domma-cms 1.8.5 → 1.8.7

package/server/services/markdown.js

@@ -57,6 +57,37 @@ marked.setOptions({
 // Collection shortcode helpers
 // ---------------------------------------------------------------------------
 
+/**
+ * Make text from a collection entry inert to the shortcode stages that run
+ * after `[collection]` / `[view]`.
+ *
+ * Entry values are DATA - public form submissions among them - and the
+ * rendered display is spliced into the page before tabs, form, embed, badge,
+ * button, card, slideover and the rest run, so a stored `[form id="x" /]`
+ * would otherwise be executed on the public page. Applied to the HTML that
+ * carries entry values (escaped text, attribute values, a rendered Markdown
+ * body, a `{{{raw}}}` placeholder), never to authored markup: a block
+ * template's own shortcodes still run.
+ *
+ * Every shortcode pattern starts `[name`, `[/name` or `[ name`, so the
+ * character after each `[` is written as a numeric entity (`[form` becomes
+ * `[form`) and a trailing `[` as `[`. Nothing can match, yet the
+ * brackets themselves stay, so a Markdown link in a value that a block
+ * template leaves to marked (`[text](url)`) is still a link. Entities read
+ * back as the same characters in text and attribute values, and the final
+ * sanitiser decodes them, so nothing visible changes; the base64 `data-ctx`
+ * / table payloads carry no brackets and are left as is, so filter, search
+ * and export see the stored values.
+ *
+ * @param {string} html - already-escaped HTML or text
+ * @returns {string}
+ */
+export function inertShortcodes(html) {
+    return String(html ?? '')
+        .replace(/\[([\w\s\/-])/g, (_, c) => `[&#${c.codePointAt(0)};`)
+        .replace(/\[$/, '[');
+}
+
 function escapeHtmlText(str) {
     return String(str ?? '')
         .replace(/&/g, '&')
@@ -349,7 +380,9 @@ function interpolateBlockTemplate(blockTemplate, e) {
     // One pass: a raw value put in (pre-rendered HTML) is never read again for
     // placeholders - text that shows "{{title}}" keeps it.
     return blockTemplate.replace(/\{\{\{(\w+)\}\}\}|\{\{([\w_]+)(?::([^{}]+))?\}\}/g, (_, raw, key, fmt) => {
-        if (raw !== undefined) return String(e.data?.[raw] ?? '');
+        // Entry values never carry a shortcode into the page (inertShortcodes);
+        // the template's own markup is untouched.
+        if (raw !== undefined) return inertShortcodes(String(e.data?.[raw] ?? ''));
         let value;
         if (key === '_id') value = e.id ?? '';
         else if (key === '_createdAt') value = e.meta?.createdAt ?? '';
@@ -357,9 +390,9 @@ function interpolateBlockTemplate(blockTemplate, e) {
         else value = e.data?.[key] ?? '';
         if (fmt) {
             const formatted = formatDate(value, fmt);
-            if (formatted !== null) return escapeHtmlText(formatted);
+            if (formatted !== null) return inertShortcodes(escapeHtmlText(formatted));
         }
-        return escapeHtmlText(value);
+        return inertShortcodes(escapeHtmlText(value));
     });
 }
 
@@ -401,14 +434,14 @@ function renderCollectionBlocks(entries, blockTemplate, emptyMsg, ctaOpts, cols,
 
     const items = entries.map(e => {
         const entryCls  = entryClassSuffix(ctxOpts).trim();
-        const wrapOpen  = `<div${entryCls ? ` class="${entryCls}"` : ''}${blockAttr} data-entry-id="${escapeAttr(String(e.id ?? ''))}">`;
+        const wrapOpen  = `<div${entryCls ? ` class="${entryCls}"` : ''}${blockAttr} data-entry-id="${inertShortcodes(escapeAttr(String(e.id ?? '')))}">`;
         const wrapClose = `</div>`;
         let html = interpolateBlockTemplate(blockTemplate, e);
 
