@acms-subir/core 0.3.12 → 0.3.13

package/src/lib/editor/schedule.ts

@@ -210,24 +210,24 @@ const linkView = (l: BookingLink) => ({ ...l, createdAt: iso(l.createdAt), updat
 export async function listResourcesFor(c: EditorContext) {
   requireBookings();
   const [resources, links, settings] = await Promise.all([c.repo.listResources(), c.repo.listBookingLinks(), c.repo.getSettings()]);
-  const canEdit = canManageSchedule(c.who, settings);
+  const canEdit = await canManageSchedule(c.repo, c.who, settings);
   return { canEdit, resources: resources.map((r) => resourceView(r, links, canEdit)) };
 }
 export async function getResourceFor(c: EditorContext, id: string) {
   requireBookings();
   const r = await c.repo.getResource(id);
   if (!r) throw new ApiError(404, 'Room or service not found.');
-  return resourceView(r, await c.repo.listBookingLinks(r.id), canManageSchedule(c.who, await c.repo.getSettings()));
+  return resourceView(r, await c.repo.listBookingLinks(r.id), await canManageSchedule(c.repo, c.who, await c.repo.getSettings()));
 }
 export async function createResourceFor(c: EditorContext, body: z.infer<typeof ResourceInput>) {
   requireBookings();
-  requireScheduleRole(c.who, await c.repo.getSettings());
+  await requireScheduleRole(c.repo, c.who, await c.repo.getSettings());
   const r = await c.repo.createResource({ ...(await resourceFields(c.repo, body)), name: body.name, slug: await uniqueResourceSlug(c.repo, body.slug || body.name) });
   return resourceView(r, [], true);
 }
 export async function updateResourceFor(c: EditorContext, id: string, body: z.infer<typeof ResourcePatch>) {
   requireBookings();
-  requireScheduleRole(c.who, await c.repo.getSettings());
+  await requireScheduleRole(c.repo, c.who, await c.repo.getSettings());
   const cur = await c.repo.getResource(id);
   if (!cur) throw new ApiError(404, 'Room or service not found.');
   await c.repo.updateResource(id, { ...(await resourceFields(c.repo, body)), ...(body.slug !== undefined ? { slug: await uniqueResourceSlug(c.repo, body.slug || cur.name, id) } : {}) });
@@ -235,7 +235,7 @@ export async function updateResourceFor(c: EditorContext, id: string, body: z.in
 }
 export async function deleteResourceFor(c: EditorContext, id: string) {
   requireBookings();
-  requireScheduleRole(c.who, await c.repo.getSettings());
+  await requireScheduleRole(c.repo, c.who, await c.repo.getSettings());
   if (!await c.repo.getResource(id)) throw new ApiError(404, 'Room or service not found.');
   await c.repo.deleteResource(id);
   return { id, deleted: true as const };
@@ -276,7 +276,7 @@ async function linkOf(repo: ContentRepository, resourceId: string, linkId: strin
 }
 export async function createLinkFor(c: EditorContext, resourceId: string, body: z.infer<typeof LinkInput>) {
   requireBookings();
-  requireScheduleRole(c.who, await c.repo.getSettings());
+  await requireScheduleRole(c.repo, c.who, await c.repo.getSettings());
   if (!await c.repo.getResource(resourceId)) throw new ApiError(404, 'Room or service not found.');
   const { slug, ...rest } = body;
   const created = await c.repo.createBookingLink({ resourceId, name: body.name, slug: await uniqueLinkSlug(c.repo, resourceId, slug || body.name) });
@@ -285,7 +285,7 @@ export async function createLinkFor(c: EditorContext, resourceId: string, body:
 }
 export async function updateLinkFor(c: EditorContext, resourceId: string, linkId: string, body: z.infer<typeof LinkPatch>) {
   requireBookings();
-  requireScheduleRole(c.who, await c.repo.getSettings());
+  await requireScheduleRole(c.repo, c.who, await c.repo.getSettings());
   const cur = await linkOf(c.repo, resourceId, linkId);
   const { slug, ...rest } = body;
   await c.repo.updateBookingLink(cur.id, { ...rest, ...(slug !== undefined ? { slug: await uniqueLinkSlug(c.repo, resourceId, slug || cur.name, cur.id) } : {}) });
@@ -293,7 +293,7 @@ export async function updateLinkFor(c: EditorContext, resourceId: string, linkId
 }
 export async function deleteLinkFor(c: EditorContext, resourceId: string, linkId: string) {
   requireBookings();
-  requireScheduleRole(c.who, await c.repo.getSettings());
+  await requireScheduleRole(c.repo, c.who, await c.repo.getSettings());
   const cur = await linkOf(c.repo, resourceId, linkId);
   await c.repo.deleteBookingLink(cur.id);
   return { id: cur.id, deleted: true as const };
@@ -315,24 +315,24 @@ const calendarView = (cal: Awaited<ReturnType<ContentRepository['listCalendars']
 export async function listCalendarsFor(c: EditorContext) {
   requireCalendarModule();
   const [list, settings] = await Promise.all([c.repo.listCalendars(), c.repo.getSettings()]);
-  const canEdit = canManageSchedule(c.who, settings);
+  const canEdit = await canManageSchedule(c.repo, c.who, settings);
   return { canEdit, calendars: list.map((cal) => calendarView(cal, canEdit)) };
 }
 export async function createCalendarFor(c: EditorContext, body: z.infer<typeof CalendarBody>) {
   requireCalendarModule();
-  requireScheduleRole(c.who, await c.repo.getSettings());
+  await requireScheduleRole(c.repo, c.who, await c.repo.getSettings());
   return calendarView(await saveCalendar(c.repo, undefined, body));
 }
 export async function updateCalendarFor(c: EditorContext, id: string, body: z.infer<typeof CalendarPatch>) {
   requireCalendarModule();
-  requireScheduleRole(c.who, await c.repo.getSettings());
+  await requireScheduleRole(c.repo, c.who, await c.repo.getSettings());
   const cur = await c.repo.getCalendar(id);
   if (!cur) throw new ApiError(404, 'Calendar not found.');
   return calendarView(await saveCalendar(c.repo, id, { ...body, name: body.name ?? cur.name, slug: body.slug ?? cur.slug }));
 }
 export async function deleteCalendarFor(c: EditorContext, id: string) {
   requireCalendarModule();
-  requireScheduleRole(c.who, await c.repo.getSettings());
+  await requireScheduleRole(c.repo, c.who, await c.repo.getSettings());
   if (!await c.repo.getCalendar(id)) throw new ApiError(404, 'Calendar not found.');
   await c.repo.deleteCalendar(id);
   return { id, deleted: true as const };

