domma-cms 1.8.11 → 1.8.13

package/server/services/staffAccess.js

@@ -0,0 +1,130 @@
+/**
+ * Staff sessions - the hosting company's staff (the people at the site's
+ * Domma CMS Manager), as opposed to anyone the site itself has made.
+ *
+ * A Tool switched off with `staff: true` (services/tools.js) is open to a
+ * staff session only. A site's own users - its owner included, though the
+ * owner holds the top role - never are: a staff session is something only the
+ * Manager can mint, never a role or a user field the site could give itself.
+ *
+ * ## How a staff session starts
+ *
+ * The Manager signs a one-time TICKET with the site's own JWT_SECRET (as its
+ * Data Manager already does for its loopback calls) and sends the staff
+ * member's browser to `GET /_staff/open?ticket=…`:
+ *
+ *     {type: 'staff-ticket', dcmStaff: true, site: <SITE_SLUG>, by, jti, to, exp: +60 s}
+ *
+ * This route checks the signature and expiry, that `site` is this site's
+ * SITE_SLUG (set only by the Manager that forked it - an unmanaged site has
+ * none and refuses every ticket), that `to` is a screen it opens, and that
+ * the ticket has not been used; then it hands the browser a one-hour access
+ * token `{id: 'dcm-staff', role: <top role>, type: 'access', dcmStaff: true,
+ * site}` and opens the admin at `to`. No refresh token: the session ends.
+ *
+ * Anyone who can read the site's JWT_SECRET (shell access, or code running in
+ * the site's process - which includes a level-0 user installing an unsigned
+ * plugin, unless server.json `requireSignedPlugins` is on) can mint either;
+ * that is true of every session. The session is the site's full top role for
+ * an hour (the Manager can already act as it), with no `sid` to revoke it.
+ *
+ * @module services/staffAccess
+ */
+import {getRoleHierarchy} from './roles.js';
+
+/** Screens a staff ticket may open. */
+export const STAFF_SCREENS = Object.freeze(['#/wordpress-import']);
+export const STAFF_SESSION_SECONDS = 3600;
+const STAFF_ID = 'dcm-staff';
+
+/**
+ * Is this decoded token (request.user) a staff session for this site?
+ *
+ * @param {object|null|undefined} user
+ * @param {string|undefined} [siteSlug]  process.env.SITE_SLUG - unset on an unmanaged site
+ * @returns {boolean}
+ */
+export function isDcmStaff(user, siteSlug = process.env.SITE_SLUG) {
+    return Boolean(siteSlug) && user?.type === 'access' && user?.dcmStaff === true && user?.site === siteSlug;
+}
+
+/**
+ * Whether a request carries a staff session. Never answers: a missing or bad
+ * token is "no".
+ *
+ * @param {import('fastify').FastifyRequest} request
+ * @returns {Promise<boolean>}
+ */
+export async function isStaffRequest(request) {
+    try {
+        const decoded = await request.jwtVerify();
+        return isDcmStaff(decoded);
+    } catch {
+        return false;
+    }
+}
+
+/** jti -> expiry (ms): tickets already used. */
+const used = new Map();
+
+/**
+ * Check a ticket. Pure apart from the used-ticket list.
