domma-cms 1.6.56 → 1.6.57

package/plugins/support/tests/drafts.test.js

@@ -0,0 +1,92 @@
+/**
+ * Kept drafts (admin/lib/drafts.js): what a panel keeps of unsaved typing, the
+ * question it is offered back with - OK always throws away, so Cancel, Escape
+ * and a backdrop click (all `false` from E.confirm) keep - and what a reply box
+ * holds once its message has gone.
+ */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {
+    DRAFT_KEYS, RESTORE_CONFIRM, changedFields, afterSend, differs, draftFate, draftQuestion, draftText, draftValues, isDraft, makeDraft, newDraftQuestion,
+    settingsPrint, shortWhen, stableJson, ticketPrint
+} from '../admin/lib/drafts.js';
+
+test('stableJson ignores key order; differs compares by it', () => {
+    assert.equal(stableJson({b: 1, a: [1, {d: 2, c: 3}]}), stableJson({a: [1, {c: 3, d: 2}], b: 1}));
+    assert.equal(differs({text: 'a'}, {text: 'a'}), false);
+    assert.equal(differs({text: 'a'}, {text: ''}), true);
+});
+
+test('keys are one per panel and request - no shared map', () => {
+    assert.equal(DRAFT_KEYS.reply('ref-1'), 'support.draft.reply.ref-1');
+    assert.equal(DRAFT_KEYS.answer('e1'), 'support.draft.answer.e1');
+    assert.notEqual(DRAFT_KEYS.reply('x'), DRAFT_KEYS.answer('x'));
+    assert.notEqual(DRAFT_KEYS.compose, DRAFT_KEYS.settings);
+});
+
+test('makeDraft / isDraft / draftValues', () => {
+    const d = makeDraft({subject: 'x', other: 'y', n: 5}, 'fp', '2026-10-15T10:00:00.000Z');
+    assert.deepEqual(d, {data: {subject: 'x', other: 'y', n: 5}, was: 'fp', at: '2026-10-15T10:00:00.000Z'});
+    assert.ok(isDraft(d));
+    for (const bad of [null, 'x', {}, {data: []}, {data: 'x'}]) assert.equal(isDraft(bad), false);
+    assert.deepEqual(draftValues(d, {subject: '', where: 'here', n: ''}), {subject: 'x', where: 'here', n: '5'});
+});
+
+test('ticketPrint: someone writing moves it; reading or archiving does not', () => {
+    const t = {messages: [{id: 'm1', from: 'customer'}], status: 'open', notes: 'n', archived: false, unread: true};
+    assert.equal(ticketPrint(t), ticketPrint({...t, archived: true, unread: false, status: 'answered'}));
+    assert.notEqual(ticketPrint(t), ticketPrint({...t, messages: [...t.messages, {id: 'm2', from: 'domma'}]}));
+    // The inbox also counts its notes; the site never sees them.
+    assert.equal(ticketPrint(t), ticketPrint({...t, notes: 'changed'}));
+    assert.notEqual(ticketPrint(t, {notes: true}), ticketPrint({...t, notes: 'changed'}, {notes: true}));
+    assert.equal(ticketPrint(null), '');
+});
+
+test('afterSend: what stays in the reply box once a message has gone', () => {
+    assert.equal(afterSend('Hello', 'Hello'), '', 'unchanged while sending: emptied');
+    assert.equal(afterSend('Hello\n\nand one more thing', 'Hello'), 'and one more thing', 'carried on at the end: only the new part stays');
+    assert.equal(afterSend('Hullo', 'Hello'), 'Hullo', 'the text itself changed: all of it stays, unsent');
+    assert.equal(afterSend('', 'Hello'), '');
+    assert.equal(afterSend(undefined, undefined), '');
+});
+
+test('draftFate and draftQuestion: OK throws away; the text says what happened since', () => {
+    const d = makeDraft({text: 'Hi'}, 'A', '2026-10-15T10:00:00.000Z');
+    assert.equal(draftFate(d, null), 'deleted');
+    assert.equal(draftFate(d, 'B'), 'changed');
+    assert.equal(draftFate(d, 'A'), '');
+    assert.equal(draftFate({was: ''}, 'B'), '');
+
+    const plain = draftQuestion(d, 'A', {what: 'your reply to “Down”'});
+    assert.match(plain.text, /^Throw away the changes you left unsaved on your reply to “Down” \(15 Oct, \d\d:00\)\? Keeping them puts them back in the form\.$/);
+    assert.deepEqual(plain.options, RESTORE_CONFIRM);
+    assert.equal(plain.options.confirmText, 'Throw away');
+    assert.equal(plain.options.cancelText, 'Keep them');
+
+    const changed = draftQuestion(d, 'B', {what: 'x', changed: 'Domma has written since', changedAt: '2026-10-15T11:30:00.000Z'});
+    assert.match(changed.text, /Domma has written since \(15 Oct, \d\d:30\) - keeping them puts your changes over that\.$/);
+    assert.match(draftQuestion(d, 'B', {what: 'x'}).text, /It has been changed since - keeping/);
+
+    const gone = draftQuestion(d, null, {what: 'a request'});
+    assert.equal(gone.fate, 'deleted');
+    assert.equal(gone.options.confirmText, 'Throw away');
+    assert.equal(gone.options.cancelText, 'Copy them');
+});
+
+test('newDraftQuestion, settingsPrint and draftText', () => {
+    const q = newDraftQuestion(makeDraft({subject: 't'}, '', '2026-10-15T09:05:00.000Z'));
+    assert.match(q.text, /^Throw away the request you left unsent \(15 Oct, \d\d:05\)\? Keeping it puts it back in the form\.$/);
+    assert.equal(q.options.confirmText, 'Throw away');
+    assert.equal(settingsPrint({b: '2', a: '1'}), settingsPrint({a: '1', b: '2'}));
+    assert.equal(draftText(makeDraft({reply: 'Thanks', notes: ''})), 'reply:\nThanks');
+    assert.equal(shortWhen('nope'), '');
+});
+
+test('changedFields keeps only what was edited, so a picked-up draft leaves the rest as the record has it now', () => {
+    const saved = {status: 'acknowledged', reply: '', notes: ''};
+    const kept = changedFields({status: 'acknowledged', reply: 'Thanks', notes: ''}, saved);
+    assert.deepEqual(kept, {reply: 'Thanks'});
+    // Later, someone else set the status and wrote notes: the draft puts back only the reply.
+    assert.deepEqual(draftValues(makeDraft(kept), {status: 'planned', reply: '', notes: 'theirs'}), {status: 'planned', reply: 'Thanks', notes: 'theirs'});
+    assert.deepEqual(changedFields({a: '1'}, {a: '1'}), {});
+});

