@acms-subir/core 0.3.12 → 0.3.13

package/src/pages/admin/settings.astro

@@ -3,8 +3,8 @@ import Admin from '../../layouts/Admin.astro';
 import AiSettings from '../../components/AiSettings';
 import MonitoringSettings from '../../components/MonitoringSettings';
 import { getRepo } from '../../lib/repo';
-import { OWNER_ENV } from '../../lib/auth';
-import { validateRequestSession } from '../../lib/auth/request';
+import { accessFor } from '../../lib/permissions/access';
+import type { Permission } from '../../lib/permissions/catalog';
 import { AUTH } from '../../lib/auth/config';
 import { invalidateRedirectCache } from '../../middleware';
 import { CONTENT } from '../../lib/content';
@@ -12,9 +12,10 @@ import { UMAMI_ID_RE, META_PIXEL_ID_RE, TIKTOK_PIXEL_ID_RE, normalizeScriptUrl }
 
 const repo = await getRepo(Astro.locals);
 
-const sessionUserId = (await validateRequestSession(Astro.request, Astro.cookies, Astro.locals));
-const sessionUser = sessionUserId && sessionUserId !== OWNER_ENV ? await repo.getUser(sessionUserId) : null;
-const isOwner = sessionUserId === OWNER_ENV || sessionUser?.role === 'owner';
+// each card follows its permission on Team → Roles
+const access = await accessFor(Astro.request, Astro.cookies, repo);
+const isOwner = access?.role === 'owner';
+const can = (permission: Permission) => access?.can(permission) ?? false;
 
 const genKey = () =>
   'acms_sk_' + [...crypto.getRandomValues(new Uint8Array(24))].map((b) => b.toString(16).padStart(2, '0')).join('');
@@ -41,7 +42,9 @@ if (Astro.request.method === 'POST') {
   const form = await Astro.request.formData();
   const action = String(form.get('action') || 'site');
   postedAction = action;
-  if (action === 'site') {
+  if (['site', 'localization', 'announcement', 'addRedirect', 'removeRedirect'].includes(action) && !can('site.settings')) {
+    flashError = 'Your role doesn’t include “General settings”. Ask an owner if you need it.';
+  } else if (action === 'site') {
     // site URL: normalize to a bare origin; empty is fine (falls back to the
     // request origin until configured)
     const rawUrl = String(form.get('siteUrl') ?? '').trim();
@@ -75,8 +78,8 @@ if (Astro.request.method === 'POST') {
       flash = 'Timezone & language saved.';
     }
   } else if (action === 'codeInjection') {
-    if (!isOwner) {
-      flashError = 'Only owners can edit injected code.';
+    if (!can('site.code')) {
+      flashError = 'Your role doesn’t include “Code injection and analytics”.';
     } else {
       await repo.updateSettings({
         headCode: String(form.get('headCode') ?? ''),
@@ -85,8 +88,8 @@ if (Astro.request.method === 'POST') {
       flash = 'Code injection saved.';
     }
   } else if (action === 'analytics') {
-    if (!isOwner) {
-      flashError = 'Only owners can edit analytics.';
+    if (!can('site.code')) {
+      flashError = 'Your role doesn’t include “Code injection and analytics”.';
     } else {
       // replay sample rate is edited as a percent, stored as a fraction
       const replayPct = Number(String(form.get('umamiReplaySampleRate') ?? '15').trim());
@@ -167,8 +170,8 @@ if (Astro.request.method === 'POST') {
     await repo.deleteRedirect(String(form.get('id') ?? ''));
     invalidateRedirectCache();
     flash = 'Redirect removed.';
-  } else if (!isOwner) {
-    flashError = 'Only owners can manage the drafts API.';
+  } else if (!can('integrations.manage')) {
+    flashError = 'Your role doesn’t include “API keys and webhooks”.';
   } else {
     const current = await repo.getSettings();
     if (action === 'generateKey') {
@@ -222,18 +225,18 @@ const groups = [
     { id: 'announcement', label: 'Announcement bar', terms: 'announcement banner bar' },
   ] },
   { label: 'Publishing', items: [
-    ...(isOwner ? [{ id: 'drafts-api', label: 'External drafts API', terms: 'api key drafts cors origins' }] : []),
+    ...(can('integrations.manage') ? [{ id: 'drafts-api', label: 'External drafts API', terms: 'api key drafts cors origins' }] : []),
     { id: 'redirects', label: 'Redirects', terms: 'redirects 301 302 urls' },
   ] },
-  ...(isOwner ? [{ label: 'Integrations', items: [
-    { id: 'email', label: 'Email', terms: 'email transactional resend mailgun amazon ses aws cloudflare invitation invite password reset booking calendar notifications reminders' },
-    { id: 'ai-agents', label: 'AI & agents', terms: 'ai agents openai custom kimi deepseek cli proxy cpamc tailscale mcp' },
-    { id: 'analytics', label: 'Analytics', terms: 'analytics umami replay meta pixel tiktok tracking' },
-    { id: 'code', label: 'Code injection', terms: 'code injection head footer scripts' },
-    { id: 'monitoring', label: 'Monitoring', terms: 'monitoring uptime kuma health status down alerts heartbeat scheduler' },
+  ...(can('services.manage') || can('site.code') ? [{ label: 'Integrations', items: [
+    ...(can('services.manage') ? [{ id: 'email', label: 'Email', terms: 'email transactional resend mailgun amazon ses aws cloudflare invitation invite password reset booking calendar notifications reminders' },
+      { id: 'ai-agents', label: 'AI & agents', terms: 'ai agents openai custom kimi deepseek cli proxy cpamc tailscale mcp' }] : []),
+    ...(can('site.code') ? [{ id: 'analytics', label: 'Analytics', terms: 'analytics umami replay meta pixel tiktok tracking' },
+      { id: 'code', label: 'Code injection', terms: 'code injection head footer scripts' }] : []),
+    ...(can('services.manage') ? [{ id: 'monitoring', label: 'Monitoring', terms: 'monitoring uptime kuma health status down alerts heartbeat scheduler' }] : []),
   ] }] : []),
   { label: 'Advanced', items: [
-    ...(isOwner ? [{ id: 'import', label: 'Import & export', terms: 'import export ghost wordpress migrate migration move content' }] : []),
+    ...(can('data.import') ? [{ id: 'import', label: 'Import & export', terms: 'import export ghost wordpress migrate migration move content' }] : []),
     { id: 'backup', label: 'Backup', terms: 'backup restore export zip' },
     { id: 'backend', label: 'Backend', terms: 'backend database d1 sqlite' },
   ] },
@@ -370,7 +373,7 @@ const groups = [
 