+ *
+ * @param {object} decoded  the verified ticket payload
+ * @param {{siteSlug?: string, now?: number}} [opts]
+ * @returns {{ok: true, to: string, by: string} | {ok: false, error: string}}
+ */
+export function acceptTicket(decoded, {siteSlug = process.env.SITE_SLUG, now = Date.now()} = {}) {
+    for (const [jti, exp] of used) if (exp < now) used.delete(jti);
+    if (!siteSlug) return {ok: false, error: 'This site is not run by a Domma CMS Manager.'};
+    if (decoded?.type !== 'staff-ticket' || decoded.dcmStaff !== true) return {ok: false, error: 'Not a staff ticket.'};
+    if (decoded.site !== siteSlug) return {ok: false, error: 'This ticket is for another site.'};
+    if (!STAFF_SCREENS.includes(decoded.to)) return {ok: false, error: 'This ticket does not open anything here.'};
+    if (typeof decoded.jti !== 'string' || decoded.jti.length < 16) return {ok: false, error: 'Not a staff ticket.'};
+    if (used.has(decoded.jti)) return {ok: false, error: 'This ticket has been used - open it again from the manager.'};
+    used.set(decoded.jti, (Number(decoded.exp) || 0) * 1000 + 60_000);
+    return {ok: true, to: decoded.to, by: String(decoded.by || 'staff').slice(0, 120)};
+}
+
+const json = (v) => JSON.stringify(v).replace(/</g, '\\u003c');
+const page = (title, body) => `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="robots" content="noindex">
+<meta name="viewport" content="width=device-width, initial-scale=1"><title>${title}</title></head><body>${body}</body></html>`;
+
+/**
+ * GET /_staff/open?ticket=… - exchange a Manager's ticket for a staff session.
+ *
+ * @param {import('fastify').FastifyInstance} fastify
+ */
+export async function staffAccessRoutes(fastify) {
+    fastify.get('/_staff/open', {config: {rateLimit: {max: 30, timeWindow: '1 minute'}}}, async (request, reply) => {
+        reply.header('Cache-Control', 'no-store').header('Referrer-Policy', 'no-referrer').header('X-Robots-Tag', 'noindex');
+        const refuse = (error) => reply.code(403).type('text/html; charset=utf-8')
+            .send(page('Not opened', `<p>${error.replace(/[<>&]/g, '')}</p>`));
+        const ticket = typeof request.query?.ticket === 'string' ? request.query.ticket : '';
+        if (!ticket || ticket.length > 4096) return refuse('Not a staff ticket.');
+        let decoded;
+        try {
+            decoded = fastify.jwt.verify(ticket);
+        } catch {
+            return refuse('This ticket is not valid or has run out - open it again from the manager.');
+        }
+        const ok = acceptTicket(decoded);
+        if (!ok.ok) return refuse(ok.error);
+
+        const role = getRoleHierarchy()[0];
+        if (!role) return refuse('This site has no roles yet.');
+        const user = {id: STAFF_ID, name: `${ok.by} (staff)`, email: '', role, additionalRoles: [], level: 0, dcmStaff: true};
+        const token = fastify.jwt.sign({id: STAFF_ID, role, type: 'access', dcmStaff: true, site: decoded.site, name: user.name},
+            {expiresIn: STAFF_SESSION_SECONDS});
+        // warn, not info: production logs at warn, and this is the site's only record of a staff visit.
+        fastify.log.warn?.(`[staff] ${ok.by} opened a staff session at ${ok.to} (ticket ${String(decoded.jti).slice(0, 8)}…)`);
+        return reply.type('text/html; charset=utf-8').send(page('Opening…', `<p>Opening…</p>
+<script src="/dist/domma/domma.min.js"></script>
+<script>
+S.remove('auth_refresh_token');
+S.set('auth_token', ${json(token)});
+S.set('auth_user', ${json(user)});
+location.replace('/admin/' + ${json(ok.to)});
+</script>`));
+    });
+}

package/server/services/tools.js

@@ -39,6 +39,19 @@
  * own admin cannot change that switch; only its Manager, which writes the
  * files directly. A cascade that would move a locked switch is refused.
  *
+ * ## Off for the site, on for the hosting staff (`staff`)
+ *
+ *     { "wordpress-import": { "enabled": false, "locked": true, "staff": true } }
+ *
+ * `staff: true` on a Tool that is off keeps it open to a STAFF SESSION - one
+ * the site's Manager minted (services/staffAccess.js, `dcmStaff`) - and to
+ * nobody else, not even the site's own top role: its API answers a staff
+ * session (toolGate), its sidebar entry is shown to one only, and the admin
+ * route lets one in. Everyone else sees an ordinary switched-off Tool. The
+ * Manager writes it - hosted sites get the WordPress importer this way until
+ * it is gifted. It changes nothing the planner decides: a staff-only Tool is
+ * OFF to planSwitch().
