domma-cms 1.8.13 → 1.8.15

package/server/routes/api/forms.js

@@ -45,6 +45,7 @@ import {hooks} from '../../services/hooks.js';
 import {saveMedia} from '../../services/content.js';
 import {v4 as uuidv4} from 'uuid';
 import {ago, clip, plural} from '../../services/sidebarBadges.js';
+import {safeFetch} from '../../services/outbound.js';
 
 /**
  * Detect form↔collection mismatches at save time so admins know BEFORE
@@ -961,11 +962,15 @@ export async function formsRoutes(fastify) {
         const webhookAction = form.actions?.webhook;
         if (record && webhookAction?.enabled && webhookAction.url) {
             try {
-                await fetch(webhookAction.url, {
-                    method:  webhookAction.method || 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body:    JSON.stringify({ form: slug, data })
+                // services/outbound.js: public addresses only, pinned, no redirect inward.
+                const method = String(webhookAction.method || 'POST').toUpperCase();
+                const res = await safeFetch(webhookAction.url, {
+                    method,
+                    headers:  { 'Content-Type': 'application/json' },
+                    body:     method === 'GET' || method === 'HEAD' ? undefined : JSON.stringify({ form: slug, data }),
+                    truncate: true
                 });
+                if (!res.ok) throw new Error(`Webhook returned HTTP ${res.status}`);
             } catch (err) {
                 fastify.log.warn(`[forms] Webhook failed for "${slug}": ${err.message}`);
                 formActionFailed(slug, form.title, 'webhook', err.message);

package/server/routes/api/plugin-marketplace.js

@@ -112,8 +112,7 @@ export async function pluginMarketplaceRoutes(fastify) {
             // bare "Installation failed." while Install from file showed it.
             const safe = err.expose === true || [
                 'Plugin already installed', 'Plugin signature invalid', 'Unknown public key',
-                'Invalid plugin slug', 'Refusing to downgrade', 'Refusing to upgrade',
-                'This site accepts signed plugins only'
+                'Invalid plugin slug', 'Refusing to downgrade', 'Refusing to upgrade'
             ].some(m => err.message.startsWith(m));
             return reply.code(400).send({ error: safe ? err.message : 'Installation failed.' });
         }

package/server/routes/api/plugins.js

@@ -2,6 +2,7 @@
  * Plugins API
  * GET  /api/plugins              - list all discovered plugins + state (admin only)
  * GET  /api/plugins/_count       - the sidebar badge (`_` is outside the slug alphabet)
+ * GET  /api/plugins/_policy      - {signedOnly}: what the screens may offer (services/codePolicy.js)
  * POST /api/plugins/scaffold     - create a new plugin from plugins/_template (admin only)
  * PUT  /api/plugins/:name        - enable/disable, update settings (admin only)
  * GET  /api/plugins/admin-config - sidebar/routes/views for enabled plugins (authenticated)
@@ -27,6 +28,7 @@ import {getToolStates, planSwitch, requiresOf, switchableUnits, usesOf} from '..
 import {applyCascade} from './tools.js';
 import {scaffoldPlugin} from '../../services/pluginScaffold.js';
 import {deletePluginFile, listPluginFiles, readPluginFile, writePluginFile} from '../../services/pluginFiles.js';
+import {signedOnly, signedOnlyError} from '../../services/codePolicy.js';
 import {getConfig} from '../../config.js';
 import path from 'path';
 import {existsSync, readFileSync} from 'node:fs';
@@ -217,6 +219,10 @@ export async function pluginsRoutes(fastify, opts = {}) {
     const canUpdate  = { preHandler: [authenticate, requirePermission('plugins', 'update')]  };
     const canDevelop = { preHandler: [authenticate, requirePermission('plugins', 'develop')] };
 
+    // A signed-only refusal carries its code so a screen can tell it from a failure.
+    const mapErr = (reply, err) => reply.status(err.statusCode || 500)
+        .send({ error: err.message, ...(err.code === 'signed-only' && {code: err.code}) });
+
     // List all plugins with their current state
     fastify.get('/plugins', canRead, async (request) => {
         const manifests = await discoverPlugins();
@@ -286,6 +292,12 @@ export async function pluginsRoutes(fastify, opts = {}) {
         return pluginsBadge(plugins, await latestVersions());
     });
 
