@acms-subir/core 0.3.21 → 0.3.23

package/src/lib/permissions/catalog.ts

@@ -1,4 +1,6 @@
+import { userConfig } from 'virtual:acms-config';
 import type { Role } from '../schema';
+import { SITE_ROLES, isStaffRole, roleRank, rolesByRank } from '../roles';
 
 // What each role may do. The catalog and its defaults live in code; the
 // owner's choices on Team → Roles are stored as differences from these
@@ -12,8 +14,13 @@ import type { Role } from '../schema';
 //
 // Owners always have every permission. Locked permissions stay owner-only and
 // can't be granted, so an owner can never lock themselves out of recovery.
+//
+// Sites add their own roles (lib/roles.ts) and permissions (acms({
+// permissions }), shown under "This site"). A role without admin access can
+// only hold site permissions and the few core ones marked `members`; every
+// other core permission is forced off for it, whatever is stored.
 
-/** roles whose permissions an owner can change */
+/** the core roles whose permissions an owner can change (site roles are editable too, see editableRoles) */
 export const EDITABLE_ROLES = ['administrator', 'editor', 'author', 'contributor'] as const;
 export type EditableRole = typeof EDITABLE_ROLES[number];
 
@@ -25,11 +32,17 @@ export interface PermissionDef {
   label: string;
   description: string;
   /** default holders (owners hold everything) */
-  defaults: readonly EditableRole[];
+  defaults: readonly string[];
   /** owner-only, never grantable */
   locked?: boolean;
   /** grants code, credentials or people: the page asks owners to grant with care */
   sensitive?: boolean;
+  /** roles without admin access can hold it too */
+  members?: boolean;
+  /** on by default for every site role (with `members`) */
+  siteRoleDefault?: boolean;
+  /** defined by the site (acms({ permissions })) */
+  site?: boolean;
 }
 export interface PermissionArea { id: string; label: string; permissions: readonly PermissionDef[] }
 
@@ -39,6 +52,10 @@ export const PERMISSION_AREAS = [
     { key: 'content.publish', label: 'Publish content', description: 'Publish, schedule and unpublish, and put staged edits live.', defaults: STAFF },
     { key: 'content.delete', label: 'Delete content', description: 'Delete posts, pages and events.', defaults: STAFF },
   ] },
+  { id: 'requests', label: 'Event requests', permissions: [
+    // for the site's own roles (members): staff edit events directly, and approve requests with Publish content
+    { key: 'events.request', label: 'Request events', description: 'Ask for new events and suggest changes to events they host, from My events on the site. Staff approve them. Cancelling a date of an event they host is always allowed.', defaults: NONE, members: true, siteRoleDefault: true },
+  ] },
   { id: 'media', label: 'Media', permissions: [
     { key: 'media.upload', label: 'Upload media', description: 'Add images and files, and edit their descriptions.', defaults: STAFF },
     { key: 'media.delete', label: 'Delete media', description: 'Remove files from the media library.', defaults: STAFF },
@@ -75,29 +92,58 @@ export const PERMISSION_AREAS = [
   ] },
 ] as const satisfies readonly PermissionArea[];
 
+/** a core permission key (site keys are plain strings) */
 export type Permission = typeof PERMISSION_AREAS[number]['permissions'][number]['key'];
+/** the core permissions */
 export const PERMISSIONS: readonly PermissionDef[] = (PERMISSION_AREAS as readonly PermissionArea[]).flatMap((a) => [...a.permissions]);
-const BY_KEY = new Map<string, PermissionDef>(PERMISSIONS.map((p) => [p.key, p]));
-export const permissionDef = (key: string) => BY_KEY.get(key);
-export const isPermission = (key: string): key is Permission => BY_KEY.has(key);
+
+/** the site's permissions; mutable so tests can add and remove some */
+export const SITE_PERMISSIONS: PermissionDef[] = (userConfig.permissions ?? []).map((p) => ({ ...p, site: true, members: true }));
+export const SITE_AREA_ID = 'site-defined';
+
+/** core areas, then "This site" (when the site defines permissions), then "Owner only" */
+export function permissionAreas(): PermissionArea[] {
+  const core = PERMISSION_AREAS as readonly PermissionArea[];
+  if (!SITE_PERMISSIONS.length) return [...core];
+  const owner = core.filter((a) => a.id === 'owner');
+  return [...core.filter((a) => a.id !== 'owner'), { id: SITE_AREA_ID, label: 'This site', permissions: SITE_PERMISSIONS }, ...owner];
+}
+export const allPermissions = (): PermissionDef[] => [...PERMISSIONS, ...SITE_PERMISSIONS];
+const CORE_BY_KEY = new Map<string, PermissionDef>(PERMISSIONS.map((p) => [p.key, p]));
+export const permissionDef = (key: string) => CORE_BY_KEY.get(key) ?? SITE_PERMISSIONS.find((p) => p.key === key);
+/** a core or site permission */
+export const isPermission = (key: string): boolean => !!permissionDef(key);
+export const isCorePermission = (key: string): key is Permission => CORE_BY_KEY.has(key);
 
