's 32 KB limit never applies to them. */
+    const attach = async (reportId, attId, buffer) => {
+        try {
+            const res = await fetchImpl(`${manager.url}/api/plugins/feedback/fleet/attach/${encodeURIComponent(reportId)}/${encodeURIComponent(attId)}`, {
+                method: 'POST',
+                headers: {authorization: `Bearer ${manager.token}`, 'content-type': 'application/octet-stream'},
+                body: buffer,
+                signal: AbortSignal.timeout(30_000)
+            });
+            let json = null;
+            try { json = await res.json(); } catch { /* not JSON */ }
+            if (res.status >= 200 && res.status < 300) return {ok: true, status: res.status, body: json};
+            return {ok: false, status: res.status, error: json?.error || `The Domma server answered ${res.status}.`};
+        } catch (err) {
+            return {ok: false, error: `Could not reach the Domma server: ${err.message}`};
+        }
+    };
     return {
         submit: (payload) => call('POST', 'submit', payload),
-        mine: () => call('GET', 'mine')
+        mine: () => call('GET', 'mine'),
+        attach
     };
 }
 
+/** Statuses that mean "try again later"; any other 4xx means the manager will never take it. */
+const RETRY = new Set([401, 408, 429]);
+
+/**
+ * The files of reports that have arrived but whose files have not all followed.
+ * A file the manager refuses for good (400/404/413) is not tried again; a file
+ * this site no longer has is given up on too - the report itself is there.
+ */
+async function sendFiles(outbox, api, files) {
+    let error = '';
+    for (const item of outbox.all().filter(i => i.state === 'sent' && i.remoteId && (i.payload?.attachments || []).length)) {
+        const done = new Set([...(item.filesSent || []), ...(item.filesRefused || [])]);
+        for (const a of item.payload.attachments.filter(x => !done.has(x.id))) {
+            const buffer = files?.read(a);
+            if (!buffer) {
+                item.filesRefused = [...(item.filesRefused || []), a.id];
+                outbox.mark(item.ref, {filesRefused: item.filesRefused});
+                continue;
+            }
+            const r = await api.attach(item.remoteId, a.id, buffer);
+            if (r.ok) {
+                item.filesSent = [...(item.filesSent || []), a.id];
+                outbox.mark(item.ref, {filesSent: item.filesSent});
+            } else {
+                error = r.error || 'A file was not sent.';
+                if (r.status >= 400 && r.status < 500 && !RETRY.has(r.status)) {
+                    item.filesRefused = [...(item.filesRefused || []), a.id];
+                    outbox.mark(item.ref, {filesRefused: item.filesRefused});
+                }
+            }
+        }
+    }
+    return error;
+}
+
 /**
- * Send whatever is waiting. A report the manager already has (a retry after a
- * timeout that did arrive) comes back with the same id, so this is safe to
- * repeat.
+ * Send whatever is waiting, then any attached files whose report has arrived.
+ * A report the manager already has (a retry after a timeout that did arrive)
+ * comes back with the same id, and a file it already has answers 200, so this
+ * is safe to repeat.
  *
  * @returns {Promise<{sent: number, waiting: number, error: string}>}
  */
-export async function flush(outbox, api) {
+export function flush(outbox, api, files = null) {
+    // One flush at a time per outbox (as Support's): the timer, /sent and /send can all ask at
+    // once, and two flushes would POST the same waiting report - and its files - twice.
+    if (!outbox.flushing) outbox.flushing = flushOnce(outbox, api, files).finally(() => { outbox.flushing = null; });
+    return outbox.flushing;
+}
+
+async function flushOnce(outbox, api, files) {
     let sent = 0;
     let error = '';
     for (const item of outbox.all().filter(i => i.state === 'waiting')) {
@@ -127,7 +207,9 @@ export async function flush(outbox, api) {
             if (r.status === 400) outbox.mark(item.ref, {state: 'refused'});
         }
     }
-    return {sent, waiting: outbox.all().filter(i => i.state === 'waiting').length, error};
+    // Then the files, each on its own request once its report has an id on the manager.
+    const fileError = api.attach ? await sendFiles(outbox, api, files) : '';
+    return {sent, waiting: outbox.all().filter(i => i.state === 'waiting').length, error: error || fileError};
 }
 
