@bygghammar/cms-platform 0.90.0-m7.9 → 0.91.0

package/src/cms/timezone.ts

@@ -0,0 +1,181 @@
+/**
+ * Canonical timezone maths for the whole platform.
+ *
+ * One engine, not several: countdown deadlines, scheduled menu items, scheduled
+ * footer links and any future scheduled content all resolve a wall-clock
+ * `YYYY-MM-DDTHH:mm` in an IANA zone to a single absolute instant through the
+ * functions here. Only `Intl` is used, so there is no date library to ship.
+ *
+ * Storage rule: absolute instants are stored as UTC ISO strings. A wall-clock
+ * string is only ever an *input format* — it is resolved against a zone the
+ * moment it is saved, and rendered back into a zone when an editor sees it.
+ */
+
+/** Zone used when a site has not configured one. */
+export const DEFAULT_TIMEZONE = "Europe/Stockholm";
+
+/** A short list of zones offered in editors; any IANA zone can be typed. */
+export const TIMEZONE_OPTIONS = [
+  "Europe/Stockholm",
+  "Europe/Oslo",
+  "Europe/Copenhagen",
+  "Europe/Helsinki",
+  "Europe/London",
+  "Europe/Berlin",
+  "Europe/Madrid",
+  "Europe/Athens",
+  "UTC",
+  "America/New_York",
+  "America/Chicago",
+  "America/Los_Angeles",
+  "Asia/Dubai",
+  "Asia/Bangkok",
+  "Asia/Tokyo",
+  "Australia/Sydney",
+] as const;
+
+/**
+ * A usable IANA zone name.
+ *
+ * An unknown or misspelled zone falls back to UTC rather than throwing: a typo
+ * in one editor field must not take a page down.
+ */
+export function safeZone(tz?: string | null): string {
+  const zone = tz?.trim() || DEFAULT_TIMEZONE;
+  try {
+    new Intl.DateTimeFormat("en-GB", { timeZone: zone });
+    return zone;
+  } catch {
+    return "UTC";
+  }
+}
+
+/** True when `tz` names a zone this runtime understands. */
+export function isValidTimezone(tz: string): boolean {
+  if (!tz.trim()) return false;
+  try {
+    new Intl.DateTimeFormat("en-GB", { timeZone: tz.trim() });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Offset (ms) of `tz` from UTC at the given instant. */
+export function timezoneOffsetMs(instant: number, tz: string): number {
+  const zone = safeZone(tz);
+  const parts = new Intl.DateTimeFormat("en-GB", {
+    timeZone: zone,
+    hour12: false,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit",
+  }).formatToParts(new Date(instant));
+  const get = (type: string) => Number(parts.find((p) => p.type === type)?.value ?? "0");
+  const asUtc = Date.UTC(
+    get("year"),
+    get("month") - 1,
+    get("day"),
+    get("hour") % 24,
+    get("minute"),
+    get("second"),
+  );
+  return asUtc - instant;
+}
+
+const LOCAL_RE = /^(\d{4})-(\d{2})-(\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2}))?)?$/;
+
+/**
+ * Resolve `YYYY-MM-DDTHH:mm` read as wall-clock time in `tz` to an absolute
+ * timestamp (ms). Returns `null` when the value is empty or unparsable.
+ */
+export function zonedLocalToInstant(local?: string | null, tz?: string | null): number | null {
+  const raw = local?.trim();
+  if (!raw) return null;
+  const m = LOCAL_RE.exec(raw);
+  if (!m) return null;
+  const [, y, mo, d, h, mi, s] = m;
+  const naive = Date.UTC(
+    Number(y),
+    Number(mo) - 1,
+    Number(d),
+    Number(h ?? "0"),
+    Number(mi ?? "0"),
+    Number(s ?? "0"),
+  );
+  const zone = safeZone(tz);
+  // Two passes settle DST boundaries (the offset itself depends on the instant).
+  let instant = naive - timezoneOffsetMs(naive, zone);
+  instant = naive - timezoneOffsetMs(instant, zone);
+  return instant;
+}
+
+/**
+ * Does `local` name a wall-clock time that actually happens in `tz`?
+ *
+ * The hour a spring-forward transition skips does not exist: in Europe/Stockholm
+ * the clocks go straight from 02:00 to 03:00 on the last Sunday in March, so
+ * "02:30" that night is not a time. `zonedLocalToInstant` still resolves it —
+ * to an instant that reads back as a *different* wall clock — which is exactly
+ * the silent hour-long shift a scheduled publication must never have. Editors
+ * check this before storing, so the editor is told instead of the schedule
+ * quietly firing at the wrong time.
+ *
+ * Ambiguous times (the hour repeated by an autumn transition) are *not*
+ * rejected: both readings are real instants, and the earlier one is chosen.
+ */
+export function zonedLocalExists(local?: string | null, tz?: string | null): boolean {
+  const raw = local?.trim();
+  if (!raw) return false;
+  const m = LOCAL_RE.exec(raw);
+  if (!m) return false;
+  const instant = zonedLocalToInstant(raw, tz);
+  if (instant == null) return false;
+  const [, y, mo, d, h, mi] = m;
+  return instantToZonedLocal(instant, tz) === `${y}-${mo}-${d}T${h ?? "00"}:${mi ?? "00"}`;
+}
+
+const pad = (n: number) => String(n).padStart(2, "0");
+
+/**
+ * The inverse of `zonedLocalToInstant`: the wall-clock `YYYY-MM-DDTHH:mm` an
+ * instant shows in `tz`. This is what an `<input type="datetime-local">` needs.
+ */
+export function instantToZonedLocal(instant: number, tz?: string | null): string {
+  const zone = safeZone(tz);
+  const shifted = new Date(instant + timezoneOffsetMs(instant, zone));
+  return (
+    `${shifted.getUTCFullYear()}-${pad(shifted.getUTCMonth() + 1)}-${pad(shifted.getUTCDate())}` +
+    `T${pad(shifted.getUTCHours())}:${pad(shifted.getUTCMinutes())}`
+  );
+}
+
+/** Human wall-clock text for an instant in a zone, e.g. "7 Sep 2026, 16:00 CEST". */
+export function formatInZone(instant: number, tz?: string | null, locale = "en-GB"): string {
+  const zone = safeZone(tz);
+  return new Intl.DateTimeFormat(locale, {
+    timeZone: zone,
+    day: "numeric",
+    month: "short",
+    year: "numeric",
+    hour: "2-digit",
+    minute: "2-digit",
+    hour12: false,
+    timeZoneName: "short",
+  }).format(new Date(instant));
+}
+
+/**
+ * Short zone name for an editor hint, e.g. "CEST" — falling back to the zone's
+ * own identifier when a runtime has no abbreviation for it.
+ */
+export function zoneAbbreviation(tz?: string | null, instant: number = Date.now()): string {
+  const zone = safeZone(tz);
+  const part = new Intl.DateTimeFormat("en-GB", { timeZone: zone, timeZoneName: "short" })
+    .formatToParts(new Date(instant))
+    .find((p) => p.type === "timeZoneName");
+  return part?.value ?? zone;
+}

