wiki-plugin-gatekeeper 0.0.0-stage → 0.2.0

package/api/openapi.json

@@ -0,0 +1,216 @@
+{
+  "openapi": "3.1.0",
+  "info": {
+    "title": "Gatekeeper",
+    "version": "0.1.0",
+    "description": "Who may read which site of this farm. Almost all of it changes farm configuration and is admin-only, which is why it keeps its own server: every route but the first reads the caller\u2019s identity, and one of them exits the process for a supervisor to restart. None of that survives a handler that never sees the request."
+  },
+  "paths": {
+    "/plugin/gatekeeper/ping.json": {
+      "get": {
+        "x-fedwiki-served-by": "plugin",
+        "x-fedwiki-read-only": true,
+        "operationId": "ping",
+        "summary": "Is the gatekeeper here",
+        "description": "The one route open to everybody, and the only one whose answer is not about configuration. A client uses it to find out whether restriction is available at all.",
+        "responses": {
+          "200": {
+            "description": "Present, and its version."
+          }
+        }
+      }
+    },
+    "/plugin/gatekeeper/status.json": {
+      "get": {
+        "x-fedwiki-served-by": "plugin",
+        "x-fedwiki-read-only": true,
+        "operationId": "status",
+        "summary": "How each site is restricted",
+        "description": "The current restriction settings for the farm. Admin only.",
+        "responses": {
+          "200": {
+            "description": "Per-site restriction settings."
+          },
+          "403": {
+            "description": "Not an admin."
+          }
+        }
+      }
+    },
+    "/plugin/gatekeeper/toggle": {
+      "post": {
+        "x-fedwiki-served-by": "plugin",
+        "x-fedwiki-writes": true,
+        "x-fedwiki-private-only": true,
+        "operationId": "toggle",
+        "summary": "Restrict a site, or stop restricting it",
+        "description": "Turns login-to-view on or off for one site, and writes the farm config. Admin only.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "host"
+                ],
+                "properties": {
+                  "host": {
+                    "type": "string",
+                    "description": "The site being configured."
+                  },
+                  "restricted": {
+                    "type": "boolean"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Written."
+          },
+          "403": {
+            "description": "Not an admin."
+          }
+        }
+      }
+    },
+    "/plugin/gatekeeper/allowed": {
+      "post": {
+        "x-fedwiki-served-by": "plugin",
+        "x-fedwiki-writes": true,
+        "x-fedwiki-private-only": true,
+        "operationId": "allowed",
+        "summary": "Who may read a restricted site",
+        "description": "Sets the allowed identities and domains for a site, and the splash page shown to everyone else. Admin only.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "host"
+                ],
+                "properties": {
+                  "host": {
+                    "type": "string",
+                    "description": "The site being configured."
+                  },
+                  "allowed_ids": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "allowed_domains": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "splash_page": {
+                    "type": "string"
+                  },
+                  "details": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Written."
+          },
+          "403": {
+            "description": "Not an admin."
+          }
+        }
+      }
+    },
+    "/plugin/gatekeeper/site": {
+      "post": {
+        "x-fedwiki-served-by": "plugin",
+        "x-fedwiki-writes": true,
+        "x-fedwiki-private-only": true,
+        "operationId": "site",
+        "summary": "Add or remove a site",
+        "description": "Creates or drops a site entry in the farm configuration. Admin only.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "host",
+                  "action"
+                ],
+                "properties": {
+                  "host": {
+                    "type": "string",
+                    "description": "The site being configured."
+                  },
+                  "action": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Written."
+          },
+          "403": {
+            "description": "Not an admin."
+          }
+        }
+      }
+    },
+    "/plugin/gatekeeper/restart": {
+      "post": {
+        "x-fedwiki-served-by": "plugin",
+        "x-fedwiki-writes": true,
+        "x-fedwiki-private-only": true,
+        "operationId": "restart",
+        "summary": "Restart the wiki",
+        "description": "Exits the process so a supervisor restarts it, which is how configuration changes take effect. Refused unless the server is actually supervised, because otherwise it would stop the wiki and nothing would bring it back. The single clearest example of a route that can never be a farm-mounted operation.",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "force": {
+                    "type": "boolean",
+                    "description": "Exit even when no supervisor is detected."
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Exiting."
