domma-cms 1.8.5 → 1.8.7

package/server/services/wpImport/index.js

@@ -29,12 +29,19 @@
  * here (wp-<type>, with a list page at the type's old address), to pages, or
  * nowhere - the person chooses per type in the preview.
  *
+ * The WordPress authors (./people.js) are matched to users here by email, made
+ * into new accounts (the role the person chose, no usable password, an
+ * optional "set your password" email through core's administrator reset), or
+ * left out; what they wrote is credited to whoever they became. A user here is
+ * only ever credited - never changed.
+ *
  * The one request hook here answers WordPress's query addresses (/?p=12,
  * /?page_id=7, /?attachment_id=3) from the mapping; path redirects go into
  * SEO's redirect store.
  *
  * @module services/wpImport
  */
+import crypto from 'node:crypto';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import fp from 'fastify-plugin';
@@ -54,7 +61,11 @@ import {createCollection, createEntry, getCollection, getEntry, listCollections,
 import {customEntryData, customFields, customTypesOf, entryFingerprintText, listPageBody, mediaContext, mergeFields, schemaFields, stripShortcodes} from './custom.js';
 import {getPluginStates} from '../plugins.js';
 import {createMenu, getMenu, listMenus, updateMenu} from '../menus.js';
-import {listUsers} from '../users.js';
+import {createUser, getUserByEmail, getUserById, listUsers} from '../users.js';
+import {adminInvite} from '../passwordReset.js';
+import {adminRightsGiven} from '../notification-sources.js';
+import {getRoleLevel} from '../roles.js';
+import {creditMap} from './people.js';
 import {seoEngine} from '../seo/index.js';
 import {hooks as coreHooks} from '../hooks.js';
 import {allowInGitignore} from '../siteGitignore.js';
@@ -242,8 +253,10 @@ export async function siteState(mapping = {}) {
         customEntries.set(m.slug, hashes);
     }
     const seo = seoEngine();
+    // The users here - only what matching an author needs (never a password or a token).
+    const users = (await listUsers().catch(() => [])).map(u => ({id: u.id, email: String(u.email || '').toLowerCase(), name: u.name || ''}));
     return {
-        pagePaths, pageHashes, shop, collections, customEntries,
+        pagePaths, pageHashes, shop, collections, customEntries, users,
         mediaNames: new Set(media.map(m => String(m.name).toLowerCase())),
         menuSlugs: new Set(menus.map(m => m.slug)),
         menuHashes,
@@ -334,7 +347,8 @@ export async function previewImport(id, options = {}) {
     const mapping = await mappingFor(sourceKey(wxr.site));
     const state = await siteState(mapping);
     const zipPaths = options.media === 'zip' ? await uploadsIndex(id) : null;
-    const plan = planImport(wxr, state, mapping, {...cleanOptions(options), zipPaths, anyPort: testHostsAllowed()});
+    // `people` (what the person may do with users) comes from the route, never from the request body.
+    const plan = planImport(wxr, state, mapping, {...cleanOptions(options), people: options.people || null, zipPaths, anyPort: testHostsAllowed()});
     return {plan, state, wxr, mapping, meta};
 }
 
@@ -354,10 +368,21 @@ export function cleanOptions(o = {}) {
         products: o.products !== false,
         types: cleanTypeChoices(o.types, ['collection', 'pages', 'skip']),
         listPages: cleanTypeChoices(o.listPages, [false]),
-        choices
+        choices,
+        users: cleanUserChoices(o.users),
+        userRole: typeof o.userRole === 'string' && /^[a-z0-9][a-z0-9_-]{0,59}$/i.test(o.userRole) ? o.userRole : '',
+        invite: o.invite === true
     };
 }
 
+/** {'author:<id>': 'create'|'skip'} - only author keys, only those two choices. */
+function cleanUserChoices(map) {
+    const out = {};
+    if (!map || typeof map !== 'object') return out;
+    for (const [k, v] of Object.entries(map).slice(0, 5000)) if (/^author:(\d{1,12}|login-[\w.-]{1,60})$/.test(k) && (v === 'create' || v === 'skip')) out[k] = v;
+    return out;
+}
+
 /** {postType: choice} - only real post type names, only the allowed values. */
 function cleanTypeChoices(map, allowed) {
     const out = {};
@@ -380,6 +405,8 @@ export const runningJob = () => running;
  * @returns {Promise<object>} the job (poll getJob(id) for progress)
  */
 export async function startRun(id, options, user, log = console) {
+    // Where a "set your password" link points - the route's adminOrigin(); never part of the plan or the report.
+    const inviteOrigin = typeof options?.inviteOrigin === 'string' ? options.inviteOrigin : '';
     if (running) throw Object.assign(new Error('An import is already running - wait for it to finish.'), {statusCode: 409});
     // Claimed before the first await, so two quick Run requests cannot both start.
     const job = {id: newId(), staged: id, status: 'running', phase: 'Starting', done: 0, total: 0, startedAt: new Date().toISOString(), reportId: null, error: ''};
@@ -399,7 +426,7 @@ export async function startRun(id, options, user, log = console) {
     const record = {id: job.id, by: user?.name || user?.email || '', source: pre.plan.source, siteTitle: pre.plan.site.title,
         siteUrl: pre.plan.site.url, file: pre.meta.fileName || '', staged: id, startedAt: job.startedAt};
     await markRunning(record).catch(() => {});
-    runJob(job, pre, user, log)
+    runJob(job, {...pre, inviteOrigin}, user, log)
         .catch(async (err) => {
             job.status = 'failed';
             job.error = err.message || String(err);
@@ -411,7 +438,7 @@ export async function startRun(id, options, user, log = console) {
     return job;
 }
 
