domma-cms 1.8.12 → 1.8.14

package/server/routes/api/plugin-marketplace.js

@@ -112,8 +112,7 @@ export async function pluginMarketplaceRoutes(fastify) {
             // bare "Installation failed." while Install from file showed it.
             const safe = err.expose === true || [
                 'Plugin already installed', 'Plugin signature invalid', 'Unknown public key',
-                'Invalid plugin slug', 'Refusing to downgrade', 'Refusing to upgrade',
-                'This site accepts signed plugins only'
+                'Invalid plugin slug', 'Refusing to downgrade', 'Refusing to upgrade'
             ].some(m => err.message.startsWith(m));
             return reply.code(400).send({ error: safe ? err.message : 'Installation failed.' });
         }

package/server/routes/api/plugins.js

@@ -2,6 +2,7 @@
  * Plugins API
  * GET  /api/plugins              - list all discovered plugins + state (admin only)
  * GET  /api/plugins/_count       - the sidebar badge (`_` is outside the slug alphabet)
+ * GET  /api/plugins/_policy      - {signedOnly}: what the screens may offer (services/codePolicy.js)
  * POST /api/plugins/scaffold     - create a new plugin from plugins/_template (admin only)
  * PUT  /api/plugins/:name        - enable/disable, update settings (admin only)
  * GET  /api/plugins/admin-config - sidebar/routes/views for enabled plugins (authenticated)
@@ -27,6 +28,7 @@ import {getToolStates, planSwitch, requiresOf, switchableUnits, usesOf} from '..
 import {applyCascade} from './tools.js';
 import {scaffoldPlugin} from '../../services/pluginScaffold.js';
 import {deletePluginFile, listPluginFiles, readPluginFile, writePluginFile} from '../../services/pluginFiles.js';
+import {signedOnly, signedOnlyError} from '../../services/codePolicy.js';
 import {getConfig} from '../../config.js';
 import path from 'path';
 import {existsSync, readFileSync} from 'node:fs';
@@ -217,6 +219,10 @@ export async function pluginsRoutes(fastify, opts = {}) {
     const canUpdate  = { preHandler: [authenticate, requirePermission('plugins', 'update')]  };
     const canDevelop = { preHandler: [authenticate, requirePermission('plugins', 'develop')] };
 
+    // A signed-only refusal carries its code so a screen can tell it from a failure.
+    const mapErr = (reply, err) => reply.status(err.statusCode || 500)
+        .send({ error: err.message, ...(err.code === 'signed-only' && {code: err.code}) });
+
     // List all plugins with their current state
     fastify.get('/plugins', canRead, async (request) => {
         const manifests = await discoverPlugins();
@@ -286,6 +292,12 @@ export async function pluginsRoutes(fastify, opts = {}) {
         return pluginsBadge(plugins, await latestVersions());
     });
 
+    // What this site lets its admin do with plugin code. A signed-only site
+    // (services/codePolicy.js) refuses New plugin, unsigned uploads and code
+    // edits - the screens ask so they can leave those off rather than offer
+    // them and show the refusal. The refusal is the guard, not this.
+    fastify.get('/plugins/_policy', canRead, async () => ({signedOnly: signedOnly()}));
+
     // Scaffold a new plugin from plugins/_template. The plugin is created
     // pre-enabled so it goes live on the next server restart (its routes and
     // admin views only register at boot - same restart rule as enable/disable).
@@ -296,7 +308,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
             savePluginState(result.name, { enabled: true });
             return { success: true, name: result.name, files: result.files, restartRequired: true };
         } catch (err) {
-            return reply.status(err.statusCode || 500).send({ error: err.message });
+            return mapErr(reply, err);
         }
     });
 
@@ -371,13 +383,12 @@ export async function pluginsRoutes(fastify, opts = {}) {
     });
 
     // Return merged admin config (sidebar, routes, views) for enabled plugins
-    fastify.get('/plugins/admin-config', { preHandler: [authenticate] }, async () => {
-        return getAdminPluginConfig();
+    fastify.get('/plugins/admin-config', { preHandler: [authenticate] }, async (request) => {
+        return getAdminPluginConfig(request.user);
     });
 
     // ── In-admin code editor (plugins.develop - code execution grade) ──────
 
-    const mapErr = (reply, err) => reply.status(err.statusCode || 500).send({ error: err.message });
 
