domma-cms 1.8.32 → 1.8.34

package/plugins/messages/tests/messages.test.js

@@ -0,0 +1,167 @@
+/** The pure part of Messages - admin/lib/messages.js. */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {
+    ago, arrangeThreads, attachmentUrl, buildBubbles, cleanAttachments, cleanDrafts, dayLabel, filterCounts,
+    indexByThread, initials, messageRights, threadTitle, unreadBadge, UNREAD_AFTER_MS, unreadKey, unreadNotices,
+    CALL_PICK_MAX, callGroupName, callTarget, callTargetText} from '../admin/lib/messages.js';
+
+const me = 'u1';
+const T = (id, extra = {}) => ({id, kind: 'group-adhoc', name: id.toUpperCase(), participants: [{id: me, name: 'Me'}, {id: 'u2', name: 'Ann'}], unread: 0, lastMessageAt: '2026-09-20T10:00:00Z', ...extra});
+
+test('titles: a DM is the other person, a group its name', () => {
+    assert.equal(threadTitle({kind: 'dm', participants: [{id: me, name: 'Me'}, {id: 'u2', name: 'Ann Lee'}]}, me), 'Ann Lee');
+    assert.equal(threadTitle({kind: 'dm', participants: [me, 'u9']}, me), 'u9');
+    assert.equal(threadTitle({kind: 'group-adhoc', name: ''}, me), 'Unnamed group');
+    assert.equal(initials('Ann Lee'), 'AL');
+    assert.equal(initials(''), '?');
+});
+
+test('arrange: newest first; inbox hides archived; unread and archived filters; search', () => {
+    const list = [T('a', {lastMessageAt: '2026-09-01T00:00:00Z', unread: 2}), T('b', {archivedBy: [me]}), T('c', {lastMessageAt: '2026-09-24T00:00:00Z', lastMessagePreview: 'budget'})];
+    assert.deepEqual(arrangeThreads(list, {myId: me}).map(t => t.id), ['c', 'a']);
+    assert.deepEqual(arrangeThreads(list, {myId: me, filter: 'unread'}).map(t => t.id), ['a']);
+    assert.deepEqual(arrangeThreads(list, {myId: me, filter: 'archived'}).map(t => t.id), ['b']);
+    assert.deepEqual(arrangeThreads(list, {myId: me, query: 'BUDGET'}).map(t => t.id), ['c']);
+    assert.deepEqual(filterCounts(list, me), {inbox: 2, unread: 1, archived: 1});
+    // Someone else's archive is not mine.
+    assert.equal(arrangeThreads([T('x', {archivedBy: ['u2']})], {myId: me}).length, 1);
+});
+
+test('rights: edit only mine, inside the window; delete mine, or as admin or thread creator', () => {
+    const now = Date.parse('2026-09-25T12:00:00Z');
+    const m = {senderId: me, createdAt: '2026-09-25T11:50:00Z'};
+    assert.deepEqual([messageRights(m, {myId: me, now}).canEdit, messageRights(m, {myId: me, now}).editLeftMinutes], [true, 5]);
+    assert.equal(messageRights({...m, createdAt: '2026-09-25T11:00:00Z'}, {myId: me, now}).canEdit, false);
+    const theirs = {senderId: 'u2', createdAt: m.createdAt};
+    assert.equal(messageRights(theirs, {myId: me, now}).canDelete, false);
+    assert.equal(messageRights(theirs, {myId: me, now, isAdmin: true}).canDelete, true);
+    assert.equal(messageRights(theirs, {myId: me, now, threadCreator: me}).canDelete, true);
+    assert.equal(messageRights({...m, deletedAt: 'x'}, {myId: me, now}).canDelete, false);
+});
+
+test('attachments: the address is always rebuilt - a stored url is never trusted', () => {
+    assert.equal(attachmentUrl({mediaId: 'a b.png'}), '/media/a%20b.png');
+    assert.equal(attachmentUrl({mediaId: 'x.png', url: 'javascript:alert(1)'}), '/media/x.png');
+    assert.equal(attachmentUrl({url: '/media/y.png'}), '/media/y.png');