 /**
@@ -152,6 +234,7 @@ export function mergeReports(outboxItems, remote, seen = {}) {
         const p = i.payload || {};
         out.push({
             id: '', ref: i.ref, type: p.type, title: p.title, description: p.description, where: p.where || '', severity: p.severity || '',
+            attachments: (p.attachments || []).map(a => ({...a, stored: false})),
             userName: p.user?.name || '', status: i.state === 'refused' ? 'refused' : 'waiting',
             statusLabel: i.state === 'refused' ? 'Not accepted' : 'Waiting to send',
             reply: '', replyAt: '', issueKey: '', issueStatus: '', createdAt: i.createdAt, updatedAt: i.createdAt,

package/plugins/feedback/lib/shape.js

@@ -43,7 +43,69 @@ export const typeLabel = (key) => TYPES.find(t => t.key === key)?.short ?? key;
 /** Longest a field may be. The route's bodyLimit (32 KB) is the outer wall. */
 export const LIMITS = {title: 140, description: 8000, where: 300, reply: 8000, notes: 8000};
 
-const text = (v, max) => String(v ?? '').replace(/\u0000/g, '').replace(/\r\n?/g, '\n').trim().slice(0, max);
+// Control characters go (all but tab and newline): each is 6 bytes once JSON-escaped, so 8000 of them
+// would pass here and then be refused by the manager's 32 KB body limit, forever.
+const text = (v, max) => String(v ?? '').replace(/\r\n?/g, '\n').replace(/[\u0000-\u0008\u000B-\u001F\u007F]/g, '').trim().slice(0, max);
+
+// ---------------------------------------------------------------------------------
+// Attachments: a screenshot is worth most of a bug report
+// ---------------------------------------------------------------------------------
+
+/** How many files a report may carry and how big each may be. The files travel one per request, after the report. */
+export const ATTACHMENTS = {max: 3, maxBytes: 2 * 1024 * 1024};
+
+/** What may be attached: mime -> the extension the file is kept under. No SVG or HTML - they can carry scripts. */
+export const ATTACHMENT_TYPES = {
+    'image/png': 'png', 'image/jpeg': 'jpg', 'image/gif': 'gif', 'image/webp': 'webp', 'application/pdf': 'pdf', 'text/plain': 'txt'
+};
+
+/** Ids are made by the server (randomUUID) and become file names, so nothing else gets through. */
+const ATTACHMENT_ID = /^[A-Za-z0-9-]{8,64}$/;
+
+export const extOf = (type) => ATTACHMENT_TYPES[String(type || '').toLowerCase()] || 'bin';
+
+/**
+ * A file name fit to show and to put in a Content-Disposition header: the last path
+ * segment, odd characters replaced, never empty.
+ */
+export function safeFileName(name, ext = 'bin') {
+    const base = String(name ?? '').split(/[\\/]/).pop().replace(/[^A-Za-z0-9._ -]/g, '_').replace(/^[. ]+/, '').trim().slice(0, 120);
+    return base || `file.${ext}`;
+}
+
+/**
+ * One attachment's description, cleaned - or null when it is not one we take.
+ * The bytes are checked against `size` when they arrive.
+ *
+ * @param   {object} a - {id, name, type, size}
+ * @returns {{id: string, name: string, type: string, size: number}|null}
+ */
+export function cleanAttachment(a = {}) {
+    if (!a || typeof a !== 'object') return null;
+    const type = String(a.type || '').toLowerCase().split(';')[0].trim();
+    const id = String(a.id || '');
+    const size = Number(a.size);
+    if (!ATTACHMENT_TYPES[type] || !ATTACHMENT_ID.test(id) || !Number.isInteger(size) || size < 1 || size > ATTACHMENTS.maxBytes) return null;
+    return {id, name: safeFileName(a.name, ATTACHMENT_TYPES[type]), type, size};
+}
+
+/** A list of them: the bad ones dropped, duplicates once, at most ATTACHMENTS.max. */
+export function cleanAttachments(list) {
+    if (!Array.isArray(list)) return [];
+    const out = [];
+    const seen = new Set();
+    for (const a of list) {
+        const c = cleanAttachment(a);
+        if (!c || seen.has(c.id)) continue;
+        seen.add(c.id);
+        out.push(c);
+        if (out.length >= ATTACHMENTS.max) break;
+    }
+    return out;
+}
+
+/** The sender-safe view of a stored attachment: what it is and whether the manager has the bytes yet. */
+export const attachmentView = (a) => ({id: a.id, name: a.name, type: a.type, size: a.size, stored: Boolean(a.stored)});
 