-async function runJob(job, {plan, wxr, mapping: oldMapping, meta}, user, log) {
+async function runJob(job, {plan, wxr, mapping: oldMapping, meta, inviteOrigin}, user, log) {
     const started = Date.now();
     const mapping = {
         items: {...(oldMapping.items || {})},
@@ -419,7 +446,7 @@ async function runJob(job, {plan, wxr, mapping: oldMapping, meta}, user, log) {
         query: {p: {...oldMapping.query?.p}, page_id: {...oldMapping.query?.page_id}, attachment_id: {...oldMapping.query?.attachment_id}}
     };
     try {
-        await runPhases(job, {plan, wxr, oldMapping, meta}, user, log, mapping, started);
+        await runPhases(job, {plan, wxr, oldMapping, meta, inviteOrigin}, user, log, mapping, started);
     } catch (err) {
         // What was written before the failure is recorded, so a retry updates it rather than duplicating it.
         await saveMapping(plan.source, mapping).catch(() => {});
@@ -428,13 +455,14 @@ async function runJob(job, {plan, wxr, mapping: oldMapping, meta}, user, log) {
     }
 }
 
-async function runPhases(job, {plan, wxr, oldMapping, meta}, user, log, mapping, started) {
+async function runPhases(job, {plan, wxr, oldMapping, meta, inviteOrigin}, user, log, mapping, started) {
     const byId = new Map(wxr.items.map(i => [i.id, i]));
     const rows = new Map(plan.items.map(r => [r.key, r]));
     const results = new Map(); // key -> {result, error?, target?, notes?}
     const set = (key, r) => results.set(key, r);
     const works = (r) => ['create', 'rename', 'update'].includes(r.action);
-    job.total = plan.items.filter(works).length + plan.redirects.filter(r => r.action !== 'skip').length;
+    const peopleRows = plan.people?.rows || [];
+    job.total = plan.items.filter(works).length + plan.redirects.filter(r => r.action !== 'skip').length + peopleRows.filter(r => r.action === 'create').length;
     // What has been made is saved as the run goes (every few items, and at each phase), so a
     // restart in the middle loses nothing a second run would then make twice.
     let unsaved = 0;
@@ -447,6 +475,14 @@ async function runPhases(job, {plan, wxr, oldMapping, meta}, user, log, mapping,
     };
     const step = async (label) => { job.done++; unsaved++; if (label) job.current = label; await checkpoint(); await tick(); };
 
