kempo 4.6.1 → 4.7.0

package/server/utils/menus/deleteMenu.js

@@ -0,0 +1,27 @@
+import { readStores, writeStores } from './store.js';
+import triggerHook from '../hooks/triggerHook.js';
+
+/*
+  Deletes a menu and all of its items. Where it was shown is left without a menu.
+*/
+export default async ({ rootDir, id, extensionDirs }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!id){
+    return [{ code: 400, msg: 'Menu ID is required' }, null];
+  }
+
+  const stores = await readStores(rootDir);
+  if(!stores.active.some(e => e.id === id && e.menuLocations !== null)){
+    return [{ code: 404, msg: 'Menu not found' }, null];
+  }
+
+  const removed = [...stores.active, ...stores.disabled].filter(e => e.menu === id).map(e => e.id);
+  stores.active = stores.active.filter(e => e.menu !== id);
+  stores.disabled = stores.disabled.filter(e => e.menu !== id);
+  await writeStores(rootDir, stores, extensionDirs);
+  for(const removedId of removed) await triggerHook('globalContent:deleted', { id: removedId });
+
+  return [null, { deleted: removed.length - 1 }];
+};

package/server/utils/menus/deleteMenuItems.js

@@ -0,0 +1,27 @@
+import { readStores, writeStores, isMenuItem } from './store.js';
+import triggerHook from '../hooks/triggerHook.js';
+
+export default async ({ rootDir, ids, extensionDirs }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!Array.isArray(ids) || !ids.length){
+    return [{ code: 400, msg: 'No IDs specified' }, null];
+  }
+
+  const stores = await readStores(rootDir);
+  const found = [...stores.active, ...stores.disabled].filter(e => ids.includes(e.id) && isMenuItem(e));
+  if(found.length !== new Set(ids).size){
+    return [{ code: 404, msg: 'Menu item not found' }, null];
+  }
+  if(found.some(e => e.locked)){
+    return [{ code: 403, msg: 'A locked item cannot be deleted' }, null];
+  }
+
+  stores.active = stores.active.filter(e => !ids.includes(e.id));
+  stores.disabled = stores.disabled.filter(e => !ids.includes(e.id));
+  await writeStores(rootDir, stores, extensionDirs);
+  for(const id of ids) await triggerHook('globalContent:deleted', { id });
+
+  return [null, { deleted: ids.length }];
+};

package/server/utils/menus/findMenuLocations.js

@@ -0,0 +1,41 @@
+import { readFile } from 'fs/promises';
+import scanDir from '../fs/scanDir.js';
+
+const LOCATION_TAG = /<location((?:[^>"']|"[^"]*"|'[^']*')*?)(?:\s*\/>|>[\s\S]*?<\/location>)/g;
+const SOURCE_FILE = /\.(template|fragment|page)\.html$/;
+
+/*
+  A location is a menu when the template, fragment or page that holds it says so:
+  `<location name="main-nav-links" label="Main menu" menu="true" />`. Looking in the site's own files
+  means the Menus page lists exactly the slots this site's theme has, and a theme with no menu slot
+  simply has no menus.
+*/
+export default async ({ rootDir }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+
+  const found = await scanDir(rootDir, rootDir, async (fullPath, entry) => {
+    if(entry.isDirectory() || !SOURCE_FILE.test(entry.name)) return null;
+    const content = await readFile(fullPath, 'utf-8');
+    const locations = [];
+    let match;
+    LOCATION_TAG.lastIndex = 0;
+    while((match = LOCATION_TAG.exec(content)) !== null){
+      const attr = name => {
+        const value = new RegExp(`(?:^|\\s)${name}=(?:"([^"]*)"|'([^']*)')`).exec(match[1]);
+        return value ? (value[1] ?? value[2]) : undefined;
+      };
+      if(attr('menu') !== 'true') continue;
+      locations.push({ location: attr('name') ?? 'default', label: attr('label') ?? '' });
+    }
+    return locations;
+  });
+
+  const byName = new Map();
+  for(const { location, label } of found){
+    if(!byName.has(location) || (!byName.get(location).label && label)) byName.set(location, { location, label: label || location });
+  }
+
+  return [null, [...byName.values()]];
+};

