domma-cms 1.8.33 → 1.8.35

package/plugins/theme-roller/tests/themes.test.js

@@ -0,0 +1,77 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {slugify, uniqueId, cleanChanges, cleanLabel, usageOf, withoutTheme, themeCss, isSafeValue} from '../admin/lib/themes.js';
+
+test('slugify makes a class-safe id', () => {
+    assert.equal(slugify('  Café Brand!! '), 'cafe-brand');
+    assert.equal(slugify('!!!'), '');
+    assert.equal(slugify('x'.repeat(80)).length, 60);
+});
+
+test('uniqueId never collides with a built-in theme or a saved one', () => {
+    assert.equal(uniqueId('Ocean Dark', {builtins: ['ocean-dark']}), 'ocean-dark-2');
+    assert.equal(uniqueId('Brand', {taken: ['brand', 'brand-2']}), 'brand-3');
+    assert.equal(uniqueId('Brand'), 'brand');
+    assert.equal(uniqueId('???'), '');
+});
+
+test('only real tokens with plain values survive', () => {
+    const {changes, dropped} = cleanChanges({
+        '--dm-primary': ' #ff0000 ', '--dm-surface': 'red; } body { display: none', color: 'blue',
+        '--dm-bg': 'url(https://evil)', '--dm-radius-md': '8px'
+    });
+    assert.deepEqual(changes, {'--dm-primary': '#ff0000', '--dm-radius-md': '8px'});
+    assert.deepEqual(dropped.sort(), ['--dm-bg', '--dm-surface', 'color']);
+    assert.equal(isSafeValue('rgba(0, 0, 0, .5)'), true);
+});
+
+test('labels are tidy and never empty', () => {
+    assert.equal(cleanLabel('  My   theme  '), 'My theme');
+    assert.equal(cleanLabel(''), 'Untitled theme');
+    assert.equal(cleanLabel('', 'fallback'), 'fallback');
+});
+
+test('usageOf reads the CMS theme config the way the renderer does', () => {
+    const cfg = {theme: 'mine', adminTheme: 'mine', autoTheme: {enabled: false, dayTheme: 'mine'},
+        overrides: [{theme: 'mine'}, {theme: 'mine', enabled: false}]};
+    assert.deepEqual(usageOf('mine', cfg), ['site', 'admin', 'region']);
+    const auto = {theme: 'mine', autoTheme: {enabled: true, dayTheme: 'mine', nightTheme: 'mine'}};
+    assert.deepEqual(usageOf('mine', auto), ['day', 'night'], 'with switching on, the site theme is not what shows');
+    assert.deepEqual(usageOf('mine', {}), []);
+});
+
+test('withoutTheme puts every use back on the base, and nothing else', () => {
+    const cfg = {theme: 'mine', adminTheme: 'charcoal-dark', autoTheme: {enabled: true, dayTheme: 'mine', nightTheme: 'x'},
+        overrides: [{id: 'a', theme: 'mine'}, {id: 'b', theme: 'y'}]};
+    assert.deepEqual(withoutTheme(cfg, 'mine', 'ocean-dark'), {
+        theme: 'ocean-dark',
+        autoTheme: {enabled: true, dayTheme: 'ocean-dark', nightTheme: 'x'},
+        overrides: [{id: 'a', theme: 'ocean-dark'}, {id: 'b', theme: 'y'}]
+    });
+    assert.equal(withoutTheme({theme: 'other'}, 'mine', 'ocean-dark'), null);
+});
+
+test('exported CSS is scoped to the class the CMS applies', () => {
+    const css = themeCss({id: 'brand', label: 'Brand */ evil', baseTheme: 'ocean-dark', changes: {'--dm-primary': '#123456', bad: 'x'}}, '2026-09-25');
+    assert.match(css, /\.dm-custom-brand \{\n {4}--dm-primary: #123456;\n\}/);
+    assert.match(css, /dm-theme-ocean-dark dm-custom-brand/);
+    assert.ok(!css.includes('*/ evil'), 'a label cannot close the comment');
+    assert.ok(!css.includes('bad'));
+});
+
+test('the sidebar badge counts saved themes; the popover says what is worn and where each is used', async () => {
+    const {badgeFor} = await import('../admin/lib/themes.js');
+    const themes = [
+        {id: 'ruby', label: 'Ruby', baseTheme: 'silver-dark', usage: ['site', 'admin']},
+        {id: 'sea', label: 'Sea', baseTheme: 'ocean-light', usage: []}
+    ];
+    const b = badgeFor(themes, {theme: 'ruby', adminTheme: 'ruby', autoTheme: {enabled: false}});
+    assert.equal(b.count, 2);
+    assert.equal(b.label, '2 custom themes, 1 in use');
+    assert.deepEqual(b.details.rows, [{label: 'Site theme', value: 'Ruby'}, {label: 'Admin theme', value: 'Ruby'}]);
+    assert.deepEqual(b.details.items[0], {text: 'Ruby', meta: 'On silver-dark · Site, Admin', tone: 'ok'});
+    assert.deepEqual(b.details.items[1], {text: 'Sea', meta: 'On ocean-light'});
+    const auto = badgeFor(themes, {adminTheme: 'dreamy-light', autoTheme: {enabled: true, dayTheme: 'sea', nightTheme: 'charcoal-dark'}});
+    assert.deepEqual(auto.details.rows[0], {label: 'Site (day / night)', value: 'Sea / charcoal-dark'});
+    assert.equal(badgeFor([], {}).label, 'No custom themes yet');
+});

