@cosmicdrift/kumiko-samples 0.377.0 → 0.379.0

package/packages/bundled-features/src/template-resolver/feature.ts

@@ -3,44 +3,51 @@ import {
   createSystemConfig,
   defineFeature,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { isCollectionRefusedKind } from "./constants.ts";
 import { bySlugQuery } from "./handlers/by-slug.query.ts";
 import { byTenantQuery } from "./handlers/by-tenant.query.ts";
 import { makeCollectionItemQuery } from "./handlers/collection-item.query.ts";
 import { makeCollectionListQuery } from "./handlers/collection-list.query.ts";
 import { makeCollectionSetWrite } from "./handlers/collection-set.write.ts";
-import { copyLocaleWrite } from "./handlers/copy-locale.write.ts";
+import { makeCopyLocaleWrite } from "./handlers/copy-locale.write.ts";
 import { diffToSystemQuery } from "./handlers/diff-to-system.query.ts";
-import { discardDraftSystemWrite, discardDraftWrite } from "./handlers/discard-draft.write.ts";
+import {
+  makeDiscardDraftSystemWrite,
+  makeDiscardDraftWrite,
+} from "./handlers/discard-draft.write.ts";
 import { documentBlocksQuery } from "./handlers/document-blocks.query.ts";
 import { exportBundleQuery } from "./handlers/export-bundle.query.ts";
 import { findByIdQuery } from "./handlers/find-by-id.query.ts";
-import { importBundleWrite } from "./handlers/import-bundle.write.ts";
+import { makeImportBundleWrite } from "./handlers/import-bundle.write.ts";
 import { importBundleSystemWrite } from "./handlers/import-bundle-system.write.ts";
 import { layoutSourceQuery } from "./handlers/layout-source.query.ts";
 import { listQuery } from "./handlers/list.query.ts";
-import { overviewQuery } from "./handlers/overview.query.ts";
-import { patchDraftWrite } from "./handlers/patch-draft.write.ts";
+import { makeOverviewQuery } from "./handlers/overview.query.ts";
+import { makePatchDraftWrite } from "./handlers/patch-draft.write.ts";
 import { previewQuery } from "./handlers/preview.query.ts";
-import { resetToSystemWrite } from "./handlers/reset-to-system.write.ts";
-import { resourceLinkPdfWrite } from "./handlers/resource-link-pdf.write.ts";
-import { resourceRemoveWrite } from "./handlers/resource-remove.write.ts";
-import { resourceUploadWrite } from "./handlers/resource-upload.write.ts";
-import { sendTestWrite } from "./handlers/send-test.write.ts";
-import { setWrite } from "./handlers/set.write.ts";
+import { makeResetToSystemWrite } from "./handlers/reset-to-system.write.ts";
+import { makeResourceLinkPdfWrite } from "./handlers/resource-link-pdf.write.ts";
+import { makeResourceRemoveWrite } from "./handlers/resource-remove.write.ts";
+import { makeResourceUploadWrite } from "./handlers/resource-upload.write.ts";
+import { makeSendTestWrite } from "./handlers/send-test.write.ts";
+import { sendTestStatusQuery } from "./handlers/send-test-status.query.ts";
+import { makeSetWrite } from "./handlers/set.write.ts";
 import { tenantOverridesQuery } from "./handlers/tenant-overrides.query.ts";
 import {
-  archiveSystemWrite,
-  archiveWrite,
-  publishSystemWrite,
-  publishWrite,
+  makeArchiveSystemWrite,
+  makeArchiveWrite,
+  makePublishSystemWrite,
+  makePublishWrite,
 } from "./handlers/toggle-status.write.ts";
 import { upsertSystemWrite } from "./handlers/upsert-system.write.ts";
-import { upsertTenantWrite } from "./handlers/upsert-tenant.write.ts";
+import { makeUpsertTenantWrite } from "./handlers/upsert-tenant.write.ts";
 import { usageQuery } from "./handlers/usage.query.ts";
 import { validateQuery } from "./handlers/validate.query.ts";
+import { TEMPLATE_RESOLVER_I18N } from "./i18n.ts";
 import { templateResourceEntity } from "./table.ts";
+import type { TemplateDeliveryPolicy } from "./template-delivery-policy.ts";
+import type { TenantEditableTemplate } from "./template-edit-policy.ts";
 import { userContentEntryEntity } from "./user-content-table.ts";
+import { DEFAULT_COLLECTION_ACCESS, isCollectionRefusedKind } from "./web/constants.ts";
 
