domma-cms 1.8.32 → 1.8.34

package/plugins/garage/plugin.js

@@ -0,0 +1,471 @@
+/**
+ * Garage Plugin — Backend
+ *
+ * Proxies DVLA vehicle lookups and stores per-user vehicle history via the
+ * CMS collections service (garage-vehicles collection). Uses MongoDB when
+ * configured, falls back to file-based storage automatically.
+ * All routes are mounted at /api/plugins/garage/ by the plugin system.
+ *
+ * Routes:
+ *   POST /lookup             — Proxy DVLA lookup, upsert into history
+ *   GET  /vehicles           — Saved vehicles for the authenticated user
+ *   GET  /history            — Full lookup history for the authenticated user
+ *   PATCH /vehicles/:id/save — Set ({isSaved}) or toggle isSaved on a vehicle entry
+ *   DELETE /vehicles/:id     — Remove a vehicle entry from history
+ *   GET  /count              — The sidebar badge: saved vehicles whose MOT or tax has run out or is due
+ */
+import {
+    createEntry,
+    deleteEntry,
+    getEntry,
+    listEntries,
+    updateEntry
+} from '../../server/services/collections.js';
+import defaultConfig from './config.js';
+import {badgeFor, isoDay, shortDay, vehicleNotices} from './admin/lib/garage.js';
+import {getPluginSettings} from '../../server/services/plugins.js';
+
+const COLLECTION = 'garage-vehicles';
+
+/** In-memory rate limit tracker: Map<userId, { count: number, windowStart: number }> */
+const rateLimits = new Map();
+
+
+/**
+ * Flatten a collection entry into the vehicle model the frontend expects.
+ *
+ * @param {{ id: string, data: object }} entry
+ * @returns {object}
+ */
+function toVehicle(entry) {
+    return {
+        id: entry.id,
+        ...entry.data,
+        isSaved: entry.data.isSaved === true || entry.data.isSaved === 'true'
+    };
+}
+
+/**
+ * Check and increment the per-user rate limit.
+ *
+ * @param {string} userId
+ * @param {{ max: number, windowSeconds: number }} config
+ * @returns {{ allowed: boolean, retryAfter: number }} retryAfter is seconds until reset (0 if allowed)
+ */
+function checkRateLimit(userId, config) {
+    const now = Date.now();
+    const windowMs = config.windowSeconds * 1000;
+    const entry = rateLimits.get(userId);
+
+    if (!entry || now - entry.windowStart >= windowMs) {
+        rateLimits.set(userId, {count: 1, windowStart: now});
+        return {allowed: true, retryAfter: 0};
+    }
+
+    if (entry.count >= config.max) {
+        const retryAfter = Math.ceil((entry.windowStart + windowMs - now) / 1000);
+        return {allowed: false, retryAfter};
+    }
+
+    entry.count += 1;
+    return {allowed: true, retryAfter: 0};
+}
+
+/**
+ * Normalise a registration number: uppercase and strip all spaces.
+ *
+ * @param {string} reg
+ * @returns {string}
+ */
+function normaliseReg(reg) {
+    return String(reg).toUpperCase().replace(/\s+/g, '');
+}
+
+/**
+ * Map a DVLA API response to our internal vehicle data shape.
+ *
+ * @param {string} userId
+ * @param {object} dvlaData - Raw response from DVLA API
+ * @returns {object}
+ */
+function mapDvlaResponse(userId, dvlaData) {
+    return {
+        userId,
+        registrationNumber: dvlaData.registrationNumber ?? '',
+        make: dvlaData.make ?? '',
+        colour: dvlaData.colour ?? '',
+        yearOfManufacture: dvlaData.yearOfManufacture ?? null,
+        fuelType: dvlaData.fuelType ?? '',
+        engineCapacity: dvlaData.engineCapacity ?? null,
+        co2Emissions: dvlaData.co2Emissions ?? null,
+        motStatus: dvlaData.motStatus ?? '',
+        motExpiryDate: dvlaData.motExpiryDate ?? null,
+        taxStatus: dvlaData.taxStatus ?? '',
+        taxDueDate: dvlaData.taxDueDate ?? null,
+        isSaved: false,
+        lookupDate: new Date().toISOString()
+    };
+}
+
+/**
+ * Escape HTML special characters for safe server-side rendering.