+    // ---- 0. People: authors matched to users here, or made into new accounts ----
+    job.phase = 'People';
+    const people = await runPeople(peopleRows, {plan, mapping, oldMapping, user, step, log});
+    const credit = creditMap(peopleRows, people.resolved);
+    /** The user a WordPress item is credited to, or '' when its author has no account here. */
+    const creditOf = (it) => credit.get(it?.creator) || '';
+    await checkpoint(true);
+
     // ---- 1. Media ----
     job.phase = 'Media';
     const mediaRows = plan.items.filter(r => r.kind === 'media' && works(r));
@@ -569,11 +605,8 @@ async function runPhases(job, {plan, wxr, oldMapping, meta}, user, log, mapping,
     // ---- 3. Pages (and posts as pages) ----
     job.phase = 'Pages';
     const users = await listUsers().catch(() => []);
-    const userByEmail = new Map(users.filter(u => u.email).map(u => [u.email.toLowerCase(), u.id]));
-    const authorOf = (it) => {
-        const a = wxr.authors.find(x => x.login === it.creator);
-        return (a?.email && userByEmail.get(a.email.toLowerCase())) || user?.id || users[0]?.id || 'import';
-    };
+    // An author without an account here is credited to the person running the import, as before.
+    const authorOf = (it) => creditOf(it) || user?.id || users[0]?.id || 'import';
     // Pages, posts as pages, and custom items as pages; a type's list page is made with its collection.
     const docRows = plan.items.filter(r => !r.listFor && (r.kind === 'page' || (r.kind === 'post' && !blogMode) || (r.kind === 'custom' && r.as === 'pages')));
     for (const r of docRows) {
@@ -586,6 +619,7 @@ async function runPhases(job, {plan, wxr, oldMapping, meta}, user, log, mapping,
         try {
             const conv = convert(it);
             const fm = pageFrontmatter(it, r, plan, wxr);
+            if (creditOf(it)) fm.createdBy = creditOf(it);
             const exists = await getPage(r.target).catch(() => null);
             if (exists && (r.action === 'update')) await updatePage(r.target, fm, conv.body, {author: user?.email || 'WordPress import'});
             else if (exists) throw new Error(`${r.target} was taken while the import ran.`);
@@ -735,7 +769,7 @@ async function runPhases(job, {plan, wxr, oldMapping, meta}, user, log, mapping,
                     let entry;
                     const now = r.action === 'update' && r.entryId ? await getEntry(slug, r.entryId) : null;
                     if (now) entry = await updateEntry(slug, r.entryId, {...(now.data || {}), ...data});
-                    else entry = await createEntry(slug, data, {createdBy: user?.id || null, source: 'import'});
+                    else entry = await createEntry(slug, data, {createdBy: creditOf(it) || user?.id || null, source: 'import'});
                     mapping.items[r.key] = {...pagePart(oldMapping.items[r.key]), kind: 'custom', collection: slug, entryId: entry.id, entryHash: customFingerprint(entry.data), at: new Date().toISOString()};
                     if (r.listAt) mapping.query.p[r.wpId] = r.listAt;
                     set(r.key, {result: now ? 'updated' : 'created', target: r.listAt || '', entryId: entry.id, collection: slug, notes: [...conv.notes, ...notes], format: conv.format});
@@ -838,11 +872,19 @@ async function runPhases(job, {plan, wxr, oldMapping, meta}, user, log, mapping,
         await step(r.from);
     }
 
-    // ---- 9. Save the mapping, the report, the history ----
+    // The mapping is saved before any email goes: an account made is recorded whatever the mail does.
+    await saveMapping(plan.source, mapping);
+    // ---- 9. "Set your password" emails - only now the run has got this far, only if asked ----
+    if (plan.options.invite && people.made.length) {
+        job.phase = 'Emailing new users';
+        await sendInvites(people, {origin: inviteOrigin, by: user, log});
+    }
+
+    // ---- 10. Save the mapping, the report, the history ----
     job.phase = 'Finishing';
     await saveMapping(plan.source, mapping);
     forgetMapCache();
-    const report = buildReport({job, plan, results, redirectResults, meta, user, started, commentsMade});
+    const report = buildReport({job, plan, results, redirectResults, meta, user, started, commentsMade, people});
     await addHistory(report.run, report);
     await discardStaged(job.staged);
     job.reportId = report.run.id;
@@ -852,6 +894,107 @@ async function runPhases(job, {plan, wxr, oldMapping, meta}, user, log, mapping,
     log.info?.(`[wordpress-import] ${plan.site.title || plan.source}: ${JSON.stringify(report.run.summary)}`);
 }
 