 /**
  * What a site admin typed, cleaned. Never carries who sent it - that comes
@@ -59,7 +121,8 @@ export function cleanSubmission(body = {}) {
     if (!title) return {error: 'Give it a short title.'};
     if (!description) return {error: 'Say a little more in the description.'};
     const severity = type === 'bug' && SEVERITY_KEYS.includes(body.severity) ? body.severity : '';
-    return {report: {type, title, description, where: text(body.where, LIMITS.where), severity}};
+    // Descriptions of files, not the files: those follow one per request once the report is in.
+    return {report: {type, title, description, where: text(body.where, LIMITS.where), severity, attachments: cleanAttachments(body.attachments)}};
 }
 
 /**
@@ -96,6 +159,8 @@ export function receivedReport(payload = {}, slug) {
     return {
         data: {
             ...report,
+            // Announced by the report; `stored` turns true as each file arrives (/fleet/attach).
+            attachments: report.attachments.map(a => ({...a, stored: false})),
             site: slug,
             ref: text(payload.ref, 64),
             cmsVersion: text(payload.cmsVersion, 20),
@@ -131,6 +196,7 @@ export function senderView(entry) {
         description: d.description,
         where: d.where || '',
         severity: d.severity || '',
+        attachments: (d.attachments || []).map(attachmentView),
         userName: d.userName || '',
         status: d.status,
         statusLabel: statusLabel(d.status),
@@ -181,20 +247,57 @@ export function cleanUpdate(body = {}, current = {}) {
  * limiter exempts loopback, which is where every site calls from, so this is
  * the only brake.
  *
+ * The limits may also come with each call (`limits`), so a setting changed in
+ * the cog applies to the next request rather than the next restart.
+ *
  * @param   {{max?: number, windowMs?: number}} [opts]
- * @returns {(key: string, now?: number) => boolean} true when allowed
+ * @returns {(key: string, now?: number, limits?: {max?: number, windowMs?: number}) => boolean} true when allowed
  */
 export function createThrottle({max = 10, windowMs = 10 * 60_000} = {}) {
     const seen = new Map();
-    return (key, now = Date.now()) => {
-        const recent = (seen.get(key) || []).filter(t => now - t < windowMs);
-        if (recent.length >= max) { seen.set(key, recent); return false; }
+    return (key, now = Date.now(), limits = {}) => {
+        const cap = Number(limits.max) > 0 ? Number(limits.max) : max;
+        const window = Number(limits.windowMs) > 0 ? Number(limits.windowMs) : windowMs;
+        const recent = (seen.get(key) || []).filter(t => now - t < window);
+        if (recent.length >= cap) { seen.set(key, recent); return false; }
         recent.push(now);
         seen.set(key, recent);
         return true;
     };
 }
 
+/**
+ * The settings each side owns, with the whole-number range each may take.
+ * `fallback` repeats config.js so this stays pure (no import of the defaults).
+ */
+export const SETTING_RULES = {
+    syncMinutes: {min: 5, max: 1440, fallback: 60},
+    perSiteMax: {min: 1, max: 1000, fallback: 10},
+    perSiteMinutes: {min: 1, max: 1440, fallback: 10}
+};
+export const SIDE_SETTINGS = {sender: ['syncMinutes'], receiver: ['perSiteMax', 'perSiteMinutes']};
+
+/**
+ * One side's settings from whatever was saved (or sent): only that side's keys,
+ * each a whole number in range, else what is current, else the default.
+ *
+ * @param   {object} raw                 what the cog sent, or the merged config
+ * @param   {object} [current]           the settings as they stand
+ * @param   {'sender'|'receiver'} [side]
+ * @returns {object}
+ */
+export function cleanSettings(raw, current = {}, side = 'sender') {
+    const r = raw && typeof raw === 'object' ? raw : {};
+    const cur = current && typeof current === 'object' ? current : {};
+    const out = {};
+    for (const k of SIDE_SETTINGS[side] || []) {
+        const rule = SETTING_RULES[k];
+        const pick = (v) => { const n = Number(v); return v !== '' && v != null && Number.isInteger(n) && n >= rule.min && n <= rule.max ? n : null; };
+        out[k] = pick(r[k]) ?? pick(cur[k]) ?? rule.fallback;
+    }
+    return out;
+}
+
 /**
  * The description a Waypoint issue gets from a report: the words, then where
  * they came from.
@@ -207,5 +310,7 @@ export function issueDescription(d = {}) {
     if (d.cmsVersion) lines.push(`Domma CMS ${d.cmsVersion}`);
     if (d.where) lines.push(`Where: ${d.where}`);
     if (d.severity) lines.push(`Severity: ${d.severity}`);
+    const files = (d.attachments || []).map(a => a.name);
+    if (files.length) lines.push(`Attachments (in the Feedback inbox): ${files.join(', ')}`);
     return lines.join('\n');
 }