     /*
      * May this request read a LICENSED plugin's source?
@@ -388,7 +399,9 @@ export async function pluginsRoutes(fastify, opts = {}) {
      * without opening it on the sites they are distributed to. Level rather
      * than role name, the same way requireAdmin and canManageUser decide.
      */
-    const mayEditLicensed = (request) => !!request.user && getEffectiveLevel(request.user) === 0;
+    // A signed-only site is a hosted one, where level 0 is the customer - the
+    // assumption above does not hold there, so nobody reads licensed source.
+    const mayEditLicensed = (request) => !!request.user && getEffectiveLevel(request.user) === 0 && !signedOnly();
     const licensed = (request) => ({allowLicensed: mayEditLicensed(request)});
 
     // List a plugin's editable files
@@ -465,6 +478,14 @@ export async function pluginsRoutes(fastify, opts = {}) {
             return reply.code(400).send({error: err.message});
         }
 
+        // A signed-only site refuses an unsigned file outright - before the
+        // "already installed, update it?" question, which would otherwise be
+        // asked about something that can never be installed.
+        if (!parts.signature && signedOnly()) {
+            const err = signedOnlyError();
+            return reply.code(err.statusCode).send({error: err.message, code: err.code});
+        }
+
         // The slug comes from the manifest inside, never from the filename: a
         // file can be renamed by anyone, a manifest is what the installer then
         // validates against what was actually extracted.
@@ -496,6 +517,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
             });
         } catch (err) {
             fastify.log.warn({err}, '[plugins] upload install failed');
+            if (err.code === 'signed-only') return mapErr(reply, err);
             return reply.code(400).send({error: err.message});
         }
 

package/server/routes/api/sidebar.js

@@ -17,6 +17,7 @@
  * Auth middlewares are accepted as DI options so tests can supply no-ops.
  */
 import {authenticate as defaultAuthenticate, checkVisibility} from '../../middleware/auth.js';
+import {isDcmStaff} from '../../services/staffAccess.js';
 import {getRegisteredSidebarItems} from '../../services/hooks.js';
 import {filterItemsForUser, getMenu} from '../../services/menus.js';
 import {isDashboardPro} from '../../services/widgets.js';
@@ -60,6 +61,8 @@ export async function sidebarRoutes(fastify, opts = {}) {
                 ? {...entry, item: {...entry.item, text: boardLabel}}
                 : entry))
             .filter(entry => !entry?.item?.hidden && checkVisibility(request.user, entry?.item?.visibility))
+            // A staff-only Tool's entry (services/tools.js `staff`): the Manager's staff sessions only.
+            .filter(entry => !entry?.item?.staffOnly || isDcmStaff(request.user))
             .map(entry => Array.isArray(entry.item?.items)
                 ? {...entry, item: {...entry.item, items: filterItemsForUser(entry.item.items, request.user)}}
                 : entry);

package/server/routes/api/tools.js

@@ -2,7 +2,8 @@
  * Built-in Tool switches - Contacts, Notes, Todo, Analytics (services/tools.js).
  *
  * GET  /api/tools          - each built-in Tool, on/off, locked, and the plugins that depend on it (plugins.read)
- * GET  /api/tools/enabled  - {name: boolean}, for any signed-in user (plugin screens hide what needs a Tool that is off)
+ * GET  /api/tools/enabled  - {name: boolean}, for any signed-in user (plugin screens hide what needs a Tool that is off);
+ *                            a staff-only Tool (`staff: true`, services/tools.js) is true for a staff session only
  * PUT  /api/tools/:name    - {enabled, cascade?} (plugins.update). Answers 423 when the site's manager has
  *                            locked it, and 409 with the plan when the switch moves other Tools too - repeat
  *                            with `cascade: true` to apply. Restarts the site like a plugin switch does.
@@ -12,7 +13,10 @@ import {
     requirePermission as defaultRequirePermission
 } from '../../middleware/auth.js';
 import {discoverPlugins, getPluginStates, runLifecycleHook, savePluginState} from '../../services/plugins.js';
-import {CORE_TOOLS, getToolStates, isCoreTool, isToolEnabled, planSwitch, saveToolState, switchableUnits} from '../../services/tools.js';
+import {
+    CORE_TOOLS, getToolStates, isCoreTool, isToolEnabled, isToolStaffOnly, planSwitch, saveToolState, switchableUnits, toolOpenAt
+} from '../../services/tools.js';
+import {isDcmStaff, isStaffRequest} from '../../services/staffAccess.js';
 import {autoRestartEnabled, hasSupervisor, scheduleRestart} from './plugins.js';
 