+ *
  * @module services/tools
  */
 import {getConfig, saveConfig} from '../config.js';
@@ -84,6 +97,35 @@ export function isToolLocked(name) {
     return getToolStates()[name]?.locked === true;
 }
 
+/**
+ * Whether a Tool in this stored state is open to a viewer. Pure: on for
+ * everyone unless switched off; off with `staff: true` is still on for a
+ * staff session (services/staffAccess.js isDcmStaff) - and for nobody else.
+ *
+ * @param {{enabled?: boolean, staff?: boolean}|undefined} state
+ * @param {boolean} staffSession  isDcmStaff(request.user)
+ * @returns {boolean}
+ */
+export function toolOpenAt(state, staffSession) {
+    if (state?.enabled !== false) return true;
+    return state?.staff === true && staffSession === true;
+}
+
+/** @param {string} name  @returns {boolean} off for the site, kept open to staff sessions (`staff`) */
+export function isToolStaffOnly(name) {
+    const s = getToolStates()[name];
+    return s?.enabled === false && s?.staff === true;
+}
+
+/**
+ * @param {string} name
+ * @param {boolean} staffSession  isDcmStaff(request.user)
+ * @returns {boolean}
+ */
+export function isToolOpenTo(name, staffSession) {
+    return toolOpenAt(getToolStates()[name], staffSession);
+}
+
 /**
  * @param {string} name
  * @param {{enabled?: boolean, locked?: boolean}} patch
@@ -121,7 +163,8 @@ export function switchableUnits({manifests = [], pluginStates = {}, toolStates =
     for (const t of CORE_TOOLS) {
         const s = toolStates[t.name] || {};
         units.set(t.name, {name: t.name, kind: 'tool', displayName: t.displayName, icon: t.icon,
-            enabled: s.enabled !== false, locked: s.locked === true, requires: [], uses: {}, supersedes: [], closedSource: false});
+            enabled: s.enabled !== false, locked: s.locked === true, staff: s.enabled === false && s.staff === true,
+            requires: [], uses: {}, supersedes: [], closedSource: false});
     }
     for (const m of manifests) {
         if (!m?.name || units.has(m.name)) continue;

package/server/services/wpImport/index.js

@@ -45,7 +45,9 @@
  * The home page (./front.js): the page WordPress showed at its home address
  * becomes this site's home page. The page at "/" before is moved to
  * /previous-home as a draft - never deleted, never overwritten - by the first
- * run that does it, and never again (mapping `home`). That move leaves the
+ * run that does it, and never again unless the person says Yes to the preview's
+ * question (an earlier import set the home page and this export's front page is
+ * another page; a run without the answer is refused). That move leaves the
  * menus' "/" alone and adds no redirect (renamePage's `redirect: false`).
  *
  * The one request hook here answers WordPress's query addresses (/?p=12,
@@ -295,11 +297,13 @@ export async function siteState(mapping = {}, source = '') {
     try { searchOn = getSearchSettings().enabled !== false; } catch { /* no search settings */ }
     const seo = seoEngine();
     // The users here - only what matching an author needs (never a password or a token).
-    // The home page set by an import of ANOTHER WordPress site: once per site, not once per export.