       <div class="set-group-title">Publishing</div>
 
-      {isOwner && (
+      {can('integrations.manage') && (
         <section class="scard" id="drafts-api">
           <header class="scard-head">
             <a class="scard-back" href="#" aria-label="All settings"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M15 6l-6 6 6 6" /></svg></a>
@@ -470,9 +473,9 @@ const groups = [
         </form>
       </section>
 
-      {isOwner && <div class="set-group-title">Integrations</div>}
+      {(can('services.manage') || can('site.code')) && <div class="set-group-title">Integrations</div>}
 
-      {isOwner && (
+      {can('services.manage') && (
         <section class="scard" id="email">
           <header class="scard-head">
             <a class="scard-back" href="#" aria-label="All settings"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M15 6l-6 6 6 6" /></svg></a>
@@ -483,7 +486,7 @@ const groups = [
         </section>
       )}
 
-      {isOwner && (
+      {can('site.code') && (
         <section class={`scard ${openCard === 'analytics' ? 'editing' : ''}`} id="analytics" data-editable>
           <header class="scard-head">
             <a class="scard-back" href="#" aria-label="All settings"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M15 6l-6 6 6 6" /></svg></a>
@@ -545,7 +548,7 @@ const groups = [
         </section>
       )}
 
-      {isOwner && (
+      {can('site.code') && (
         <section class={`scard ${openCard === 'codeInjection' ? 'editing' : ''}`} id="code" data-editable>
           <header class="scard-head">
             <a class="scard-back" href="#" aria-label="All settings"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M15 6l-6 6 6 6" /></svg></a>
@@ -572,9 +575,9 @@ const groups = [
         </section>
       )}
 
-      {isOwner && <section class="scard" id="ai-agents"><header class="scard-head"><a class="scard-back" href="#" aria-label="All settings">←</a><div class="grow"><h2>AI &amp; agents</h2></div><a class="btn" href="/admin/ai">Import document</a></header><AiSettings client:load /></section>}
+      {can('services.manage') && <section class="scard" id="ai-agents"><header class="scard-head"><a class="scard-back" href="#" aria-label="All settings">←</a><div class="grow"><h2>AI &amp; agents</h2></div><a class="btn" href="/admin/ai">Import document</a></header><AiSettings client:load /></section>}
 
-      {isOwner && (
+      {can('services.manage') && (
         <section class="scard" id="monitoring">
           <header class="scard-head">
             <a class="scard-back" href="#" aria-label="All settings"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M15 6l-6 6 6 6" /></svg></a>
@@ -586,7 +589,7 @@ const groups = [
 
       <div class="set-group-title">Advanced</div>
 
-      {isOwner && (
+      {can('data.import') && (
         <section class="scard" id="import">
           <header class="scard-head">
             <a class="scard-back" href="#" aria-label="All settings"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M15 6l-6 6 6 6" /></svg></a>

package/src/pages/admin/tags.astro

@@ -4,8 +4,10 @@ import Modal from '../../components/Modal.astro';
 import { getRepo } from '../../lib/repo';
 import { slugify } from '../../lib/schema';
 import { CONTENT, tagUrl } from '../../lib/content';
+import { forbiddenUnless } from '../../lib/permissions/access';
 
 const repo = await getRepo(Astro.locals);
+if (Astro.request.method === 'POST') { const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, 'content.edit'); if (denied) return denied; }
 
 if (Astro.request.method === 'POST') {
   const form = await Astro.request.formData();

package/src/pages/admin/users.astro

@@ -13,12 +13,16 @@ import { kickEmail } from '../../lib/email/service';
 import { waitUntilFrom } from '../../lib/webhooks';
 import { requireSession } from '../../lib/api';
 import { slugify, authorSlug, Role } from '../../lib/schema';
-import { roleLabels } from '../../lib/roles';
+import { roleLabels, roleSummaries } from '../../lib/roles';
+import { accessFor } from '../../lib/permissions/access';
+import { ROLE_RANK, assignableRoles } from '../../lib/permissions/catalog';
 import { EDITOR } from '../../lib/editor/config';
 
 const repo = await getRepo(Astro.locals);
 
