domma-cms 1.8.32 → 1.8.34

package/plugins/messages/plugin.json

@@ -0,0 +1,59 @@
+{
+  "name": "messages",
+  "displayName": "Messages",
+  "version": "1.9.0",
+  "tier": "free",
+  "description": "Internal user-to-user and group messaging with real-time delivery - conversations you can archive, mark unread and search, video calls for up to 6 from any conversation or by picking people, drafts kept per conversation, attachments, and an unread badge in the sidebar.",
+  "author": "Darryl Waterhouse",
+  "date": "2026-10-21",
+  "icon": "message-circle",
+  "admin": {
+    "sidebar": [
+      {
+        "id": "messages",
+        "text": "Messages",
+        "icon": "message-circle",
+        "url": "#/plugins/messages",
+        "section": "#/plugins/messages",
+        "countUrl": "/api/plugins/messages/count",
+        "permission": "messages"
+      }
+    ],
+    "routes": [
+      {
+        "path": "/plugins/messages",
+        "view": "plugin-messages",
+        "title": "Messages - Domma CMS"
+      }
+    ],
+    "views": {
+      "plugin-messages": {
+        "entry": "messages/admin/views/messages.js",
+        "exportName": "messagesView"
+      }
+    },
+    "css": [
+      "admin/css/messages.css"
+    ]
+  },
+  "permissions": [
+    {
+      "key": "messages",
+      "label": "Messages",
+      "group": "Plugins",
+      "description": "Send and read your own messages (read). Admins also run managed groups.",
+      "actions": [
+        {
+          "key": "read",
+          "label": "Use",
+          "description": "Send, read and manage your own conversations"
+        }
+      ],
+      "grant": [
+        "admin",
+        "user"
+      ]
+    }
+  ],
+  "minCmsVersion": "0.109.5"
+}

package/plugins/messages/plugin.public.js

@@ -0,0 +1,52 @@
+/**
+ * Messages - the call page (1.4): `/messages-call/<conversation>?u=&x=&s=`.
+ *
+ * A public page, since it is served outside the admin, but it only ever holds
+ * a call for someone carrying a link made for them (POST
+ * /api/plugins/messages/threads/:id/call) who is still in the conversation.
+ * The link is checked here only to choose between the call and a plain "not
+ * valid" page; the join checks it again (plugin.js, the engine's resolve).
+ */
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {renderBlogPage} from '../../server/services/renderer.js';
+import {getEntry} from '../../server/services/collections.js';
+import {getUserById} from '../../server/services/users.js';
+import {CALL_API, CALL_PATH, checkInvite, checkJoin, credOf, escHtml, loadSecret, whoIsCalling} from './lib/call.js';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+export const ASSET_V = '1.7.0';
+
+/** On a bare call address: return to the link this tab kept (the call screen moves it out of the address bar). */
+const RECOVER_CALL = '<script>(function(){try{if(location.search)return;var s=sessionStorage.getItem("dm-call:"+location.pathname);if(s&&s.charAt(0)==="?")location.replace(location.pathname+s);}catch(e){}})();</script>';
+
+export default async function messagesPublic(fastify, options = {}) {
+    const dataDir = options.dataDir || path.join(HERE, 'data');
+    let secret = null;
+    const callSecret = () => (secret ??= loadSecret(dataDir));
+
+    fastify.get(`${CALL_PATH}/:room`, async (request, reply) => {
+        const room = String(request.params.room || '');
+        const cred = credOf(request.query);
+        // A member's link, or (1.7) an invitation to the running call - the join checks the invitation is still live.
+        const invited = cred.i === '1';
+        const userId = invited ? checkInvite(callSecret(), room, cred) : checkJoin(callSecret(), room, cred);
+        const entry = userId ? await getEntry('user-message-threads', room).catch(() => null) : null;
+        const user = entry ? await getUserById(userId).catch(() => null) : null;
+        const names = {};
+        if (entry?.data?.kind === 'dm') {
+            for (const id of entry.data.participants ?? []) names[id] = String((await getUserById(id).catch(() => null))?.name || '').trim();
+        }
+        const who = entry ? whoIsCalling({id: entry.id, ...entry.data}, user, userId, names, {invited}) : null;
+        const cfg = who ? {api: CALL_API, room, cred, title: who.title, askName: false, recordingAllowed: false} : null;
+        reply.header('X-Robots-Tag', 'noindex, nofollow').header('Cache-Control', 'no-store').header('Referrer-Policy', 'no-referrer');
+        const html = await renderBlogPage(path.join(HERE, 'templates', 'call.html'), {
+            notValid: who ? '' : '<h1>This call link is not valid</h1><p>Call links last two hours and are only for the person they were made for. Open the conversation in Messages and click Call or Join for a new one.</p>'
+                // A reload of the bare address (the call screen took the link out of the address bar): back to it.
+                + (Object.keys(request.query || {}).length ? '' : RECOVER_CALL),
+            cfg: cfg ? escHtml(JSON.stringify(cfg)) : '{}',
+            assetV: ASSET_V
+        }, {title: who ? who.title : 'Call', urlPath: CALL_PATH, noindex: true});
+        return reply.type('text/html; charset=utf-8').send(html);
+    });
+}