         if (ctaOpts) {
             const ctaStyle = escapeAttr(ctaOpts.style || 'primary');
             let btnCls = `btn btn-${ctaStyle} dm-cta-trigger`;
-            let btnData = `data-action="${escapeAttr(ctaOpts.action)}" data-entry="${escapeAttr(e.id || '')}"`;
+            let btnData = `data-action="${escapeAttr(ctaOpts.action)}" data-entry="${inertShortcodes(escapeAttr(e.id || ''))}"`;
             if (ctaOpts.confirm) btnData += ` data-confirm="${escapeAttr(ctaOpts.confirm)}"`;
             if (ctaOpts.scope) btnData += ` data-scope="${escapeAttr(ctaOpts.scope)}"`;
             const iconHtml = ctaOpts.icon ? `<span data-icon="${escapeAttr(ctaOpts.icon)}"></span> ` : '';
@@ -636,15 +669,16 @@ function renderCollectionCards(entries, visibleFields, titleField, columns, empt
         if (ctaOpts) {
             const ctaStyle = escapeAttr(ctaOpts.style || 'primary');
             let btnCls = `btn btn-${ctaStyle} dm-cta-trigger`;
-            let btnData = `data-action="${escapeAttr(ctaOpts.action)}" data-entry="${escapeAttr(e.id || '')}"`;
+            let btnData = `data-action="${escapeAttr(ctaOpts.action)}" data-entry="${inertShortcodes(escapeAttr(e.id || ''))}"`;
             if (ctaOpts.confirm) btnData += ` data-confirm="${escapeAttr(ctaOpts.confirm)}"`;
             if (ctaOpts.scope) btnData += ` data-scope="${escapeAttr(ctaOpts.scope)}"`;
             const iconHtml = ctaOpts.icon ? `<span data-icon="${escapeAttr(ctaOpts.icon)}"></span> ` : '';
             footer = `<div class="card-footer"><button class="${btnCls}" ${btnData}>${iconHtml}${escapeHtmlText(ctaOpts.label || 'Run')}</button></div>`;
         }
-        return `<div class="card${entryClassSuffix(ctxOpts)}" data-entry-id="${escapeAttr(String(e.id ?? ''))}">${title ? `<div class="card-header">${title}</div>` : ''}<div class="card-body">${body || '&nbsp;'}</div>${footer}</div>`;
+        return `<div class="card${entryClassSuffix(ctxOpts)}" data-entry-id="${inertShortcodes(escapeAttr(String(e.id ?? '')))}">${title ? `<div class="card-header">${title}</div>` : ''}<div class="card-body">${body || '&nbsp;'}</div>${footer}</div>`;
     }).join('\n');
-    return `<div class="dm-collection-display grid ${responsiveGridCols(cols).join(' ')} gap-4"${buildCtxAttr(visibleFields, entries, ctxOpts)}>\n${cards}\n</div>`;
+    // No authored markup in this display - everything bracketed in it is entry data.
+    return inertShortcodes(`<div class="dm-collection-display grid ${responsiveGridCols(cols).join(' ')} gap-4"${buildCtxAttr(visibleFields, entries, ctxOpts)}>\n${cards}\n</div>`);
 }
 