-// Only owners manage users. The env-password session is always owner.
+// Owners manage everyone. Team → Roles can let other roles invite people
+// (Invite people) or manage members (Manage members), always limited to roles
+// below their own. The env-password session is always owner.
 const auth = await getRequestAuth(Astro.request, Astro.cookies, Astro.locals);
 const sessionUserId = auth.userId;
 // Clerk mode: credentials live in Clerk; ACMS keeps accounts, roles and the
@@ -29,8 +33,14 @@ let clerkReady = !clerkMode;
 if (clerkMode) {
   try { issuer = clerkConfig(Astro.locals).issuer; clerkReady = true; } catch { clerkReady = false; }
 }
-const sessionUser = sessionUserId && sessionUserId !== OWNER_ENV ? await repo.getUser(sessionUserId) : null;
-const isOwner = sessionUserId === OWNER_ENV || sessionUser?.role === 'owner';
+const access = await accessFor(Astro.request, Astro.cookies, repo);
+const isOwner = access?.role === 'owner';
+const canInvite = access?.can('team.invite') ?? false;
+const canManage = access?.can('team.manage') ?? false;
+// roles this person may give out (owners: all; everyone else: below their own)
+const assignable = access ? assignableRoles(access.role) : [];
+const below = (role: Role) => isOwner || (!!access && ROLE_RANK[role] < ROLE_RANK[access.role]);
+const manages = (u: { id: string; role: Role }) => canManage && below(u.role) && (isOwner || u.id !== sessionUserId);
 
 let error = '';
 let failedOp = '';
@@ -67,14 +77,30 @@ if (Astro.url.searchParams.has('signedOut')) notice = 'Signed out. The app has t
 if (Astro.url.searchParams.has('linked')) notice = 'Account linked. They can now sign in with Clerk; their apps were signed out.';
 if (Astro.url.searchParams.has('emailChanged')) notice = clerkMode ? 'Email updated.' : 'Email updated. They were signed out everywhere and sign in with the new address.';
 if (Astro.url.searchParams.has('invited')) notice = clerkMode ? 'Invitation sent. Clerk emails the sign-up link; it expires in seven days.' : 'Invitation queued.';
-if (Astro.request.method === 'POST' && isOwner && !error) {
+if (Astro.request.method === 'POST' && (canInvite || canManage) && !error) {
   const form = await Astro.request.formData();
   const op = String(form.get('op'));
   failedOp = op;
   failedId = String(form.get('id') ?? '');
   try {
-    await requireSession(Astro.request,Astro.cookies,repo,true);
+    await requireSession(Astro.request,Astro.cookies,repo);
     if(Astro.request.headers.get('origin')!==Astro.url.origin)throw new Error('Cross-origin requests are not allowed.');
+    // what this person may do here, checked again on the server for every change
+    const inviteOp = ['create', 'resend', 'revoke'].includes(op);
+    if (inviteOp && !canInvite) throw new Error('Your role doesn’t include “Invite people”. Ask an owner if you need it.');
+    if (!inviteOp && !canManage) throw new Error('Your role doesn’t include “Manage members”. Ask an owner if you need it.');
+    if (op === 'link' && !isOwner) throw new Error('Only owners can link sign-in accounts.');
+    if (op === 'create' && !assignable.includes(Role.parse(form.get('role')))) throw new Error('You can only invite people to roles below your own.');
+    if (op === 'resend' || op === 'revoke') {
+      const target = clerkMode ? await repo.auth.invitation(issuer, String(form.get('id'))) : await repo.email.token(String(form.get('id')));
+      if (target && !below(Role.parse(target.role))) throw new Error('Only an owner can change invitations for this role.');
+    }
+    if (['update', 'delete', 'email'].includes(op)) {
+      const target = await repo.getUser(String(form.get('id')));
+      if (!target) throw new Error('The account no longer exists.');
+      if (!manages(target)) throw new Error('You can only manage people in roles below your own.');
+      if (op === 'update' && !assignable.includes(Role.parse(form.get('role')))) throw new Error('You can only assign roles below your own.');
+    }
     if (clerkMode) {
       if (!clerkReady) throw new Error('Clerk sign-in isn’t fully configured, so accounts can’t be changed right now.');
       if (SENSITIVE.has(op) && !auth.reverified) {
@@ -91,7 +117,7 @@ if (Astro.request.method === 'POST' && isOwner && !error) {
           if (previous.state === 'pending' || previous.state === 'sending') await revokeClerkInvitation(repo, previous.id, Astro.locals);
           data = { email: previous.email, name: previous.name, role: previous.role };
         }
-        await inviteClerkUser(repo, data, Astro.locals);
+        await inviteClerkUser(repo, { ...data, invitedBy: sessionUserId }, Astro.locals);
         return Astro.redirect('/admin/users?invited=1');
       }
       if (op === 'revoke') await revokeClerkInvitation(repo, String(form.get('id')), Astro.locals);
@@ -109,7 +135,7 @@ if (Astro.request.method === 'POST' && isOwner && !error) {
       const invitedRole = Role.parse(previous ? previous.role : form.get('role'));
       await issueAccountToken(repo,{purpose:'invite',email:previous?String(previous.email):String(form.get('email')||''),
         name:previous?String(previous.name):String(form.get('name')||''),
-        role:invitedRole},Astro.locals);
+        role:invitedRole,invitedBy:sessionUserId},Astro.locals);
       await kickEmail(repo,Astro.locals,waitUntilFrom(Astro.locals));
     }
     if(!clerkMode&&op==='revoke')await repo.email.revoke(String(form.get('id')));
@@ -148,8 +174,8 @@ if (Astro.request.method === 'GET' && isOwner && clerkMode && clerkReady) {
   try { await syncClerkEmails(repo, Astro.locals); } catch { /* Clerk unavailable: keep stored emails */ }
 }
 const users = await repo.listUsers();
-type Row = { id: string; email: string; role: AuthInvitation['role']; state: string; expiresAt: number; name?: string };
-const invitations: Row[] = !isOwner ? [] : clerkMode ? (clerkReady ? await repo.auth.invitations(issuer) : []) : await repo.email.invitations();
+type Row = { id: string; email: string; role: AuthInvitation['role']; state: string; expiresAt: number; name?: string; invitedBy?: string; createdAt?: number };
+const invitations: Row[] = !canInvite ? [] : clerkMode ? (clerkReady ? await repo.auth.invitations(issuer) : []) : await repo.email.invitations();
 // Clerk identity linked to each local account (owners see who can sign in)
 const linked = new Map<string, string>(clerkMode && clerkReady
   ? (await repo.auth.identities(issuer)).map((r) => [String(r.userId), String(r.subject)]) : []);
@@ -184,11 +210,13 @@ const deviceGroups = [...new Set(devices.map((d) => d.userId))].map((uid) => ({
       <h1>Users</h1>
       <p class="sub">{users.length} {users.length === 1 ? 'person' : 'people'}{clerkMode && isOwner && clerkReady && <> · {linked.size} connected to Clerk</>}</p>
     </div>
-    {isOwner && clerkReady && <button class="btn primary" type="button" data-modal="invite-user">Invite user</button>}
+    {canInvite && clerkReady && <button class="btn primary" type="button" data-modal="invite-user">Invite people</button>}
   </div>
 
