domma-cms 1.6.38 → 1.6.39

package/plugins/_lib/mail/oauthRoutes.js

@@ -0,0 +1,294 @@
+/**
+ * The OAuth2 sign-in routes for mailboxes: Connect, the provider's callback,
+ * Disconnect and Test. Registered by Email Pro (which feature-detects this
+ * file - an engine without it simply offers no sign-in); the free reader does
+ * not register them, but reads a signed-in mailbox all the same.
+ *
+ * Each customer registers THEIR OWN app with Microsoft or Google - the Docs
+ * Pro cloud-copies design. The admin form shows this site's exact redirect
+ * URI with a guide; the client secret goes in sealed and never comes out.
+ *
+ * The callback is the one route without a session. Its `state` is a one-time
+ * ticket, ten minutes long, naming the person who pressed Connect, and the
+ * callback refuses a browser signed in to this site as somebody else.
+ *
+ * @module _lib/mail/oauthRoutes
+ */
+import {createHash, randomBytes, timingSafeEqual} from 'node:crypto';
+
+import {originOf, trustedOrigin} from '../../../server/services/passwordReset.js';
+import {resolveViewer} from '../../../server/services/viewerSession.js';
+import * as accounts from './accounts.js';
+import {MailKeyError, open, seal} from './secretbox.js';
+import {verifySmtp} from './send.js';
+import {
+    announceConnected, authorizeUrl, cleanTenant, configureOAuth, describeProviders, exchangeCode,
+    mailboxFor, pkcePair, PROVIDERS, revokeAccount
+} from './oauth.js';
+
+const STATE_TTL = 10 * 60 * 1000;
+/** Pending sign-ins kept at once - a ceiling on what a busy (or hostile) admin can pile up. */
+const MAX_PENDING = 200;
+/** Pending sign-ins per person: a new one beyond this replaces their oldest. */
+const MAX_PENDING_PER_USER = 5;
+
+const sha256 = (v) => createHash('sha256').update(String(v)).digest();
+
+/**
+ * The browser-binding cookie's name for one sign-in. Per state, so two
+ * Connects in two tabs do not overwrite each other's cookie.
+ *
+ * @param   {string} state
+ * @returns {string}
+ */
+export function bindCookieName(state) {
+    return `dm_mail_oauth_${sha256(state).toString('hex').slice(0, 16)}`;
+}
+
+/**
+ * One cookie's value from a raw Cookie header (no cookie plugin assumed).
+ *
+ * @param   {string|undefined} header
+ * @param   {string} name
+ * @returns {string}
+ */
+export function readCookie(header, name) {
+    for (const part of String(header ?? '').split(';')) {
+        const at = part.indexOf('=');
+        if (at !== -1 && part.slice(0, at).trim() === name) return part.slice(at + 1).trim();
+    }
+    return '';
+}
+
+const text = (v, max = 300) => String(v ?? '').trim().slice(0, max);
+// JSON inside a <script>: nothing in it can close the element early.
+const js = (v) => JSON.stringify(v).replace(/</g, '\\u003c').replace(/\u2028/g, '\\u2028').replace(/\u2029/g, '\\u2029');
+const esc = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+
+/**
+ * @param {object} fastify
+ * @param {{authenticate: Function, pool: object, pluginName: string, config?: object,
+ *          onNeedsReconnect?: Function, onConnected?: Function, fetch?: Function}} options
+ */
+export function registerOAuthRoutes(fastify, {authenticate, pool, pluginName, config = {}, onNeedsReconnect, onConnected, fetch}) {
+    configureOAuth({fetch, onNeedsReconnect: onNeedsReconnect ?? null, onConnected: onConnected ?? null});
+
+    /** state -> {userId, accountId, provider, clientId, clientSecretSealed, tenant, label, username, verifier, redirectUri, expires} */
+    const pending = new Map();
+    const userId = (request) => request.user?.id ?? request.user?.sub ?? null;
+
+    /** This site's exact return address - what the customer registers with the provider. */
+    async function redirectUriFor(request) {
+        const origin = await trustedOrigin(originOf(request)).catch(() => '') || originOf(request);
+        return `${origin}/api/plugins/${pluginName}/oauth/callback`;
+    }
+
+    function sweep() {
+        const now = Date.now();
+        for (const [k, v] of pending) if (v.expires < now) pending.delete(k);
+    }
+