 /**
@@ -39,15 +43,22 @@ export async function applyCascade(cascaded, fastify) {
  * the Tool's prefix; the inner routes must NOT be given it again, or every
  * route lands at /api/notes/api/notes/... (0.88.0 did exactly that on dcm).
  *
+ * Off with `staff: true` (services/tools.js) lets a staff session through
+ * (services/staffAccess.js) and nobody else - not the site's own top role;
+ * the routes' own authenticate/permission checks still run.
+ *
  * @param {string} name        the Tool (services/tools.js CORE_TOOLS)
  * @param {Function} routes    its Fastify plugin
  * @param {(name: string) => boolean} [isEnabled]
+ * @param {{isStaffOnly?: (name: string) => boolean, staffPass?: (request: object) => Promise<boolean>}} [opts]
  */
-export function toolGate(name, routes, isEnabled = isToolEnabled) {
+export function toolGate(name, routes, isEnabled = isToolEnabled, {isStaffOnly = isToolStaffOnly, staffPass = isStaffRequest} = {}) {
     const displayName = CORE_TOOLS.find(t => t.name === name)?.displayName || name;
     return async (scope) => {
         scope.addHook('onRequest', async (request, reply) => {
-            if (!isEnabled(name)) return reply.code(404).send({error: `${displayName} is switched off on this site.`});
+            if (isEnabled(name)) return;
+            if (isStaffOnly(name) && await staffPass(request)) return;
+            return reply.code(404).send({error: `${displayName} is switched off on this site.`});
         });
         await scope.register(routes);
     };
@@ -74,6 +85,8 @@ export async function toolsRoutes(fastify, opts = {}) {
                 ...t,
                 enabled: u.enabled,
                 locked: u.locked,
+                // Off for the site, kept open to the Manager's staff sessions.
+                staff: u.staff === true,
                 // Enabled plugins that stop, or lose something, if this goes off.
                 requiredBy: plugins.filter(p => p.enabled && p.requires.includes(t.name)).map(p => ({name: p.name, displayName: p.displayName})),
                 usedBy: plugins.filter(p => p.enabled && t.name in p.uses).map(p => ({name: p.name, displayName: p.displayName, reason: p.uses[t.name]}))
@@ -81,9 +94,10 @@ export async function toolsRoutes(fastify, opts = {}) {
         });
     });
 
-    fastify.get('/tools/enabled', {preHandler: [authenticate]}, async () => {
+    fastify.get('/tools/enabled', {preHandler: [authenticate]}, async (request) => {
         const states = getToolStates();
-        return Object.fromEntries(CORE_TOOLS.map(t => [t.name, states[t.name]?.enabled !== false]));
+        const staff = isDcmStaff(request.user);
+        return Object.fromEntries(CORE_TOOLS.map(t => [t.name, toolOpenAt(states[t.name], staff)]));
     });
 