-  {!isOwner && (
-    <div class="flash error">{clerkMode ? 'Only owners can manage users. Ask an owner to make changes.' : 'Only owners can manage users. Ask an owner (or sign in with the owner password) to make changes.'}</div>
+  {!isOwner && !canManage && (
+    canInvite
+      ? <div class="flash" role="status">You can invite people to roles below yours. Ask an owner to change existing accounts.</div>
+      : <div class="flash error">{clerkMode ? 'Only owners can manage users. Ask an owner to make changes.' : 'Only owners can manage users. Ask an owner (or sign in with the owner password) to make changes.'}</div>
   )}
   {error && (
     <div class="flash error users-flash" role="alert">
@@ -215,7 +243,7 @@ const deviceGroups = [...new Set(devices.map((d) => d.userId))].map((uid) => ({
         {clerkMode
           ? 'Clerk handles passwords, verification and recovery. ACMS roles decide what each person can do; only invited or linked accounts get in.'
           : 'People sign in with their email and a password they choose from their invitation. Password resets use your email settings.'}
-        {clerkMode && isOwner && clerkReady && ' Changes here ask you to verify it’s you.'}
+        {clerkMode && (canInvite || canManage) && clerkReady && ' Changes here ask you to verify it’s you.'}
       </p>
       {clerkMode && !clerkReady && (
         <p class="hint">Set <code>PUBLIC_CLERK_PUBLISHABLE_KEY</code>, <code>CLERK_SECRET_KEY</code> and <code>CLERK_AUTHORIZED_PARTIES</code> in the deployment environment.</p>
@@ -224,26 +252,30 @@ const deviceGroups = [...new Set(devices.map((d) => d.userId))].map((uid) => ({
     <p class="hint auth-where">Set in the deployment configuration</p>
   </section>
 
-  {isOwner && clerkReady && (
-    <Modal id="invite-user" title="Invite user" open={!!error && failedOp === 'create'}>
+  {canInvite && clerkReady && (
+    <Modal id="invite-user" title="Invite people" open={!!error && failedOp === 'create'}>
       <form method="post" data-reverify>
         <input type="hidden" name="op" value="create" />
-        <div class="field-row">
-          <label class="field">
-            <span>Name</span>
-            <input type="text" name="name" placeholder="Name" required autofocus />
-          </label>
-          <label class="field">
-            <span>Role</span>
-            <select name="role">
-              {Role.options.map(role => <option value={role} selected={role === 'editor'}>{roleLabels[role]}</option>)}
-            </select>
-          </label>
-        </div>
         <label class="field">
           <span>Email</span>
-          <input type="email" name="email" placeholder="email@example.com" required />
+          <input type="email" name="email" placeholder="email@example.com" required autofocus />
         </label>
+        <label class="field">
+          <span>Name</span>
+          <input type="text" name="name" placeholder="Name" required />
+        </label>
+        <fieldset class="invite-roles">
+          <legend>Role</legend>
+          {Role.options.slice().reverse().map((role) => {
+            const allowed = assignable.includes(role);
+            return (
+              <label class:list={['invite-role', { 'is-off': !allowed }]}>
+                <input type="radio" name="role" value={role} checked={role === (assignable.includes('editor') ? 'editor' : assignable[assignable.length - 1])} disabled={!allowed} />
+                <span><b>{roleLabels[role]}</b>{!allowed && <span class="pill archived">Owner only</span>}<small>{roleSummaries[role]}</small></span>
+              </label>
+            );
+          })}
+        </fieldset>
         <p class="hint">{clerkMode
           ? 'Clerk emails them a sign-up link that’s valid for seven days. Their account gets this role once they accept.'
           : 'They’ll receive a single-use invitation valid for seven days and choose their own password.'}</p>
@@ -253,15 +285,15 @@ const deviceGroups = [...new Set(devices.map((d) => d.userId))].map((uid) => ({
         </div>
         <p class="hint modal-note">{clerkMode
           ? <>Already have an ACMS account? Open it in the list and link its Clerk user ID instead, so posts and roles stay attached.</>
-          : <>They sign in at <code>/admin/login</code> with email + password. Choose a default role for their account. Owners also manage users.</>}</p>
+          : <>They sign in at <code>/admin/login</code> with email + password. {isOwner ? <a href="/admin/roles">Roles</a> : 'Roles'} decide what each role can do.</>}</p>
       </form>
     </Modal>
   )}
 