package/plugins/feedback/plugin.js

@@ -10,30 +10,37 @@
  *     GET  /sent                  this site's reports (sends any waiting first)
  *     POST /send                  a new report: kept here, then sent
  *     PUT  /sent/:id/seen         a reply has been read
+ *     POST /attachments           a file for the report being written (multipart, kept here)
+ *     GET  /attachments/:id       one of this site's attached files
  *
  *   receiver (the manager - Site Manager is installed beside it)
  *     POST /fleet/submit          a site's report (Bearer fleet token)
+ *     POST /fleet/attach/:id/:att one of its announced files, raw bytes (Bearer fleet token)
  *     GET  /fleet/mine            that site's reports, sender-safe fields only
  *     GET  /mode · GET /count     'new' reports
  *     POST /send · GET /sent · PUT /sent/:id/seen
  *                                 the manager's OWN feedback (level-0 role only):
  *                                 written straight into the inbox as site `_manager`
  *     GET  /reports · GET /reports/:id · PUT /reports/:id · DELETE /reports/:id
+ *     GET  /reports/:id/attachments/:att   a report's file
  *     GET  /waypoint              is Waypoint Pro here, and its projects
  *     POST /reports/:id/promote   make a Waypoint issue from a report
  *
  * Nothing the browser sends says who sent a report or which site it came from:
  * the user is the session's, the site is the one the fleet token names.
  */
+import {randomUUID} from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import {fileURLToPath} from 'node:url';
 import defaults from './config.js';
 import {
-    SEVERITIES, STATUSES, TYPES, buildPayload, cleanSubmission, cleanUpdate, createThrottle, issueDescription, senderView
+    ATTACHMENTS, SEVERITIES, STATUSES, TYPES, buildPayload, cleanAttachment, cleanSubmission, cleanUpdate, cleanSettings, createThrottle, issueDescription, senderView
 } from './lib/shape.js';
+import {createStore, readUpload, sendFile} from './lib/attachments.js';
 import {createOutbox, flush, managerApi, managerOf, mergeReports, newRef} from './lib/sender.js';
 import {getEffectiveLevel} from '../../server/services/userRoles.js';
+import {getPluginSettings, getPluginStates, savePluginState} from '../../server/services/plugins.js';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const NAME = 'feedback';
@@ -53,9 +60,19 @@ export default async function feedbackPlugin(fastify, options) {
     const {authenticate, requirePermission} = options.auth;
     const hooks = options.hooks || {};
     const can = (action) => ({preHandler: [authenticate, requirePermission(NAME, action)]});
-    const settings = {...defaults, ...(options.settings || {})};
     const receiverMod = await import('./lib/receiver.js');
     const mode = options.mode || (receiverMod.isManager() ? 'receiver' : 'sender');
+    // Each side's settings are read when used (1.1.7), not once at boot: the cog's
+    // save, and Marketplace > Configure, take effect without a restart. Only this
+    // side's keys (lib/shape.js SIDE_SETTINGS). Tests inject a reader and writer.
+    const side = mode === 'receiver' ? 'receiver' : 'sender';
+    const readSettings = typeof options.readSettings === 'function' ? options.readSettings
+        : async () => ({...defaults, ...(await getPluginSettings(NAME).catch(() => options.settings || {}))});
+    const writeSettings = typeof options.writeSettings === 'function' ? options.writeSettings
+        // Merged over what is stored: the object holds the other side's keys too.
+        : (next) => savePluginState(NAME, {settings: {...(getPluginStates()[NAME]?.settings || {}), ...next}});
+    const liveSettings = async () => cleanSettings(await readSettings().catch(() => ({})), defaults, side);
+    const settingsHooks = {saved: () => {}};
     const notifyOk = typeof hooks.notify === 'function';
     if (typeof hooks.registerNotificationSource === 'function') {
         try {
@@ -69,28 +86,58 @@ export default async function feedbackPlugin(fastify, options) {
         } catch (err) { fastify.log.warn(`[feedback] notification source: ${err.message}`); }
     }
 
