@acms-subir/core 0.3.12 → 0.3.13

package/src/lib/repo/sql.ts

@@ -5,6 +5,7 @@ import { GuestStore } from '../mobile/guest-store';
 import { LiveStore } from '../live/store';
 import { PushStore } from '../push/store';
 import { EditorStore } from '../editor/store';
+import { PermissionStore } from '../permissions/store';
 import { BackupStore } from '../backup/store';
 import { LiveConfig } from '../live/types';
 import { ApiError } from '../api';
@@ -269,6 +270,7 @@ export class SqlRepository implements ContentRepository {
   readonly push: PushStore;
   readonly editor: EditorStore;
   readonly backups: BackupStore;
+  readonly permissions: PermissionStore;
 
   constructor(driver: SqlDriver | (() => Promise<SqlDriver>)) {
     this.ready = this.init(driver);
@@ -280,6 +282,7 @@ export class SqlRepository implements ContentRepository {
     this.backups = new BackupStore(async () => { await this.ready; return this.driver; });
     this.auth = new AuthStore(async () => { await this.ready; return this.driver; });
     this.email = new EmailStore(async () => { await this.ready; return this.driver; });
+    this.permissions = new PermissionStore(async () => { await this.ready; return this.driver; });
   }
 
   private async init(driver: SqlDriver | (() => Promise<SqlDriver>)) {

package/src/lib/repo/types.ts

@@ -8,6 +8,7 @@ import type { BookingRequest } from '../backup/content';
 import type { EmailStore } from '../email/store';
 import type { PushStore } from '../push/store';
 import type { EditorStore } from '../editor/store';
+import type { PermissionStore } from '../permissions/store';
 export interface ImportRun { id: string; source: string; label: string; status: 'running' | 'done' | 'undone'; report: Record<string, unknown>; createdAt: number; updatedAt: number }
 export type ImportRecordKind = 'post' | 'page' | 'user' | 'tag' | 'media' | 'redirect' | 'nav';
 export interface ImportRecord { runId: string; kind: ImportRecordKind; sourceId: string; acmsId: string; action: 'created' | 'updated'; stamp: number }
@@ -60,6 +61,7 @@ export interface ContentRepository {
   readonly live: LiveStore;
   readonly push: PushStore;
   readonly editor: EditorStore;
+  readonly permissions: PermissionStore;
   // Bounded public catalog; fetch limit + 1 IDs without loading every body.
   listPublicContent(options: { page: number; limit: number; kind?: 'post' | 'page'; collection?: string; locale?: string; collections: string[]; defaultLocale: string }): Promise<{ id: string; kind: 'post' | 'page' }[]>;
   exportBookingState(): Promise<{ bookings: Booking[]; bookingRequests: BookingRequest[] }>;

package/src/lib/roles.ts

@@ -3,3 +3,12 @@ import type { Role } from './schema';
 export const roleLabels: Record<Role, string> = {
   contributor: 'Contributor', author: 'Author', editor: 'Editor', administrator: 'Administrator', owner: 'Owner',
 };
+
+/** one line per role for pickers (the defaults; owners can change what each role does on Team → Roles) */
+export const roleSummaries: Record<Role, string> = {
+  owner: 'Everything, including roles, backups and sign-in settings.',
+  administrator: 'Runs the site day to day and invites people.',
+  editor: 'Writes, edits and publishes content.',
+  author: 'Writes and publishes content.',
+  contributor: 'Writes and edits content.',
+};

package/src/pages/admin/c/[collection]/index.astro

@@ -5,6 +5,7 @@ import ContentList, { type ContentItem } from '../../../../components/ContentLis
 import { getRepo } from '../../../../lib/repo';
 import { slugify, type Status } from '../../../../lib/schema';
 import { CONTENT, collectionUrl } from '../../../../lib/content';
+import { forbiddenUnless } from '../../../../lib/permissions/access';
 