 function renderCollectionList(entries, visibleFields, titleField, emptyMsg, ctaOpts, ctxOpts = {}) {
@@ -664,15 +698,16 @@ function renderCollectionList(entries, visibleFields, titleField, emptyMsg, ctaO
         if (ctaOpts) {
             const ctaStyle = escapeAttr(ctaOpts.style || 'primary');
             let btnCls = `btn btn-${ctaStyle} dm-cta-trigger`;
-            let btnData = `data-action="${escapeAttr(ctaOpts.action)}" data-entry="${escapeAttr(e.id || '')}"`;
+            let btnData = `data-action="${escapeAttr(ctaOpts.action)}" data-entry="${inertShortcodes(escapeAttr(e.id || ''))}"`;
             if (ctaOpts.confirm) btnData += ` data-confirm="${escapeAttr(ctaOpts.confirm)}"`;
             if (ctaOpts.scope) btnData += ` data-scope="${escapeAttr(ctaOpts.scope)}"`;
             const iconHtml = ctaOpts.icon ? `<span data-icon="${escapeAttr(ctaOpts.icon)}"></span> ` : '';
             ctaHtml = `<button class="${btnCls}" ${btnData}>${iconHtml}${escapeHtmlText(ctaOpts.label || 'Run')}</button>`;
         }
-        return `<div class="dm-collection-list-item${entryClassSuffix(ctxOpts)}" data-entry-id="${escapeAttr(String(e.id ?? ''))}">${title ? `<strong>${title}</strong>` : ''}${rest}${ctaHtml}</div>`;
+        return `<div class="dm-collection-list-item${entryClassSuffix(ctxOpts)}" data-entry-id="${inertShortcodes(escapeAttr(String(e.id ?? '')))}">${title ? `<strong>${title}</strong>` : ''}${rest}${ctaHtml}</div>`;
     }).join('\n');
-    return `<div class="dm-collection-display dm-collection-list"${buildCtxAttr(visibleFields, entries, ctxOpts)}>\n${items}\n</div>`;
+    // No authored markup in this display - everything bracketed in it is entry data.
+    return inertShortcodes(`<div class="dm-collection-display dm-collection-list"${buildCtxAttr(visibleFields, entries, ctxOpts)}>\n${items}\n</div>`);
 }
 
 /**
@@ -695,7 +730,7 @@ function renderCollectionAccordion(entries, titleField, bodyField, multiple, emp
         const bodyVal = String(e.data?.[bodyField] ?? '');
         const bodyHtml = marked.parse(bodyVal);
         return (
-            `<div class="accordion-item${entryClassSuffix(ctxOpts)}" data-entry-id="${escapeAttr(String(e.id ?? ''))}">\n` +
+            `<div class="accordion-item${entryClassSuffix(ctxOpts)}" data-entry-id="${inertShortcodes(escapeAttr(String(e.id ?? '')))}">\n` +
             `  <h3 class="accordion-header"><button class="accordion-button" type="button">${title}` +
             `<span class="accordion-icon" data-icon="chevron-down"></span></button></h3>\n` +
             `  <div class="accordion-body"><div class="accordion-content">${bodyHtml}</div></div>\n` +
@@ -704,7 +739,8 @@ function renderCollectionAccordion(entries, titleField, bodyField, multiple, emp
     }).join('\n');
 
     const ctx = buildCtxAttr([{name: titleField}, {name: bodyField}], entries, ctxOpts);
-    return `<div class="dm-collection-display accordion"${multiAttr}${ctx}>\n${items}\n</div>`;
+    // No authored markup in this display - everything bracketed in it is entry data.
+    return inertShortcodes(`<div class="dm-collection-display accordion"${multiAttr}${ctx}>\n${items}\n</div>`);
 }
 
 /**
@@ -740,7 +776,7 @@ function renderCollectionTimeline(entries, opts, ctxOpts = {}) {
         const bodyHtml = bodyField
             ? marked.parse(String(e.data?.[bodyField] ?? ''))
             : '';
-        return `<div class="dm-progression-item${entryClassSuffix(ctxOpts)}" data-entry-id="${escapeAttr(String(e.id ?? ''))}"${date}${status}${icon}><div class="dm-progression-item-title">${title}</div><div class="dm-progression-item-body">${bodyHtml}</div></div>`;
+        return `<div class="dm-progression-item${entryClassSuffix(ctxOpts)}" data-entry-id="${inertShortcodes(escapeAttr(String(e.id ?? '')))}"${date}${status}${icon}><div class="dm-progression-item-title">${title}</div><div class="dm-progression-item-body">${bodyHtml}</div></div>`;
     }).join('\n');
 