-  {(isOwner && clerkReady || showDevices) && (
+  {(canInvite && clerkReady || showDevices) && (
     <div class="seg users-tabs" role="tablist" aria-label="Users sections">
       <button type="button" role="tab" id="tab-members" aria-controls="panel-members" aria-selected={tab === 'members' ? 'true' : 'false'} data-users-tab="members">Members <span class="count">{users.length}</span></button>
-      {isOwner && clerkReady && <button type="button" role="tab" id="tab-invitations" aria-controls="panel-invitations" aria-selected={tab === 'invitations' ? 'true' : 'false'} data-users-tab="invitations">Invitations{pendingInvites > 0 && <span class="count">{pendingInvites}</span>}</button>}
+      {canInvite && clerkReady && <button type="button" role="tab" id="tab-invitations" aria-controls="panel-invitations" aria-selected={tab === 'invitations' ? 'true' : 'false'} data-users-tab="invitations">Invitations{pendingInvites > 0 && <span class="count">{pendingInvites}</span>}</button>}
       {showDevices && <button type="button" role="tab" id="tab-devices" aria-controls="panel-devices" aria-selected={tab === 'devices' ? 'true' : 'false'} data-users-tab="devices">Signed-in apps{devices.length > 0 && <span class="count">{devices.length}</span>}</button>}
     </div>
   )}
@@ -271,7 +303,7 @@ const deviceGroups = [...new Set(devices.map((d) => d.userId))].map((uid) => ({
       <thead><tr><th>Name</th><th>Role</th>{clerkMode && isOwner && clerkReady && <th>Sign-in</th>}<th><span class="sr-only">Actions</span></th></tr></thead>
       <tbody>
         {users.map((u) => (
-          <tr data-user-row={isOwner ? `user-${u.id}` : undefined}>
+          <tr data-user-row={manages(u) ? `user-${u.id}` : undefined}>
             <td>
               <div class="user-cell">
                 <span class="avatar user-av">{u.avatar ? <img src={u.avatar} alt="" loading="lazy" /> : initials(u.name)}</span>
@@ -288,7 +320,7 @@ const deviceGroups = [...new Set(devices.map((d) => d.userId))].map((uid) => ({
                 : <span class="pill archived">Not linked</span>}</td>
             )}
             <td class="td-actions">
-              {isOwner && <button class="btn sm ghost" type="button" data-modal={`user-${u.id}`} aria-label={`Edit ${u.name}`}>Edit</button>}
+              {manages(u) && <button class="btn sm ghost" type="button" data-modal={`user-${u.id}`} aria-label={`Edit ${u.name}`}>Edit</button>}
             </td>
           </tr>
         ))}
@@ -299,7 +331,7 @@ const deviceGroups = [...new Set(devices.map((d) => d.userId))].map((uid) => ({
     </table>
   </section>
 
-  {isOwner && users.map((u) => {
+  {users.filter(manages).map((u) => {
     const isLinked = linked.has(u.id);
     const self = clerkMode && u.id === sessionUserId;
     const formId = `upd-${u.id}`;
@@ -334,7 +366,7 @@ const deviceGroups = [...new Set(devices.map((d) => d.userId))].map((uid) => ({
               <label class="field">
                 <span>Role</span>
                 <select name="role" form={formId}>
-                  {Role.options.map(role => <option value={role} selected={u.role === role}>{roleLabels[role]}</option>)}
+                  {Role.options.filter((role) => assignable.includes(role)).map(role => <option value={role} selected={u.role === role}>{roleLabels[role]}</option>)}
                 </select>
               </label>
               {!clerkMode && (
@@ -354,7 +386,7 @@ const deviceGroups = [...new Set(devices.map((d) => d.userId))].map((uid) => ({
                     ? <span class="pill published" title={linked.get(u.id)}>Connected</span>
                     : <span class="pill archived">Not linked</span>}</span>
                 </div>
-                {!isLinked && (
+                {!isLinked && isOwner && (
                   <form method="post" class="drawer-link" data-reverify>
                     <input type="hidden" name="op" value="link" />
                     <input type="hidden" name="id" value={u.id} />
@@ -431,18 +463,19 @@ const deviceGroups = [...new Set(devices.map((d) => d.userId))].map((uid) => ({
     );
   })}
 