package/src/lib/editor/sections.ts

@@ -4,6 +4,7 @@ import type { Settings } from '../schema';
 import { ApiError } from '../api';
 import { DesignRequest, runDesignOperation } from '../design-service';
 import type { EditorPrincipal } from './auth';
+import { principalCan, requirePrincipal } from '../permissions/access';
 
 // Section layouts for editor apps. Every write is a design operation run by
 // the same code as the Design screen (lib/design-service runDesignOperation)
@@ -27,7 +28,12 @@ export const stagedPages = (s: Settings) => (s.draftDesign?.sectionPages ?? s.se
 // lazy: the theme registry pulls in Astro templates (keeps the OpenAPI/schema imports light)
 const getTheme = async (slug: string) => (await import('../theme')).getTheme(slug);
 export const stagedTheme = (s: Settings) => getTheme(String(s.draftDesign?.activeTheme ?? s.activeTheme));
-export const designIdentityFor = (who: EditorPrincipal) => ({ actor: who.actor, role: who.user.role === 'owner' ? 'owner' as const : 'editor' as const });
+/** the design rules for an app user: Arrange and lock sections acts like an owner; otherwise Edit page sections */
+export async function designIdentityFor(repo: ContentRepository, who: EditorPrincipal) {
+  if (await principalCan(repo, who, 'site.layout')) return { actor: who.actor, role: 'owner' as const };
+  await requirePrincipal(repo, who, 'site.sections');
+  return { actor: who.actor, role: 'editor' as const };
+}
 
 export async function listSections(repo: ContentRepository, query: z.infer<typeof SectionsQuery>, who: EditorPrincipal) {
   const [settings, pages] = await Promise.all([repo.getSettings(), repo.listPages()]);
@@ -35,6 +41,7 @@ export async function listSections(repo: ContentRepository, query: z.infer<typeo
   const layouts = draft ? stagedPages(settings) : settings.sectionPages;
   const theme = draft ? await stagedTheme(settings) : await getTheme(settings.activeTheme);
   const byId = new Map(pages.map((p) => [p.id, p]));
+  const arranges = await principalCan(repo, who, 'site.layout');
   const out = Object.entries(layouts)
     .filter(([id, layout]) => layout && byId.has(id) && (!query.pageId || query.pageId === id))
     .map(([id, layout]) => {
@@ -49,7 +56,7 @@ export async function listSections(repo: ContentRepository, query: z.infer<typeo
           /** new on the page (not live yet): only a full design publish adds it */
           isNew: !liveLayout?.sections.some((x) => x.id === s.id),
           changed: draft && JSON.stringify(liveLayout?.sections.find((x) => x.id === s.id) ?? null) !== JSON.stringify(s),
-          editable: who.user.role === 'owner' || !s.locked,
+          editable: arranges || !s.locked,
         })),
       };
     });
@@ -80,7 +87,7 @@ export async function stageSection(repo: ContentRepository, who: EditorPrincipal
   if (!layout || index < 0) throw new ApiError(404, 'Section not found.');
   layout.sections[index] = change(layout.sections[index]);
   const input = DesignRequest.parse({ operation: 'stage', revision, patch: { sectionPages: pages } });
-  const result = await runDesignOperation(repo, designIdentityFor(who), input, origin);
+  const result = await runDesignOperation(repo, await designIdentityFor(repo, who), input, origin);
   return { revision: result.revision, section: layout.sections[index] };
 }
 
@@ -91,6 +98,6 @@ export async function patchSection(repo: ContentRepository, who: EditorPrincipal
 
 export async function publishSection(repo: ContentRepository, who: EditorPrincipal, pageId: string, sectionId: string, revision: number, origin: string) {
   const input = DesignRequest.parse({ operation: 'publishSection', revision, pageId, sectionId });
-  const result = await runDesignOperation(repo, designIdentityFor(who), input, origin);
+  const result = await runDesignOperation(repo, await designIdentityFor(repo, who), input, origin);
   return { revision: result.revision };
 }

package/src/lib/editor/site-data.ts

@@ -5,6 +5,7 @@ import { ApiError } from '../api';
 import { displayAnswers } from '../forms/service';
 import type { EditorContext } from './http';
 import { isAdmin, requireAdmin } from './roles';
+import { principalCan, requirePrincipal } from '../permissions/access';
 