 /** grants that differ from the defaults: { editor: { 'site.design': true } } */
-export type PolicyOverrides = Partial<Record<EditableRole, Partial<Record<Permission, boolean>>>>;
+export type PolicyOverrides = Partial<Record<string, Partial<Record<string, boolean>>>>;
 /** every editable role's full grant set */
-export type Grants = Record<EditableRole, Record<Permission, boolean>>;
+export type Grants = Record<string, Record<string, boolean>>;
 
-export const isEditableRole = (role: string): role is EditableRole => (EDITABLE_ROLES as readonly string[]).includes(role);
-export const defaultGrant = (role: EditableRole, key: Permission) => (BY_KEY.get(key)!.defaults as readonly string[]).includes(role);
+/** roles whose permissions an owner can change: the core four, then the site's */
+export const editableRoles = (): string[] => [...EDITABLE_ROLES, ...SITE_ROLES.map((r) => r.key)];
+export const isEditableRole = (role: string): boolean => editableRoles().includes(role);
+/** whether a role can hold a permission at all (locked ones are owner-only) */
+export function applies(role: string, key: string): boolean {
+  const p = permissionDef(key);
+  if (!p || p.locked) return false;
+  return isStaffRole(role) || p.members === true;
+}
+export function defaultGrant(role: string, key: string): boolean {
+  const p = permissionDef(key);
+  if (!p || !applies(role, key)) return false;
+  if (p.defaults.includes(role)) return true;
+  return p.siteRoleDefault === true && SITE_ROLES.some((r) => r.key === role);
+}
 
-/** the effective grants: defaults, then overrides (unknown keys and locked ones ignored) */
+/** the effective grants: defaults, then overrides (unknown, locked and non-applicable keys ignored) */
 export function resolveGrants(overrides: PolicyOverrides = {}): Grants {
-  const out = {} as Grants;
-  for (const role of EDITABLE_ROLES) {
-    out[role] = {} as Record<Permission, boolean>;
-    for (const p of PERMISSIONS) {
-      const key = p.key as Permission;
-      const chosen = overrides[role]?.[key];
-      out[role][key] = p.locked ? false : typeof chosen === 'boolean' ? chosen : defaultGrant(role, key);
+  const out: Grants = {};
+  for (const role of editableRoles()) {
+    out[role] = {};
+    for (const p of allPermissions()) {
+      const chosen = overrides[role]?.[p.key];
+      out[role][p.key] = !applies(role, p.key) ? false : typeof chosen === 'boolean' ? chosen : defaultGrant(role, p.key);
     }
   }
   return out;
@@ -106,41 +152,43 @@ export function resolveGrants(overrides: PolicyOverrides = {}): Grants {
 /** a full grant set back to the minimal difference from defaults */
 export function diffFromDefaults(grants: Partial<Record<string, Partial<Record<string, unknown>>>>): PolicyOverrides {
   const out: PolicyOverrides = {};
-  for (const role of EDITABLE_ROLES) {
-    for (const p of PERMISSIONS) {
-      if (p.locked) continue;
+  for (const role of editableRoles()) {
+    for (const p of allPermissions()) {
+      if (!applies(role, p.key)) continue;
       const value = grants[role]?.[p.key];
-      if (typeof value !== 'boolean' || value === defaultGrant(role, p.key as Permission)) continue;
-      (out[role] ??= {})[p.key as Permission] = value;
+      if (typeof value !== 'boolean' || value === defaultGrant(role, p.key)) continue;
+      (out[role] ??= {})[p.key] = value;
     }
   }
   return out;
 }
 
 export function deniedMessage(permission: string) {
-  return `Your role doesn’t include “${BY_KEY.get(permission)?.label ?? permission}”. Ask an owner if you need it.`;
+  return `Your role doesn’t include “${permissionDef(permission)?.label ?? permission}”. Ask an owner if you need it.`;
 }
 
-export function allows(grants: Grants, role: Role, key: Permission): boolean {
+/** owners hold every permission; everyone else needs an explicit grant that applies to their role */
+export function allows(grants: Grants, role: Role, key: string): boolean {
+  if (!isPermission(key)) return false;
   if (role === 'owner') return true;
-  return isEditableRole(role) ? grants[role][key] === true : false;
+  return applies(role, key) && grants[role]?.[key] === true;
 }
 
-/** highest first; people only invite or manage roles below their own */
-export const ROLE_RANK: Record<Role, number> = { owner: 4, administrator: 3, editor: 2, author: 1, contributor: 0 };
-export const ROLES_BY_RANK: readonly Role[] = ['owner', 'administrator', 'editor', 'author', 'contributor'];
+/** people only invite or manage roles below their own (rolesByRank is highest first) */
 export function assignableRoles(role: Role): Role[] {
-  if (role === 'owner') return [...ROLES_BY_RANK];
-  return ROLES_BY_RANK.filter((r) => ROLE_RANK[r] < ROLE_RANK[role]);
+  if (role === 'owner') return rolesByRank();
+  return rolesByRank().filter((r) => roleRank(r) > roleRank(role));
 }
+/** whether `role` ranks below `than` (unknown roles rank lowest) */
+export const ranksBelow = (role: string, than: string) => roleRank(role) > roleRank(than);
 