     const ctx = buildCtxAttr(
@@ -748,7 +784,8 @@ function renderCollectionTimeline(entries, opts, ctxOpts = {}) {
         entries,
         ctxOpts
     );
-    return `<div class="dm-collection-display dm-progression" data-layout="${layout}" data-theme="${theme}" data-mode="${mode}"${ctx}>\n${items}\n</div>`;
+    // No authored markup in this display - everything bracketed in it is entry data.
+    return inertShortcodes(`<div class="dm-collection-display dm-progression" data-layout="${layout}" data-theme="${theme}" data-mode="${mode}"${ctx}>\n${items}\n</div>`);
 }
 
 /**
@@ -779,7 +816,7 @@ function renderCollectionCarousel(entries, opts, ctxOpts = {}) {
     }
 
     const passthrough = ['autoplay', 'interval', 'loop', 'animation', 'animation-duration', 'animation-easing', 'arrow-position',
-        'background', 'arrow-background', 'arrow-color', 'height-mode', 'height']
+        'background', 'arrow-background', 'arrow-color', 'height-mode', 'height', 'mobile-popup']
         .map(k => dataAttrs[k] ? ` data-${k}="${escapeAttr(String(dataAttrs[k]))}"` : '')
         .join('');
 
@@ -799,9 +836,9 @@ function renderCollectionCarousel(entries, opts, ctxOpts = {}) {
             const bodyHtml = bodyField && e.data?.[bodyField] != null
                 ? `<div class="carousel-slide-description">${marked.parse(String(e.data[bodyField]))}</div>`
                 : '';
-            inner = img + (title || bodyHtml ? `<div class="carousel-slide-content">${title}${bodyHtml}</div>` : '');
+            inner = inertShortcodes(img + (title || bodyHtml ? `<div class="carousel-slide-content">${title}${bodyHtml}</div>` : ''));
         }
-        return `<div class="carousel-slide${entryClassSuffix(ctxOpts)}" data-entry-id="${escapeAttr(String(e.id ?? ''))}">${inner}</div>`;
+        return `<div class="carousel-slide${entryClassSuffix(ctxOpts)}" data-entry-id="${inertShortcodes(escapeAttr(String(e.id ?? '')))}">${inner}</div>`;
     }).join('\n');
 
     const ctxFields = blockTemplate
@@ -892,9 +929,9 @@ function renderCollectionListgroup(entries, opts, ctxOpts = {}) {
             const body = bodyField && e.data?.[bodyField] != null
                 ? `${title ? ' ' : ''}${marked.parseInline(String(e.data[bodyField]))}`
                 : '';
-            inner = (title + body) || escapeHtmlText(String(e.id ?? ''));
+            inner = inertShortcodes((title + body) || escapeHtmlText(String(e.id ?? '')));
         }
-        return `<div class="${itemClassStr}${entryClassSuffix(ctxOpts)}" data-entry-id="${escapeAttr(String(e.id ?? ''))}">${inner}</div>`;
+        return `<div class="${itemClassStr}${entryClassSuffix(ctxOpts)}" data-entry-id="${inertShortcodes(escapeAttr(String(e.id ?? '')))}">${inner}</div>`;
     }).join('\n');
 
     const ctxFields = blockTemplate
@@ -954,7 +991,7 @@ async function processViewBlocks(markdown, tagSet, user = null, flags = {}) {
         // browsing happens without the shortcode itself having to learn joins.
         if (isInteractiveCollection(attrs)) {
             const shell = await renderViewBrowserShell(attrs, {viewConfig, allowed, user});
-            result = result.replace(fullMatch, shell);
+            result = result.replace(fullMatch, () => shell);
             continue;
         }
 