 // Forms and the links page from editor apps. Any staff account sees which
 // forms exist and how many responses they have; reading responses (personal
@@ -17,7 +18,7 @@ const iso = (n: number | null) => (n === null ? null : new Date(n).toISOString()
 export async function listFormsFor(c: EditorContext) {
   const [forms, stats] = await Promise.all([c.repo.forms.list(), c.repo.forms.stats()]);
   return {
-    canReadResponses: isAdmin(c.who),
+    canReadResponses: isAdmin(c.who) && await principalCan(c.repo, c.who, 'forms.responses'),
     forms: forms.filter((f) => f.kind === 'form').map((f) => ({
       id: f.id, name: f.name, title: f.definition.title || f.name, purpose: f.purpose, status: f.status, hasDraft: Boolean(f.draft),
       responses: stats.get(f.id)?.count ?? 0, lastResponseAt: iso(stats.get(f.id)?.last ?? null), updatedAt: iso(f.updatedAt),
@@ -31,6 +32,7 @@ export const ResponsesQuery = z.object({
 }).strict();
 export async function formResponsesFor(c: EditorContext, id: string, q: z.infer<typeof ResponsesQuery>) {
   requireAdmin(c.who, 'read form responses');
+  await requirePrincipal(c.repo, c.who, 'forms.responses');
   const form = await c.repo.forms.get(id);
   if (!form || form.kind !== 'form') throw new ApiError(404, 'Form not found.');
   const rows = await c.repo.forms.searchSubmissions(id, { q: q.q, since: q.since ? Date.parse(q.since) : undefined, limit: q.limit + 1, offset: (q.page - 1) * q.limit });
@@ -54,7 +56,7 @@ export async function getLinksFor(c: EditorContext) {
   // next save gets a 409), never newer than the blocks it is sent with
   const revision = await c.repo.linksRevision();
   const [settings, links] = await Promise.all([c.repo.getSettings(), c.repo.listLinks()]);
-  return { revision, name: settings.linksName, bio: settings.linksBio, avatar: settings.linksAvatar, canEditHtml: isAdmin(c.who), items: links.map(linkView) };
+  return { revision, name: settings.linksName, bio: settings.linksBio, avatar: settings.linksAvatar, canEditHtml: isAdmin(c.who) && await principalCan(c.repo, c.who, 'site.links'), items: links.map(linkView) };
 }
 
 const Item = z.object({

package/src/lib/editor/translations.ts

@@ -10,6 +10,7 @@ import type { SaveHooks } from '../content-service';
 import type { EditorPrincipal } from './auth';
 import { checkRevision, loadDoc, mergedDoc, revisionOf, saveRaw, withDocLock, type DocKind } from './documents';
 import { findSection, stagedPages, stagedTheme, stageSection } from './sections';
+import { principalCan } from '../permissions/access';
 
 // Translations for editor apps, same rules as the web editors: a person
 // setting a text marks it reviewed; AI drafts are stored as "AI draft" for
@@ -147,7 +148,7 @@ export async function changeSectionTranslation(repo: ContentRepository, who: Edi
   const section = findSection(stagedPages(settings), pageId, sectionId);
   const def = (await stagedTheme(settings)).sections[section.type];
   if (!def) throw new ApiError(409, `The “${section.type}” section isn’t available in this theme.`);
-  if (section.locked && who.user.role !== 'owner') throw new ApiError(403, `Only an owner can edit the locked “${def.name}” section.`);
+  if (section.locked && !await principalCan(repo, who, 'site.layout')) throw new ApiError(403, `Only someone who can arrange and lock sections can edit the locked “${def.name}” section.`);
   const units: Unit[] = translationUnits(def, section.data).map((u) => ({ path: u.path, label: u.label, kind: u.kind as Unit['kind'], source: u.source, hash: u.hash }));
   const cur = section.translations?.[locale] ?? { data: {}, meta: {} };
   const next = { data: { ...cur.data } as Record<string, unknown>, meta: { ...cur.meta } as Meta };

package/src/lib/email/accounts.ts

@@ -30,7 +30,7 @@ export async function reauthenticate(repo:ContentRepository, userId:string, pass
   const user=await repo.getUser(userId); if(!user)return false;
   const auth=await repo.getUserAuth(user.email);return !!auth && verifyPassword(password,auth.passHash);
 }
-export async function issueAccountToken(repo:ContentRepository, data:{purpose:'invite'|'reset';email:string;name?:string;role?:Role;expiresDays?:number}, locals?:unknown) {
+export async function issueAccountToken(repo:ContentRepository, data:{purpose:'invite'|'reset';email:string;name?:string;role?:Role;expiresDays?:number;invitedBy?:string}, locals?:unknown) {
   if (AUTH.provider !== 'builtin') throw new Error('Account access is managed by Clerk.');
   const email=data.email.trim().toLowerCase();
   if(!validAddress(email))throw new Error('Enter a valid email address.');
@@ -43,7 +43,7 @@ export async function issueAccountToken(repo:ContentRepository, data:{purpose:'i
   canonicalOrigin((await repo.getSettings()).siteUrl);
   const id=crypto.randomUUID(),raw=randomBytes(32).toString('base64url');
   const expiresAt=Date.now()+(data.purpose==='reset'?30*60000:(data.expiresDays||7)*86400000);
-  const token={id,hash:sha256(raw),encrypted:encrypt(raw,`token:${id}`,locals),purpose:data.purpose,email,name:data.name?.trim().slice(0,120)||email.split('@')[0],role:data.role||'editor',userId:auth?.user.id||'',expiresAt};
+  const token={id,hash:sha256(raw),encrypted:encrypt(raw,`token:${id}`,locals),purpose:data.purpose,email,name:data.name?.trim().slice(0,120)||email.split('@')[0],role:data.role||'editor',userId:auth?.user.id||'',expiresAt,invitedBy:data.invitedBy||''};
   const job:NewEmailJob={dedupe:`${data.purpose}:${id}`,kind:'auth',recipient:email,payload:JSON.stringify({tokenId:id,purpose:data.purpose}),configVersion:c.version,expiresAt};
   await repo.email.saveToken(token,job);
 }