 // template-resolver — structured template storage with tenant-override
 // hierarchy, locale fallback and resource linking via file-foundation.
@@ -61,6 +68,13 @@ export type TemplateResolverOptions = {
    *  access rule, so the dispatcher enforces the separation instead of a
    *  branch in a shared handler. */
   readonly collections?: readonly ContentCollectionDefinition[];
+  /** Templates a TenantAdmin may edit for the own tenant (override, draft, publish, archive,
+   *  reset, copy-locale, import, resources). Without an entry only a SystemAdmin edits.
+   *  A tenant-edited mail goes out under the platform's name, so the app opts in per
+   *  template instead of the framework guessing which ones a tenant may reword.
+   *  `access` is required: the host decides its role vocabulary here, like for
+   *  `collections`. SystemAdmin always passes. */
+  readonly tenantEditable?: readonly TenantEditableTemplate[];
 };
 
 function assertCollectionKindsAllowed(collections: readonly ContentCollectionDefinition[]): void {
@@ -73,20 +87,51 @@ function assertCollectionKindsAllowed(collections: readonly ContentCollectionDef
   }
 }
 
+function assertTenantEditableValid(entries: readonly TenantEditableTemplate[]): void {
+  const seen = new Set<string>();
+  for (const entry of entries) {
+    const key = `${entry.kind}/${entry.slug}`;
+    if (seen.has(key)) {
+      throw new Error(`template-resolver: tenantEditable lists "${key}" twice`);
+    }
+    seen.add(key);
+    if (entry.slug.trim() === "") {
+      throw new Error(
+        `template-resolver: tenantEditable entry of kind "${entry.kind}" has an empty slug`,
+      );
+    }
+    if (entry.access.roles.length === 0) {
+      throw new Error(
+        `template-resolver: tenantEditable entry "${entry.kind}/${entry.slug}" has no roles in access`,
+      );
+    }
+  }
+}
+
 export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}) {
   const collections = opts.collections ?? [];
   assertCollectionKindsAllowed(collections);
+  const tenantEditable = opts.tenantEditable ?? [];
+  assertTenantEditableValid(tenantEditable);
+  const policy = { tenantEditable };
+  const deliveryPolicy: TemplateDeliveryPolicy = {
+    tenantEditable: tenantEditable.map(({ kind, slug }) => ({ kind, slug })),
+    collectionKinds: collections
+      .filter((c) => c.ownership !== "user" && c.access !== undefined)
+      .map((c) => c.kind),
+  };
   const hasUserOwned = collections.some((c) => c.ownership === "user");
   return defineFeature("template-resolver", (r) => {
     r.describe(
       [
         "Every piece of editable text lives here, in one entity: mail bodies, notification texts, PDF document templates, AI prompts and plain text blocks. What a record is used for is the `kind` (`notification`, `mail`, `mail-layout`, `document-pdf`, `pdf-layout`, `ai-prompt`, `text-block`, `snippet`, `image-snapshot`).",
         "Reading is one call — `ctx.templateResolver.resolveTemplate({ tenantId, slug, kind, locale })`. It walks four levels: tenant+locale, system+locale, tenant+fallback-locale, system+fallback-locale. A tenant overrides a system default by simply having its own record; no application code changes. Writing programmatically goes through the `upsertSystem`, `upsertTenant`, `publish` and `archive` write handlers; a SystemAdmin retires or restores a system default with `publishSystem` and `archiveSystem`, and a tenant drops its override with `resetToSystem`. Saving a draft over an active template keeps the active version served and stores the edit beside it (column `draft`); `publish` makes it the served version, `discardDraft` / `discardDraftSystem` throws it away.",
+        'Editing templates is for SystemAdmin only. A TenantAdmin edits only the templates the app unlocks at the mount site, `createTemplateResolverFeature({ tenantEditable: [{ kind: "mail", slug: "status-update", access: { roles: ["TenantAdmin"] } }] })`, and every write handler enforces that on the server (override, draft, publish, archive, reset, copy-locale, import, resources, `set`). Each entry carries the `access` roles allowed to edit it, because a bundled feature cannot know the host\'s roles. The same list decides delivery: a tenant override is served (mail, PDF, layouts, text blocks) only while its template is listed in tenantEditable; otherwise the system version is served. A locked override stays stored, a SystemAdmin sees it in the overview marked as not delivered, and listing the template makes it effective again. Tenant rows of a collection mounted with `access` are always served. A collection mounted without `access` is SystemAdmin only.',