+// ---- People ------------------------------------------------------------------
+
+/** Between two "set your password" emails - a big export must not burst the mail server. Tests shorten it. */
+export const INVITE_LIMITS = {gapMs: 1500, max: 200};
+
+/**
+ * The People phase: each author's row (./people.js) acted on. Matched and
+ * linked users are only credited - nothing here ever writes to an existing
+ * account. A new account gets a random password nobody is told (bcrypt-hashed
+ * by createUser, never stored or logged), so it cannot sign in until a password
+ * is set through a reset link.
+ *
+ * @returns {Promise<{resolved: Map<string,string>, made: object[], results: Map<string,object>}>}
+ *   resolved: author key -> user id; made: the accounts this run created
+ */
+async function runPeople(rows, {plan, mapping, oldMapping, user, step, log}) {
+    const resolved = new Map();
+    const made = [];
+    const results = new Map();
+    const record = (r, userId, how) => {
+        resolved.set(r.key, userId);
+        mapping.items[r.key] = {kind: 'author', userId, how, at: new Date().toISOString()};
+    };
+    for (const r of rows) {
+        if (r.action === 'linked') {
+            const was = oldMapping.items?.[r.key];
+            if (was) mapping.items[r.key] = was;
+            resolved.set(r.key, r.userId);
+            results.set(r.key, {result: 'linked', userId: r.userId});
+        } else if (r.action === 'match') {
+            record(r, r.userId, 'matched');
+            results.set(r.key, {result: 'matched', userId: r.userId});
+        } else if (r.action === 'create') {
+            try {
+                // Someone may have been added with this email since the preview: credit them, change nothing.
+                const here = await getUserByEmail(r.email);
+                if (here) {
+                    record(r, here.id, 'matched');
+                    results.set(r.key, {result: 'matched', userId: here.id, note: 'An account with that email was added while the import ran - credited to it.'});
+                } else {
+                    // Checked again here, not only in the route: the role must still be one new accounts may have.
+                    if (!r.role || !(getRoleLevel(r.role) > 0) || !plan.people.roles.some(x => x.name === r.role)) throw new Error('That role cannot be given to new accounts.');
+                    const created = await createUser({
+                        name: r.name, email: r.email, role: r.role,
+                        password: crypto.randomBytes(36).toString('base64url'),
+                        meta: {importedFrom: {source: 'wordpress', site: plan.source, author: r.wpId}}
+                    });
+                    record(r, created.id, 'created');
+                    made.push({key: r.key, id: created.id});
+                    results.set(r.key, {result: 'created', userId: created.id});
+                    if (getRoleLevel(r.role) <= 1) Promise.resolve().then(() => adminRightsGiven(created, [r.role], `the WordPress import run by ${user?.name || user?.email || 'an administrator'}`)).catch(() => {});
+                }
+            } catch (err) {
+                results.set(r.key, {result: 'failed', error: err.message || String(err)});
+                log.warn?.(`[wordpress-import] an account for WordPress author ${r.wpId} was not made: ${err.message}`);
+            }
+            await step(r.name);
+        } else if (r.action !== 'same') {
+            results.set(r.key, {result: 'skipped'});
+        }
+    }
+    // One account per email: an author sharing another's email comes to whatever that one did.
+    for (const r of rows.filter(x => x.action === 'same')) {
+        const id = resolved.get(r.sameAs);
+        if (id) resolved.set(r.key, id);
+        results.set(r.key, {result: id ? 'same' : 'skipped', userId: id || ''});
+    }
+    return {resolved, made, results, invited: new Map(), inviteNote: ''};
+}
+
+/**
+ * An invitation to each account this run made (services/passwordReset.js
+ * adminInvite): "an account has been made for you - set your password", a
+ * link valid 7 days on the reset screen's token. One at a time, spaced, capped.
+ * Never throws: what was not sent goes in the report.
+ */
+async function sendInvites(people, {origin, by, log}) {
+    const list = people.made.slice(0, INVITE_LIMITS.max);
+    for (let i = 0; i < list.length; i++) {
+        const m = list[i];
+        try {
+            const target = await getUserById(m.id);
+            if (!target) throw Object.assign(new Error('The account has gone.'), {code: 'GONE'});
+            await adminInvite({user: target, origin, by: by || true});
+            people.invited.set(m.key, 'sent');
+        } catch (err) {
+            people.invited.set(m.key, 'failed');
+            // No mail server, or the site does not know its address: the same for every one - say it once and stop.
+            if (err.code === 'NO_SMTP' || err.code === 'NO_ORIGIN') {
+                people.inviteNote = `No invitations were sent: ${err.message} Use Users › Send password reset for each new account instead.`;
+                for (const rest of list.slice(i + 1)) people.invited.set(rest.key, 'failed');
+                return;
+            }
+            // The mail server's own message can quote the address - only its code goes in the log.
+            log.warn?.(`[wordpress-import] the set-your-password email for new account ${m.id} was not sent (${err.code || err.responseCode || 'error'}).`);
+        }
+        if (i < list.length - 1) await new Promise(r => setTimeout(r, INVITE_LIMITS.gapMs));
+    }
+    if (people.made.length > list.length) people.inviteNote = `Only the first ${list.length} new accounts were emailed - send the rest a reset from Users.`;
+}
+
 /**
  * The collection a custom type goes to: made the first time, used again after.
  * An existing one only gains fields - the person may have changed or removed
@@ -1046,7 +1189,7 @@ async function importComments(it, postEntryId, mapping, oldMapping, user) {
     return made;
 }
 