+ *
+ * @param {*} str
+ * @returns {string}
+ */
+function escHtml(str) {
+    return String(str ?? '')
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;');
+}
+
+/**
+ * Render a list of saved vehicle objects as a static HTML card grid.
+ * Used by the [garage-vehicles /] shortcode for front-end display.
+ *
+ * @param {object[]} vehicles
+ * @returns {string} HTML string
+ */
+function renderVehiclesHtml(vehicles) {
+    const cards = vehicles.map(v => {
+        const motLv = (v.motStatus || '').toLowerCase();
+        const motCls = motLv === 'valid' ? 'badge-success' : motLv ? 'badge-danger' : 'badge-secondary';
+        const taxLv = (v.taxStatus || '').toLowerCase();
+        const taxCls = taxLv === 'taxed' ? 'badge-success' : taxLv === 'sorn' ? 'badge-warning' : taxLv ? 'badge-danger' : 'badge-secondary';
+
+        const details = [
+            v.colour,
+            v.fuelType,
+            v.engineCapacity ? `${v.engineCapacity}cc` : null,
+            v.co2Emissions ? `${v.co2Emissions}g/km` : null
+        ].filter(Boolean).join(' · ');
+
+        const motExpiry = v.motExpiryDate
+            ? `<span style="font-size:0.78rem;color:var(--dm-text-muted,#888);">Exp ${escHtml(shortDay(v.motExpiryDate))}</span>` : '';
+        const taxDue = v.taxDueDate
+            ? `<span style="font-size:0.78rem;color:var(--dm-text-muted,#888);">Due ${escHtml(shortDay(v.taxDueDate))}</span>` : '';
+
+        return `<div class="card" style="flex:1;min-width:260px;max-width:340px;">
+  <div class="card-header" style="display:flex;align-items:center;justify-content:space-between;gap:0.75rem;">
+    <span style="background:#FFD900;color:#000;font-family:'Arial Black',Arial,sans-serif;font-weight:900;font-size:1rem;letter-spacing:3px;padding:0.15rem 0.5rem;border-radius:4px;border:2px solid #000;">${escHtml(v.registrationNumber || '')}</span>
+    <span style="font-size:0.85rem;color:var(--dm-text-muted,#888);">${escHtml(v.make || '')}${v.yearOfManufacture ? ` · ${escHtml(String(v.yearOfManufacture))}` : ''}</span>
+  </div>
+  <div class="card-body">
+    ${details ? `<p style="font-size:0.85rem;color:var(--dm-text-muted,#888);margin:0 0 0.6rem;">${escHtml(details)}</p>` : ''}
+    <div style="display:flex;gap:0.4rem;flex-wrap:wrap;align-items:center;">
+      <span class="badge ${motCls}">MOT: ${escHtml(v.motStatus || 'Unknown')}</span>
+      ${motExpiry}
+      <span class="badge ${taxCls}">Tax: ${escHtml(v.taxStatus || 'Unknown')}</span>
+      ${taxDue}
+    </div>
+  </div>
+</div>`;
+    }).join('\n');
+
+    return `<div style="display:flex;flex-wrap:wrap;gap:1rem;">\n${cards}\n</div>`;
+}
+
+export default async function garagePlugin(fastify, options) {
+    const {authenticate, requirePermission} = options.auth;
+    // The Garage permission (1.3): granted to admin and user; take it from a role
+    // under Roles and that role has no Garage (a lookup spends the site's DVLA key).
+    const need = (action) => (typeof requirePermission === 'function' ? requirePermission('garage', action) : async () => {});
+
+    // Notifications (core 0.80+; feature-detected): each morning, a saved
+    // vehicle whose MOT or tax has run out (critical) or is due soon (warning)
+    // - to its OWNER. A garage is personal. Checks that pass resolve.
