domma-cms 1.8.9 → 1.8.10

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [1.8.10] - 2026-10-16
+
+- Domma Docs pages now show signed-in visitors their own menus. They were always drawn as for an anonymous visitor and cached as one copy for everybody; they now recognise who is looking, like every other page, and keep one cached copy per set of roles, so a menu item meant for admins is never shown to the public.
+
 ## [1.8.9] - 2026-10-16
 
 - **Import from WordPress brings the widgets across.** A WordPress export has no widgets in it, so the import screen now takes a second, optional file: the `.wie` file the free "Widget Importer & Exporter" WordPress plugin exports (or put it in the same zip as the export). Each widget area becomes a block named wp-… (Content › Blocks), its widgets in order under their titles. Text and custom HTML come across cleaned - no scripts, WordPress shortcodes left as text to rebuild - with links and pictures pointing at their new addresses; an image widget brings its picture with the media; a navigation menu shows the menu imported from it; recent posts and categories show the Blog's own lists, and archives a link to the Blog; a search widget becomes a link that opens the site search. Anything else (a calendar, an RSS feed, a plugin's widget) is listed to rebuild - nothing is guessed. A footer widget area is also added to the footer of every page, after whatever is there, unless you switch that off in the preview's new Widgets card; other areas are blocks you can put on a page with `[block]`. Run it again and a block you edited here is left alone unless you choose Overwrite, nothing is added to the footer twice, and an area you took out of the footer is not put back.

package/docs/cache.md

@@ -37,6 +37,8 @@ page:<urlPath>:m<fileMtime>:role<roles>:o<origin>
 
 For example: `page:/about:m1727430000000:roleanon:ohttps://example.com`.
 
+Domma Docs pages (`/domma-docs/...`) are cached the same way under `docs:<path>:role<roles>:o<origin>`, because their navbar, footers and overlays filter by role too. Both keys build the role part with `viewerRoleKey()` in `server/services/userRoles.js` - use it for any new cached render whose output depends on the viewer, and never key on the user id.
+
 Admin API responses, login pages and error pages are not cached. Drafts (including draft previews) are never cached, and a page containing a row-level `[view]` is rendered fresh for each signed-in viewer.
 
 Cache keys are versioned with a `v1:` prefix. Bumping the version (in `server/services/cache/index.js`) auto-invalidates the entire cache without needing `clear()` - useful if the cached value shape ever changes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.8.9",
+  "version": "1.8.10",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/routes/docs-public.js

@@ -17,7 +17,8 @@
  */
 import {isProjectEnabled} from '../services/projects.js';
 import {renderDocPage} from '../services/docs.js';
-import {getBaseUrl, render404} from './public.js';
+import {getBaseUrl, render404, sendHtml} from './public.js';
+import {resolveViewer} from '../services/viewerSession.js';
 
 const DOCS_PROJECT_SLUG = 'domma-docs';
 
@@ -30,12 +31,17 @@ export async function docsPublicRoutes(fastify) {
         }
 
         const docPath = String(request.params['*'] || '');
-        const html = await renderDocPage(docPath, {user: null, baseUrl: getBaseUrl(request)});
+        // Resolved like any public page: the navbar, footers and overlays in
+        // the docs shell filter by role, and renderDocPage keys its cache on
+        // the viewer's role set, so anonymous traffic still shares one entry.
+        const user = await resolveViewer(request);
+        const html = await renderDocPage(docPath, {user, baseUrl: getBaseUrl(request)});
         if (html == null) {
             reply.status(404);
             return reply.type('text/html; charset=utf-8').send(await render404(`/domma-docs${docPath ? '/' + docPath : ''}`));
         }
-        return reply.type('text/html; charset=utf-8').send(html);
+        // private + ETag: the response is role-dependent, so no shared proxy may reuse it.
+        return sendHtml(request, reply, html);
     };
 
     fastify.get('/domma-docs', handle);    // exact - params['*'] === '' (home landing)