-function buildReport({job, plan, results, redirectResults, meta, user, started, commentsMade}) {
+function buildReport({job, plan, results, redirectResults, meta, user, started, commentsMade, people}) {
     const items = plan.items.map(r => {
         const res = results.get(r.key) || {result: r.action === 'skip' ? 'skipped' : r.action === 'keep' ? 'kept' : 'skipped'};
         return {
@@ -1065,8 +1208,28 @@ function buildReport({job, plan, results, redirectResults, meta, user, started,
     }
     const redirects = {created: 0, updated: 0, skipped: 0, failed: 0};
     for (const r of redirectResults) redirects[r.result] = (redirects[r.result] || 0) + 1;
-    const failed = items.filter(i => i.result === 'failed').length + redirects.failed + commentErrors.length;
+    // The authors - names and ids only: the emails stay in the export, which is deleted after the run.
+    const invite = Boolean(plan.options.invite);
+    const peopleRows = (plan.people?.rows || []).map(r => {
+        const res = people?.results.get(r.key) || {result: 'skipped'};
+        const sent = people?.invited.get(r.key);
+        return {
+            key: r.key, wpId: r.wpId, name: r.name, result: res.result, userId: res.userId || '', role: res.result === 'created' ? r.role : '',
+            items: r.items, total: r.total,
+            // Never the address itself, even an unusable one: the report is kept on disk.
+            reason: res.error || res.note || (r.problem === 'email' ? 'The export had no usable email address for them, so no account was made.' : r.reason) || '',
+            ...(res.result === 'created' && {invited: sent === 'sent', ...(invite && sent !== 'sent' && {inviteFailed: true})})
+        };
+    });
+    const peopleTally = {created: 0, matched: 0, linked: 0, same: 0, skipped: 0, failed: 0, invited: 0};
+    for (const r of peopleRows) { peopleTally[r.result] = (peopleTally[r.result] || 0) + 1; if (r.invited) peopleTally.invited++; }
+    const failed = items.filter(i => i.result === 'failed').length + redirects.failed + commentErrors.length + peopleTally.failed;
+    const newPeople = peopleRows.filter(r => r.result === 'created');
+    const peopleNotes = [];
+    if (people?.inviteNote) peopleNotes.push(people.inviteNote);
+    else if (newPeople.length && !invite) peopleNotes.push(`${newPeople.length} new account${newPeople.length === 1 ? ' was' : 's were'} made with no password - nobody can sign in to ${newPeople.length === 1 ? 'it' : 'them'} until a password is set. Send each one a reset from Users (⋮ › Send password reset) when you are ready.`);
     const summary = {
+        people: peopleTally,
         kinds: tally,
         comments: commentsMade,
         redirects,
@@ -1085,7 +1248,7 @@ function buildReport({job, plan, results, redirectResults, meta, user, started,
         durationMs: Date.now() - started,
         summary
     };
-    return {run, options: plan.options, items, redirects: redirectResults, notes: [...plan.notes, ...(plan.summary.products?.notes || []), ...commentErrors.slice(0, 50)], blogBase: plan.blogBase, shopBase: plan.shopBase};
+    return {run, options: plan.options, items, people: peopleRows, redirects: redirectResults, notes: [...peopleNotes, ...plan.notes, ...(plan.summary.products?.notes || []), ...commentErrors.slice(0, 50)], blogBase: plan.blogBase, shopBase: plan.shopBase};
 }
 