+    const hooks = options.hooks || {};
+    if (typeof hooks.registerNotificationSource === 'function') {
+        try {
+            hooks.registerNotificationSource({
+                id: 'due', label: 'MOT and tax due', severity: 'warning', every: 'daily', atBoot: true,
+                description: 'Each morning: a saved vehicle whose MOT or road tax has run out, or is due within 30 days - told to its owner.',
+                check: async (ctx) => {
+                    const {entries} = await listEntries(COLLECTION, {limit: 10000});
+                    const saved = entries.map(toVehicle).filter(v => v.isSaved);
+                    const {raise, resolve} = vehicleNotices(saved, isoDay(ctx.now || new Date()));
+                    for (const key of resolve) await ctx.resolve(key);
+                    for (const p of raise) await ctx.notify(p);
+                }
+            });
+        } catch { /* older engine */ }
+    }
+    const {registerShortcode} = options.hooks;
+    const cfg = {...defaultConfig, ...(options.settings || {})};
+    cfg.dvlaApiKey = process.env.DVLA_API_KEY || cfg.dvlaApiKey;
+
+    // --- [garage-vehicles /] shortcode --------------------------------------
+
+    /**
+     * Renders saved vehicles as a static HTML card grid on public pages.
+     *
+     * Reads through the collections service (listEntries -> the storage adapter),
+     * exactly as the API routes do, so file and MongoDB storage render the same.
+     * Until 1.4.1 it read content/collections/garage-vehicles/data.json directly,
+     * and on a site whose vehicles live in MongoDB it rendered nothing.
+     * Shortcode handlers may be async (processPluginShortcodes awaits them).
+     *
+     * Usage:
+     *   [garage-vehicles user="uuid" /]        — one user's saved vehicles
+     *
+     * A user must be named: until 1.3 the bare shortcode put EVERY user's saved
+     * vehicles on a public page, and a user's garage is theirs.
+     */
+    registerShortcode('garage-vehicles', async (attrStr, _body, ctx) => {
+        const attrs = ctx.parseShortcodeAttrs(attrStr);
+        const userId = attrs.user || null;
+        if (!userId) return '';
+
+        let entries;
+        try {
+            ({entries} = await listEntries(COLLECTION, {limit: 10000}));
+        } catch {
+            return '';
+        }
+
+        const vehicles = (entries || [])
+            .filter(e => e?.data && e.data.userId === userId)
+            .map(toVehicle)
+            .filter(v => v.isSaved);
+        if (!vehicles.length) return '';
+
+        return renderVehiclesHtml(vehicles);
+    });
+
+    // --- POST /lookup -------------------------------------------------------
+
+    /**
+     * Proxy a DVLA vehicle lookup and upsert the result into the user's history.
+     * Returns 503 if no DVLA API key is configured.
+     * Returns 429 if the user has exceeded the rate limit.
+     */
+    fastify.post('/lookup', {preHandler: [authenticate, need('create')]}, async (request, reply) => {
+        const userId = request.user.id;
+        const {registrationNumber} = request.body || {};
+
+        if (!registrationNumber || typeof registrationNumber !== 'string') {
+            return reply.status(400).send({error: 'registrationNumber is required'});
+        }
+
+        const reg = normaliseReg(registrationNumber);
+        if (!reg) {
+            return reply.status(400).send({error: 'Invalid registration number'});
+        }
+
+        const rl = checkRateLimit(userId, cfg.rateLimit);
+        if (!rl.allowed) {
+            return reply.status(429).send({
+                error: `Rate limit reached. Try again in ${rl.retryAfter} seconds.`,
+                retryAfter: rl.retryAfter
+            });
+        }
+
+        // Read the key now, not at boot: one saved from the settings panel works at once,
+        // without a restart (1.1 needed one). The environment variable still wins.
+        let apiKey = process.env.DVLA_API_KEY || cfg.dvlaApiKey;
+        try { apiKey = process.env.DVLA_API_KEY || (await getPluginSettings('garage'))?.dvlaApiKey || apiKey; } catch { /* keep the boot value */ }
+        if (!apiKey) {
+            return reply.status(503).send({
+                error: 'No DVLA API key yet - add one in Garage settings (the cog in the banner).'