     fastify.put('/tools/:name', canUpdate, async (request, reply) => {

package/server/server.js

@@ -4,7 +4,7 @@
  * Domma dist files are served directly from node_modules/domma-js/public/dist.
  * Updated: blobs + z-index fixes.
  */
-import 'dotenv/config';
+import './env.js';
 import Fastify from 'fastify';
 import jwt from '@fastify/jwt';
 import staticPlugin from '@fastify/static';
@@ -578,7 +578,7 @@ await app.register(scaffoldRoutes, {prefix: '/api'});
 // Each can be switched off (config/tools.json, services/tools.js): the gate is
 // read per request, so an API stops answering the moment the switch is saved,
 // before the restart that takes its sidebar entry and sources away.
-const {isToolEnabled} = await import('./services/tools.js');
+const {isToolEnabled, isToolStaffOnly} = await import('./services/tools.js');
 const {toolGate, toolsRoutes} = await import('./routes/api/tools.js');
 await app.register(toolGate('notes', notesRoutes), {prefix: '/api/notes'});
 await app.register(toolGate('todo', todoRoutes), {prefix: '/api/todo'});
@@ -635,7 +635,13 @@ await app.register(relatedRoutes, {prefix: '/api/related'});
 const {registerSidebarItem} = await import('./services/hooks.js');
 // `countUrl` is the badge: the sidebar fetches it and shows {count, label, tone}
 // (see fetchCounts in admin/js/lib/sidebar-renderer.js).
-// A built-in Tool switched off gets no entry (its switch restarts the site).
+// A built-in Tool switched off gets no entry (its switch restarts the site) - unless it is
+// off with `staff: true` (the Manager's lock on hosted sites): then the entry is there for
+// the Manager's staff sessions only (`staffOnly`, checked per viewer by /api/sidebar/registered-items).
+const toolEntry = (name, item) => {
+    if (isToolEnabled(name)) registerSidebarItem({item: {source: 'Built in', ...item}});
+    else if (isToolStaffOnly(name)) registerSidebarItem({item: {source: 'Built in', ...item, staffOnly: true}});
+};
 const coreToolItems = [
     {text: 'Notes', url: '#/notes', icon: 'edit-3', permission: 'notes', countUrl: '/api/notes/count'},
     {text: 'Todo', url: '#/todo', icon: 'check-square', permission: 'todo', countUrl: '/api/todo/count'},
@@ -644,12 +650,8 @@ const coreToolItems = [
     {text: 'Contacts', url: '#/contacts', icon: 'users', permission: 'contacts', countUrl: '/api/contacts/count', inventory: true},
     {text: 'SEO', url: '#/seo', icon: 'search', permission: 'seo', countUrl: '/api/seo/count'}
 ];
-for (const item of coreToolItems) {
-    if (isToolEnabled(item.permission)) registerSidebarItem({item: {source: 'Built in', ...item}});
-}
-if (isToolEnabled('wordpress-import')) {
-    registerSidebarItem({item: {source: 'Built in', text: 'Import from WordPress', url: '#/wordpress-import', icon: 'download', permission: 'import', countUrl: '/api/import/wordpress/count', inventory: true}});
-}
+for (const item of coreToolItems) toolEntry(item.permission, item);
+toolEntry('wordpress-import', {text: 'Import from WordPress', url: '#/wordpress-import', icon: 'download', permission: 'import', countUrl: '/api/import/wordpress/count', inventory: true});
 // Todo's to-dos on the calendar (registered when routes/api/todo.js loads).
 if (!isToolEnabled('todo')) {
     const {unregisterCalendarSource} = await import('./services/hooks.js');
@@ -747,6 +749,10 @@ await app.register(docsPublicRoutes);
 // An instant call's page, /_call/<id> (a reserved prefix, like /_preview) - before the catch-all.
 const { callPublicRoutes } = await import('./routes/call-public.js');
 await app.register(callPublicRoutes);
+// A staff session from the site's Manager (/_staff/open?ticket=…, services/staffAccess.js) - the one way
+// into a Tool switched off with `staff: true`. A ticket only works on a site its Manager started.
+const { staffAccessRoutes } = await import('./services/staffAccess.js');
+await app.register(staffAccessRoutes);
 
 // The outreach unsubscribe link (/campaign-unsubscribe) - core's, so it outlives the Tool that
 // sent the email. After the plugins: an older Campaigns Pro that registers it itself wins.

package/server/services/adapters/FileAdapter.js

@@ -23,6 +23,7 @@ import path from 'path';
 import { config } from '../../config.js';
 import { applyFilter } from '../filterEngine.js';
 import { withFileLock, writeFileAtomic } from './fileLock.js';
+import {fileIn} from '../safePath.js';
 
 const COLLECTIONS_DIR = path.resolve(config.content.collectionsDir);
 
@@ -31,7 +32,7 @@ const COLLECTIONS_DIR = path.resolve(config.content.collectionsDir);
 // ---------------------------------------------------------------------------
 
 function dataPath(slug) {
-    return path.join(COLLECTIONS_DIR, slug, 'data.json');
+    return path.join(fileIn(COLLECTIONS_DIR, slug), 'data.json');
 }
 