package/src/cms/use-publication-boundary.ts

@@ -0,0 +1,84 @@
+/**
+ * One timer that re-reads a screen when its next publication boundary falls due.
+ *
+ * A builder tab or the pages dashboard is often left open across the moment a
+ * schedule takes effect. Without this the header still says "Scheduled" half an
+ * hour after the page went live, and the only way to find out is to navigate
+ * away and back.
+ *
+ * The awkward part is that the boundary is a fact about the *server's* data and
+ * the refresh is asynchronous. Between asking for fresh data and receiving it,
+ * `boundaryTimeoutMs` keeps answering zero — the boundary really has passed —
+ * so an effect that re-arms on its own inputs re-arms instantly, refreshes
+ * again, and does it once more, for as long as the answer takes to come back or
+ * forever if it never does. That is why the timer here is a chain of `setTimeout`
+ * calls owned by one effect rather than a dependency on a counter: after a
+ * refresh has been asked for, the next attempt is a bounded, growing wait, and
+ * the boundary that actually re-arms the timer is a *new* one arriving in fresh
+ * data.
+ */
+
+import { useEffect, useRef } from "react";
+
+import { boundaryRetryMs, boundaryTimeoutMs } from "./page-publication";
+
+/**
+ * Call `refresh` when `boundary` arrives, and again if it is still in the past.
+ *
+ * `boundary` is the next transition instant — `publication_at` from the server,
+ * as an ISO string or epoch milliseconds. Null or unparseable means nothing is
+ * scheduled and no timer is set at all.
+ *
+ * `refresh` is read through a ref, so a parent handing down a new callback on
+ * every render does not restart the wait; only the boundary itself does.
+ */
+export function usePublicationBoundaryRefresh(
+  boundary: string | number | null | undefined,
+  refresh: () => void,
+): void {
+  const refreshRef = useRef(refresh);
+  refreshRef.current = refresh;
+
+  useEffect(() => {
+    const first = boundaryTimeoutMs(boundary);
+    if (first === null) return;
+
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    // Counted per boundary: a new instant arrives as a new effect, with this
+    // back at zero, so one slow refresh cannot lengthen the next one's waits.
+    let asked = 0;
+
+    const arm = (ms: number) => {
+      timer = setTimeout(fire, ms);
+    };
+
+    function fire() {
+      try {
+        refreshRef.current();
+      } catch {
+        // The failure this backoff exists for. Dropping the chain here would
+        // leave the screen stale until somebody navigated.
+      }
+      // Re-read the clock rather than assuming the wait that just elapsed is
+      // the whole of it: a laptop that slept through the boundary wakes with a
+      // timer measured against a clock that has moved on.
+      const remaining = boundaryTimeoutMs(boundary);
+      if (remaining === null) return;
+      if (remaining > 0) {
+        // The six-hour cap fired, not the boundary. Nothing has happened yet,
+        // so this is not an attempt at anything and the wait starts over.
+        asked = 0;
+        arm(remaining);
+        return;
+      }
+      // The boundary itself. Fresh data has not arrived — it cannot have, the
+      // request went out a moment ago — so the zero this instant computes to is
+      // not a delay to re-arm on.
+      asked += 1;
+      arm(boundaryRetryMs(asked));
+    }
+
+    arm(first);
+    return () => clearTimeout(timer);
+  }, [boundary]);
+}