package/plugins/messages/templates/call.html

@@ -0,0 +1,6 @@
+<main class="container" style="padding: 2rem 0;">
+  {{notValid}}
+  <link rel="stylesheet" href="/plugins/_lib/public/call/call.css?v={{assetV}}">
+  <div data-dm-call='{{cfg}}'><noscript><p>The call needs JavaScript switched on.</p></noscript></div>
+  <script type="module" src="/plugins/_lib/public/call/call.js?v={{assetV}}"></script>
+</main>

package/plugins/messages/tests/after-send.test.js

@@ -0,0 +1,22 @@
+/** Messages 1.8 - what stays in the compose box after a send that took a while (afterSend). */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {afterSend} from '../admin/lib/messages.js';
+
+const a1 = {mediaId: 'a.png'}; const a2 = {mediaId: 'b.pdf'};
+
+test('nothing typed meanwhile: the box empties', () => {
+    assert.deepEqual(afterSend({body: 'Hi "there"', attachments: [a1]}, {body: 'Hi "there"', attachments: [a1]}), {body: '', attachments: []});
+});
+test('typed on after the sent text: only the new part stays', () => {
+    assert.deepEqual(afterSend({body: 'Hello', attachments: []}, {body: 'Hello\n and more', attachments: []}), {body: 'and more', attachments: []});
+});
+test('edited some other way: everything stays, nothing typed is lost', () => {
+    assert.deepEqual(afterSend({body: 'Hello', attachments: []}, {body: 'Help', attachments: []}), {body: 'Help', attachments: []});
+});
+test('an attachment added meanwhile stays; the sent ones go', () => {
+    assert.deepEqual(afterSend({body: '', attachments: [a1]}, {body: '', attachments: [a1, a2]}), {body: '', attachments: [a2]});
+});
+test('an empty sent body never swallows what is there', () => {
+    assert.deepEqual(afterSend({body: '', attachments: [a1]}, {body: 'caption', attachments: [a1]}), {body: 'caption', attachments: []});
+});

