domma-cms 1.8.46 → 1.9.0

package/server/routes/api/views.js

@@ -17,6 +17,19 @@
  */
 import {canReadView, createView, deleteView, executeView, executeViewConfig, getView, listViews, updateView, viewsBadge} from '../../services/views.js';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
+import {pluginDenialFor} from '../../services/collectionAccess.js';
+
+/**
+ * Sends 403 and answers true when a pipeline reads (as its source or through a
+ * $lookup) a plugin's collection the caller may not read through the
+ * Collections API (collectionAccess.js).
+ */
+async function refusedPluginSources(request, reply, pipeline) {
+    const denial = await pluginDenialFor([pipeline?.source, ...lookupSources(pipeline?.stages || [])], request.user);
+    if (!denial) return false;
+    reply.status(403).send({error: denial});
+    return true;
+}
 
 /**
  * Every collection a pipeline's $lookup stages read, as slugs (`cms_` stripped - Mongo-authored views
@@ -78,6 +91,7 @@ export async function viewsRoutes(fastify) {
     });
 
     fastify.post('/views', canCreate, async (request, reply) => {
+        if (await refusedPluginSources(request, reply, request.body?.pipeline)) return;
         try {
             const view = await createView(request.body || {}, request.user?.id || null);
             return reply.status(201).send(view);
@@ -119,6 +133,7 @@ export async function viewsRoutes(fastify) {
     });
 
     fastify.put('/views/:slug', canUpdate, async (request, reply) => {
+        if (await refusedPluginSources(request, reply, request.body?.pipeline)) return;
         try {
             return await updateView(request.params.slug, request.body || {});
         } catch (err) {
@@ -143,6 +158,8 @@ export async function viewsRoutes(fastify) {
 
     fastify.get('/views/:slug/execute', canRead, async (request, reply) => {
         const { page, limit } = request.query;
+        const view = await getView(request.params.slug).catch(() => null);
+        if (view && await refusedPluginSources(request, reply, view.pipeline)) return;
         try {
             return await executeView(request.params.slug, {
                 page:  parseInt(page,  10) || 1,
@@ -178,6 +195,7 @@ export async function viewsRoutes(fastify) {
             const joined = await getCollection(from).catch(() => null);
             if (joined && !canSeeArtefact(request.user, joined)) return reply.status(403).send({error: 'Forbidden'});
         }
+        if (await refusedPluginSources(request, reply, {source, stages})) return;
         const n = Math.min(Math.max(parseInt(limit, 10) || 10, 1), 50);
         try {
             return await executeViewConfig({connection, pipeline: {source, stages}, access: {rowLevel: null}},

package/server/services/collectionAccess.js

@@ -13,15 +13,29 @@
  *
  *   - A collection a plugin created (`schema.plugin`) belongs to that plugin.
  *     When the plugin registers permission resources (plugin.json
- *     `permissions`, or `resources` in its role files) the caller must hold one
- *     of them; a plugin that registers none falls back to `collections` alone.
+ *     `permissions`, or `resources` in its role files) the caller must have
+ *     full use of one of them: the action the resource names as its
+ *     `collectionAction` (a game's `manage`), or else EVERY action it has. A
+ *     read-only holder is kept out - the generic API shows whole rows, and a
+ *     plugin's rows can hold what its own screens never show a reader (a
+ *     quiz's answers, a puzzle's solution, a player's play token). A plugin
+ *     that registers no resource falls back to `collections` alone. A plugin
+ *     that is switched off (or failed to load) has nothing in the registry, so
+ *     the permissions its plugin.json and role files declare still guard its
+ *     collections - switching a game off must not open its answers.
+ *
+ *   The same check guards every other way into a plugin's rows: a form whose
+ *   submissions collection is the plugin's, a view reading or joining it, and
+ *   an API Builder endpoint exposing it.
  *
  * A level-0 user keeps everything - the same bypass rowAccess.js gives them.
  */
 import {USER_DATA_PRESET_SLUGS} from './presetCollections.js';
 import {getPermissionsFor} from './roles.js';
 import {getEffectiveLevel, getEffectiveRoles} from './userRoles.js';
-import {getEffectiveRegistry} from './permissionRegistry.js';
+import fs from 'node:fs';
+import path from 'node:path';
+import {getEffectiveRegistry, normalisePluginResource} from './permissionRegistry.js';
 
