domma-cms 1.8.32 → 1.8.34

package/plugins/docs/tests/plugin.test.js

@@ -0,0 +1,816 @@
+import {DATA} from './_env.js';
+import {after, test} from 'node:test';
+import assert from 'node:assert/strict';
+import Fastify from 'fastify';
+import fs from 'fs/promises';
+import path from 'path';
+import {fileURLToPath} from 'url';
+import docsPlugin from '../plugin.js';
+import {load as loadRoles} from '../../../cms/server/services/roles.js';
+
+/**
+ * Docs - the settings route and version retention.
+ *
+ * Only the refusing paths of PUT /settings are driven here: a successful save
+ * persists through savePluginState into the host CMS's config/plugins.json,
+ * which in this harness is a real checkout that a test has no business
+ * writing to. The accepting path is exercised in the browser instead.
+ *
+ * Documents are written to a temp dir (tests/_env.js), removed afterwards.
+ */
+
+const created = [];
+
+after(async () => {
+    // Everything lives in a temp dir (tests/_env.js): remove it whole.
+    await fs.rm(DATA, {recursive: true, force: true});
+});
+
+const PEOPLE = [
+    {id: 'd-alice', name: 'Alice', email: 'alice@example.com', role: 'user'},
+    {id: 'd-bob', name: 'Bob', email: 'bob@example.com', role: 'user'},
+    {id: 'd-carol', name: 'Carol', email: 'carol@example.com', role: 'user'},
+    {id: 'd-admin', name: 'Ada Admin', email: 'ada@example.com', role: 'super-admin'},
+    {id: 'docs-test', name: 'Tester', email: 'test@example.com', role: 'super-admin'}
+];
+
+/** Mail that goes nowhere and remembers what it was asked to send. */
+const outbox = [];
+const mailer = {
+    createTransport: async () => ({}),
+    sendEmail: async (t, msg) => { outbox.push(msg); return {ok: true}; }
+};
+
+/**
+ * @param   {object} [opts]
+ * @param   {object} [opts.user]     who authenticate() says is calling
+ * @param   {boolean} [opts.admin]   whether requireAdmin lets them through
+ * @param   {object} [opts.settings] plugin settings, as config/plugins.json would hold them
+ */
+async function buildApp({user = {id: 'docs-test', role: 'super-admin'}, admin = true, settings = {}, perm = true} = {}) {
+    const app = Fastify();
+    const authenticate = async (req) => { req.user = {name: PEOPLE.find(p => p.id === user.id)?.name, ...user}; };
+    const requireAdmin = async (req, reply) => {
+        if (!admin) return reply.code(403).send({error: 'Admin access required'});
+    };
+    // perm: whether this user's role holds the Docs permission (1.3).
+    const requirePermission = () => async (req, reply) => {
+        if (!perm) return reply.code(403).send({error: 'Insufficient permissions'});
+    };
+    await app.register(docsPlugin, {prefix: '/api/plugins/docs', settings: {...settings},
+        auth: {authenticate, requireAdmin, requirePermission}, listUsers: async () => PEOPLE, mailer});
+    return app;
+}
+
+/** JSON body of an inject, with the status alongside. */
+async function call(app, method, url, payload, headers) {
+    const res = await app.inject({method, url: `/api/plugins/docs${url}`, payload, headers});
+    let body = null;
+    try { body = JSON.parse(res.body); } catch { body = res.body; }
+    return {status: res.statusCode, body};
+}
+
+async function make(app, fields) {
+    const r = await call(app, 'POST', '/documents', fields);
+    assert.equal(r.status, 201);
+    created.push(r.body.id);
+    return r.body;
+}
+
+test('GET /settings answers the whitelisted keys, and whether this user may change them', async () => {
+    await loadRoles();
+    const app = await buildApp({settings: {maxVersions: 20, scope: 'all', smtpPassword: 'never-sent'}});
+    const res = await app.inject({method: 'GET', url: '/api/plugins/docs/settings'});
+    assert.equal(res.statusCode, 200);
+    const body = JSON.parse(res.body);
+    assert.deepEqual(Object.keys(body).sort(), ['allowSend', 'autoSaveInterval', 'canEdit', 'extensions', 'maxVersions', 'pdf', 'publicLinks', 'scope', 'suggestions', 'trashDays']);
+    assert.equal(body.maxVersions, 20);
+    assert.equal(body.scope, 'all');
+    assert.equal(body.canEdit, true);
+
+    const nobody = await buildApp({user: {id: 'x', role: 'no-such-role'}});
+    const r2 = JSON.parse((await nobody.inject({method: 'GET', url: '/api/plugins/docs/settings'})).body);
+    assert.equal(r2.canEdit, false);
+});
+
+test('PUT /settings refuses non-admins and bad values, before anything is saved', async () => {
+    const guest = await buildApp({admin: false});
+    const denied = await guest.inject({method: 'PUT', url: '/api/plugins/docs/settings', payload: {maxVersions: 10}});
+    assert.equal(denied.statusCode, 403);
+
+    const app = await buildApp();
+    for (const payload of [{trashDays: 'soon'}, {autoSaveInterval: -1}, {maxVersions: 'lots'}]) {
+        const res = await app.inject({method: 'PUT', url: '/api/plugins/docs/settings', payload});
+        assert.equal(res.statusCode, 400, JSON.stringify(payload));
+    }
+    // Nothing applied: the running config still answers its defaults.
+    const after = JSON.parse((await app.inject({method: 'GET', url: '/api/plugins/docs/settings'})).body);
+    assert.equal(after.autoSaveInterval, 30000);
+    assert.equal(after.trashDays, 30);
+});
+
+test('version history keeps the newest maxVersions and never stops recording', async () => {
+    // It used to stop writing versions at the cap, so a document's history
+    // froze at its fiftieth save and everything after was unrecoverable.
+    // Two people take turns, so every save keeps what it replaced (one
+    // person's own saves within ten minutes are merged - see the next test).
+    const owner = await buildApp({settings: {maxVersions: 3}});
+    const bob = await buildApp({user: {id: 'd-bob', role: 'user'}, settings: {maxVersions: 3}});
+    const doc = JSON.parse((await owner.inject({method: 'POST', url: '/api/plugins/docs/documents',
+        payload: {title: 'Retention', content: '<p>v0</p>'}})).body);
+    created.push(doc.id);
+    await owner.inject({method: 'PUT', url: `/api/plugins/docs/documents/${doc.id}/shares`, payload: {shares: [{userId: 'd-bob', role: 'editor'}]}});
+
+    for (let i = 1; i <= 6; i++) {
+        const app = i % 2 ? bob : owner;
+        await app.inject({method: 'PUT', url: `/api/plugins/docs/documents/${doc.id}`, payload: {content: `<p>v${i}</p>`}});
+    }
+    // A title-only save changes no content and so records nothing.
+    await owner.inject({method: 'PUT', url: `/api/plugins/docs/documents/${doc.id}`, payload: {title: 'Renamed'}});
+
+    const versions = JSON.parse((await owner.inject({method: 'GET', url: `/api/plugins/docs/documents/${doc.id}/versions`})).body);
+    assert.deepEqual(versions.map(v => v.num), [6, 5, 4]);
+    assert.deepEqual(versions.map(v => v.content), ['<p>v5</p>', '<p>v4</p>', '<p>v3</p>']);
+
+    // Restoring always snapshots what it replaces, within the same limit.