package/src/lib/email/store.ts

@@ -143,16 +143,16 @@ export class EmailStore {
   }
   async sessionVersion(id: string): Promise<number | null> { const r = await (await this.getDriver()).all('SELECT session_version FROM users WHERE id=?', [id]); return r[0] ? Number(r[0].session_version) : null; }
   async invitations(): Promise<Invitation[]> {
-    return (await (await this.getDriver()).all("SELECT id,email,name,role,expires_at,created_at,CASE WHEN revoked=1 THEN 'revoked' WHEN used_by!='' THEN 'accepted' WHEN expires_at < ? THEN 'expired' ELSE 'pending' END state FROM email_tokens WHERE purpose='invite' ORDER BY created_at DESC LIMIT 100", [Date.now()])).map((r) => ({ id: String(r.id), email:String(r.email),name:String(r.name),role:r.role as Invitation['role'],expiresAt:Number(r.expires_at),createdAt:Number(r.created_at),state:String(r.state) }));
+    return (await (await this.getDriver()).all("SELECT id,email,name,role,expires_at,created_at,invited_by,CASE WHEN revoked=1 THEN 'revoked' WHEN used_by!='' THEN 'accepted' WHEN expires_at < ? THEN 'expired' ELSE 'pending' END state FROM email_tokens WHERE purpose='invite' ORDER BY created_at DESC LIMIT 100", [Date.now()])).map((r) => ({ id: String(r.id), email:String(r.email),name:String(r.name),role:r.role as Invitation['role'],expiresAt:Number(r.expires_at),createdAt:Number(r.created_at),state:String(r.state),invitedBy:String(r.invited_by ?? '') }));
   }
   async token(id: string) { return (await (await this.getDriver()).all('SELECT * FROM email_tokens WHERE id=?', [id]))[0] || null; }
   async tokenByHash(hash: string) { return (await (await this.getDriver()).all('SELECT * FROM email_tokens WHERE token_hash=? AND revoked=0 AND used_by=\'\' AND expires_at > ?', [hash,Date.now()]))[0] || null; }
-  async saveToken(t: { id:string; hash:string; encrypted:string; purpose:'invite'|'reset'; email:string; name:string; role:string; userId:string; expiresAt:number }, j: NewEmailJob) {
+  async saveToken(t: { id:string; hash:string; encrypted:string; purpose:'invite'|'reset'; email:string; name:string; role:string; userId:string; expiresAt:number; invitedBy?:string }, j: NewEmailJob) {
     const d=await this.getDriver();
     await d.batch([
       {sql:"UPDATE email_tokens SET revoked=1,encrypted='' WHERE email=? AND purpose=? AND used_by=''",args:[t.email,t.purpose]},
       {sql:"UPDATE email_jobs SET state='cancelled',payload='',rendered='' WHERE kind='auth' AND recipient=? AND json_extract(NULLIF(payload,''),'$.purpose')=? AND state IN ('queued','retrying','failed','unknown')",args:[t.email,t.purpose]},
-      {sql:'INSERT INTO email_tokens (id,token_hash,encrypted,purpose,email,name,role,user_id,expires_at,created_at) VALUES (?,?,?,?,?,?,?,?,?,?)',args:[t.id,t.hash,t.encrypted,t.purpose,t.email,t.name,t.role,t.userId,t.expiresAt,Date.now()]},
+      {sql:'INSERT INTO email_tokens (id,token_hash,encrypted,purpose,email,name,role,user_id,expires_at,created_at,invited_by) VALUES (?,?,?,?,?,?,?,?,?,?,?)',args:[t.id,t.hash,t.encrypted,t.purpose,t.email,t.name,t.role,t.userId,t.expiresAt,Date.now(),t.invitedBy??'']},
       jobStatement(j),
     ]);
   }

package/src/lib/email/types.ts

@@ -21,7 +21,7 @@ export interface EmailJob {
 }
 export interface NewEmailJob { id?: string; dedupe: string; kind: string; recipient: string; payload: string; configVersion: number; nextAt?: number; expiresAt?: number }
 export type SendResult = { state: 'accepted'; providerId: string } | { state: 'retrying' | 'failed' | 'unknown'; error: string; retryAfter?: number };
-export interface Invitation { id: string; email: string; name: string; role: Role; state: string; expiresAt: number; createdAt: number }
+export interface Invitation { id: string; email: string; name: string; role: Role; state: string; expiresAt: number; createdAt: number; invitedBy: string }
 export interface PublicEmailSettings {
   authProvider?: 'builtin' | 'clerk';
   version: number; config: EmailConfig; provider: Provider | 'none'; configured: boolean; error: string;