 /** human summary of what changed between two grant sets (audit + review dialog) */
-export function describeChanges(before: Grants, after: Grants): Array<{ role: EditableRole; permission: Permission; granted: boolean }> {
-  const out: Array<{ role: EditableRole; permission: Permission; granted: boolean }> = [];
-  for (const role of EDITABLE_ROLES) {
-    for (const p of PERMISSIONS) {
-      const key = p.key as Permission;
-      if (before[role][key] !== after[role][key]) out.push({ role, permission: key, granted: after[role][key] });
+export function describeChanges(before: Grants, after: Grants): Array<{ role: string; permission: string; granted: boolean }> {
+  const out: Array<{ role: string; permission: string; granted: boolean }> = [];
+  for (const role of editableRoles()) {
+    for (const p of allPermissions()) {
+      const was = before[role]?.[p.key] === true, now = after[role]?.[p.key] === true;
+      if (was !== now) out.push({ role, permission: p.key, granted: now });
     }
   }
   return out;

package/src/lib/permissions/service.ts

@@ -2,11 +2,10 @@ import { z } from 'zod';
 import type { ContentRepository } from '../repo/types';
 import { OWNER_ENV } from '../auth';
 import { ApiError } from '../api';
-import { roleLabels, roleSummaries } from '../roles';
+import { CORE_ROLES, isStaffRole, roleLabel, roleSummary, rolesByRank } from '../roles';
 import type { Role } from '../schema';
 import {
-  PERMISSION_AREAS, ROLES_BY_RANK, describeChanges, diffFromDefaults, isEditableRole, isPermission, resolveGrants,
-  type Grants,
+  applies, describeChanges, diffFromDefaults, isEditableRole, isPermission, permissionAreas, resolveGrants,
 } from './catalog';
 import type { Access } from './access';
 
@@ -30,10 +29,10 @@ export async function rolesState(repo: ContentRepository, access: Access) {
     canEdit: access.role === 'owner',
     updatedAt: policy.updatedAt || null,
     updatedBy: policy.updatedBy ? actorName(policy.updatedBy, names) : null,
-    roles: ROLES_BY_RANK.map((role) => ({ role, label: roleLabels[role], summary: roleSummaries[role], members: members(role), editable: isEditableRole(role) })),
-    areas: PERMISSION_AREAS.map((a) => ({
+    roles: rolesByRank().map((role) => ({ role, label: roleLabel(role), summary: roleSummary(role), members: members(role), editable: isEditableRole(role), admin: isStaffRole(role), site: !(CORE_ROLES as readonly string[]).includes(role) })),
+    areas: permissionAreas().map((a) => ({
       id: a.id, label: a.label,
-      permissions: a.permissions.map((p) => ({ key: p.key, label: p.label, description: p.description, locked: 'locked' in p && p.locked === true, sensitive: 'sensitive' in p && p.sensitive === true })),
+      permissions: a.permissions.map((p) => ({ key: p.key, label: p.label, description: p.description, locked: p.locked === true, sensitive: p.sensitive === true, members: p.members === true, site: p.site === true })),
     })),
     grants: resolveGrants(policy.overrides),
     defaults: resolveGrants({}),
@@ -47,12 +46,16 @@ export async function saveRoles(repo: ContentRepository, access: Access, input:
   if (access.role !== 'owner') throw new ApiError(403, 'Only owners can change role permissions.');
   for (const [role, grants] of Object.entries(input.grants)) {
     if (!isEditableRole(role)) throw new ApiError(400, `Unknown or fixed role “${role}”.`);
-    for (const key of Object.keys(grants)) if (!isPermission(key)) throw new ApiError(400, `Unknown permission “${key}”.`);
+    for (const [key, value] of Object.entries(grants)) {
+      if (!isPermission(key)) throw new ApiError(400, `Unknown permission “${key}”.`);
+      // a core permission for a role without admin access (or a locked one) can't be granted
+      if (value && !applies(role, key)) throw new ApiError(400, `“${roleLabel(role)}” can’t be given “${key}”: that role has no admin access.`);
+    }
   }
   const current = await repo.permissions.policy();
   if (current.revision !== input.revision) throw new ApiError(409, 'Permissions were changed by someone else since you opened this page.');
   const overrides = diffFromDefaults(input.grants);
-  const changes = describeChanges(resolveGrants(current.overrides), resolveGrants(overrides) as Grants);
+  const changes = describeChanges(resolveGrants(current.overrides), resolveGrants(overrides));
   if (!changes.length) return current.revision;
   return repo.permissions.save(overrides, input.revision, access.userId, changes);
 }

package/src/lib/repo/migrations.ts

@@ -662,6 +662,12 @@ export const MIGRATIONS: Migration[] = [
     // [insert, delete, update]: only the update trigger names columns
     contentVersionTriggers('events', [...CONTENT_VERSION_COLUMNS.events, 'cancelled_dates'])[2],
   ] },
+  // event hosts and members' event requests (CalEvent.hostIds / .request);
+  // neither is public, so the content-version trigger stays as it is
+  { version: 56, statements: [
+    `ALTER TABLE events ADD COLUMN host_ids TEXT NOT NULL DEFAULT '[]'`,
+    `ALTER TABLE events ADD COLUMN request TEXT`,
+  ] },
 ];
 