 // One list page for every collection; [collection] is the config key from
 // acms({ content.collections }). Unknown keys 404 — content in removed
@@ -21,6 +22,8 @@ if (Astro.request.method === 'POST') {
   const form = await Astro.request.formData();
   const op = String(form.get('op'));
   if (op === 'create') {
+    const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, 'content.edit');
+    if (denied) return denied;
     const title = String(form.get('title') || 'Untitled');
     let slug = slugify(title);
     let n = 1;
@@ -32,6 +35,9 @@ if (Astro.request.method === 'POST') {
   if (op === 'bulk') {
     const to = String(form.get('to'));
     const ids = form.getAll('ids').map(String).filter(Boolean);
+    const touchesLive = to === 'published' || (await Promise.all(ids.map((id) => repo.getPost(id)))).some((p) => p?.status === 'published' || p?.status === 'scheduled');
+    const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, to === 'delete' ? 'content.delete' : touchesLive ? 'content.publish' : 'content.edit');
+    if (denied) return denied;
     for (const id of ids) {
       const p = await repo.getPost(id);
       if (!p || p.collection !== key) continue;

package/src/pages/admin/calendar/bookings.astro

@@ -15,12 +15,14 @@ import { resolveConfig } from '../../../lib/email/config';
 import { emailReadiness } from '../../../lib/email/readiness';
 import { siteOrigin } from '../../../lib/seo';
 import { waitUntilFrom } from '../../../lib/webhooks';
+import { forbiddenUnless } from '../../../lib/permissions/access';
 
 // Bookings (mockup I): Cal.com-style tabs, an agenda by day with pending
 // requests first, a Day view with one column per resource, a details panel
 // (?b=<id>) with private notes, plus Block time and Add booking.
 if (!CALENDAR.enabled) return new Response(null, { status: 404 });
 const repo = await getRepo(Astro.locals);
+{ const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, 'schedule.bookings'); if (denied) return denied; }
 const settings = await repo.getSettings();
 const tz = settings.timezone || 'UTC';
 const f = fmt(settings, tz);

package/src/pages/admin/calendar/events/index.astro

@@ -19,6 +19,8 @@ import { siteOrigin } from '../../../../lib/seo';
 import { siteLocale } from '../../../../lib/dates';
 import { waitUntilFrom } from '../../../../lib/webhooks';
 import { invalidateRedirectCache } from '../../../../middleware';
+import { forbiddenUnless } from '../../../../lib/permissions/access';
+import type { Permission } from '../../../../lib/permissions/catalog';
 
 // Schedule → List: upcoming first, grouped by the month each event next
 // happens. Subscribed calendars appear as read-only rows with a "Make an
@@ -63,6 +65,15 @@ if (Astro.request.method === 'POST') {
   const form = await Astro.request.formData();
   const op = String(form.get('op'));
   const hookOpts = { origin: siteOrigin(settings, Astro.url), waitUntil: waitUntilFrom(Astro.locals), onRedirect: invalidateRedirectCache };
+  // create, copy and import make drafts; bulk status changes that touch live events need Publish
+  let needs: Permission = 'content.edit';
+  if (op === 'bulk') {
+    const to = String(form.get('to'));
+    const before = await Promise.all(form.getAll('ids').map(String).filter(Boolean).map((id) => repo.getEvent(id)));
+    needs = to === 'delete' ? 'content.delete' : to === 'published' || before.some((e) => e?.status === 'published' || e?.status === 'scheduled') ? 'content.publish' : 'content.edit';
+  }
+  const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, needs);
+  if (denied) return denied;
 
   if (op === 'create') {
     const title = String(form.get('title') || 'Untitled event').slice(0, 300);

package/src/pages/admin/calendar/resources/[id].astro

@@ -12,11 +12,13 @@ import { siteOrigin } from '../../../../lib/seo';
 import { approvalShort, linkApproval } from '../../../../lib/booking/approval';
 import { eventHolds } from '../../../../lib/booking/holds';
 import { fmt } from '../../../../lib/booking/view';
+import { forbiddenUnless } from '../../../../lib/permissions/access';
 