+    /** GET /oauth/status - providers and the redirect URI, for the form's guide. */
+    fastify.get('/oauth/status', {preHandler: [authenticate]}, async (request) => {
+        const redirectUri = await redirectUriFor(request);
+        return {available: true, redirectUri, https: redirectUri.startsWith('https://'), providers: describeProviders()};
+    });
+
+    /**
+     * POST /oauth/start - where to send the person to sign in.
+     * Body: {accountId?, provider, clientId, clientSecret (blank = keep the saved one), tenant?, label?, username?}
+     */
+    fastify.post('/oauth/start', {preHandler: [authenticate], config: {rateLimit: {max: 20, timeWindow: '1 minute'}}}, async (request, reply) => {
+        const uid = userId(request);
+        if (!uid) return reply.code(401).send({error: 'Authentication required.'});
+        const body = request.body ?? {};
+        const provider = text(body.provider, 20);
+        if (!PROVIDERS[provider]) return reply.code(400).send({error: 'Choose Microsoft or Google.'});
+
+        const accountId = body.accountId ? text(body.accountId, 80) : null;
+        const existing = accountId ? await accounts.getAccount(uid, accountId) : null;
+        if (accountId && !existing) return reply.code(404).send({error: 'That mailbox does not exist.'});
+
+        const clientId = text(body.clientId, 200);
+        if (!clientId) return reply.code(400).send({error: PROVIDERS[provider].id === 'microsoft' ? 'The Application (client) ID is needed.' : 'The Client ID is needed.'});
+
+        // Blank secret = the one already saved, but only for the same app.
+        let clientSecret = text(body.clientSecret, 2000);
+        if (!clientSecret) {
+            const o = existing?.oauth;
+            if (o?.clientSecretSealed && o.provider === provider && o.clientId === clientId) {
+                try {
+                    clientSecret = open(o.clientSecretSealed);
+                } catch (err) {
+                    if (err instanceof MailKeyError) return reply.code(409).send({error: 'The saved client secret can no longer be read - type it again.'});
+                    throw err;
+                }
+            }
+        }
+        if (!clientSecret) return reply.code(400).send({error: 'The client secret is needed.'});
+
+        const username = text(body.username, 254).toLowerCase();
+        if (username && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(username)) return reply.code(400).send({error: 'That is not an email address.'});
+
+        sweep();
+        // Per person first: their oldest waiting sign-in makes room. Then the
+        // site-wide ceiling, which only many people at once can reach.
+        const mine = [...pending.entries()].filter(([, v]) => v.userId === uid).sort((a, b) => a[1].expires - b[1].expires);
+        while (mine.length >= MAX_PENDING_PER_USER) pending.delete(mine.shift()[0]);
+        if (pending.size >= MAX_PENDING) return reply.code(429).send({error: 'Too many sign-ins are waiting. Try again in a few minutes.'});
+
+        const state = randomBytes(24).toString('base64url');
+        const {verifier, challenge} = pkcePair();
+        const redirectUri = await redirectUriFor(request);
+        const tenant = PROVIDERS[provider].needsTenant ? cleanTenant(body.tenant) : null;
+        // Binds the sign-in to THIS browser: the callback refuses one that does
+        // not bring the cookie back. Without it, an anonymous browser could
+        // finish a sign-in someone else started (send a colleague the
+        // provider link, and their mailbox lands under your account).
+        // HttpOnly, SameSite=Lax (sent on the provider's top-level redirect
+        // back), scoped to the callback path, gone in ten minutes.
+        const bind = randomBytes(24).toString('base64url');
+        const callbackPath = new URL(redirectUri).pathname;
+        reply.header('Set-Cookie', `${bindCookieName(state)}=${bind}; Path=${callbackPath}; Max-Age=${STATE_TTL / 1000}; HttpOnly; SameSite=Lax`
+            + (redirectUri.startsWith('https://') ? '; Secure' : ''));