+    // The home page set by an import of ANOTHER WordPress site (the latest, when several did): the plan asks
+    // before this export's front page takes its place.
     let homeSetBy = null;
     try {
         for (const [key, src] of Object.entries((await readMap()).sources || {})) {
-            if (key !== source && src?.items?.home?.kind === 'home') { homeSetBy = {...src.items.home, source: key}; break; }
+            const rec = src?.items?.home;
+            if (key !== source && rec?.kind === 'home' && (!homeSetBy || String(rec.at || '') > String(homeSetBy.at || ''))) homeSetBy = {...rec, source: key};
         }
     } catch { /* no imports yet */ }
     const users = (await listUsers().catch(() => [])).map(u => ({id: u.id, email: String(u.email || '').toLowerCase(), name: u.name || ''}));
@@ -454,7 +458,9 @@ export function cleanOptions(o = {}) {
         // confirmed (its WordPress id - the plan accepts only the one it suggests), the latest posts instead.
         home: o.home !== false,
         postsPage: Number.isInteger(o.postsPage) && o.postsPage > 0 && o.postsPage < 1e12 ? o.postsPage : 0,
-        latestPosts: o.latestPosts === true
+        latestPosts: o.latestPosts === true,
+        // The answer to the home page question (plan.home.question): true, false, or not answered.
+        homeReplace: typeof o.homeReplace === 'boolean' ? o.homeReplace : null
     };
 }
 
@@ -508,6 +514,11 @@ export async function startRun(id, options, user, log = console) {
         if (pre.plan.options.media === 'zip' && !pre.meta.uploads) {
             throw Object.assign(new Error('Upload the wp-content/uploads zip first, or choose another media source.'), {statusCode: 400});
         }
+        // Whether this export's front page replaces the home page an earlier import set is never assumed.
+        const q = pre.plan.home?.question;
+        if (q && typeof q.answer !== 'boolean') {
+            throw Object.assign(new Error(`Answer the home page question first: make "${q.title}" the home page instead of "${q.current || 'the page at /'}"?`), {statusCode: 400});
+        }
     } catch (err) {
         running = null;
         throw err;
@@ -709,6 +720,11 @@ async function runPhases(job, {plan, wxr, oldMapping, meta, inviteOrigin, wie},
     for (const r of docRows) {
         if (!works(r) && r.moveFrom && homeOutcome?.error) { set(r.key, {result: 'failed', error: homeOutcome.error}); continue; }
         if (!works(r)) {
+            if (r.movedAside) {
+                // The home page until now, moved aside by runHome (which followed it in the mapping) - or still at "/" if that failed.
+                set(r.key, {result: 'kept', target: mapping.items[r.key]?.path || r.target});
+                continue;
+            }
             if (r.action === 'keep') {
                 // Moved to "/" by this run (the home page), its edits here left as they are.
                 mapping.items[r.key] = r.moveFrom && homeOutcome?.moved ? {...oldMapping.items[r.key], path: r.target} : oldMapping.items[r.key];
@@ -752,7 +768,11 @@ async function runPhases(job, {plan, wxr, oldMapping, meta, inviteOrigin, wie},
     // The new home page was not made: the one moved aside for it goes back.
     if (homeOutcome?.moved && homeOutcome.previous && results.get(homeOutcome.key)?.result === 'failed') {
         await putHomeBack(homeOutcome, mapping, user?.email || 'WordPress import');
-        if (homeOutcome.restored) (results.get(homeOutcome.key).notes ||= []).push('The home page from before was put back at /.');
+        if (homeOutcome.restored) {
+            (results.get(homeOutcome.key).notes ||= []).push('The home page from before was put back at /.');
+            // A page of this import's that was moved aside for it is back at "/" too.
+            for (const r of plan.items) if (r.movedAside && results.get(r.key)) results.set(r.key, {...results.get(r.key), target: mapping.items[r.key]?.path || '/'});
+        }
     }
 
     await checkpoint(true);
@@ -1118,8 +1138,10 @@ async function runPhases(job, {plan, wxr, oldMapping, meta, inviteOrigin, wie},
  */
 async function runHome({plan, mapping, oldMapping, user, results}) {
     const claim = plan.items.find(r => (r.front || r.homeLatest) && r.target === '/' && r.action !== 'skip');
-    if (!claim || oldMapping.items?.home?.kind === 'home') return null;
-    const out = {moved: false, previous: '', title: '', status: '', from: claim.moveFrom || '', key: claim.key};
+    // Set by an earlier run of this import: moved again only when the person said Yes to the question.
