domma-cms 1.8.12 → 1.8.14

package/server/services/plugins.js

@@ -45,10 +45,11 @@ import * as defaultRolesService from './roles.js';
 import {getAdminScope, normaliseAdminScope} from './roles.js';
 import {authenticateFor} from './pluginScope.js';
 import {getEffectiveRoles} from './userRoles.js';
+import {isDcmStaff} from './staffAccess.js';
 import * as defaultUsersService from './users.js';
 import {registerLoginCheck, registerPasswordCheck} from './authChecks.js';
 import {invalidateTags as cacheInvalidateTags} from './cache/index.js';
-import {CORE_TOOLS, getToolStates, unmetRequirements} from './tools.js';
+import {CORE_TOOLS, getToolStates, toolOpenAt, unmetRequirements} from './tools.js';
 
 const PLUGINS_DIR = path.resolve('plugins');
 
@@ -1353,7 +1354,10 @@ export function viewSection(manifest, viewName) {
     return text && text !== (manifest.displayName || manifest.name) ? text : '';
 }
 
-export async function getAdminPluginConfig() {
+/**
+ * @param {object} [viewer]  request.user - a staff-only Tool (services/tools.js) is on for a staff session only
+ */
+export async function getAdminPluginConfig(viewer = null) {
     const manifests = await discoverPlugins();
     const states = getPluginStates();
 
@@ -1432,10 +1436,12 @@ export async function getAdminPluginConfig() {
         }
     }
 
-    // Built-in Tools and whether each is on, so the admin can turn a link to a
-    // switched-off one away (services/tools.js).
+    // Built-in Tools and whether each is on FOR THIS VIEWER, so the admin can
+    // turn a link to a switched-off one away (services/tools.js; `staff: true`
+    // keeps one open to the Manager's staff sessions).
     const toolStates = getToolStates();
-    const tools = Object.fromEntries(CORE_TOOLS.map(t => [t.name, {displayName: t.displayName, enabled: toolStates[t.name]?.enabled !== false}]));
+    const staff = isDcmStaff(viewer);
+    const tools = Object.fromEntries(CORE_TOOLS.map(t => [t.name, {displayName: t.displayName, enabled: toolOpenAt(toolStates[t.name], staff)}]));
 
     return { sidebar, routes, views, css, meta, takeovers: getToolTakeovers(), tools };
 }

package/server/services/safePath.js

@@ -0,0 +1,35 @@
+/**
+ * One name, one file, inside one folder.
+ *
+ * Fastify DECODES route params, so `/api/forms/..%2F..%2Fconfig%2Fserver`
+ * arrives as the slug `../../config/server`. A store that builds its file as
+ * `path.join(DIR, `${slug}.json`)` then reads and writes `config/server.json` -
+ * which is how a site admin could rewrite the host's own settings (switching
+ * `requireSignedPlugins` off, unlocking a Tool) through an ordinary form save.
+ * Routes check slugs in most places; this is the check at the file, so a route
+ * that forgets is still safe.
+ *
+ * @module services/safePath
+ */
+import path from 'path';
+
+/**
+ * The file `<dir>/<name><ext>`, refusing any name that is not one plain path
+ * segment (a separator, `.`/`..`, a NUL, empty, or not a string).
+ *
+ * @param {string} dir
+ * @param {string} name
+ * @param {string} [ext]  e.g. '.json'; '' for a folder
+ * @returns {string}
+ * @throws {Error} statusCode 404 - to a caller, a name like that names nothing
+ */
+export function fileIn(dir, name, ext = '') {
+    const root = path.resolve(dir);
+    const ok = typeof name === 'string' && name !== '' && name !== '.' && name !== '..'
+        && !/[\\/\0]/.test(name);
+    const file = ok ? path.join(root, `${name}${ext}`) : null;
+    if (!file || path.dirname(file) !== root) {
+        throw Object.assign(new Error(`Not found: ${String(name).slice(0, 80)}`), {statusCode: 404, code: 'ENOENT'});
+    }
+    return file;
+}