+          },
+          "403": {
+            "description": "Not an admin."
+          },
+          "409": {
+            "description": "Not supervised, and force was not set."
+          }
+        }
+      }
+    }
+  },
+  "components": {
+    "schemas": {}
+  }
+}

package/client/gatekeeper.js

@@ -0,0 +1,42 @@
+(()=>{var l=(o,p)=>fetch(`/plugin/gatekeeper/${o}`,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify(p||{})}),c=o=>String(o).replace(/[&<>"]/g,p=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;"})[p]),k=`
+  .gatekeeper { font-size: 90%; }
+  .gatekeeper table { width: 100%; border-collapse: collapse; }
+  .gatekeeper th, .gatekeeper td { text-align: left; padding: 3px 6px; border-bottom: 1px solid #eee; }
+  .gatekeeper .pending { background: #f5a623; color: #fff; border-radius: 8px; padding: 0 7px; font-size: 85%; }
+  .gatekeeper .warning { color: #c0392b; font-size: 85%; }
+  .gatekeeper .ids, .gatekeeper .pub, .gatekeeper .terms { cursor: pointer; border-bottom: 1px dotted #999; }
+  .gatekeeper .terms { font-size: 85%; color: #888; }
+  .gatekeeper .remove { cursor: pointer; color: #c0392b; border: 0; background: none; }
+  .gatekeeper .bar { display: flex; gap: 6px; margin-top: 8px; align-items: center; flex-wrap: wrap; }
+  .gatekeeper input[type=text] { flex: 1; min-width: 10em; padding: 2px 6px; }
+  .gatekeeper button { padding: 2px 10px; }
+  .gatekeeper .status { margin-top: 6px; font-size: 85%; color: #666; min-height: 1.2em; }
+  .gatekeeper .status.err { color: #c0392b; }
+  .gatekeeper .status.ok { color: #27ae60; }
+`,b=(o,p)=>{o.html(`<style>${k}</style><div class="gatekeeper"><p>Gatekeeper \u2014 loading\u2026</p></div>`)},w=(o,p)=>{let g=()=>o.find(".gatekeeper"),n=(e,t)=>g().find(".status").attr("class",`status ${t||""}`).text(e),f=e=>{let t=(e.sites||[]).map(s=>{if(s.removed)return`<tr><td>${c(s.host)}</td><td colspan="4"><em>removed from config</em></td>
+            <td><span class="pending">pending restart</span></td><td></td></tr>`;let i=(s.public_pages||[]).join(", "),a=s.require_terms||"";return`<tr data-host="${c(s.host)}">
+          <td>${c(s.host)}</td>
+          <td><input type="checkbox" class="restricted" ${s.restricted?"checked":""}></td>
+          <td><span class="ids" title="click to edit allowed ids">${c((s.allowed_ids||[]).join(" ")||"\u2014")}</span></td>
+          <td><span class="pub" title="click to edit the public (blessed) pages">${c(i||"\u2014")}</span>
+            <div><span class="terms" title="click to set the must-read-before-login page">terms: ${c(a||"\u2014")}</span></div></td>
+          <td>${s.warnings.map(h=>`<div class="warning">\u26A0 ${c(h)}</div>`).join("")}</td>
+          <td>${s.pending?'<span class="pending">pending restart</span>':""}</td>
+          <td><button class="remove" title="remove site from config">\xD7</button></td>
+        </tr>`}).join(""),r=e.configEditedSinceBoot||(e.sites||[]).some(s=>s.pending);g().html(`
+      <table>
+        <tr><th>site</th><th>login-to-view</th><th>allowed ids</th><th>public pages</th><th></th><th></th><th></th></tr>
+        ${t||'<tr><td colspan="7"><em>no wikiDomains entries in the config yet</em></td></tr>'}
+      </table>
+      <div class="bar">
+        <input type="text" class="new-host" placeholder="add a site, e.g. private.example.com">
+        <button class="add">add</button>
+        ${r?'<button class="restart">restart farm</button>':""}
+      </div>
+      <div class="status"></div>
+    `),r&&n(e.supervised?`Config changed since the farm started \u2014 restart to apply (${c(e.supervisor||"supervised")} will bring it back).`:"Config changed \u2014 no supervisor detected; restart with wiki-start --restart (button will offer force).")},d=()=>fetch("/plugin/gatekeeper/status.json",{credentials:"include",cache:"no-store"}).then(e=>{if(e.status===403)throw Object.assign(new Error("admin"),{admin:!0});return e.json()}).then(e=>{if(e.error&&e.readOnly){g().html(`<p><em>${c(e.error)}</em></p>`);return}m=e.processStarted,f(e)}).catch(e=>{e.admin?g().html("<p><em>Gatekeeper needs an admin login \u2014 log in with the site secret first.</em></p>"):g().html(`<p><em>gatekeeper unreachable: ${c(e.message)}</em></p>`)}),m=null,u=()=>{let e=Date.now();n("restarting\u2026");let t=()=>{if(Date.now()-e>12e4){n("server did not come back within 2 minutes \u2014 check the supervisor.","err");return}fetch("/plugin/gatekeeper/ping.json",{cache:"no-store"}).then(r=>r.json()).then(r=>{r.started&&r.started!==m?(n("back up \u2713","ok"),setTimeout(d,800)):setTimeout(t,2e3)}).catch(()=>setTimeout(t,2e3))};setTimeout(t,2e3)};o.on("change",".restricted",e=>{let t=e.target.closest("tr").dataset.host;l("toggle",{host:t,restricted:e.target.checked}).then(r=>r.ok?d():r.json().then(s=>n(s.error,"err"))).catch(r=>n(r.message,"err"))}),o.on("click",".ids",e=>{let t=e.target.closest("tr").dataset.host,r=e.target.textContent==="\u2014"?"":e.target.textContent,s=prompt(`Allowed ids for ${t} \u2014 space-separated ("*" = any logged-in user, empty = clear):`,r);if(s==null)return;let i=s.trim()?s.trim().split(/[\s]+/):[];l("allowed",{host:t,allowed_ids:i}).then(a=>a.ok?d():a.json().then(h=>n(h.error,"err"))).catch(a=>n(a.message,"err"))}),o.on("click",".pub",e=>{let t=e.target.closest("tr").dataset.host,r=e.target.textContent==="\u2014"?"":e.target.textContent,s=prompt(`Public (blessed) pages for ${t} \u2014 comma-separated page names a logged-out visitor may read (empty = splash only):`,r);if(s==null)return;let i=s.trim()?s.split(",").map(a=>a.trim()).filter(Boolean):[];l("allowed",{host:t,public_pages:i}).then(a=>a.ok?d():a.json().then(h=>n(h.error,"err"))).catch(a=>n(a.message,"err"))}),o.on("click",".terms",e=>{let t=e.target.closest("tr").dataset.host,r=e.target.textContent.replace(/^terms:\s*/,""),s=prompt(`Must-read-before-login page for ${t} \u2014 a page name, "true" for site-terms, empty to clear:`,r==="\u2014"?"":r);s!