package/src/lib/permissions/access.ts

@@ -0,0 +1,73 @@
+import type { Role } from '../schema';
+import type { ContentRepository } from '../repo/types';
+import { OWNER_ENV } from '../auth';
+import { validateRequestSession } from '../auth/request';
+import { ApiError, requireSession } from '../api';
+import { allows, deniedMessage, resolveGrants, type Grants, type Permission } from './catalog';
+
+// Every permission check reads the saved policy fresh (memoised per request
+// only), so a save on Team → Roles applies to everyone's next request,
+// including sessions and editor apps that are already signed in.
+
+export interface Access { userId: string; role: Role; name: string; can(permission: Permission): boolean }
+
+const requestGrants = new WeakMap<object, Promise<Grants>>();
+/** the effective grants, read once per request (or other key object) */
+export function grantsFor(repo: ContentRepository, key?: object): Promise<Grants> {
+  const load = () => repo.permissions.policy().then((p) => resolveGrants(p.overrides));
+  if (!key) return load();
+  let grants = requestGrants.get(key);
+  if (!grants) {
+    grants = load();
+    requestGrants.set(key, grants);
+    grants.catch(() => requestGrants.delete(key));
+  }
+  return grants;
+}
+
+const requestAccess = new WeakMap<Request, Promise<Access | null>>();
+type Cookies = { get(name: string): { value: string } | undefined };
+
+/** who is signed in on this request and what their role allows (null: signed out or removed) */
+export function accessFor(request: Request, cookies: Cookies, repo: ContentRepository): Promise<Access | null> {
+  let access = requestAccess.get(request);
+  if (!access) {
+    access = (async () => {
+      const userId = await validateRequestSession(request, cookies, repo);
+      if (!userId) return null;
+      const user = userId === OWNER_ENV ? null : await repo.getUser(userId);
+      if (userId !== OWNER_ENV && !user) return null;
+      const role: Role = user?.role ?? 'owner';
+      const grants = await grantsFor(repo, request);
+      return { userId, role, name: user?.name ?? 'Owner', can: (p: Permission) => allows(grants, role, p) };
+    })();
+    requestAccess.set(request, access);
+    access.catch(() => requestAccess.delete(request));
+  }
+  return access;
+}
+
+/** an API request from a signed-in person whose role grants this permission */
+export async function requirePermission(request: Request, cookies: Cookies, repo: ContentRepository, permission: Permission): Promise<Access> {
+  await requireSession(request, cookies, repo);
+  const access = await accessFor(request, cookies, repo);
+  if (!access) throw new ApiError(401, 'Sign in to continue.');
+  if (!access.can(permission)) throw new ApiError(403, deniedMessage(permission));
+  return access;
+}
+
+/** the same check for an editor-app principal (role read live per request) */
+export async function principalCan(repo: ContentRepository, who: { user: { role: Role } }, permission: Permission): Promise<boolean> {
+  return allows(await grantsFor(repo, who), who.user.role, permission);
+}
+export async function requirePrincipal(repo: ContentRepository, who: { user: { role: Role } }, permission: Permission) {
+  if (!await principalCan(repo, who, permission)) throw new ApiError(403, deniedMessage(permission));
+}
+
+/** admin pages: a plain 403 when this person's role lacks the permission (null: allowed) */
+export async function forbiddenUnless(request: Request, cookies: Cookies, repo: ContentRepository, ...permissions: Permission[]): Promise<Response | null> {
+  const access = await accessFor(request, cookies, repo);
+  const missing = permissions.find((p) => !access?.can(p));
+  if (!missing) return null;
+  return new Response(deniedMessage(missing), { status: 403, headers: { 'Content-Type': 'text/plain; charset=utf-8', 'Cache-Control': 'no-store' } });
+}

