domma-cms 1.8.32 → 1.8.34

package/plugins/docs/plugin.json

@@ -0,0 +1,89 @@
+{
+  "name": "docs",
+  "displayName": "Docs",
+  "version": "2.14.0",
+  "tier": "free",
+  "description": "A document editor: sharing, public links, import and export, send to a page, blog or email, version history and templates. PDF documents: add a PDF and it is kept as it is - filed, shared, linked, emailed and versioned like any document, shown in the browser's own viewer.",
+  "author": "Darryl Waterhouse",
+  "date": "2026-10-21",
+  "icon": "book-open",
+  "contentPaths": [
+    "data"
+  ],
+  "admin": {
+    "css": [
+      "admin/css/docs.css"
+    ],
+    "sidebar": [
+      {
+        "id": "docs",
+        "text": "Docs",
+        "icon": "book-open",
+        "url": "#/plugins/docs",
+        "hotkey": "o",
+        "section": "#/plugins/docs",
+        "permission": "docs",
+        "countUrl": "/api/plugins/docs/count"
+      }
+    ],
+    "routes": [
+      {
+        "path": "/plugins/docs",
+        "view": "plugin-docs",
+        "title": "Docs - Domma CMS"
+      },
+      {
+        "path": "/plugins/docs/d/:id",
+        "view": "plugin-docs-editor",
+        "title": "Docs - Domma CMS"
+      }
+    ],
+    "views": {
+      "plugin-docs": {
+        "entry": "docs/admin/views/docs.js",
+        "exportName": "docsView"
+      },
+      "plugin-docs-editor": {
+        "entry": "docs/admin/views/editor.js",
+        "exportName": "docsEditorView"
+      }
+    }
+  },
+  "permissions": [
+    {
+      "key": "docs",
+      "label": "Docs",
+      "group": "Plugins",
+      "description": "Documents, folders and templates - your own and those shared with you.",
+      "actions": [
+        {
+          "key": "read",
+          "label": "View",
+          "description": "Open Docs and read documents"
+        },
+        {
+          "key": "create",
+          "label": "Create",
+          "description": "Write new documents, folders and templates"
+        },
+        {
+          "key": "update",
+          "label": "Edit",
+          "description": "Edit documents and folders (your own; admins any, when shared site-wide)"
+        },
+        {
+          "key": "delete",
+          "label": "Delete",
+          "description": "Delete documents, folders and templates (the same)"
+        }
+      ],
+      "grant": [
+        "admin",
+        "user"
+      ]
+    }
+  ],
+  "uses": {
+    "blog": "Send a document to a new blog post"
+  }
+}