+    const clean = cleanAttachments([{mediaId: 'ok.pdf', filename: 'Ok', url: 'https://evil'}, {mediaId: '../etc/passwd'}, {filename: 'no id'}]);
+    assert.deepEqual(clean, [{mediaId: 'ok.pdf', filename: 'Ok', mime: '', size: 0, url: '/media/ok.pdf'}]);
+});
+
+test('drafts: whitelisted, empty ones dropped', () => {
+    const d = cleanDrafts({t1: {text: 'hi', attachments: [{mediaId: 'a.png', filename: 'a'}, {nope: 1}]}, t2: {text: '   ', attachments: []}, t3: 'junk'});
+    assert.deepEqual(Object.keys(d), ['t1']);
+    assert.equal(d.t1.attachments.length, 1);
+    assert.deepEqual(cleanDrafts(null), {});
+});
+
+test('bubbles: a day separator on each new day; the sender only in groups, only when it changes', () => {
+    const now = Date.parse('2026-09-25T12:00:00Z');
+    const msgs = [
+        {id: '1', senderId: 'u2', body: 'hi', createdAt: '2026-09-24T09:00:00Z'},
+        {id: '2', senderId: 'u2', body: 'again', createdAt: '2026-09-24T09:01:00Z'},
+        {id: '3', senderId: me, body: 'yo', createdAt: '2026-09-25T09:00:00Z', editedAt: 'x'},
+        {id: '4', senderId: 'u2', body: '', deletedAt: 'x', createdAt: '2026-09-25T09:05:00Z', attachments: [{mediaId: 'a.png', mime: 'image/png'}]}
+    ];
+    const b = buildBubbles(msgs, {myId: me, isGroup: true, nameOf: () => 'Ann', now});
+    assert.deepEqual(b.map(x => x.isDay ? `[${x.dayLabel}]` : x.id), ['[Yesterday]', '1', '2', '[Today]', '3', '4']);
+    assert.deepEqual(b.filter(x => !x.isDay).map(x => x.showSender), [true, false, false, true]);
+    assert.match(b[4].meta, /edited/);
+    assert.equal(b[5].bodyText, 'message deleted');
+    assert.equal(b[5].attachments.length, 0, 'a deleted message shows no attachments');
+    assert.equal(buildBubbles(msgs, {myId: me, isGroup: false, now}).some(x => x.showSender), false);
+    assert.equal(dayLabel('nonsense', now), '');
+    // 1.6: a line typed in the conversation's call says so beside the time.
+    const inCall = buildBubbles([{id: '5', senderId: 'u2', body: 'from the call', createdAt: '2026-09-25T10:00:00Z', callChat: {id: 'x', who: 'w'}}], {myId: me, now});
+    assert.match(inCall.find(x => x.id === '5').meta, /in the call/);
+});
+
+test('badge: unread in conversations not archived; plain text popover', () => {
+    const now = Date.parse('2026-09-25T12:00:00Z');
+    const b = unreadBadge([T('a', {unread: 2}), T('b', {unread: 5, archivedBy: [me]}), T('c', {unread: 1, name: '<b>x</b>'})], me, now);
+    assert.equal(b.count, 3);
+    assert.equal(b.label, '3 unread messages in 2 conversations');
+    assert.equal(b.tone, 'info');
+    assert.deepEqual(b.details.rows.map(r => r.value), ['3', '2', '1']);
+    assert.ok(b.details.items.some(i => i.text === '<b>x</b>'), 'names pass through as text');
+    assert.match(b.details.items.find(i => i.text === 'A').meta, /^2 unread · /);
+    assert.equal(unreadBadge([], me, now).count, 0);
+    assert.equal(unreadBadge([], me, now).showZero, true);
+    assert.equal(b.showZero, true);
+});
+
+test('unread notices: waiting 10 minutes, one per conversation, to the recipient only', () => {
+    const now = Date.parse('2026-09-26T12:00:00Z');
+    const at = (mins) => new Date(now - mins * 60_000).toISOString();
+    const threads = [
+        {id: 't1', kind: 'dm', participants: ['a', 'b']},
+        {id: 't2', kind: 'group-adhoc', name: 'Site team', participants: ['a', 'b', 'c'], archivedBy: ['c']}