-    fastify.get('/meta', can('send'), async () => ({types: TYPES, statuses: STATUSES, severities: SEVERITIES}));
+    // On the manager the inbox needs it, so `manage` is enough there (a manager role with only
+    // `manage` used to get 403 here, and the whole screen failed to load).
+    fastify.get('/meta', can(mode === 'receiver' ? 'manage' : 'send'), async () => ({types: TYPES, statuses: STATUSES, severities: SEVERITIES,
+        attachments: {max: ATTACHMENTS.max, maxBytes: ATTACHMENTS.maxBytes}}));
+
+    // ---- The settings cog (1.1.7) ----
+    // A site's sync interval is the site administrators' (requireAdmin); the manager's
+    // per-site limits are the inbox's (`manage`).
+    const settingsGuard = mode === 'receiver' ? can('manage')
+        : {preHandler: [authenticate, typeof options.auth.requireAdmin === 'function' ? options.auth.requireAdmin : requirePermission(NAME, 'send')]};
+    fastify.get('/settings', settingsGuard, async () => ({side, settings: await liveSettings()}));
+    fastify.put('/settings', settingsGuard, async (request) => {
+        const next = cleanSettings(request.body, await liveSettings(), side);
+        await writeSettings(next);
+        settingsHooks.saved(next);
+        return {side, settings: next};
+    });
 
-    if (mode === 'receiver') await receiverRoutes(fastify, {can, authenticate, requirePermission, hooks, notifyOk, receiverMod, settings, options});
-    else await senderRoutes(fastify, {can, hooks, notifyOk, settings, options});
+    if (mode === 'receiver') await receiverRoutes(fastify, {can, authenticate, requirePermission, hooks, notifyOk, receiverMod, liveSettings, options});
+    else await senderRoutes(fastify, {can, hooks, notifyOk, liveSettings, settingsHooks, options});
 }
 
 // ---------------------------------------------------------------------------------
 // Sender
 // ---------------------------------------------------------------------------------
 
-async function senderRoutes(fastify, {can, hooks, notifyOk, settings, options}) {
+async function senderRoutes(fastify, {can, hooks, notifyOk, liveSettings, settingsHooks, options}) {
     const env = options.env || process.env;
     const manager = managerOf(env);
-    const outbox = createOutbox(options.dataDir || path.join(HERE, 'data'));
+    const dataDir = options.dataDir || path.join(HERE, 'data');
+    const outbox = createOutbox(dataDir);
     const api = manager ? managerApi(manager, options.fetch) : null;
+    // Files attached to reports, kept here as well: they go after their report, and a report
+    // waiting to send must still have them. Never under the public media folder - they are
+    // screenshots of this site's admin.
+    const files = createStore(path.join(dataDir, 'attachments'));
+    /** Files picked in a panel that was then closed: gone after a day. Those a report names stay. */
+    const pruneFiles = () => {
+        try {
+            const keep = new Set(outbox.all().flatMap(i => (i.payload?.attachments || []).map(a => a.id)));
+            files.prune({keep});
+        } catch { /* tidying only */ }
+    };
 
     /** Send what waits, then read the manager's view; tell admins about replies they have not heard of. */
     async function sync() {
         if (!api) return {reports: mergeReports(outbox.all(), null, outbox.seen()), reachable: false, error: ''};
-        const pushed = await flush(outbox, api);
+        const pushed = await flush(outbox, api, files);
         const mine = await api.mine();
         const remote = mine.ok ? (mine.body?.reports || []) : null;
+        // Deleted on the manager: gone here too, and its screenshots with the next prune (1.1.8).
+        if (remote) outbox.forgetDropped(remote);
         const reports = mergeReports(outbox.all(), remote, outbox.seen());
         // Keep the last-known reply on the outbox copy: the badge reads that, never the manager.
         if (remote) for (const r of reports) if (!r.local && r.ref) outbox.mark(r.ref, {reply: r.reply ? '1' : '', replyAt: r.replyAt, remoteId: r.id});
@@ -104,12 +151,24 @@ async function senderRoutes(fastify, {can, hooks, notifyOk, settings, options})
     }
 