package/plugins/docs/plugin.public.js

@@ -0,0 +1,114 @@
+/**
+ * Docs - the public link page: /docs/s/<token>.
+ *
+ * A read-only copy of one document for anyone holding its link, inside the
+ * site's own theme, never indexed. The body is sanitised again on the way
+ * out - it was sanitised when saved, but this is the one place a document
+ * meets the public. Downloads (?download=md|html|txt) come from the same
+ * page. Docs Pro may answer first (a password, an expired link) through the
+ * registry's gate.
+ *
+ * @module docs/plugin.public
+ */
+
+import path from 'path';
+import {fileURLToPath} from 'url';
+import {renderBlogPage} from '../../server/services/renderer.js';
+import {docByToken, sanitizeDoc, withoutSuggestions, kindOf, readFileBytes} from './lib/store.js';
+import {docsRegistry} from './lib/extensions.js';
+import {escapeHtml, htmlToMarkdown, htmlToText, standaloneHtml, fileName, startsWithTitle} from './admin/lib/convert.js';
+import {contentDisposition, sizeText} from './lib/pdf.js';
+
+const TEMPLATE = path.join(fileURLToPath(new URL('.', import.meta.url)), 'templates', 'public-doc.html');
+
+const disposition = (name) => contentDisposition(name);
+
+function notFound(reply) {
+    return reply.code(404).type('text/html').header('X-Robots-Tag', 'noindex')
+        .send('<!doctype html><meta charset="utf-8"><meta name="robots" content="noindex"><title>Not found</title>'
+            + '<p style="font-family:sans-serif;margin:3rem auto;max-width:32rem">This link does not work any more. Ask whoever sent it for a new one.</p>');
+}
+
+export default async function docsPublic(fastify) {
+    const registry = docsRegistry();
+
+    fastify.get('/docs/s/:token', {config: {rateLimit: {max: 60, timeWindow: '1 minute'}}}, async (request, reply) => {
+        const doc = await docByToken(request.params.token);
+        if (!doc) return notFound(reply);
+
+        // A link an add-on protects (a password, an expiry date) never opens without that add-on
+        // there to check it - a lapsed licence or a switched-off add-on must fail closed. (2.3)
+        if (doc.linkGuarded && !registry.hasGate()) return notFound(reply);
+        // A document an add-on keeps private right now (a members-only wiki's page, 2.11): its link is off.
+        if (registry.restrictionOf?.(doc)) return notFound(reply);
+        const gated = await registry.gate({doc, request, reply});
+        if (gated?.handled) {
+            if (gated.error) return notFound(reply);
+            return reply;
+        }
+
+        const title = doc.title || 'Untitled';
+        reply.header('X-Robots-Tag', 'noindex, nofollow').header('Cache-Control', 'no-store')
+            .header('Referrer-Policy', 'no-referrer');
+
+        const dl = request.query?.download;
+        // A PDF document (2.13) is its file: shown in the browser's own viewer, or saved. Nothing else is derived from it.
+        if (kindOf(doc) === 'pdf') {
+            if (dl !== undefined || request.query?.file === '1') {
+                const buf = await readFileBytes(doc.id);
+                if (!buf) return notFound(reply);
+                return reply.type('application/pdf')
+                    .header('Content-Disposition', contentDisposition(fileName(title, 'pdf'), dl === undefined))
+                    .header('X-Content-Type-Options', 'nosniff')
+                    .header('Content-Security-Policy', "default-src 'none'; sandbox")
+                    .send(buf);
+            }
+            const here = `/docs/s/${encodeURIComponent(request.params.token)}`;
+            const facts = [doc.file?.pages ? `${doc.file.pages} page${doc.file.pages === 1 ? '' : 's'}` : '', doc.file?.size ? sizeText(doc.file.size) : ''].filter(Boolean).join(' · ');
+            const html = await renderBlogPage(TEMPLATE, {
+                heading: `<h1 class="docs-public__title">${escapeHtml(title)}</h1>`,
+                body: `<iframe class="docs-public__pdf" src="${here}?file=1" title="${escapeHtml(title)}"></iframe>`
+                    + `<p class="docs-public__pdf-fallback">If the document does not show above, <a href="${here}?download=pdf" rel="nofollow">download the PDF</a>.</p>`,
+                actions: `<a href="?download=pdf" rel="nofollow">Download PDF</a>`,
+                byline: `Shared document - PDF${facts ? ` · ${facts}` : ''}`,
+                updated: doc.updatedAt && !isNaN(new Date(doc.updatedAt)) ? `Last updated ${escapeHtml(new Date(doc.updatedAt).toUTCString().replace(/:\d\d GMT$/, ' GMT'))}` : ''
+            }, {
+                title, description: htmlToText(doc.content || '').slice(0, 160), noindex: true,
+                urlPath: here,
+                baseUrl: `${request.protocol}://${request.host || request.headers.host || request.hostname}`
+            });
+            return reply.type('text/html; charset=utf-8').send(html);
+        }
+
+        // Add-ons' filters (2.5): no comment marks, pending suggestions shown as not made.
+        const body = registry.publicHtml(withoutSuggestions(sanitizeDoc(doc.content)));
+
+        if (dl === 'md') {
+            return reply.type('text/markdown; charset=utf-8').header('Content-Disposition', disposition(fileName(title, 'md')))
+                .send(startsWithTitle(title, body) ? htmlToMarkdown(body) : `# ${title}\n\n${htmlToMarkdown(body)}`);
+        }
+        if (dl === 'html') {
+            return reply.type('text/html; charset=utf-8').header('Content-Disposition', disposition(fileName(title, 'html')))
+                .send(standaloneHtml(title, body));
+        }
+        if (dl === 'txt') {
+            return reply.type('text/plain; charset=utf-8').header('Content-Disposition', disposition(fileName(title, 'txt')))
+                .send(`${title}\n\n${htmlToText(body)}\n`);
+        }
+
+        const updated = doc.updatedAt ? new Date(doc.updatedAt) : null;
+        const html = await renderBlogPage(TEMPLATE, {
+            heading: startsWithTitle(title, body) ? '' : `<h1 class="docs-public__title">${escapeHtml(title)}</h1>`,
+            body,
+            actions: '<button type="button" id="docs-public-print">Print or save as PDF</button>'
+                + '<a href="?download=md" rel="nofollow">Markdown</a><a href="?download=html" rel="nofollow">HTML</a><a href="?download=txt" rel="nofollow">Text</a>',
+            byline: 'Shared document - read only',
+            updated: updated && !isNaN(updated) ? `Last updated ${escapeHtml(updated.toUTCString().replace(/:\d\d GMT$/, ' GMT'))}` : ''
+        }, {
+            title, description: htmlToText(body).slice(0, 160), noindex: true,
+            urlPath: `/docs/s/${request.params.token}`,
+            baseUrl: `${request.protocol}://${request.host || request.headers.host || request.hostname}`
+        });
+        return reply.type('text/html; charset=utf-8').send(html);
+    });
+}