package/src/lib/permissions/catalog.ts

@@ -0,0 +1,147 @@
+import type { Role } from '../schema';
+
+// What each role may do. The catalog and its defaults live in code; the
+// owner's choices on Team → Roles are stored as differences from these
+// defaults (lib/permissions/store.ts), so a framework update that changes a
+// default never overwrites a deliberate choice, and "Restore defaults" just
+// drops the differences.
+//
+// Defaults reproduce the access ACMS had before roles became editable: every
+// signed-in staff member could do everyday work, owners did the rest. The one
+// deliberate change is that administrators can invite people.
+//
+// Owners always have every permission. Locked permissions stay owner-only and
+// can't be granted, so an owner can never lock themselves out of recovery.
+
+/** roles whose permissions an owner can change */
+export const EDITABLE_ROLES = ['administrator', 'editor', 'author', 'contributor'] as const;
+export type EditableRole = typeof EDITABLE_ROLES[number];
+
+const STAFF: readonly EditableRole[] = EDITABLE_ROLES;
+const NONE: readonly EditableRole[] = [];
+
+export interface PermissionDef {
+  key: string;
+  label: string;
+  description: string;
+  /** default holders (owners hold everything) */
+  defaults: readonly EditableRole[];
+  /** owner-only, never grantable */
+  locked?: boolean;
+  /** grants code, credentials or people: the page asks owners to grant with care */
+  sensitive?: boolean;
+}
+export interface PermissionArea { id: string; label: string; permissions: readonly PermissionDef[] }
+
+export const PERMISSION_AREAS = [
+  { id: 'content', label: 'Content', permissions: [
+    { key: 'content.edit', label: 'Create and edit content', description: 'Write posts, pages and events, stage edits to published ones, and manage tags and snippets.', defaults: STAFF },
+    { key: 'content.publish', label: 'Publish content', description: 'Publish, schedule and unpublish, and put staged edits live.', defaults: STAFF },
+    { key: 'content.delete', label: 'Delete content', description: 'Delete posts, pages and events.', defaults: STAFF },
+  ] },
+  { id: 'media', label: 'Media', permissions: [
+    { key: 'media.upload', label: 'Upload media', description: 'Add images and files, and edit their descriptions.', defaults: STAFF },
+    { key: 'media.delete', label: 'Delete media', description: 'Remove files from the media library.', defaults: STAFF },
+  ] },
+  { id: 'forms', label: 'Forms', permissions: [
+    { key: 'forms.manage', label: 'Manage forms', description: 'Create, edit, publish and archive forms.', defaults: STAFF },
+    { key: 'forms.responses', label: 'View form responses', description: 'Read, export and delete what people submitted. In the editor app, responses also stay limited to administrators.', defaults: STAFF },
+  ] },
+  { id: 'site', label: 'Site', permissions: [
+    { key: 'site.links', label: 'Edit the links page', description: 'Add, change and reorder links-page blocks. In the editor app, HTML blocks stay limited to administrators.', defaults: STAFF },
+    { key: 'site.navigation', label: 'Edit navigation', description: 'Change header, footer and social menus.', defaults: STAFF },
+    { key: 'site.sections', label: 'Edit page sections', description: 'Change section text and pictures and publish single sections. Never layout or locked sections.', defaults: STAFF },
+    { key: 'site.design', label: 'Theme, colours and logo', description: 'Pick the theme, colours, fonts, logo and favicon, share design previews and publish design changes.', defaults: STAFF },
+    { key: 'site.layout', label: 'Arrange and lock sections', description: 'Add, move, restyle and lock page sections, edit locked ones, and import or export themes.', defaults: NONE },
+    { key: 'site.settings', label: 'General settings', description: 'Site title, timezone and language, the announcement bar and redirects.', defaults: STAFF },
+    { key: 'site.code', label: 'Code injection and analytics', description: 'Add scripts to every page and configure analytics and tracking pixels.', defaults: NONE, sensitive: true },
+  ] },
+  { id: 'scheduling', label: 'Scheduling', permissions: [
+    { key: 'schedule.bookings', label: 'Manage bookings', description: 'See bookings, approve, reschedule, cancel and block time.', defaults: STAFF },
+    { key: 'schedule.manage', label: 'Manage rooms and calendars', description: 'Rooms, booking types, opening hours, places and calendars. The editor app also follows Mobile app → schedule access.', defaults: STAFF },
+  ] },
+  { id: 'team', label: 'Team', permissions: [
+    { key: 'team.invite', label: 'Invite people', description: 'Send, resend and revoke invitations for roles below their own.', defaults: ['administrator'], sensitive: true },
+    { key: 'team.manage', label: 'Manage members', description: 'Edit, re-assign and remove people in roles below their own.', defaults: NONE, sensitive: true },
+  ] },
+  { id: 'advanced', label: 'Integrations and services', permissions: [
+    { key: 'integrations.manage', label: 'API keys and webhooks', description: 'Create and revoke API keys, webhooks, the drafts API and design keys.', defaults: NONE, sensitive: true },
+    { key: 'services.manage', label: 'Connected services', description: 'Email delivery, AI, live streaming, monitoring, push notifications and the mobile app.', defaults: NONE, sensitive: true },
+    { key: 'data.import', label: 'Import and export content', description: 'Bring in content from other platforms and download exports.', defaults: NONE, sensitive: true },
+  ] },
+  { id: 'owner', label: 'Owner only', permissions: [
+    { key: 'roles.manage', label: 'Change role permissions', description: 'Edit this page. Always owner-only.', defaults: NONE, locked: true },
+    { key: 'data.backup', label: 'Backup and restore', description: 'Download full backups and restore the site from one. Always owner-only.', defaults: NONE, locked: true },
+  ] },
+] as const satisfies readonly PermissionArea[];
+
+export type Permission = typeof PERMISSION_AREAS[number]['permissions'][number]['key'];
+export const PERMISSIONS: readonly PermissionDef[] = (PERMISSION_AREAS as readonly PermissionArea[]).flatMap((a) => [...a.permissions]);
+const BY_KEY = new Map<string, PermissionDef>(PERMISSIONS.map((p) => [p.key, p]));
+export const permissionDef = (key: string) => BY_KEY.get(key);
+export const isPermission = (key: string): key is Permission => BY_KEY.has(key);
+
+/** grants that differ from the defaults: { editor: { 'site.design': true } } */
+export type PolicyOverrides = Partial<Record<EditableRole, Partial<Record<Permission, boolean>>>>;
+/** every editable role's full grant set */
+export type Grants = Record<EditableRole, Record<Permission, boolean>>;
+
+export const isEditableRole = (role: string): role is EditableRole => (EDITABLE_ROLES as readonly string[]).includes(role);
+export const defaultGrant = (role: EditableRole, key: Permission) => (BY_KEY.get(key)!.defaults as readonly string[]).includes(role);
+
+/** the effective grants: defaults, then overrides (unknown keys and locked ones ignored) */
+export function resolveGrants(overrides: PolicyOverrides = {}): Grants {
+  const out = {} as Grants;
+  for (const role of EDITABLE_ROLES) {
+    out[role] = {} as Record<Permission, boolean>;
+    for (const p of PERMISSIONS) {
+      const key = p.key as Permission;
+      const chosen = overrides[role]?.[key];
+      out[role][key] = p.locked ? false : typeof chosen === 'boolean' ? chosen : defaultGrant(role, key);
+    }
+  }
+  return out;
+}
+
+/** a full grant set back to the minimal difference from defaults */
+export function diffFromDefaults(grants: Partial<Record<string, Partial<Record<string, unknown>>>>): PolicyOverrides {
+  const out: PolicyOverrides = {};
+  for (const role of EDITABLE_ROLES) {
+    for (const p of PERMISSIONS) {
+      if (p.locked) continue;
+      const value = grants[role]?.[p.key];
+      if (typeof value !== 'boolean' || value === defaultGrant(role, p.key as Permission)) continue;
+      (out[role] ??= {})[p.key as Permission] = value;
+    }
+  }
+  return out;
+}
+
+export function deniedMessage(permission: string) {
+  return `Your role doesn’t include “${BY_KEY.get(permission)?.label ?? permission}”. Ask an owner if you need it.`;
+}
+
+export function allows(grants: Grants, role: Role, key: Permission): boolean {
+  if (role === 'owner') return true;
+  return isEditableRole(role) ? grants[role][key] === true : false;
+}
+
+/** highest first; people only invite or manage roles below their own */
+export const ROLE_RANK: Record<Role, number> = { owner: 4, administrator: 3, editor: 2, author: 1, contributor: 0 };
+export const ROLES_BY_RANK: readonly Role[] = ['owner', 'administrator', 'editor', 'author', 'contributor'];
+export function assignableRoles(role: Role): Role[] {
+  if (role === 'owner') return [...ROLES_BY_RANK];
+  return ROLES_BY_RANK.filter((r) => ROLE_RANK[r] < ROLE_RANK[role]);
+}
+
+/** human summary of what changed between two grant sets (audit + review dialog) */
+export function describeChanges(before: Grants, after: Grants): Array<{ role: EditableRole; permission: Permission; granted: boolean }> {
+  const out: Array<{ role: EditableRole; permission: Permission; granted: boolean }> = [];
+  for (const role of EDITABLE_ROLES) {
+    for (const p of PERMISSIONS) {
+      const key = p.key as Permission;
+      if (before[role][key] !== after[role][key]) out.push({ role, permission: key, granted: after[role][key] });
+    }
+  }
+  return out;
+}