package/server/services/staffAccess.js

@@ -0,0 +1,131 @@
+/**
+ * Staff sessions - the hosting company's staff (the people at the site's
+ * Domma CMS Manager), as opposed to anyone the site itself has made.
+ *
+ * A Tool switched off with `staff: true` (services/tools.js) is open to a
+ * staff session only. A site's own users - its owner included, though the
+ * owner holds the top role - never are: a staff session is something only the
+ * Manager can mint, never a role or a user field the site could give itself.
+ *
+ * ## How a staff session starts
+ *
+ * The Manager signs a one-time TICKET with the site's own JWT_SECRET (as its
+ * Data Manager already does for its loopback calls) and sends the staff
+ * member's browser to `GET /_staff/open?ticket=…`:
+ *
+ *     {type: 'staff-ticket', dcmStaff: true, site: <SITE_SLUG>, by, jti, to, exp: +60 s}
+ *
+ * This route checks the signature and expiry, that `site` is this site's
+ * SITE_SLUG (set only by the Manager that forked it - an unmanaged site has
+ * none and refuses every ticket), that `to` is a screen it opens, and that
+ * the ticket has not been used; then it hands the browser a one-hour access
+ * token `{id: 'dcm-staff', role: <top role>, type: 'access', dcmStaff: true,
+ * site}` and opens the admin at `to`. No refresh token: the session ends.
+ *
+ * Anyone who can read the site's JWT_SECRET (shell access, or code running in
+ * the site's process - which includes a level-0 user installing an unsigned
+ * plugin or editing one, unless the site is signed-only - services/codePolicy.js,
+ * which hosted sites are) can mint either;
+ * that is true of every session. The session is the site's full top role for
+ * an hour (the Manager can already act as it), with no `sid` to revoke it.
+ *
+ * @module services/staffAccess
+ */
+import {getRoleHierarchy} from './roles.js';
+
+/** Screens a staff ticket may open. */
+export const STAFF_SCREENS = Object.freeze(['#/wordpress-import']);
+export const STAFF_SESSION_SECONDS = 3600;
+const STAFF_ID = 'dcm-staff';
+
+/**
+ * Is this decoded token (request.user) a staff session for this site?
+ *
+ * @param {object|null|undefined} user
+ * @param {string|undefined} [siteSlug]  process.env.SITE_SLUG - unset on an unmanaged site
+ * @returns {boolean}
+ */
+export function isDcmStaff(user, siteSlug = process.env.SITE_SLUG) {
+    return Boolean(siteSlug) && user?.type === 'access' && user?.dcmStaff === true && user?.site === siteSlug;
+}
+
+/**
+ * Whether a request carries a staff session. Never answers: a missing or bad
+ * token is "no".
+ *
+ * @param {import('fastify').FastifyRequest} request
+ * @returns {Promise<boolean>}
+ */
+export async function isStaffRequest(request) {
+    try {
+        const decoded = await request.jwtVerify();
+        return isDcmStaff(decoded);
+    } catch {
+        return false;
+    }
+}
+
+/** jti -> expiry (ms): tickets already used. */
+const used = new Map();
+
+/**
+ * Check a ticket. Pure apart from the used-ticket list.
+ *
+ * @param {object} decoded  the verified ticket payload
+ * @param {{siteSlug?: string, now?: number}} [opts]
+ * @returns {{ok: true, to: string, by: string} | {ok: false, error: string}}
+ */
+export function acceptTicket(decoded, {siteSlug = process.env.SITE_SLUG, now = Date.now()} = {}) {