package/server/routes/api/analytics.js

@@ -66,11 +66,15 @@ const REALTIME_WINDOW_MS = 5 * 60 * 1000;
  * for ever). Prototype names are refused explicitly as well - the '/' rule
  * already excludes them, but `lifetime["constructor"] + 1` turning every total
  * into a string is exactly the bug a relaxed rule must not bring back.
+ * A path the browser would resolve off the site is refused too: '//host/x' is
+ * protocol-relative, and browsers read '\' as '/', so '/\host' is the same.
+ * The admin opens these as links.
  */
 const URL_MAX = 2048;
 const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
 function isBeaconPath(url) {
-    return typeof url === 'string' && url.length <= URL_MAX && url.startsWith('/') && !/\s/.test(url);
+    return typeof url === 'string' && url.length <= URL_MAX && url.startsWith('/') && !url.startsWith('//')
+        && !url.includes('\\') && !/\s/.test(url);
 }
 function isSafeKey(key) {
     return !UNSAFE_KEYS.has(key) && !UNSAFE_KEYS.has(key.replace(/^\/+/, ''));

package/server/routes/api/contacts.js

@@ -35,6 +35,7 @@ import {createEntry, deleteEntry, getEntry, listEntries, updateEntry} from '../.
 import {hooks} from '../../services/hooks.js';
 import {getPermissionsFor} from '../../services/roles.js';
 import {getEffectiveRoles} from '../../services/userRoles.js';
+import {ago, clip, plural} from '../../services/sidebarBadges.js';
 