 async function read(slug) {

package/server/services/codePolicy.js

@@ -0,0 +1,111 @@
+/**
+ * Signed-only sites: who may put server-side code on this site.
+ *
+ * `config/server.json` `requireSignedPlugins: true` means the only plugin code
+ * this site runs is code the Marketplace signed. A hosted site (one a Domma CMS
+ * Manager runs) has it on, because its owner holds the top role there and a
+ * level-0 user who can run their own code can read the site's secrets - and
+ * with JWT_SECRET forge a Manager staff session (services/staffAccess.js).
+ * Self-hosted sites leave it off: there the owner IS the host.
+ *
+ * With it on, every way the admin had of getting its own JavaScript onto the
+ * server is refused here, at the service, so a second route or a plugin calling
+ * the same service cannot step round it:
+ *
+ *   - installing an unsigned .dcmsplugin (pluginInstaller.installPlugin)
+ *   - New plugin (pluginScaffold.scaffoldPlugin)
+ *   - writing or deleting a plugin's files in the code editor (pluginFiles)
+ *   - reading a LICENSED plugin's source as level 0 - on a hosted site level 0
+ *     is the customer, not the people who publish the plugin (routes/api/plugins.js)
+ *
+ * Three things say "on", and any one is enough - none can be undone from the
+ * site's own admin:
+ *
+ *   1. `DOMMA_SIGNED_ONLY=1` in the environment. The Manager sets it when it
+ *      forks a site it hosts (after the site's .env, so .env cannot unset it).
+ *      This is the one a file-write bug cannot touch.
+ *   2. server.json as it was at boot (config.server). Deleting or rewriting
+ *      the file while the site runs changes nothing until a restart.
+ *   3. server.json now, read fresh - so the Manager can switch a running site
+ *      on without restarting it.
+ *
+ * Nothing in the admin or the API writes server.json - it is the host's file.
+ * Keep it that way: a route that ever writes it must leave
+ * `requireSignedPlugins` exactly as it found it.
+ *
+ * @module services/codePolicy
+ */
+import {config, getConfig} from '../config.js';
+
+/** What the admin is told, whatever it tried. Plain words: it is the whole answer. */
+export const SIGNED_ONLY_MESSAGE = 'This site only runs plugins signed by the Marketplace, so plugin code cannot be uploaded, created or edited here. Install plugins from Browse.';
+
+/**
+ * Does this site refuse any plugin code the Marketplace has not signed?
+ *
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {boolean}
+ */
+export function signedOnly(env = process.env) {
+    if (env.DOMMA_SIGNED_ONLY === '1') return true;
+    if (config.server?.requireSignedPlugins === true) return true;
+    try {
+        return getConfig('server')?.requireSignedPlugins === true;
+    } catch {
+        return false;
+    }
+}
+
+/**
+ * The refusal, as an Error the routes map straight to a reply
+ * (`statusCode` 403, `code` 'signed-only', `expose` for the marketplace route).
+ *
+ * @returns {Error}
+ */
+export function signedOnlyError() {
+    return Object.assign(new Error(SIGNED_ONLY_MESSAGE), {statusCode: 403, code: 'signed-only', expose: true});
+}
+
+/** Throw the refusal when the site is signed-only. */
+export function assertMayChangeCode() {
+    if (signedOnly()) throw signedOnlyError();
+}
+
+/**
+ * MongoDB client options that reach outside the database: start a program
+ * (`autoEncryption.extraOptions.mongocryptdSpawnPath` / `...SpawnArgs`), load a
+ * native library (`cryptSharedLibPath`) or read a file off this server
+ * (`tlsCAFile`, `tlsCertificateKeyFile`, the old `ssl*` names). The admin
+ * writes connections.json (PUT /api/collections/connections) and the site -
+ * and the Manager's Data Manager - hand its `options` to `new MongoClient`.
+ * Today the spawn needs `mongodb-client-encryption`, which is not installed;
+ * this keeps it that way on a signed-only site whatever gets installed later.
+ */
+const RISKY_MONGO_OPTION = /^(autoEncryption|extraOptions|.*File|.*Path|.*SpawnArgs|ssl(CA|Cert|Key|CRL|PEMKeyFile|PEMKeyPassword)|cryptShared.*|mongocryptd.*)$/i;
+
+/**
+ * The risky option names in one stored connection (its `options`, at any depth,
+ * and its URI's query string). Empty when it is fine.
+ *
+ * @param {{uri?: string, options?: object}} conn
+ * @returns {string[]}
+ */
+export function riskyConnectionOptions(conn) {
+    const found = [];
+    const walk = (obj, at) => {
+        if (!obj || typeof obj !== 'object') return;
+        for (const [k, v] of Object.entries(obj)) {
+            const here = at ? `${at}.${k}` : k;
+            if (RISKY_MONGO_OPTION.test(k)) found.push(here);
+            else walk(v, here);
+        }
+    };
+    walk(conn?.options, 'options');
+    const query = String(conn?.uri || '').split('?')[1] || '';
+    for (const pair of query.split('&')) {
+        let key = pair.split('=')[0];
+        try { key = decodeURIComponent(key); } catch { /* keep it raw */ }
+        if (key && RISKY_MONGO_OPTION.test(key)) found.push(`uri ${key}`);
+    }
+    return found;
+}