+    ];
+    const msgs = [
+        {threadId: 't1', senderId: 'a', body: 'Are you in today?', createdAt: at(12), readBy: ['a']},
+        {threadId: 't1', senderId: 'a', body: 'just now', createdAt: at(2), readBy: ['a']},
+        {threadId: 't2', senderId: 'b', body: 'Skip', createdAt: at(30), readBy: ['b', 'a']},
+        {threadId: 't2', senderId: 'b', body: 'old', createdAt: at(60 * 24 * 3), readBy: ['b']}
+    ];
+    const n = unreadNotices(threads, msgs, {a: 'Ann', b: 'Bob'}, now);
+    assert.equal(n.length, 1, 'b in the DM; a read the group; c archived it; the 3-day-old one is left alone');
+    assert.equal(n[0].title, 'Ann sent you a message');
+    assert.equal(n[0].body, 'Are you in today?');
+    assert.deepEqual(n[0].audience, {userIds: ['b']});
+    assert.equal(n[0].dedupeKey, unreadKey('t1', 'b'));
+    assert.ok(UNREAD_AFTER_MS === 600_000);
+});
+
+test('older dates read dd/mm/yyyy: the list stamp and the day separator', () => {
+    const now = new Date(2026, 8, 27, 12, 0).getTime();
+    const old = new Date(2026, 8, 3, 9, 30).toISOString();
+    assert.equal(ago(old, now), '03/09/2026');
+    assert.equal(dayLabel(old, now), 'Thu 03/09/2026');
+});
+
+test('Call…: which conversation a call with the people picked goes to', () => {
+    const P = (...ids) => ids.map(id => ({id, name: id}));
+    const threads = [
+        {id: 'dm-ann', kind: 'dm', participants: P(me, 'u2'), lastMessageAt: '2026-09-20T10:00:00Z'},
+        {id: 'dm-bob-archived', kind: 'dm', participants: [me, 'u3'], archivedBy: [me]},
+        {id: 'g-old', kind: 'group-adhoc', name: 'Old', participants: P(me, 'u2', 'u3'), lastMessageAt: '2026-09-01T10:00:00Z'},
+        {id: 'g-new', kind: 'group-adhoc', name: 'New', participants: P('u3', me, 'u2'), lastMessageAt: '2026-09-25T10:00:00Z'},
+        {id: 'g-big', kind: 'group-adhoc', name: 'Big', participants: P(me, 'u2', 'u3', 'u4')},
+        {id: 'g-gone', kind: 'group-adhoc', name: 'Gone', participants: P(me, 'u4', 'u5'), archivedBy: [me]},
+        {id: 'm-team', kind: 'group-managed', name: 'Team', participants: P(me, 'u5', 'u6')},
+        {id: 'g-without-me', kind: 'group-adhoc', name: 'Them', participants: P('u6', 'u7')}
+    ];
+    assert.equal(callTarget(threads, me, ['u2']).id, 'dm-ann', 'one person: your DM');
+    assert.equal(callTarget(threads, me, ['u3']).id, 'dm-bob-archived', 'a DM is one per pair, archived or not');
+    assert.deepEqual(callTarget(threads, me, ['u9']), {create: {kind: 'dm', participants: ['u9']}});
+    assert.equal(callTarget(threads, me, ['u3', 'u2']).id, 'g-new', 'exactly those people, the latest used');
+    assert.equal(callTarget(threads, me, ['u2', 'u3', 'u2', me]).id, 'g-new', 'repeats and yourself are ignored');
+    assert.deepEqual(callTarget(threads, me, ['u4', 'u5']), {create: {kind: 'group-adhoc', participants: ['u4', 'u5']}}, 'not one you archived');
+    assert.ok(callTarget(threads, me, ['u5', 'u6']).create, 'a managed group is not taken for an ad-hoc call');
+    assert.ok(callTarget(threads, me, ['u6', 'u7']).create, 'nor one you are not in');
+    assert.equal(callTarget(threads, me, []), null);
+    assert.equal(CALL_PICK_MAX, 5);
+    assert.ok(callTarget(threads, me, ['a', 'b', 'c', 'd', 'e']).create);