+    if (!claim || (oldMapping.items?.home?.kind === 'home' && plan.home?.question?.answer !== true)) return null;
+    // The record of the home page before (put back if this one cannot be made).
+    const out = {moved: false, previous: '', title: '', status: '', from: claim.moveFrom || '', key: claim.key, priorHome: oldMapping.items?.home || null};
     const author = user?.email || 'WordPress import';
     try {
         const move = plan.home?.move;
@@ -1146,6 +1168,11 @@ async function runHome({plan, mapping, oldMapping, user, results}) {
             await followRename(claim.moveFrom, '/');
             followInMapping(mapping, claim.moveFrom, '/');
             await relinkMenus(claim.moveFrom, '/').catch(() => {});
+            // Left as it is (edited here), it may be a draft - an earlier home page change moved it aside as one.
+            // Chosen as the home page, it is published: a draft at "/" would leave the site without one.
+            if (claim.action === 'keep' && (await getPage('/').catch(() => null))?.status === 'draft') {
+                await updatePage('/', {status: 'published'}, undefined, {author});
+            }
         }
         out.moved = true;
         mapping.items.home = {kind: 'home', how: claim.homeLatest ? 'latest' : 'page', wpId: claim.wpId || 0, previous: out.previous, at: new Date().toISOString()};
@@ -1170,7 +1197,8 @@ async function putHomeBack(out, mapping, author) {
         await followRename(out.previous, '/');
         followInMapping(mapping, out.previous, '/');
         await updatePage('/', {status: out.status || 'published', slug: 'index'}, undefined, {author});
-        delete mapping.items.home;
+        if (out.priorHome) mapping.items.home = out.priorHome;
+        else delete mapping.items.home;
         out.restored = true;
         out.moved = false;
         out.previous = '';

package/server/services/wpImport/plan.js

@@ -28,7 +28,11 @@
  * The home page (./front.js, plan.home): the page WordPress showed at its home
  * address becomes this site's home page (options.home, on by default when one
  * is found); the page there now moves to /previous-home as a draft - once, on
- * the first run that does it (mapping `home`), never again. A suggested posts
+ * the first run that does it (mapping `home`), never again without asking: when
+ * an earlier import set the home page and this export's front page is another
+ * page, plan.home.question asks (options.homeReplace, no default - the run is
+ * refused until it is answered). Yes moves the home page aside the same way;
+ * No imports the page at its own address. A suggested posts
  * page, once confirmed (options.postsPage), is not made: its old address leads
  * to the Blog. With no front page, the latest posts can be the home page
  * (options.latestPosts, a page holding the Blog's [blog-list]).
@@ -231,6 +235,8 @@ export function isoDate(gmt, local) {
  * @param {boolean} [options.home=true] - the WordPress front page becomes this site's home page
  * @param {number} [options.postsPage] - the suggested posts page, confirmed (its WordPress id)
  * @param {boolean} [options.latestPosts=false] - no front page: the latest posts on the home page
+ * @param {boolean|null} [options.homeReplace=null] - the answer to plan.home.question: make this export's
+ *   front page the home page instead of the one an earlier import set (null: not answered)
  * @param {string|null} [site.homeTitle] - the title of the page at / now (null: none)
  * @returns {object}
  */
@@ -239,7 +245,7 @@ export function planImport(wxr, site, mapping = {}, options = {}) {
         posts: site.blog?.available ? 'blog' : 'pages',
         media: 'download', comments: true, menus: true, redirects: true, drafts: true, products: true, choices: {}, zipPaths: null,
         types: {}, listPages: {}, users: {}, userRole: '', invite: false, footer: {}, wie: null,
-        home: true, postsPage: 0, latestPosts: false,
+        home: true, postsPage: 0, latestPosts: false, homeReplace: null,
         ...options
     };
     opt.types ||= {};
@@ -311,9 +317,11 @@ export function planImport(wxr, site, mapping = {}, options = {}) {
     const depthOf = (it, seen = new Set()) => (it.parent && byId.has(it.parent) && !seen.has(it.id) ? 1 + depthOf(byId.get(it.parent), seen.add(it.id)) : 0);
     const orderedPages = [...pages].sort((a, b) => depthOf(a) - depthOf(b) || a.order - b.order || a.id - b.id);
     // ---- The home page: WordPress's front page, its posts page (./front.js) ----
-    // `home` in the mapping: an earlier run set this site's home page - it is never moved again.