package/server/services/collections.js

@@ -14,6 +14,7 @@ import {adapterForStorage, describeAdapter, getAdapter, invalidate, isFixedToFil
 import * as cache from './cache/index.js';
 import {typedEntryData} from './entryValues.js';
 import {toCsv} from '../../public/js/collection-export.mjs';
+import {fileIn} from './safePath.js';
 
 const COLLECTIONS_DIR = path.resolve(config.content.collectionsDir);
 const TOOL_TRASH_SLUGS = new Set(['notes-notes', 'todo-items', 'contacts-contacts']);
@@ -27,7 +28,7 @@ async function ensureDir() {
 }
 
 function collectionDir(slug) {
-    return path.join(COLLECTIONS_DIR, slug);
+    return fileIn(COLLECTIONS_DIR, slug);
 }
 
 function schemaPath(slug) {

package/server/services/components.js

@@ -7,6 +7,7 @@ import fs from 'fs/promises';
 import path from 'path';
 import {fileURLToPath} from 'url';
 import {getPluginComponents} from './hooks.js';
+import {fileIn} from './safePath.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const COMPONENTS_DIR = path.resolve(__dirname, '../../content/components');
@@ -28,7 +29,7 @@ function assertValidName(name) {
  * @param {string} name - Component name (without extension).
  * @returns {string}
  */
-function componentFilePath(name) { return path.join(COMPONENTS_DIR, `${name}.dmc`); }
+function componentFilePath(name) { return fileIn(COMPONENTS_DIR, name, '.dmc'); }
 
 /**
  * Absolute filesystem path to a component's companion .meta.json file.
@@ -36,7 +37,7 @@ function componentFilePath(name) { return path.join(COMPONENTS_DIR, `${name}.dmc
  * @param {string} name - Component name (without extension).
  * @returns {string}
  */
-function componentMetaPath(name) { return path.join(COMPONENTS_DIR, `${name}.meta.json`); }
+function componentMetaPath(name) { return fileIn(COMPONENTS_DIR, name, '.meta.json'); }
 
 /**
  * Split a .dmc source string into its four SFC blocks.

package/server/services/connectionManager.js

@@ -35,6 +35,14 @@ export async function initialise(connectionsConfig) {
             continue;
         }
 
+        // Written before the site went signed-only, or by hand: not used there.
+        const {riskyConnectionOptions, signedOnly} = await import('./codePolicy.js');
+        const risky = signedOnly() ? riskyConnectionOptions(cfg) : [];
+        if (risky.length) {
+            console.error(`[connectionManager] Skipping connection "${name}": ${risky.join(', ')} not allowed on a signed-only site`);
+            continue;
+        }
+
         try {
             const client = new MongoClient(cfg.uri, cfg.options || {});
             await client.connect();

package/server/services/content.js

@@ -501,7 +501,7 @@ function urlPathToFilePath(urlPath) {
     const normalised = urlPath === '/' || !urlPath ? 'index' : urlPath.replace(/^\//, '').replace(/\/$/, '');
     const result = path.join(PAGES_DIR, normalised + '.md');
     const resolved = path.resolve(result);
-    if (!resolved.startsWith(path.resolve(PAGES_DIR))) {
+    if (!resolved.startsWith(path.resolve(PAGES_DIR) + path.sep)) {
         throw new Error('Invalid path: outside content directory');
     }
     return result;

package/server/services/contextMenus.js

@@ -20,6 +20,7 @@ import path from 'path';
 import {fileURLToPath} from 'url';
 import * as cache from './cache/index.js';
 import {cssClassProblems} from '../../public/js/css-classes.mjs';
+import {fileIn} from './safePath.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const CONFIG_DIR = path.resolve(__dirname, '..', '..', 'config');
@@ -66,7 +67,7 @@ export async function ensureContextMenusDir() {
 }
 