+    assert.equal(callTarget(threads, me, ['a', 'b', 'c', 'd', 'e', 'f']), null, 'a call holds 6, you included');
+
+    assert.equal(callGroupName([{name: 'Alex Carter'}, {name: 'Priya Shah'}, {name: 'Sam Patel'}]), 'Alex, Priya and Sam');
+    assert.equal(callGroupName([{name: 'Alex Carter'}, {name: 'Priya'}]), 'Alex and Priya');
+    assert.equal(callGroupName([]), 'Call');
+    assert.ok(callGroupName(Array.from({length: 30}, () => ({name: 'Bartholomew'}))).length <= 80);
+
+    assert.equal(callTargetText(callTarget(threads, me, ['u2']), me), 'Calls in your conversation with u2.');
+    assert.equal(callTargetText(callTarget(threads, me, ['u2', 'u3']), me), 'Calls in your group "New".');
+    assert.equal(callTargetText(callTarget(threads, me, ['u8', 'u9']), me), 'Starts a new group for these people and calls.');
+    assert.equal(callTargetText(null, me), '');
+});
+
+test('indexByThread: one list per conversation, in collection order; entries with no thread are left out', () => {
+    const E = (id, threadId, extra = {}) => ({id, data: {threadId, ...extra}});
+    const idx = indexByThread([E('m1', 't1'), E('m2', 't2'), E('m3', 't1', {deletedAt: 'x'}), {id: 'odd', data: {}}, null]);
+    assert.deepEqual([...idx.keys()], ['t1', 't2']);
+    assert.deepEqual(idx.get('t1').map(e => e.id), ['m1', 'm3']);   // deleted ones stay in: the routes decide what to skip
+    assert.deepEqual(idx.get('t2').map(e => e.id), ['m2']);
+    assert.equal(idx.get('t9'), undefined);
+    assert.equal(indexByThread([]).size, 0);
+    assert.equal(indexByThread(undefined).size, 0);
+});

package/plugins/quiz/CLAUDE.md

@@ -0,0 +1,43 @@
+# quiz - AI Assistant Guide
+
+## Purpose
+
+Timed quizzes on the public site with name-only players and leaderboards. 1.1.0 (2026-10-21), `tier: free`,
+disabled on arrival. Sibling of `crossword`; both sit in the sidebar's Tools > Games folder (`"group": "Games"`)
+and share `plugins/_lib/games` (server) + `_lib/public/games` (browser) + `_lib/admin/games` (admin kit).
+
+## Files
+
+- `lib/quiz.js` - PURE rules: `cleanQuiz` (the only gate on what the admin saves), `isOpen`, `planPlay` (question
+  order, option order, `draw`, fixed at start), `publicQuestion` (never `correct`), `mark`, `foldAnswer`.
+- `lib/engine.js` - PURE clock: `catchUp`, `serve`, `answer`, `end`, `view`. Each mutates the play and says if it
+  changed; the route saves through `plays.change()` (locked read-modify-write).
+- `lib/store.js` - `quiz-quizzes` collection + `plays = new PlayStore('quiz-plays', {order: 'score'})`.
+- `plugin.js` - routes (header comment lists them), shortcodes, the `top-scores` notification source.
+- `public/quiz.js` - the player (domma-reactive bindings), injected on every page by `inject/body.html`. Exports
+  `mount(el, {test})`, which the admin's Test screen uses.
+- `admin/views/quiz.js` - list, editor, test and plays screens, all domma-reactive through the admin kit
+  (`mountScreen`, `wireRows`, `sortableRows`, `testScreen`, `playsScreen` in `_lib/admin/games/kit.js`). Templates
+  are strings in the JS (a templateUrl goes through `_.render`, which eats data-each `{{ }}`); the questions are an
+  `observableArray` of question models with their answers nested as `{{#each options key=id}}`.
+- Tests: `tests/plugins/games-pure.test.js`, `tests/plugins/games-api.test.js` in the CMS repo.