+    // What this site lets its admin do with plugin code. A signed-only site
+    // (services/codePolicy.js) refuses New plugin, unsigned uploads and code
+    // edits - the screens ask so they can leave those off rather than offer
+    // them and show the refusal. The refusal is the guard, not this.
+    fastify.get('/plugins/_policy', canRead, async () => ({signedOnly: signedOnly()}));
+
     // Scaffold a new plugin from plugins/_template. The plugin is created
     // pre-enabled so it goes live on the next server restart (its routes and
     // admin views only register at boot - same restart rule as enable/disable).
@@ -296,7 +308,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
             savePluginState(result.name, { enabled: true });
             return { success: true, name: result.name, files: result.files, restartRequired: true };
         } catch (err) {
-            return reply.status(err.statusCode || 500).send({ error: err.message });
+            return mapErr(reply, err);
         }
     });
 
@@ -377,7 +389,6 @@ export async function pluginsRoutes(fastify, opts = {}) {
 
     // ── In-admin code editor (plugins.develop - code execution grade) ──────
 
-    const mapErr = (reply, err) => reply.status(err.statusCode || 500).send({ error: err.message });
 
     /*
      * May this request read a LICENSED plugin's source?
@@ -388,7 +399,9 @@ export async function pluginsRoutes(fastify, opts = {}) {
      * without opening it on the sites they are distributed to. Level rather
      * than role name, the same way requireAdmin and canManageUser decide.
      */
-    const mayEditLicensed = (request) => !!request.user && getEffectiveLevel(request.user) === 0;
+    // A signed-only site is a hosted one, where level 0 is the customer - the
+    // assumption above does not hold there, so nobody reads licensed source.
+    const mayEditLicensed = (request) => !!request.user && getEffectiveLevel(request.user) === 0 && !signedOnly();
     const licensed = (request) => ({allowLicensed: mayEditLicensed(request)});
 
     // List a plugin's editable files
@@ -465,6 +478,14 @@ export async function pluginsRoutes(fastify, opts = {}) {
             return reply.code(400).send({error: err.message});
         }
 
+        // A signed-only site refuses an unsigned file outright - before the
+        // "already installed, update it?" question, which would otherwise be
+        // asked about something that can never be installed.
+        if (!parts.signature && signedOnly()) {
+            const err = signedOnlyError();
+            return reply.code(err.statusCode).send({error: err.message, code: err.code});
+        }
+
         // The slug comes from the manifest inside, never from the filename: a
         // file can be renamed by anyone, a manifest is what the installer then
         // validates against what was actually extracted.
@@ -496,6 +517,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
             });
         } catch (err) {
             fastify.log.warn({err}, '[plugins] upload install failed');
+            if (err.code === 'signed-only') return mapErr(reply, err);
             return reply.code(400).send({error: err.message});
         }
 

package/server/server.js

@@ -4,7 +4,7 @@
  * Domma dist files are served directly from node_modules/domma-js/public/dist.
  * Updated: blobs + z-index fixes.
  */
-import 'dotenv/config';
+import './env.js';
 import Fastify from 'fastify';
 import jwt from '@fastify/jwt';
 import staticPlugin from '@fastify/static';

package/server/services/actions.js

@@ -203,10 +203,13 @@ async function executeStep(step, collection, entry, context) {
             const body    = cfg.body ? interpolateValue(cfg.body, context) : undefined;
             const headers = { 'Content-Type': 'application/json', ...(cfg.headers || {}) };
 
-            const res = await fetch(url, {
+            // services/outbound.js: public addresses only, pinned, no redirect inward.
+            const { safeFetch } = await import('./outbound.js');
+            const res = await safeFetch(url, {
                 method,
                 headers,
-                body: body !== undefined ? JSON.stringify(body) : undefined
+                body: body !== undefined && method !== 'GET' && method !== 'HEAD' ? JSON.stringify(body) : undefined,
+                truncate: true
             });
 
             if (!res.ok) throw new Error(`Webhook returned HTTP ${res.status}`);

package/server/services/adapters/FileAdapter.js

@@ -23,6 +23,7 @@ import path from 'path';
 import { config } from '../../config.js';
 import { applyFilter } from '../filterEngine.js';
 import { withFileLock, writeFileAtomic } from './fileLock.js';
+import {fileIn} from '../safePath.js';
 
 const COLLECTIONS_DIR = path.resolve(config.content.collectionsDir);
 