+        pending.set(state, {
+            userId: uid, accountId, provider, clientId, clientSecretSealed: seal(clientSecret), tenant,
+            label: text(body.label, 80), username, verifier, redirectUri, bindHash: sha256(bind), expires: Date.now() + STATE_TTL
+        });
+        return {
+            url: authorizeUrl({provider, clientId, tenant, redirectUri, state, codeChallenge: challenge,
+                loginHint: username || existing?.username || ''}),
+            redirectUri
+        };
+    });
+
+    /**
+     * GET /oauth/callback - the provider sends the person back here. Answers a
+     * small page that tells the mail screen (its opener) and closes itself.
+     */
+    fastify.get('/oauth/callback', {config: {rateLimit: {max: 30, timeWindow: '1 minute'}}}, async (request, reply) => {
+        const q = request.query ?? {};
+        const key = String(q.state ?? '');
+        const ticket = pending.get(key);
+        pending.delete(key);
+
+        const page = (ok, message, origin, accountId = null) => reply
+            .type('text/html; charset=utf-8')
+            .header('Cache-Control', 'no-store')
+            .header('Referrer-Policy', 'no-referrer')
+            .header('X-Robots-Tag', 'noindex')
+            .send(`<!doctype html><meta charset="utf-8"><meta name="robots" content="noindex"><title>${ok ? 'Mailbox connected' : 'Not connected'}</title>`
+                + `<body style="font-family:system-ui,sans-serif;display:grid;place-items:center;min-height:90vh;margin:0"><main style="max-width:30rem;text-align:center;padding:1rem">`
+                + `<h1 style="font-size:1.3rem">${ok ? 'Mailbox connected' : 'Not connected'}</h1><p>${esc(message)}</p><p>You can close this window.</p></main>`
+                + `<script>try{window.opener&&window.opener.postMessage(${js({type: 'domma-mail-oauth', ok, message, accountId})},${js(origin || '')});}catch(e){}${ok ? 'setTimeout(function(){window.close();},1200);' : ''}</script>`);
+
+        if (!ticket || ticket.expires < Date.now()) {
+            return page(false, 'This sign-in link has expired or was already used. Go back to Email and press Connect again.', null);
+        }
+        const origin = new URL(ticket.redirectUri).origin;
+        // Used up either way; clear it.
+        const cookieName = bindCookieName(key);
+        reply.header('Set-Cookie', `${cookieName}=; Path=${new URL(ticket.redirectUri).pathname}; Max-Age=0; HttpOnly; SameSite=Lax`);
+        if (q.error) return page(false, `The sign-in was not completed: ${text(q.error_description || q.error, 200)}`, origin);
+
+        // The browser that pressed Connect, and no other.
+        const bound = readCookie(request.headers.cookie, cookieName);
+        if (!bound || !timingSafeEqual(sha256(bound), ticket.bindHash)) {
+            return page(false, `This sign-in has to be finished in the browser that pressed Connect, with the admin open at ${origin}. Press Connect again there.`, origin);
+        }
+
+        // Signed in to this site as somebody else: refuse - whoever pressed
+        // Connect must be the one who finishes it.
+        const viewer = await resolveViewer(request).catch(() => null);
+        if (viewer?.id && viewer.id !== ticket.userId) {
+            return page(false, 'This sign-in was started by someone else. Press Connect yourself.', origin);
+        }
+        if (ticket.accountId && !(await accounts.getAccount(ticket.userId, ticket.accountId))) {
+            return page(false, 'That mailbox no longer exists.', origin);
+        }
+
+        try {
+            const clientSecret = open(ticket.clientSecretSealed);
+            const got = await exchangeCode({
+                provider: ticket.provider, clientId: ticket.clientId, clientSecret, tenant: ticket.tenant,
+                code: text(q.code, 4000), redirectUri: ticket.redirectUri, codeVerifier: ticket.verifier
+            });
+            const box = mailboxFor(ticket.provider, got.claims);
+            // Typed wins: a Microsoft 365 shared mailbox is signed in to by a