 /** Where each user-data preset keeps its owner - the field its Tool routes filter on. */
 const OWNER_FIELD = Object.freeze({
@@ -81,35 +95,103 @@ export function holds(user, resource, action) {
     return getEffectiveRoles(user).some(r => allowed.includes(r));
 }
 
+/** Plugin names as directories - anything else is not read from disk. */
+const PLUGIN_NAME = /^[a-z0-9][a-z0-9_-]*$/i;
+
 /**
- * The permission resources a plugin registered at boot (plugin.json
- * `permissions` plus `resources` in its role files).
+ * The permission resources a plugin declares on disk (plugin.json
+ * `permissions` and `resources` in its role files), shaped like registry
+ * entries. Used when the registry holds none for it - the plugin is switched
+ * off or failed to load - so its collections keep their gate.
  *
  * @param {string} plugin
- * @param {Array<{key: string, plugin?: string}>} [registry] - injectable for tests
- * @returns {string[]}
+ * @param {string} [pluginsDir]
+ * @returns {Array<{key: string, plugin: string, actions: Array<{key: string}>, collectionAction?: string}>}
  */
-export function pluginResources(plugin, registry = getEffectiveRegistry()) {
-    return registry.filter(r => r.plugin === plugin).map(r => r.key);
+export function declaredPluginResources(plugin, pluginsDir = path.resolve('plugins')) {
+    if (typeof plugin !== 'string' || !PLUGIN_NAME.test(plugin)) return [];
+    const dir = path.join(pluginsDir, plugin);
+    const readJson = file => { try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; } };
+    const declared = [];
+    const manifest = readJson(path.join(dir, 'plugin.json'));
+    if (Array.isArray(manifest?.permissions)) declared.push(...manifest.permissions);
+    let roleFiles = [];
+    try { roleFiles = fs.readdirSync(path.join(dir, 'roles')).filter(f => f.endsWith('.json')); } catch { /* none */ }
+    for (const file of roleFiles) {
+        const def = readJson(path.join(dir, 'roles', file));
+        if (Array.isArray(def?.resources)) declared.push(...def.resources);
+    }
+    const seen = new Set();
+    return declared.filter(r => typeof r?.key === 'string' && r.key && !seen.has(r.key) && seen.add(r.key))
+        .map(r => {
+            const {actions, collectionAction} = normalisePluginResource(r);
+            return {key: r.key, plugin, actions, ...(collectionAction && {collectionAction})};
+        });
+}
+
+/**
+ * The permissions that admit a user to a plugin's collections through the
+ * generic API, one list per resource the plugin registered (or, switched off,
+ * declares on disk): `[resource.action]` when the resource declares a
+ * `collectionAction`, otherwise every action it has. Holding every entry of
+ * any one list admits. A resource with no actions asks for one nobody but
+ * root holds, rather than admitting any action.
+ *
+ * @param {string} plugin
+ * @param {Array<{key: string, plugin?: string, actions?: Array<{key: string}>, collectionAction?: string}>} [registry] - injectable for tests
+ * @param {(plugin: string) => Array<object>} [onDisk] - injectable for tests
+ * @returns {Array<Array<[string, string]>>} [resource, action] pairs
+ */
+export function pluginCollectionGates(plugin, registry = getEffectiveRegistry(), onDisk = declaredPluginResources) {
+    let own = registry.filter(r => r.plugin === plugin);
+    if (!own.length) own = onDisk(plugin);
+    return own.map(r => {
+        if (r.collectionAction) return [[r.key, r.collectionAction]];
+        const actions = (r.actions || []).map(a => a?.key).filter(Boolean);
+        return actions.length ? actions.map(action => [r.key, action]) : [[r.key, '(root only)']];
+    });
 }
 