 // One resource: details, weekly hours, date overrides, calendars that block
 // time, who gets notified, the staff feed, and its booking links.
 if (!bookingsEnabled()) return new Response(null, { status: 404 });
 const repo = await getRepo(Astro.locals);
+if (Astro.request.method === 'POST') { const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, 'schedule.manage'); if (denied) return denied; }
 const id = Astro.params.id!;
 let resource = await repo.getResource(id);
 if (!resource) return new Response(null, { status: 404 });

package/src/pages/admin/calendar/resources/index.astro

@@ -10,12 +10,14 @@ import { DEFAULT_HOURS, int } from '../../../../lib/booking/forms';
 import { availabilityContext } from '../../../../lib/booking/service';
 import { describeLink, nextOpenings } from '../../../../lib/booking/availability';
 import { fmt } from '../../../../lib/booking/view';
+import { forbiddenUnless } from '../../../../lib/permissions/access';
 
 // Bookings → Rooms & people: everything people can book (rooms, people,
 // vehicles, equipment). Each row shows its booking links, whether they
 // confirm instantly, and when it's next free.
 if (!bookingsEnabled()) return new Response(null, { status: 404 });
 const repo = await getRepo(Astro.locals);
+if (Astro.request.method === 'POST') { const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, 'schedule.manage'); if (denied) return denied; }
 const settings = await repo.getSettings();
 
 if (Astro.request.method === 'POST') {

package/src/pages/admin/calendar/resources/link.astro

@@ -10,12 +10,14 @@ import { describeLink } from '../../../../lib/booking/availability';
 import { siteOrigin } from '../../../../lib/seo';
 import { APPROVAL_LABEL, linkApproval, siteApproval } from '../../../../lib/booking/approval';
 import { ApprovalRules } from '../../../../lib/schema';
+import { forbiddenUnless } from '../../../../lib/permissions/access';
 
 // One booking link: how people book, how bookings get approved (follow the
 // site setting, or its own mode + rules), when it's open (within the room or
 // person's hours), and what we ask.
 if (!bookingsEnabled()) return new Response(null, { status: 404 });
 const repo = await getRepo(Astro.locals);
+if (Astro.request.method === 'POST') { const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, 'schedule.manage'); if (denied) return denied; }
 const resource = await repo.getResource(Astro.params.id!);
 let link = resource ? await repo.getBookingLink(Astro.params.link!) : null;
 if (!resource || !link || link.resourceId !== resource.id) return new Response(null, { status: 404 });

package/src/pages/admin/calendar/settings.astro

@@ -13,6 +13,7 @@ import { placeUsage, savePlace } from '../../../lib/maps/places';
 import { parseMapLink } from '../../../lib/maps/parse';
 import { ApiError } from '../../../lib/api';
 import type { Place } from '../../../lib/schema';
+import { forbiddenUnless } from '../../../lib/permissions/access';
 
 // Calendar settings — one page behind the ⚙ on Schedule and Bookings:
 // calendars (groups + colors), saved places (picked in an event's Where),
@@ -22,6 +23,7 @@ import type { Place } from '../../../lib/schema';
 if (!CALENDAR.enabled) return new Response(null, { status: 404, statusText: 'Not found' });
 
 const repo = await getRepo(Astro.locals);
+if (Astro.request.method === 'POST') { const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, 'schedule.manage'); if (denied) return denied; }
 const settings = await repo.getSettings();
 const origin = siteOrigin(settings, Astro.url);
 const back = (notice?: string, hash = '') => Astro.redirect(`/admin/calendar/settings${notice ? `?notice=${encodeURIComponent(notice)}` : ''}${hash}`);