-  {isOwner && clerkReady && <section class="card users-panel" id="panel-invitations" role="tabpanel" aria-labelledby="tab-invitations" data-users-panel="invitations" hidden={tab !== 'invitations'}>
+  {canInvite && clerkReady && <section class="card users-panel" id="panel-invitations" role="tabpanel" aria-labelledby="tab-invitations" data-users-panel="invitations" hidden={tab !== 'invitations'}>
     <p class="hint users-panel-hint">{clerkMode
       ? 'Clerk delivers these emails; your email settings aren’t needed for them. Resending cancels the previous link.'
       : <>Manage delivery in <a href="/admin/email">Email settings</a>. Resending revokes the previous link.</>}</p>
     <table class="list"><thead><tr><th>Email</th><th>Role</th><th>Status</th><th><span class="sr-only">Actions</span></th></tr></thead><tbody>
       {invitations.map(i=>{
         const [label, tone] = clerkMode ? (stateLabel[i.state] ?? [i.state, 'archived']) : [i.state, ''];
-        return <tr><td>{i.email}{clerkMode && i.name && i.name !== i.email && <div class="t-sub">{i.name}</div>}</td><td>{roleLabels[i.role] ?? i.role}</td>
+        const inviter = i.invitedBy ? (userById.get(i.invitedBy)?.name ?? (i.invitedBy === OWNER_ENV ? 'Owner' : 'Removed user')) : '';
+        return <tr><td>{i.email}{clerkMode && i.name && i.name !== i.email && <div class="t-sub">{i.name}</div>}{(inviter || i.createdAt) && <div class="t-sub">{inviter && <>Invited by {inviter}</>}{inviter && i.createdAt ? ' · ' : ''}{i.createdAt ? day(i.createdAt) : ''}</div>}</td><td>{roleLabels[i.role] ?? i.role}</td>
           <td>{clerkMode ? <span class={`pill ${tone}`}>{label}</span> : i.state}{clerkMode && i.state === 'pending' && <div class="t-sub">Expires {day(i.expiresAt)}</div>}</td>
-          <td class="td-actions">{i.state!=='accepted'&&<form method="post" class="inline-form" data-reverify><input type="hidden" name="id" value={i.id}/><button class="btn sm" name="op" value="resend">Resend</button>{(i.state==='pending'||(clerkMode&&i.state==='sending'))&&<button class="btn sm ghost" name="op" value="revoke">Revoke</button>}</form>}</td></tr>;
+          <td class="td-actions">{i.state!=='accepted'&&!below(i.role)&&<span class="hint">Owner only</span>}{i.state!=='accepted'&&below(i.role)&&<form method="post" class="inline-form" data-reverify><input type="hidden" name="id" value={i.id}/><button class="btn sm" name="op" value="resend">Resend</button>{(i.state==='pending'||(clerkMode&&i.state==='sending'))&&<button class="btn sm ghost" name="op" value="revoke">Revoke</button>}</form>}</td></tr>;
       })}
-      {!invitations.length&&<tr><td colspan="4" class="hint">No invitations yet. Use <b>Invite user</b> to add someone.</td></tr>}
+      {!invitations.length&&<tr><td colspan="4" class="hint">No invitations yet. Use <b>Invite people</b> to add someone.</td></tr>}
     </tbody></table></section>}
 
   {showDevices && (
@@ -543,4 +576,17 @@ const deviceGroups = [...new Set(devices.map((d) => d.userId))].map((uid) => ({
       });
     }
   </script>
+  <style>
+    /* invite dialog: each role with what it's for; roles above yours stay visible but off */
+    .invite-roles { border: 0; padding: 0; margin: 4px 0 12px; display: grid; gap: 6px; }
+    .invite-roles legend { font-size: 13px; font-weight: 600; margin-bottom: 6px; }
+    .invite-role { display: flex; gap: 10px; align-items: flex-start; padding: 9px 12px; border: 1px solid var(--line-strong); border-radius: var(--r-md); cursor: pointer; }
+    .invite-role:has(input:checked) { border-color: var(--accent); background: var(--accent-soft); }
+    .invite-role input { margin-top: 3px; accent-color: var(--accent); }
+    .invite-role > span { display: grid; gap: 1px; }
+    .invite-role b { font-size: 14px; }
+    .invite-role small { color: var(--muted); font-size: 12.5px; }
+    .invite-role .pill { margin-left: 6px; }
+    .invite-role.is-off { opacity: .55; cursor: not-allowed; }
+  </style>
 </Admin>

package/src/pages/api/ai/clean.ts

@@ -1,11 +1,12 @@
 import type { APIRoute } from 'astro';
 import { getRepo } from '../../../lib/repo';
-import { apiError, json, readJson, requireSession } from '../../../lib/api';
+import { apiError, json, readJson } from '../../../lib/api';
 import { cleanDocument } from '../../../lib/ai';
+import { requirePermission } from '../../../lib/permissions/access';
 export const POST: APIRoute = async ({ request, cookies, locals }) => {
   try {
     const repo = await getRepo(locals);
-    await requireSession(request, cookies, repo);
+    await requirePermission(request, cookies, repo, 'content.edit');
     const input = await readJson(request);
     const { ai } = await repo.getSettings();
     return json(await cleanDocument(ai, input));