 /**
  * Why `user` may not touch a plugin's collection through the generic API, or
  * null when they may: the collection is nobody's, the plugin registered no
- * permission, the user holds one of them, or the user is root.
+ * permission, the user has full use of one of them (see pluginCollectionGates),
+ * or the user is root.
  *
  * @param {object} schema
  * @param {object|null} user
  * @param {Array<{key: string, plugin?: string}>} [registry] - injectable for tests
+ * @param {(plugin: string) => Array<object>} [onDisk] - injectable for tests
  * @returns {string|null}
  */
-export function pluginDenial(schema, user, registry) {
+export function pluginDenial(schema, user, registry, onDisk) {
     const plugin = schema?.plugin;
     if (!plugin || isRoot(user)) return null;
-    const resources = pluginResources(plugin, registry);
-    if (!resources.length) return null;
-    if (resources.some(resource => holds(user, resource))) return null;
-    return `This collection belongs to the ${plugin} plugin - its permission is required`;
+    const gates = pluginCollectionGates(plugin, registry, onDisk);
+    if (!gates.length) return null;
+    if (gates.some(gate => gate.every(([resource, action]) => holds(user, resource, action)))) return null;
+    const needs = gates.map(gate => gate.map(([r, a]) => `${r}.${a}`).join(' + ')).join(' or ');
+    return `This collection belongs to the ${plugin} plugin - it needs ${needs}`;
+}
+
+/**
+ * pluginDenial for collections named by slug - a form's submissions
+ * collection, a view's source and joins, an endpoint's collection. A slug
+ * with no collection is nobody's.
+ *
+ * @param {Iterable<string>} slugs
+ * @param {object|null} user
+ * @returns {Promise<string|null>} the first denial, or null
+ */
+export async function pluginDenialFor(slugs, user) {
+    if (isRoot(user)) return null;
+    const {getCollection} = await import('./collections.js');
+    for (const slug of new Set(slugs)) {
+        if (typeof slug !== 'string' || !slug) continue;
+        const denial = pluginDenial(await getCollection(slug).catch(() => null), user);
+        if (denial) return denial;
+    }
+    return null;
 }
 
 /**

package/server/services/permissionRegistry.js

@@ -353,7 +353,7 @@ export const REGISTRY = [
  * Plugin-contributed resources registered at runtime via registerPluginResource().
  * Cleared on teardown via unregisterPluginResourcesByPlugin().
  *
- * @type {Array<{key:string,label:string,description:string,icon:string,group:string,plugin:string,actions:{key:string,label:string,description:string}[]}>}
+ * @type {Array<{key:string,label:string,description:string,icon:string,group:string,plugin:string,actions:{key:string,label:string,description:string}[],collectionAction?:string}>}
  */
 const _pluginContributed = [];
 
@@ -361,13 +361,23 @@ const _pluginContributed = [];
  * Register a resource contributed by a plugin.
  * Idempotent - if the key already exists in the effective registry it is skipped.
  *
- * @param {{key:string,label:string,description?:string,icon?:string,group?:string,actions?:{key:string,label:string,description?:string}[]}} resource
+ * @param {{key:string,label:string,description?:string,icon?:string,group?:string,actions?:{key:string,label:string,description?:string}[],collectionAction?:string}} resource
  * @param {string} plugin - Plugin name that owns this resource
  */
 export function registerPluginResource(resource, plugin) {
     if (!resource || typeof resource.key !== 'string' || !resource.key) return;
-    const effective = getEffectiveRegistry();
-    if (effective.some(r => r.key === resource.key)) return;
+    const {actions, collectionAction} = normalisePluginResource(resource);
+    const existing = getEffectiveRegistry().find(r => r.key === resource.key);
+    if (existing) {
+        // The same plugin registering the key again (a role file or
+        // hooks.registerRole() before the manifest) must not lose the
+        // manifest's collectionAction - it is a security setting.
+        if (existing.plugin === plugin && collectionAction && !existing.collectionAction
+            && existing.actions.some(a => a.key === collectionAction)) {
+            existing.collectionAction = collectionAction;
+        }
+        return;
+    }
 