=null&&l("allowed",{host:t,require_terms:s.trim()}).then(i=>i.ok?d():i.json().then(a=>n(a.error,"err"))).catch(i=>n(i.message,"err"))}),o.on("click",".remove",e=>{let t=e.target.closest("tr").dataset.host;confirm(`Remove ${t} from the farm config's wikiDomains? (site data is untouched)`)&&l("site",{host:t,action:"remove"}).then(r=>r.ok?d():r.json().then(s=>n(s.error,"err"))).catch(r=>n(r.message,"err"))}),o.on("click",".add",()=>{let e=(o.find(".new-host").val()||"").trim().toLowerCase();e&&l("site",{host:e,action:"add"}).then(t=>t.ok?d():t.json().then(r=>n(r.error,"err"))).catch(t=>n(t.message,"err"))}),o.on("click",".restart",()=>{o.find("button, input").attr("disabled","disabled"),l("restart").then(e=>e.ok?u():e.status===409?e.json().then(t=>{confirm(`${t.error}
+
+${t.hint}
+
+Force the exit anyway?`)?l("restart",{force:!0}).then(r=>r.ok?u():n("restart refused","err")):(o.find("button, input").removeAttr("disabled"),n("restart cancelled \u2014 use wiki-start --restart from a shell.","err"))}):e.json().then(t=>n(t.error||"restart failed","err")))}),d()};typeof window<"u"&&(window.plugins=window.plugins||{},window.plugins.gatekeeper={emit:b,bind:w});})();
+//# sourceMappingURL=gatekeeper.js.map

package/client/gatekeeper.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/client/gatekeeper.js"],
+  "sourcesContent": ["// Gatekeeper item \u2014 farm login-to-view control panel.\n// Talks to /plugin/gatekeeper/* on the origin serving the page. All writes\n// are admin-gated server-side; non-admins get a read-only notice.\n\nconst post = (endpoint, body) =>\n  fetch(`/plugin/gatekeeper/${endpoint}`, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    credentials: 'include',\n    body: JSON.stringify(body || {}),\n  })\n\nconst esc = s =>\n  String(s).replace(/[&<>\"]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '\"': '&quot;' }[c]))\n\nconst styles = `\n  .gatekeeper { font-size: 90%; }\n  .gatekeeper table { width: 100%; border-collapse: collapse; }\n  .gatekeeper th, .gatekeeper td { text-align: left; padding: 3px 6px; border-bottom: 1px solid #eee; }\n  .gatekeeper .pending { background: #f5a623; color: #fff; border-radius: 8px; padding: 0 7px; font-size: 85%; }\n  .gatekeeper .warning { color: #c0392b; font-size: 85%; }\n  .gatekeeper .ids, .gatekeeper .pub, .gatekeeper .terms { cursor: pointer; border-bottom: 1px dotted #999; }\n  .gatekeeper .terms { font-size: 85%; color: #888; }\n  .gatekeeper .remove { cursor: pointer; color: #c0392b; border: 0; background: none; }\n  .gatekeeper .bar { display: flex; gap: 6px; margin-top: 8px; align-items: center; flex-wrap: wrap; }\n  .gatekeeper input[type=text] { flex: 1; min-width: 10em; padding: 2px 6px; }\n  .gatekeeper button { padding: 2px 10px; }\n  .gatekeeper .status { margin-top: 6px; font-size: 85%; color: #666; min-height: 1.2em; }\n  .gatekeeper .status.err { color: #c0392b; }\n  .gatekeeper .status.ok { color: #27ae60; }\n`\n\nconst emit = (div, item) => {\n  div.html(`<style>${styles}</style><div class=\"gatekeeper\"><p>Gatekeeper \u2014 loading\u2026</p></div>`)\n}\n\nconst bind = (div, item) => {\n  const root = () => div.find('.gatekeeper')\n  const say = (msg, cls) => root().find('.status').attr('class', `status ${cls || ''}`).text(msg)\n\n  const render = data => {\n    const rows = (data.sites || [])\n      .map(site => {\n        if (site.removed)\n          return `<tr><td>${esc(site.host)}</td><td colspan=\"4\"><em>removed from config</em></td>\n            <td><span class=\"pending\">pending restart</span></td><td></td></tr>`\n        const pub = (site.public_pages || []).join(', ')\n        const terms = site.require_terms || ''\n        return `<tr data-host=\"${esc(site.host)}\">\n          <td>${esc(site.host)}</td>\n          <td><input type=\"checkbox\" class=\"restricted\" ${site.restricted ? 