package/plugins/theme-roller/tests/view.test.js

@@ -0,0 +1,55 @@
+/** Theme Roller 1.2 - the screen's pure decisions (admin/lib/view.js). */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {changesKey, filterThemes, listCounts, staleNote, stillDirty} from '../admin/lib/view.js';
+
+const THEMES = [
+    {id: 'brand', label: 'Brand', baseTheme: 'ocean-light', usage: ['site'], updatedAt: '2026-10-15T10:00:00Z'},
+    {id: 'night', label: 'Night "owl"', baseTheme: 'charcoal-dark', usage: [], updatedAt: '2026-10-14T10:00:00Z'}
+];
+
+test('filter counts and the filter itself, with search', () => {
+    assert.deepEqual(listCounts(THEMES), {all: 2, used: 1, unused: 1});
+    assert.deepEqual(listCounts(), {all: 0, used: 0, unused: 0});
+    assert.deepEqual(filterThemes(THEMES, 'used').map(t => t.id), ['brand']);
+    assert.deepEqual(filterThemes(THEMES, 'unused').map(t => t.id), ['night']);
+    assert.deepEqual(filterThemes(THEMES, 'all', 'charcoal').map(t => t.id), ['night']);
+    assert.deepEqual(filterThemes(THEMES, 'all', '"OWL"').map(t => t.id), ['night']);
+    assert.deepEqual(filterThemes(THEMES, 'used', 'night'), []);
+});
+
+test('a save leaves changes made while it ran unsaved', () => {
+    const a = changesKey({'--dm-primary': '#f00', '--dm-surface': '#fff'});
+    assert.equal(a, changesKey({'--dm-surface': '#fff', '--dm-primary': '#f00'}), 'order does not matter');
+    assert.equal(stillDirty(`ocean|${a}`, `ocean|${a}`), false);
+    assert.equal(stillDirty(`ocean|${a}`, `ocean|${changesKey({'--dm-primary': '#0f0'})}`), true);
+    assert.equal(stillDirty(`ocean|${a}`, `forest|${a}`), true, 'a new base counts');
+});
+
+test('a kept draft says when it is older than what is saved now', () => {
+    assert.equal(staleNote({theme: {id: 'brand', was: '2026-10-15T10:00:00Z'}}, THEMES), '');
+    assert.match(staleNote({theme: {id: 'brand', was: '2026-10-01T00:00:00Z'}}, THEMES), /saved again since/);
+    assert.match(staleNote({theme: {id: 'gone', was: 'x'}}, THEMES), /deleted since/);
+    assert.equal(staleNote({theme: {id: '', was: ''}}, THEMES), '', 'a new theme has nothing to be older than');
+    assert.equal(staleNote({css: 'a{}', cssWas: 'b{}'}, THEMES, 'b{}'), '');
+    assert.match(staleNote({css: 'a{}', cssWas: 'b{}'}, THEMES, 'c{}'), /custom\.css has changed/);
+    assert.equal(staleNote({css: 'a{}', cssWas: 'b{}'}, THEMES, null), '', 'the file could not be read - say nothing');
+    assert.equal(staleNote({css: 'a{}'}, THEMES, 'c{}'), '', 'an old draft without cssWas');
+});
+
+// 1.2.1 sweep: the restore question (OK throws away, Cancel keeps) and the per-user key.
+import {RESTORE_ANSWERS, draftKeyFor, restoreQuestion} from '../admin/lib/view.js';
+
+test('the restore question asks to throw away, naming what was left', () => {
+    assert.equal(restoreQuestion({theme: {id: 'brand', label: 'Brand'}}), 'Throw away the changes you left unsaved to the theme "Brand"?');
+    assert.equal(restoreQuestion({theme: {id: '', label: 'New theme'}, css: 'a{}'}),
+        'Throw away the changes you left unsaved to a new theme and the Custom CSS?');
+    assert.match(restoreQuestion({css: ''}, 'Note.'), /to the Custom CSS\? Note\.$/);
+    assert.equal(RESTORE_ANSWERS.confirmText, 'Throw away');
+    assert.equal(RESTORE_ANSWERS.cancelText, 'Keep them');
+});
+test('the draft key carries the signed-in user; no user keeps nothing', () => {
+    assert.equal(draftKeyFor('u1'), 'theme-roller.drafts.u1');
+    assert.notEqual(draftKeyFor('u1'), draftKeyFor('u2'));
+    assert.equal(draftKeyFor(''), null);
+});

package/server/routes/public.js

@@ -44,6 +44,22 @@ export function getBaseUrl(request) {
 import {sendHtml} from '../services/htmlResponse.js';
 export {sendHtml};
 
+/**
+ * Escape user-controlled strings before interpolating into HTML.
+ * Prevents reflected XSS in the built-in 403 and 404 pages.
+ *
+ * @param {string} str
+ * @returns {string}
+ */
+function escapeHtml(str) {
+    return String(str)
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+
 export async function publicRoutes(fastify) {
     // Admin panel: serve index.html for all /admin/* paths (SPA fallback)
     fastify.get('/admin', async (request, reply) => {