+            // person but addressed as itself (XOAUTH2 user = the shared address).
+            const username = ticket.username || box.email;
+            if (!username) {
+                return page(false, 'The provider did not say which mailbox was signed in to. Type the email address in the form and Connect again.', origin);
+            }
+            const p = PROVIDERS[ticket.provider];
+            const saved = await accounts.saveOAuthAccount(ticket.userId, ticket.accountId, {
+                label: ticket.label || username,
+                username,
+                provider: ticket.provider,
+                clientId: ticket.clientId,
+                tenant: ticket.tenant,
+                clientSecret,
+                refreshToken: got.refreshToken,
+                accessToken: got.accessToken,
+                expiresAt: got.expiresAt,
+                scope: got.scope,
+                imap: p.imap,
+                smtp: box.smtp
+            });
+            if (!saved) return page(false, 'That mailbox no longer exists.', origin);
+            // A connection opened with the old details must not be reused.
+            pool.release(`${ticket.userId}:${saved.id}`);
+            announceConnected(saved);
+            return page(true, `${username} is connected through ${p.short}.`, origin, saved.id);
+        } catch (err) {
+            fastify.log.warn(`[${pluginName}] mailbox sign-in failed: ${err.message}`);
+            return page(false, text(err.message, 300), origin);
+        }
+    });
+
+    /** POST /oauth/:id/disconnect - hand the sign-in back (where the provider allows) and forget it. */
+    fastify.post('/oauth/:id/disconnect', {preHandler: [authenticate]}, async (request, reply) => {
+        const uid = userId(request);
+        if (!uid) return reply.code(401).send({error: 'Authentication required.'});
+        const account = await accounts.getAccount(uid, request.params.id);
+        if (!account) return reply.code(404).send({error: 'That mailbox does not exist.'});
+        if (!accounts.isOAuth(account)) return reply.code(400).send({error: 'This mailbox uses a password, not a sign-in.'});
+
+        const result = await revokeAccount(account);
+        pool.release(`${uid}:${account.id}`);
+        // A new generation: a renewal already on the wire must not write a
+        // working token back over the disconnect (see accounts.updateOAuth).
+        const saved = await accounts.updateOAuth(uid, account.id, {
+            status: 'disconnected',
+            error: 'Disconnected. Reconnect to use this mailbox again.',
+            refreshTokenSealed: null,
+            accessTokenSealed: null,
+            expiresAt: 0
+        }, {bumpGen: true});
+        return {account: accounts.toPublic(saved), revoked: result.revoked, revokeSupported: result.supported};
+    });
+
+    /** POST /oauth/:id/test - sign in to both servers with the stored sign-in. */
+    fastify.post('/oauth/:id/test', {preHandler: [authenticate], config: {rateLimit: {max: 10, timeWindow: '1 minute'}}}, async (request, reply) => {
+        const uid = userId(request);
+        if (!uid) return reply.code(401).send({error: 'Authentication required.'});
+        const account = await accounts.getAccount(uid, request.params.id);
+        if (!account) return reply.code(404).send({error: 'That mailbox does not exist.'});
+        if (!accounts.isOAuth(account)) return reply.code(400).send({error: 'This mailbox uses a password, not a sign-in.'});
+
+        let imap;
+        let smtp;
+        try {
+            imap = await pool.test(accounts.toConnection(account));
+        } catch (err) {
+            imap = {ok: false, error: err.message};
+        }
+        try {
+            const out = accounts.toSmtpConnection(account);
+            smtp = out ? await verifySmtp(out.transport, config.allowInsecureTLS === true) : {ok: false, error: 'No outgoing server.'};
+        } catch (err) {
+            smtp = {ok: false, error: err.message};
+        }
+        return {ok: imap.ok && smtp.ok, imap, smtp};
+    });
+}