package/src/cms/use-schedule-clock.ts

@@ -0,0 +1,43 @@
+/**
+ * A clock that ticks only when a schedule actually changes.
+ *
+ * Scheduled menu and footer entries are evaluated against `now`. A page left
+ * open across a publish time would otherwise keep rendering the state it was
+ * rendered with — a stale schedule is exactly what requirement-level caching
+ * must not do. Rather than polling every second, this hook computes the next
+ * boundary from the schedules themselves and sets a single timer for it, so a
+ * page with no pending change costs nothing at all.
+ */
+
+import { useEffect, useState } from "react";
+
+import { nextScheduleChangeAcross, type VisibilitySchedule } from "./visibility-schedule";
+
+/** Longest single timeout we ever set; `setTimeout` overflows past ~24.8 days. */
+const MAX_DELAY = 21_600_000; // 6 hours
+
+export function useScheduleClock(
+  schedules: readonly (VisibilitySchedule | null | undefined)[],
+): number {
+  const [now, setNow] = useState(() => Date.now());
+
+  // Boundaries, as a stable primitive, so the effect re-runs when the set of
+  // pending changes actually changes rather than on every render.
+  const boundaries = schedules
+    .map((schedule) => schedule && `${schedule.enabled}|${schedule.publishAt}|${schedule.unpublishAt}`)
+    .filter(Boolean)
+    .join(",");
+
+  useEffect(() => {
+    const next = nextScheduleChangeAcross(schedules, Date.now());
+    if (next == null) return;
+    // Clamp: a far-future boundary is re-checked periodically instead of
+    // trusting one enormous timer to survive.
+    const delay = Math.min(Math.max(next - Date.now(), 0) + 250, MAX_DELAY);
+    const timer = setTimeout(() => setNow(Date.now()), delay);
+    return () => clearTimeout(timer);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [boundaries, now]);
+
+  return now;
+}