package/server/utils/menus/findNavItems.js

@@ -0,0 +1,74 @@
+import { readFile } from 'fs/promises';
+import { basename, dirname } from 'path';
+import scanDir from '../fs/scanDir.js';
+
+const WRAPPER = /^\s*(?:<!--[\s\S]*?-->\s*)*<menu-item((?:[^>"']|"[^"]*"|'[^']*')*)>([\s\S]*)<\/menu-item>\s*$/;
+const ATTRIBUTE = /(\w[\w-]*)=(?:"([^"]*)"|'([^']*)')/g;
+const ID = /^[\w-]+$/;
+
+/*
+  What kempo itself offers, so it is there on every site and needs no extension. The spacer takes up
+  the space left in a menu that is laid out in a row, which pushes the items after it to the far side.
+*/
+const BUILT_IN = [{
+  key: 'kempo:spacer',
+  extension: 'kempo',
+  id: 'spacer',
+  label: 'Spacer',
+  description: 'A flexible gap that pushes the items after it to the far side of the menu, such as the account link to the right. For a menu laid out in a row.',
+  icon: '',
+  markup: '<div class="flex"></div>'
+}];
+
+/*
+  The items enabled extensions offer for a site's menus. An extension ships a `*.menu-item.html` file
+  anywhere in its `public/` folder:
+
+    <menu-item id="cart" label="Cart" description="The shopping cart." icon-src="/commerce/icons/shopping_cart.svg">
+      <k-commerce-cart-button></k-commerce-cart-button>
+    </menu-item>
+
+  `icon` is the name of an icon in the shared sets; `icon-src` is the path to an icon file the extension ships
+  (`/commerce/icons/shopping_cart.svg`), and wins when both are given.
+
+  Kempo's own items (a spacer) come first, always.
+
+  Its content is what is rendered where an admin puts the item. It may include a <script> for the
+  element it uses. An item is named `<extension>:<id>`, which is what a menu stores. A file with no
+  <menu-item> wrapper, or without an id and a label, is skipped rather than breaking the others.
+
+  `extensionDirs` overrides where extensions are read from, as for the other menu functions; each is
+  an extension's public folder, so its package name is the folder above it.
+*/
+export default async ({ extensionDirs } = {}) => {
+  const dirs = extensionDirs ?? await (await import('../extensions/contentDirs.js')).extensionPublicDirs();
+  const items = BUILT_IN.map(item => ({ ...item }));
+
+  for(const dir of dirs){
+    const extension = basename(dirname(dir));
+    const files = await scanDir(dir, dir, async (fullPath, entry) =>
+      !entry.isDirectory() && entry.name.endsWith('.menu-item.html') ? fullPath : null);
+
+    for(const file of files.sort()){
+      const match = WRAPPER.exec(await readFile(file, 'utf-8'));
+      if(!match) continue;
+      const attrs = {};
+      let a;
+      ATTRIBUTE.lastIndex = 0;
+      while((a = ATTRIBUTE.exec(match[1])) !== null) attrs[a[1]] = a[2] ?? a[3];
+      if(!ID.test(attrs.id || '') || !String(attrs.label || '').trim()) continue;
+      items.push({
+        key: `${extension}:${attrs.id}`,
+        extension,
+        id: attrs.id,
+        label: attrs.label.trim(),
+        description: attrs.description || '',
+        icon: attrs.icon || '',
+        iconSrc: attrs['icon-src'] || '',
+        markup: match[2].trim()
+      });
+    }
+  }
+
+  return [null, items];
+};