+    const restore = await owner.inject({method: 'POST', url: `/api/plugins/docs/documents/${doc.id}/versions/4/restore`});
+    assert.equal(JSON.parse(restore.body).content, '<p>v3</p>');
+    const again = JSON.parse((await owner.inject({method: 'GET', url: `/api/plugins/docs/documents/${doc.id}/versions`})).body);
+    assert.deepEqual(again.map(v => v.num), [7, 6, 5]);
+    assert.equal(again[0].content, '<p>v6</p>');
+});
+
+test('2.0: one person saving again within ten minutes adds no version (autosave does not flood history)', async () => {
+    const alice = await buildApp({user: {id: 'd-alice', role: 'user'}});
+    const doc = await make(alice, {title: 'Draft', content: '<p>start</p>'});
+    for (const t of ['a', 'b', 'c']) await call(alice, 'PUT', `/documents/${doc.id}`, {content: `<p>${t}</p>`});
+    const versions = (await call(alice, 'GET', `/documents/${doc.id}/versions`)).body;
+    // Creating counts as Alice's save, so even the first edit is merged into her session.
+    assert.equal(versions.length, 0);
+    const bob = await buildApp({user: {id: 'd-bob', role: 'user'}});
+    await call(alice, 'PUT', `/documents/${doc.id}/shares`, {shares: [{userId: 'd-bob', role: 'editor'}]});
+    await call(bob, 'PUT', `/documents/${doc.id}`, {content: '<p>bob</p>'});
+    const after = (await call(alice, 'GET', `/documents/${doc.id}/versions`)).body;
+    assert.deepEqual(after.map(v => v.content), ['<p>c</p>']);
+});
+
+test('1.3: the Docs permission; shared site-wide means read, not rewrite; folders must be yours', async () => {
+    await loadRoles();
+    const u = (id, role = 'user') => ({id, role});
+    const without = await buildApp({user: u('d-none'), perm: false});
+    assert.equal((await without.inject({method: 'GET', url: '/api/plugins/docs/documents'})).statusCode, 403);
+    assert.equal((await without.inject({method: 'POST', url: '/api/plugins/docs/documents', payload: {title: 'x'}})).statusCode, 403);
+
+    const shared = {scope: 'all'};
+    const alice = await buildApp({user: u('d-alice'), settings: shared});
+    const bob = await buildApp({user: u('d-bob'), settings: shared});
+    const admin = await buildApp({user: u('d-admin', 'super-admin'), settings: shared});
+    const doc = JSON.parse((await alice.inject({method: 'POST', url: '/api/plugins/docs/documents', payload: {title: 'Alice', content: 'hers'}})).body);
+    created.push(doc.id);
+    assert.equal((await bob.inject({method: 'GET', url: `/api/plugins/docs/documents/${doc.id}`})).statusCode, 200, 'shared: others may read');
+    assert.equal((await bob.inject({method: 'PUT', url: `/api/plugins/docs/documents/${doc.id}`, payload: {content: 'mine now'}})).statusCode, 403, 'but not rewrite');
+    assert.equal((await bob.inject({method: 'DELETE', url: `/api/plugins/docs/documents/${doc.id}`})).statusCode, 403, 'nor delete');
+    assert.equal((await admin.inject({method: 'PUT', url: `/api/plugins/docs/documents/${doc.id}`, payload: {title: 'Tidied'}})).statusCode, 200, 'an admin may');
+
+    // Folders: only one this user may use.
+    const own = await buildApp({user: u('d-carol')});
+    const folder = JSON.parse((await alice.inject({method: 'POST', url: '/api/plugins/docs/folders', payload: {name: 'Hers'}})).body);
+    const put = await own.inject({method: 'POST', url: '/api/plugins/docs/documents', payload: {title: 'x', folderId: folder.id}});
+    assert.equal(put.statusCode, 400, "someone else's folder, when not shared");
+    assert.equal((await own.inject({method: 'POST', url: '/api/plugins/docs/documents', payload: {title: 'x', folderId: 'nope'}})).statusCode, 400);
+    await alice.inject({method: 'DELETE', url: `/api/plugins/docs/folders/${folder.id}`});
+});
+
+// ----------------------------------------------------------------------- 2.0
+
+const as = (id) => buildApp({user: {id, role: PEOPLE.find(p => p.id === id)?.role || 'user'}});
+
+test('2.0: bodies are sanitised on the way in', async () => {
+    const app = await as('d-alice');
+    const doc = await make(app, {title: '  Clean  ', content: '<p onclick="x()">hi<script>alert(1)</script></p><a href="javascript:alert(1)">bad</a><img src="x" onerror="y()"><p style="text-align:center;position:fixed">c</p><ul data-type="checklist"><li data-checked="true">t</li></ul>'});
+    assert.equal(doc.title, 'Clean');
+    assert.doesNotMatch(doc.content, /onclick|script|javascript|onerror|position/);
+    assert.match(doc.content, /text-align:center/);
+    assert.match(doc.content, /<li data-checked="true">/);
+    assert.equal(doc.format, 'html');
+});
+
+test('2.0: sharing - viewers read, editors edit, only the owner trashes; strangers see nothing', async () => {
+    const alice = await as('d-alice');
+    const bob = await as('d-bob');
+    const carol = await as('d-carol');
+    const doc = await make(alice, {title: 'Plan', content: '<p>v1</p>'});
+
+    assert.equal((await call(bob, 'GET', `/documents/${doc.id}`)).status, 404, 'private by default');
+
+    const shared = await call(alice, 'PUT', `/documents/${doc.id}/shares`, {shares: [
+        {userId: 'd-bob', role: 'viewer'}, {userId: 'd-carol', role: 'editor'},
+        {userId: 'd-alice', role: 'editor'}, {userId: 'nobody', role: 'editor'}]});
+    assert.equal(shared.status, 200);
+    assert.deepEqual(shared.body.shares.map(s => [s.userId, s.role, s.name]), [['d-bob', 'viewer', 'Bob'], ['d-carol', 'editor', 'Carol']]);
+
+    const seen = await call(bob, 'GET', `/documents/${doc.id}`);
+    assert.equal(seen.body.access, 'viewer');
+    assert.equal((await call(bob, 'PUT', `/documents/${doc.id}`, {content: '<p>bob</p>'})).status, 403);
+    assert.equal((await call(carol, 'PUT', `/documents/${doc.id}`, {content: '<p>carol</p>'})).status, 200);
+    assert.equal((await call(carol, 'DELETE', `/documents/${doc.id}`)).status, 403, 'editors do not trash');
+    assert.equal((await call(carol, 'PUT', `/documents/${doc.id}`, {folderId: null})).status, 403, 'nor move');
+
+    // An editor may add people but not remove another editor.
+    const byCarol = await call(carol, 'PUT', `/documents/${doc.id}/shares`, {shares: [{userId: 'd-bob', role: 'viewer'}]});
+    assert.equal(byCarol.status, 403);
+
+    // Shared with me lists it for Bob, not for Alice; Mine lists it for Alice.
+    const bobShared = await call(bob, 'GET', '/documents?view=shared');
+    assert.ok(bobShared.body.some(r => r.id === doc.id && r.ownerName === 'Alice' && r.content === undefined && r.excerpt === 'carol'));
+    assert.ok(!(await call(alice, 'GET', '/documents?view=shared')).body.some(r => r.id === doc.id));
+    assert.ok((await call(alice, 'GET', '/documents?view=mine')).body.some(r => r.id === doc.id && r.shared));
+
+    // A viewer's duplicate is their own, private, unshared copy.
+    const copy = await call(bob, 'POST', `/documents/${doc.id}/duplicate`);
+    created.push(copy.body.id);
+    assert.equal(copy.status, 201);
+    assert.equal(copy.body.userId, 'd-bob');
+    assert.deepEqual(copy.body.shares, []);
+    assert.equal(copy.body.publicLink, null);
+});
+
+test('2.0: notify emails the people newly shared with', async () => {
+    const alice = await as('d-alice');
+    const doc = await make(alice, {title: 'Notes <b>', content: '<p>x</p>'});
+    outbox.length = 0;
+    // The sharer's request claims a Host of its own: the email must never point there.
+    const r = await call(alice, 'PUT', `/documents/${doc.id}/shares`, {shares: [{userId: 'd-bob', role: 'viewer'}], notify: true, message: 'Have a look <3'}, {host: 'evil.example'});
+    assert.equal(r.body.notified, 1);
+    assert.equal(outbox[0].to, 'bob@example.com');
+    assert.match(outbox[0].html, /Notes &lt;b&gt;/);
+    assert.match(outbox[0].html, /Have a look &lt;3/);
+    assert.match(outbox[0].html, new RegExp(`#/plugins/docs/d/${doc.id}`));
+    assert.equal(outbox[0].html.includes('evil.example'), false, 'no link from the Host header');
+    assert.equal(outbox[0].text.includes('evil.example'), false);
+    // Saving the same list again notifies nobody.
+    const again = await call(alice, 'PUT', `/documents/${doc.id}/shares`, {shares: [{userId: 'd-bob', role: 'editor'}], notify: true});
+    assert.equal(again.body.notified, 0);
+});
+
+test('2.0: the edit lock - one session edits, others wait, the owner can take over', async () => {
+    const alice = await as('d-alice');
+    const carol = await as('d-carol');
+    const bob = await as('d-bob');
+    const doc = await make(alice, {title: 'Locked', content: '<p>a</p>'});
+    await call(alice, 'PUT', `/documents/${doc.id}/shares`, {shares: [{userId: 'd-carol', role: 'editor'}, {userId: 'd-bob', role: 'viewer'}]});
+
+    const s1 = 'session-carol-1';
+    const got = await call(carol, 'POST', `/documents/${doc.id}/lock`, {session: s1});
+    assert.equal(got.status, 200);
+    assert.equal(got.body.lock.mine, true);
+
+    const refused = await call(alice, 'POST', `/documents/${doc.id}/lock`, {session: 'session-alice-1'});
+    assert.equal(refused.body.ok, false);
+    assert.equal(refused.body.lock.name, 'Carol');
+    assert.equal(refused.body.canTakeOver, true);
+
+    // A save from outside the lock is refused; the holder's goes through.
+    assert.equal((await call(alice, 'PUT', `/documents/${doc.id}`, {content: '<p>alice</p>'}, {'x-docs-session': 'session-alice-1'})).status, 423);
+    assert.equal((await call(carol, 'PUT', `/documents/${doc.id}`, {content: '<p>carol</p>'}, {'x-docs-session': s1})).status, 200);
+
+    // Viewers never take the lock; they are told it is read-only.
+    const viewer = await call(bob, 'POST', `/documents/${doc.id}/lock`, {session: 'session-bob-1'});
+    assert.equal(viewer.body.readOnly, true);
+    assert.equal(viewer.body.lock.name, 'Carol');
+
+    // The list shows who is editing.
+    const row = (await call(alice, 'GET', '/documents?view=mine')).body.find(r => r.id === doc.id);
+    assert.equal(row.locked.name, 'Carol');
+
+    // An editor may not force; the owner may.
+    const s3 = 'session-carol-2';
+    await call(carol, 'DELETE', `/documents/${doc.id}/lock?session=${s1}`);
+    await call(carol, 'POST', `/documents/${doc.id}/lock`, {session: s3});
+    assert.equal((await call(bob, 'POST', `/documents/${doc.id}/lock`, {session: 'session-bob-1', force: true})).body.readOnly, true);
+    const took = await call(alice, 'POST', `/documents/${doc.id}/lock`, {session: 'session-alice-1', force: true});
+    assert.equal(took.status, 200);
+    // Carol's next heartbeat learns she lost it.
+    const lost = await call(carol, 'POST', `/documents/${doc.id}/lock`, {session: s3});
+    assert.equal(lost.body.ok, false);
+    assert.equal(lost.body.lock.name, 'Alice');
+    await call(alice, 'DELETE', `/documents/${doc.id}/lock?session=session-alice-1`);
+});
+
+test('2.0: trash, restore, delete for good; star and recent', async () => {
+    const alice = await as('d-alice');
+    const doc = await make(alice, {title: 'Binned', content: '<p>b</p>'});
+
+    const star = await call(alice, 'POST', `/documents/${doc.id}/star`, {on: true});
+    assert.equal(star.body.starred, true);
+    assert.ok((await call(alice, 'GET', '/documents?view=starred')).body.some(r => r.id === doc.id && r.starred));
+    await call(alice, 'GET', `/documents/${doc.id}`);
+    assert.equal((await call(alice, 'GET', '/documents?view=recent')).body[0].id, doc.id);
+
+    assert.equal((await call(alice, 'DELETE', `/documents/${doc.id}?permanent=1`)).status, 409, 'trash first');
+    assert.equal((await call(alice, 'DELETE', `/documents/${doc.id}`)).body.trashed, true);
+    assert.ok(!(await call(alice, 'GET', '/documents?view=mine')).body.some(r => r.id === doc.id));
+    assert.ok((await call(alice, 'GET', '/documents?view=trash')).body.some(r => r.id === doc.id));
+    assert.equal((await call(alice, 'PUT', `/documents/${doc.id}`, {content: 'x'})).status, 409);
+
+    await call(alice, 'POST', `/documents/${doc.id}/restore`);
+    assert.ok((await call(alice, 'GET', '/documents?view=mine')).body.some(r => r.id === doc.id));
+
+    await call(alice, 'DELETE', `/documents/${doc.id}`);
+    assert.equal((await call(alice, 'POST', '/trash/empty')).body.deleted >= 1, true);
+    assert.equal((await call(alice, 'GET', `/documents/${doc.id}`)).status, 404);
+    assert.ok(!(await call(alice, 'GET', '/documents?view=starred')).body.some(r => r.id === doc.id), 'forgotten');
+});
+
+test('2.0: public links - on, served sanitised and unindexed, off again; site switch', async () => {
+    const alice = await as('d-alice');
+    const doc = await make(alice, {title: 'Public <i>', content: '<h2>Hello</h2><p>World</p>'});
+    const on = await call(alice, 'POST', `/documents/${doc.id}/link`);
+    assert.equal(on.status, 200);
+    const token = on.body.publicLink.token;
+    assert.match(on.body.url, new RegExp(`/docs/s/${token}$`));
+    assert.equal((await call(alice, 'POST', `/documents/${doc.id}/link`)).body.publicLink.token, token, 'idempotent');
+
+    const {default: docsPublic} = await import('../plugin.public.js');
+    const pub = Fastify();
+    await pub.register(docsPublic, {settings: {}});
+    // The page itself renders through the CMS template; the downloads do not.