package/src/cms/visibility-schedule.ts

@@ -0,0 +1,267 @@
+/**
+ * The platform's one scheduled-visibility model.
+ *
+ * Menu items, footer links and anything else that should appear or disappear on
+ * a date share this shape and this evaluator. There is deliberately no second
+ * scheduling engine: date parsing, timezone conversion, evaluation and
+ * validation all live here, on top of `./timezone`.
+ *
+ * Instants are stored as UTC ISO strings (`2026-09-10T16:00:00.000Z`). Editors
+ * type wall-clock time in the site's timezone; `localInputToIso` /
+ * `isoToLocalInput` are the only sanctioned conversions between the two.
+ *
+ * Boundary semantics, fixed and tested:
+ *   now  <  publishAt    hidden
+ *   now === publishAt    visible
+ *   between              visible
+ *   now === unpublishAt  hidden
+ *   now  >  unpublishAt  hidden
+ * An empty window (`unpublishAt <= publishAt`) can never be open, so it
+ * evaluates to hidden and is reported as a validation problem in the editor.
+ */
+
+import { formatInZone, instantToZonedLocal, zonedLocalToInstant } from "./timezone";
+
+export type VisibilitySchedule = {
+  /**
+   * Master switch. `false` hides the item outright, whatever the dates say;
+   * `undefined` means visible, so content that predates scheduling is unchanged.
+   */
+  enabled?: boolean;
+  /** UTC ISO instant the item becomes visible. Empty means "already live". */
+  publishAt?: string | null;
+  /** UTC ISO instant the item stops being visible. Empty means "no end". */
+  unpublishAt?: string | null;
+};
+
+/** A schedule that changes nothing — the value a new row starts from. */
+export const EMPTY_VISIBILITY_SCHEDULE: VisibilitySchedule = { enabled: true };
+
+/** Anything carrying an optional schedule, e.g. a menu item or footer link. */
+export type Schedulable = { schedule?: VisibilitySchedule | null };
+
+export type VisibilityState =
+  | "visible"
+  | "hidden"
+  | "scheduled-to-publish"
+  | "scheduled-to-hide"
+  | "expired"
+  | "invalid";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** Parse an ISO string / epoch ms / Date into epoch ms. `null` when unusable. */
+export function toInstant(value: string | number | Date | null | undefined): number | null {
+  if (value == null || value === "") return null;
+  if (value instanceof Date) return Number.isFinite(value.getTime()) ? value.getTime() : null;
+  if (typeof value === "number") return Number.isFinite(value) ? value : null;
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  const parsed = Date.parse(trimmed);
+  return Number.isFinite(parsed) ? parsed : null;
+}
+
+/** Narrow untrusted JSON (a content-section row) to a schedule. */
+export function normalizeSchedule(raw: unknown): VisibilitySchedule | undefined {
+  if (!isRecord(raw)) return undefined;
+  const out: VisibilitySchedule = {};
+  if (typeof raw["enabled"] === "boolean") out.enabled = raw["enabled"];
+  for (const key of ["publishAt", "unpublishAt"] as const) {
+    const value = raw[key];
+    if (typeof value === "string" && value.trim()) out[key] = value.trim();
+  }
+  return out;
+}
+
+/** True when a schedule carries no instruction at all. */
+export function isEmptySchedule(schedule: VisibilitySchedule | null | undefined): boolean {
+  if (!schedule) return true;
+  return (
+    schedule.enabled !== false &&
+    toInstant(schedule.publishAt) == null &&
+    toInstant(schedule.unpublishAt) == null
+  );
+}
+
+/**
+ * Should this item be shown at `now`?
+ *
+ * `now` is always passed in (epoch ms or Date) so rendering is a pure function
+ * of its inputs and every boundary is testable.
+ */
+export function isVisibleAt(
+  schedule: VisibilitySchedule | null | undefined,
+  now: number | Date,
+): boolean {
+  const state = visibilityStateAt(schedule, now);
+  return state === "visible" || state === "scheduled-to-hide";
+}
+
+/**
+ * The state a schedule is in at `now`. `visible` and `scheduled-to-hide` are
+ * both live states — the second one just also has an end date in the future.
+ */
+export function visibilityStateAt(
+  schedule: VisibilitySchedule | null | undefined,
+  now: number | Date,
+): VisibilityState {
+  if (!schedule) return "visible";
+  if (schedule.enabled === false) return "hidden";
+
+  const at = toInstant(now) ?? Date.now();
+  const from = toInstant(schedule.publishAt);
+  const until = toInstant(schedule.unpublishAt);
+
+  // A window that closes before it opens can never be live. Fail closed and
+  // let the editor show the problem rather than guessing which date was meant.
+  if (from != null && until != null && until <= from) return "invalid";
+
+  if (from != null && at < from) return "scheduled-to-publish";
+  if (until != null && at >= until) return "expired";
+  if (until != null) return "scheduled-to-hide";
+  return "visible";
+}
+
+/** Badge text for a state. Never colour-only: the label always says the state. */
+export const VISIBILITY_STATE_LABELS: Record<VisibilityState, string> = {
+  visible: "Visible",
+  hidden: "Hidden",
+  "scheduled-to-publish": "Scheduled to publish",
+  "scheduled-to-hide": "Scheduled to hide",
+  expired: "Hidden",
+  invalid: "Invalid schedule",
+};
+
+/** Longer wording for tooltips and screen-reader descriptions. */
+export const VISIBILITY_STATE_DESCRIPTIONS: Record<VisibilityState, string> = {