package/server/utils/menus/findPages.js

@@ -0,0 +1,73 @@
+import { readFile } from 'fs/promises';
+import { join, relative } from 'path';
+import scanDir from '../fs/scanDir.js';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+import listPages from '../pages/listPages.js';
+import { normalizeScopes } from '../extensions/scopes.js';
+
+/*
+  The enabled extensions that serve pages, as [{ name, root, kempo }]. Read from disk each time, as the
+  router does, so what is listed is what is answering.
+*/
+const enabledExtensions = async () => {
+  const [{ getEnabledExtensions }, { default: readKempoConfig }] = await Promise.all([
+    import('../extensions/scopeCache.js'),
+    import('../extensions/readKempoConfig.js'),
+  ]);
+  const found = [];
+  for(const { name } of await getEnabledExtensions()){
+    const root = join(process.cwd(), 'node_modules', name);
+    try {
+      found.push({ name, root, kempo: (await readKempoConfig(root)).kempo });
+    } catch { /* not readable: nothing is served from it */ }
+  }
+  return found;
+};
+
+/* The pages an extension serves under one of its scopes, as /scope/path/. */
+const pagesOfScope = async (root, { scope, dir }) => {
+  const base = join(root, dir);
+  return scanDir(base, base, async (fullPath, entry) => {
+    if(entry.isDirectory() || !entry.name.endsWith('.page.html')) return null;
+    const path = relative(base, fullPath).replace(/\\/g, '/').replace(/\.page\.html$/, '').replace(/(^|\/)index$/, '$1');
+    if(path.includes('[')) return null;
+    const content = await readFile(fullPath, 'utf-8');
+    const meta = parseFrontmatter(content);
+    if(meta.hidden === 'true') return null;
+    return {
+      url: `/${scope}/${path}`.replace(/\/\/+/g, '/'),
+      title: meta.title || content.match(/<page\s[^>]*title="([^"]*)"/)?.[1] || '',
+    };
+  });
+};
+
+/*
+  Every page a link can go to: the site's own, then those its extensions serve under their scopes
+  (/products/, /categories/, /commerce/cart/). A page with a [param] in its address has no one address and
+  is left out, and so are hidden and disabled pages. The site wins when both have an address.
+
+  `extensions` replaces what is read from disk, as [{ name, root, kempo }], for tests.
+*/
+export default async ({ rootDir, extensions }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+
+  const [, site] = await listPages({ rootDir, showHidden: false });
+  const pages = (site?.pages ?? [])
+    .filter(page => !page.disabled && !page.url.includes('['))
+    .map(page => ({ url: page.url, title: page.title || page.name || page.url, owner: page.owner }));
+
+  const seen = new Set(pages.map(page => page.url));
+  for(const { name, root, kempo } of extensions ?? await enabledExtensions()){
+    for(const scope of normalizeScopes(kempo)[1]){
+      for(const page of (await pagesOfScope(root, scope)).sort((a, b) => a.url.localeCompare(b.url))){
+        if(seen.has(page.url)) continue;
+        seen.add(page.url);
+        pages.push({ url: page.url, title: page.title || page.url, owner: name });
+      }
+    }
+  }
+
+  return [null, pages];
+};