'checked' : ''}></td>\n          <td><span class=\"ids\" title=\"click to edit allowed ids\">${esc((site.allowed_ids || []).join(' ') || '\u2014')}</span></td>\n          <td><span class=\"pub\" title=\"click to edit the public (blessed) pages\">${esc(pub || '\u2014')}</span>\n            <div><span class=\"terms\" title=\"click to set the must-read-before-login page\">terms: ${esc(terms || '\u2014')}</span></div></td>\n          <td>${site.warnings.map(w => `<div class=\"warning\">\u26A0 ${esc(w)}</div>`).join('')}</td>\n          <td>${site.pending ? '<span class=\"pending\">pending restart</span>' : ''}</td>\n          <td><button class=\"remove\" title=\"remove site from config\">\u00D7</button></td>\n        </tr>`\n      })\n      .join('')\n    const anyPending =\n      data.configEditedSinceBoot || (data.sites || []).some(site => site.pending)\n    root().html(`\n      <table>\n        <tr><th>site</th><th>login-to-view</th><th>allowed ids</th><th>public pages</th><th></th><th></th><th></th></tr>\n        ${rows || '<tr><td colspan=\"7\"><em>no wikiDomains entries in the config yet</em></td></tr>'}\n      </table>\n      <div class=\"bar\">\n        <input type=\"text\" class=\"new-host\" placeholder=\"add a site, e.g. private.example.com\">\n        <button class=\"add\">add</button>\n        ${anyPending ? '<button class=\"restart\">restart farm</button>' : ''}\n      </div>\n      <div class=\"status\"></div>\n    `)\n    if (anyPending)\n      say(\n        data.supervised\n          ? `Config changed since the farm started \u2014 restart to apply (${esc(data.supervisor || 'supervised')} will bring it back).`\n          : 'Config changed \u2014 no supervisor detected; restart with wiki-start --restart (button will offer force).'\n      )\n  }\n\n  const refresh = () =>\n    fetch('/plugin/gatekeeper/status.json', { credentials: 'include', cache: 'no-store' })\n      .then(r => {\n        if (r.status === 403) throw Object.assign(new Error('admin'), { admin: true })\n        return r.json()\n      })\n      .then(data => {\n        if (data.error && data.readOnly) {\n          root().html(`<p><em>${esc(data.error)}</em></p>`)\n          return\n        }\n        lastStarted = data.processStarted\n        render(data)\n      })\n      .catch(e => {\n        if (e.admin)\n          root().html('<p><em>Gatekeeper needs an admin login \u2014 log in with the site secret first.</em></p>')\n        else root().html(`<p><em>gatekeeper unreachable: ${esc(e.message)}</em></p>`)\n      })\n\n  let lastStarted = null\n\n  const pollUntilBack = () => {\n    const began = Date.now()\n    say('restarting\u2026')\n    const tick = () => {\n      if (Date.now() - began > 120000) {\n        say('server did not come back within 2 minutes \u2014 check the supervisor.', 'err')\n        return\n      }\n      fetch('/plugin/gatekeeper/ping.json', { cache: 'no-store' })\n        .then(r => r.json())\n        .then(pong => {\n          if (pong.started && pong.started !== lastStarted) {\n            say('back up \u2713', 'ok')\n            setTimeout(refresh, 800)\n          } else setTimeout(tick, 2000)\n        })\n        .catch(() => setTimeout(tick, 2000))\n    }\n    setTimeout(tick, 2000)\n  }\n\n  div.on('change', '.restricted', e => {\n    const host = e.target.closest('tr').dataset.host\n    post('toggle', { host, restricted: e.target.checked })\n      .then(r => (r.ok ? refresh() : r.json().then(b => say(b.error, 'err'))))\n      .catch(e2 => say(e2.message, 'err'))\n  })\n\n  div.on('click', '.ids', e => {\n    const host = e.target.closest('tr').dataset.host\n    const current = e.target.textContent === '\u2014' ? '' : e.target.textContent\n    const entered = prompt(\n      `Allowed ids for ${host} \u2014 space-separated (\"*\" = any logged-in user, empty = clear):`,\n      current\n    )\n    if (entered == null) return\n    const allowed_ids = entered.trim() ? entered.trim().split(/[\\s]+/) : []\n    post('allowed', { host, allowed_ids })\n      .then(r => (r.ok ? refresh() : r.json().then(b => say(b.error, 'err'))))\n      .catch(e2 => say(e2.message, 'err'))\n  })\n\n  div.on('click', '.pub', e => {\n    const host = e.target.closest('tr').dataset.host\n    const current = e.target.textContent === '\u2014' ? '' : e.target.textContent\n    const entered = prompt(\n      `Public (blessed) pages for ${host} \u2014 comma-separated page names a logged-out visitor may read (empty = splash only):`,\n      current\n    )\n    if (entered == null) return\n    const public_pages = entered.trim()\n      ? entered.split(',').map(s => s.trim()).filter(Boolean)\n      : []\n    post('allowed', { host, public_pages })\n      .then(r => (r.ok ? refresh() : r.json().then(b => say(b.error, 'err'))))\n      .catch(e2 => say(e2.message, 'err'))\n  })\n\n  div.on('click', '.terms', e => {\n    const host = e.target.closest('tr').dataset.host\n    const current = e.target.textContent.replace(/^terms:\\s*/, '')\n    const entered = prompt(\n      `Must-read-before-login page for ${host} \u2014 a page name, \"true\" for site-terms, empty to clear:`,\n      current === '\u2014' ? '' : current\n    )\n    if (entered == null) return\n    post('allowed', { host, require_terms: entered.trim() })\n      .then(r => (r.ok ? refresh() : r.json().then(b => say(b.error, 'err'))))\n      .catch(e2 => say(e2.message, 'err'))\n  })\n\n  div.on('click', '.remove', e => {\n    const host = e.target.closest('tr').dataset.host\n    if (!confirm(`Remove ${host} from the farm config's wikiDomains? (site data is untouched)`)) return\n    post('site', { host, action: 'remove' })\n      .then(r => (r.ok ? refresh() : r.json().then(b => say(b.error, 'err'))))\n      .catch(e2 => say(e2.message, 'err'))\n  })\n\n  div.on('click', '.add', () => {\n    const host = (div.find('.new-host').val() || '').trim().toLowerCase()\n    if (!host) return\n    post('site', { host, action: 'add' })\n      .then(r => (r.ok ? refresh() : r.json().then(b => say(b.error, 'err'))))\n      .catch(e2 => say(e2.message, 'err'))\n  })\n\n  div.on('click', '.restart', () => {\n    div.find('button, input').attr('disabled', 'disabled')\n    post('restart').then(r => {\n      if (r.ok) return pollUntilBack()\n      if (r.status === 409)\n        return r.json().then(b => {\n          if (confirm(`${b.error}\\n\\n${b.hint}\\n\\nForce the exit anyway?