@@ -31,7 +32,7 @@ const COLLECTIONS_DIR = path.resolve(config.content.collectionsDir);
 // ---------------------------------------------------------------------------
 
 function dataPath(slug) {
-    return path.join(COLLECTIONS_DIR, slug, 'data.json');
+    return path.join(fileIn(COLLECTIONS_DIR, slug), 'data.json');
 }
 
 async function read(slug) {

package/server/services/adapters/MongoAdapter.js

@@ -19,7 +19,7 @@
  *   count(slug)               → number
  *   archive(slug)             → string|null (set the entries aside after a storage move)
  */
-import { toMongoQuery } from '../filterEngine.js';
+import { toSafeMongoQuery } from '../mongoQueryGuard.js';
 
 /** Prefix applied to all CMS collection names in MongoDB to avoid collisions. */
 const PREFIX = 'cms_';
@@ -36,6 +36,19 @@ function strip(doc) {
     return rest;
 }
 
+/**
+ * An entry id as it may be put in a query: text only. An object from a JSON
+ * body (`{"$ne": ""}`) would otherwise be read as an operator and pick
+ * whichever entry matched first.
+ *
+ * @param {unknown} entryId
+ * @returns {string}
+ */
+function idOf(entryId) {
+    if (typeof entryId !== 'string' && typeof entryId !== 'number') throw Object.assign(new Error('Entry not found'), {statusCode: 404});
+    return String(entryId);
+}
+
 export class MongoAdapter {
 
     /**
@@ -67,7 +80,7 @@ export class MongoAdapter {
      * and structured filtering.
      *
      * `filter` is translated to native MongoDB query operators via
-     * `filterEngine.toMongoQuery()` and pushed down to the database - page
+     * `mongoQueryGuard.toSafeMongoQuery()` and pushed down to the database - page
      * authors writing `[collection where_salary_gte="50000"]` get index-aware
      * queries automatically. When `search` is present, all documents are
      * fetched and filtered in memory (same behaviour as FileAdapter, kept
@@ -88,7 +101,9 @@ export class MongoAdapter {
 
         const sortField = sort === 'createdAt' ? 'meta.createdAt' : `data.${sort}`;
         const sortDir   = order === 'desc' ? -1 : 1;
-        const query     = filter ? toMongoQuery(filter) : {};
+        // The one translation of a user-shaped filter for MongoDB - refuses
+        // anything that would run code on the server (mongoQueryGuard.js).
+        const query     = toSafeMongoQuery(filter);
 
         if (search) {
             // Fetch matching (by filter) docs and substring-match in memory.
@@ -140,8 +155,9 @@ export class MongoAdapter {
      * @returns {Promise<object|null>}
      */
     async get(slug, entryId) {
+        if (typeof entryId !== 'string' && typeof entryId !== 'number') return null;
         const col = await this._col(slug);
-        const doc = await col.findOne({ id: entryId }, { projection: { _id: 0 } });
+        const doc = await col.findOne({ id: idOf(entryId) }, { projection: { _id: 0 } });
         return doc || null;
     }
 
@@ -169,7 +185,7 @@ export class MongoAdapter {
      */
     async update(slug, entryId, updated) {
         const col    = await this._col(slug);
-        const result = await col.replaceOne({ id: entryId }, { ...updated });
+        const result = await col.replaceOne({ id: idOf(entryId) }, { ...updated });
         if (result.matchedCount === 0) throw new Error('Entry not found');
         return updated;
     }
@@ -184,7 +200,7 @@ export class MongoAdapter {
      */
     async remove(slug, entryId) {
         const col    = await this._col(slug);
-        const result = await col.deleteOne({ id: entryId });
+        const result = await col.deleteOne({ id: idOf(entryId) });
         if (result.deletedCount === 0) throw new Error('Entry not found');
     }
 