+    const md = await pub.inject({method: 'GET', url: `/docs/s/${token}?download=md`});
+    assert.equal(md.statusCode, 200);
+    assert.equal(md.body, '# Public <i>\n\n## Hello\n\nWorld\n');
+    assert.match(md.headers['x-robots-tag'], /noindex/);
+    assert.match(md.headers['content-disposition'], /attachment/);
+    const page = await pub.inject({method: 'GET', url: `/docs/s/${token}`});
+    assert.equal(page.statusCode, 200);
+    assert.match(page.body, /<h2>Hello<\/h2>/);
+    assert.match(page.body, /Public &lt;i&gt;/);
+    assert.equal((await pub.inject({method: 'GET', url: '/docs/s/not-a-real-token-at-all'})).statusCode, 404);
+
+    await call(alice, 'DELETE', `/documents/${doc.id}/link`);
+    assert.equal((await pub.inject({method: 'GET', url: `/docs/s/${token}`})).statusCode, 404, 'off means off');
+
+    // Switched off site-wide: no new links, and old ones stop.
+    const again = await call(alice, 'POST', `/documents/${doc.id}/link`);
+    const offSite = await buildApp({user: {id: 'd-alice', role: 'user'}, settings: {publicLinks: false}});
+    assert.equal((await call(offSite, 'POST', `/documents/${doc.id}/link`)).status, 403);
+    assert.equal((await pub.inject({method: 'GET', url: `/docs/s/${again.body.publicLink.token}`})).statusCode, 404);
+    await buildApp({user: {id: 'd-alice', role: 'user'}});   // back to the default for later tests
+});
+
+test('2.0: import Markdown, HTML and text', async () => {
+    const alice = await as('d-alice');
+    const md = await call(alice, 'POST', '/documents/import', {name: 'notes.md', text: '---\ntitle: x\n---\n# Meeting\n\n- [x] done\n- [ ] todo\n\n| a | b |\n|---|---|\n| 1 | 2 |\n'});
+    created.push(md.body.id);
+    assert.equal(md.status, 201);
+    assert.equal(md.body.title, 'Meeting');
+    assert.match(md.body.content, /<ul data-type="checklist">\s*<li data-checked="true">done/);
+    assert.match(md.body.content, /<table>/);
+
+    const html = await call(alice, 'POST', '/documents/import', {name: 'page.html', text: '<html><body><p onclick="x">Hi</p><script>bad()</script></body></html>'});
+    created.push(html.body.id);
+    assert.equal(html.body.title, 'page');
+    assert.equal(html.body.content, '<p>Hi</p>');
+
+    const txt = await call(alice, 'POST', '/documents/import', {name: 'plain.txt', text: 'one <two>\nline\n\npara'});
+    created.push(txt.body.id);
+    assert.equal(txt.body.content, '<p>one &lt;two&gt;<br />line</p><p>para</p>');
+
+    assert.equal((await call(alice, 'POST', '/documents/import', {name: 'x.pdf', text: 'nope'})).status, 400);
+});
+
+test('2.0: send by email - inline or as a link; limits', async () => {
+    const alice = await as('d-alice');
+    const doc = await make(alice, {title: 'Agenda', content: '<p>Item one</p>'});
+    outbox.length = 0;
+    const inline = await call(alice, 'POST', `/documents/${doc.id}/send`, {to: 'a@example.com, b@example.com', message: 'FYI', mode: 'inline'});
+    assert.equal(inline.body.sent, 2);
+    assert.match(outbox[0].html, /<p>Item one<\/p>/);
+    assert.equal(outbox[0].subject, 'Agenda');
+
+    const link = await call(alice, 'POST', `/documents/${doc.id}/send`, {to: ['c@example.com'], mode: 'link'});
+    assert.match(link.body.url, /\/docs\/s\//);
+    assert.match(outbox[2].html, /Read it here/);
+
+    assert.equal((await call(alice, 'POST', `/documents/${doc.id}/send`, {to: 'not-an-address'})).status, 400);
+    assert.equal((await call(alice, 'POST', `/documents/${doc.id}/send`, {to: Array.from({length: 11}, (_, i) => `p${i}@example.com`)})).status, 400);
+    const bob = await as('d-bob');
+    assert.equal((await call(bob, 'POST', `/documents/${doc.id}/send`, {to: 'x@example.com'})).status, 404);
+});
+
+test('2.0: people lists others who hold Docs; emails only for admins', async () => {
+    await loadRoles();
+    const alice = await as('d-alice');
+    const list = (await call(alice, 'GET', '/people')).body;
+    assert.ok(list.some(p => p.id === 'd-bob' && p.name === 'Bob' && p.email === undefined));
+    assert.ok(!list.some(p => p.id === 'd-alice'));
+    const admin = await as('d-admin');
+    assert.ok((await call(admin, 'GET', '/people')).body.some(p => p.id === 'd-bob' && p.email === 'bob@example.com'));
+});
+
+test('2.0 review: a save from a stale copy is refused (409), never written over newer work', async () => {
+    const alice = await as('d-alice');
+    const doc = await make(alice, {title: 'Race', content: '<p>one</p>'});
+    const first = await call(alice, 'PUT', `/documents/${doc.id}`, {content: '<p>two</p>', baseUpdatedAt: doc.updatedAt});
+    assert.equal(first.status, 200);
+    await new Promise(r => setTimeout(r, 5));
+    const stale = await call(alice, 'PUT', `/documents/${doc.id}`, {content: '<p>stale</p>', baseUpdatedAt: doc.updatedAt});
+    assert.equal(stale.status, 409);
+    assert.equal(stale.body.conflict, true);
+    assert.equal((await call(alice, 'GET', `/documents/${doc.id}`)).body.content, '<p>two</p>');
+    // A move (no text) is not a conflict.