`))\n            post('restart', { force: true }).then(r2 =>\n              r2.ok ? pollUntilBack() : say('restart refused', 'err')\n            )\n          else {\n            div.find('button, input').removeAttr('disabled')\n            say('restart cancelled \u2014 use wiki-start --restart from a shell.', 'err')\n          }\n        })\n      return r.json().then(b => say(b.error || 'restart failed', 'err'))\n    })\n  })\n\n  refresh()\n}\n\nif (typeof window !== 'undefined') {\n  window.plugins = window.plugins || {}\n  window.plugins['gatekeeper'] = { emit, bind }\n}\n\nexport { emit, bind }\n"],
+  "mappings": "MAIA,IAAMA,EAAO,CAACC,EAAUC,IACtB,MAAM,sBAAsBD,CAAQ,GAAI,CACtC,OAAQ,OACR,QAAS,CAAE,eAAgB,kBAAmB,EAC9C,YAAa,UACb,KAAM,KAAK,UAAUC,GAAQ,CAAC,CAAC,CACjC,CAAC,EAEGC,EAAMC,GACV,OAAOA,CAAC,EAAE,QAAQ,UAAWC,IAAM,CAAE,IAAK,QAAS,IAAK,OAAQ,IAAK,OAAQ,IAAK,QAAS,GAAEA,CAAC,CAAE,EAE5FC,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBTC,EAAO,CAACC,EAAKC,IAAS,CAC1BD,EAAI,KAAK,UAAUF,CAAM,8EAAoE,CAC/F,EAEMI,EAAO,CAACF,EAAKC,IAAS,CAC1B,IAAME,EAAO,IAAMH,EAAI,KAAK,aAAa,EACnCI,EAAM,CAACC,EAAKC,IAAQH,EAAK,EAAE,KAAK,SAAS,EAAE,KAAK,QAAS,UAAUG,GAAO,EAAE,EAAE,EAAE,KAAKD,CAAG,EAExFE,EAASC,GAAQ,CACrB,IAAMC,GAAQD,EAAK,OAAS,CAAC,GAC1B,IAAIE,GAAQ,CACX,GAAIA,EAAK,QACP,MAAO,WAAWf,EAAIe,EAAK,IAAI,CAAC;AAAA,iFAElC,IAAMC,GAAOD,EAAK,cAAgB,CAAC,GAAG,KAAK,IAAI,EACzCE,EAAQF,EAAK,eAAiB,GACpC,MAAO,kBAAkBf,EAAIe,EAAK,IAAI,CAAC;AAAA,gBAC/Bf,EAAIe,EAAK,IAAI,CAAC;AAAA,0DAC4BA,EAAK,WAAa,UAAY,EAAE;AAAA,oEACtBf,GAAKe,EAAK,aAAe,CAAC,GAAG,KAAK,GAAG,GAAK,QAAG,CAAC;AAAA,mFAC/Bf,EAAIgB,GAAO,QAAG,CAAC;AAAA,mGACChB,EAAIiB,GAAS,QAAG,CAAC;AAAA,gBACpGF,EAAK,SAAS,IAAIG,GAAK,+BAA0BlB,EAAIkB,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;AAAA,gBACzEH,EAAK,QAAU,+CAAiD,EAAE;AAAA;AAAA,cAG5E,CAAC,EACA,KAAK,EAAE,EACJI,EACJN,EAAK,wBAA0BA,EAAK,OAAS,CAAC,GAAG,KAAKE,GAAQA,EAAK,OAAO,EAC5EP,EAAK,EAAE,KAAK;AAAA;AAAA;AAAA,UAGNM,GAAQ,iFAAiF;AAAA;AAAA;AAAA;AAAA;AAAA,UAKzFK,EAAa,gDAAkD,EAAE;AAAA;AAAA;AAAA,KAGtE,EACGA,GACFV,EACEI,EAAK,WACD,kEAA6Db,EAAIa,EAAK,YAAc,YAAY,CAAC,wBACjG,4GACN,CACJ,EAEMO,EAAU,IACd,MAAM,iCAAkC,CAAE,YAAa,UAAW,MAAO,UAAW,CAAC,EAClF,KAAKC,GAAK,CACT,GAAIA,EAAE,SAAW,IAAK,MAAM,OAAO,OAAO,IAAI,MAAM,OAAO,EAAG,CAAE,MAAO,EAAK,CAAC,EAC7E,OAAOA,EAAE,KAAK,CAChB,CAAC,EACA,KAAKR,GAAQ,CACZ,GAAIA,EAAK,OAASA,EAAK,SAAU,CAC/BL,EAAK,EAAE,KAAK,UAAUR,EAAIa,EAAK,KAAK,CAAC,WAAW,EAChD,MACF,CACAS,EAAcT,EAAK,eACnBD,EAAOC,CAAI,CACb,CAAC,EACA,MAAM,GAAK,CACN,EAAE,MACJL,EAAK,EAAE,KAAK,2FAAsF,EAC/FA,EAAK,EAAE,KAAK,kCAAkCR,EAAI,EAAE,OAAO,CAAC,WAAW,CAC9E,CAAC,EAEDsB,EAAc,KAEZC,EAAgB,IAAM,CAC1B,IAAMC,EAAQ,KAAK,IAAI,EACvBf,EAAI,kBAAa,EACjB,IAAMgB,EAAO,IAAM,CACjB,GAAI,KAAK,IAAI,EAAID,EAAQ,KAAQ,CAC/Bf,EAAI,yEAAqE,KAAK,EAC9E,MACF,CACA,MAAM,+BAAgC,CAAE,MAAO,UAAW,CAAC,EACxD,KAAK,GAAK,EAAE,KAAK,CAAC,EAClB,KAAKiB,GAAQ,CACRA,EAAK,SAAWA,EAAK,UAAYJ,GACnCb,EAAI,iBAAa,IAAI,EACrB,WAAWW,EAAS,GAAG,GAClB,WAAWK,EAAM,GAAI,CAC9B,CAAC,EACA,MAAM,IAAM,WAAWA,EAAM,GAAI,CAAC,CACvC,EACA,WAAWA,EAAM,GAAI,CACvB,EAEApB,EAAI,GAAG,SAAU,cAAe,GAAK,CACnC,IAAMsB,EAAO,EAAE,OAAO,QAAQ,IAAI,EAAE,QAAQ,KAC5C9B,EAAK,SAAU,CAAE,KAAA8B,EAAM,WAAY,EAAE,OAAO,OAAQ,CAAC,EAClD,KAAK,GAAM,EAAE,GAAKP,EAAQ,EAAI,EAAE,KAAK,EAAE,KAAKQ,GAAKnB,EAAImB,EAAE,MAAO,KAAK,CAAC,CAAE,EACtE,MAAMC,GAAMpB,EAAIoB,EAAG,QAAS,KAAK,CAAC,CACvC,CAAC,EAEDxB,EAAI,GAAG,QAAS,OAAQ,GAAK,CAC3B,IAAMsB,EAAO,EAAE,OAAO,QAAQ,IAAI,EAAE,QAAQ,KACtCG,EAAU,EAAE,OAAO,cAAgB,SAAM,GAAK,EAAE,OAAO,YACvDC,EAAU,OACd,mBAAmBJ,CAAI,qEACvBG,CACF,EACA,GAAIC,GAAW,KAAM,OACrB,IAAMC,EAAcD,EAAQ,KAAK,EAAIA,EAAQ,KAAK,EAAE,MAAM,OAAO,EAAI,CAAC,EACtElC,EAAK,UAAW,CAAE,KAAA8B,EAAM,YAAAK,CAAY,CAAC,EAClC,KAAKX,GAAMA,EAAE,GAAKD,EAAQ,EAAIC,EAAE,KAAK,EAAE,KAAKO,GAAKnB,EAAImB,EAAE,MAAO,KAAK,CAAC,CAAE,EACtE,MAAMC,GAAMpB,EAAIoB,EAAG,QAAS,KAAK,CAAC,CACvC,CAAC,EAEDxB,EAAI,GAAG,QAAS,OAAQ,GAAK,CAC3B,IAAMsB,EAAO,EAAE,OAAO,QAAQ,IAAI,EAAE,QAAQ,KACtCG,EAAU,EAAE,OAAO,cAAgB,SAAM,GAAK,EAAE,OAAO,YACvDC,EAAU,OACd,8BAA8BJ,CAAI,0FAClCG,CACF,EACA,GAAIC,GAAW,KAAM,OACrB,IAAME,EAAeF,EAAQ,KAAK,EAC9BA,EAAQ,MAAM,GAAG,EAAE,IAAI9B,GAAKA,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,EACpD,CAAC,EACLJ,EAAK,UAAW,CAAE,KAAA8B,EAAM,aAAAM,CAAa,CAAC,EACnC,KAAKZ,GAAMA,EAAE,GAAKD,EAAQ,EAAIC,EAAE,KAAK,EAAE,KAAKO,GAAKnB,EAAImB,EAAE,MAAO,KAAK,CAAC,CAAE,EACtE,MAAMC,GAAMpB,EAAIoB,EAAG,QAAS,KAAK,CAAC,CACvC,CAAC,EAEDxB,EAAI,GAAG,QAAS,SAAU,GAAK,CAC7B,IAAMsB,EAAO,EAAE,OAAO,QAAQ,IAAI,EAAE,QAAQ,KACtCG,EAAU,EAAE,OAAO,YAAY,QAAQ,aAAc,EAAE,EACvDC,EAAU,OACd,mCAAmCJ,CAAI,8DACvCG,IAAY,SAAM,GAAKA,CACzB,EACIC,GAAW,MACflC,EAAK,UAAW,CAAE,KAAA8B,EAAM,cAAeI,EAAQ,KAAK,CAAE,CAAC,EACpD,KAAKV,GAAMA,EAAE,GAAKD,EAAQ,EAAIC,EAAE,KAAK,EAAE,KAAKO,GAAKnB,EAAImB,EAAE,MAAO,KAAK,CAAC,CAAE,EACtE,MAAMC,GAAMpB,EAAIoB,EAAG,QAAS,KAAK,CAAC,CACvC,CAAC,EAEDxB,EAAI,GAAG,QAAS,UAAW,GAAK,CAC9B,IAAMsB,EAAO,EAAE,OAAO,QAAQ,IAAI,EAAE,QAAQ,KACvC,QAAQ,UAAUA,CAAI,+DAA+D,GAC1F9B,EAAK,OAAQ,CAAE,KAAA8B,EAAM,OAAQ,QAAS,CAAC,EACpC,KAAK,GAAM,EAAE,GAAKP,EAAQ,EAAI,EAAE,KAAK,EAAE,KAAKQ,GAAKnB,EAAImB,EAAE,MAAO,KAAK,CAAC,CAAE,EACtE,MAAMC,GAAMpB,EAAIoB,EAAG,QAAS,KAAK,CAAC,CACvC,CAAC,EAEDxB,EAAI,GAAG,QAAS,OAAQ,IAAM,CAC5B,IAAMsB,GAAQtB,EAAI,KAAK,WAAW,EAAE,IAAI,GAAK,IAAI,KAAK,EAAE,YAAY,EAC/DsB,GACL9B,EAAK,OAAQ,CAAE,KAAA8B,EAAM,OAAQ,KAAM,CAAC,EACjC,KAAKN,GAAMA,EAAE,GAAKD,EAAQ,EAAIC,EAAE,KAAK,EAAE,KAAKO,GAAKnB,EAAImB,EAAE,MAAO,KAAK,CAAC,CAAE,EACtE,MAAMC,GAAMpB,EAAIoB,EAAG,QAAS,KAAK,CAAC,CACvC,CAAC,EAEDxB,EAAI,GAAG,QAAS,WAAY,IAAM,CAChCA,EAAI,KAAK,eAAe,EAAE,KAAK,WAAY,UAAU,EACrDR,EAAK,SAAS,EAAE,KAAKwB,GACfA,EAAE,GAAWE,EAAc,EAC3BF,EAAE,SAAW,IACRA,EAAE,KAAK,EAAE,KAAKO,GAAK,CACpB,QAAQ,GAAGA,EAAE,KAAK;AAAA;AAAA,EAAOA,EAAE,IAAI;AAAA;AAAA,uBAA4B,EAC7D/B,EAAK,UAAW,CAAE,MAAO,EAAK,CAAC,EAAE,KAAKqC,GACpCA,EAAG,GAAKX,EAAc,EAAId,EAAI,kBAAmB,KAAK,CACxD,GAEAJ,EAAI,KAAK,eAAe,EAAE,WAAW,UAAU,EAC/CI,EAAI,kEAA8D,KAAK,EAE3E,CAAC,EACIY,EAAE,KAAK,EAAE,KAAKO,GAAKnB,EAAImB,EAAE,OAAS,iBAAkB,KAAK,CAAC,CAClE,CACH,CAAC,EAEDR,EAAQ,CACV,EAEI,OAAO,OAAW,MACpB,OAAO,QAAU,OAAO,SAAW,CAAC,EACpC,OAAO,QAAQ,WAAgB,CAAE,KAAAhB,EAAM,KAAAG,CAAK",
+  "names": ["post", "endpoint", "body", "esc", "s", "c", "styles", "emit", "div", "item", "bind", "root", "say", "msg", "cls", "render", "data", "rows", "site", "pub", "terms", "w", "anyPending", "refresh", "r", "lastStarted", "pollUntilBack", "began", "tick", "pong", "host", "b", "e2", "current", "entered", "allowed_ids", "public_pages", "r2"]
+}

package/factory.json

@@ -0,0 +1 @@
+{"name": "Gatekeeper", "title": "Toggle login-to-view for farm sites and restart the farm", "category": "other"}

package/package.json

@@ -1,6 +1,38 @@
 {
   "name": "wiki-plugin-gatekeeper",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "Federated Wiki farm admin item: list and toggle login-to-view (restricted) sites in the farm config, edit allowed ids, add or remove sites, and restart the farm with proper back-up detection.",
+  "type": "module",
+  "main": "client/gatekeeper.js",
+  "files": [
+    "api",
+    "client",
+    "factory.json",
+    "pages",
+    "server"
+  ],
+  "scripts": {
+    "build": "node scripts/build.js",
+    "test": "node --test"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "esbuild": "^0.25.0"
+  },
+  "author": "David Bovill",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Hitchhikers-Guide-to-the-Galaxy/wiki-plugin-gatekeeper.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Hitchhikers-Guide-to-the-Galaxy/wiki-plugin-gatekeeper/issues"
+  },
+  "homepage": "https://github.com/Hitchhikers-Guide-to-the-Galaxy/wiki-plugin-gatekeeper#readme",
+  "fedwiki": {
+    "api": {
+      "version": 1,
+      "spec": "api/openapi.json"
+    }
+  }
 }

package/pages/about-gatekeeper-plugin

@@ -0,0 +1,60 @@
+{
+  "title": "About Gatekeeper Plugin",
+  "story": [
+    {
+      "type": "markdown",
+      "id": "f1a2b3c4d5e60718",
+      "text": "The Gatekeeper item manages **login-to-view** across a wiki farm: it lists every site in the farm config's wikiDomains map, toggles the `restricted` flag, edits `allowed_ids`, blesses `public_pages` and a `require_terms` page for the logged-out public face, adds or removes sites, and restarts the farm so the changes take effect."
+    },
+    {
+      "type": "gatekeeper",
+      "id": "a2b3c4d5e6f70819",
+      "text": ""
+    },
+    {
+      "type": "markdown",
+      "id": "b3c4d5e6f708192a",
+      "text": "# How it works\n\nThe server side reads and writes the farm config file (the `--config` path), with a timestamped backup in `config-backups/` beside it and an atomic same-directory rename so sync clients never see a half-written file. Un-restricting **deletes** the `restricted` key, because upstream security modules check mere presence of the key.\n\nConfig changes only take effect after a farm restart (per-site servers are cached at first request), so each edited site shows a *pending restart* badge. The restart button exits the process Plugmatic-style and lets the supervisor respawn it \u2014 then polls until the server is back, proving the restart by watching the process start-time change. On an unsupervised farm (plain `wiki-start`) the exit is refused with a hint to run `wiki-start --restart` instead.\n\nAll writes require an **admin** session; the enforcement itself lives in the security modules via the shared `wiki-view-gate` module, which also serves the customisable splash screen (see the `splash_page` config key and `/assets/splash/index.html`).\n\nThe **public face** columns bless pages a logged-out visitor may read: `public_pages` serves those pages through the real client shell with a filtered sitemap, and `require_terms` names the page the splash insists on before showing its login form. Both live in the same wikiDomains entry and follow the same pending-restart flow."
+    }
+  ],
+  "journal": [
+    {
+      "type": "create",
+      "item": {
+        "title": "About Gatekeeper Plugin",
+        "story": [
+          {
+            "type": "markdown",
+            "id": "f1a2b3c4d5e60718",
+            "text": "The Gatekeeper item manages **login-to-view** across a wiki farm: it lists every site in the farm config's wikiDomains map, toggles the `restricted` flag, edits `allowed_ids`, adds or removes sites, and restarts the farm so the changes take effect."