+  visible: "Shown on the public website.",
+  hidden: "Hidden from the public website.",
+  "scheduled-to-publish": "Hidden until the start date.",
+  "scheduled-to-hide": "Shown now, hidden again on the end date.",
+  expired: "Hidden — the end date has passed.",
+  invalid: "The end date is not after the start date, so this never shows.",
+};
+
+/**
+ * The next instant at which `isVisibleAt` would return a different answer, or
+ * `null` when the schedule never changes again. Callers use it to cap cache
+ * lifetimes so a scheduled change is never hidden behind a stale entry.
+ */
+export function nextVisibilityChangeAt(
+  schedule: VisibilitySchedule | null | undefined,
+  now: number | Date,
+): number | null {
+  if (!schedule || schedule.enabled === false) return null;
+  const at = toInstant(now) ?? Date.now();
+  const from = toInstant(schedule.publishAt);
+  const until = toInstant(schedule.unpublishAt);
+  if (from != null && until != null && until <= from) return null;
+  const upcoming = [from, until].filter((t): t is number => t != null && t > at);
+  return upcoming.length ? Math.min(...upcoming) : null;
+}
+
+/** The soonest scheduled change across many items; `null` when none is pending. */
+export function nextScheduleChangeAcross(
+  schedules: Iterable<VisibilitySchedule | null | undefined>,
+  now: number | Date,
+): number | null {
+  let soonest: number | null = null;
+  for (const schedule of schedules) {
+    const next = nextVisibilityChangeAt(schedule, now);
+    if (next != null && (soonest == null || next < soonest)) soonest = next;
+  }
+  return soonest;
+}
+
+/**
+ * Human-readable validation problems. An empty array means the schedule is
+ * safe to save; the editor blocks saving while anything is listed.
+ */
+export function scheduleProblems(schedule: VisibilitySchedule | null | undefined): string[] {
+  if (!schedule) return [];
+  const problems: string[] = [];
+  const rawFrom = schedule.publishAt?.trim();
+  const rawUntil = schedule.unpublishAt?.trim();
+  const from = toInstant(rawFrom);
+  const until = toInstant(rawUntil);
+  if (rawFrom && from == null) problems.push("Start date is not a valid date and time.");
+  if (rawUntil && until == null) problems.push("End date is not a valid date and time.");
+  if (from != null && until != null && until <= from) {
+    problems.push("End date must be after the start date.");
+  }
+  return problems;
+}
+
+/** A schedule problem, addressed by where in a content document it was found. */
+export type ScheduleProblemAt = { path: string; problem: string };
+
+/**
+ * Every schedule problem anywhere in a content document.
+ *
+ * Content records are free-form JSON — a navigation tree, footer columns,
+ * shared blocks — so there is no fixed field list to validate. Any object under
+ * a `schedule` key is a schedule, wherever it sits, and each one is checked
+ * with the same {@link scheduleProblems} the editor shows. `path` is the dotted
+ * location, so a refusal can say which item is wrong instead of just "invalid".
+ */
+export function scheduleProblemsIn(value: unknown, path = ""): ScheduleProblemAt[] {
+  const found: ScheduleProblemAt[] = [];
+  const visit = (node: unknown, at: string) => {
+    if (Array.isArray(node)) {
+      node.forEach((entry, i) => visit(entry, `${at}[${i}]`));
+      return;
+    }
+    if (!isRecord(node)) return;
+    for (const [key, child] of Object.entries(node)) {
+      const here = at ? `${at}.${key}` : key;
+      if (key === "schedule" && isRecord(child)) {
+        for (const problem of scheduleProblems(normalizeSchedule(child))) {
+          found.push({ path: here, problem });
+        }
+        continue;
+      }
+      visit(child, here);
+    }
+  };
+  visit(value, path);
+  return found;
+}
+
+/** Convert a `datetime-local` value typed in `tz` into the stored UTC ISO. */
+export function localInputToIso(local: string | null | undefined, tz?: string | null): string | null {
+  const instant = zonedLocalToInstant(local, tz);
+  return instant == null ? null : new Date(instant).toISOString();
+}
+
+/** Convert a stored UTC ISO into the `datetime-local` value for `tz`. */
+export function isoToLocalInput(iso: string | null | undefined, tz?: string | null): string {
+  const instant = toInstant(iso);
+  return instant == null ? "" : instantToZonedLocal(instant, tz);
+}
+
+/** One-line summary of a schedule, in the site's timezone. */
+export function describeSchedule(
+  schedule: VisibilitySchedule | null | undefined,
+  tz?: string | null,
+  locale = "en-GB",
+): string {
+  if (!schedule || schedule.enabled === false) return "Hidden";
+  const from = toInstant(schedule.publishAt);
+  const until = toInstant(schedule.unpublishAt);
+  if (from == null && until == null) return "Always visible";
+  if (from != null && until != null) {
+    return `Visible ${formatInZone(from, tz, locale)} – ${formatInZone(until, tz, locale)}`;
+  }
+  if (from != null) return `Visible from ${formatInZone(from, tz, locale)}`;
+  return `Visible until ${formatInZone(until as number, tz, locale)}`;
+}
+
+/** Filter any schedulable list down to what a visitor may see at `now`. */
+export function visibleItems<T extends Schedulable>(
+  items: readonly T[] | undefined,
+  now: number | Date,
+): T[] {
+  return (items ?? []).filter((item) => isVisibleAt(item.schedule, now));
+}