 /**
  * The permission that lets someone rename or delete a group they did not
@@ -238,6 +239,41 @@ function toGroupName(entry) {
     return entry.data.name ?? '';
 }
 
+/**
+ * The sidebar badge: how many contacts this user has - an inventory, so it is
+ * left out of a closed folder's total. The popover gives the starred and the
+ * groups, and the four most recently changed. Plain text throughout.
+ *
+ * @param   {object[]} contacts - the caller's own, as toContact() shapes them
+ * @param   {number}   groupCount - every group (groups are shared)
+ * @param   {number}   [now]
+ * @returns {object}
+ */
+export function contactsBadge(contacts, groupCount = 0, now = Date.now()) {
+    const list = Array.isArray(contacts) ? contacts : [];
+    const stamp = c => String(c.updatedAt || c.createdAt || '');
+    const recent = [...list].sort((a, b) => stamp(b).localeCompare(stamp(a))).slice(0, 4);
+    return {
+        count: list.length,
+        label: plural(list.length, 'contact'),
+        tone: 'info',
+        inventory: true,
+        details: {
+            title: 'Contacts',
+            rows: [
+                {label: 'Contacts', value: String(list.length)},
+                {label: 'Starred', value: String(list.filter(c => c.favourite === true).length)},
+                {label: 'Groups', value: String(groupCount)}
+            ],
+            items: recent.map(c => ({
+                text: clip(c.name || 'Unnamed'),
+                meta: stamp(c) ? `changed ${ago(stamp(c), now)}` : ''
+            })),
+            empty: 'No contacts yet.'
+        }
+    };
+}
+
 /**
  * Auth is injectable, the shape dashboard.js and plugins.js use.
  *
@@ -308,6 +344,12 @@ export async function contactsRoutes(fastify, opts = {}) {
     // Contacts CRUD
     // -------------------------------------------------------------------------
 
+    /** GET /api/contacts/count - the sidebar badge (contactsBadge). */
+    fastify.get('/count', {preHandler: [authenticate, requirePermission('contacts', 'read')]}, async (request) => {
+        const [contacts, groups] = await Promise.all([loadContacts(userId(request)), loadGroups()]);
+        return contactsBadge(contacts, groups.length);
+    });
+
     /** GET /api/contacts/contacts - supports ?q=, ?group=, ?favourites=true */
     fastify.get('/contacts', {preHandler: [authenticate, requirePermission('contacts', 'read')]}, async (request, reply) => {
         const uid = userId(request);

package/server/routes/api/forms.js

@@ -329,6 +329,8 @@ async function cachedStats(form, now) {
     statsCache.set(form.slug, {at: now, value});
     return value;
 }
+/** A form's submissions changed (sent, deleted, cleared) or the form went: the next badge reads afresh. */
+const forgetStats = (slug) => { statsCache.delete(slug); };
 
 export function formsBadge(forms = [], now = Date.now()) {
     const week = forms.reduce((n, f) => n + (f.stats?.week || 0), 0);
@@ -376,6 +378,8 @@ export async function formsRoutes(fastify) {
         const result = await Promise.all(forms.map(async form => {
             // Counted where the submissions screen reads them (submissionsCollectionFor).
             const stats = await submissionStats(form, now);
+            // The list has just counted them: the badge, asked straight after, agrees with it.
+            statsCache.set(form.slug, {at: now, value: stats});
             // listForms returns metadata only; readForm returns full record with meta
             let full = null;
             try { full = await readForm(form.slug); } catch { /* skip */ }
@@ -556,6 +560,7 @@ export async function formsRoutes(fastify) {
         } catch {
             return reply.status(404).send({ error: 'Form not found.' });
         }
+        forgetStats(slug);
         return { ok: true };
     });
 
@@ -666,6 +671,7 @@ export async function formsRoutes(fastify) {
         } catch {
             return reply.status(404).send({ error: 'Collection not found for this form.' });
         }
+        forgetStats(slug);
         return { ok: true };
     });
 
@@ -690,6 +696,7 @@ export async function formsRoutes(fastify) {
         } catch {
             return reply.status(404).send({ error: 'Submission not found.' });
         }
+        forgetStats(slug);
         return { ok: true };
     });
 