     // The hourly sync: waiting reports go, new replies are noticed. Off in tests.
+    // Each wait asks for syncMinutes again, and a save re-arms it, so a changed
+    // interval counts from the save rather than from the next restart.
     if (api && options.timer !== false) {
-        const t = setInterval(() => { sync().catch(() => {}); }, Math.max(5, Number(settings.syncMinutes) || 60) * 60_000);
-        t.unref?.();
+        let t = null;
+        let closed = false;
+        const arm = async () => {
+            clearTimeout(t);
+            if (closed) return;
+            const minutes = Math.max(5, Number((await liveSettings().catch(() => ({}))).syncMinutes) || 60);
+            if (closed) return;
+            t = setTimeout(() => { pruneFiles(); sync().catch(() => {}).finally(() => arm()); }, minutes * 60_000);
+            t.unref?.();
+        };
+        arm();
+        settingsHooks.saved = () => { arm(); };
         const first = setTimeout(() => { sync().catch(() => {}); }, 60_000);
         first.unref?.();
-        fastify.addHook('onClose', async () => { clearInterval(t); clearTimeout(first); });
+        fastify.addHook('onClose', async () => { closed = true; clearTimeout(t); clearTimeout(first); });
     }
 
     fastify.get('/mode', can('send'), async () => ({mode: 'sender', connected: Boolean(manager), site: manager?.slug || ''}));
@@ -139,13 +198,32 @@ async function senderRoutes(fastify, {can, hooks, notifyOk, settings, options})
         return {connected: Boolean(manager), reachable: r.reachable, error: r.error, reports: r.reports};
     });
 
+    fastify.post('/attachments', can('send'), async (request, reply) => {
+        if (!manager) return reply.code(409).send({error: 'This site is not connected to Domma, so feedback cannot be sent from here.'});
+        const up = await readUpload(request);
+        if (up.error) return reply.code(up.code || 400).send({error: up.error});
+        const saved = files.save({id: randomUUID(), name: up.file.name, type: up.file.type, size: up.file.size}, up.file.buffer);
+        return reply.code(201).send(saved);
+    });
+
+    fastify.get('/attachments/:id', can('send'), async (request, reply) => {
+        const a = files.meta(String(request.params.id));
+        const buffer = a && files.read(a);
+        if (!buffer) return reply.code(404).send({error: 'That file is not here.'});
+        return sendFile(reply, a, buffer);
+    });
+
     fastify.post('/send', can('send'), async (request, reply) => {
         if (!manager) return reply.code(409).send({error: 'This site is not connected to Domma, so feedback cannot be sent from here.'});
         const {report, error} = cleanSubmission(request.body || {});
         if (error) return reply.code(400).send({error});
+        // What a file is comes from what was uploaded here, never from the form's say-so.
+        const attachments = report.attachments.map(a => files.meta(a.id));
+        if (attachments.some(a => !a)) return reply.code(400).send({error: 'An attached file is no longer here - attach it again.'});
+        report.attachments = attachments;
         const payload = buildPayload({report, user: request.user, cmsVersion: cmsVersion(), site: manager.slug, ref: newRef()});
         outbox.add(payload);
-        const r = await flush(outbox, api);
+        const r = await flush(outbox, api, files);
         const item = outbox.all().find(i => i.ref === payload.ref);
         return reply.code(201).send({ref: payload.ref, state: item?.state || 'waiting',
             message: item?.state === 'sent' ? 'Sent to Domma. Thank you.' : `Kept here and sent as soon as Domma answers. (${r.error || 'not sent yet'})`});
@@ -165,7 +243,7 @@ async function senderRoutes(fastify, {can, hooks, notifyOk, settings, options})
 /** Level 0 - the most senior role, whatever it is called. Roles are data, never names in code. */
 const isTopLevel = (user) => { try { return getEffectiveLevel(user) === 0; } catch { return false; } };
 