package/plugins/_lib/mail/readRoutes.js

@@ -140,7 +140,10 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
             };
         } catch (err) {
             if (err instanceof MailKeyError) {
-                reply.code(409).send({error: err.message, needsPassword: true, accountId: account.id});
+                // needsPassword stays true for a dead sign-in too: older
+                // screens already open settings on it, which is the right place.
+                reply.code(409).send({error: err.message, needsPassword: true,
+                    ...(err.needsReconnect ? {needsReconnect: true} : {}), accountId: account.id});
                 return null;
             }
             throw err;
@@ -245,7 +248,8 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
 
         const result = accounts.validate(request.body ?? {}, existing);
         if (!result.ok) return reply.code(400).send({error: result.error});
-        const where = await guardHost(result.value.host);
+        // A signed-in mailbox's servers are the provider's and cannot be edited here.
+        const where = result.value.oauth ? {ok: true} : await guardHost(result.value.host);
         if (!where.ok) return reply.code(400).send({error: where.error});
 
         const saved = await accounts.saveAccount(uid, request.params.id, result.value);
@@ -270,8 +274,15 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
         if (!uid) return reply.code(401).send({error: 'Authentication required.'});
 
         pool.release(`${uid}:${request.params.id}`);
+        const existing = await accounts.getAccount(uid, request.params.id);
         const deleted = await accounts.deleteAccount(uid, request.params.id);
         if (!deleted) return reply.code(404).send({error: 'That mailbox does not exist.'});
+        // A signed-in mailbox hands its sign-in back where the provider allows
+        // it (Google). Best-effort and after the delete: forgetting it here
+        // must not wait on, or fail because of, the provider.
+        if (accounts.isOAuth?.(existing)) {
+            import('./oauth.js').then(m => m.revokeAccount(existing)).catch(() => {});
+        }
         return {deleted: true};
     });
 
@@ -292,6 +303,16 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
 
         const result = accounts.validate(body, existing);
         if (!result.ok) return reply.code(400).send({error: result.error});
+        // A signed-in mailbox is tested as stored: the provider's own server,
+        // its token renewed if need be. Nothing typed is involved.
+        if (result.value.oauth) {
+            try {
+                return await pool.test(accounts.toConnection(existing));
+            } catch (err) {
+                if (err instanceof MailKeyError) return {ok: false, error: err.message};
+                throw err;
+            }
+        }
         const where = await guardHost(result.value.host);
         if (!where.ok) return reply.code(400).send({error: where.error});
 

package/plugins/_lib/mail/scheduler.js

@@ -40,6 +40,17 @@ const MAX_ATTEMPTS = 3;
 /** How long to wait before trying a failed send again. */
 const RETRY_MS = 120_000;
 
+/**
+ * The reason recorded on a queued item whose mailbox needs signing in again.
+ *
+ * @param   {Error} err
+ * @returns {string}
+ */
+export function reconnectReason(err) {
+    if (!err?.needsReconnect) return err?.message || 'The mailbox could not be used.';
+    return `The mailbox needs signing in again (Mail Settings > Mailboxes > Reconnect): ${err.message}`;
+}
+
 /**
  * Create the scheduler.
  *
@@ -70,7 +81,16 @@ export function createScheduler({store, pool, config, logger, tickMs = TICK_MS})
             return;
         }
 
-        const smtp = accounts.toSmtpConnection(account, item.identityId ?? null);
+        // Built INSIDE the try: a signed-in mailbox whose sign-in is dead throws
+        // here (OAuthReconnectError), and escaping would leave the claimed item
+        // `sending` with no finishSend - picked up again on every reclaim.
+        let smtp;
+        try {
+            smtp = accounts.toSmtpConnection(account, item.identityId ?? null);
+        } catch (err) {
+            await store.finishSend(item._id, {status: 'failed', error: reconnectReason(err)});
+            return;
+        }
         if (!smtp) {
             await store.finishSend(item._id, {
                 status: 'failed',
@@ -94,9 +114,11 @@ export function createScheduler({store, pool, config, logger, tickMs = TICK_MS})
             });
             await store.finishSend(item._id, {status: 'sent', result, error: null});
         } catch (err) {
-            const giveUp = (item.attempts ?? 1) >= MAX_ATTEMPTS;
+            // A dead sign-in will not fix itself between retries: fail now, so
+            // the sender is told (the send-failed notice) instead of waiting.
+            const giveUp = err?.needsReconnect || (item.attempts ?? 1) >= MAX_ATTEMPTS;
             await store.finishSend(item._id, giveUp
-                ? {status: 'failed', error: err.message}
+                ? {status: 'failed', error: err?.needsReconnect ? reconnectReason(err) : err.message}
                 // Back to pending, a little later. `finishedAt` is set either
                 // way, which is harmless on a retry and is what tells a
                 // screen when the last attempt was.
@@ -126,9 +148,11 @@ export function createScheduler({store, pool, config, logger, tickMs = TICK_MS})
         }
 