package/plugins/docs/templates/public-doc.html

@@ -0,0 +1,36 @@
+<style>
+.docs-public{max-width:820px;margin:2rem auto 3rem;padding:0 1rem}
+.docs-public__bar{display:flex;flex-wrap:wrap;gap:.5rem;align-items:center;justify-content:space-between;margin-bottom:1rem;color:var(--dm-text-muted);font-size:.875rem}
+.docs-public__actions{display:flex;gap:.25rem;flex-wrap:wrap}
+.docs-public__actions a,.docs-public__actions button{font:inherit;font-size:.8125rem;padding:.3rem .65rem;border:1px solid var(--dm-border);border-radius:var(--dm-radius,6px);background:var(--dm-surface);color:var(--dm-text);text-decoration:none;cursor:pointer}
+.docs-public__actions a:hover,.docs-public__actions button:hover{border-color:var(--dm-primary)}
+.docs-public__page{background:var(--dm-surface);color:var(--dm-text);border:1px solid var(--dm-border);border-radius:var(--dm-radius,8px);padding:clamp(1.25rem,5vw,3.5rem);line-height:1.65;overflow-wrap:anywhere}
+.docs-public__page h1.docs-public__title{margin-top:0}
+.docs-public__page img{max-width:100%;height:auto}
+.docs-public__page table{border-collapse:collapse;width:100%;margin:0 0 1em}
+.docs-public__page td,.docs-public__page th{border:1px solid var(--dm-border);padding:.4em .6em;vertical-align:top;text-align:left}
+.docs-public__page blockquote{margin:0 0 1em;padding:.25em 1em;border-left:4px solid var(--dm-border);color:var(--dm-text-muted)}
+.docs-public__page pre{background:color-mix(in srgb,var(--dm-text) 6%,transparent);padding:1em;border-radius:6px;overflow:auto}
+.docs-public__page ul[data-type=checklist]{list-style:none;padding-left:.25em}
+.docs-public__page ul[data-type=checklist] li::before{content:"\2610";margin-right:.5em}
+.docs-public__page ul[data-type=checklist] li[data-checked=true]::before{content:"\2611"}
+.docs-public__pdf{display:block;width:100%;height:min(85vh,1100px);border:0;background:#fff}
+.docs-public__pdf-fallback{margin:.75rem 0 0;font-size:.875rem;color:var(--dm-text-muted)}
+.docs-public__page:has(.docs-public__pdf){padding:0;overflow:hidden}
+.docs-public__page:has(.docs-public__pdf) h1.docs-public__title{padding:1rem 1.25rem 0;margin-bottom:.75rem}
+.docs-public__page:has(.docs-public__pdf) .docs-public__pdf-fallback{padding:0 1.25rem 1rem}
+.docs-public__foot{margin-top:.75rem;font-size:.8125rem;color:var(--dm-text-muted)}
+@media print{#site-navbar,.navbar,footer,.docs-public__bar,.docs-public__foot{display:none!important}.docs-public{margin:0;max-width:none}.docs-public__page{border:0;padding:0}}
+</style>
+<main class="docs-public">
+<div class="docs-public__bar">
+<span>{{byline}}</span>
+<span class="docs-public__actions">{{actions}}</span>
+</div>
+<article class="docs-public__page">
+{{heading}}
+{{body}}
+</article>
+<p class="docs-public__foot">{{updated}}</p>
+</main>
+<script>document.getElementById('docs-public-print')?.addEventListener('click',function(){window.print();});</script>

package/plugins/docs/tests/_env.js

@@ -0,0 +1,10 @@
+/**
+ * Imported FIRST by the Docs tests: point the plugin at a throwaway data
+ * directory, so a test run never reads or purges a real site's documents.
+ */
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+
+export const DATA = fs.mkdtempSync(path.join(os.tmpdir(), 'docs-test-'));
+process.env.DOCS_DATA_DIR = DATA;