 // ---- The request hook: WordPress's query addresses ------------------------

package/server/services/wpImport/people.js

@@ -0,0 +1,202 @@
+/**
+ * The WordPress authors - who wrote what, and whether each becomes (or is
+ * matched to) a user here. PURE: the site's users and what the person running
+ * the import may do come in as data; nothing is read or written here. The run
+ * (./index.js, the People phase) acts on what this decides.
+ *
+ * A WordPress export names each author once (<wp:author>: id, login, email,
+ * display name, first and last name - never a password or a role) and each item
+ * names its author's login (dc:creator). That is personal data: the emails are
+ * shown on the preview to the person running the import, and are never written
+ * to the report or the history kept on disk (ids and names are enough there).
+ *
+ * Every author gets one action:
+ *   linked - an earlier run of this import made or matched their account
+ *            (map.json `author:<id>`), and it is still here: credited, untouched
+ *   match  - a user here has the same email (any case): credited to them; their
+ *            account - role, password, profile - is never changed
+ *   create - a new account, with the role chosen for new accounts and no usable
+ *            password: it cannot sign in until a password is set
+ *   same   - another author in this export has the same email: credited to
+ *            whatever that author's row comes to (one account per email)
+ *   skip   - no account: their content is credited to the person running the import
+ *
+ * Only an exact email match ever joins an author to an account. A missing or
+ * unusable email is never guessed at; a name shared with someone here is only
+ * pointed out (accounts here have no usernames to clash with - they sign in
+ * with their email).
+ *
+ * @module services/wpImport/people
+ */
+
+/** The kinds of item an author is credited with. Not products: the Shop's save records no author, so they would credit nobody. */
+export const CREDITED_KINDS = ['page', 'post', 'custom'];
+
+const CONTROL = /[\u0000-\u001f\u007f]/g;
+
+/** An email as stored here (lower case, trimmed), or '' when it is not a usable one. */
+export function cleanEmail(raw) {
+    const s = String(raw ?? '').trim().toLowerCase();
+    if (!s || s.length > 254) return '';
+    // One @, something either side, a dot in the domain, nothing that could end a header or a quoted name.
+    return /^[^\s@<>()",;:\\[\]]+@[^\s@<>()",;:\\[\]]+\.[^\s@<>()",;:\\[\]]+$/.test(s) ? s : '';
+}
+
+/** What to call an author: display name, else first and last name, else the login - plain text, short. */
+export function authorName(a = {}) {
+    const clean = (v) => String(v ?? '').replace(CONTROL, ' ').replace(/<[^>]*>/g, '').replace(/[<>]/g, '').replace(/\s+/g, ' ').trim();
+    const full = clean(`${a.firstName || ''} ${a.lastName || ''}`);
+    // readWxr() fills an empty display name with the login: a real name, when there is one, reads better.
+    const display = clean(a.displayName) === clean(a.login) && full ? '' : clean(a.displayName);
+    return (display || full || clean(a.login) || `Author ${a.id || '?'}`).slice(0, 100);
+}
+
+/**
+ * The authors and what happens to each.
+ *
+ * @param {object} wxr - from readWxr()
+ * @param {object[]} rows - the plan's items (what each is credited with is counted from those being imported)
+ * @param {{id: string, email: string, name: string}[]} siteUsers - the users here now
+ * @param {object} [mapping] - earlier runs ({items: {'author:<id>': {kind: 'author', userId, how}}})
+ * @param {object} [options]
+ * @param {Object<string,'create'|'skip'>} [options.users] - per author key, the person's choice
+ * @param {string} [options.userRole] - the role for new accounts ('' = the default)
+ * @param {boolean} [options.invite] - email each new account a link to set its password
+ * @param {object} [ctx] - what the person running the import may do (routes/api/wordpress-import.js peopleContext())
+ * @param {boolean} ctx.canCreate
+ * @param {string} [ctx.why] - why not, when they may not
+ * @param {{name: string, label: string, level: number}[]} ctx.roles - the roles they may give
+ * @param {string} ctx.defaultRole
+ * @param {boolean} [ctx.mailReady] - a mail server is set up
+ * @returns {object} {rows, role, roles, canCreate, why, invite, mailReady, counts}
+ */
+export function planPeople(wxr, rows, siteUsers = [], mapping = {}, options = {}, ctx = {}) {
+    const choices = options.users && typeof options.users === 'object' ? options.users : {};
+    const roles = Array.isArray(ctx.roles) ? ctx.roles : [];
+    const canCreate = Boolean(ctx.canCreate && roles.length);
+    const role = roles.some(r => r.name === options.userRole) ? options.userRole
+        : roles.some(r => r.name === ctx.defaultRole) ? ctx.defaultRole : '';
+    const why = canCreate ? '' : (ctx.why || 'You cannot add users on this site, so no accounts are made.');
+    const mapped = mapping.items || {};
+    const byId = new Map((wxr.items || []).map(i => [i.id, i]));
+    const usersById = new Map(siteUsers.map(u => [u.id, u]));
+    const usersByEmail = new Map(siteUsers.filter(u => u.email).map(u => [String(u.email).toLowerCase(), u]));
+    const userNames = new Map(siteUsers.filter(u => u.name).map(u => [String(u.name).trim().toLowerCase(), u]));
+
+    // What each author is credited with - only what this run imports.
+    const tally = new Map();
+    for (const r of rows) {
+        if (!CREDITED_KINDS.includes(r.kind) || r.action === 'skip' || !r.wpId || r.listFor) continue;
+        const login = byId.get(r.wpId)?.creator;
+        if (!login) continue;
+        const t = tally.get(login) || {page: 0, post: 0, product: 0, custom: 0};
+        t[r.kind]++;
+        tally.set(login, t);
+    }
+