         "Text an editor should be able to change belongs in a collection, declared at mount: `createTemplateResolverFeature({ collections: [{ id, kind, access: { roles }, nav }] })`. It appears in the navigation, and `access` is part of the mount because a bundled feature cannot know the host's roles. Each collection gets its own `<id>-list` / `<id>-item` / `<id>-set` handlers, so the dispatcher enforces the separation.",
         "How a collection is edited follows from `contentFormat`: `plain` gives a text area, `rich` a small WYSIWYG (bold, italic, headings, lists, links), `markdown` a text area that stores markdown text (same insertable chips as `plain`). All three offer the collection's `variableSchema` as insertable chips and a preview rendered with sample data — an editor sees what `{{firstName}}` becomes without sending a mail. An app can register its own editor for a format; the last `clientFeature` that registers a format wins (a conflict logs a warning).",
         'A collection is tenant-wide by default. With `ownership: "user"` every user keeps their own entries — mail signatures being the obvious case. Those rows live in the separate `user-content-entry` entity and count as user data, so mounting one also requires the `template-resolver-user-data` feature and a migration on the app side.',
         "`validate` dry-runs the write pipeline for a draft (sanitizer, layout rules, placeholders) and reports what the template uses and misses. `export-bundle` / `import-bundle` (and `import-bundle-system`) move one template with all locales and resource files between tenants or environments; `copy-locale` starts a translation from an existing locale. Layouts are structured: a mail or PDF layout is `data-header` / `data-content` / `data-signature` / `data-footer` regions, and mjml layout source is system-only.",
-        "`preview` renders a draft (or the stored template) with sample values taken from the `example` of each declared variable, through the same gates and the same mail renderer as a real send, and returns subject, html, `displayHtml` (the html with cid images as data URIs for an editor), text, attachments (inline images and files) and `checks` (images resolved, plain text present, size under 10 MiB, required placeholders used); nothing is saved or sent. `send-test` mails that rendering to the calling user's own address only, subject prefixed with `[TEST]`, at most 10 per user and hour; it needs `delivery`, `channel-email` and `renderer-mail-html` to be mounted.",
+        "`preview` renders a draft (or the stored template) with sample values taken from the `example` of each declared variable, through the same gates and the same mail renderer as a real send, and returns subject, html, `displayHtml` (the html with cid images as data URIs for an editor), text, attachments (inline images and files) and `checks` (images resolved, plain text present, size under 10 MiB, required placeholders used); nothing is saved or sent. `send-test` mails that rendering to the calling user's own address only, subject prefixed with `[TEST]`, at most 10 per user and hour; it needs `delivery`, `channel-email` and `renderer-mail-html` to be mounted. `send-test-status` tells an editor beforehand whether that send can work for the caller (`canSend`, else `reason` `no_channel` or `no_address`), never returning the address.",
         'Images used by a template (`<img data-resource="logo">`) are uploaded with `resourceUpload`, which re-encodes them, stores a file and links it under the key; `resourceRemove` unlinks it. `linkedResources` is written only through these two handlers. With `purpose: "attachment"` and a `fileName`, `resourceUpload` stores a PDF, PNG or JPEG as a file attachment of a mail template (original bytes, at most 10) that the mail renderer attaches after the inline images. `resourceLinkPdf` instead links a `document-pdf` template under a key: every mail sent from the template then carries that PDF, rendered at send time with the mail\'s own variables and locale, under a file name pattern such as `invoice-{{number}}.pdf`; files and linked PDFs share the limit of 10.',
         "Replaces the former `text-content` feature; its blocks now live here as kind `text-block`.",
       ].join("\n\n"),
@@ -101,6 +146,7 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
         resourceMaxBytes: createSystemConfig("number", { default: 2_097_152, bounds: { min: 1 } }),
       },
     });
+    r.translations({ keys: TEMPLATE_RESOLVER_I18N });
     r.entity({ name: "template-resource", ...templateResourceEntity });
     // Only when the app actually mounts a user-owned collection: the entity's
     // `content` is `userOwned`, which makes it subject data — the boot guard
@@ -110,23 +156,23 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
 