 // Current cache coverage; keep earlier migration inputs frozen for upgrade compatibility.

package/src/lib/repo/sql.ts

@@ -12,7 +12,7 @@ import { LiveConfig } from '../live/types';
 import { ApiError } from '../api';
 import { EmailStore, bookingJobs } from '../email/store';
 import type { ContentRepository, DesignVersion, EventUpdate, ImportRecord, ImportRecordKind, ImportRun, SearchResults, Stats } from './types';
-import { DocTranslations, Page, Post, Link, Media, NavItem, Redirect, Settings, Snippet, Tag, User, Calendar, CalEvent, ApiKey, Webhook, WebhookDelivery, Resource, BookingLink, Booking, Place, EventLocation, isInternalTag, normalizeRedirectPath, publicTags, slugify, type WidgetInstance } from '../schema';
+import { DocTranslations, Page, Post, Link, Media, NavItem, Redirect, Settings, Snippet, Tag, User, Calendar, CalEvent, ApiKey, Webhook, WebhookDelivery, Resource, BookingLink, Booking, Place, EventLocation, EventRequest, isInternalTag, normalizeRedirectPath, publicTags, slugify, type WidgetInstance } from '../schema';
 import { designSnapshot, draftNavItems, pickDesignDraft, pickEventDraft, pickPageDraft, pickPostDraft } from '../drafts';
 import { eventInstants, eventTimeZone, normalizeEventTimes } from '../calendar/events';
 import { cleanRrule } from '../calendar/rrule';
@@ -142,6 +142,11 @@ function rowToCalendar(r: Row): Calendar {
     createdAt: Number(r.created_at), updatedAt: Number(r.updated_at),
   });
 }
+// a corrupt request snapshot reads as "no request" rather than breaking the event
+function parseRequest(raw: unknown): EventRequest | null {
+  if (raw === null || raw === undefined || raw === '') return null;
+  try { const r = EventRequest.safeParse(JSON.parse(String(raw))); return r.success ? r.data : null; } catch { return null; }
+}
 function rowToEvent(r: Row): CalEvent {
   return CalEvent.parse({
     id: r.id, slug: r.slug, title: r.title, bodyJson: r.body_json ?? '', bodyHtml: r.body_html ?? '',
@@ -152,6 +157,7 @@ function rowToEvent(r: Row): CalEvent {
     rrule: r.rrule ?? '', exdates: json(r.exdates, []), cancelled: Boolean(r.cancelled), cancelledDates: json(r.cancelled_dates, []),
     location: json(r.location, {}), cta: json(r.cta, {}), calendarIds: json(r.calendar_ids, []),
     fields: json(r.fields, {}), sourceUid: r.source_uid ?? '', rsvp: json(r.rsvp, {}), roomHold: json(r.room_hold, {}),
+    hostIds: json(r.host_ids, []), request: parseRequest(r.request),
     startAt: Number(r.start_at), endAt: Number(r.end_at), draft: parseDraft(r.draft), translations: parseTranslations(r.translations),
     publishedAt: r.published_at === null || r.published_at === undefined ? null : Number(r.published_at),
     scheduledAt: r.scheduled_at === null || r.scheduled_at === undefined ? null : Number(r.scheduled_at),
@@ -833,8 +839,8 @@ export class SqlRepository implements ContentRepository {
     await this.driver.run(
       `INSERT INTO events (id, slug, title, body_json, body_html, excerpt, cover, cover_alt, seo_title, seo_desc, status, featured, tags, template,
         starts, ends, all_day, timezone, rrule, exdates, cancelled, location, cta, calendar_ids, fields, source_uid, start_at, end_at,
-        published_at, scheduled_at, created_at, updated_at, rsvp, room_hold, cancelled_dates)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        published_at, scheduled_at, created_at, updated_at, rsvp, room_hold, cancelled_dates, host_ids, request)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       [
         id, data.slug, data.title, data.bodyJson ?? '', data.bodyHtml ?? '', data.excerpt ?? '', data.cover ?? '', data.coverAlt ?? '',
         data.seoTitle ?? '', data.seoDesc ?? '', data.status ?? 'draft', data.featured ? 1 : 0, JSON.stringify(data.tags ?? []), data.template ?? '',
@@ -843,6 +849,7 @@ export class SqlRepository implements ContentRepository {
         JSON.stringify(data.fields ?? {}), data.sourceUid ?? '', startAt, endAt,
         data.publishedAt ?? (data.status === 'published' ? now : null), data.scheduledAt ?? null, now, now,
         JSON.stringify(data.rsvp ?? {}), JSON.stringify(data.roomHold ?? {}), JSON.stringify(data.cancelledDates ?? []),
+        JSON.stringify(data.hostIds ?? []), data.request ? JSON.stringify(data.request) : null,
       ]
     );
     await this.syncEventIndex(id);
@@ -936,6 +943,16 @@ export class SqlRepository implements ContentRepository {
     await this.ready;
     await this.driver.run('UPDATE events SET draft = NULL WHERE id = ?', [id]);
   }
+  // hosts and requests never change what the public sees, so they skip
+  // updateEvent (which would also drop a staged draft)
+  async setEventHosts(id: string, hostIds: string[]) {
+    await this.ready;
+    await this.driver.run('UPDATE events SET host_ids = ?, updated_at = ? WHERE id = ?', [JSON.stringify([...new Set(hostIds)]), Date.now(), id]);
+  }
+  async setEventRequest(id: string, request: EventRequest | null) {
+    await this.ready;
+    await this.driver.run('UPDATE events SET request = ?, updated_at = ? WHERE id = ?', [request ? JSON.stringify(request) : null, Date.now(), id]);
+  }
   async deleteEvent(id: string) {
     await this.ready;
     const mutation = crypto.randomUUID();
@@ -1784,14 +1801,15 @@ export class SqlRepository implements ContentRepository {
       ...(content.events ?? []).map((e) => ({
         sql: `INSERT INTO events (id, slug, title, body_json, body_html, excerpt, cover, cover_alt, seo_title, seo_desc, status, featured, tags, template,
           starts, ends, all_day, timezone, rrule, exdates, cancelled, location, cta, calendar_ids, fields, source_uid, start_at, end_at,
-          draft, published_at, scheduled_at, created_at, updated_at, rsvp, room_hold, cancelled_dates)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+          draft, published_at, scheduled_at, created_at, updated_at, rsvp, room_hold, cancelled_dates, host_ids, request)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
         args: [
           e.id, e.slug, e.title, e.bodyJson, e.bodyHtml, e.excerpt, e.cover, e.coverAlt, e.seoTitle, e.seoDesc, e.status, e.featured ? 1 : 0,
           JSON.stringify(e.tags), e.template, e.start, e.end, e.allDay ? 1 : 0, e.timezone, e.rrule, JSON.stringify(e.exdates),
           e.cancelled ? 1 : 0, JSON.stringify(e.location), JSON.stringify(e.cta), JSON.stringify(e.calendarIds), JSON.stringify(e.fields),
           e.sourceUid, e.startAt, e.endAt, e.draft ? JSON.stringify(e.draft) : null, e.publishedAt, e.scheduledAt, e.createdAt, e.updatedAt,
           JSON.stringify(e.rsvp ?? {}), JSON.stringify(e.roomHold ?? {}), JSON.stringify(e.cancelledDates ?? []),
+          JSON.stringify(e.hostIds ?? []), e.request ? JSON.stringify(e.request) : null,
         ],
       })),
       ...(content.forms ?? []).map(formInsert),