+          }
+        ]
+      },
+      "date": 1753113600000,
+      "provenance": "from marvin"
+    },
+    {
+      "type": "edit",
+      "id": "f1a2b3c4d5e60718",
+      "item": {
+        "type": "markdown",
+        "id": "f1a2b3c4d5e60718",
+        "text": "The Gatekeeper item manages **login-to-view** across a wiki farm: it lists every site in the farm config's wikiDomains map, toggles the `restricted` flag, edits `allowed_ids`, blesses `public_pages` and a `require_terms` page for the logged-out public face, adds or removes sites, and restarts the farm so the changes take effect."
+      },
+      "date": 1785705961585,
+      "provenance": "Edited through a dialogue between David Bovill and Claude Code, session 2026-08-02: Gatekeeper public-face rework."
+    },
+    {
+      "type": "edit",
+      "id": "b3c4d5e6f708192a",
+      "item": {
+        "type": "markdown",
+        "id": "b3c4d5e6f708192a",
+        "text": "# How it works\n\nThe server side reads and writes the farm config file (the `--config` path), with a timestamped backup in `config-backups/` beside it and an atomic same-directory rename so sync clients never see a half-written file. Un-restricting **deletes** the `restricted` key, because upstream security modules check mere presence of the key.\n\nConfig changes only take effect after a farm restart (per-site servers are cached at first request), so each edited site shows a *pending restart* badge. The restart button exits the process Plugmatic-style and lets the supervisor respawn it \u2014 then polls until the server is back, proving the restart by watching the process start-time change. On an unsupervised farm (plain `wiki-start`) the exit is refused with a hint to run `wiki-start --restart` instead.\n\nAll writes require an **admin** session; the enforcement itself lives in the security modules via the shared `wiki-view-gate` module, which also serves the customisable splash screen (see the `splash_page` config key and `/assets/splash/index.html`).\n\nThe **public face** columns bless pages a logged-out visitor may read: `public_pages` serves those pages through the real client shell with a filtered sitemap, and `require_terms` names the page the splash insists on before showing its login form. Both live in the same wikiDomains entry and follow the same pending-restart flow."
+      },
+      "date": 1785705961585,
+      "provenance": "Edited through a dialogue between David Bovill and Claude Code, session 2026-08-02: Gatekeeper public-face rework."
+    }
+  ],
+  "plugin": "gatekeeper"
+}

package/server/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/server/server.js

@@ -0,0 +1,258 @@
+// server/server.js — CommonJS (see sibling server/package.json).
+// Gatekeeper: reads and writes the FARM config file (argv.config) to manage
+// per-site login-to-view (the wikiDomains map's `restricted` keys), and
+// restarts the farm Plugmatic-style (exit 0, supervisor respawns).
+//
+// Module-level state is shared by every per-site server in the farm process
+// via the require cache: one snapshot of the config as the process booted,
+// one write queue so concurrent edits never interleave.
+
+const fs = require('node:fs')
+const path = require('node:path')
+
+const PROCESS_STARTED = Date.now() - process.uptime() * 1000
+const BACKUPS_TO_KEEP = 20
+
+// Keys the toggle/allowed routes may touch inside a wikiDomains entry.
+const SITE_KEYS = [
+  'restricted',
+  'allowed_ids',
+  'allowed_domains',
+  'splash_page',
+  'details',
+  'public_pages',
+  'require_terms',
+]
+
+let configPath = null
+let bootSnapshot = null // config parsed when this module first loaded
+
+// Serialise all read-modify-write cycles.
+let writeQueue = Promise.resolve()
+
+const readConfig = () => JSON.parse(fs.readFileSync(configPath, 'utf8'))
+
+const detectIndent = raw => {
+  const m = raw.match(/^(\s+)"/m)
+  return m ? m[1] : '  '
+}
+
+// A supervisor respawns the process after exit 0: a container runtime, a
+// systemd service (systemd sets INVOCATION_ID for every unit it runs; the
+// unit must carry Restart=always, as the Pi5 farms do), or an operator
+// saying so with WIKI_SUPERVISED=1. Named so the client can show which.
+const supervisor = () =>
+  process.env.WIKI_SUPERVISED === '1'
+    ? 'env'
+    : fs.existsSync('/.dockerenv')
+      ? 'docker'
+      : process.env.INVOCATION_ID
+        ? 'systemd'
+        : null
+const supervised = () => supervisor() != null
+
+const writeConfig = mutator =>
+  (writeQueue = writeQueue.then(() => {
+    const raw = fs.readFileSync(configPath, 'utf8')
+    const config = JSON.parse(raw)
+    mutator(config)
+
+    const dir = path.dirname(configPath)
+    const backups = path.join(dir, 'config-backups')
+    fs.mkdirSync(backups, { recursive: true })
+    const stamp = new Date().toISOString().replace(/[:.]/g, '-')
+    fs.copyFileSync(configPath, path.join(backups, `${path.basename(configPath)}.${stamp}`))
+    const old = fs
+      .readdirSync(backups)
+      .filter(f => f.startsWith(path.basename(configPath)))
+      .sort()
+    for (const f of old.slice(0, Math.max(0, old.length - BACKUPS_TO_KEEP)))
+      fs.rmSync(path.join(backups, f))
+
+    // Same-directory tmp + rename = atomic on one filesystem; sync clients
+    // (Nextcloud) never observe a half-written config.
+    const tmp = path.join(dir, `.${path.basename(configPath)}.gatekeeper-tmp`)
+    fs.writeFileSync(tmp, JSON.stringify(config, null, detectIndent(raw)) + '\n')
+    fs.renameSync(tmp, configPath)
+    return config
+  }))
+
+const validHost = h => typeof h === 'string' && /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i.test(h)
+const validEntry = s => typeof s === 'string' && s.length > 0 && !s.includes(',')
+
+const lint = site => {
+  const warnings = []
+  for (const key of ['allowed_ids', 'allowed_domains']) {
+    const list = site[key]
+    if (list == null) continue
+    if (!Array.isArray(list)) warnings.push(`${key} is not an array`)
+    else if (list.some(e => typeof e === 'string' && e.includes(',')))
+      warnings.push(`${key} has a comma inside one entry — split it into separate entries; it can never match as-is`)
+  }
+  if (site.restricted != null && site.restricted !== 'true' && site.restricted !== 'terms')
+    warnings.push(`restricted is ${JSON.stringify(site.restricted)} — any value restricts (upstream checks mere presence); use "true", "terms", or delete the key`)
+  if (site.public_pages != null && !Array.isArray(site.public_pages))
+    warnings.push('public_pages is not an array')
+  return warnings
+}
+
+const validSlugName = s => typeof s === 'string' && s.trim().length > 0 && !s.includes(',')
+
+const startServer = ({ argv, app }) => {
+  if (!configPath && argv.config) {
+    configPath = argv.config
+    try {
+      bootSnapshot = readConfig()
+    } catch (e) {
+      console.log('gatekeeper: could not parse config at boot:', e.message)
+    }
+  }
+
+  const admin = (req, res, next) => {
+    try {
+      if (app.securityhandler && app.securityhandler.isAdmin(req)) return next()
+    } catch {}
+    res.status(403).json({ error: 'gatekeeper requires an admin login' })
+  }
+
+  // Unauthenticated liveness probe. `started` changing across polls is the
+  // client's proof that the restart actually happened.