package/plugins/docs/tests/_pdf.js

@@ -0,0 +1,73 @@
+/**
+ * A small, valid PDF for the tests: one or more pages of Helvetica text,
+ * with a correct cross-reference table. `extra` puts raw objects in (a
+ * /JavaScript action, an attached file) to see them refused.
+ */
+import zlib from 'zlib';
+
+/**
+ * @param {object} [o]
+ * @param {string[]} [o.pages]    the text on each page
+ * @param {string}   [o.extra]    extra object bodies, appended as further objects (a string per object, joined by \n)
+ * @param {boolean}  [o.deflate]  compress the content streams (FlateDecode)
+ * @param {string}   [o.catalogExtra] text added inside the catalog dictionary
+ * @returns {Buffer}
+ */
+export function makePdf({pages = ['Hello Docs'], extra = [], deflate = false, catalogExtra = ''} = {}) {
+    const objects = [];
+    const add = (body) => { objects.push(body); return objects.length; };
+    const catalog = add(null);
+    const pagesObj = add(null);
+    const font = add('<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>');
+    const kids = [];
+    for (const text of pages) {
+        const safe = String(text).replace(/[\\()]/g, (c) => `\\${c}`);
+        const content = Buffer.from(`BT /F1 18 Tf 72 720 Td (${safe}) Tj ET`, 'latin1');
+        const data = deflate ? zlib.deflateSync(content) : content;
+        const stream = add(Buffer.concat([Buffer.from(`<< /Length ${data.length}${deflate ? ' /Filter /FlateDecode' : ''} >>\nstream\n`, 'latin1'), data, Buffer.from('\nendstream', 'latin1')]));
+        const page = add(`<< /Type /Page /Parent ${pagesObj} 0 R /MediaBox [0 0 612 792] /Resources << /Font << /F1 ${font} 0 R >> >> /Contents ${stream} 0 R >>`);
+        kids.push(`${page} 0 R`);
+    }
+    objects[pagesObj - 1] = `<< /Type /Pages /Kids [${kids.join(' ')}] /Count ${kids.length} >>`;
+    objects[catalog - 1] = `<< /Type /Catalog /Pages ${pagesObj} 0 R ${catalogExtra} >>`;
+    for (const body of extra) add(body);
+
+    const parts = [Buffer.from('%PDF-1.4\n%\xe2\xe3\xcf\xd3\n', 'latin1')];
+    const offsets = [];
+    let at = parts[0].length;
+    objects.forEach((body, i) => {
+        offsets.push(at);
+        const head = Buffer.from(`${i + 1} 0 obj\n`, 'latin1');
+        const b = Buffer.isBuffer(body) ? body : Buffer.from(body, 'latin1');
+        const tail = Buffer.from('\nendobj\n', 'latin1');
+        parts.push(head, b, tail);
+        at += head.length + b.length + tail.length;
+    });
+    const xref = [`xref\n0 ${objects.length + 1}\n0000000000 65535 f \n`, ...offsets.map(o => `${String(o).padStart(10, '0')} 00000 n \n`)].join('');
+    const trailer = `trailer\n<< /Size ${objects.length + 1} /Root ${catalog} 0 R >>\nstartxref\n${at}\n%%EOF\n`;
+    parts.push(Buffer.from(xref + trailer, 'latin1'));
+    return Buffer.concat(parts);
+}
+
+/**
+ * A real PNG (RGBA, with a little noise so it is bigger than a blank pad's), for
+ * the drawn-signature and picture tests: the server reads its header and
+ * refuses anything that is not one.
+ */
+export function makePng(width = 200, height = 60) {
+    const crcTable = [];
+    for (let n = 0; n < 256; n++) { let c = n; for (let k = 0; k < 8; k++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1; crcTable[n] = c >>> 0; }
+    const crc = (buf) => { let c = 0xffffffff; for (const b of buf) c = crcTable[(c ^ b) & 0xff] ^ (c >>> 8); return (c ^ 0xffffffff) >>> 0; };
+    const chunk = (type, data) => { const len = Buffer.alloc(4); len.writeUInt32BE(data.length); const td = Buffer.concat([Buffer.from(type, 'latin1'), data]); const c = Buffer.alloc(4); c.writeUInt32BE(crc(td)); return Buffer.concat([len, td, c]); };
+    const ihdr = Buffer.alloc(13); ihdr.writeUInt32BE(width, 0); ihdr.writeUInt32BE(height, 4); ihdr[8] = 8; ihdr[9] = 6; ihdr[10] = 0; ihdr[11] = 0; ihdr[12] = 0;
+    const raw = Buffer.alloc((width * 4 + 1) * height);
+    for (let y = 0; y < height; y++) {
+        raw[y * (width * 4 + 1)] = 0;
+        for (let x = 0; x < width; x++) {
+            const i = y * (width * 4 + 1) + 1 + x * 4;
+            const on = (x * 7 + y * 13) % 11 < 3;
+            raw[i] = 20; raw[i + 1] = 20; raw[i + 2] = 30; raw[i + 3] = on ? 255 : 0;
+        }
+    }
+    return Buffer.concat([Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]), chunk('IHDR', ihdr), chunk('IDAT', zlib.deflateSync(raw)), chunk('IEND', Buffer.alloc(0))]);
+}