package/src/lib/repo/types.ts

@@ -15,7 +15,7 @@ export type ImportRecordKind = 'post' | 'page' | 'user' | 'tag' | 'media' | 'red
 export interface ImportRecord { runId: string; kind: ImportRecordKind; sourceId: string; acmsId: string; action: 'created' | 'updated'; stamp: number }
 export interface DesignVersion { id: string; createdAt: number; author: string; summary: string; snapshot: Record<string, unknown> }
 
-import type { Page, Post, Link, Media, NavItem, Redirect, Settings, Snippet, Tag, User, Role, WidgetInstance, Calendar, CalEvent, ApiKey, ApiScope, Webhook, WebhookDelivery, Resource, BookingLink, Booking, BookingStatus, Place, EventLocation } from '../schema';
+import type { Page, Post, Link, Media, NavItem, Redirect, Settings, Snippet, Tag, User, Role, WidgetInstance, Calendar, CalEvent, ApiKey, ApiScope, Webhook, WebhookDelivery, Resource, BookingLink, Booking, BookingStatus, Place, EventLocation, EventRequest } from '../schema';
 
 export interface Stats {
   publishedPages: number;
@@ -141,6 +141,10 @@ export interface ContentRepository {
   createEvent(data: Partial<Omit<CalEvent, 'id' | 'draft' | 'startAt' | 'endAt' | 'createdAt' | 'updatedAt'>> & { title: string; slug: string; start: string }): Promise<CalEvent>;
   updateEvent(id: string, data: EventUpdate): Promise<void>;
   saveEventDraft(id: string, data: Omit<EventUpdate, 'status' | 'scheduledAt' | 'publishedAt'>): Promise<void>;
+  /** the Team members who host an event (lib/calendar/requests.ts) */
+  setEventHosts(id: string, hostIds: string[]): Promise<void>;
+  /** a member's pending or declined request on an event; null clears it */
+  setEventRequest(id: string, request: EventRequest | null): Promise<void>;
   applyEventDraft(id: string): Promise<void>;
   discardEventDraft(id: string): Promise<void>;
   /** replace an event's cancelled occurrence keys at once, keeping any staged draft */

package/src/lib/roles.ts

@@ -1,14 +1,56 @@
-import type { Role } from './schema';
+import { userConfig } from 'virtual:acms-config';
+import type { CoreRole, Role } from './schema';
 