+            });
+        }
+
+        let dvlaData;
+        try {
+            const dvlaRes = await fetch(cfg.dvlaApiUrl, {
+                method: 'POST',
+                headers: {
+                    'x-api-key': apiKey,
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify({registrationNumber: reg})
+            });
+
+            if (dvlaRes.status === 404) {
+                return reply.status(404).send({error: 'Vehicle not found. Check the registration number.'});
+            }
+            if (!dvlaRes.ok) {
+                const body = await dvlaRes.text().catch(() => '');
+                fastify.log.warn({status: dvlaRes.status, body}, '[garage] DVLA API error');
+                return reply.status(502).send({error: 'DVLA API returned an error. Please try again.'});
+            }
+
+            dvlaData = await dvlaRes.json();
+        } catch (err) {
+            fastify.log.error({err}, '[garage] Failed to reach DVLA API');
+            return reply.status(502).send({error: 'Could not reach the DVLA API. Check your network connection.'});
+        }
+
+        // Upsert: update existing entry if same reg+user, otherwise create
+        const {entries: all} = await listEntries(COLLECTION, {limit: 10000});
+        const existing = all.find(e => e.data.userId === userId && e.data.registrationNumber === reg);
+
+        let vehicle;
+        if (existing) {
+            const updated = await updateEntry(COLLECTION, existing.id, {
+                ...mapDvlaResponse(userId, dvlaData),
+                isSaved: existing.data.isSaved
+            });
+            vehicle = toVehicle(updated);
+        } else {
+            const created = await createEntry(COLLECTION, mapDvlaResponse(userId, dvlaData), {createdBy: userId});
+            vehicle = toVehicle(created);
+
+            // Prune oldest unsaved entries if over the history limit
+            const {entries: fresh} = await listEntries(COLLECTION, {limit: 10000});
+            const userEntries = fresh.filter(e => e.data.userId === userId);
+            if (userEntries.length > cfg.maxHistoryItems) {
+                const unsaved = userEntries
+                    .filter(e => !e.data.isSaved)
+                    .sort((a, b) => new Date(a.data.lookupDate) - new Date(b.data.lookupDate));
+                const toDelete = unsaved.slice(0, userEntries.length - cfg.maxHistoryItems);
+                for (const entry of toDelete) {
+                    await deleteEntry(COLLECTION, entry.id);
+                }
+            }
+        }
+
+        return vehicle;
+    });
+
+    // --- GET /vehicles (saved) ----------------------------------------------
+
+    /**
+     * Return all vehicles the authenticated user has saved to their garage.
+     * Supports optional ?q= for server-side search across reg/make/colour/year/fuel.
+     */
+    fastify.get('/vehicles', {preHandler: [authenticate, need('read')]}, async (request) => {
+        const userId = request.user.id;
+        const q = (request.query.q || '').toLowerCase().trim();
+
+        const {entries} = await listEntries(COLLECTION, {limit: 10000});
+        let results = entries
+            .filter(e => e.data.userId === userId && (e.data.isSaved === true || e.data.isSaved === 'true'))
+            .map(toVehicle);
+
+        if (q) {
+            results = results.filter(v => {
+                const haystack = [
+                    v.registrationNumber, v.make, v.colour,
+                    v.yearOfManufacture, v.fuelType, v.taxStatus, v.motStatus
+                ].join(' ').toLowerCase();
+                return haystack.includes(q);
+            });
+        }
+
+        return results;
+    });
+
+    // --- GET /history -------------------------------------------------------
+
+    /**
+     * Return the authenticated user's full lookup history, newest first.
+     * Supports optional ?q= search.
+     */
+    fastify.get('/history', {preHandler: [authenticate, need('read')]}, async (request) => {
+        const userId = request.user.id;
+        const q = (request.query.q || '').toLowerCase().trim();
+
+        const {entries} = await listEntries(COLLECTION, {limit: 10000});
+        let results = entries
+            .filter(e => e.data.userId === userId)
+            .map(toVehicle)
+            .sort((a, b) => new Date(b.lookupDate) - new Date(a.lookupDate));
+
+        if (q) {
+            results = results.filter(v => {
+                const haystack = [
+                    v.registrationNumber, v.make, v.colour,
+                    v.yearOfManufacture, v.fuelType, v.taxStatus, v.motStatus
+                ].join(' ').toLowerCase();
+                return haystack.includes(q);
+            });
+        }
+
+        return results;
+    });
+
+    // --- PATCH /vehicles/:id/save -------------------------------------------
+
+    /**
+     * Save a vehicle to My Garage or take it out. `{isSaved: true|false}` in the
+     * body sets it - what the screen sends, so a screen that is out of date (a
+     * change in another tab) still does what the person asked; with no body it
+     * toggles, as before 1.5. A body whose isSaved is not a boolean is refused
+     * (400): reading "false" as "toggle" would save an unsaved vehicle.
+     * Returns 404 if the entry does not exist or belongs to another user.