-async function receiverRoutes(fastify, {can, authenticate, requirePermission, hooks, notifyOk, receiverMod, settings, options}) {
+async function receiverRoutes(fastify, {can, authenticate, requirePermission, hooks, notifyOk, receiverMod, liveSettings, options}) {
     const rx = receiverMod;
     const slugOf = options.slugFromToken || rx.slugFromToken;
     const siteNames = options.siteNames || rx.siteNames;
@@ -176,8 +254,28 @@ async function receiverRoutes(fastify, {can, authenticate, requirePermission, ho
         if (!isTopLevel(request.user)) return reply.code(403).send({error: 'Only the most senior role on this server can send feedback from here.'});
     };
     const own = {preHandler: [authenticate, requirePermission('feedback', 'send'), topOnly]};
-    const ownSeen = createOutbox(options.dataDir || path.join(HERE, 'data'), 'own.json');
-    const allowed = createThrottle({max: Number(settings.perSiteMax) || 10, windowMs: (Number(settings.perSiteMinutes) || 10) * 60_000});
+    const dataDir = options.dataDir || path.join(HERE, 'data');
+    const ownSeen = createOutbox(dataDir, 'own.json');
+    // The per-site brakes take their limits at each call (the cog changes them live).
+    const reportThrottle = createThrottle();
+    const fileThrottle = createThrottle();
+    const limits = async () => {
+        const s = await liveSettings().catch(() => ({}));
+        return {max: Number(s.perSiteMax) || 10, windowMs: (Number(s.perSiteMinutes) || 10) * 60_000};
+    };
+    const allowed = async (slug) => reportThrottle(slug, Date.now(), await limits());
+    // Files have their own brake: up to ATTACHMENTS.max per report allowed in the same window.
+    const allowedFile = async (slug) => {
+        const l = await limits();
+        return fileThrottle(slug, Date.now(), {max: l.max * ATTACHMENTS.max, windowMs: l.windowMs});
+    };
+    // A report's files live in data/attachments/<report id>/; the level-0 role's uploads wait in _staging.
+    const files = createStore(path.join(dataDir, 'attachments'));
+    const STAGING = '_staging';
+    // A site sends a file's bytes raw. Only inside this plugin's scope; the engine has no parser for it.
+    if (!fastify.hasContentTypeParser('application/octet-stream')) {
+        fastify.addContentTypeParser('application/octet-stream', {parseAs: 'buffer', bodyLimit: ATTACHMENTS.maxBytes + 1024}, (req, body, done) => done(null, body));
+    }
     try { await rx.ensureCollection(); } catch (err) { fastify.log.error(`[feedback] collection: ${err.message}`); }
 
     // Waypoint Pro, when it is loaded, calls this when a linked issue moves.
@@ -196,7 +294,7 @@ async function receiverRoutes(fastify, {can, authenticate, requirePermission, ho
     fastify.post('/fleet/submit', {bodyLimit: 32 * 1024}, async (request, reply) => {
         const slug = await slugOf(request.headers.authorization);
         if (!slug) return reply.code(401).send({error: 'Unknown site.'});
-        if (!allowed(slug)) return reply.code(429).send({error: 'That is a lot of feedback at once - try again in a few minutes.'});
+        if (!await allowed(slug)) return reply.code(429).send({error: 'That is a lot of feedback at once - try again in a few minutes.'});
         const r = await rx.receive(slug, request.body || {});
         if (r.error) return reply.code(400).send({error: r.error});
         if (r.created && notifyOk) {
@@ -208,6 +306,24 @@ async function receiverRoutes(fastify, {can, authenticate, requirePermission, ho
         return reply.code(r.created ? 201 : 200).send({id: r.entry.id, status: r.entry.data.status});
     });
 
+    fastify.post('/fleet/attach/:id/:att', {bodyLimit: ATTACHMENTS.maxBytes + 1024}, async (request, reply) => {
+        const slug = await slugOf(request.headers.authorization);
+        if (!slug) return reply.code(401).send({error: 'Unknown site.'});
+        if (!await allowedFile(slug)) return reply.code(429).send({error: 'That is a lot of files at once - try again in a few minutes.'});
+        const e = await rx.getReport(String(request.params.id)).catch(() => null);
+        // Another site's report is "not found", never "not yours".
+        if (!e || e.data?.site !== slug) return reply.code(404).send({error: 'No such report.'});
+        // Only a file the report announced, at the size it announced, in the type it announced.
+        const a = cleanAttachment((e.data.attachments || []).find(x => x.id === String(request.params.att)));
+        if (!a) return reply.code(404).send({error: 'That report has no such file.'});
+        if ((e.data.attachments || []).find(x => x.id === a.id)?.stored) return {id: a.id, stored: true};
+        const body = request.body;
+        if (!Buffer.isBuffer(body) || body.length !== a.size) return reply.code(400).send({error: 'That file is not the size the report said.'});
+        files.save(a, body, e.id);
+        await rx.markStored(e.id, a.id);
+        return reply.code(201).send({id: a.id, stored: true});
+    });
+
     fastify.get('/fleet/mine', async (request, reply) => {
         const slug = await slugOf(request.headers.authorization);
         if (!slug) return reply.code(401).send({error: 'Unknown site.'});
@@ -244,13 +360,44 @@ async function receiverRoutes(fastify, {can, authenticate, requirePermission, ho
 