package/plugins/docs/tests/convert.test.js

@@ -0,0 +1,95 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {startsWithTitle, parseHtml, htmlToMarkdown, htmlToText, countWords, excerpt, preview, outline, standaloneHtml, fileName, decodeEntities}
+    from '../admin/lib/convert.js';
+
+/** Docs - the pure conversions behind export, excerpts and the Outline. */
+
+test('parseHtml builds a tree, decodes entities and drops scripts', () => {
+    const t = parseHtml('<p class="x">a &amp; b<br>c</p><script>alert(1)</script><!-- note -->');
+    assert.equal(t.children.length, 1);
+    const p = t.children[0];
+    assert.equal(p.name, 'p');
+    assert.equal(p.attrs.class, 'x');
+    assert.equal(p.children[0].text, 'a & b');
+    assert.equal(p.children[1].name, 'br');
+});
+
+test('parseHtml closes implied paragraphs, list items and cells', () => {
+    const t = parseHtml('<ul><li>one<li>two</ul><p>para<h2>head</h2><table><tr><td>a<td>b<tr><td>c</table>');
+    const ul = t.children[0];
+    assert.equal(ul.children.length, 2);
+    assert.equal(t.children[2].name, 'h2');
+    const rows = t.children[3].children;
+    assert.equal(rows.length, 2);
+    assert.equal(rows[0].children.length, 2);
+});
+
+test('headings, emphasis, links and images', () => {
+    const md = htmlToMarkdown('<h1>Title</h1><p>Some <strong>bold</strong>, <em>italic</em>, <s>gone</s> and <a href="https://x.test/a b">a link</a>.</p><p><img src="/media/p.png" alt="Pic"></p>');
+    assert.equal(md, '# Title\n\nSome **bold**, *italic*, ~~gone~~ and [a link](https://x.test/a%20b).\n\n![Pic](/media/p.png)\n');
+});
+
+test('bold spaces stay outside the markers', () => {
+    assert.equal(htmlToMarkdown('<p>a<b> b </b>c</p>'), 'a **b** c\n');
+});
+
+test('markdown characters in text are escaped', () => {
+    assert.equal(htmlToMarkdown('<p>2 * 3 = [six] #1</p>'), '2 \\* 3 = \\[six\\] #1\n');
+    assert.equal(htmlToMarkdown('<p># not a heading</p>'), '\\# not a heading\n');
+    assert.equal(htmlToMarkdown('<p>1. not a list</p>'), '1\\. not a list\n');
+});
+
+test('nested lists and checklists', () => {
+    const md = htmlToMarkdown('<ul><li>one<ul><li>inner</li></ul></li><li>two</li></ul><ol start="3"><li>c</li><li>d</li></ol><ul data-type="checklist"><li data-checked="true">done</li><li data-checked="false">todo</li></ul>');
+    assert.equal(md, '- one\n\n  - inner\n- two\n\n3. c\n4. d\n\n- [x] done\n- [ ] todo\n');
+});
+
+test('quotes, code and rules', () => {
+    const md = htmlToMarkdown('<blockquote><p>quoted</p><p>twice</p></blockquote><pre><code class="language-js">let a = 1;\n</code></pre><hr><p>use <code>x*y</code></p>');
+    assert.equal(md, '> quoted\n>\n> twice\n\n```js\nlet a = 1;\n```\n\n---\n\nuse `x*y`\n');
+});
+
+test('tables become GFM tables, pipes escaped', () => {
+    const md = htmlToMarkdown('<table><thead><tr><th>A</th><th>B</th></tr></thead><tbody><tr><td>1|2</td><td>3</td></tr></tbody></table>');
+    assert.equal(md, '| A | B |\n| --- | --- |\n| 1\\|2 | 3 |\n');
+});
+
+test('underline and highlight stay as inline HTML; divs and loose text survive', () => {
+    assert.equal(htmlToMarkdown('<div>loose <u>under</u><div><mark>hi</mark></div></div>'), 'loose <u>under</u>\n\n<mark>hi</mark>\n');
+});
+
+test('line breaks become hard breaks', () => {
+    assert.equal(htmlToMarkdown('<p>a<br>b</p>'), 'a\\\nb\n');
+});
+
+test('plain text, words and excerpts', () => {
+    const html = '<h1>Hi</h1><p>one two&nbsp;three</p><ul><li>four</li><li>five</li></ul>';
+    assert.equal(htmlToText(html), 'Hi\n\none two three\n\nfour\nfive');
+    assert.equal(countWords(html), 6);
+    assert.equal(countWords(''), 0);
+    assert.equal(excerpt('<p>' + 'word '.repeat(100) + '</p>', 20).length, 20);
+});
+
+test('outline lists headings in order', () => {
+    assert.deepEqual(outline('<h1>A</h1><p>x</p><div><h2>B <em>b</em></h2></div><h3> </h3>'),
+        [{level: 1, text: 'A'}, {level: 2, text: 'B b'}]);
+});
+
+test('standalone file escapes the title; file names are safe', () => {
+    const html = standaloneHtml('<Plan>', '<p>x</p>');
+    assert.match(html, /<title>&lt;Plan&gt;<\/title>/);
+    assert.equal(fileName('a/b: c?', 'md'), 'a b c.md');
+    assert.equal(fileName('', 'html'), 'Untitled.html');
+    assert.equal(decodeEntities('&#x41;&#66;&bogus;'), 'AB&bogus;');
+});
+
+test('preview keeps one line per block', () => {
+    assert.equal(preview('<h1>Plan</h1><p>Intro</p><ul><li>a</li><li>b</li></ul>'), 'Plan\nIntro\na\nb');
+});
+
+test('a body that opens with its title is not given the title twice', () => {
+    assert.equal(startsWithTitle('Plan & more', '<h1>Plan <em>&amp;</em>  more</h1><p>x</p>'), true);
+    assert.equal(startsWithTitle('Plan', '<p>Plan</p>'), false);
+    assert.doesNotMatch(standaloneHtml('Plan', '<h1>Plan</h1>'), /<h1>Plan<\/h1>\n<h1>/);
+});