+     */
+    fastify.patch('/vehicles/:id/save', {preHandler: [authenticate, need('create')]}, async (request, reply) => {
+        const userId = request.user.id;
+        const {id} = request.params;
+
+        const hasBody = request.body !== undefined && request.body !== null;
+        const wanted = hasBody ? request.body.isSaved : undefined;
+        if (hasBody && typeof wanted !== 'boolean') {
+            return reply.status(400).send({error: 'isSaved must be true or false'});
+        }
+
+        const entry = await getEntry(COLLECTION, id);
+        if (!entry || entry.data.userId !== userId) {
+            return reply.status(404).send({error: 'Vehicle not found'});
+        }
+
+        const updated = await updateEntry(COLLECTION, id, {
+            ...entry.data,
+            isSaved: typeof wanted === 'boolean' ? wanted : !(entry.data.isSaved === true || entry.data.isSaved === 'true')
+        });
+        return toVehicle(updated);
+    });
+
+    // --- GET /count (sidebar badge) -----------------------------------------
+
+    /**
+     * The badge on Garage in the sidebar (plugin.json countUrl), for the reader's
+     * own saved vehicles. `?today=YYYY-MM-DD` is the browser's day (the sidebar
+     * sends it) - MOT and tax dates are calendar days. Polled every minute from
+     * every admin tab, so each answer is kept for a minute per user and day.
+     */
+    const badgeCache = new Map();
+    fastify.get('/count', {preHandler: [authenticate, need('read')]}, async (request) => {
+        const userId = request.user.id;
+        const given = String(request.query?.today ?? '');
+        const today = /^\d{4}-\d{2}-\d{2}$/.test(given) ? given : isoDay();
+        const key = `${userId}|${today}`;
+        const hit = badgeCache.get(key);
+        if (hit && Date.now() - hit.at < 60_000) return hit.value;
+        const {entries} = await listEntries(COLLECTION, {limit: 10000});
+        const saved = entries
+            .filter(e => e.data.userId === userId && (e.data.isSaved === true || e.data.isSaved === 'true'))
+            .map(toVehicle);
+        const value = badgeFor(saved, today);
+        badgeCache.set(key, {at: Date.now(), value});
+        return value;
+    });
+
+    /** A change to a user's vehicles: their next badge is worked out afresh. */
+    const forget = (userId) => { for (const k of badgeCache.keys()) if (k.startsWith(`${userId}|`)) badgeCache.delete(k); };
+    fastify.addHook('onResponse', async (request) => {
+        if (request.method !== 'GET' && request.user?.id) forget(request.user.id);
+    });
+
+    // --- DELETE /vehicles/:id -----------------------------------------------
+
+    /**
+     * Permanently remove a vehicle entry from the user's history.
+     * Returns 404 if the entry does not exist or belongs to another user.
+     */
+    fastify.delete('/vehicles/:id', {preHandler: [authenticate, need('delete')]}, async (request, reply) => {
+        const userId = request.user.id;
+        const {id} = request.params;
+
+        const entry = await getEntry(COLLECTION, id);
+        if (!entry || entry.data.userId !== userId) {
+            return reply.status(404).send({error: 'Vehicle not found'});
+        }
+
+        await deleteEntry(COLLECTION, id);
+        return {ok: true};
+    });
+}

package/plugins/garage/plugin.json

@@ -0,0 +1,68 @@
+{
+  "name": "garage",
+  "displayName": "Garage",
+  "version": "1.6.0",
+  "tier": "free",
+  "description": "UK vehicle management with DVLA API lookup, save vehicles, and search history.",
+  "author": "Darryl Waterhouse",
+  "date": "2026-10-21",
+  "icon": "truck",
+  "admin": {
+    "sidebar": [
+      {
+        "id": "garage",
+        "text": "Garage",
+        "icon": "truck",
+        "url": "#/plugins/garage",
+        "section": "#/plugins/garage",
+        "countUrl": "/api/plugins/garage/count",
+        "permission": "garage"
+      }
+    ],
+    "routes": [
+      {
+        "path": "/plugins/garage",
+        "view": "plugin-garage",
+        "title": "Garage - Domma CMS"
+      }
+    ],
+    "views": {
+      "plugin-garage": {
+        "entry": "garage/admin/views/garage.js",
+        "exportName": "garageView"
+      }
+    },
+    "css": [
+      "admin/css/garage.css"
+    ]
+  },
+  "permissions": [
+    {
+      "key": "garage",
+      "label": "Garage",
+      "group": "Plugins",
+      "description": "Your own vehicle lookups and saved vehicles.",
+      "actions": [
+        {
+          "key": "read",
+          "label": "View",
+          "description": "Open My Garage and your lookup history"
+        },
+        {
+          "key": "create",
+          "label": "Look up",
+          "description": "Look vehicles up (uses the site's DVLA key) and save them"
+        },
+        {
+          "key": "delete",
+          "label": "Delete",
+          "description": "Remove your saved vehicles and lookups"
+        }
+      ],
+      "grant": [
+        "admin",
+        "user"
+      ]
+    }
+  ]
+}

package/plugins/garage/tests/access.test.js

@@ -0,0 +1,134 @@
+/**
+ * Garage 1.3: the Garage permission on every route, and a shortcode that shows
+ * one named user's vehicles - never everyone's.