package/src/lib/permissions/migration.ts

@@ -0,0 +1,17 @@
+// Team → Roles: the owner's permission choices (stored as differences from
+// the code defaults) with a revision for conflict-safe saves, an audit trail,
+// and who sent each invitation (admins can invite now, so it matters).
+// Backups don't carry this table: restoring old content never changes who
+// can do what.
+export const ROLES_MIGRATION = {
+  version: 51,
+  statements: [
+    `CREATE TABLE role_policy (id INTEGER PRIMARY KEY CHECK (id = 1), overrides TEXT NOT NULL DEFAULT '{}', revision INTEGER NOT NULL DEFAULT 0,
+      updated_by TEXT NOT NULL DEFAULT '', updated_at INTEGER NOT NULL DEFAULT 0)`,
+    `INSERT INTO role_policy (id) VALUES (1)`,
+    `CREATE TABLE role_policy_log (id TEXT PRIMARY KEY, revision INTEGER NOT NULL, actor TEXT NOT NULL, changes TEXT NOT NULL, created_at INTEGER NOT NULL)`,
+    `CREATE INDEX role_policy_log_created ON role_policy_log(created_at)`,
+    `ALTER TABLE auth_invitations ADD COLUMN invited_by TEXT NOT NULL DEFAULT ''`,
+    `ALTER TABLE email_tokens ADD COLUMN invited_by TEXT NOT NULL DEFAULT ''`,
+  ],
+};

package/src/lib/permissions/service.ts

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+import type { ContentRepository } from '../repo/types';
+import { OWNER_ENV } from '../auth';
+import { ApiError } from '../api';
+import { roleLabels, roleSummaries } from '../roles';
+import type { Role } from '../schema';
+import {
+  PERMISSION_AREAS, ROLES_BY_RANK, describeChanges, diffFromDefaults, isEditableRole, isPermission, resolveGrants,
+  type Grants,
+} from './catalog';
+import type { Access } from './access';
+
+// Team → Roles: the page's state and its one write. The page edits a local
+// draft; nothing changes for anyone until Save sends the whole grant set,
+// which replaces the policy atomically (or fails on a newer revision).
+
+export const RolesSave = z.object({
+  revision: z.number().int().nonnegative(),
+  grants: z.record(z.record(z.boolean())),
+}).strict();
+
+const actorName = (id: string, names: Map<string, string>) => (id === OWNER_ENV ? 'Owner' : names.get(id) ?? 'Removed user');
+
+export async function rolesState(repo: ContentRepository, access: Access) {
+  const [policy, users, history] = await Promise.all([repo.permissions.policy(), repo.listUsers(), repo.permissions.history(20)]);
+  const names = new Map(users.map((u) => [u.id, u.name]));
+  const members = (role: Role) => users.filter((u) => u.role === role).length;
+  return {
+    revision: policy.revision,
+    canEdit: access.role === 'owner',
+    updatedAt: policy.updatedAt || null,
+    updatedBy: policy.updatedBy ? actorName(policy.updatedBy, names) : null,
+    roles: ROLES_BY_RANK.map((role) => ({ role, label: roleLabels[role], summary: roleSummaries[role], members: members(role), editable: isEditableRole(role) })),
+    areas: PERMISSION_AREAS.map((a) => ({
+      id: a.id, label: a.label,
+      permissions: a.permissions.map((p) => ({ key: p.key, label: p.label, description: p.description, locked: 'locked' in p && p.locked === true, sensitive: 'sensitive' in p && p.sensitive === true })),
+    })),
+    grants: resolveGrants(policy.overrides),
+    defaults: resolveGrants({}),
+    history: history.map((h) => ({ id: h.id, at: h.createdAt, by: actorName(h.actor, names), changes: h.changes })),
+  };
+}
+export type RolesState = Awaited<ReturnType<typeof rolesState>>;
+
+/** replace the whole policy; unknown roles or permissions are a client bug, not silently dropped */
+export async function saveRoles(repo: ContentRepository, access: Access, input: z.infer<typeof RolesSave>) {
+  if (access.role !== 'owner') throw new ApiError(403, 'Only owners can change role permissions.');
+  for (const [role, grants] of Object.entries(input.grants)) {
+    if (!isEditableRole(role)) throw new ApiError(400, `Unknown or fixed role “${role}”.`);
+    for (const key of Object.keys(grants)) if (!isPermission(key)) throw new ApiError(400, `Unknown permission “${key}”.`);
+  }
+  const current = await repo.permissions.policy();
+  if (current.revision !== input.revision) throw new ApiError(409, 'Permissions were changed by someone else since you opened this page.');
+  const overrides = diffFromDefaults(input.grants);
+  const changes = describeChanges(resolveGrants(current.overrides), resolveGrants(overrides) as Grants);
+  if (!changes.length) return current.revision;
+  return repo.permissions.save(overrides, input.revision, access.userId, changes);
+}
+