package/plugins/docs/tests/drafts.test.js

@@ -0,0 +1,82 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {draftKey, legacyDraftKey, normaliseDraft, makeDraft, draftDiffers, draftFate, draftQuestion, copyTitle, when} from '../admin/lib/drafts.js';
+
+/** Docs - the editor's kept draft and its restore question (admin/lib/drafts.js). */
+
+test('a draft is per signed-in person: keyed by user, and never read back for anyone else', () => {
+    assert.equal(draftKey('abc', 'u1'), 'docs.draft.u1.abc');
+    assert.equal(draftKey('abc', ''), '', 'nobody signed in: no key, no draft');
+    assert.equal(legacyDraftKey('abc'), 'docs.draft.abc');
+    const mine = {owner: 'u1', title: 'T', content: '<p>a</p>', at: 'A', was: 'W'};
+    assert.deepEqual(normaliseDraft(mine, 'u1'), mine);
+    assert.equal(normaliseDraft(mine, 'u2'), null, "another person's draft is no draft");
+    assert.equal(normaliseDraft({...mine, owner: undefined}, 'u1'), null, 'no owner (2.9) is never offered');
+    assert.equal(normaliseDraft(mine, ''), null);
+});
+
+test('a stored draft is whitelisted; `base` is read as `was`', () => {
+    assert.equal(normaliseDraft(null, 'u1'), null);
+    assert.equal(normaliseDraft('not json', 'u1'), null);
+    assert.equal(normaliseDraft({owner: 'u1', title: 'x'}, 'u1'), null, 'no content, no draft');
+    const old = normaliseDraft(JSON.stringify({owner: 'u1', title: 'T', content: '<p>a</p>', at: '2026-10-14T09:00:00.000Z', base: '2026-10-14T08:00:00.000Z', evil: 1}), 'u1');
+    assert.deepEqual(old, {owner: 'u1', title: 'T', content: '<p>a</p>', at: '2026-10-14T09:00:00.000Z', was: '2026-10-14T08:00:00.000Z'});
+    assert.equal(normaliseDraft({owner: 'u1', content: '', title: 5, was: 'w'}, 'u1').title, '');
+});
+
+test('makeDraft keeps the owner and the `was` it is given - never "now"', () => {
+    const d = makeDraft({owner: 'u1', title: 'T', content: 'c', was: 'W1', at: 'A1'});
+    assert.deepEqual(d, {owner: 'u1', title: 'T', content: 'c', at: 'A1', was: 'W1'});
+    assert.equal(makeDraft({content: 'c'}).was, '');
+});
+
+test('draftDiffers: content or a title of its own', () => {
+    const doc = {title: 'T', content: '<p>a</p>'};
+    assert.equal(draftDiffers({title: 'T', content: '<p>a</p>'}, doc), false);
+    assert.equal(draftDiffers({title: '', content: '<p>a</p>'}, doc), false);
+    assert.equal(draftDiffers({title: 'T2', content: '<p>a</p>'}, doc), true);
+    assert.equal(draftDiffers({title: 'T', content: '<p>b</p>'}, doc), true);
+    assert.equal(draftDiffers(null, doc), false);
+    assert.equal(draftDiffers({content: 'x'}, null), true);
+});
+
+test('draftFate: deleted, changed since `was`, or nothing', () => {
+    const d = {was: '2026-10-14T08:00:00.000Z', at: '2026-10-14T09:00:00.000Z'};
+    assert.equal(draftFate(d, null), 'deleted');
+    assert.equal(draftFate(d, {updatedAt: d.was}), '');
+    assert.equal(draftFate(d, {updatedAt: '2026-10-14T08:30:00.000Z'}), 'changed', 'saved elsewhere before the draft was even kept');
+    assert.equal(draftFate(d, {updatedAt: d.was, trashedAt: 'x'}), 'trashed');
+    // No `was`: only a save after the draft was kept counts.
+    assert.equal(draftFate({at: d.at}, {updatedAt: '2026-10-14T08:30:00.000Z'}), '');
+    assert.equal(draftFate({at: d.at}, {updatedAt: '2026-10-14T10:00:00.000Z'}), 'changed');
+});
+
+test('draftQuestion: OK throws away; Cancel keeps - put back, or a new document when it has gone', () => {
+    const d = {title: 'Q3 <b>"plan"</b>', content: 'c', was: 'W', at: '2026-10-14T09:00:00.000Z'};
+    const plain = draftQuestion(d, {title: 'Q3', updatedAt: 'W'});
+    assert.equal(plain.copy, false);
+    assert.equal(plain.options.confirmText, 'Throw away');
+    assert.equal(plain.options.cancelText, 'Put them back');
+    assert.match(plain.text, /^Throw away the changes/);
+    assert.ok(plain.text.includes('Q3 &lt;b&gt;&quot;plan&quot;&lt;/b&gt;'), 'the title is escaped for E.confirm');
+    assert.ok(!/saved since|deleted/.test(plain.text));
+
+    const changed = draftQuestion(d, {title: 'Q3', updatedAt: '2026-10-14T10:00:00.000Z'});
+    assert.equal(changed.copy, false);
+    assert.match(changed.text, /saved since/);
+    assert.match(changed.text, /Version history/);
+
+    const gone = draftQuestion(d, null);
+    assert.equal(gone.copy, true);
+    assert.equal(gone.options.confirmText, 'Throw away');
+    assert.match(gone.options.cancelText, /new document/);
+    assert.match(gone.text, /deleted since/);
+});
+
+test('copyTitle and when', () => {
+    assert.equal(copyTitle({title: 'Plan'}), 'Plan (your unsaved changes)');
+    assert.equal(copyTitle({title: '  '}), 'Untitled (your unsaved changes)');
+    assert.ok(copyTitle({title: 'x'.repeat(300)}).length <= 200);
+    assert.equal(when(''), '');
+    assert.match(when('2026-10-14T09:05:00.000Z'), /^\d{1,2} Oct, \d\d:\d\d$/);
+});