+ *
+ * 1.4.1: the shortcode reads through the collections service and its storage
+ * adapter, like every route, not the data file - so it is tested on file
+ * storage (a real garage-vehicles collection in the domma-cms checkout, made
+ * for the run and removed again, or put back if one was there) and on a
+ * non-file adapter (the registry's adapter for the slug, stubbed).
+ */
+import {test, before, after, mock} from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import Fastify from 'fastify';
+import garagePlugin from '../plugin.js';
+import {getAdapter, invalidate} from '../../../server/services/adapterRegistry.js';
+
+const SLUG = 'garage-vehicles';
+const HERE = path.dirname(new URL(import.meta.url).pathname);
+// Where the collections service keeps it: `make test` runs with cwd = the CMS root.
+const DIR = path.resolve('content/collections', SLUG);
+const KEEP = ['schema.json', 'data.json'].map(f => path.join(DIR, f));
+const saved = new Map();
+let dirWas = false;
+let app;
+let shortcode;
+
+before(async () => {
+    dirWas = await fs.stat(DIR).then(() => true, () => false);
+    for (const f of KEEP) saved.set(f, await fs.readFile(f, 'utf8').catch(() => null));
+    await fs.mkdir(DIR, {recursive: true});
+    await fs.copyFile(path.join(HERE, '..', 'collections', SLUG, 'schema.json'), path.join(DIR, 'schema.json'));
+    await fs.writeFile(path.join(DIR, 'data.json'), JSON.stringify([
+        {id: 'v1', data: {userId: 'u-sam', registrationNumber: 'AB12CDE', make: 'FORD', isSaved: true}},
+        {id: 'v2', data: {userId: 'u-jo', registrationNumber: 'XY99ZZZ', make: 'VOLVO', isSaved: true}},
+        {id: 'v3', data: {userId: 'u-sam', registrationNumber: 'LK07ABC', make: 'SKODA', isSaved: false}}
+    ]));
+    invalidate(SLUG);
+    app = Fastify();
+    const authenticate = async (req) => { req.user = {id: req.headers['x-id'] || 'u-sam', role: req.headers['x-role'] || 'user'}; };
+    // The Garage permission: held unless x-no-garage is sent.
+    const requirePermission = () => async (req, reply) => {
+        if (req.headers['x-no-garage']) return reply.code(403).send({error: 'Insufficient permissions'});
+    };
+    await app.register(garagePlugin, {auth: {authenticate, requirePermission}, settings: {},
+        hooks: {registerShortcode: (name, fn) => { if (name === 'garage-vehicles') shortcode = fn; }}});
+    await app.ready();
+});
+
+after(async () => {
+    await app?.close();
+    if (!dirWas) await fs.rm(DIR, {recursive: true, force: true});
+    else for (const [f, body] of saved) {
+        if (body === null) await fs.rm(f, {force: true});
+        else await fs.writeFile(f, body);
+    }
+    invalidate(SLUG);
+});
+
+const ctx = {parseShortcodeAttrs: (s) => Object.fromEntries([...String(s).matchAll(/(\w+)="([^"]*)"/g)].map(m => [m[1], m[2]]))};
+
+test('the bare shortcode shows nobody\'s vehicles; a named user, only theirs (file storage)', async () => {
+    assert.equal(await shortcode('', null, ctx), '', 'every user\'s garage on a public page - no more');
+    const sams = await shortcode(' user="u-sam"', null, ctx);
+    assert.match(sams, /FORD/);
+    assert.doesNotMatch(sams, /VOLVO/, 'another user\'s vehicle');
+    assert.doesNotMatch(sams, /SKODA/, 'looked up but not saved');
+    assert.equal(await shortcode(' user="u-nobody"', null, ctx), '');
+});
+
+test('the shortcode reads through the storage adapter, so a non-file store renders the same', async () => {
+    // What a MongoDB-backed collection hands back: nothing in data.json, and
+    // isSaved as the schema's text field may store it.