package/server/utils/menus/listMenus.js

@@ -0,0 +1,103 @@
+import { readFile } from 'fs/promises';
+import { basename, dirname } from 'path';
+import scanDir from '../fs/scanDir.js';
+import { parseEntries } from '../global-content/helpers.js';
+import findMenuLocations from './findMenuLocations.js';
+import findNavItems from './findNavItems.js';
+import findPages from './findPages.js';
+import { readStores, isMenuDefinition, isMenuItem } from './store.js';
+import { parseLink } from './markup.js';
+
+/*
+  What an extension adds to a location from its own public/*.global.html. It is shown so the person
+  editing the menus sees the whole of what a location will contain, but it cannot be changed here:
+  it belongs to the extension.
+*/
+const readExtensionEntries = async dirs => {
+  const found = [];
+  for(const dir of dirs){
+    const owner = basename(dirname(dir));
+    const files = await scanDir(dir, dir, async (fullPath, entry) =>
+      !entry.isDirectory() && entry.name.endsWith('.global.html') ? fullPath : null);
+    for(const file of files){
+      for(const entry of parseEntries(await readFile(file, 'utf-8'))) found.push({ ...entry, owner });
+    }
+  }
+  return found;
+};
+
+const toItem = (entry, disabled, available = new Map()) => {
+  const link = entry.navItem ? null : parseLink(entry.markup);
+  return {
+    id: entry.id,
+    label: link?.label ?? entry.name,
+    href: link?.href ?? '',
+    icon: link?.icon ?? '',
+    newTab: link?.newTab ?? false,
+    editable: link !== null,
+    navItem: entry.navItem,
+    available: entry.navItem ? available.has(entry.navItem) : true,
+    priority: entry.priority,
+    owner: entry.owner,
+    disabled
+  };
+};
+
+/*
+  The site's menus and the places in its theme that can show one.
+
+  A menu is `{ id, name, locations, items }`, its items in the order they render (highest priority
+  first). A location is `{ location, label, declared, menuId, extensionItems, candidates }`:
+  `menuId` is the menu shown there (or null), `extensionItems` what extensions put there themselves,
+  and `candidates` the plain links already placed there, which can be moved into a menu but are never
+  converted on their own. `declared` is false for a place the theme no longer has.
+
+  `pages` is every page a link can go to, the site's and those its extensions serve under their scopes
+  (see findPages.js), as { url, title, owner }.
+
+  `extensionDirs` overrides where extensions' content is read from, and `extensions` where their pages are.
+*/
+export default async ({ rootDir, extensionDirs, extensions }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+
+  const [, declared] = await findMenuLocations({ rootDir });
+  const { active, disabled } = await readStores(rootDir);
+  const dirs = extensionDirs ?? await (await import('../extensions/contentDirs.js')).extensionPublicDirs();
+  const fromExtensions = await readExtensionEntries(dirs);
+  const navItems = (await findNavItems({ extensionDirs: dirs }))[1];
+  const available = new Map(navItems.map(item => [item.key, item]));
+
+  const menus = active.filter(isMenuDefinition).map(definition => ({
+    id: definition.id,
+    name: definition.name,
+    locations: definition.menuLocations,
+    items: [
+      ...active.filter(e => isMenuItem(e) && e.menu === definition.id).map(e => toItem(e, false, available)),
+      ...disabled.filter(e => isMenuItem(e) && e.menu === definition.id).map(e => toItem(e, true, available))
+    ].sort((a, b) => b.priority - a.priority)
+  }));
+
+  const locations = declared.map(({ location, label }) => ({ location, label, declared: true }));
+  for(const menu of menus){
+    for(const location of menu.locations){
+      if(!locations.some(l => l.location === location)) locations.push({ location, label: location, declared: false });
+    }
+  }
+
+  for(const place of locations){
+    place.menuId = menus.find(m => m.locations.includes(place.location))?.id ?? null;
+    place.extensionItems = [
+      ...active.filter(e => !e.menu && e.owner !== 'custom' && e.location === place.location),
+      ...fromExtensions.filter(e => e.location === place.location)
+    ].map(e => toItem(e, false)).sort((a, b) => b.priority - a.priority);
+    place.candidates = active
+      .filter(e => !e.menu && e.owner === 'custom' && e.location === place.location && parseLink(e.markup))
+      .map(e => toItem(e, false));
+  }
+
+  const [, pages] = await findPages({ rootDir, extensions });
+
+  return [null, { menus, locations, navItems: navItems.map(({ markup, ...item }) => item), pages: pages ?? [] }];
+};