package/src/pages/api/ai/draft.ts

@@ -1,13 +1,14 @@
 import type { APIRoute } from 'astro';
 import { z } from 'zod';
 import { getRepo } from '../../../lib/repo';
-import { apiError, json, readJson, requireSession } from '../../../lib/api';
+import { apiError, json, readJson } from '../../../lib/api';
 import { runAgentTool } from '../../../lib/agent';
+import { requirePermission } from '../../../lib/permissions/access';
 const Input = z.object({ kind: z.enum(['posts', 'pages']), collection: z.string().optional(), title: z.string().trim().min(1).max(300), content: z.string().trim().min(1).max(100_000) }).strict();
 export const POST: APIRoute = async ({ request, cookies, locals }) => {
   try {
     const repo = await getRepo(locals);
-    await requireSession(request, cookies, repo);
+    await requirePermission(request, cookies, repo, 'content.edit');
     const input = Input.parse(await readJson(request));
     return json(await runAgentTool(repo, { tool: 'create_draft', arguments: input }, false), 201);
   } catch (error) { return apiError(error); }

package/src/pages/api/ai/settings.ts

@@ -1,10 +1,11 @@
 import type { APIRoute } from 'astro';
 import { z } from 'zod';
 import { getRepo } from '../../../lib/repo';
-import { ApiError, apiError, json, readJson, requireSession } from '../../../lib/api';
+import { ApiError, apiError, json, readJson } from '../../../lib/api';
 import { encryptApiKey, generateAgentKey, normalizeAiUrl, publicAiConfig } from '../../../lib/ai-config';
 import { AiProvider } from '../../../lib/ai-schema';
 import type { Settings } from '../../../lib/schema';
+import { requirePermission } from '../../../lib/permissions/access';
 
 function publicSettings(settings: Settings, url: URL) {
   const { keyHash, ...agent } = settings.agent;
@@ -20,14 +21,14 @@ const Input = z.discriminatedUnion('action', [
 export const GET: APIRoute = async ({ request, cookies, locals, url }) => {
   try {
     const repo = await getRepo(locals);
-    await requireSession(request, cookies, repo, true);
+    await requirePermission(request, cookies, repo, 'services.manage');
     return json(publicSettings(await repo.getSettings(), url));
   } catch (error) { return apiError(error); }
 };
 export const POST: APIRoute = async ({ request, cookies, locals, url }) => {
   try {
     const repo = await getRepo(locals);
-    await requireSession(request, cookies, repo, true);
+    await requirePermission(request, cookies, repo, 'services.manage');
     const input = Input.parse(await readJson(request, 16_000));
     const current = await repo.getSettings();
     let token: string | undefined;

package/src/pages/api/ai/test.ts

@@ -1,11 +1,12 @@
 import type { APIRoute } from 'astro';
 import { getRepo } from '../../../lib/repo';
-import { apiError, json, requireSession } from '../../../lib/api';
+import { apiError, json } from '../../../lib/api';
 import { listAiModels } from '../../../lib/ai';
+import { requirePermission } from '../../../lib/permissions/access';
 export const POST: APIRoute = async ({ request, cookies, locals }) => {
   try {
     const repo = await getRepo(locals);
-    await requireSession(request, cookies, repo, true);
+    await requirePermission(request, cookies, repo, 'services.manage');
     const { ai } = await repo.getSettings();
     return json({ models: await listAiModels(ai), baseUrl: ai.baseUrl });
   } catch (error) { return apiError(error); }

package/src/pages/api/design/export.ts

@@ -4,6 +4,7 @@ import { getRepo } from '../../../lib/repo';
 import { getMediaStore } from '../../../lib/media/store';
 import { apiError, ApiError } from '../../../lib/api';
 import { designIdentity } from '../../../lib/design-service';
+import { deniedMessage } from '../../../lib/permissions/catalog';
 import { draftNavItems, mergeDesignDraft } from '../../../lib/drafts';
 import { sectionTargets } from '../../../lib/section-targets';
 import { getTheme, isProjectTheme } from '../../../lib/theme';
@@ -20,7 +21,7 @@ export const GET: APIRoute = async ({ request, cookies, locals }) => {
     const url = new URL(request.url);
     const includeMedia = url.searchParams.get('media') !== '0', includeNav = url.searchParams.get('nav') === '1';
     const who = await designIdentity(request, cookies, repo, 'design:read');
-    if ('role' in who && who.role === 'editor') throw new ApiError(403, 'Only an owner can export the theme.');
+    if ('role' in who && who.role === 'editor') throw new ApiError(403, deniedMessage('site.layout'));
     if (includeMedia && !who.scopes.includes('media:read')) throw new ApiError(403, 'Required scope: media:read (or export with media=0).');
     const live = await repo.getSettings();
     const settings = mergeDesignDraft(live);