+    assert.equal((await call(alice, 'PUT', `/documents/${doc.id}`, {folderId: null, baseUpdatedAt: doc.updatedAt})).status, 200);
+});
+
+test('2.0 review: concurrent share + save both land', async () => {
+    const alice = await as('d-alice');
+    const doc = await make(alice, {title: 'Both', content: '<p>x</p>'});
+    await Promise.all([
+        call(alice, 'PUT', `/documents/${doc.id}/shares`, {shares: [{userId: 'd-bob', role: 'viewer'}]}),
+        call(alice, 'PUT', `/documents/${doc.id}`, {content: '<p>saved</p>'})
+    ]);
+    const now = (await call(alice, 'GET', `/documents/${doc.id}`)).body;
+    assert.equal(now.content, '<p>saved</p>');
+    assert.deepEqual(now.shares.map(s => s.userId), ['d-bob']);
+});
+
+test('2.0 review: lock edges - wrong session cannot release, editor cannot force, restore needs the lock', async () => {
+    const alice = await as('d-alice');
+    const carol = await as('d-carol');
+    const doc = await make(alice, {title: 'Edges', content: '<p>a</p>'});
+    await call(alice, 'PUT', `/documents/${doc.id}/shares`, {shares: [{userId: 'd-carol', role: 'editor'}]});
+    await call(carol, 'PUT', `/documents/${doc.id}`, {content: '<p>b</p>'});   // another person: a version is kept
+    await call(alice, 'POST', `/documents/${doc.id}/lock`, {session: 'alice-session-1'});
+    await call(carol, 'DELETE', `/documents/${doc.id}/lock?session=not-the-session`);
+    assert.equal((await call(carol, 'POST', `/documents/${doc.id}/lock`, {session: 'carol-session-1'})).body.ok, false, 'still held');
+    assert.equal((await call(carol, 'POST', `/documents/${doc.id}/lock`, {session: 'carol-session-1', force: true})).status, 403);
+    const versions = (await call(alice, 'GET', `/documents/${doc.id}/versions`)).body;
+    assert.equal((await call(carol, 'POST', `/documents/${doc.id}/versions/${versions[0].num}/restore`, {}, {'x-docs-session': 'carol-session-1'})).status, 423);
+    assert.equal((await call(alice, 'POST', `/documents/${doc.id}/versions/${versions[0].num}/restore`, {}, {'x-docs-session': 'alice-session-1'})).status, 200);
+    await call(alice, 'DELETE', `/documents/${doc.id}/lock?session=alice-session-1`);
+});
+
+test('2.0 review: the lock expires on its own', async () => {
+    const {acquireLock, lockOf, LOCK_TTL_MS} = await import('../lib/store.js');
+    const t0 = Date.now();
+    assert.equal(acquireLock('ttl-doc-1', {userId: 'a', name: 'A', session: 's-aaaaaaaa'}, t0).ok, true);
+    assert.equal(acquireLock('ttl-doc-1', {userId: 'b', name: 'B', session: 's-bbbbbbbb'}, t0 + 1000).ok, false);
+    assert.equal(lockOf('ttl-doc-1', t0 + LOCK_TTL_MS + 1), null);
+    assert.equal(acquireLock('ttl-doc-1', {userId: 'b', name: 'B', session: 's-bbbbbbbb'}, t0 + LOCK_TTL_MS + 2).ok, true);
+});
+
+test('2.0 review: Trash belongs to the owner - sharees lose it, public page and send refuse, admins empty only their own', async () => {
+    const alice = await as('d-alice');
+    const bob = await as('d-bob');
+    const doc = await make(alice, {title: 'Binned share', content: '<p>x</p>'});
+    await call(alice, 'PUT', `/documents/${doc.id}/shares`, {shares: [{userId: 'd-bob', role: 'editor'}]});
+    const token = (await call(alice, 'POST', `/documents/${doc.id}/link`)).body.publicLink.token;
+    await call(alice, 'DELETE', `/documents/${doc.id}`);
+    assert.equal((await call(bob, 'GET', `/documents/${doc.id}`)).status, 404);
+    assert.equal((await call(bob, 'POST', `/documents/${doc.id}/duplicate`)).status, 404);
+    assert.equal((await call(alice, 'POST', `/documents/${doc.id}/send`, {to: 'x@example.com'})).status, 409);
+    const {default: docsPublic} = await import('../plugin.public.js');
+    const pub = Fastify();
+    await pub.register(docsPublic, {settings: {}});
+    assert.equal((await pub.inject({method: 'GET', url: `/docs/s/${token}`})).statusCode, 404);
+    // An admin on a site-wide install empties only their own Trash.
+    const admin = await buildApp({user: {id: 'd-admin', role: 'super-admin'}, settings: {scope: 'all'}});
+    await call(admin, 'POST', '/trash/empty');
+    assert.equal((await call(alice, 'GET', `/documents/${doc.id}`)).status, 200, 'still in Alice\'s Trash');
+    await buildApp({user: {id: 'd-alice', role: 'user'}});   // back to the default scope
+});
+
+test('2.0 review: viewers cannot send; daily email allowance; sending can be switched off', async () => {
+    const alice = await as('d-alice');
+    const bob = await as('d-bob');
+    const doc = await make(alice, {title: 'Mail', content: '<p>x</p>'});
+    await call(alice, 'PUT', `/documents/${doc.id}/shares`, {shares: [{userId: 'd-bob', role: 'viewer'}]});
+    assert.equal((await call(bob, 'POST', `/documents/${doc.id}/send`, {to: 'x@example.com'})).status, 403);
+    const carol = await as('d-carol');
+    const cdoc = await make(carol, {title: 'Lots', content: '<p>x</p>'});
+    let status = 200;
+    for (let i = 0; i < 6 && status === 200; i++) {
+        status = (await call(carol, 'POST', `/documents/${cdoc.id}/send`, {to: Array.from({length: 10}, (_, j) => `c${i}-${j}@example.com`)})).status;
+    }
+    assert.equal(status, 429, 'the 51st address today is refused');
+    const off = await buildApp({user: {id: 'd-alice', role: 'user'}, settings: {allowSend: false}});
+    assert.equal((await call(off, 'POST', `/documents/${doc.id}/send`, {to: 'x@example.com'})).status, 403);
+    await buildApp({user: {id: 'd-alice', role: 'user'}});
+});
+
+test('2.0 review: public page escapes the title and downloads carry a safe file name', async () => {
+    const alice = await as('d-alice');
+    const doc = await make(alice, {title: `Bob's "plan" <script>x</script>\r\nX-Evil: 1`, content: '<p>body</p>'});
+    const token = (await call(alice, 'POST', `/documents/${doc.id}/link`)).body.publicLink.token;
+    const {default: docsPublic} = await import('../plugin.public.js');
+    const pub = Fastify();
+    await pub.register(docsPublic, {settings: {}});
+    const page = await pub.inject({method: 'GET', url: `/docs/s/${token}`});
+    assert.doesNotMatch(page.body, /<script>x<\/script>/);
+    const dl = await pub.inject({method: 'GET', url: `/docs/s/${token}?download=txt`});
+    const cd = dl.headers['content-disposition'];
+    assert.doesNotMatch(cd, /[\r\n]/);
+    assert.equal(dl.headers['x-evil'], undefined);
+    assert.match(cd, /filename\*=UTF-8''[^'()*]*$/);
+});
+
+test('2.0 review: pre-2.0 documents - Markdown converted per document, raw HTML sanitised, templates too', async () => {
+    const {migrateLegacy, looksLikeMarkdown} = await import('../plugin.js');
+    assert.equal(looksLikeMarkdown('# Hi\n\n- a'), true);
+    assert.equal(looksLikeMarkdown('<p>hi</p>'), false);
+    const dir = path.join(DATA, 'documents');
+    await fs.mkdir(dir, {recursive: true});
+    const base = {folderId: null, tags: [], userId: 'd-alice', createdAt: '2026-01-01T00:00:00.000Z', updatedAt: '2026-01-01T00:00:00.000Z'};
+    await fs.writeFile(path.join(dir, 'legacy-md-0001.json'), JSON.stringify({...base, id: 'legacy-md-0001', title: 'Old md', content: '# Heading\n\n**bold** text'}));
+    await fs.writeFile(path.join(dir, 'legacy-html-0001.json'), JSON.stringify({...base, id: 'legacy-html-0001', title: 'Old html', content: '<p onclick="x()">hi</p><script>bad()</script>'}));
+    created.push('legacy-md-0001', 'legacy-html-0001');
+    assert.equal(await migrateLegacy(), 2);
+    const md = JSON.parse(await fs.readFile(path.join(dir, 'legacy-md-0001.json'), 'utf8'));
+    assert.match(md.content, /<h1>Heading<\/h1>/);
+    assert.match(md.content, /<strong>bold<\/strong>/);
+    assert.equal(md.format, 'html');