+    // Every author the export names, and anyone items name who is not in its author list (a partial export).
+    const authors = [...(wxr.authors || [])].filter(a => a.login || a.id).sort((a, b) => (a.id || 0) - (b.id || 0));
+    const known = new Set(authors.map(a => a.login));
+    for (const login of tally.keys()) if (!known.has(login)) { known.add(login); authors.push({id: 0, login, email: '', displayName: login}); }
+
+    const out = [];
+    const firstByEmail = new Map();
+    for (const a of authors) {
+        const items = tally.get(a.login) || {page: 0, post: 0, product: 0, custom: 0};
+        const total = items.page + items.post + items.product + items.custom;
+        const key = a.id ? `author:${a.id}` : `author:login-${String(a.login).replace(/[^\w.-]/g, '_').slice(0, 60)}`;
+        const email = cleanEmail(a.email);
+        const row = {key, wpId: a.id || 0, login: String(a.login || '').slice(0, 60), name: authorName(a), email, rawEmail: email ? '' : String(a.email || '').replace(CONTROL, '').trim().slice(0, 120),
+            items, total, action: 'skip', userId: '', userName: '', role: '', reason: '', problem: '', sameAs: '', choosable: false, choice: choices[key] || ''};
+        const was = mapped[key];
+        const linked = was?.kind === 'author' && was.userId && usersById.get(was.userId);
+        if (linked) {
+            row.action = 'linked';
+            row.userId = linked.id;
+            row.userName = linked.name || '';
+            row.reason = was.how === 'created'
+                ? `An earlier import made their account (${linked.name || 'a user here'}) - credited to it; it is not changed.`
+                : `Matched to ${linked.name || 'a user here'} by an earlier import - credited to them; their account is not changed.`;
+            if (email && !firstByEmail.has(email)) firstByEmail.set(email, row);
+            out.push(row);
+            continue;
+        }
+        if (!email) {
+            row.problem = 'email';
+            row.reason = row.rawEmail
+                ? `"${row.rawEmail}" is not a usable email address, so no account can be made - ${total ? 'their content is credited to you' : 'and nothing of theirs is being imported'}.`
+                : `The export has no email address for them, so no account can be made - ${total ? 'their content is credited to you' : 'and nothing of theirs is being imported'}.`;
+            out.push(row);
+            continue;
+        }
+        const first = firstByEmail.get(email);
+        if (first) {
+            row.action = 'same';
+            row.problem = 'duplicate';
+            row.sameAs = first.key;
+            row.reason = `Has the same email as ${first.name} in this export - one account for both, credited the same way.`;
+            out.push(row);
+            continue;
+        }
+        firstByEmail.set(email, row);
+        const here = usersByEmail.get(email);
+        if (here) {
+            row.action = 'match';
+            row.userId = here.id;
+            row.userName = here.name || '';
+            row.reason = `Matches ${here.name || 'a user here'} by email - credited to them; their account is not changed.`;
+            out.push(row);
+            continue;
+        }
+        row.choosable = canCreate;
+        const want = ['create', 'skip'].includes(row.choice) ? row.choice : (total ? 'create' : 'skip');
+        if (want === 'create' && canCreate) {
+            row.action = 'create';
+            row.role = role;
+            const clash = userNames.get(row.name.toLowerCase());
+            row.reason = `A new account (${roles.find(r => r.name === role)?.label || role}) with no password - it cannot sign in until a password is set.`
+                + (clash ? ` Someone here is also called ${clash.name} - this is a separate account (they sign in with different emails).` : '');
+        } else if (want === 'create') {
+            row.reason = `${why} Their content is credited to you.`;
+        } else {
+            row.reason = row.choice === 'skip'
+                ? `You chose not to make an account${total ? ' - their content is credited to you' : ''}.`
+                : 'Nothing of theirs is being imported, so no account is made.';
+        }
+        out.push(row);
+    }
+    // Rows with the same email follow their first: what that one comes to, they come to.
+    for (const r of out) {
+        if (r.action !== 'same') continue;
+        const first = out.find(x => x.key === r.sameAs);
+        if (first?.action === 'match' || first?.action === 'linked') { r.userId = first.userId; r.userName = first.userName; }
+        if (first?.action === 'skip') r.reason += ' No account is being made for that email, so their content is credited to you.';
+    }
+    out.sort((a, b) => b.total - a.total || a.name.localeCompare(b.name));
+    const counts = {total: out.length, create: 0, match: 0, linked: 0, same: 0, skip: 0, problems: 0};
+    for (const r of out) { counts[r.action]++; if (r.problem === 'email') counts.problems++; }
+    return {
+        rows: out, role, roles, canCreate, why,
+        invite: Boolean(options.invite && canCreate && counts.create),
+        mailReady: Boolean(ctx.mailReady),
+        counts
+    };
+}
+
+/**
+ * Who each WordPress login is credited to, once the People phase has run:
+ * login -> user id. Authors without an account are left out (the caller's own
+ * fallback - the person running the import - applies to them).
+ *
+ * @param {object[]} rows - planPeople().rows
+ * @param {Map<string,string>} made - author key -> user id, as the run resolved them
+ * @returns {Map<string,string>}
+ */
+export function creditMap(rows, made) {
+    const out = new Map();
+    for (const r of rows) {
+        const id = made.get(r.action === 'same' ? r.sameAs : r.key);
+        if (id && r.login) out.set(r.login, id);
+    }
+    return out;
+}