package/src/lib/permissions/store.ts

@@ -0,0 +1,54 @@
+import type { SqlDriver } from '../repo/sql';
+import { ApiError } from '../api';
+import { diffFromDefaults, type PolicyOverrides } from './catalog';
+
+export interface RolePolicy { overrides: PolicyOverrides; revision: number; updatedBy: string; updatedAt: number }
+export interface RolePolicyChange { id: string; revision: number; actor: string; changes: Array<{ role: string; permission: string; granted: boolean }>; createdAt: number }
+
+function parseOverrides(raw: unknown): PolicyOverrides {
+  // a corrupt row falls back to the defaults rather than locking everyone out
+  try {
+    const value = JSON.parse(String(raw ?? '{}'));
+    return value && typeof value === 'object' && !Array.isArray(value) ? diffFromDefaults(value) : {};
+  } catch { return {}; }
+}
+
+export class PermissionStore {
+  constructor(private driver: () => Promise<SqlDriver>) {}
+
+  async policy(): Promise<RolePolicy> {
+    const r = (await (await this.driver()).all('SELECT overrides, revision, updated_by, updated_at FROM role_policy WHERE id = 1'))[0];
+    if (!r) return { overrides: {}, revision: 0, updatedBy: '', updatedAt: 0 };
+    return { overrides: parseOverrides(r.overrides), revision: Number(r.revision), updatedBy: String(r.updated_by), updatedAt: Number(r.updated_at) };
+  }
+
+  /**
+   * Replace the whole policy in one batch. A save made against an older
+   * revision fails the revision_checks CHECK, so the batch (policy + audit
+   * row) rolls back and nothing changes.
+   */
+  async save(overrides: PolicyOverrides, expectedRevision: number, actor: string, changes: RolePolicyChange['changes']): Promise<number> {
+    const now = Date.now();
+    try {
+      await (await this.driver()).batch([
+        { sql: 'INSERT INTO revision_checks (expected, actual) SELECT ?, revision FROM role_policy WHERE id = 1', args: [expectedRevision] },
+        { sql: 'DELETE FROM revision_checks' },
+        { sql: 'UPDATE role_policy SET overrides = ?, revision = revision + 1, updated_by = ?, updated_at = ? WHERE id = 1', args: [JSON.stringify(diffFromDefaults(overrides)), actor, now] },
+        { sql: 'INSERT INTO role_policy_log (id, revision, actor, changes, created_at) VALUES (?, ?, ?, ?, ?)', args: [crypto.randomUUID(), expectedRevision + 1, actor, JSON.stringify(changes), now] },
+      ]);
+    } catch (e) {
+      if (/CHECK constraint/i.test(String(e))) throw new ApiError(409, 'Permissions were changed by someone else since you opened this page.');
+      throw e;
+    }
+    return expectedRevision + 1;
+  }
+
+  async history(limit = 20): Promise<RolePolicyChange[]> {
+    const rows = await (await this.driver()).all('SELECT * FROM role_policy_log ORDER BY created_at DESC LIMIT ?', [limit]);
+    return rows.map((r) => {
+      let changes: RolePolicyChange['changes'] = [];
+      try { const parsed = JSON.parse(String(r.changes)); if (Array.isArray(parsed)) changes = parsed; } catch { /* keep the entry, drop its details */ }
+      return { id: String(r.id), revision: Number(r.revision), actor: String(r.actor), changes, createdAt: Number(r.created_at) };
+    });
+  }
+}

package/src/lib/repo/migrations.ts

@@ -6,6 +6,7 @@ import { PUSH_MIGRATION } from '../push/migration';
 import { EDITOR_MIGRATION, EDITOR_GRACE_MIGRATION } from '../editor/migration';
 import { CALENDAR_SETTINGS_MIGRATION, ROOM_HOLD_MIGRATION } from '../calendar/migration';
 import { PLACES_MIGRATION } from '../maps/migration';
+import { ROLES_MIGRATION } from '../permissions/migration';
 // Versioned schema migrations shared by the two SQLite-dialect adapters
 // (D1 and libSQL). Applied versions are recorded in the `migrations` table;
 // each adapter's runner applies whatever is newer, in order, at startup.
@@ -630,6 +631,7 @@ export const MIGRATIONS: Migration[] = [
       last_key TEXT NOT NULL DEFAULT '', last_error TEXT NOT NULL DEFAULT '', failed_at INTEGER NOT NULL DEFAULT 0)`,
     `INSERT INTO backup_state (id) VALUES (1)`,
   ] },
+  ROLES_MIGRATION,
 ];
 
 export const LATEST_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;