package/plugins/docs/tests/pdf.test.js

@@ -0,0 +1,86 @@
+import './_env.js';
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import zlib from 'zlib';
+import {makePdf} from './_pdf.js';
+import {inspectPdf, extractPdfText, extractToHtml, extractCapability, contentDisposition, cleanFileName, sizeText, REFUSED_NAMES} from '../lib/pdf.js';
+
+/** lib/pdf.js on its own: the checks a file passes before Docs keeps it, and the text read out of it. */
+
+test('inspectPdf: a PDF passes with its page count and hash; anything else is refused with a plain reason', () => {
+    const ok = inspectPdf(makePdf({pages: ['a', 'b', 'c']}));
+    assert.equal(ok.ok, true);
+    assert.equal(ok.pages, 3);
+    assert.match(ok.sha256, /^[a-f0-9]{64}$/);
+    assert.equal(ok.encrypted, false);
+    assert.deepEqual(inspectPdf(Buffer.alloc(0)), {ok: false, reason: 'The file is empty.'});
+    assert.match(inspectPdf(Buffer.from('<html>'), {}).reason, /not a PDF/);
+    assert.match(inspectPdf(makePdf(), {maxBytes: 100}).reason, /over 0 MB/);
+    assert.equal(inspectPdf(makePdf({extra: ['<< /Filter /Standard /V 2 >>'], catalogExtra: '/Encrypt 9 0 R'})).encrypted, true);
+});
+
+test('inspectPdf: every refused name is caught plain, #-escaped, and inside a deflated stream; lookalikes pass', () => {
+    for (const name of Object.keys(REFUSED_NAMES)) {
+        const plain = inspectPdf(makePdf({extra: [`<< /${name} 1 >>`]}));
+        assert.equal(plain.ok, false, name);
+        assert.match(plain.reason, new RegExp(REFUSED_NAMES[name].replace(/[()]/g, '\\$&')));
+        const escaped = `/${name.slice(0, 1)}#${name.charCodeAt(1).toString(16)}${name.slice(2)}`;
+        assert.equal(inspectPdf(makePdf({extra: [`<< ${escaped} 1 >>`]})).ok, false, `${name} escaped as ${escaped}`);
+        const deflated = zlib.deflateSync(Buffer.from(`<< /${name} 1 >>`));
+        const hidden = makePdf({extra: [Buffer.concat([Buffer.from(`<< /Length ${deflated.length} /Filter /FlateDecode >>\nstream\n`), deflated, Buffer.from('\nendstream')])]});
+        assert.equal(inspectPdf(hidden).ok, false, `${name} deflated`);
+    }
+    // A name that merely starts the same way is a different name.
+    assert.equal(inspectPdf(makePdf({extra: ['<< /JSON 1 /Launcher 2 /XFAB 3 >>']})).ok, true);
+    // Text inside a content stream that says the word is not a name.
+    assert.equal(inspectPdf(makePdf({pages: ['JavaScript is fun /JavaScript']})).ok, false, 'a slash-name in a string is still refused - the check is by bytes, not meaning');
+    assert.equal(inspectPdf(makePdf({pages: ['JavaScript is fun']})).ok, true);
+});
+
+test('inspectPdf: a stream that inflates to too much is refused quickly, never followed', () => {
+    // 200 MB of zeros deflate to a few KB.
+    const bomb = zlib.deflateSync(Buffer.alloc(200 * 1024 * 1024));
+    const pdf = makePdf({extra: [Buffer.concat([Buffer.from(`<< /Length ${bomb.length} /Filter /FlateDecode >>\nstream\n`), bomb, Buffer.from('\nendstream')])]});