         const poolKey = `${item.userId}:${item.accountId}`;
-        const connection = accounts.toConnection(account);
+        let connection;
 
         try {
+            // Inside the try for the same reason as runSend: a dead sign-in throws here.
+            connection = accounts.toConnection(account);
             // The UID the move reported, when the server has UIDPLUS. Without
             // it the message is found by its Message-ID instead - a snooze on
             // such a server is still a snooze, and refusing to bring it back
@@ -160,9 +184,9 @@ export function createScheduler({store, pool, config, logger, tickMs = TICK_MS})
             // does not read, absent from the list that was supposed to bring
             // it back.
             const attempts = (item.attempts ?? 0) + 1;
-            const giveUp = attempts >= MAX_ATTEMPTS;
+            const giveUp = err?.needsReconnect || attempts >= MAX_ATTEMPTS;
             await store.finishSnooze(item._id, giveUp
-                ? {status: 'failed', error: err.message, attempts}
+                ? {status: 'failed', error: err?.needsReconnect ? `${reconnectReason(err)} The message is still in ${item.folder}.` : err.message, attempts}
                 : {status: 'pending', at: new Date(Date.now() + RETRY_MS), error: err.message, attempts});
             logger.warn(
                 `[mail] could not wake snoozed message ${item._id} (attempt ${attempts}): ${err.message}`

package/plugins/feedback/CLAUDE.md

@@ -173,3 +173,10 @@ lib/shape.js; no SVG or HTML - they can carry script). Chosen with "Attach a fil
 - `admin/lib/settings.js`: the banner cog, added by `feedback.js` once the mode is known, only when the silent
   `GET /settings` answers; a slideover through kit's `openPanel` with M bindings, data-help per field, discard
   guard, Ctrl+Enter. Tests: tests/settings.test.js, and "the per-site throttle" in tests/api.test.js (live limit).
+
+## 1.1.8 (2026-10-13) - a report deleted on the manager leaves the site too
+Deleting a report in the inbox hid it from the site, but the site's outbox kept the sent item - its text and, through
+`pruneFiles`' keep list, its screenshots - for good. `sync()` now calls `outbox.forgetDropped(remote)` whenever the
+manager answered `/fleet/mine` (its list for the site is complete): a SENT item the manager no longer has is dropped
+(`droppedByManager`, PURE, tested); waiting/refused items and an unreachable manager keep everything. The files go
+at the next prune (older than a day, no longer named). Found on the dcm click-through.

package/plugins/feedback/admin/views/feedback.js

@@ -17,7 +17,7 @@ import {api, loadKit, store} from '../lib/kit.js';
 import {addSettingsCog} from '../lib/settings.js';
 
 const ROUTE = /^#\/plugins\/feedback(\/|$)/;
-const V = '1.1.7';
+const V = '1.1.8';
 const TABS = [
     {key: 'inbox', label: 'Inbox', icon: 'inbox'},
     {key: 'mine', label: 'My feedback', icon: 'send'}

package/plugins/feedback/lib/sender.js

@@ -69,10 +69,29 @@ export function createOutbox(dataDir, name = 'outbox.json') {
             const s = read();
             s.seen[id] = replyAt;
             write(s);
+        },
+        /**
+         * The manager's full list of this site's reports: a SENT report it no longer has was deleted there,
+         * so this site forgets it too - its copy of the text, and (on the next prune) its files.
+         * @returns {number} how many were forgotten
+         */
+        forgetDropped(remote) {
+            if (!Array.isArray(remote)) return 0;
+            const s = read();
+            const keep = s.items.filter(i => !droppedByManager(i, remote));
+            const gone = s.items.length - keep.length;
+            if (gone) { s.items = keep; write(s); }
+            return gone;
         }
     };
 }
 