-export const roleLabels: Record<Role, string> = {
+// Every role ACMS knows: the five core roles, then the site's own from
+// acms({ roles }), ranked below Contributor in the order listed. A site role
+// with admin: false signs people in for the site's own pages only; it never
+// counts as staff (see lib/auth.ts and lib/auth/request.ts). A stored role
+// that isn't defined any more (the site removed it) is treated as non-staff
+// with no permissions, so it fails closed instead of breaking pages.
+
+export interface SiteRole { key: string; label: string; summary: string; admin: boolean; home: string }
+
+/** the site's roles; mutable so tests can add and remove some */
+export const SITE_ROLES: SiteRole[] = [...(userConfig.roles ?? [])];
+
+export const CORE_ROLES: readonly CoreRole[] = ['owner', 'administrator', 'editor', 'author', 'contributor'];
+const isCoreRole = (role: string): role is CoreRole => (CORE_ROLES as readonly string[]).includes(role);
+const siteRole = (role: string) => SITE_ROLES.find((r) => r.key === role);
+
+const CORE_LABELS: Record<CoreRole, string> = {
   contributor: 'Contributor', author: 'Author', editor: 'Editor', administrator: 'Administrator', owner: 'Owner',
 };
-
 /** one line per role for pickers (the defaults; owners can change what each role does on Team → Roles) */
-export const roleSummaries: Record<Role, string> = {
+const CORE_SUMMARIES: Record<CoreRole, string> = {
   owner: 'Everything, including roles, backups and sign-in settings.',
   administrator: 'Runs the site day to day and invites people.',
   editor: 'Writes, edits and publishes content.',
   author: 'Writes and publishes content.',
   contributor: 'Writes and edits content.',
 };
+
+/** highest first: the core roles, then the site's */
+export const rolesByRank = (): Role[] => [...CORE_ROLES, ...SITE_ROLES.map((r) => r.key)];
+/** a configured role (core or site) */
+export const isRole = (role: unknown): role is Role => typeof role === 'string' && (isCoreRole(role) || !!siteRole(role));
+/** may use the admin: core roles and site roles with admin: true */
+export const isStaffRole = (role: string | null | undefined): boolean => !!role && (isCoreRole(role) || siteRole(role)?.admin === true);
+/** owner 0 … contributor 4, then site roles; unknown roles rank lowest */
+export function roleRank(role: string): number {
+  const i = rolesByRank().indexOf(role);
+  return i < 0 ? Number.MAX_SAFE_INTEGER : i;
+}
+export const roleLabel = (role: string): string => (isCoreRole(role) ? CORE_LABELS[role] : siteRole(role)?.label ?? role);
+export function roleSummary(role: string): string {
+  if (isCoreRole(role)) return CORE_SUMMARIES[role];
+  const r = siteRole(role);
+  if (!r) return 'No longer defined by this site. People with it can’t use the admin.';
+  return r.summary || (r.admin ? 'Uses the admin with only what you grant it on Roles.' : 'Signs in to this site. No admin access.');
+}
+/** where someone with this role lands after signing in when nothing else is asked for */
+export const roleHome = (role: string): string => (isStaffRole(role) ? '/admin' : siteRole(role)?.home ?? '/');
+/** a role read from a form: must be configured */
+export function parseRole(value: unknown): Role {
+  if (!isRole(value)) throw new Error('Choose a role from the list.');
+  return value;
+}

package/src/lib/schema.ts

@@ -155,6 +155,18 @@ export type Post = z.infer<typeof Post>;
 // and for post-list blocks.
 export const isInternalTag = (name: string) => name.startsWith('#');
 export const publicTags = (names: string[]) => names.filter((n) => !isInternalTag(n));
+// Filters name a tag by its name (any case) or its slug: "Bible Study",
+// "bible study" and "bible-study" all match a "Bible Study" tag. Internal
+// tags match by name only, so "class" never picks up "#class".
+export function hasTag(names: string[], wanted: string): boolean {
+  const w = wanted.trim().toLowerCase();
+  if (!w) return false;
+  const slug = /^[a-z0-9-]+$/.test(w);
+  return names.some((n) => n.trim().toLowerCase() === w || (slug && !isInternalTag(n.trim()) && slugify(n) === w));
+}
+/** only `tag` (when set), never `excludeTag` (when set) */
+export const tagFilter = (tag?: string, excludeTag?: string) => (names: string[]) =>
+  (!tag?.trim() || hasTag(names, tag)) && (!excludeTag?.trim() || !hasTag(names, excludeTag));
 
 export const MediaVariant = z.object({ w: z.number(), key: z.string() });
 export type MediaVariant = z.infer<typeof MediaVariant>;
@@ -196,8 +208,13 @@ export const Snippet = z.object({
 });
 export type Snippet = z.infer<typeof Snippet>;
 