@@ -1097,7 +1134,7 @@ async function processViewBlocks(markdown, tagSet, user = null, flags = {}) {
             replacement = `<div class="dm-view-wrapper${cls}"${id}>${replacement}</div>`;
         }
 
-        result = result.replace(fullMatch, replacement);
+        result = result.replace(fullMatch, () => replacement);
     }
 
     return restore(result);
@@ -1154,12 +1191,12 @@ async function processCollectionBlocks(markdown, tagSet) {
         // browser hydrates and replaces it).
         if (isInteractiveCollection(attrs)) {
             const shell = await renderCollectionBrowserShell(attrs);
-            result = result.replace(fullMatch, shell);
+            result = result.replace(fullMatch, () => shell);
             continue;
         }
 
         const replacement = await renderCollectionFragment(attrs);
-        result = result.replace(fullMatch, replacement);
+        result = result.replace(fullMatch, () => replacement);
     }
 
     return restore(result);
@@ -3160,6 +3197,7 @@ function processCarouselBlocks(markdown) {
     (_, attrStr, body) => {
       const attrs = parseShortcodeAttrs(attrStr);
       const dataAttrs = [
+        attrs['mobile-popup'] === 'true' ? ' data-mobile-popup="true"' : '',
         attrs.autoplay ? ` data-autoplay="${escapeAttr(attrs.autoplay)}"` : '',
         attrs.interval ? ` data-interval="${escapeAttr(attrs.interval)}"` : '',
         attrs.loop ? ` data-loop="${escapeAttr(attrs.loop)}"` : '',

package/server/services/menus.js

@@ -284,6 +284,14 @@ export function normaliseDock(dock) {
     return Object.keys(out).length ? out : null;
 }
 
+/** Mobile navbar choices are independent and opt in. */
+export function normaliseMobile(mobile) {
+    if (!mobile || typeof mobile !== 'object' || Array.isArray(mobile)) return null;
+    const out = Object.fromEntries(['hamburgerOnly', 'hideBrand']
+        .filter(key => mobile[key] === true).map(key => [key, true]));
+    return Object.keys(out).length ? out : null;
+}
+
 // ---------------------------------------------------------------------------
 // Per-page overrides - the `[navbar ... /]` tag.
 //
@@ -610,6 +618,7 @@ export async function createMenu(input) {
         ...(input.class    != null && input.class !== '' && {class: input.class}),
         ...(input.style    != null && {style:    input.style}),
         ...(normaliseDock(input.dock) && {dock: normaliseDock(input.dock)}),
+        ...(normaliseMobile(input.mobile) && {mobile: normaliseMobile(input.mobile)}),
         ...(binding != null && {binding}),
         items: Array.isArray(input.items) ? input.items : [],
         meta: {
@@ -658,6 +667,7 @@ export async function updateMenu(slug, input) {
         ...(input.class    != null && input.class !== '' && {class: input.class}),
         ...(input.style    != null && {style:    input.style}),
         ...(normaliseDock(input.dock) && {dock: normaliseDock(input.dock)}),
+        ...(normaliseMobile(input.mobile) && {mobile: normaliseMobile(input.mobile)}),
         ...(binding != null && {binding}),
         items: Array.isArray(input.items) ? input.items : [],
         meta: {
@@ -864,6 +874,17 @@ export function validateMenu(menu) {
     if (menu.align != null && menu.align !== '' && !MENU_ALIGN.includes(menu.align)) {
         errors.push(`align must be one of: ${MENU_ALIGN.join(', ')}`);
     }
+    if (menu.mobile != null) {
+        if (typeof menu.mobile !== 'object' || Array.isArray(menu.mobile)) {
+            errors.push('mobile must be an object');
+        } else {
+            for (const key of ['hamburgerOnly', 'hideBrand']) {
+                if (menu.mobile[key] != null && typeof menu.mobile[key] !== 'boolean') {
+                    errors.push(`mobile.${key} must be true or false`);
+                }
+            }
+        }
+    }
     if (menu.highlight != null) {
         if (typeof menu.highlight !== 'object' || Array.isArray(menu.highlight)) {
             errors.push('highlight must be an object');