package/server/routes/public.js

@@ -14,7 +14,7 @@ import {buildRobotsTxt, generate as generateSitemap} from '../services/sitemap.j
 import {resolveViewer} from '../services/viewerSession.js';
 import {validSessionCookie, newSessionCookie} from '../services/shortcodeExpiry.js';
 import {touchPreviewLink, verifyPreviewToken} from '../services/previewLinks.js';
-import {getEffectiveRoles} from '../services/userRoles.js';
+import {viewerRoleKey} from '../services/userRoles.js';
 import {hooks} from '../services/hooks.js';
 import {getConfig} from '../config.js';
 import * as cache from '../services/cache/index.js';
@@ -73,7 +73,7 @@ function escapeHtml(str) {
  * keys on role for exactly that reason - and a shared proxy must never hand one
  * visitor a page rendered for another's permissions.
  */
-function sendHtml(request, reply, html) {
+export function sendHtml(request, reply, html) {
     const etag = `"${createHash('sha1').update(html).digest('base64')}"`;
     reply.header('cache-control', 'private, no-cache');
     reply.header('etag', etag);
@@ -196,7 +196,6 @@ export async function publicRoutes(fastify) {
         // what renders. Real sites hold a handful of role combinations, so
         // the entry count stays bounded by what users actually have.
         const userObj  = await resolveViewer(request);
-        const userRole = userObj ? [...getEffectiveRoles(userObj)].sort().join('+') : null;
 
         // The access decision - the directory-index fallback, the project
         // kill-switch, drafts and visibility - is resolvePublishedPage(), shared
@@ -274,7 +273,7 @@ export async function publicRoutes(fastify) {
         // script, git pull - yields a fresh entry even if no invalidation
         // hook fired. Stale-mtime entries age out via TTL/LRU.
         const pageMtime = await getPageMtime(page.urlPath || urlPath);
-        const cacheKey = `page:${urlPath}:m${pageMtime}:role${userRole ?? 'anon'}:o${baseUrl}`;
+        const cacheKey = `page:${urlPath}:m${pageMtime}:role${viewerRoleKey(userObj)}:o${baseUrl}`;
         // The footer's blocks (site.json footer.blocks) are on every page: editing one must reach the cached pages.
         const cacheTags = [`page:${urlPath}`, ...(page.cacheTags || []), 'nav', 'site', ...footerBlockCacheTags(getConfig('site'))];
         const html = await cache.wrap(cacheKey, render, {tags: cacheTags});

package/server/services/docs.js

@@ -25,6 +25,7 @@ import {parseMarkdown} from './markdown.js';
 import {footerBlockCacheTags, renderPage} from './renderer.js';
 import {getConfig} from '../config.js';
 import * as cache from './cache/index.js';
+import {viewerRoleKey} from './userRoles.js';
 
 // import.meta.url-relative (NOT cwd-relative): the templates live beside the
 // engine's admin dir in both the npm-package layout and each child site's
@@ -321,8 +322,11 @@ async function buildDocBody(docPath) {
 
 /**
  * Render a Domma Docs page to full HTML, or return null for an unknown path
- * (the route turns that into a 404). Cached per path+origin under the static
- * 'docs' tag - invalidated on boot so a version bump never serves stale HTML.
+ * (the route turns that into a 404). Cached per path + viewer role set + origin
+ * under the 'docs' tag. Nothing flushes that tag; a version bump never serves
+ * stale HTML only because the in-memory cache starts empty on every restart.
+ * The role set is in the key because the shell's menus and footer blocks
+ * filter by role, exactly as a normal page's do.
  *
  * @param {string} docPath  url tail after /domma-docs (e.g. 'usage/pages', '' for home)
  * @param {{user?: object|null, baseUrl?: string}} [opts]
@@ -335,7 +339,7 @@ export async function renderDocPage(docPath, opts = {}) {
 
     const {user = null, baseUrl} = opts;
     return cache.wrap(
-        `docs:${path}:o${baseUrl || ''}`,
+        `docs:${path}:role${viewerRoleKey(user)}:o${baseUrl || ''}`,
         async () => {
             const parsed = await parseMarkdown(built.body, {user});
             const css = [DOCS_BODY_CSS, ...built.styles].filter(Boolean).join('\n\n');

package/server/services/userRoles.js

@@ -39,6 +39,21 @@ export function getEffectiveRoles(user) {
     return out;
 }
 
+/**
+ * The viewer's role set as it appears in a response-cache key: every role the
+ * user holds (primary plus additional), sorted and joined with `+`, or `anon`
+ * for no viewer. Every cached render whose output depends on the viewer (menu
+ * visibility, role-gated shortcodes) keys on this, so two viewers share an
+ * entry exactly when they hold the same roles - never per user.
+ *
+ * @param {object|null} user
+ * @returns {string} e.g. 'anon', 'admin', 'blog-editor+user'
+ */
+export function viewerRoleKey(user) {
+    const roles = getEffectiveRoles(user);
+    return roles.length ? [...roles].sort().join('+') : 'anon';
+}
+
 /**
  * Return the effective role level for a user - the LOWEST level number
  * across all roles. Lower number = higher privilege, so the user's most