 function ctxPath(slug) {
-    return path.join(CTX_DIR, `${slug}.json`);
+    return fileIn(CTX_DIR, slug, '.json');
 }
 
 async function readCtxFile(slug) {

package/server/services/forms.js

@@ -8,6 +8,7 @@ import path from 'path';
 import {fileURLToPath} from 'url';
 import * as cache from './cache/index.js';
 import {buttonSettingsProblems, formClassProblems} from '../../public/js/form-submit.mjs';
+import {fileIn} from './safePath.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT      = path.resolve(__dirname, '..', '..');
@@ -30,7 +31,7 @@ export async function ensureFormsDir() {
  * @throws {Error} If the form file does not exist or cannot be parsed.
  */
 export async function readForm(slug) {
-    const file = path.join(FORMS_DIR, `${slug}.json`);
+    const file = fileIn(FORMS_DIR, slug, '.json');
     return JSON.parse(await fs.readFile(file, 'utf8'));
 }
 
@@ -43,7 +44,7 @@ export async function readForm(slug) {
  */
 export async function writeForm(slug, data) {
     await ensureFormsDir();
-    const file = path.join(FORMS_DIR, `${slug}.json`);
+    const file = fileIn(FORMS_DIR, slug, '.json');
     await fs.writeFile(file, JSON.stringify(data, null, 4) + '\n', 'utf8');
     await cache.invalidateTags([`form:${slug}`]);
 }
@@ -83,7 +84,7 @@ export async function listForms() {
  * @throws {Error} If the form file does not exist.
  */
 export async function deleteForm(slug) {
-    await fs.unlink(path.join(FORMS_DIR, `${slug}.json`));
+    await fs.unlink(fileIn(FORMS_DIR, slug, '.json'));
     await cache.invalidateTags([`form:${slug}`]);
 }
 

package/server/services/menus.js

@@ -21,6 +21,7 @@ import {
     LEGACY_STYLE_HOVER, LEGACY_STYLE_ACTIVE, legacyStyleHighlight,
     PRESET_COLOUR_VARS, PRESET_COLOUR_FALLBACKS, colourToCss, cssClassProblems
 } from '../../public/js/menu-decor.mjs';
+import {fileIn} from './safePath.js';
 
 /**
  * Bust the response-cache tags that menu changes affect. Public pages are
@@ -472,7 +473,7 @@ export async function ensureMenusDir() {
 }
 
 function menuPath(slug) {
-    return path.join(MENUS_DIR, `${slug}.json`);
+    return fileIn(MENUS_DIR, slug, '.json');
 }
 
 async function readMenuFile(slug) {

package/server/services/pluginFiles.js

@@ -13,13 +13,16 @@
  * exception is a SUPER-ADMIN (role level 0), which on the fleet exists only on
  * the manager: the people who publish the paid plugins are the people who need
  * to read and edit them. Customer sites are all level 1, so nothing changes
- * there - see the `allowLicensed` argument, set from the request's user.
+ * there - see the `allowLicensed` argument, set from the request's user. (Hosted
+ * owners are in fact level 0 on their own site: on a signed-only site the route
+ * never allows licensed source - services/codePolicy.js.)
  *
  * Thrown errors carry `statusCode` (400 invalid, 403 licensed, 404 missing,
  * 413 too large) for direct mapping in the route layer.
  */
 import fs from 'fs/promises';
 import path from 'path';
+import {assertMayChangeCode} from './codePolicy.js';
 
 const PLUGINS_DIR = path.resolve('plugins');
 
@@ -200,6 +203,8 @@ export async function readPluginFile(name, relPath, {allowLicensed = false} = {}
  * @returns {Promise<{path: string, restartRequired: boolean}>}
  */
 export async function writePluginFile(name, relPath, content, {allowLicensed = false} = {}) {
+    // A signed-only site runs the Marketplace's code as signed: nothing here may change it.
+    assertMayChangeCode();
     const pluginDir = await resolvePluginDir(name, allowLicensed);
     const abs = await resolveFilePath(pluginDir, relPath);
 