-    // An import of another WordPress site that set it counts too (site.homeSetBy): once per site.
-    const homeRec = mapped.home?.kind === 'home' ? mapped.home : site.homeSetBy?.kind === 'home' ? site.homeSetBy : null;
+    // `home` in the mapping: an earlier run set this site's home page - it is not moved again without asking.
+    // An import of another WordPress site that set it counts too (site.homeSetBy): the latest one is the home page.
+    const ownHome = mapped.home?.kind === 'home' ? mapped.home : null;
+    const otherHome = site.homeSetBy?.kind === 'home' ? site.homeSetBy : null;
+    const homeRec = otherHome && (!ownHome || String(otherHome.at || '') > String(ownHome.at || '')) ? otherHome : ownHome;
     const leftAsIs = homeRec?.source
         ? `An earlier import (of ${homeRec.source}) set this site's home page - it is left as it is.`
         : 'This site\'s home page was changed here since the last import - it is left as it is.';
@@ -326,15 +334,34 @@ export function planImport(wxr, site, mapping = {}, options = {}) {
     const latestOffered = !front && !frontMatches && opt.posts === 'blog' && Boolean(site.shortcodes?.has('blog-list'));
     let homeMove = null;
     let homeChanged = '';
-    /** Something of this run's takes "/" for the first time: the page there now moves to /previous-home (-2…), never deleted. */
-    const claimHome = () => {
-        if (site.pagePaths.has('/') && !ownPaths.has('/')) {
+    /**
+     * Something of this run's takes "/": the page there now moves to /previous-home (-2…), never deleted.
+     * `replace`: the person said Yes to the question - even a page an earlier run of this import put there moves.
+     */
+    const claimHome = (replace = false) => {
+        if (homeMove) return;
+        if (site.pagePaths.has('/') && (replace || !ownPaths.has('/'))) {
             const to = freePath('/previous-home', takenPaths);
             takenPaths.add(to);
             takenPaths.delete('/');
             homeMove = {from: '/', to};
         }
     };
+    // ---- The question: an earlier import set the home page, and this export's front page is another page ----
+    const frontKey = front ? `page:${front.id}` : '';
+    const frontWas = front ? mapped[frontKey] : null;
+    // Deleted here since an earlier run made it: not imported, or ("Import again") brought back at its old address -
+    // either way it does not take "/", so there is nothing to ask.
+    const frontGone = Boolean(frontWas?.path && !site.pagePaths.has(frontWas.path));
+    // The same page this import made the home page (a re-run), or already at "/" anyway: nothing to ask.
+    const sameHome = Boolean(homeRec && !homeRec.source && homeRec.how !== 'latest' && Number(homeRec.wpId) === front?.id);
+    const frontIsHome = frontWas?.path === '/' && site.pagePaths.has('/');
+    const askHome = Boolean(front && opt.home && choices[frontKey] !== 'skip' && !frontGone && homeRec && !sameHome && !frontIsHome && site.pagePaths.has('/'));
+    const homeAnswer = askHome && typeof opt.homeReplace === 'boolean' ? opt.homeReplace : null;
+    const replaceHome = homeAnswer === true;
+    // Yes: what is at "/" moves aside before any page is planned, so a page of this import's that is there now
+    // is planned at its new address (planDocument), not over the new home page.