package/server/utils/menus/markup.js

@@ -0,0 +1,55 @@
+const escapeHtml = value => String(value)
+  .replace(/&/g, '&')
+  .replace(/</g, '&lt;')
+  .replace(/>/g, '&gt;')
+  .replace(/"/g, '&quot;');
+
+const unescapeHtml = value => String(value)
+  .replace(/&quot;/g, '"')
+  .replace(/&lt;/g, '<')
+  .replace(/&gt;/g, '>')
+  .replace(/&amp;/g, '&');
+
+const UNSAFE_HREF = /^\s*(javascript|data|vbscript):/i;
+const ICON_NAME = /^[\w-]+$/;
+
+/*
+  A menu item is stored as nothing more than one link, so the entry stays plain global content that
+  any template renders without knowing about menus. This reads that link back into its fields, and
+  returns null for markup that is anything more than a link with an optional icon.
+*/
+export const parseLink = markup => {
+  const match = /^<a\s((?:[^>"']|"[^"]*"|'[^']*')*)>([\s\S]*)<\/a>$/.exec(String(markup || '').trim());
+  if(!match || /<a[\s>]/.test(match[2])) return null;
+
+  const attrs = {};
+  const attrRegex = /(\w[\w-]*)=(?:"([^"]*)"|'([^']*)')/g;
+  let a;
+  while((a = attrRegex.exec(match[1])) !== null) attrs[a[1]] = a[2] ?? a[3];
+  if(attrs.href === undefined) return null;
+
+  const icon = /^\s*<k-icon\s+name="([\w-]+)"\s*><\/k-icon>/.exec(match[2]);
+  const rest = icon ? match[2].slice(icon[0].length) : match[2];
+  if(/</.test(rest)) return null;
+
+  return {
+    label: unescapeHtml(rest.trim()),
+    href: unescapeHtml(attrs.href),
+    icon: icon ? icon[1] : '',
+    newTab: attrs.target === '_blank'
+  };
+};
+
+/*
+  Returns [error, markup], with the same error shape as the rest of the server utils.
+*/
+export const buildLink = ({ label, href, icon, newTab }) => {
+  if(!String(label || '').trim()) return [{ code: 400, msg: 'Label is required' }, null];
+  if(!String(href || '').trim()) return [{ code: 400, msg: 'Link is required' }, null];
+  if(UNSAFE_HREF.test(href)) return [{ code: 400, msg: 'That link is not allowed' }, null];
+  if(icon && !ICON_NAME.test(icon)) return [{ code: 400, msg: 'Icon names use letters, numbers, dashes and underscores' }, null];
+
+  const target = newTab ? ' target="_blank" rel="noopener"' : '';
+  const iconMarkup = icon ? `<k-icon name="${icon}"></k-icon> ` : '';
+  return [null, `<a href="${escapeHtml(href.trim())}"${target}>${iconMarkup}${escapeHtml(label.trim())}</a>`];
+};

package/server/utils/menus/reorderMenuItems.js

@@ -0,0 +1,36 @@
+import { readStores, writeStores, isMenuItem } from './store.js';
+import triggerHook from '../hooks/triggerHook.js';
+
+/*
+  `ids` are a menu's items in the order they should now render. They take over the priorities those
+  same items already held, so the priorities stay in the range they were in. Priorities that were
+  equal are separated by one each, because equal ones have no order to keep.
+*/
+export default async ({ rootDir, menuId, ids, extensionDirs }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!menuId || !Array.isArray(ids) || !ids.length){
+    return [{ code: 400, msg: 'A menu and the item order are required' }, null];
+  }
+
+  const stores = await readStores(rootDir);
+  const items = ids.map(id => [...stores.active, ...stores.disabled].find(e => e.id === id && isMenuItem(e) && e.menu === menuId));
+  if(items.includes(undefined) || new Set(ids).size !== ids.length){
+    return [{ code: 404, msg: 'Menu item not found' }, null];
+  }
+
+  const slots = items.map(e => e.priority).sort((a, b) => b - a);
+  for(let i = 1; i < slots.length; i++) slots[i] = Math.min(slots[i], slots[i - 1] - 1);
+
+  const now = new Date().toISOString();
+  items.forEach((entry, i) => {
+    if(entry.priority === slots[i]) return;
+    entry.priority = slots[i];
+    entry.updatedAt = now;
+  });
+  await writeStores(rootDir, stores, extensionDirs);
+  await triggerHook('globalContent:updated', { id: ids[0], updatedAt: now });
+
+  return [null, { ids }];
+};