+    const t0 = Date.now();
+    assert.equal(inspectPdf(pdf).ok, false);
+    assert.ok(Date.now() - t0 < 5000, 'capped, so quick');
+});
+
+test('extractPdfText: the text of each page, or null when it cannot be read', {skip: extractCapability().available ? false : extractCapability().reason}, async () => {
+    const r = await extractPdfText(makePdf({pages: ['Hello Docs', 'Second (page)'], deflate: true}));
+    assert.deepEqual(r, {pages: 2, text: 'Hello Docs\n\nSecond (page)'});
+    assert.equal(await extractPdfText(Buffer.from('%PDF-1.4 not really')), null);
+    assert.equal(await extractPdfText(makePdf(), {timeoutMs: 1}), null, 'out of time is null, not an error');
+});
+
+test('extractToHtml, cleanFileName, contentDisposition, sizeText', () => {
+    assert.equal(extractToHtml('One <b>\ntwo\n\nThree'), '<p>One &lt;b&gt;<br>two</p><p>Three</p>');
+    assert.equal(extractToHtml(''), '');
+    assert.equal(cleanFileName('../../etc/passwd\u0000.pdf'), 'passwd.pdf');
+    assert.equal(cleanFileName('C:\\Users\\me\\Q3 report.pdf'), 'Q3 report.pdf');
+    assert.equal(cleanFileName(''), 'document.pdf');
+    assert.equal(contentDisposition('Q3 "report" é.pdf'), `attachment; filename="Q3 report _.pdf"; filename*=UTF-8''Q3%20%22report%22%20%C3%A9.pdf`);
+    assert.match(contentDisposition('x.pdf', true), /^inline; /);
+    assert.equal(sizeText(877), '877 B');
+    assert.equal(sizeText(1536), '2 KB');
+    assert.equal(sizeText(1.5 * 1024 * 1024), '1.5 MB');
+    assert.equal(sizeText(12 * 1024 * 1024), '12 MB');
+});
+
+test('inspectPdf: a name inside an object stream with a nested dictionary, a double-deflated stream, and a stream past the cap', () => {
+    const name = Buffer.from('<< /S /JavaScript /JS (x) >>');
+    // The stream dictionary holds a nested one (every object stream with /DecodeParms does): still inflated and searched.
+    const z = zlib.deflateSync(name);
+    const nested = makePdf({extra: [Buffer.concat([Buffer.from(`<< /Type /ObjStm /Filter /FlateDecode /DecodeParms << /Predictor 12 /Columns 4 >> /Length ${z.length} >>\nstream\n`), z, Buffer.from('\nendstream')])]});
+    assert.equal(inspectPdf(nested).ok, false, 'nested dictionary');
+    // Deflated twice (/Filter [/FlateDecode /FlateDecode]).
+    const zz = zlib.deflateSync(zlib.deflateSync(name));
+    const twice = makePdf({extra: [Buffer.concat([Buffer.from(`<< /Filter [/FlateDecode /FlateDecode] /Length ${zz.length} >>\nstream\n`), zz, Buffer.from('\nendstream')])]});
+    assert.equal(inspectPdf(twice).ok, false, 'double deflate');
+    // A stream that inflates past the cap cannot be checked: refused, not skipped.
+    const bomb = zlib.deflateSync(Buffer.alloc(40 * 1024 * 1024));
+    const big = makePdf({extra: [Buffer.concat([Buffer.from(`<< /Length ${bomb.length} /Filter /FlateDecode >>\nstream\n`), bomb, Buffer.from('\nendstream')])]});
+    const r = inspectPdf(big);
+    assert.equal(r.ok, false);
+    assert.match(r.reason, /too large to check/);
+});