package/server/services/wpImport/plan.js

@@ -20,6 +20,8 @@
  * plugin's own post types (./custom.js) become a collection with a list page
  * at their old address (default), pages, or nothing; WordPress's plumbing is
  * listed with the reason it is not imported (summary.customTypes / internalTypes).
+ * The authors (./people.js) are matched to users here by email, or made into
+ * new accounts, or left out - plan.people.
  *
  * @module services/wpImport/plan
  */
@@ -28,6 +30,7 @@ import {hostOf} from './wxr.js';
 import {FETCH_PORTS, portOf} from './fetch.js';
 import {readWooProducts, shopProductInput, wooPageRole} from './woo.js';
 import {customFields, customOldPath, customTypesOf, mediaContext, rewriteSlugOf, typeLabel} from './custom.js';
+import {planPeople} from './people.js';
 
 /** Addresses under the Shop's that are its own pages, never a product's. */
 const SHOP_RESERVED = ['cart', 'checkout', 'basket', 'account', 'order'];
@@ -185,6 +188,7 @@ export function isoDate(gmt, local) {
  * @param {{available: boolean, reason?: string, basePath: string, currency: string, decimals: number, products: Map<string,{slug, hash}>, productSlugs: Set<string>}} [site.shop]
  * @param {Set<string>} [site.collections]   - every collection's slug
  * @param {Map<string,Map<string,string>>} [site.customEntries] - collection slug -> entry id -> fingerprint (collections an import made)
+ * @param {{id: string, email: string, name: string}[]} [site.users] - the users here (authors are matched by email)
  * @param {boolean} site.redirectsAvailable  - SEO is running (its redirects take the old addresses)
  * @param {Set<string>} site.redirectFroms   - addresses that already redirect
  * @param {object} [mapping] - what earlier runs of this import made ({items: {key: {...}}})
@@ -201,13 +205,17 @@ export function isoDate(gmt, local) {
  * @param {Object<string,false>} [options.listPages] - a custom type's list page left out
  * @param {Object<string,'skip'|'overwrite'|'import'>} [options.choices] - per item key
  * @param {Set<string>|null} [options.zipPaths] - uploads-relative paths in the uploaded zip
+ * @param {Object<string,'create'|'skip'>} [options.users] - per author key (./people.js)
+ * @param {string} [options.userRole] - the role for new accounts
+ * @param {boolean} [options.invite] - email new accounts a link to set their password
+ * @param {object} [options.people] - what the person running it may do with users (never from a request)
  * @returns {object}
  */
 export function planImport(wxr, site, mapping = {}, options = {}) {
     const opt = {
         posts: site.blog?.available ? 'blog' : 'pages',
         media: 'download', comments: true, menus: true, redirects: true, drafts: true, products: true, choices: {}, zipPaths: null,
-        types: {}, listPages: {},
+        types: {}, listPages: {}, users: {}, userRole: '', invite: false,
         ...options
     };
     opt.types ||= {};
@@ -621,6 +629,7 @@ export function planImport(wxr, site, mapping = {}, options = {}) {
 
     for (const r of items) if (r.builder) notes.push(`"${r.title}" was built with ${r.builder} - its layout will need rebuilding.`);
     const productRows = items.filter(r => r.kind === 'product');
+    const people = planPeople(wxr, items, site.users || [], mapping, opt, opt.people || {});
     const shortcodeCount = items.reduce((n, r) => n + (r.shortcodes?.length || 0), 0);
 
     const summary = {
@@ -631,6 +640,7 @@ export function planImport(wxr, site, mapping = {}, options = {}) {
         builders: items.filter(r => r.builder).length,
         customTypes,
         internalTypes,
+        people: people.counts,
         products: {
             total: wooProducts.length,
             types: productTypes,
@@ -646,13 +656,14 @@ export function planImport(wxr, site, mapping = {}, options = {}) {
     return {
         source: sourceKey(wxr.site),
         site: {title: wxr.site.title, url: wxr.site.baseSiteUrl || wxr.site.link, wxrVersion: wxr.site.wxrVersion, hosts: wxr.site.hosts},
-        options: {...opt, zipPaths: undefined, anyPort: undefined, choices},
+        options: {...opt, zipPaths: undefined, anyPort: undefined, people: undefined, inviteOrigin: undefined, invite: people.invite, choices},
         blogBase,
         shopBase,
         items,
         redirects: redirectPlan,
         query,
         mediaByRel,
+        people,
         notes: [...new Set(notes)],
         summary
     };

package/server/services/wpImport/wxr.js

@@ -3,7 +3,8 @@
  * runner work from. Reads the tree from ./xml.js; does no I/O.
  *
  *   {site: {title, link, baseSiteUrl, baseBlogUrl, wxrVersion, hosts[]},
- *    authors[], categories[], tags[], menus[],
+ *    authors: [{id, login, email, displayName, firstName, lastName}] (personal data - see ./people.js),
+ *    categories[], tags[], menus[],
  *    terms: [{taxonomy, id, slug, name, parent, description}]   - every other taxonomy's terms
  *           (WooCommerce's product_cat, product_tag, pa_* attribute values…),
  *    items: [{id, type, title, slug, status, parent, order, date, dateGmt, link, guid,
@@ -66,7 +67,9 @@ export function wxrFromTree(root) {
         id: int(textOf(a, 'wp:author_id')),
         login: textOf(a, 'wp:author_login'),
         email: textOf(a, 'wp:author_email'),
-        displayName: textOf(a, 'wp:author_display_name') || textOf(a, 'wp:author_login')
+        displayName: textOf(a, 'wp:author_display_name') || textOf(a, 'wp:author_login'),
+        firstName: textOf(a, 'wp:author_first_name'),
+        lastName: textOf(a, 'wp:author_last_name')
     }));
 
     const categories = children(channel, 'wp:category').map(c => ({