+    const adapter = await getAdapter(SLUG);
+    const listed = [];
+    const list = mock.method(adapter, 'list', async (slug, opts) => {
+        listed.push(slug);
+        return {entries: [
+            {id: 'm1', data: {userId: 'u-sam', registrationNumber: 'MO55NGO', make: 'TESLA', isSaved: 'true', motStatus: 'Valid'}},
+            {id: 'm2', data: {userId: 'u-jo', registrationNumber: 'JO11JJJ', make: 'VOLVO', isSaved: true}},
+            {id: 'm3', data: {userId: 'u-sam', registrationNumber: 'UN54VED', make: 'SKODA', isSaved: false}}
+        ], total: 3, page: 1, limit: opts?.limit ?? 50};
+    });
+    try {
+        const sams = await shortcode(' user="u-sam"', null, ctx);
+        assert.deepEqual(listed, [SLUG], 'asked the adapter, not the file');
+        assert.match(sams, /MO55NGO/);
+        assert.match(sams, /TESLA/);
+        assert.match(sams, /MOT: Valid/);
+        assert.doesNotMatch(sams, /FORD/, 'the data file was not read');
+        assert.doesNotMatch(sams, /VOLVO|SKODA/, 'still only the named user\'s saved vehicles');
+        assert.equal(await shortcode('', null, ctx), '', 'and still nobody\'s without a user');
+        // The API's own read gives the same vehicles through the same adapter.
+        const api = (await app.inject({method: 'GET', url: '/vehicles', headers: {'x-id': 'u-sam'}})).json();
+        assert.deepEqual(api.map(v => v.registrationNumber), ['MO55NGO']);
+    } finally {
+        list.mock.restore();
+    }
+});
+
+test('a store that fails renders nothing rather than breaking the page', async () => {
+    const adapter = await getAdapter(SLUG);
+    const list = mock.method(adapter, 'list', async () => { throw new Error('connection lost'); });
+    try {
+        assert.equal(await shortcode(' user="u-sam"', null, ctx), '');
+    } finally {
+        list.mock.restore();
+    }
+});
+
+test('every route needs the Garage permission', async () => {
+    for (const [method, url] of [['GET', '/vehicles'], ['GET', '/history'], ['GET', '/count'], ['POST', '/lookup'],
+        ['PATCH', '/vehicles/v1/save'], ['DELETE', '/vehicles/v1']]) {
+        const res = await app.inject({method, url, headers: {'x-no-garage': '1'}, payload: method === 'GET' ? undefined : {}});
+        assert.equal(res.statusCode, 403, `${method} ${url}`);
+    }
+    assert.notEqual((await app.inject({method: 'GET', url: '/count'})).statusCode, 403, 'with it, as before');
+});
+
+test('saving sets the state asked for; with no body it toggles as before; anything else is refused', async () => {
+    const send = (payload) => app.inject({method: 'PATCH', url: '/vehicles/v3/save', headers: {'x-id': 'u-sam'}, payload});
+    const save = async (payload) => (await send(payload)).json().isSaved;
+    assert.equal(await save({isSaved: true}), true);
+    assert.equal(await save({isSaved: true}), true, 'asked twice (a screen out of date) - still saved, not flipped back');
+    assert.equal(await save({isSaved: false}), false);
+    assert.equal(await save(undefined), true, 'no body: a toggle');
+    for (const bad of [{isSaved: 'false'}, {isSaved: 'yes'}, {isSaved: 0}, {}]) {
+        assert.equal((await send(bad)).statusCode, 400, `refused: ${JSON.stringify(bad)}`);
+    }
+    assert.equal(await save({isSaved: false}), false, 'the refused ones changed nothing: it was still saved');
+    const other = await app.inject({method: 'PATCH', url: '/vehicles/v3/save', headers: {'x-id': 'u-jo'}, payload: {isSaved: true}});
+    assert.equal(other.statusCode, 404, 'another user\'s vehicle');
+});