package/server/utils/menus/saveMenu.js

@@ -0,0 +1,54 @@
+import crypto from 'crypto';
+import { readStores, writeStores, menuHome, isMenuDefinition } from './store.js';
+import triggerHook from '../hooks/triggerHook.js';
+
+/*
+  Creates a menu, or renames one when `id` is given. A new menu is not shown anywhere until it is
+  assigned to a location.
+*/
+export default async ({ rootDir, id, name, author, extensionDirs }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!String(name || '').trim()){
+    return [{ code: 400, msg: 'Name is required' }, null];
+  }
+
+  const stores = await readStores(rootDir);
+  const now = new Date().toISOString();
+
+  if(id){
+    const definition = stores.active.find(e => e.id === id && isMenuDefinition(e));
+    if(!definition){
+      return [{ code: 404, msg: 'Menu not found' }, null];
+    }
+    definition.name = name.trim();
+    definition.updatedAt = now;
+    await writeStores(rootDir, stores, extensionDirs);
+    await triggerHook('globalContent:updated', { id, updatedAt: now });
+    return [null, { id }];
+  }
+
+  const menuId = crypto.randomUUID();
+  stores.active.push({
+    id: menuId,
+    name: name.trim(),
+    owner: 'custom',
+    author: author || '',
+    locked: false,
+    menu: menuId,
+    menuLocations: [],
+    menuCopyOf: '',
+    navItem: '',
+    extra: {},
+    location: menuHome(menuId),
+    priority: 0,
+    createdAt: now,
+    updatedAt: now,
+    markup: ''
+  });
+  await writeStores(rootDir, stores, extensionDirs);
+  await triggerHook('globalContent:created', { id: menuId, name: name.trim(), location: menuHome(menuId) });
+
+  return [null, { id: menuId }];
+};