package/plugins/messages/tests/api.test.js

@@ -0,0 +1,187 @@
+/**
+ * The Messages API against the real CMS collection service. `make test` runs
+ * inside the domma-cms checkout, whose user-messages / user-message-threads
+ * data files are tracked - both are snapshotted and restored byte for byte.
+ */
+import {test, before, after} from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import Fastify from 'fastify';
+import messagesPlugin from '../plugin.js';
+
+const FILES = ['user-messages', 'user-message-threads'].map(s => path.resolve('content', 'collections', s, 'data.json'));
+const saved = {};
+let app;
+// Real accounts: since 1.2 a conversation takes only real, active people the sender may reach.
+const ID = {};
+const made = [];
+
+before(async () => {
+    for (const f of FILES) saved[f] = await fs.readFile(f, 'utf8').catch(() => null);
+    const {createUser} = await import('../../../server/services/users.js');
+    await (await import('../../../server/services/roles.js')).load();
+    const tag = Math.random().toString(36).slice(2, 7);
+    for (const k of ['a', 'b', 'c']) {
+        const u = await createUser({name: `Member ${k} ${tag}`, email: `dt-${k}-${tag}@example.test`, password: 'password123', role: 'user'});
+        ID[k] = u.id; made.push(u.id);
+    }
+    app = Fastify();
+    // The caller is whoever the x-test-user header names; x-no-messages = a role without the permission.
+    const authenticate = async (req) => { req.user = {id: req.headers['x-test-user'] || ID.a, role: 'user'}; };
+    const requirePermission = () => async (req, reply) => {
+        if (req.headers['x-no-messages']) return reply.code(403).send({error: 'Insufficient permissions'});
+    };
+    await app.register(messagesPlugin, {auth: {authenticate, requireAdmin: async () => {}, requirePermission}, settings: {}});
+});
+
+after(async () => {
+    await app?.close();
+    const {deleteUser} = await import('../../../server/services/users.js');
+    for (const id of made) await deleteUser(id).catch(() => {});
+    for (const f of FILES) {
+        if (saved[f] === null) await fs.rm(f, {force: true});
+        else await fs.writeFile(f, saved[f]);
+    }
+});
+
+const as = (user) => async (method, url, body) => {
+    const res = await app.inject({method, url, payload: body, headers: {'x-test-user': user}});
+    return {status: res.statusCode, body: res.body ? JSON.parse(res.body) : null};
+};
+const A = (...a) => as(ID.a)(...a);
+const B = (...a) => as(ID.b)(...a);
+let threadId;
+
+test('a DM, messages both ways, and the unread badge follows', async () => {
+    const t = await A('POST', '/threads', {kind: 'dm', participants: [ID.b]});
+    assert.equal(t.status, 201);
+    threadId = t.body.id;
+    for (const body of ['one', 'two', 'three']) assert.equal((await A('POST', `/threads/${threadId}/messages`, {body})).status, 201);
+    const badge = await B('GET', '/count');
+    assert.equal(badge.body.count, 3);
+    assert.equal((await A('GET', '/count')).body.count, 0, 'your own messages are never unread');
+});
+
+test('mark read clears EVERY unread message (the old parallel writes kept all but one)', async () => {
+    await B('POST', `/threads/${threadId}/read`);
+    assert.equal((await B('GET', '/count')).body.count, 0);
+    const list = (await B('GET', '/threads')).body;
+    assert.equal(list.find(t => t.id === threadId).unread, 0);
+});
+
+test('mark unread brings the newest back; archive is per person and a new message undoes it', async () => {
+    assert.equal((await B('POST', `/threads/${threadId}/unread`)).status, 200);
+    assert.equal((await B('GET', '/count')).body.count, 1);
+    await B('POST', `/threads/${threadId}/archive`, {archived: true});
+    assert.equal((await B('GET', '/count')).body.count, 0, 'archived conversations are left out of the badge');
+    const aSees = (await A('GET', '/threads')).body.find(t => t.id === threadId);
+    assert.ok(!(aSees.archivedBy || []).includes(ID.a), 'the other person is unaffected');
+    await A('POST', `/threads/${threadId}/messages`, {body: 'are you there?'});
+    const bSees = (await B('GET', '/threads')).body.find(t => t.id === threadId);
+    assert.deepEqual(bSees.archivedBy, [], 'a new message brings it back to the inbox');
+    assert.equal((await B('GET', '/count')).body.count, 2);
+});
+
+test('attachments keep only a media name - a javascript: address never reaches another screen', async () => {
+    const r = await A('POST', `/threads/${threadId}/messages`, {body: '', attachments: [
+        {mediaId: 'plan.pdf', filename: 'Plan', mime: 'application/pdf', size: 10, url: 'javascript:alert(1)'},
+        {mediaId: '../../secret', filename: 'x'}]});
+    assert.equal(r.status, 201);
+    assert.deepEqual(r.body.attachments, [{mediaId: 'plan.pdf', filename: 'Plan', mime: 'application/pdf', size: 10, url: '/media/plan.pdf'}]);
+    const t = (await A('GET', '/threads')).body.find(x => x.id === threadId);
+    assert.equal(t.lastMessagePreview, 'Attachment: Plan');
+    assert.equal((await A('POST', `/threads/${threadId}/messages`, {body: '', attachments: [{mediaId: '../x'}]})).status, 400);
+});
+
+test('/me answers the rights the screen shows; a stranger cannot read or mark a thread', async () => {
+    const m = await A('GET', '/me');
+    assert.equal(m.body.id, ID.a);
+    assert.equal(typeof m.body.isAdmin, 'boolean');
+    assert.equal(m.body.editWindowMinutes, 15);
+    const C = (...a) => as(ID.c)(...a);
+    assert.equal((await C('GET', `/threads/${threadId}/messages`)).status, 404);
+    assert.equal((await C('POST', `/threads/${threadId}/unread`)).status, 404);
+    assert.equal((await C('POST', `/threads/${threadId}/archive`, {archived: true})).status, 404);