+
+## Contracts
+
+- **The server keeps time and marks.** A question's clock starts at `serve()` - the GET of `/public/play/:id` -
+  and only then can it be answered (`answer()` refuses an unserved one with `code: 'not-current'`). So the player
+  must GET the next question after each answer, not use the one in the answer response. `GRACE_MS` (3s) covers
+  latency; late answers are marked wrong, never refused.
+- **The play token** (`X-Play-Token`) is returned once by start and compared with `timingSafeEqual`.
+  `PlayStore.adminView` strips it and the state from everything the admin sees.
+- **Leaderboards** rank finished, unhidden plays, best per `nameKey`, score then time (`_lib/games/ranking.js`).
+- **Shortcode prefix trap:** the engine's plugin-shortcode regex is a PREFIX match, so `[quiz` also matches
+  `[quiz-leaderboard`. `quiz-leaderboard` is registered with `{priority: 5}` so it runs first. Keep it that way.
+- **Domma bindings:** a `data-on-submit` handler must return `false` synchronously - an async one returns a
+  Promise and the form submits natively (page reload).
+- Collections' API verbs are all off: nothing here is readable through `/api/v1`.
+- **Test plays** (1.1.0): `GET/POST /quizzes/:id/test` (manage) give the start screen and a play marked `test: true`,
+  for the SAVED quiz whatever its status. It is played through the ordinary `/public/play` routes. `PlayStore` leaves
+  tests out of `forGame` (so boards, places, goes-per-name and the admin list), `todayBadge` skips them,
+  `afterFinish` never notifies for one, and the next test of the game clears them (`clearTests`). `/result` answers
+  `test: true` and `wouldPlace` instead of a place. Tests: `games-api.test.js` "test plays".

package/plugins/quiz/admin/css/index.css

@@ -1 +1,13 @@
-.qza-questions{display:flex;flex-direction:column;gap:.75rem}.qza-question{border:1px solid var(--gma-line);border-left:4px solid var(--dm-primary);border-radius:var(--dm-radius-md, 8px);padding:.85rem 1rem;display:flex;flex-direction:column;gap:.6rem;background:var(--dm-background, transparent)}.qza-question .form-select{width:auto}.qza-answers{display:flex;flex-direction:column;gap:.4rem}.qza-answer{display:flex;align-items:center;gap:.5rem;padding:.25rem .4rem;border-radius:6px}.qza-answer.is-right{background:color-mix(in srgb,var(--dm-success) 12%,transparent)}.qza-answer .form-input{flex:1;min-width:0}.qza-mark{display:inline-flex;align-items:center;cursor:pointer;padding:.2rem}.qza-mark input{width:1.1rem;height:1.1rem;accent-color:var(--dm-success)}.qza-fixed{flex:1;font-weight:500}.qza-more summary{cursor:pointer;color:var(--dm-text-muted);font-size:var(--dm-text-sm);margin-bottom:.5rem}
+/* Quiz admin - the question editor. Shared pieces are in /plugins/_lib/admin/games/games.css. */
+.qza-questions { display: flex; flex-direction: column; gap: .75rem; }
+.qza-question { border: 1px solid var(--gma-line); border-left: 4px solid var(--dm-primary); border-radius: var(--dm-radius-md, 8px);
+    padding: .85rem 1rem; display: flex; flex-direction: column; gap: .6rem; background: var(--dm-background, transparent); }
+.qza-question .form-select { width: auto; }
+.qza-answers { display: flex; flex-direction: column; gap: .4rem; }
+.qza-answer { display: flex; align-items: center; gap: .5rem; padding: .25rem .4rem; border-radius: 6px; }
+.qza-answer.is-right { background: color-mix(in srgb, var(--dm-success) 12%, transparent); }
+.qza-answer .form-input { flex: 1; min-width: 0; }
+.qza-mark { display: inline-flex; align-items: center; cursor: pointer; padding: .2rem; }
+.qza-mark input { width: 1.1rem; height: 1.1rem; accent-color: var(--dm-success); }
+.qza-fixed { flex: 1; font-weight: 500; }
+.qza-more summary { cursor: pointer; color: var(--dm-text-muted); font-size: var(--dm-text-sm); margin-bottom: .5rem; }