-export const Role = z.enum(['contributor', 'author', 'editor', 'administrator', 'owner']);
-export type Role = z.infer<typeof Role>;
+export const CoreRole = z.enum(['contributor', 'author', 'editor', 'administrator', 'owner']);
+export type CoreRole = z.infer<typeof CoreRole>;
+// A core role or one the site defines (acms({ roles })). Stored values are
+// never rejected here, so a role a site later removes can't break a page:
+// lib/roles.ts decides what any role may do, and an unknown one gets nothing.
+export const Role = z.string().min(1).max(64);
+export type Role = CoreRole | (string & {});
 
 // Password hashes never leave the repo layer — User is the public shape.
 export const User = z.object({
@@ -339,6 +356,26 @@ export const RoomHold = z.object({
 });
 export type RoomHold = z.infer<typeof RoomHold>;
 
+// A member's event request (lib/calendar/requests.ts): a new event waiting
+// for approval (kind 'new', the event stays a draft), or changes to a live
+// event staged in its `draft` (kind 'changes'). Staff approve or decline;
+// approving clears it. `note` is the requester's message to staff, `reply`
+// staff's answer when declining.
+export const EventRequest = z.object({
+  kind: z.enum(['new', 'changes']),
+  state: z.enum(['pending', 'declined']),
+  by: z.string(),
+  at: z.number(),
+  note: z.string().default(''),
+  reply: z.string().default(''),
+  reviewedBy: z.string().default(''),
+  reviewedAt: z.number().default(0),
+  // the event was made by this request (withdrawing it may delete it); false
+  // when a host asked to publish a draft staff wrote
+  created: z.boolean().default(false),
+});
+export type EventRequest = z.infer<typeof EventRequest>;
+
 export const CalEvent = z.object({
   id: z.string(),
   slug: z.string(),
@@ -389,6 +426,10 @@ export const CalEvent = z.object({
   // all day). Computed into availability, never stored as bookings. Drafts
   // only hold when whileDraft is on; cancelled events never hold.
   roomHold: RoomHold.default({}),
+  // Team members who host it: they see it on My events, can cancel its dates
+  // and suggest changes (lib/calendar/requests.ts)
+  hostIds: z.array(z.string()).default([]),
+  request: EventRequest.nullable().default(null),
   startAt: z.number(),
   endAt: z.number(),
   translations: DocTranslations,

package/src/lib/section-targets.ts

@@ -18,6 +18,8 @@ export interface SectionTargets {
   calendars: { slug: string; name: string }[];
   collections: { key: string; label: string }[];
   tags: string[];
+  /** tags on published events (the events source picks from these) */
+  eventTags: string[];
   resources: { slug: string; name: string }[];
   features: { events: boolean; bookings: boolean };
   /** AI help for text fields: provider configured + languages to translate into */
@@ -26,6 +28,13 @@ export interface SectionTargets {
   i18n: { defaultLocale: string; locales: { code: string; name: string }[]; drafts: boolean };
 }
 
+// one entry per tag, ignoring case (the first spelling wins), A–Z
+function uniqueTags(names: string[]) {
+  const seen = new Map<string, string>();
+  for (const n of names.map((x) => x.trim()).filter(Boolean)) if (!seen.has(n.toLowerCase())) seen.set(n.toLowerCase(), n);
+  return [...seen.values()].sort((a, b) => a.localeCompare(b));
+}
+
 export async function sectionTargets(repo: ContentRepository, locals?: unknown): Promise<SectionTargets> {
   const bookings = bookingsEnabled();
   const settings = await repo.getSettings();
@@ -54,6 +63,7 @@ export async function sectionTargets(repo: ContentRepository, locals?: unknown):
     calendars: calendars.filter((c) => c.visibility !== 'private').map((c) => ({ slug: c.slug, name: c.name })),
     collections: Object.entries(CONTENT.collections).map(([key, c]) => ({ key, label: c.plural })),
     tags: [...new Set(tags.map((t) => t.name))].sort((a, b) => a.localeCompare(b)),
+    eventTags: uniqueTags(events.flatMap((e) => e.tags)),
     resources: publicResources.map((r) => ({ slug: r.slug, name: r.name })),
     features: { events: CALENDAR.enabled, bookings },
     ai: { enabled: Boolean(settings.ai.enabled && settings.ai.model), languages: languageNames() },

package/src/lib/sections.ts

@@ -1,7 +1,7 @@
 import sanitizeHtml from 'sanitize-html';
 import type { z } from 'zod';
 import type { ContentRepository } from './repo/types';
-import { authorSlug, type Settings, type User } from './schema';
+import { authorSlug, tagFilter, type Settings, type User } from './schema';
 import { htmlToPlaintext } from './plaintext';
 import type { SectionInstance as SectionInstanceSchema, SectionDefinition } from '../theme-sdk/contract.mjs';
 import { normalizeData, safeUrl, SOURCE_LIMIT_MAX, isEmptyValue, safeFocus, focusKey } from '../theme-sdk/fields.mjs';
@@ -21,7 +21,8 @@ import { localizeDoc, isExtraLocale } from './translations';
 //   • migrations/<type>.mjs upgrades older instances on the fly
 //   • link fields resolve their ref (page/post/event/booking) to today's URL
 //   • richtext is sanitized
-//   • source fields ("next 3 Youth events") become fresh item arrays
+//   • source fields ("next 3 Youth events", "events not tagged Class") become
+//     fresh item arrays
 