package/src/pages/api/design/import.ts

@@ -3,6 +3,7 @@ import { z } from 'zod';
 import { getRepo } from '../../../lib/repo';
 import { apiError, ApiError, json, readJson } from '../../../lib/api';
 import { DesignPatch, designIdentity, runDesignOperation } from '../../../lib/design-service';
+import { deniedMessage } from '../../../lib/permissions/catalog';
 import { diffDesign } from '../../../lib/designDiff';
 import { sectionTargets } from '../../../lib/section-targets';
 import { getTheme, listThemes } from '../../../lib/theme';
@@ -23,7 +24,7 @@ export const POST: APIRoute = async ({ request, cookies, locals }) => {
     const repo = await getRepo(locals);
     const input = Body.parse(await readJson(request, 2_000_000));
     const who = await designIdentity(request, cookies, repo, 'design:write-draft');
-    if ('role' in who && who.role === 'editor') throw new ApiError(403, 'Only an owner can import a theme.');
+    if ('role' in who && who.role === 'editor') throw new ApiError(403, deniedMessage('site.layout'));
     const current = await repo.getSettings();
     if (current.designRevision !== input.revision) throw new ApiError(409, 'Design changed. Reload and try again.');
     const [pages, targets, liveNav] = await Promise.all([repo.listPages(), sectionTargets(repo, locals), repo.listNavItems()]);

package/src/pages/api/design/keys.ts

@@ -1,12 +1,13 @@
 import type { APIRoute } from 'astro';
 import { z } from 'zod';
 import { getRepo } from '../../../lib/repo';
-import { apiError, json, readJson, requireSession, ApiError } from '../../../lib/api';
+import { apiError, json, readJson, ApiError } from '../../../lib/api';
 import { DESIGN_SCOPES } from '../../../lib/design-service';
 import { generateAgentKey } from '../../../lib/ai-config';
+import { requirePermission } from '../../../lib/permissions/access';
 export const ALL:APIRoute=async({request,cookies,locals})=>{
   try {
-    const repo=await getRepo(locals);await requireSession(request,cookies,repo,true);
+    const repo=await getRepo(locals);await requirePermission(request, cookies, repo, 'integrations.manage');
     if(request.method==='GET')return json({keys:(await repo.listApiKeys()).filter(k=>k.scopes.some(s=>DESIGN_SCOPES.includes(s as typeof DESIGN_SCOPES[number])))});
     if(request.method==='POST') {
       const input=z.object({name:z.string().min(1).max(100),scopes:z.array(z.enum(DESIGN_SCOPES)).min(1)}).strict().parse(await readJson(request,10000));

package/src/pages/api/email/settings.ts

@@ -1,7 +1,7 @@
 import type { APIRoute } from 'astro';
 import { z } from 'zod';
 import { getRepo } from '../../../lib/repo';
-import { ApiError, apiError, json, readJson, requireSession } from '../../../lib/api';
+import { ApiError, apiError, json, readJson } from '../../../lib/api';
 import { validateRequestSession } from '../../../lib/auth/request';
 import { reauthenticate } from '../../../lib/email/accounts';
 import { AUTH } from '../../../lib/auth/config';
@@ -11,6 +11,7 @@ import { dispatchEmail } from '../../../lib/email/service';
 import { emailReadiness } from '../../../lib/email/readiness';
 import type { ContentRepository } from '../../../lib/repo/types';
 import type { Credentials, PublicEmailSettings } from '../../../lib/email/types';
+import { requirePermission } from '../../../lib/permissions/access';
 const Config = z.object({provider:z.enum(['auto','none','resend','mailgun','ses','cloudflare']),source:z.enum(['env','encrypted']),from:z.string().trim().max(320),replyTo:z.string().trim().max(320),domain:z.string().trim().max(253),region:z.string().trim().max(40),configurationSet:z.string().trim().max(200),snsTopicArn:z.string().trim().max(300),enabled:z.boolean(),reminders:z.boolean(),staffNotifications:z.boolean()}).strict();
 const Secrets = z.object({apiKey:z.string().max(4096).optional(),webhookSecret:z.string().max(4096).optional(),accessKeyId:z.string().max(256).optional(),secretAccessKey:z.string().max(4096).optional(),sessionToken:z.string().max(8192).optional()}).strict();
 const Input = z.discriminatedUnion('action',[
@@ -23,11 +24,11 @@ export async function publicSettings(repo:ContentRepository,locals?:unknown):Pro
   return {authProvider:AUTH.provider,version:c.version,config:c.config,provider:c.provider,...emailReadiness(c,(await repo.getSettings()).siteUrl,locals),environmentLocked:!!runtimeValue('EMAIL_PROVIDER',locals),credentialFields:Object.entries(c.credentials).filter(([,v])=>!!v).map(([k])=>k),activity:(await repo.email.list()).map(({payload,lease,fingerprint,rendered,...safe})=>safe),heartbeat:await repo.email.heartbeat()};
 }
 export const GET:APIRoute=async({request,cookies,locals})=>{
-  try{const repo=await getRepo(locals);await requireSession(request,cookies,repo,true);return json(await publicSettings(repo,locals));}catch(e){return apiError(e);}
+  try{const repo=await getRepo(locals);await requirePermission(request, cookies, repo, 'services.manage');return json(await publicSettings(repo,locals));}catch(e){return apiError(e);}
 };
 export const POST:APIRoute=async({request,cookies,locals})=>{
   try{
-    const repo=await getRepo(locals);await requireSession(request,cookies,repo,true);
+    const repo=await getRepo(locals);await requirePermission(request, cookies, repo, 'services.manage');
     const userId=(await validateRequestSession(request, cookies, repo))!;
     const input=Input.parse(await readJson(request,20000));
     if(input.action==='save'){