+  app.get('/plugin/gatekeeper/ping.json', (req, res) => {
+    res.json({ up: true, started: PROCESS_STARTED })
+  })
+
+  app.get('/plugin/gatekeeper/status.json', admin, (req, res) => {
+    if (!configPath)
+      return res.json({
+        readOnly: true,
+        error: 'no --config path in argv; gatekeeper cannot manage this farm',
+        sites: [],
+      })
+    let config
+    try {
+      config = readConfig()
+    } catch (e) {
+      return res.status(500).json({ error: `config unreadable: ${e.message}` })
+    }
+    let configMtime = null
+    try {
+      configMtime = fs.statSync(configPath).mtimeMs
+    } catch {}
+    const domains = config.wikiDomains || {}
+    const bootDomains = (bootSnapshot && bootSnapshot.wikiDomains) || {}
+    const sites = Object.keys(domains).map(host => {
+      const site = domains[host] || {}
+      const pending =
+        JSON.stringify(site) !== JSON.stringify(bootDomains[host] || {})
+      return {
+        host,
+        restricted: site.restricted != null,
+        allowed_ids: site.allowed_ids || null,
+        allowed_domains: site.allowed_domains || null,
+        splash_page: site.splash_page || null,
+        details: site.details || null,
+        public_pages: site.public_pages || null,
+        require_terms: site.require_terms || null,
+        security_type: site.security_type || null,
+        pending,
+        warnings: lint(site),
+      }
+    })
+    // Sites removed from the file since boot are also a pending change.
+    for (const host of Object.keys(bootDomains))
+      if (!(host in domains))
+        sites.push({ host, removed: true, pending: true, warnings: [] })
+    res.json({
+      configPath,
+      farm: !!config.farm,
+      security_type: config.security_type || null,
+      processStarted: PROCESS_STARTED,
+      configMtime,
+      configEditedSinceBoot: configMtime != null && configMtime > PROCESS_STARTED,
+      supervised: supervised(),
+      supervisor: supervisor(),
+      sites,
+    })
+  })
+
+  app.post('/plugin/gatekeeper/toggle', admin, (req, res) => {
+    if (!configPath) return res.status(500).json({ error: 'no config path' })
+    const { host, restricted } = req.body || {}
+    if (!validHost(host)) return res.status(400).json({ error: 'bad host' })
+    writeConfig(config => {
+      config.wikiDomains = config.wikiDomains || {}
+      const site = (config.wikiDomains[host] = config.wikiDomains[host] || {})
+      if (restricted) {
+        site.restricted = 'true'
+        // Any logged-in user may view unless the admin narrows it later.
+        if (!site.allowed_ids && !site.allowed_domains) site.allowed_ids = ['*']
+      } else {
+        // Upstream checks mere presence of the key, so un-restrict = delete.
+        delete site.restricted
+      }
+    })
+      .then(() => res.json({ ok: true }))
+      .catch(e => res.status(500).json({ error: e.message }))
+  })
+
+  app.post('/plugin/gatekeeper/allowed', admin, (req, res) => {
+    if (!configPath) return res.status(500).json({ error: 'no config path' })
+    const body = req.body || {}
+    const { host } = body
+    if (!validHost(host)) return res.status(400).json({ error: 'bad host' })
+    for (const key of ['allowed_ids', 'allowed_domains'])
+      if (body[key] != null && (!Array.isArray(body[key]) || !body[key].every(validEntry)))
+        return res.status(400).json({ error: `${key} must be an array of comma-free strings` })
+    for (const key of ['splash_page', 'details', 'require_terms'])
+      if (body[key] != null && typeof body[key] !== 'string')
+        return res.status(400).json({ error: `${key} must be a string` })
+    if (body.public_pages != null &&
+        (!Array.isArray(body.public_pages) || !body.public_pages.every(validSlugName)))
+      return res.status(400).json({ error: 'public_pages must be an array of comma-free page names' })
+    writeConfig(config => {
+      config.wikiDomains = config.wikiDomains || {}
+      const site = (config.wikiDomains[host] = config.wikiDomains[host] || {})
+      for (const key of SITE_KEYS.filter(k => k !== 'restricted'))
+        if (key in body) {
+          const empty =
+            body[key] == null ||
+            (Array.isArray(body[key]) && body[key].length === 0) ||
+            (typeof body[key] === 'string' && body[key].trim() === '')
+          if (empty) delete site[key]
+          else site[key] = body[key]
+        }
+    })
+      .then(() => res.json({ ok: true }))
+      .catch(e => res.status(500).json({ error: e.message }))
+  })
+
+  app.post('/plugin/gatekeeper/site', admin, (req, res) => {
+    if (!configPath) return res.status(500).json({ error: 'no config path' })
+    const { host, action } = req.body || {}
+    if (!validHost(host)) return res.status(400).json({ error: 'bad host' })
+    if (action !== 'add' && action !== 'remove')
+      return res.status(400).json({ error: 'action must be add or remove' })
+    writeConfig(config => {
+      config.wikiDomains = config.wikiDomains || {}
+      if (action === 'add') config.wikiDomains[host] = config.wikiDomains[host] || {}
+      else delete config.wikiDomains[host]
+    })
+      .then(() => res.json({ ok: true }))
+      .catch(e => res.status(500).json({ error: e.message }))
+  })
+
+  app.post('/plugin/gatekeeper/restart', admin, (req, res) => {
+    if (!supervised() && !(req.body && req.body.force))
+      return res.status(409).json({
+        error: 'no supervisor detected — an exit would leave the farm down',
+        hint: 'restart from a shell with: wiki-start --restart  (or POST again with {"force":true})',
+      })
+    console.log('gatekeeper: exit to restart')
+    res.sendStatus(200)
+    // Let the response flush before dying (plugmatic exits immediately and
+    // the 200 usually — but not always — escapes the process).
+    setTimeout(() => process.exit(0), 250)
+  })
+}
+
+module.exports = { startServer }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.