@@ -905,6 +912,7 @@ export async function formsRoutes(fastify) {
                     excused,
                     outcome:   ended ? {type: 'ended', trigger: ended.key, field: ended.field} : null
                 });
+                forgetStats(slug);
                 // What a visitor sent is theirs, not the site's content: keep it out of the site repo.
                 try { keepSubmissionsOut(ROOT, targetSlug); } catch { /* never fail a submission over this */ }
             } else {

package/server/routes/api/seo.js

@@ -41,7 +41,10 @@ export async function seoRoutes(fastify, opts = {}) {
 
     fastify.get('/count', may('read'), async () => {
         const s = seo().summary();
-        if (!s.at) return {count: 0, label: 'Not checked yet'};
+        if (!s.at) {
+            return {count: 0, label: 'Not checked yet',
+                details: {title: 'SEO', rows: [], items: [], empty: 'Not checked yet - open SEO to check every page.'}};
+        }
         const bad = (seo().store.audit().results || []).filter(r => r.error || r.failing > 0);
         return {
             count: bad.length,

package/server/routes/api/todo.js

@@ -23,6 +23,41 @@ import {getPermissionsFor} from '../../services/roles.js';
 
 const SLUG = 'todo-items';
 
+/** What a to-do may hold - the admin view's own lists (admin/js/lib/todo-arrange.js). */
+export const TODO_STATUSES = ['not-started', 'in-progress', 'completed'];
+export const TODO_PRIORITIES = ['highest', 'high', 'medium', 'low', 'lowest'];
+
+/** Most urgent first; an unknown priority sits with medium. */
+const priorityRank = (p) => { const i = TODO_PRIORITIES.indexOf(p); return i === -1 ? 2 : i; };
+const isHigh = (p) => p === 'highest' || p === 'high';
+
+/** A status or priority of null or '' was not given. */
+const blank = (v) => v === null || v === undefined || v === '';
+
+/**
+ * Check the fields a create or update carries. Only what is present is
+ * checked, and a null or '' status or priority counts as absent. A CHANGE to
+ * something outside the lists is refused rather than stored, since a stray
+ * status or priority falls out of every filter and sort - but a value equal to
+ * what the task already holds is let through: todo-items keeps these as free
+ * text, so a legacy or API-made task may hold 'urgent' or 'High', and the
+ * editor sends it back untouched with any edit.
+ *
+ * @param   {object} body
+ * @param   {object} [stored] - the task's current data, on an update
+ * @returns {string|null} the problem, or null
+ */
+export function todoFieldError(body, stored = {}) {
+    if (!body || typeof body !== 'object') return null;
+    const same = (key) => key in body && stored && body[key] === stored[key];
+    if (!blank(body.status) && !same('status') && !TODO_STATUSES.includes(body.status)) return `status must be one of ${TODO_STATUSES.join(', ')}`;
+    if (!blank(body.priority) && !same('priority') && !TODO_PRIORITIES.includes(body.priority)) return `priority must be one of ${TODO_PRIORITIES.join(', ')}`;
+    if ('dueAt' in body && !blank(body.dueAt) && !same('dueAt')
+        && !(typeof body.dueAt === 'string' && /^\d{4}-\d{2}-\d{2}/.test(body.dueAt))) return 'dueAt must be a YYYY-MM-DD day or null';
+    if ('text' in body && !same('text') && (typeof body.text !== 'string' || !body.text.trim())) return 'text cannot be empty';
+    return null;
+}
+
 /** 'YYYY-MM-DD' of a date, in the server's local time. */
 function localDay(d) {
     const pad = (n) => String(n).padStart(2, '0');
@@ -65,7 +100,7 @@ export async function todoCalendarItems({from, to, user}) {
             endAt: `${addDays(day, 1)}T00:00:00.000Z`,
             allDay: true,
             url: '#/todo',
-            meta: t.priority === 'high' ? 'high priority' : ''
+            meta: isHigh(t.priority) ? `${t.priority} priority` : ''
         }));
 }
 
@@ -124,17 +159,16 @@ export async function todoRoutes(fastify, opts = {}) {
         const daysBetween = (a, b) => Math.round((Date.parse(a) - Date.parse(b)) / 86_400_000);
         const overdue = open.filter(t => dayOf(t) && dayOf(t) < today);
         const dueToday = open.filter(t => dayOf(t) === today);
-        const PRIORITY = {high: 0, medium: 1, low: 2};
 