package/src/pages/admin/email.astro

@@ -2,9 +2,9 @@
 import Admin from '../../layouts/Admin.astro';
 import EmailSettings from '../../components/EmailSettings';
 import { getRepo } from '../../lib/repo';
-import { requireSession } from '../../lib/api';
+import { requirePermission } from '../../lib/permissions/access';
 const repo=await getRepo(Astro.locals);
-try { await requireSession(Astro.request,Astro.cookies,repo,true); }
+try { await requirePermission(Astro.request, Astro.cookies, repo, 'services.manage'); }
 catch { return new Response('Only owners can manage email.',{status:403}); }
 ---
 <Admin title="Email" section="settings">

package/src/pages/admin/forms/[id]/share.astro

@@ -7,8 +7,10 @@ import { escapeForm } from '../../../../lib/forms/fields';
 import { siteOrigin } from '../../../../lib/seo';
 import { CONTENT } from '../../../../lib/content';
 import '../../../../styles/forms-admin.css';
+import { forbiddenUnless } from '../../../../lib/permissions/access';
 
 const repo = await getRepo(Astro.locals);
+if (Astro.request.method === 'POST') { const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, 'forms.manage'); if (denied) return denied; }
 let form = await repo.forms.get(Astro.params.id || '');
 if (!form || form.kind !== 'form') return new Response(null, { status: 404 });
 Astro.response.headers.set('Cache-Control', 'private, no-store');

package/src/pages/admin/forms/[id]/submissions.astro

@@ -8,8 +8,10 @@ import { csv, displayAnswers, formVersion } from '../../../../lib/forms/service'
 import { answerFields, relativeTime, versionLabeler, wideRows } from '../../../../lib/forms/export';
 import type { FormSubmission } from '../../../../lib/forms/schema';
 import '../../../../styles/forms-admin.css';
+import { forbiddenUnless } from '../../../../lib/permissions/access';
 
 const repo = await getRepo(Astro.locals);
+{ const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, 'forms.responses'); if (denied) return denied; }
 const form = await repo.forms.get(Astro.params.id || '');
 if (!form || form.kind !== 'form') return new Response(null, { status: 404 });
 Astro.response.headers.set('Cache-Control', 'private, no-store');

package/src/pages/admin/forms/index.astro

@@ -6,8 +6,10 @@ import { FormDefinition, starter, type SavedForm } from '../../../lib/forms/sche
 import { readForm } from '../../../lib/forms/http';
 import { relativeTime } from '../../../lib/forms/export';
 import '../../../styles/forms-admin.css';
+import { forbiddenUnless } from '../../../lib/permissions/access';
 
 const repo = await getRepo(Astro.locals);
+if (Astro.request.method === 'POST') { const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, 'forms.manage'); if (denied) return denied; }
 Astro.response.headers.set('Cache-Control', 'private, no-store');
 const BLANK = { title: '', intro: '', submitLabel: '', confirmation: 'Thank you. Your response has been received.', fields: [] };
 const STARTERS = [

package/src/pages/admin/import.astro

@@ -3,14 +3,11 @@ import Admin from '../../layouts/Admin.astro';
 import ImportExport from '../../components/import/ImportExport';
 import { AUTH } from '../../lib/auth/config';
 import { getRepo } from '../../lib/repo';
-import { OWNER_ENV } from '../../lib/auth';
-import { validateRequestSession } from '../../lib/auth/request';
+import { accessFor } from '../../lib/permissions/access';
 
-// owner-only: an import can create accounts and change site settings
+// an import can create accounts and change site settings (owners by default)
 const repo = await getRepo(Astro.locals);
-const sessionUserId = await validateRequestSession(Astro.request, Astro.cookies, Astro.locals);
-const sessionUser = sessionUserId && sessionUserId !== OWNER_ENV ? await repo.getUser(sessionUserId) : null;
-if (sessionUserId !== OWNER_ENV && sessionUser?.role !== 'owner') return Astro.redirect('/admin/settings');
+if (!(await accessFor(Astro.request, Astro.cookies, repo))?.can('data.import')) return Astro.redirect('/admin/settings');
 const tab = Astro.url.searchParams.get('tab');
 ---
 <Admin title="Import & export" section="settings" wide>