+    for (const [jti, exp] of used) if (exp < now) used.delete(jti);
+    if (!siteSlug) return {ok: false, error: 'This site is not run by a Domma CMS Manager.'};
+    if (decoded?.type !== 'staff-ticket' || decoded.dcmStaff !== true) return {ok: false, error: 'Not a staff ticket.'};
+    if (decoded.site !== siteSlug) return {ok: false, error: 'This ticket is for another site.'};
+    if (!STAFF_SCREENS.includes(decoded.to)) return {ok: false, error: 'This ticket does not open anything here.'};
+    if (typeof decoded.jti !== 'string' || decoded.jti.length < 16) return {ok: false, error: 'Not a staff ticket.'};
+    if (used.has(decoded.jti)) return {ok: false, error: 'This ticket has been used - open it again from the manager.'};
+    used.set(decoded.jti, (Number(decoded.exp) || 0) * 1000 + 60_000);
+    return {ok: true, to: decoded.to, by: String(decoded.by || 'staff').slice(0, 120)};
+}
+
+const json = (v) => JSON.stringify(v).replace(/</g, '\\u003c');
+const page = (title, body) => `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="robots" content="noindex">
+<meta name="viewport" content="width=device-width, initial-scale=1"><title>${title}</title></head><body>${body}</body></html>`;
+
+/**
+ * GET /_staff/open?ticket=… - exchange a Manager's ticket for a staff session.
+ *
+ * @param {import('fastify').FastifyInstance} fastify
+ */
+export async function staffAccessRoutes(fastify) {
+    fastify.get('/_staff/open', {config: {rateLimit: {max: 30, timeWindow: '1 minute'}}}, async (request, reply) => {
+        reply.header('Cache-Control', 'no-store').header('Referrer-Policy', 'no-referrer').header('X-Robots-Tag', 'noindex');
+        const refuse = (error) => reply.code(403).type('text/html; charset=utf-8')
+            .send(page('Not opened', `<p>${error.replace(/[<>&]/g, '')}</p>`));
+        const ticket = typeof request.query?.ticket === 'string' ? request.query.ticket : '';
+        if (!ticket || ticket.length > 4096) return refuse('Not a staff ticket.');
+        let decoded;
+        try {
+            decoded = fastify.jwt.verify(ticket);
+        } catch {
+            return refuse('This ticket is not valid or has run out - open it again from the manager.');
+        }
+        const ok = acceptTicket(decoded);
+        if (!ok.ok) return refuse(ok.error);
+
+        const role = getRoleHierarchy()[0];
+        if (!role) return refuse('This site has no roles yet.');
+        const user = {id: STAFF_ID, name: `${ok.by} (staff)`, email: '', role, additionalRoles: [], level: 0, dcmStaff: true};
+        const token = fastify.jwt.sign({id: STAFF_ID, role, type: 'access', dcmStaff: true, site: decoded.site, name: user.name},
+            {expiresIn: STAFF_SESSION_SECONDS});
+        // warn, not info: production logs at warn, and this is the site's only record of a staff visit.
+        fastify.log.warn?.(`[staff] ${ok.by} opened a staff session at ${ok.to} (ticket ${String(decoded.jti).slice(0, 8)}…)`);
+        return reply.type('text/html; charset=utf-8').send(page('Opening…', `<p>Opening…</p>
+<script src="/dist/domma/domma.min.js"></script>
+<script>
+S.remove('auth_refresh_token');
+S.set('auth_token', ${json(token)});
+S.set('auth_user', ${json(user)});
+location.replace('/admin/' + ${json(ok.to)});
+</script>`));
+    });
+}