         // Most urgent first: overdue (oldest first), due today, then by due day, then priority.
         const urgent = [...open].sort((a, b) =>
             (dayOf(a) ?? '9999') .localeCompare(dayOf(b) ?? '9999')
-            || (PRIORITY[a.priority] ?? 1) - (PRIORITY[b.priority] ?? 1));
+            || priorityRank(a.priority) - priorityRank(b.priority));
         const items = urgent.slice(0, 5).map(t => {
             const day = dayOf(t);
             const d = day ? daysBetween(day, today) : null;
             const when = d === null ? '' : d < 0 ? `${plural(-d, 'day')} overdue` : d === 0 ? 'due today' : d === 1 ? 'due tomorrow' : `due in ${d} days`;
-            const meta = [when, t.priority === 'high' ? 'high priority' : ''].filter(Boolean).join(' · ');
+            const meta = [when, isHigh(t.priority) ? `${t.priority} priority` : ''].filter(Boolean).join(' · ');
             return {text: clip(t.text), meta, tone: d !== null && d < 0 ? 'danger' : undefined};
         });
 
@@ -178,12 +212,15 @@ export async function todoRoutes(fastify, opts = {}) {
             return reply.code(400).send({ error: 'text is required' });
         }
 
+        const problem = todoFieldError(request.body);
+        if (problem) return reply.code(400).send({error: problem});
+
         const {dueAt} = request.body ?? {};
         const entry = await createEntry(SLUG, {
             text: text.trim(),
-            status: status ?? 'not-started',
-            priority: priority ?? 'medium',
-            dueAt: dueAt ?? null,
+            status: blank(status) ? 'not-started' : status,
+            priority: blank(priority) ? 'medium' : priority,
+            dueAt: dueAt || null,
             userId: uid ?? null
         }, {createdBy: uid, source: 'admin'});
 
@@ -194,15 +231,18 @@ export async function todoRoutes(fastify, opts = {}) {
     fastify.put('/items/:id', {preHandler: [authenticate, requirePermission('todo', 'update')]}, async (request, reply) => {
         const uid = userId(request);
         const { id } = request.params;
-        const patch = request.body ?? {};
-
+        const patch = request.body && typeof request.body === 'object' ? request.body : {};
         const entry = await getEntry(SLUG, id);
         if (!entry) return reply.code(404).send({error: 'Todo not found'});
         if (uid && entry.data.userId !== uid) return reply.code(404).send({error: 'Todo not found'});
 
+        const problem = todoFieldError(patch, entry.data);
+        if (problem) return reply.code(400).send({error: problem});
+
         const merged = {...entry.data};
         for (const key of ['text', 'status', 'priority', 'dueAt']) {
-            if (key in patch) merged[key] = key === 'text' ? String(patch[key]).trim() : patch[key];
+            if (!(key in patch) || (blank(patch[key]) && key !== 'dueAt')) continue;
+            merged[key] = key === 'text' ? String(patch[key]).trim() : key === 'dueAt' ? (patch.dueAt || null) : patch[key];
         }
 
         const updated = await updateEntry(SLUG, id, merged);

package/server/server.js

@@ -637,7 +637,7 @@ const coreToolItems = [
     {text: 'Todo', url: '#/todo', icon: 'check-square', permission: 'todo', countUrl: '/api/todo/count'},
     {text: 'Calculator', url: '#/calculator', icon: 'calculator', permission: 'calculator'},
     {text: 'Analytics', url: '#/analytics', icon: 'chart-bar', permission: 'analytics', countUrl: '/api/analytics/active-count'},
-    {text: 'Contacts', url: '#/contacts', icon: 'users', permission: 'contacts'},
+    {text: 'Contacts', url: '#/contacts', icon: 'users', permission: 'contacts', countUrl: '/api/contacts/count', inventory: true},
     {text: 'SEO', url: '#/seo', icon: 'search', permission: 'seo', countUrl: '/api/seo/count'}
 ];
 for (const item of coreToolItems) {