package/src/config/modules.ts

@@ -18,7 +18,6 @@ import {
   Blocks,
   Calendar,
   ClipboardList,
-  Globe,
   GraduationCap,
   MessageSquare,
   MessageSquareQuote,
@@ -71,15 +70,20 @@ export type CmsModuleDefinition = {
   /** One line of help on the Modules screen. */
   readonly description?: string;
   /**
-   * Sidebar contribution. Absent for modules with no screen of their own —
-   * `email`, `tracking` and `backup` live under Admin.
+   * Sidebar contribution. Absent for modules whose screen belongs under Admin
+   * rather than in the sidebar — `email`, `tracking`, `backup` and `domains`.
    */
   readonly nav?: CmsModuleNav;
   /**
-   * Minimum role for the module's own screens. `superadmin` is used by modules
-   * that can destroy or exfiltrate data.
+   * Minimum role for the module's own screens.
+   *
+   * This is not decoration: it has to name the same role the module's server
+   * functions actually demand. `admin` is used by modules whose writes call
+   * `has_role(user, 'admin')`, and `superadmin` by modules that can destroy or
+   * exfiltrate data. A module advertised to staff whose saves are refused sends
+   * an editor to a screen that cannot work.
    */
-  readonly requiresRole?: "staff" | "superadmin";
+  readonly requiresRole?: "staff" | "admin" | "superadmin";
   /**
    * True when the module contributes a component to the public site. The public
    * runtime host renders only the modules that both declare this and are
@@ -118,14 +122,13 @@ export const CMS_MODULES = [
     requiresRole: "staff",
   },
   { key: "email", label: "Transactional email", defaultEnabled: true, requiresRole: "staff" },
-  { key: "tracking", label: "Code & tracking", defaultEnabled: true, requiresRole: "staff" },
+  { key: "tracking", label: "Code & tracking", defaultEnabled: true, requiresRole: "admin" },
   { key: "backup", label: "Backup & restore", defaultEnabled: true, requiresRole: "superadmin" },
   {
     key: "domains",
-    label: "Custom domains",
+    label: "Languages & domains",
     defaultEnabled: false,
-    nav: { path: "/domains", label: "Domains", icon: Globe },
-    requiresRole: "staff",
+    requiresRole: "admin",
   },
   {
     key: "forms",
@@ -166,6 +169,27 @@ export function findCmsModule(key: CmsModuleKey): CmsModuleDefinition | undefine
   return CMS_MODULES.find((module) => module.key === key);
 }
 
+/**
+ * Whether a viewer's platform roles satisfy a module's `requiresRole`.
+ *
+ * `staff` is not a row in `user_roles`: it is the host's own `is_staff` check,
+ * which anyone rendering the backoffice has already passed, so it is satisfied
+ * here. `admin` and `superadmin` are rows, and each has to be held in its own
+ * right — the server asks `has_role(user, 'admin')`, and that question is not
+ * answered by holding some other, higher-sounding role. Inferring one from the
+ * other here would put an editable screen in front of someone whose every save
+ * the server then refuses.
+ */
+export function moduleRoleSatisfied(
+  requiresRole: CmsModuleDefinition["requiresRole"],
+  roles: readonly string[],
+): boolean {
+  if (requiresRole === "admin" || requiresRole === "superadmin") {
+    return roles.includes(requiresRole);
+  }
+  return true;
+}
+
 /** The defaults a site starts from, derived so the two can never disagree. */
 export const DEFAULT_FEATURE_FLAGS: SiteFeatureFlags = Object.fromEntries(
   CMS_MODULES.map((module) => [module.key, module.defaultEnabled]),