+    const html = JSON.parse(await fs.readFile(path.join(dir, 'legacy-html-0001.json'), 'utf8'));
+    assert.equal(html.content, '<p>hi</p>');
+    assert.equal(await migrateLegacy(), 0, 'once only');
+    await fs.access(path.join(DATA, '.backup-markdown', 'legacy-md-0001.json'));
+});
+
+test('2.7: the sidebar badge counts your own documents as an inventory - shared ones in the details, Trash left out', async () => {
+    const owner = await buildApp({user: {id: 'd-carol', role: 'user'}});
+    const before = (await call(owner, 'GET', '/count')).body;
+    assert.equal(before.inventory, true);
+    assert.equal(before.tone, 'info');
+    assert.ok(before.label, 'never an empty label');
+    const a = await make(owner, {title: 'Badge one'});
+    const b = await make(owner, {title: 'Badge two'});
+    let r = await call(owner, 'GET', '/count');
+    assert.equal(r.body.count, before.count + 2, 'a create clears the cached answer');
+    assert.equal(r.body.details.items[0].text, 'Badge two');
+    await call(owner, 'DELETE', `/documents/${b.id}`);
+    r = await call(owner, 'GET', '/count');
+    assert.equal(r.body.count, before.count + 1, 'Trash is left out');
+    assert.equal(r.body.details.rows.find(x => x.label === 'In Trash').value, String(Number(before.details.rows.find(x => x.label === 'In Trash').value) + 1));
+
+    await call(owner, 'PUT', `/documents/${a.id}/shares`, {shares: [{userId: 'd-bob', role: 'viewer'}], notify: false});
+    const bob = await buildApp({user: {id: 'd-bob', role: 'user'}});
+    const theirs = (await call(bob, 'GET', '/count')).body;
+    assert.ok(Number(theirs.details.rows.find(x => x.label === 'Shared with you').value) >= 1);
+    assert.match(theirs.label, /shared with you$/);
+    assert.ok(!theirs.details.items.some(i => i.text === 'Badge one'), 'only your own documents are counted');
+});
+
+test('2.7: the badge cache - a count racing a write never keeps the old answer; two people do not evict each other', async () => {
+    const carol = await buildApp({user: {id: 'd-carol', role: 'user'}});
+    const bob = await buildApp({user: {id: 'd-bob', role: 'user'}});
+    const start = (await call(carol, 'GET', '/count')).body.count;
+    // A count in flight while a create lands: the next count must see the new document.
+    const [, made] = await Promise.all([call(carol, 'GET', '/count'), call(carol, 'POST', '/documents', {title: 'Raced'})]);
+    created.push(made.body.id);
+    assert.equal((await call(carol, 'GET', '/count')).body.count, start + 1);
+    // Alternating people: each keeps their own answer.
+    const c1 = (await call(carol, 'GET', '/count')).body;
+    const b1 = (await call(bob, 'GET', '/count')).body;
+    assert.deepEqual((await call(carol, 'GET', '/count')).body, c1);
+    assert.deepEqual((await call(bob, 'GET', '/count')).body, b1);
+    assert.notDeepEqual(c1.details.items, b1.details.items);
+});
+
+test('2.8.1: version history is for editors and the owner - a viewer gets 403, not the text removed before sharing', async () => {
+    const alice = await as('d-alice');
+    const doc = await make(alice, {title: 'Secret draft', content: '<p>salary table</p>'});
+    await call(alice, 'PUT', `/documents/${doc.id}`, {content: '<p>clean</p>'});
+    await call(alice, 'PUT', `/documents/${doc.id}/shares`, {shares: [{userId: 'd-bob', role: 'viewer'}, {userId: 'd-carol', role: 'editor'}]});
+    const bob = await as('d-bob');
+    const carol = await as('d-carol');
+    assert.equal((await call(bob, 'GET', `/documents/${doc.id}`)).status, 200, 'the viewer reads the document');
+    assert.equal((await call(bob, 'GET', `/documents/${doc.id}/versions`)).status, 403);
+    const mine = await call(alice, 'GET', `/documents/${doc.id}/versions`);
+    assert.equal(mine.status, 200);
+    if (mine.body.length) {
+        assert.equal((await call(bob, 'GET', `/documents/${doc.id}/versions/${mine.body[0].num}`)).status, 403);
+        assert.equal((await call(carol, 'GET', `/documents/${doc.id}/versions/${mine.body[0].num}`)).status, 200);
+    }
+    assert.equal((await call(carol, 'GET', `/documents/${doc.id}/versions`)).status, 200);
+});
+
+test('2.10: /count answers what each Home place shows when opened - the rail numbers match the lists', async () => {
+    const dave = await buildApp({user: {id: 'd-alice', role: 'user'}});
+    const folder = (await call(dave, 'POST', '/folders', {name: 'Rail counts'})).body;
+    const top = await make(dave, {title: 'Top level'});
+    const filed = await make(dave, {title: 'Filed', folderId: folder.id});
+    const binned = await make(dave, {title: 'Binned'});
+    await call(dave, 'DELETE', `/documents/${binned.id}`);
+    await call(dave, 'POST', `/documents/${filed.id}/star`, {on: true});
+    const {places} = (await call(dave, 'GET', '/count')).body;
+    for (const [view, extra] of [['starred', ''], ['shared', ''], ['mine', '&folder='], ['trash', '']]) {
+        const list = (await call(dave, 'GET', `/documents?view=${view}${extra}`)).body;
+        assert.equal(places[view], list.length, `${view} matches its list`);
+    }
+    assert.ok(places.mine >= 1 && places.trash >= 1 && places.starred >= 1);
+    assert.ok(!(await call(dave, 'GET', '/documents?view=mine&folder=')).body.some(r => r.id === filed.id), 'filed documents are under their folder');
+    created.push(top.id, filed.id);
+});
+
+test('2.10: a write that does not come through a Docs route (Docs Pro, via services) still refreshes /count', async () => {
+    const {docsRegistry} = await import('../lib/extensions.js');
+    const app = await buildApp({user: {id: 'd-carol', role: 'user'}});
+    const before = (await call(app, 'GET', '/count')).body;
+    assert.deepEqual((await call(app, 'GET', '/count')).body, before, 'cached between writes');
+    const svc = docsRegistry().services;
+    const made = await svc.createDoc({title: 'From an add-on', content: '<p>x</p>'}, {id: 'd-carol', name: 'Carol', role: 'user'});
+    created.push(made.id);
+    let r = (await call(app, 'GET', '/count')).body;
+    assert.equal(r.count, before.count + 1, 'createDoc clears the cached answer');
+    await svc.writeDoc({...(await svc.readDoc(made.id)), trashedAt: new Date().toISOString()});
+    r = (await call(app, 'GET', '/count')).body;
+    assert.equal(r.count, before.count, 'writeDoc clears it too');
+    assert.equal(r.places.trash, before.places.trash + 1);
+});
+
+// ------------------------------------------------------------------ 2.13: PDF documents
+
+import {makePdf} from './_pdf.js';
+import {extractCapability} from '../lib/pdf.js';
+import {filePath, versionFilePath} from '../lib/store.js';
+
+const b64 = (buf) => buf.toString('base64');
+const exists = (p) => fs.access(p).then(() => true, () => false);
+
+test('2.13: a PDF uploads as a document - kept as it is, text read for search, served with safe headers', async () => {
+    const alice = await as('d-alice');
+    const pdf = makePdf({pages: ['Quarterly figures', 'Second page'], deflate: true});
+    const up = await call(alice, 'POST', '/documents/upload', {name: 'Q3 report.pdf', data: b64(pdf)});
+    assert.equal(up.status, 201, JSON.stringify(up.body));
+    created.push(up.body.id);
+    assert.equal(up.body.format, 'pdf');
+    assert.equal(up.body.title, 'Q3 report');
+    assert.equal(up.body.file.size, pdf.length);
+    assert.equal(up.body.file.name, 'Q3 report.pdf');
+    assert.match(up.body.file.sha256, /^[a-f0-9]{64}$/);
+    assert.ok(await exists(filePath(up.body.id)), 'the file is on disk');
+    if (extractCapability().available) {
+        assert.equal(up.body.file.pages, 2);
+        assert.match(up.body.content, /<p>Quarterly figures<\/p>/);
+        // Search finds words inside the PDF.