package/src/pages/admin/integrations.astro

@@ -3,8 +3,7 @@ import Admin from '../../layouts/Admin.astro';
 import Modal from '../../components/Modal.astro';
 import { getRepo } from '../../lib/repo';
 import { API_SCOPES, WEBHOOK_EVENTS, type ApiScope } from '../../lib/schema';
-import { OWNER_ENV } from '../../lib/auth';
-import { validateRequestSession } from '../../lib/auth/request';
+import { accessFor } from '../../lib/permissions/access';
 import { CALENDAR, bookingsEnabled } from '../../lib/calendar/config';
 import { issueApiKey } from '../../lib/api-keys';
 import { attemptDelivery, generateWebhookSecret, validateWebhookUrl } from '../../lib/webhooks';
@@ -16,9 +15,8 @@ import { PROVIDERS } from '../../lib/maps/providers';
 // Site-wide integrations. Owners manage keys and webhook subscriptions;
 // calendar-specific feeds and API help appear only when enabled.
 const repo = await getRepo(Astro.locals);
-const sessionId = (await validateRequestSession(Astro.request, Astro.cookies, Astro.locals));
-const me = sessionId && sessionId !== OWNER_ENV ? await repo.getUser(sessionId) : null;
-const isOwner = sessionId === OWNER_ENV || me?.role === 'owner';
+// owners, or roles granted “API keys and webhooks” on Team → Roles
+const canManage = (await accessFor(Astro.request, Astro.cookies, repo))?.can('integrations.manage') ?? false;
 const settings = await repo.getSettings();
 let notice = '';
 let error = '';
@@ -27,7 +25,7 @@ let newSecret = '';
 const dev = import.meta.env.DEV;
 
 if (Astro.request.method === 'POST') {
-  if (!isOwner) return new Response('Owners only', { status: 403 });
+  if (!canManage) return new Response('Your role doesn’t include “API keys and webhooks”.', { status: 403 });
   const form = await Astro.request.formData();
   const op = String(form.get('op'));
   try {
@@ -105,7 +103,7 @@ const SCOPE_LABEL: Record<string, string> = {
   </div>
   {notice && <p class="notice" role="status">{notice}</p>}
   {error && <p class="notice warn" role="alert">{error}</p>}
-  {!isOwner && <p class="notice">Only owners can create keys or webhooks.</p>}
+  {!canManage && <p class="notice">Your role can view integrations but not create keys or webhooks.</p>}
   {newKey && (
     <div class="notice reveal">
       <b>Copy this key now — it won’t be shown again.</b>
@@ -124,20 +122,20 @@ const SCOPE_LABEL: Record<string, string> = {
   <div class="res-grid">
     <div>
       <section class="card card-pad">
-        <div class="card-head"><b>API keys</b>{isOwner && <button class="btn sm" type="button" data-modal="new-key">New key</button>}</div>
+        <div class="card-head"><b>API keys</b>{canManage && <button class="btn sm" type="button" data-modal="new-key">New key</button>}</div>
         {keys.length === 0 && <p class="hint">No keys yet. Public calendars and bookings don’t need one — keys unlock private data and changes.</p>}
         {keys.map((k) => (
           <div class="int-row">
             <div><b>{k.name}</b> <code>{k.prefix}…</code><div class="int-scopes">{k.scopes.map((s) => <span class="pill lang">{s}</span>)}</div></div>
             <span class="hint">used {ago(k.lastUsedAt)}</span>
-            {isOwner && <form method="post"><input type="hidden" name="op" value="revoke" /><input type="hidden" name="id" value={k.id} /><button class="btn sm ghost danger" data-confirm={`Revoke “${k.name}”?`}>Revoke</button></form>}
+            {canManage && <form method="post"><input type="hidden" name="op" value="revoke" /><input type="hidden" name="id" value={k.id} /><button class="btn sm ghost danger" data-confirm={`Revoke “${k.name}”?`}>Revoke</button></form>}
           </div>
         ))}
         <p class="hint">Content-agent keys can access calendar integrations. Design and media APIs require explicitly scoped keys.</p>
       </section>
 