package/server/services/codePolicy.js

@@ -0,0 +1,111 @@
+/**
+ * Signed-only sites: who may put server-side code on this site.
+ *
+ * `config/server.json` `requireSignedPlugins: true` means the only plugin code
+ * this site runs is code the Marketplace signed. A hosted site (one a Domma CMS
+ * Manager runs) has it on, because its owner holds the top role there and a
+ * level-0 user who can run their own code can read the site's secrets - and
+ * with JWT_SECRET forge a Manager staff session (services/staffAccess.js).
+ * Self-hosted sites leave it off: there the owner IS the host.
+ *
+ * With it on, every way the admin had of getting its own JavaScript onto the
+ * server is refused here, at the service, so a second route or a plugin calling
+ * the same service cannot step round it:
+ *
+ *   - installing an unsigned .dcmsplugin (pluginInstaller.installPlugin)
+ *   - New plugin (pluginScaffold.scaffoldPlugin)
+ *   - writing or deleting a plugin's files in the code editor (pluginFiles)
+ *   - reading a LICENSED plugin's source as level 0 - on a hosted site level 0
+ *     is the customer, not the people who publish the plugin (routes/api/plugins.js)
+ *
+ * Three things say "on", and any one is enough - none can be undone from the
+ * site's own admin:
+ *
+ *   1. `DOMMA_SIGNED_ONLY=1` in the environment. The Manager sets it when it
+ *      forks a site it hosts (after the site's .env, so .env cannot unset it).
+ *      This is the one a file-write bug cannot touch.
+ *   2. server.json as it was at boot (config.server). Deleting or rewriting
+ *      the file while the site runs changes nothing until a restart.
+ *   3. server.json now, read fresh - so the Manager can switch a running site
+ *      on without restarting it.
+ *
+ * Nothing in the admin or the API writes server.json - it is the host's file.
+ * Keep it that way: a route that ever writes it must leave
+ * `requireSignedPlugins` exactly as it found it.
+ *
+ * @module services/codePolicy
+ */
+import {config, getConfig} from '../config.js';
+
+/** What the admin is told, whatever it tried. Plain words: it is the whole answer. */
+export const SIGNED_ONLY_MESSAGE = 'This site only runs plugins signed by the Marketplace, so plugin code cannot be uploaded, created or edited here. Install plugins from Browse.';
+
+/**
+ * Does this site refuse any plugin code the Marketplace has not signed?
+ *
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {boolean}
+ */
+export function signedOnly(env = process.env) {
+    if (env.DOMMA_SIGNED_ONLY === '1') return true;
+    if (config.server?.requireSignedPlugins === true) return true;
+    try {
+        return getConfig('server')?.requireSignedPlugins === true;
+    } catch {
+        return false;
+    }
+}
+
+/**
+ * The refusal, as an Error the routes map straight to a reply
+ * (`statusCode` 403, `code` 'signed-only', `expose` for the marketplace route).
+ *
+ * @returns {Error}
+ */
+export function signedOnlyError() {
+    return Object.assign(new Error(SIGNED_ONLY_MESSAGE), {statusCode: 403, code: 'signed-only', expose: true});
+}
+
+/** Throw the refusal when the site is signed-only. */
+export function assertMayChangeCode() {
+    if (signedOnly()) throw signedOnlyError();
+}
+
+/**
+ * MongoDB client options that reach outside the database: start a program
+ * (`autoEncryption.extraOptions.mongocryptdSpawnPath` / `...SpawnArgs`), load a
+ * native library (`cryptSharedLibPath`) or read a file off this server
+ * (`tlsCAFile`, `tlsCertificateKeyFile`, the old `ssl*` names). The admin
+ * writes connections.json (PUT /api/collections/connections) and the site -
+ * and the Manager's Data Manager - hand its `options` to `new MongoClient`.
+ * Today the spawn needs `mongodb-client-encryption`, which is not installed;
+ * this keeps it that way on a signed-only site whatever gets installed later.
+ */
+const RISKY_MONGO_OPTION = /^(autoEncryption|extraOptions|.*File|.*Path|.*SpawnArgs|ssl(CA|Cert|Key|CRL|PEMKeyFile|PEMKeyPassword)|cryptShared.*|mongocryptd.*)$/i;
+
+/**
+ * The risky option names in one stored connection (its `options`, at any depth,
+ * and its URI's query string). Empty when it is fine.
+ *
+ * @param {{uri?: string, options?: object}} conn
+ * @returns {string[]}
+ */
+export function riskyConnectionOptions(conn) {
+    const found = [];
+    const walk = (obj, at) => {
+        if (!obj || typeof obj !== 'object') return;
+        for (const [k, v] of Object.entries(obj)) {
+            const here = at ? `${at}.${k}` : k;
+            if (RISKY_MONGO_OPTION.test(k)) found.push(here);
+            else walk(v, here);
+        }
+    };
+    walk(conn?.options, 'options');
+    const query = String(conn?.uri || '').split('?')[1] || '';
+    for (const pair of query.split('&')) {
+        let key = pair.split('=')[0];
+        try { key = decodeURIComponent(key); } catch { /* keep it raw */ }
+        if (key && RISKY_MONGO_OPTION.test(key)) found.push(`uri ${key}`);
+    }
+    return found;
+}