+        const found = (await call(alice, 'GET', '/documents?view=mine&q=quarterly')).body;
+        assert.ok(found.some(r => r.id === up.body.id));
+    }
+    // Rows say what it is.
+    const row = (await call(alice, 'GET', '/documents?view=mine')).body.find(r => r.id === up.body.id);
+    assert.equal(row.format, 'pdf');
+    assert.equal(row.file.size, pdf.length);
+
+    // The file comes back byte for byte, inline by default, never sniffed or cached.
+    const file = await alice.inject({method: 'GET', url: `/api/plugins/docs/documents/${up.body.id}/file`});
+    assert.equal(file.statusCode, 200);
+    assert.equal(file.headers['content-type'], 'application/pdf');
+    assert.ok(Buffer.from(file.rawPayload).equals(pdf));
+    assert.match(file.headers['content-disposition'], /^inline; filename="Q3 report\.pdf"/);
+    assert.equal(file.headers['x-content-type-options'], 'nosniff');
+    assert.match(file.headers['content-security-policy'], /sandbox/);
+    assert.match(file.headers['cache-control'], /no-store/);
+    const dl = await alice.inject({method: 'GET', url: `/api/plugins/docs/documents/${up.body.id}/file?download=1`});
+    assert.match(dl.headers['content-disposition'], /^attachment/);
+
+    // No text to edit; the title, folder and tags still change.
+    assert.equal((await call(alice, 'PUT', `/documents/${up.body.id}`, {content: '<p>x</p>'})).status, 400);
+    const renamed = await call(alice, 'PUT', `/documents/${up.body.id}`, {title: 'Q3 (final)', tags: ['finance']});
+    assert.equal(renamed.status, 200);
+    assert.equal(renamed.body.format, 'pdf', 'a title save keeps the kind');
+    assert.deepEqual(renamed.body.tags, ['finance']);
+
+    // Strangers get nothing; a viewer gets the file.
+    const bob = await as('d-bob');
+    assert.equal((await bob.inject({method: 'GET', url: `/api/plugins/docs/documents/${up.body.id}/file`})).statusCode, 404);
+    await call(alice, 'PUT', `/documents/${up.body.id}/shares`, {shares: [{userId: 'd-bob', role: 'viewer'}]});
+    assert.equal((await bob.inject({method: 'GET', url: `/api/plugins/docs/documents/${up.body.id}/file`})).statusCode, 200);
+    assert.equal((await call(bob, 'PUT', `/documents/${up.body.id}/file`, {name: 'x.pdf', data: b64(pdf)})).status, 403, 'a viewer cannot replace it');
+
+    // An HTML document has no file.
+    const html = await make(alice, {title: 'Words', content: '<p>w</p>'});
+    assert.equal((await alice.inject({method: 'GET', url: `/api/plugins/docs/documents/${html.id}/file`})).statusCode, 404);
+    assert.equal((await call(alice, 'PUT', `/documents/${html.id}/file`, {name: 'x.pdf', data: b64(pdf)})).status, 400);
+});
+
+test('2.13: uploads are checked - not a PDF, too large, JavaScript (plain, #-escaped or deflated), attached files', async () => {
+    const alice = await as('d-alice');
+    const refused = async (buf, name = 'x.pdf') => (await call(alice, 'POST', '/documents/upload', {name, data: b64(buf)}));
+    let r = await refused(Buffer.from('hello world'));
+    assert.equal(r.status, 400);
+    assert.match(r.body.error, /not a PDF/);
+    assert.equal((await call(alice, 'POST', '/documents/upload', {name: 'x.pdf', data: ''})).status, 400);
+    assert.equal((await call(alice, 'POST', '/documents/upload', {name: 'x.pdf', data: b64(makePdf()), folderId: 'no-such-folder'})).status, 400);
+
+    r = await refused(makePdf({extra: ['<< /S /JavaScript /JS (app.alert(1)) >>']}));
+    assert.equal(r.status, 400);
+    assert.match(r.body.error, /JavaScript/);
+    r = await refused(makePdf({extra: ['<< /S /J#61vaScript /JS (x) >>']}));
+    assert.match(r.body.error, /JavaScript/, 'a #-escaped name is still the name');
+    const zlib = await import('zlib');
+    const hidden = zlib.deflateSync(Buffer.from('<< /S /JavaScript /JS (x) >>'));
+    r = await refused(makePdf({extra: [Buffer.concat([Buffer.from(`<< /Length ${hidden.length} /Filter /FlateDecode >>\nstream\n`), hidden, Buffer.from('\nendstream')])]}));
+    assert.match(r.body.error, /JavaScript/, 'inside a compressed stream too');
+    r = await refused(makePdf({extra: ['<< /Type /Filespec /F (evil.exe) /EF << /F 9 0 R >> >>', '<< /Type /EmbeddedFile /Length 0 >>\nstream\n\nendstream']}));
+    assert.match(r.body.error, /attached/);
+    r = await refused(makePdf({extra: ['<< /S /Launch /F (cmd.exe) >>']}));
+    assert.match(r.body.error, /Launch/);
+    // An /OpenAction that only opens at a page is fine.