       <section class="card card-pad">
-        <div class="card-head"><b>Webhooks</b>{isOwner && <button class="btn sm" type="button" data-modal="new-hook">Add endpoint</button>}</div>
+        <div class="card-head"><b>Webhooks</b>{canManage && <button class="btn sm" type="button" data-modal="new-hook">Add endpoint</button>}</div>
         {hooks.length === 0 && <p class="hint">Get a signed POST when content goes live, a design is published, media changes or a booking comes in.</p>}
         {hooks.map((h) => {
           const log = logs.get(h.id) ?? [];
@@ -147,7 +145,7 @@ const SCOPE_LABEL: Record<string, string> = {
               <div class="int-row">
                 <div><b class="mono">{h.url.replace(/^https?:\/\//, '').slice(0, 60)}</b><div class="int-scopes">{h.events.map((e) => <span class="pill lang">{e}</span>)}</div></div>
                 <span class={`int-status ${h.lastStatus === null ? '' : ok ? 'ok' : 'bad'}`}>{h.lastStatus === null ? 'no deliveries yet' : `${h.lastStatus || 'no answer'} · ${ago(h.lastAt)}`}</span>
-                {isOwner && (
+                {canManage && (
                   <form method="post" class="int-acts">
                     <input type="hidden" name="id" value={h.id} />
                     <button class="btn sm" name="op" value="test">Send test</button>
@@ -156,7 +154,7 @@ const SCOPE_LABEL: Record<string, string> = {
                   </form>
                 )}
               </div>
-              {isOwner && <details class="int-log">
+              {canManage && <details class="int-log">
                 <summary>Edit event subscriptions</summary>
                 <form method="post">
                   <input type="hidden" name="op" value="subscriptions" />

package/src/pages/admin/live.astro

@@ -2,10 +2,10 @@
 import Admin from '../../layouts/Admin.astro';
 import LiveManager from '../../components/LiveManager';
 import { getRepo } from '../../lib/repo';
-import { requireSession } from '../../lib/api';
+import { requirePermission } from '../../lib/permissions/access';
 const repo = await getRepo(Astro.locals);
-try { await requireSession(Astro.request, Astro.cookies, repo, true); }
-catch { return new Response('Owner access is required.', { status: 403 }); }
+try { await requirePermission(Astro.request, Astro.cookies, repo, 'services.manage'); }
+catch { return new Response('Your role doesn’t include “Connected services”.', { status: 403 }); }
 ---
 <Admin title="Live video" section="integrations">
   <LiveManager client:only="react" />

package/src/pages/admin/mobile.astro

@@ -3,11 +3,11 @@ import Admin from '../../layouts/Admin.astro';
 import AppAccess from '../../components/AppAccess';
 import MobileApp from '../../components/MobileApp';
 import { getRepo } from '../../lib/repo';
-import { requireSession } from '../../lib/api';
+import { requirePermission } from '../../lib/permissions/access';
 import { PUSH } from '../../lib/push/config';
 const repo = await getRepo(Astro.locals);
-try { await requireSession(Astro.request, Astro.cookies, repo, true); }
-catch { return new Response('Owner access is required.', { status: 403 }); }
+try { await requirePermission(Astro.request, Astro.cookies, repo, 'services.manage'); }
+catch { return new Response('Your role doesn’t include “Connected services”.', { status: 403 }); }
 ---
 <Admin title="Mobile app" section="mobile">
   <div class="page-head">

package/src/pages/admin/pages/index.astro

@@ -5,6 +5,7 @@ import ContentList, { type ContentItem } from '../../../components/ContentList.a
 import { getRepo } from '../../../lib/repo';
 import { slugify, type Status } from '../../../lib/schema';
 import { I18N, localeHomeUrl } from '../../../lib/i18n';
+import { forbiddenUnless } from '../../../lib/permissions/access';
 
 const repo = await getRepo(Astro.locals);
 