 type Instance = z.infer<typeof SectionInstanceSchema>;
 type Definition = z.infer<typeof SectionDefinition>;
@@ -121,7 +122,7 @@ function resolveScalar(field: FieldDef, value: unknown, refs: RefMap, lp: Lp = s
 }
 
 async function resolveSource(field: Extract<FieldDef, { type: 'source' }>, value: unknown, ctx: ResolveContext): Promise<unknown[]> {
-  const cfg = (value ?? {}) as { calendar?: string; collection?: string; tag?: string; resource?: string; limit?: number };
+  const cfg = (value ?? {}) as { calendar?: string; collection?: string; tag?: string; excludeTag?: string; resource?: string; limit?: number };
   const limit = Math.max(1, Math.min(SOURCE_LIMIT_MAX, Number(cfg.limit) || 3));
   const { repo, settings, now } = ctx;
   // another language (settings.locale is set to it by the renderer)
@@ -137,7 +138,7 @@ async function resolveSource(field: Extract<FieldDef, { type: 'source' }>, value
     }
     const tz = settings.timezone || 'UTC';
     const locale = siteLocale(settings);
-    return (await upcomingEvents(repo, settings, now, { calendarIds, limit })).map((o): EventItem => {
+    return (await upcomingEvents(repo, settings, now, { calendarIds, limit, tag: cfg.tag, excludeTag: cfg.excludeTag })).map((o): EventItem => {
       const e = lang ? localizeDoc(o.event, lang) : o.event;
       const f = formatOccurrence(o, tz, locale);
       const ctaHref = safeUrl(e.cta.href);
@@ -152,7 +153,8 @@ async function resolveSource(field: Extract<FieldDef, { type: 'source' }>, value
   if (field.source === 'posts') {
     const collection = cfg.collection && CONTENT.collections[cfg.collection] ? cfg.collection : 'posts';
     let posts = await repo.listPublishedPosts(collection);
-    if (cfg.tag) posts = posts.filter((p) => p.tags.some((t) => t.toLowerCase() === cfg.tag!.toLowerCase()));
+    const tagged = tagFilter(cfg.tag, cfg.excludeTag);
+    posts = posts.filter((p) => tagged(p.tags));
     const shown = posts.slice(0, limit);
     // public byline only: name, profile URL, avatar — never emails or roles
     const users = shown.some((p) => p.authorIds.length || p.authorId) ? new Map((await repo.listUsers()).map((u) => [u.id, u])) : new Map();

package/src/lib/sync/catalog.ts

@@ -38,6 +38,9 @@ export const schemas = {
     startAt: true,
     endAt: true,
     sourceUid: true,
+    // people and their requests belong to one environment (user ids differ)
+    hostIds: true,
+    request: true,
   }).strict(),
   resource: Resource.omit({
     ...common,

package/src/middleware.ts

@@ -1,7 +1,8 @@
 import { defineMiddleware } from 'astro:middleware';
 import type { APIContext, MiddlewareNext } from 'astro';
 import { I18N } from './lib/i18n';
-import { bindAuthEnvironment, getRequestAuth, shouldResolveClerk, validateRequestSession, withClerkHeaders } from './lib/auth/request';
+import { bindAuthEnvironment, getRequestAuth, requestPerson, shouldResolveClerk, validateRequestSession, withClerkHeaders } from './lib/auth/request';
+import { roleHome } from './lib/roles';
 import { AUTH } from './lib/auth/config';
 import { getRepo } from './lib/repo';
 import { CONTENT } from './lib/content';
@@ -109,6 +110,12 @@ async function handle(context: APIContext, next: MiddlewareNext): Promise<Respon
   if (pathname.startsWith('/admin') && pathname !== '/admin/login' && pathname !== '/admin/logout') {
     if (auth?.error === 'configuration' || auth?.error === 'unavailable') return new Response('Sign-in is temporarily unavailable. Check the authentication configuration or try again later.', { status: 503, headers: { 'Cache-Control': 'no-store' } });
     if (!(await validateRequestSession(context.request, context.cookies, context.locals))) {
+      // signed in, but in a site role without admin access: their own home
+      // page, never the admin (the editor-app sign-in explains on the login page)
+      const person = await requestPerson(context.request, context.cookies, context.locals);
+      if (person && !(pathname === '/admin/app-auth' && context.request.method === 'GET')) {
+        return withClerkHeaders(context.redirect(roleHome(person.role)), auth, context.request);
+      }
       // editor-app sign-in comes back here after login (see login.astro's next)
       if (pathname === '/admin/app-auth' && context.request.method === 'GET') {
         return withClerkHeaders(context.redirect(`/admin/login?next=${encodeURIComponent(pathname + context.url.search)}`), auth, context.request);