+    r = await refused(makePdf({catalogExtra: '/OpenAction [5 0 R /Fit]'}));
+    assert.equal(r.status, 201);
+    created.push(r.body.id);
+});
+
+test('2.13: replacing the file keeps the old one as a version with its file; restore puts it back; copies carry the file; delete removes it', async () => {
+    const alice = await as('d-alice');
+    const v1 = makePdf({pages: ['Version one']});
+    const v2 = makePdf({pages: ['Version two', 'more']});
+    const up = await call(alice, 'POST', '/documents/upload', {name: 'contract.pdf', data: b64(v1)});
+    created.push(up.body.id);
+    const id = up.body.id;
+
+    const rep = await call(alice, 'PUT', `/documents/${id}/file`, {name: 'contract-v2.pdf', data: b64(v2)});
+    assert.equal(rep.status, 200, JSON.stringify(rep.body));
+    assert.equal(rep.body.file.size, v2.length);
+    assert.equal(rep.body.file.name, 'contract-v2.pdf');
+    assert.ok(Buffer.from((await alice.inject({method: 'GET', url: `/api/plugins/docs/documents/${id}/file`})).rawPayload).equals(v2));
+
+    const versions = (await call(alice, 'GET', `/documents/${id}/versions`)).body;
+    assert.equal(versions.length, 1);
+    assert.equal(versions[0].format, 'pdf');
+    assert.equal(versions[0].file.size, v1.length);
+    assert.ok(await exists(versionFilePath(id, versions[0].num)));
+    const old = await alice.inject({method: 'GET', url: `/api/plugins/docs/documents/${id}/versions/${versions[0].num}/file`});
+    assert.equal(old.statusCode, 200);
+    assert.ok(Buffer.from(old.rawPayload).equals(v1));
+    // History is the editors': a viewer may not fetch an old file.
+    await call(alice, 'PUT', `/documents/${id}/shares`, {shares: [{userId: 'd-bob', role: 'viewer'}]});
+    const bob = await as('d-bob');
+    assert.equal((await bob.inject({method: 'GET', url: `/api/plugins/docs/documents/${id}/versions/${versions[0].num}/file`})).statusCode, 403);
+
+    // Restore: the current file becomes a version, the old one is the file again.
+    const back = await call(alice, 'POST', `/documents/${id}/versions/${versions[0].num}/restore`);
+    assert.equal(back.status, 200, JSON.stringify(back.body));
+    assert.equal(back.body.file.size, v1.length);
+    assert.ok(Buffer.from((await alice.inject({method: 'GET', url: `/api/plugins/docs/documents/${id}/file`})).rawPayload).equals(v1));
+    assert.equal((await call(alice, 'GET', `/documents/${id}/versions`)).body.length, 2);
+
+    // A copy is the file too.
+    const copy = await call(alice, 'POST', `/documents/${id}/duplicate`, {});
+    created.push(copy.body.id);
+    assert.equal(copy.body.format, 'pdf');
+    assert.ok(Buffer.from((await alice.inject({method: 'GET', url: `/api/plugins/docs/documents/${copy.body.id}/file`})).rawPayload).equals(v1));
+
+    // In Trash the file cannot be replaced; deleted for good, the file goes with the record.
+    await call(alice, 'DELETE', `/documents/${copy.body.id}`);
+    assert.equal((await call(alice, 'PUT', `/documents/${copy.body.id}/file`, {name: 'x.pdf', data: b64(v2)})).status, 409);
+    await call(alice, 'DELETE', `/documents/${copy.body.id}?permanent=1`);
+    assert.equal(await exists(filePath(copy.body.id)), false);
+});
+
+test('2.13: a PDF on its public link - the page frames the file, the file is served, downloads are the PDF; email attaches it', async () => {
+    const alice = await as('d-alice');
+    const pdf = makePdf({pages: ['Public PDF']});
+    const up = await call(alice, 'POST', '/documents/upload', {name: 'leaflet.pdf', data: b64(pdf)});
+    created.push(up.body.id);
+    const token = (await call(alice, 'POST', `/documents/${up.body.id}/link`)).body.publicLink.token;
+    const {default: docsPublic} = await import('../plugin.public.js');
+    const pub = Fastify();
+    await pub.register(docsPublic, {settings: {}});
+    const page = await pub.inject({method: 'GET', url: `/docs/s/${token}`});
+    assert.equal(page.statusCode, 200);
+    assert.match(page.body, new RegExp(`<iframe class="docs-public__pdf" src="/docs/s/${token}\\?file=1"`));
+    assert.match(page.body, /Download PDF/);
+    assert.doesNotMatch(page.body, /download=md/);
+    const file = await pub.inject({method: 'GET', url: `/docs/s/${token}?file=1`});
+    assert.equal(file.headers['content-type'], 'application/pdf');
+    assert.match(file.headers['content-disposition'], /^inline/);
+    assert.ok(Buffer.from(file.rawPayload).equals(pdf));
+    const dl = await pub.inject({method: 'GET', url: `/docs/s/${token}?download=md`});
+    assert.equal(dl.headers['content-type'], 'application/pdf', 'nothing but the PDF is derived from a PDF');
+    assert.match(dl.headers['content-disposition'], /^attachment; filename="leaflet\.pdf"/);
+
+    outbox.length = 0;
+    const sent = await call(alice, 'POST', `/documents/${up.body.id}/send`, {to: 'z@example.com', mode: 'inline'});
+    assert.equal(sent.body.sent, 1, JSON.stringify(sent.body));
+    assert.equal(outbox[0].attachments.length, 1);
+    assert.equal(outbox[0].attachments[0].filename, 'leaflet.pdf');
+    assert.ok(outbox[0].attachments[0].content.equals(pdf));
+    assert.match(outbox[0].html, /attached as a PDF/);
+});
+
+test('2.13.2 review: restoring the oldest PDF version at the history cap; POST /documents never makes a fileless PDF', async () => {
+    const alice = await buildApp({user: {id: 'd-alice', role: 'user'}, settings: {maxVersions: 5}});
+    const up = await call(alice, 'POST', '/documents/upload', {name: 'cap.pdf', data: b64(makePdf({pages: ['v0']}))});
+    created.push(up.body.id);
+    for (let i = 1; i <= 3; i++) await call(alice, 'PUT', `/documents/${up.body.id}/file`, {name: `v${i}.pdf`, data: b64(makePdf({pages: [`v${i}`]}))});
+    const versions = (await call(alice, 'GET', `/documents/${up.body.id}/versions`)).body;
+    const oldest = versions.at(-1);
+    const back = await call(alice, 'POST', `/documents/${up.body.id}/versions/${oldest.num}/restore`);
+    assert.equal(back.status, 200, JSON.stringify(back.body));
+    const bytes = Buffer.from((await alice.inject({method: 'GET', url: `/api/plugins/docs/documents/${up.body.id}/file`})).rawPayload);
+    assert.ok(bytes.equals(makePdf({pages: ['v0']})), 'the oldest file is back');
+
+    const fake = await call(alice, 'POST', '/documents', {title: 'Fake', content: '<p>x</p>', format: 'pdf', file: {pages: 9, size: 1}});
+    created.push(fake.body.id);
+    assert.equal(fake.body.format, 'html');
+    await buildApp({user: {id: 'd-alice', role: 'user'}});
+});