@@ -12,6 +13,8 @@ if (Astro.request.method === 'POST') {
   const form = await Astro.request.formData();
   const op = String(form.get('op'));
   if (op === 'create') {
+    const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, 'content.edit');
+    if (denied) return denied;
     const title = String(form.get('title') || 'Untitled');
     let slug = slugify(String(form.get('slug') || title));
     // avoid slug collisions
@@ -22,7 +25,11 @@ if (Astro.request.method === 'POST') {
   }
   if (op === 'bulk') {
     const to = String(form.get('to'));
-    for (const id of form.getAll('ids').map(String).filter(Boolean)) {
+    const ids = form.getAll('ids').map(String).filter(Boolean);
+    const touchesLive = to === 'published' || (await Promise.all(ids.map((id) => repo.getPage(id)))).some((p) => p?.status === 'published' || p?.status === 'scheduled');
+    const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, to === 'delete' ? 'content.delete' : touchesLive ? 'content.publish' : 'content.edit');
+    if (denied) return denied;
+    for (const id of ids) {
       if (to === 'delete') await repo.deletePage(id);
       else if (to === 'published' || to === 'draft' || to === 'archived') await repo.updatePage(id, { status: to as Status });
     }

package/src/pages/admin/roles.astro

@@ -0,0 +1,80 @@
+---
+import Admin from '../../layouts/Admin.astro';
+import RolesManager from '../../components/RolesManager';
+import { getRepo } from '../../lib/repo';
+import { accessFor } from '../../lib/permissions/access';
+
+// Team → Roles: owners edit what each role can do; administrators can look.
+const repo = await getRepo(Astro.locals);
+const access = await accessFor(Astro.request, Astro.cookies, repo);
+if (access?.role !== 'owner' && access?.role !== 'administrator') return Astro.redirect('/admin/users');
+---
+<Admin title="Roles" section="roles">
+  <div class="page-head">
+    <div>
+      <h1>Roles &amp; permissions</h1>
+      <p class="sub">Choose what each role can do. Changes stay in your draft until you save.</p>
+    </div>
+  </div>
+  <RolesManager client:only="react" />
+</Admin>
+
+<style is:global>
+  .rp { padding-bottom: 72px; }
+  .rp-bar { display: flex; justify-content: space-between; align-items: center; gap: 12px; margin-bottom: 14px; flex-wrap: wrap; }
+  .rp-flash { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; }
+  .rp-flash form { margin: 0; }
+  .rp-grid { display: grid; grid-template-columns: 220px minmax(0, 1fr); gap: 16px; align-items: start; }
+  .rp-roles { display: grid; gap: 2px; position: sticky; top: 16px; }
+  .rp-role { display: flex; justify-content: space-between; align-items: center; gap: 8px; padding: 9px 11px; border: 0; border-radius: var(--r-md); background: none; color: var(--text-2); font: inherit; font-size: 14px; text-align: left; cursor: pointer; }
+  .rp-role:hover { background: var(--hover); }
+  .rp-role.on { background: var(--sel); color: var(--text); font-weight: 600; }
+  .rp-role-name { display: inline-flex; align-items: center; gap: 6px; flex-wrap: wrap; }
+  .rp-role small { color: var(--muted); font-weight: 400; font-size: 12px; white-space: nowrap; }
+  .rp-dot { display: inline-block; width: 7px; height: 7px; border-radius: 50%; background: var(--accent); flex: none; margin-right: 2px; }
+  .rp-panel { padding: 4px 20px 16px; }
+  .rp-head { display: flex; justify-content: space-between; align-items: flex-start; gap: 12px; padding: 16px 0 10px; }
+  .rp-head h2 { font-size: 18px; margin: 0 0 2px; display: flex; align-items: center; gap: 8px; }