package/server/services/passwordReset.js

@@ -28,6 +28,12 @@
  *   - an administrator's reset (Users › ⋮ › Send password reset / Copy a
  *     reset link) - adminReset(); the admin's own request is signed in, so its
  *     origin is trusted as it stands;
+ *   - an invitation (adminInvite) - "an account has been made for you, set your
+ *     password": the same token store, link and set-password screen as a reset,
+ *     but the link lives INVITE_LIFETIME (7 days), not resetTokenExpiry. The
+ *     expiry is stored with the token, so the screen and the reset route check
+ *     either the same way; whichever link was issued last replaces the other,
+ *     and the reset route clears it on use - one token per account, once;
  *   - checkResetToken() for the reset screen, which checks the link on
  *     opening rather than after a new password has been typed twice;
  *   - the "your password was changed" email on every auth:passwordChanged
@@ -80,6 +86,9 @@ export function durationText(ms) {
     return `${n} minute${n === 1 ? '' : 's'}`;
 }
 
+/** How long an invitation's set-your-password link lives - fixed, whatever resetTokenExpiry says. */
+export const INVITE_LIFETIME = {ms: 7 * 86_400_000, text: '7 days'};
+
 /** How long a reset link lives, from config/auth.json `resetTokenExpiry`. */
 export function resetLifetime() {
     const ms = durationMs(getConfig('auth')?.resetTokenExpiry || '1h');
@@ -328,15 +337,17 @@ function fromOf(site) {
 }
 
 /**
- * A new reset token for a user; replaces any earlier one.
+ * A new reset token for a user; replaces any earlier one (a reset's or an invitation's).
  *
  * @param {string} userId
+ * @param {{ms?: number}} [o] - its lifetime; a reset's (resetTokenExpiry) unless given
  * @returns {Promise<{token: string, expiresAt: string}>}
  */
-export async function issueResetToken(userId) {
+export async function issueResetToken(userId, {ms} = {}) {
     const token = crypto.randomBytes(32).toString('hex');
     const hash = crypto.createHash('sha256').update(token).digest('hex');
-    const expiresAt = new Date(Date.now() + resetLifetime().ms).toISOString();
+    const life = Number.isFinite(ms) && ms > 0 ? ms : resetLifetime().ms;
+    const expiresAt = new Date(Date.now() + life).toISOString();
     await setResetToken(userId, hash, expiresAt);
     return {token, expiresAt};
 }
@@ -444,6 +455,63 @@ export async function adminReset({user, origin, via, by}) {
     return {sent: true, expiresAt, expiresIn};
 }
 