     // ---- The manager's own feedback: straight into the inbox, no HTTP round trip ----
 
+    fastify.post('/attachments', own, async (request, reply) => {
+        const up = await readUpload(request);
+        if (up.error) return reply.code(up.code || 400).send({error: up.error});
+        const saved = files.save({id: randomUUID(), name: up.file.name, type: up.file.type, size: up.file.size}, up.file.buffer, STAGING);
+        // Tidy anything picked and never filed while we are here.
+        try { files.prune({sub: STAGING}); } catch { /* tidying only */ }
+        return reply.code(201).send(saved);
+    });
+
+    /** One of the level-0 role's own files: still staged, or already in one of its reports. */
+    fastify.get('/attachments/:id', own, async (request, reply) => {
+        const id = String(request.params.id);
+        let a = files.meta(id, STAGING);
+        let buffer = a && files.read(a, STAGING);
+        if (!buffer) {
+            const e = (await rx.reportsOf(rx.MANAGER_SITE)).find(x => (x.data.attachments || []).some(y => y.id === id));
+            a = e && cleanAttachment(e.data.attachments.find(y => y.id === id));
+            buffer = a && files.read(a, e.id);
+        }
+        if (!buffer) return reply.code(404).send({error: 'That file is not here.'});
+        return sendFile(reply, a, buffer);
+    });
+
     fastify.post('/send', own, async (request, reply) => {
         const {report, error} = cleanSubmission(request.body || {});
         if (error) return reply.code(400).send({error});
-        if (!allowed(rx.MANAGER_SITE)) return reply.code(429).send({error: 'That is a lot of feedback at once - try again in a few minutes.'});
+        const attachments = report.attachments.map(a => files.meta(a.id, STAGING));
+        if (attachments.some(a => !a)) return reply.code(400).send({error: 'An attached file is no longer here - attach it again.'});
+        report.attachments = attachments;
+        if (!await allowed(rx.MANAGER_SITE)) return reply.code(429).send({error: 'That is a lot of feedback at once - try again in a few minutes.'});
         const payload = buildPayload({report, user: request.user, cmsVersion: cmsVersion(), site: rx.MANAGER_SITE, ref: newRef()});
         const r = await rx.receive(rx.MANAGER_SITE, payload, 'manager');
         if (r.error) return reply.code(400).send({error: r.error});
+        // No travel: the staged files simply move into the report's folder.
+        for (const a of attachments) {
+            try { files.move(a, STAGING, r.entry.id); await rx.markStored(r.entry.id, a.id); }
+            catch (err) { fastify.log.warn(`[feedback] attachment ${a.id}: ${err.message}`); }
+        }
         return reply.code(201).send({id: r.entry.id, ref: payload.ref, state: 'sent', message: 'Filed in the inbox.'});
     });
 
@@ -299,10 +446,19 @@ async function receiverRoutes(fastify, {can, authenticate, requirePermission, ho
         return {id: next.id, ...next.data, createdAt: next.meta?.createdAt, updatedAt: next.meta?.updatedAt};
     });
 
+    fastify.get('/reports/:id/attachments/:att', can('manage'), async (request, reply) => {
+        const e = await rx.getReport(request.params.id);
+        const a = e && cleanAttachment((e.data.attachments || []).find(x => x.id === String(request.params.att)));
+        const buffer = a && files.read(a, e.id);
+        if (!buffer) return reply.code(404).send({error: 'That file has not arrived, or is gone.'});
+        return sendFile(reply, a, buffer);
+    });
+
     fastify.delete('/reports/:id', can('manage'), async (request, reply) => {
         const e = await rx.getReport(request.params.id);
         if (!e) return reply.code(404).send({error: 'No such report.'});
         await rx.removeReport(e.id);
+        files.removeAll(e.id);
         return {ok: true};
     });
 

package/plugins/feedback/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "feedback",
   "displayName": "Feedback",
-  "version": "1.1.4",
+  "version": "1.1.8",
   "tier": "free",
   "description": "Tell Domma what is broken, missing or good - straight from your admin - and see what became of it: seen, planned, in progress, done, with Domma's reply.",
   "author": "Domma CMS",
@@ -40,7 +40,7 @@
     ],
     "views": {
       "plugin-feedback": {
-        "entry": "feedback/admin/views/feedback.js?v=1.1.4",
+        "entry": "feedback/admin/views/feedback.js?v=1.1.8",
         "exportName": "feedbackView"
       }
     }