package/server/services/collections.js

@@ -14,6 +14,7 @@ import {adapterForStorage, describeAdapter, getAdapter, invalidate, isFixedToFil
 import * as cache from './cache/index.js';
 import {typedEntryData} from './entryValues.js';
 import {toCsv} from '../../public/js/collection-export.mjs';
+import {fileIn} from './safePath.js';
 
 const COLLECTIONS_DIR = path.resolve(config.content.collectionsDir);
 const TOOL_TRASH_SLUGS = new Set(['notes-notes', 'todo-items', 'contacts-contacts']);
@@ -27,7 +28,7 @@ async function ensureDir() {
 }
 
 function collectionDir(slug) {
-    return path.join(COLLECTIONS_DIR, slug);
+    return fileIn(COLLECTIONS_DIR, slug);
 }
 
 function schemaPath(slug) {

package/server/services/components.js

@@ -7,6 +7,7 @@ import fs from 'fs/promises';
 import path from 'path';
 import {fileURLToPath} from 'url';
 import {getPluginComponents} from './hooks.js';
+import {fileIn} from './safePath.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const COMPONENTS_DIR = path.resolve(__dirname, '../../content/components');
@@ -28,7 +29,7 @@ function assertValidName(name) {
  * @param {string} name - Component name (without extension).
  * @returns {string}
  */
-function componentFilePath(name) { return path.join(COMPONENTS_DIR, `${name}.dmc`); }
+function componentFilePath(name) { return fileIn(COMPONENTS_DIR, name, '.dmc'); }
 
 /**
  * Absolute filesystem path to a component's companion .meta.json file.
@@ -36,7 +37,7 @@ function componentFilePath(name) { return path.join(COMPONENTS_DIR, `${name}.dmc
  * @param {string} name - Component name (without extension).
  * @returns {string}
  */
-function componentMetaPath(name) { return path.join(COMPONENTS_DIR, `${name}.meta.json`); }
+function componentMetaPath(name) { return fileIn(COMPONENTS_DIR, name, '.meta.json'); }
 
 /**
  * Split a .dmc source string into its four SFC blocks.

package/server/services/connectionManager.js

@@ -35,6 +35,14 @@ export async function initialise(connectionsConfig) {
             continue;
         }
 
+        // Written before the site went signed-only, or by hand: not used there.
+        const {riskyConnectionOptions, signedOnly} = await import('./codePolicy.js');
+        const risky = signedOnly() ? riskyConnectionOptions(cfg) : [];
+        if (risky.length) {
+            console.error(`[connectionManager] Skipping connection "${name}": ${risky.join(', ')} not allowed on a signed-only site`);
+            continue;
+        }
+
         try {
             const client = new MongoClient(cfg.uri, cfg.options || {});
             await client.connect();