     _pluginContributed.push({
         key: resource.key,
@@ -376,16 +386,34 @@ export function registerPluginResource(resource, plugin) {
         icon: resource.icon || 'box',
         group: resource.group || 'Plugins',
         plugin,
-        // Actions may be objects or bare keys (`["read", "create"]`) - the
-        // short form is what plugin role files have always shipped.
-        actions: Array.isArray(resource.actions) && resource.actions.length
-            ? resource.actions.map(a => typeof a === 'string'
-                ? {key: a, label: a, description: a}
-                : {key: a.key, label: a.label || a.key, description: a.description || a.label || a.key})
-            : ACTIONS.map(key => ({key, label: key, description: key}))
+        actions,
+        ...(collectionAction && {collectionAction})
     });
 }
 
+/**
+ * A plugin resource's actions and `collectionAction`, as they are registered.
+ * Actions may be objects or bare keys (`["read", "create"]`) - the short form
+ * is what plugin role files have always shipped; an action without a key is
+ * dropped, and none left means the default CRUD set. `collectionAction` is the
+ * action the generic Collections API asks for on the plugin's collections
+ * (collectionAccess.js), kept only when it names one of those actions.
+ *
+ * @param {{actions?: Array<string|{key: string, label?: string, description?: string}>, collectionAction?: string}} resource
+ * @returns {{actions: {key: string, label: string, description: string}[], collectionAction: string|null}}
+ */
+export function normalisePluginResource(resource) {
+    const listed = (Array.isArray(resource?.actions) ? resource.actions : [])
+        .map(a => typeof a === 'string'
+            ? {key: a, label: a, description: a}
+            : {key: a?.key, label: a?.label || a?.key, description: a?.description || a?.label || a?.key})
+        .filter(a => typeof a.key === 'string' && a.key);
+    const actions = listed.length ? listed : ACTIONS.map(key => ({key, label: key, description: key}));
+    const collectionAction = typeof resource?.collectionAction === 'string'
+        && actions.some(a => a.key === resource.collectionAction) ? resource.collectionAction : null;
+    return {actions, collectionAction};
+}
+
 /**
  * Remove all resources registered by a given plugin.
  *