+    if (replaceHome) claimHome(true);
     const homeAddress = (it) => {
         const p = oldPathOf(it.link, wxr.site);
         return p !== null && relative(p, base) === '/';
@@ -807,8 +834,8 @@ export function planImport(wxr, site, mapping = {}, options = {}) {
         const here = was?.path && site.pagePaths.has(was.path) ? was.path : '';
         const slugPath = slugAddress(it);
         let row;
-        if (homeRec) {
-            // Set by an earlier run: never moved again.
+        if (homeRec && !replaceHome) {
+            // Set by an earlier run: never moved again (unless the person said Yes to the question).
             if (here && here !== '/') homeChanged = `This site's home page was changed here since the last import - "${it.title || 'the home page'}" stays at ${here}.`;
             let wanted = '/';
             if (!here && takenPaths.has('/')) {
@@ -816,9 +843,11 @@ export function planImport(wxr, site, mapping = {}, options = {}) {
                 homeChanged = leftAsIs;
             }
             row = planDocument({it, key, kind: 'page', wanted, oldPath, statusMap: PAGE_STATUS});
+            // Asked: No keeps this site's home page and the page arrives at its own address; unanswered, the card asks.
+            if (askHome) homeChanged = homeAnswer === false ? `You chose to keep this site's home page - "${it.title || 'the page'}" is imported${row.target ? ` at ${row.target}` : ''}.` : '';
         } else {
             // Deleted here since an earlier run made it (not as the home page): that is the person's call, as for any page.
-            if (!was?.path || here) claimHome();
+            if (!was?.path || here) claimHome(replaceHome);
             row = planDocument({it, key, kind: 'page', wanted: '/', oldPath, statusMap: PAGE_STATUS});
             // Imported before at another address (not as the home page then): it moves to "/".
             if (here && here !== '/' && row.action !== 'skip') {
@@ -843,6 +872,8 @@ export function planImport(wxr, site, mapping = {}, options = {}) {
             page: front ? {wpId: front.id, title: front.title || '(untitled)', oldUrl: front.link, target: frontRow?.target || '', action: frontRow?.action || 'skip', isHome: frontRow?.target === '/' && frontRow.action !== 'skip'} : null,
             now: site.pagePaths.has('/') ? {title: site.homeTitle ?? ''} : null,
             move: homeMove,
+            // An earlier import set the home page and this front page is another: asked, never assumed.
+            question: askHome ? {title: front.title || '(untitled)', current: site.homeTitle ?? '', answer: homeAnswer} : null,
             done: homeRec ? {how: homeRec.how || 'page', previous: homeRec.previous || '', source: homeRec.source || ''} : null,
             changed: homeChanged,
             latest: {offered: latestOffered, on: Boolean(latestOffered && opt.latestPosts), target: latestRow?.target || '', action: latestRow?.action || ''},
@@ -869,6 +900,11 @@ export function planImport(wxr, site, mapping = {}, options = {}) {
         if (it.password) row.status = 'draft';
         const was = mapped[key];
         const why = excluded(it);
+        // The home page until now, made by an earlier run of this import: Yes to the question moves it aside as a draft.
+        if (replaceHome && homeMove && was?.path === '/' && key !== frontKey && site.pagePaths.has('/')) {
+            return push({...row, action: 'keep', target: homeMove.to, movedAside: true,
+                reason: `This site's home page until now - it moves to ${homeMove.to} as a draft, nothing is deleted.`});
+        }
         if (choices[key] === 'skip') return push({...row, action: 'skip', reason: 'You chose to skip it.'});
         if (why) return push({...row, action: 'skip', reason: why});
         if (was?.path) {