+});
+
+test('leaving: the last one out purges the thread and its messages', async () => {
+    await A('DELETE', `/threads/${threadId}`);
+    await B('DELETE', `/threads/${threadId}`);
+    const raw = JSON.parse(await fs.readFile(FILES[0], 'utf8'));
+    const entries = Array.isArray(raw) ? raw : (raw.entries || []);
+    assert.equal(entries.filter(e => e.data?.threadId === threadId).length, 0);
+});
+
+test('/people: names only, never emails; a member sees staff, their own role and their contacts - not everyone', async () => {
+    const {createUser, deleteUser} = await import('../../../server/services/users.js');
+    // Staff are known by role level, as in production - where the roles are always loaded at boot.
+    await (await import('../../../server/services/roles.js')).load();
+    const tag = Math.random().toString(36).slice(2, 7);
+    const staff = await createUser({name: `Staff ${tag}`, email: `staff-${tag}@example.test`, password: 'password123', role: 'admin'});
+    const stranger = await createUser({name: `Stranger ${tag}`, email: `stranger-${tag}@example.test`, password: 'password123', role: 'zz-other'});
+    const nameless = await createUser({name: '', email: `nameless-${tag}@example.test`, password: 'password123', role: 'admin'});
+    try {
+        const list = (await A('GET', '/people')).body;
+        const ids = new Set(list.map(p => p.id));
+        assert.ok(ids.has(staff.id), 'staff are listed');
+        assert.ok(!ids.has(stranger.id), 'someone sharing no role, and no conversation, is not');
+        assert.ok(!JSON.stringify(list).includes('@example.test'), 'no email address, even as a fallback name');
+        assert.equal(list.find(p => p.id === nameless.id)?.name, 'Unnamed member');
+    } finally {
+        for (const u of [staff, stranger, nameless]) await deleteUser(u.id).catch(() => {});
+    }
+});
+
+test('1.2: only real people you may reach; the permission is needed; retention is the starter\'s, a day or more', async () => {
+    // Made-up or unreachable people are refused.
+    assert.equal((await A('POST', '/threads', {kind: 'dm', participants: ['no-such-user']})).status, 403);
+    assert.equal((await A('POST', '/threads', {kind: 'dm', participants: [{$ne: 1}]})).status, 400);
+    const {createUser, deleteUser} = await import('../../../server/services/users.js');
+    const stranger = await createUser({name: 'Stranger', email: `stranger-${Date.now()}@example.test`, password: 'password123', role: 'zz-other'});
+    try {
+        assert.equal((await A('POST', '/threads', {kind: 'dm', participants: [stranger.id]})).status, 403, 'shares no role, no conversation');
+    } finally {
+        await deleteUser(stranger.id).catch(() => {});
+    }
+
+    // Without the Messages permission, nothing.
+    const res = await app.inject({method: 'GET', url: '/threads', headers: {'x-test-user': ID.a, 'x-no-messages': '1'}});
+    assert.equal(res.statusCode, 403);
+
+    // A group of three: only its starter changes retention, never below a day.
+    const g = await A('POST', '/threads', {kind: 'group-adhoc', name: 'Trio', participants: [ID.b, ID.c]});
+    assert.equal(g.status, 201);
+    for (const body of ['keep me', 'and me']) await B('POST', `/threads/${g.body.id}/messages`, {body});
+    assert.equal((await B('PUT', `/threads/${g.body.id}`, {retentionDays: 1})).status, 403, 'not the starter');
+    assert.equal((await A('PUT', `/threads/${g.body.id}`, {retentionDays: -1})).status, 400, 'the wipe-everything value');
+    assert.equal((await A('PUT', `/threads/${g.body.id}`, {retentionDays: 0})).status, 400);
+    assert.equal((await A('PUT', `/threads/${g.body.id}`, {retentionDays: 30})).status, 200);
+    assert.equal((await A('GET', `/threads/${g.body.id}/messages`)).body.messages?.length ?? (await A('GET', `/threads/${g.body.id}/messages`)).body.length, 2, 'nothing was wiped');
+
+    // In a group, its starter may remove a message; in a DM, the other side may not.
+    const mine = await B('POST', `/threads/${g.body.id}/messages`, {body: 'remove me'});
+    assert.equal((await A('DELETE', `/threads/${g.body.id}/messages/${mine.body.id}`)).status, 200);
+    const dm = await A('POST', '/threads', {kind: 'dm', participants: [ID.c]});
+    const said = await (async (...a) => as(ID.c)(...a))('POST', `/threads/${dm.body.id}/messages`, {body: 'mine'});
+    assert.equal((await A('DELETE', `/threads/${dm.body.id}/messages/${said.body.id}`)).status, 403, 'starting a DM is not moderation');
+});
+
+test('1.7.2: a message is capped at 10000 characters, a name at 80; participants carry no email', async () => {
+    const t = await A('POST', '/threads', {kind: 'group-adhoc', name: 'n'.repeat(200), participants: [ID.b]});
+    assert.equal(t.status, 201, JSON.stringify(t.body));
+    const sent = await A('POST', `/threads/${t.body.id}/messages`, {body: 'x'.repeat(20001)});
+    assert.equal(sent.status, 201);
+    assert.equal(sent.body.body.length, 10000);
+    const edited = await A('PUT', `/threads/${t.body.id}/messages/${sent.body.id}`, {body: 'y'.repeat(20001)});
+    assert.equal(edited.status, 200, JSON.stringify(edited.body));
+    assert.equal(edited.body.body.length, 10000);
+    assert.equal((await A('PUT', `/threads/${t.body.id}`, {name: 'm'.repeat(200)})).body.name.length, 80);
+    const mine = (await B('GET', '/threads')).body;
+    for (const th of mine) for (const p of th.participants) {
+        assert.equal(p.email, undefined, 'no email in a conversation\'s people');
+        assert.ok(p.name, 'a name still');
+    }
+    await A('POST', `/threads/${t.body.id}/leave`);
+    await B('POST', `/threads/${t.body.id}/leave`);
+});