package/server/services/tools.js

@@ -39,6 +39,19 @@
  * own admin cannot change that switch; only its Manager, which writes the
  * files directly. A cascade that would move a locked switch is refused.
  *
+ * ## Off for the site, on for the hosting staff (`staff`)
+ *
+ *     { "wordpress-import": { "enabled": false, "locked": true, "staff": true } }
+ *
+ * `staff: true` on a Tool that is off keeps it open to a STAFF SESSION - one
+ * the site's Manager minted (services/staffAccess.js, `dcmStaff`) - and to
+ * nobody else, not even the site's own top role: its API answers a staff
+ * session (toolGate), its sidebar entry is shown to one only, and the admin
+ * route lets one in. Everyone else sees an ordinary switched-off Tool. The
+ * Manager writes it - hosted sites get the WordPress importer this way until
+ * it is gifted. It changes nothing the planner decides: a staff-only Tool is
+ * OFF to planSwitch().
+ *
  * @module services/tools
  */
 import {getConfig, saveConfig} from '../config.js';
@@ -84,6 +97,35 @@ export function isToolLocked(name) {
     return getToolStates()[name]?.locked === true;
 }
 
+/**
+ * Whether a Tool in this stored state is open to a viewer. Pure: on for
+ * everyone unless switched off; off with `staff: true` is still on for a
+ * staff session (services/staffAccess.js isDcmStaff) - and for nobody else.
+ *
+ * @param {{enabled?: boolean, staff?: boolean}|undefined} state
+ * @param {boolean} staffSession  isDcmStaff(request.user)
+ * @returns {boolean}
+ */
+export function toolOpenAt(state, staffSession) {
+    if (state?.enabled !== false) return true;
+    return state?.staff === true && staffSession === true;
+}
+
+/** @param {string} name  @returns {boolean} off for the site, kept open to staff sessions (`staff`) */
+export function isToolStaffOnly(name) {
+    const s = getToolStates()[name];
+    return s?.enabled === false && s?.staff === true;
+}
+
+/**
+ * @param {string} name
+ * @param {boolean} staffSession  isDcmStaff(request.user)
+ * @returns {boolean}
+ */
+export function isToolOpenTo(name, staffSession) {
+    return toolOpenAt(getToolStates()[name], staffSession);
+}
+
 /**
  * @param {string} name
  * @param {{enabled?: boolean, locked?: boolean}} patch
@@ -121,7 +163,8 @@ export function switchableUnits({manifests = [], pluginStates = {}, toolStates =
     for (const t of CORE_TOOLS) {
         const s = toolStates[t.name] || {};
         units.set(t.name, {name: t.name, kind: 'tool', displayName: t.displayName, icon: t.icon,
-            enabled: s.enabled !== false, locked: s.locked === true, requires: [], uses: {}, supersedes: [], closedSource: false});
+            enabled: s.enabled !== false, locked: s.locked === true, staff: s.enabled === false && s.staff === true,
+            requires: [], uses: {}, supersedes: [], closedSource: false});
     }
     for (const m of manifests) {
         if (!m?.name || units.has(m.name)) continue;

package/server/services/versions.js

@@ -37,7 +37,7 @@ const PAGES_DIR = path.join(config.content.contentDir, 'pages');
 function versionsDirForPath(urlPath) {
     const normalised = urlPath === '/' || !urlPath ? '_index' : urlPath.replace(/^\//, '').replace(/\/$/, '');
     const resolved = path.resolve(path.join(VERSIONS_DIR, normalised));
-    if (!resolved.startsWith(path.resolve(VERSIONS_DIR))) {
+    if (resolved !== path.resolve(VERSIONS_DIR) && !resolved.startsWith(path.resolve(VERSIONS_DIR) + path.sep)) {
         throw new Error('Invalid path: outside versions directory');
     }
     return resolved;

package/server/services/views.js

@@ -34,6 +34,7 @@ import {checkVisibility} from '../middleware/auth.js';
 import {getEffectiveLevel} from './userRoles.js';
 import {executePipeline} from './viewPipeline.js';
 import * as cache from './cache/index.js';
+import {fileIn} from './safePath.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT      = path.resolve(__dirname, '..', '..');
@@ -122,7 +123,7 @@ export async function ensureViewsDir() {
  * @throws {Error} If the view file does not exist or cannot be parsed.
  */
 export async function readView(slug) {
-    const file = path.join(VIEWS_DIR, `${slug}.json`);
+    const file = fileIn(VIEWS_DIR, slug, '.json');
     return JSON.parse(await fs.readFile(file, 'utf8'));
 }
 
@@ -135,7 +136,7 @@ export async function readView(slug) {
  */
 export async function writeView(slug, view) {
     await ensureViewsDir();
-    const file = path.join(VIEWS_DIR, `${slug}.json`);
+    const file = fileIn(VIEWS_DIR, slug, '.json');
     await fs.writeFile(file, JSON.stringify(view, null, 4) + '\n', 'utf8');
     await cache.invalidateTags([`view:${slug}`]);
 }
@@ -368,7 +369,7 @@ export async function deleteView(slug) {
         throw new Error(`View "${slug}" not found`);
     }
     try {
-        await fs.unlink(path.join(VIEWS_DIR, `${slug}.json`));
+        await fs.unlink(fileIn(VIEWS_DIR, slug, '.json'));
     } catch {
         throw new Error(`View "${slug}" not found`);
     }