+/**
+ * The invitation email: an account was made for them, choose a password.
+ *
+ * @param {{name: string, email: string, link: string, lifetime: string, siteTitle: string, invitedBy?: string}} o
+ * @returns {{subject: string, html: string, text: string}}
+ */
+export function buildInviteEmail({name, email: address, link, lifetime, siteTitle, invitedBy = ''}) {
+    const site = siteTitle || 'the site';
+    const hi = name ? `Hi ${name},` : 'Hello,';
+    const who = invitedBy ? `${invitedBy}, an administrator of ${site},` : `An administrator of ${site}`;
+    const line = `An account has been made for you on ${site}${address ? ` (you sign in with ${address})` : ''}. ${who} invites you to set your password and sign in.`;
+    return {
+        subject: `You have an account on ${site} - set your password`,
+        html: `
+<!DOCTYPE html>
+<html>
+<body style="font-family:sans-serif;max-width:560px;margin:0 auto;padding:24px;">
+    <h2 style="color:#333;">Your account on ${esc(site)}</h2>
+    <p>${esc(hi)}</p>
+    <p>${esc(line)}</p>
+    <p style="margin:24px 0;">
+        <a href="${esc(link)}" style="background:#5b8cff;color:#fff;padding:12px 24px;border-radius:6px;text-decoration:none;display:inline-block;">Set your password</a>
+    </p>
+    <p style="color:#888;font-size:.85rem;">The link works once and expires in ${esc(lifetime)}. Not expecting this? Ignore it - nobody can sign in to the account until a password is set.</p>
+    <p style="color:#bbb;font-size:.8rem;">${esc(link)}</p>
+</body>
+</html>`.trim(),
+        text: `${hi}\n\n${line}\n\nSet your password here (the link works once and expires in ${lifetime}):\n${link}\n\n`
+            + 'Not expecting this? Ignore it - nobody can sign in to the account until a password is set.'
+    };
+}
+
+/**
+ * An invitation to an account an administrator (or an import) made: a
+ * set-your-password link valid INVITE_LIFETIME, emailed. It replaces any
+ * earlier link for the account. The caller has already decided this account
+ * may be invited.
+ *
+ * @param {{user: object, origin: string, by?: {id?: string, name?: string, email?: string}|true}} o
+ * @returns {Promise<{sent: true, expiresAt: string, expiresIn: string}>}
+ * @throws {Error} code 'NO_SMTP' | 'INACTIVE' | 'NO_ORIGIN'
+ */
+export async function adminInvite({user, origin, by}) {
+    const fail = (code, message) => Object.assign(new Error(message), {code});
+    if (!user.isActive) throw fail('INACTIVE', 'This account is inactive - make it active first, or it cannot sign in.');
+    const site = getConfig('site') || {};
+    if (!mailer.isSmtpConfigured(site.smtp)) throw fail('NO_SMTP', 'No mail server is set up (Settings › Email), so the invitation cannot be emailed.');
+    if (!origin) throw fail('NO_ORIGIN', 'The site does not know its own address. Set the Site URL in Settings › General.');
+    const {token, expiresAt} = await issueResetToken(user.id, {ms: INVITE_LIFETIME.ms});
+    hooks.emit('auth:resetIssued', {userId: user.id, by: by?.id ?? null, via: 'invite'});
+    const message = buildInviteEmail({name: user.name, email: user.email, link: resetLink(origin, token), lifetime: INVITE_LIFETIME.text,
+        siteTitle: site.title, invitedBy: by === true ? '' : (by?.name || by?.email || '')});
+    const transport = await mailer.createTransport(site.smtp);
+    await mailer.sendEmail(transport, {...fromOf(site), to: user.email, ...message});
+    return {sent: true, expiresAt, expiresIn: INVITE_LIFETIME.text};
+}
+
 // ---------------------------------------------------------------------------
 // The reset screen
 // ---------------------------------------------------------------------------

package/server/services/renderer.js

@@ -305,6 +305,7 @@ export async function renderPage(page, opts = {}) {
             // Docked behaviour (rail width, collapse, autohide, hide on scroll) - site.js
             // wires it; width and autohide also shape the body below, from the first paint.
             ...(navMenu.dock && {dock: navMenu.dock}),
+            ...(navMenu.mobile && {mobile: navMenu.mobile}),
             // Item highlighting: the navbar is built in the browser, so the
             // config has to travel to site.js rather than being rendered here.
             ...(navMenu.highlight && {highlight: navMenu.highlight}),
@@ -1076,6 +1077,7 @@ export async function renderBlogPage(templatePath, data = {}, seoMeta = {}) {
             // Docked behaviour (rail width, collapse, autohide, hide on scroll) - site.js
             // wires it; width and autohide also shape the body below, from the first paint.
             ...(navMenu.dock && {dock: navMenu.dock}),
+            ...(navMenu.mobile && {mobile: navMenu.mobile}),
             // Item highlighting: the navbar is built in the browser, so the
             // config has to travel to site.js rather than being rendered here.
             ...(navMenu.highlight && {highlight: navMenu.highlight}),