@@ -240,6 +245,8 @@ export async function writePluginFile(name, relPath, content, {allowLicensed = f
  * @returns {Promise<{path: string}>}
  */
 export async function deletePluginFile(name, relPath, {allowLicensed = false} = {}) {
+    // A signed-only site runs the Marketplace's code as signed: nothing here may change it.
+    assertMayChangeCode();
     const pluginDir = await resolvePluginDir(name, allowLicensed);
     const abs = await resolveFilePath(pluginDir, relPath);
     const rel = path.relative(pluginDir, abs).split(path.sep).join('/');

package/server/services/pluginInstaller.js

@@ -16,9 +16,9 @@ import {readFileSync} from 'fs';
 import path from 'path';
 import zlib from 'zlib';
 import {fileURLToPath} from 'url';
-import {getConfig} from '../config.js';
 import {discoverPlugins, pluginRoleHooks, unregisterAllRolesForPlugin, validatePluginDir} from './plugins.js';
 import {allowInGitignore, manifestContentPaths, pluginContentRules} from './siteGitignore.js';
+import {signedOnly, signedOnlyError} from './codePolicy.js';
 
 // ---------------------------------------------------------------------------
 // Paths
@@ -74,18 +74,14 @@ MCowBQYDK2VwAyEAqAlx1lfHeCaNiwJmoXZMDY56yafU2GlpNG3VInw9Q14=
  * Does this site refuse anything the marketplace has not signed?
  *
  * Default false, because a CMS whose own scaffolder produces unsigned plugins
- * cannot refuse unsigned plugins without refusing its user's own work. A fleet
- * site should set it true: everything it receives arrives by push-copy, and
- * nothing legitimate is ever uploaded there.
+ * cannot refuse unsigned plugins without refusing its user's own work. A hosted
+ * site has it on (services/codePolicy.js - the one place that decides, and the
+ * other doors it closes).
  *
  * @returns {boolean}
  */
 function requireSignedPlugins() {
-    try {
-        return getConfig('server')?.requireSignedPlugins === true;
-    } catch {
-        return false;
-    }
+    return signedOnly();
 }
 
 /**
@@ -348,12 +344,12 @@ export async function installPlugin(slug, { tarball, signature, publicKeyId, all
     // Step 1 - Verify signature, or establish that there is deliberately none.
     const unsigned = !signature;
     if (unsigned) {
+        // Signed-only first: asking the admin to confirm something the site will
+        // refuse anyway would be a question with no right answer.
+        if (requireSignedPlugins()) throw signedOnlyError();
         if (!allowUnsigned) {
             throw new Error('This plugin is unsigned. Installing it runs its code on this server, so it has to be confirmed.');
         }
-        if (requireSignedPlugins()) {
-            throw new Error('This site accepts signed plugins only (server.json: requireSignedPlugins).');
-        }
     }
 
     const pubKeyPem = unsigned ? null : trustedKey(publicKeyId, 'bundle');
@@ -396,7 +392,14 @@ export async function installPlugin(slug, { tarball, signature, publicKeyId, all
         throw err;
     }
 
-    // Step 4 - Validate manifest
+    // Step 4 - Validate manifest. discoverPlugins() names a plugin after its
+    // folder, so it cannot tell a bundle installed under someone else's slug -
+    // the manifest inside must name this slug itself (as an upgrade checks).
+    const own = await validatePluginDir(destDir, slug);
+    if (!own.ok) {
+        await fs.rm(destDir, { recursive: true, force: true });
+        throw new Error(`Plugin manifest validation failed after extraction: ${slug} (${own.reason})`);
+    }
     const manifests = await discoverPlugins();
     const manifest = manifests.find(m => m.name === slug);
     if (!manifest) {

package/server/services/pluginScaffold.js

@@ -12,6 +12,7 @@
 import fs from 'fs/promises';
 import path from 'path';
 import {allowInGitignore, sitePluginRules} from './siteGitignore.js';
+import {assertMayChangeCode} from './codePolicy.js';
 
 const PLUGINS_DIR = path.resolve('plugins');
 const TEMPLATE_DIR = path.join(PLUGINS_DIR, '_template');
@@ -71,6 +72,8 @@ export function validateScaffoldInput(input = {}) {
  * @returns {Promise<{name: string, files: string[]}>} Created plugin name and relative file list
  */
 export async function scaffoldPlugin(input) {
+    // A new plugin is new server code: a signed-only site makes none (services/codePolicy.js).
+    assertMayChangeCode();
     const { slug, displayName, description, author, icon } = validateScaffoldInput(input);
 
     try {