+/** A sent report the manager's list (complete, for this site) no longer holds - deleted there. PURE. */
+export function droppedByManager(item, remote) {
+    if (item?.state !== 'sent' || !Array.isArray(remote)) return false;
+    return !remote.some(r => r.ref === item.ref);
+}
+
 export const newRef = () => randomUUID();
 
 /**

package/plugins/feedback/plugin.js

@@ -136,6 +136,8 @@ async function senderRoutes(fastify, {can, hooks, notifyOk, liveSettings, settin
         const pushed = await flush(outbox, api, files);
         const mine = await api.mine();
         const remote = mine.ok ? (mine.body?.reports || []) : null;
+        // Deleted on the manager: gone here too, and its screenshots with the next prune (1.1.8).
+        if (remote) outbox.forgetDropped(remote);
         const reports = mergeReports(outbox.all(), remote, outbox.seen());
         // Keep the last-known reply on the outbox copy: the badge reads that, never the manager.
         if (remote) for (const r of reports) if (!r.local && r.ref) outbox.mark(r.ref, {reply: r.reply ? '1' : '', replyAt: r.replyAt, remoteId: r.id});

package/plugins/feedback/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "feedback",
   "displayName": "Feedback",
-  "version": "1.1.7",
+  "version": "1.1.8",
   "tier": "free",
   "description": "Tell Domma what is broken, missing or good - straight from your admin - and see what became of it: seen, planned, in progress, done, with Domma's reply.",
   "author": "Domma CMS",
@@ -40,7 +40,7 @@
     ],
     "views": {
       "plugin-feedback": {
-        "entry": "feedback/admin/views/feedback.js?v=1.1.7",
+        "entry": "feedback/admin/views/feedback.js?v=1.1.8",
         "exportName": "feedbackView"
       }
     }

package/plugins/feedback/tests/shape.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import {
     buildPayload, cleanSubmission, cleanUpdate, createThrottle, issueDescription, receivedReport, senderView, statusFromIssue
 } from '../lib/shape.js';
-import {mergeReports} from '../lib/sender.js';
+import {createOutbox as createFbOutbox, droppedByManager, mergeReports} from '../lib/sender.js';
 
 test('a submission is cleaned, and says nothing about who sent it', () => {
     assert.equal(cleanSubmission({title: '  ', description: 'x'}).error, 'Give it a short title.');
@@ -149,3 +149,25 @@ test('the file store: private files, read back by id, unclaimed ones tidied', ()
         assert.equal(files.read(a), null);
     } finally { fs.rmSync(root, {recursive: true, force: true}); }
 });
+
+test('a report deleted on the manager is forgotten by the site (its text, then its files)', async () => {
+    const {mkdtempSync, rmSync} = await import('node:fs');
+    const {tmpdir} = await import('node:os');
+    const {join} = await import('node:path');
+    assert.equal(droppedByManager({ref: 'a', state: 'sent'}, [{ref: 'b'}]), true);
+    assert.equal(droppedByManager({ref: 'a', state: 'sent'}, [{ref: 'a'}]), false);
+    assert.equal(droppedByManager({ref: 'a', state: 'waiting'}, []), false, 'never sent: the manager cannot have it yet');
+    assert.equal(droppedByManager({ref: 'a', state: 'sent'}, null), false, 'manager unreachable: keep everything');
+    const dir = mkdtempSync(join(tmpdir(), 'fb-outbox-'));
+    try {
+        const box = createFbOutbox(dir);
+        for (const ref of ['kept', 'gone', 'wait']) box.add({ref, attachments: [{id: `${ref}-file`}]});
+        box.mark('kept', {state: 'sent'});
+        box.mark('gone', {state: 'sent'});
+        assert.equal(box.forgetDropped(null), 0);
+        assert.equal(box.forgetDropped([{ref: 'kept'}]), 1);
+        assert.deepEqual(box.all().map(i => i.ref), ['kept', 'wait']);
+    } finally {
+        rmSync(dir, {recursive: true, force: true});
+    }
+});