+  .rp-head .hint { font-size: 13px; color: var(--muted); margin: 0; }
+  .rp-area { border-top: 1px solid var(--line); padding: 12px 0 4px; }
+  .rp-area-head { display: flex; justify-content: space-between; align-items: center; margin-bottom: 4px; font-size: 14px; }
+  .rp-row { display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: 14px; align-items: center; padding: 8px 10px; margin: 0 -10px; border-radius: var(--r-md); }
+  .rp-row.changed { background: var(--accent-soft); }
+  .rp-text { display: grid; gap: 1px; }
+  .rp-label { font-size: 14px; display: inline-flex; align-items: center; gap: 6px; flex-wrap: wrap; }
+  .rp-text small { color: var(--muted); font-size: 12.5px; }
+  .rp-switch { width: 34px; height: 20px; border-radius: 99px; border: 0; padding: 0; background: var(--line-strong); position: relative; cursor: pointer; flex: none; }
+  .rp-switch i { position: absolute; top: 2px; left: 2px; width: 16px; height: 16px; border-radius: 50%; background: #fff; box-shadow: 0 1px 2px rgb(0 0 0 / 25%); transition: left 0.15s; }
+  .rp-switch.on { background: var(--accent); }
+  .rp-switch.on i { left: 16px; }
+  .rp-switch:disabled { cursor: not-allowed; opacity: 0.55; }
+  .rp-switch:focus-visible { outline: 2px solid var(--accent-ring); outline-offset: 2px; }
+  .rp-compare { overflow-x: auto; }
+  .rp-compare th, .rp-compare td { text-align: center; white-space: nowrap; }
+  .rp-compare th:first-child, .rp-compare td:first-child { text-align: left; white-space: normal; }
+  .rp-compare-area td { background: var(--panel-2); font-size: 13px; }
+  .rp-cell { color: var(--faint); }
+  .rp-cell.on { color: var(--green); font-weight: 700; }
+  .rp-cell.changed { background: var(--accent-soft); }
+  .rp-compare-note { padding: 10px 16px; margin: 0; }
+  .rp-history { margin-top: 16px; }
+  .rp-history ul { list-style: none; margin: 0; padding: 0; display: grid; gap: 10px; }
+  .rp-history li { display: grid; gap: 2px; font-size: 13.5px; }
+  .rp-history small { color: var(--muted); }
+  .rp-savebar { position: fixed; left: 50%; bottom: calc(16px + var(--tabbar-h)); transform: translateX(-50%); z-index: 30; display: flex; align-items: center; gap: 16px; padding: 8px 8px 8px 16px; border-radius: var(--r-lg); background: var(--code-bg); color: var(--code-text); box-shadow: var(--shadow-pop); font-size: 14px; max-width: calc(100vw - 32px); flex-wrap: wrap; }
+  .rp-savebar-actions { display: flex; gap: 8px; }
+  .rp-savebar .btn:not(.primary) { background: transparent; color: var(--code-text); border-color: rgb(255 255 255 / 18%); }
+  .rp-overlay { position: fixed; inset: 0; z-index: 40; background: var(--dim); display: flex; align-items: center; justify-content: center; padding: 20px; }
+  .rp-dialog { background: var(--panel); border-radius: var(--r-lg); box-shadow: var(--shadow-pop); width: min(460px, 100%); max-height: calc(100vh - 40px); overflow: auto; padding: 20px; }
+  .rp-dialog h2 { font-size: 17px; margin: 0 0 12px; }
+  .rp-dialog-body p { margin: 0 0 10px; font-size: 14px; }
+  .rp-review-role { margin-bottom: 12px; font-size: 14px; }
+  .rp-review-role ul { list-style: none; margin: 4px 0 0; padding: 0; }
+  .rp-review-role li { padding: 2px 0; }
+  .rp-review-role li.plus { color: var(--green); }
+  .rp-review-role li.minus { color: var(--red); }
+  @media (max-width: 760px) {
+    .rp-grid { grid-template-columns: 1fr; }
+    .rp-roles { position: static; grid-template-columns: repeat(auto-fill, minmax(150px, 1fr)); }
+  }
+</style>