package/plugins/crossword/CLAUDE.md

@@ -1,37 +0,0 @@
-# crossword - AI Assistant Guide
-
-## Purpose
-
-Crosswords on the public site, built from a word + clue list, timed by the server, with a fastest-solver
-leaderboard. 1.1.0 (2026-10-21), `tier: free`, disabled on arrival. Sibling of `quiz`; shares `plugins/_lib/games`.
-
-## Files
-
-- `public/lib/layout.js` - PURE, isomorphic, SERVED: `generate(words, {seed})` (greedy, deterministic from the
-  seed, clues never affect the layout), `cleanAnswer` (letters + enumeration), `solutionGrid`, `shapeOf`. The admin
-  builder imports it over HTTP for the live preview; the server runs the same function on save, so a layout is
-  never taken from the browser. It holds no puzzle, which is why it may live under `public/`.
-- `lib/crossword.js` - PURE: `cleanPuzzle`, `isOpen`, `publicPuzzle` (shape + clues, no letters), `readCells`,
-  `compare`, `catchUp`, `finish`, `view`.
-- `lib/store.js` - `crossword-puzzles` + `plays = new PlayStore('crossword-plays', {order: 'time'})`.
-- `plugin.js` - routes (header comment), shortcodes, the `fastest` notification source.
-- `public/crossword.js` - the player: the screens are domma-reactive; the grid is a `Board` class over real
-  `<input>`s (keyboard rules in its header - all focus and keystrokes, which bindings do not reach), letters
-  remembered per play in storage. Exports `mount(el, {test})`, which the admin's Test screen uses.
-- `admin/views/crossword.js` - list, editor with live grid, test and plays screens, all domma-reactive through the
-  admin kit (`_lib/admin/games/kit.js`). The preview grid is a data-each over cells.
-
-## Contracts
-
-- **No letters before solving.** `/public/crossword/:slug` gives only the size; the clues come with the play (so
-  nobody studies them off the clock); `solution` is in `/result` only when `status === 'finished'`. The tests
-  assert no answer string appears in the play payload - keep that test.
-- **Time = server elapsed + `state.penaltyMs`.** Check adds `checkPenalty` seconds (403 when `checks` is off); a
-  FULL but wrong submit adds `wrongPenalty`; a grid with empties only reports the count.
-- Cells travel as `height` strings of `width` chars, `A-Z` or space; anything else is 400.
-- The grid uses fixed ink/paper colours (`--cw-ink`, `--cw-paper`) whatever the theme - a themed grid inverted
-  under dark themes.
-- Same shortcode prefix trap as quiz: `crossword-leaderboard` is registered with `{priority: 5}`.
-- **Test plays** (1.1.0): `GET/POST /puzzles/:id/test` (manage), as in quiz's CLAUDE.md - the saved crossword
-  whatever its status, never on a board, not in the plays list, no notification, cleared by the next test.
-  `/result` answers `test: true` and `wouldPlace`.

package/plugins/crossword/admin/css/index.css

@@ -1,18 +0,0 @@
-/* Crossword admin - the word list and the live grid. Shared pieces are in /plugins/_lib/admin/games/games.css. */
-.cwa-words { display: flex; flex-direction: column; gap: .4rem; }
-.cwa-word { display: grid; grid-template-columns: 1.6rem minmax(7rem, 12rem) 3.5rem minmax(0, 1fr) auto; gap: .4rem; align-items: center; }
-.cwa-n { color: var(--dm-text-muted); font-size: var(--dm-text-sm); text-align: right; }
-.cwa-answer { text-transform: uppercase; font-family: var(--dm-font-mono, monospace); letter-spacing: .04em; }
-.cwa-enum { color: var(--dm-text-muted); font-size: var(--dm-text-xs); white-space: nowrap; }
-@media (max-width: 700px) { .cwa-word { grid-template-columns: 1.4rem 1fr auto; } .cwa-enum { display: none; } .cwa-clue { grid-column: 2 / 4; } }
-
-.cwa-side { position: sticky; top: .5rem; }
-.cwa-preview { overflow: auto; max-height: 70vh; }
-/* Fixed ink and paper, as on the public grid: a themed grid came out inverted under dark themes. */
-.cwa-grid { --cwa-ink: #111827; --cwa-paper: #ffffff; display: grid; gap: 0; width: max-content; border: 2px solid var(--cwa-ink); background: var(--cwa-ink); }
-.cwa-cell { position: relative; width: 1.7rem; height: 1.7rem; display: grid; place-items: center; font-weight: 700; font-size: .85rem;
-    background: var(--cwa-paper); color: var(--cwa-ink); border: 1px solid color-mix(in srgb, var(--cwa-ink) 35%, transparent); box-sizing: border-box; }
-.cwa-cell.is-block { background: var(--cwa-ink); border-color: var(--cwa-ink); }
-.cwa-num { position: absolute; top: 1px; left: 2px; font-size: .5rem; font-weight: 600; line-height: 1; color: #4b5563; }
-.cwa-unplaced { margin: 0; padding: .5rem .75rem; border-radius: 6px; font-size: var(--dm-text-sm);
-    background: color-mix(in srgb, var(--dm-warning) 15%, transparent); color: color-mix(in srgb, var(--dm-warning) 55%, var(--dm-text)); }

package/plugins/crossword/admin/templates/crossword.html

@@ -1 +0,0 @@
-<div class="gma cwa" data-crossword-admin></div>