package/server/services/content.js

@@ -501,7 +501,7 @@ function urlPathToFilePath(urlPath) {
     const normalised = urlPath === '/' || !urlPath ? 'index' : urlPath.replace(/^\//, '').replace(/\/$/, '');
     const result = path.join(PAGES_DIR, normalised + '.md');
     const resolved = path.resolve(result);
-    if (!resolved.startsWith(path.resolve(PAGES_DIR))) {
+    if (!resolved.startsWith(path.resolve(PAGES_DIR) + path.sep)) {
         throw new Error('Invalid path: outside content directory');
     }
     return result;

package/server/services/contextMenus.js

@@ -20,6 +20,7 @@ import path from 'path';
 import {fileURLToPath} from 'url';
 import * as cache from './cache/index.js';
 import {cssClassProblems} from '../../public/js/css-classes.mjs';
+import {fileIn} from './safePath.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const CONFIG_DIR = path.resolve(__dirname, '..', '..', 'config');
@@ -66,7 +67,7 @@ export async function ensureContextMenusDir() {
 }
 
 function ctxPath(slug) {
-    return path.join(CTX_DIR, `${slug}.json`);
+    return fileIn(CTX_DIR, slug, '.json');
 }
 
 async function readCtxFile(slug) {

package/server/services/filterEngine.js

@@ -262,7 +262,9 @@ export function toMongoQuery(filter) {
 
     // Collapse single-operator sub-docs that only contain $eq back to a flat value.
     for (const [path, sub] of Object.entries(query)) {
-        if (sub && typeof sub === 'object' && Object.keys(sub).length === 1 && '$eq' in sub) {
+        // Only a plain value: an object here would be read as operators, not matched as a value.
+        if (sub && typeof sub === 'object' && Object.keys(sub).length === 1 && '$eq' in sub
+            && (sub.$eq === null || typeof sub.$eq !== 'object')) {
             query[path] = sub.$eq;
         }
     }

package/server/services/forms.js

@@ -8,6 +8,7 @@ import path from 'path';
 import {fileURLToPath} from 'url';
 import * as cache from './cache/index.js';
 import {buttonSettingsProblems, formClassProblems} from '../../public/js/form-submit.mjs';
+import {fileIn} from './safePath.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT      = path.resolve(__dirname, '..', '..');
@@ -30,7 +31,7 @@ export async function ensureFormsDir() {
  * @throws {Error} If the form file does not exist or cannot be parsed.
  */
 export async function readForm(slug) {
-    const file = path.join(FORMS_DIR, `${slug}.json`);
+    const file = fileIn(FORMS_DIR, slug, '.json');
     return JSON.parse(await fs.readFile(file, 'utf8'));
 }
 
@@ -43,7 +44,7 @@ export async function readForm(slug) {
  */
 export async function writeForm(slug, data) {
     await ensureFormsDir();
-    const file = path.join(FORMS_DIR, `${slug}.json`);
+    const file = fileIn(FORMS_DIR, slug, '.json');
     await fs.writeFile(file, JSON.stringify(data, null, 4) + '\n', 'utf8');
     await cache.invalidateTags([`form:${slug}`]);
 }
@@ -83,7 +84,7 @@ export async function listForms() {
  * @throws {Error} If the form file does not exist.
  */
 export async function deleteForm(slug) {
-    await fs.unlink(path.join(FORMS_DIR, `${slug}.json`));
+    await fs.unlink(fileIn(FORMS_DIR, slug, '.json'));
     await cache.invalidateTags([`form:${slug}`]);
 }
 

package/server/services/menus.js

@@ -21,6 +21,7 @@ import {
     LEGACY_STYLE_HOVER, LEGACY_STYLE_ACTIVE, legacyStyleHighlight,
     PRESET_COLOUR_VARS, PRESET_COLOUR_FALLBACKS, colourToCss, cssClassProblems
 } from '../../public/js/menu-decor.mjs';
+import {fileIn} from './safePath.js';
 
 /**
  * Bust the response-cache tags that menu changes affect. Public pages are
@@ -472,7 +473,7 @@ export async function ensureMenusDir() {
 }
 
 function menuPath(slug) {
-    return path.join(MENUS_DIR, `${slug}.json`);
+    return fileIn(MENUS_DIR, slug, '.json');
 }
 
 async function readMenuFile(slug) {