package/server/utils/menus/saveMenuItem.js

@@ -0,0 +1,122 @@
+import crypto from 'crypto';
+import { buildLink } from './markup.js';
+import { readStores, writeStores, menuHome, isMenuItem, isMenuDefinition } from './store.js';
+import findMenuLocations from './findMenuLocations.js';
+import findNavItems from './findNavItems.js';
+import triggerHook from '../hooks/triggerHook.js';
+
+/*
+  Adds an item to a menu, or changes one when `id` is given. A new item goes to the end of the menu: its
+  priority is one below the lowest in that menu (items render highest first).
+
+  An item is a link (`label`, `href`, ...) or one an extension supplies, named by `navItem`
+  (`<extension>:<id>`, from findNavItems), which takes its label and markup from the extension.
+
+  A new item can name the `menuId` to join, or just the `location` it should show in. For a location,
+  it joins the menu shown there; when there is none, one is made, named after the location, and shown
+  there. That is what lets an item be added to "Main menu" without making a menu first.
+*/
+export default async ({ rootDir, id, menuId, location, navItem, label, href, icon, newTab, author, extensionDirs }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+
+  let name;
+  let markup;
+  if(navItem){
+    const supplied = (await findNavItems({ extensionDirs }))[1].find(item => item.key === navItem);
+    if(!supplied){
+      return [{ code: 404, msg: 'That item is not available. Its extension may be disabled or removed.' }, null];
+    }
+    name = supplied.label;
+    markup = supplied.markup;
+  } else {
+    const [linkError, linkMarkup] = buildLink({ label, href, icon, newTab });
+    if(linkError){
+      return [linkError, null];
+    }
+    name = label.trim();
+    markup = linkMarkup;
+  }
+
+  const stores = await readStores(rootDir);
+  const now = new Date().toISOString();
+
+  if(id){
+    const entry = [...stores.active, ...stores.disabled].find(e => e.id === id && isMenuItem(e));
+    if(!entry){
+      return [{ code: 404, msg: 'Menu item not found' }, null];
+    }
+    if(entry.navItem){
+      return [{ code: 400, msg: 'An item from an extension cannot be edited. Delete it and add it again to change it.' }, null];
+    }
+    if(entry.locked){
+      return [{ code: 403, msg: 'This item is locked and cannot be edited' }, null];
+    }
+    entry.name = name;
+    entry.markup = markup;
+    entry.updatedAt = now;
+    await writeStores(rootDir, stores, extensionDirs);
+    await triggerHook('globalContent:updated', { id, updatedAt: now });
+    return [null, { id, updatedAt: now }];
+  }
+
+  let target = menuId
+    ? stores.active.find(e => e.id === menuId && isMenuDefinition(e))
+    : stores.active.find(e => isMenuDefinition(e) && e.menuLocations.includes(location));
+
+  if(!target && !menuId && location){
+    const [, declared] = await findMenuLocations({ rootDir });
+    const place = declared.find(l => l.location === location);
+    if(!place){
+      return [{ code: 400, msg: 'That place is not a menu in the theme' }, null];
+    }
+    const newId = crypto.randomUUID();
+    target = {
+      id: newId,
+      name: place.label,
+      owner: 'custom',
+      author: author || '',
+      locked: false,
+      menu: newId,
+      menuLocations: [location],
+      menuCopyOf: '',
+      navItem: '',
+      extra: {},
+      location: menuHome(newId),
+      priority: 0,
+      createdAt: now,
+      updatedAt: now,
+      markup: ''
+    };
+    stores.active.push(target);
+  }
+
+  if(!target){
+    return [{ code: 404, msg: 'Menu not found' }, null];
+  }
+
+  const siblings = [...stores.active, ...stores.disabled].filter(e => isMenuItem(e) && e.menu === target.id);
+  const entry = {
+    id: crypto.randomUUID(),
+    name,
+    owner: 'custom',
+    author: author || '',
+    locked: false,
+    menu: target.id,
+    menuLocations: null,
+    menuCopyOf: '',
+    navItem: navItem || '',
+    extra: {},
+    location: menuHome(target.id),
+    priority: siblings.length ? Math.min(...siblings.map(e => e.priority)) - 1 : 100,
+    createdAt: now,
+    updatedAt: now,
+    markup
+  };
+  stores.active.push(entry);
+  await writeStores(rootDir, stores, extensionDirs);
+  await triggerHook('globalContent:created', { id: entry.id, name: entry.name, location: entry.location });
+
+  return [null, { id: entry.id, menuId: target.id, priority: entry.priority }];
+};

package/server/utils/menus/setMenuItemEnabled.js

@@ -0,0 +1,31 @@
+import { readStores, writeStores, isMenuItem } from './store.js';
+import triggerHook from '../hooks/triggerHook.js';
+
+/*
+  Hides an item from its menu without deleting it, or shows it again.
+*/
+export default async ({ rootDir, id, enabled, extensionDirs }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!id || typeof enabled !== 'boolean'){
+    return [{ code: 400, msg: 'An item and whether it is enabled are required' }, null];
+  }
+
+  const stores = await readStores(rootDir);
+  const [from, to] = enabled ? [stores.disabled, stores.active] : [stores.active, stores.disabled];
+  const index = from.findIndex(e => e.id === id && isMenuItem(e));
+  if(index === -1){
+    const already = to.some(e => e.id === id && isMenuItem(e));
+    return already ? [null, { id, enabled }] : [{ code: 404, msg: 'Menu item not found' }, null];
+  }
+  if(from[index].locked){
+    return [{ code: 403, msg: 'A locked item cannot be hidden' }, null];
+  }
+
+  to.push(...from.splice(index, 1));
+  await writeStores(rootDir, stores, extensionDirs);
+  await triggerHook('globalContent:updated', { id, updatedAt: new Date().toISOString() });
+
+  return [null, { id, enabled }];
+};