     const handlers = {
       upsertSystem: r.writeHandler(upsertSystemWrite),
-      upsertTenant: r.writeHandler(upsertTenantWrite),
-      publish: r.writeHandler(publishWrite),
-      archive: r.writeHandler(archiveWrite),
-      publishSystem: r.writeHandler(publishSystemWrite),
-      archiveSystem: r.writeHandler(archiveSystemWrite),
-      discardDraft: r.writeHandler(discardDraftWrite),
-      discardDraftSystem: r.writeHandler(discardDraftSystemWrite),
-      resetToSystem: r.writeHandler(resetToSystemWrite),
-      set: r.writeHandler(setWrite),
-      importBundle: r.writeHandler(importBundleWrite),
+      upsertTenant: r.writeHandler(makeUpsertTenantWrite(policy)),
+      publish: r.writeHandler(makePublishWrite(policy)),
+      archive: r.writeHandler(makeArchiveWrite(policy)),
+      publishSystem: r.writeHandler(makePublishSystemWrite(policy)),
+      archiveSystem: r.writeHandler(makeArchiveSystemWrite(policy)),
+      discardDraft: r.writeHandler(makeDiscardDraftWrite(policy)),
+      discardDraftSystem: r.writeHandler(makeDiscardDraftSystemWrite(policy)),
+      resetToSystem: r.writeHandler(makeResetToSystemWrite(policy)),
+      set: r.writeHandler(makeSetWrite(policy)),
+      importBundle: r.writeHandler(makeImportBundleWrite(policy)),
       importBundleSystem: r.writeHandler(importBundleSystemWrite),
-      copyLocale: r.writeHandler(copyLocaleWrite),
-      resourceUpload: r.writeHandler(resourceUploadWrite),
-      resourceRemove: r.writeHandler(resourceRemoveWrite),
-      resourceLinkPdf: r.writeHandler(resourceLinkPdfWrite),
-      sendTest: r.writeHandler(sendTestWrite),
-      patchDraft: r.writeHandler(patchDraftWrite),
+      copyLocale: r.writeHandler(makeCopyLocaleWrite(policy)),
+      resourceUpload: r.writeHandler(makeResourceUploadWrite(policy)),
+      resourceRemove: r.writeHandler(makeResourceRemoveWrite(policy)),
+      resourceLinkPdf: r.writeHandler(makeResourceLinkPdfWrite(policy)),
+      sendTest: r.writeHandler(makeSendTestWrite(policy)),
+      patchDraft: r.writeHandler(makePatchDraftWrite(policy)),
     };
 
     const queries = {
@@ -135,7 +181,7 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
       bySlug: r.queryHandler(bySlugQuery),
       byTenant: r.queryHandler(byTenantQuery),
       usage: r.queryHandler(usageQuery),
-      overview: r.queryHandler(overviewQuery),
+      overview: r.queryHandler(makeOverviewQuery(policy)),
       layoutSource: r.queryHandler(layoutSourceQuery),
       tenantOverrides: r.queryHandler(tenantOverridesQuery),
       diffToSystem: r.queryHandler(diffToSystemQuery),
@@ -143,13 +189,17 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
       preview: r.queryHandler(previewQuery),
       documentBlocks: r.queryHandler(documentBlocksQuery),
       exportBundle: r.queryHandler(exportBundleQuery),
+      sendTestStatus: r.queryHandler(sendTestStatusQuery),
     };
 
     for (const collection of collections) {
-      r.contentCollection(collection);
+      r.contentCollection({
+        ...collection,
+        access: collection.access ?? DEFAULT_COLLECTION_ACCESS,
+      });
       r.queryHandler(makeCollectionListQuery(collection));
       r.queryHandler(makeCollectionItemQuery(collection));
-      r.writeHandler(makeCollectionSetWrite(collection));
+      r.writeHandler(makeCollectionSetWrite(collection, policy));
     }
 
     // Visual-tree actions for the text-block content tree. The handle is
@@ -163,6 +213,6 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
       create: { args: { folder: emptyString } },
     });
 
-    return { handlers, queries, treeHandle };
+    return { handlers, queries, treeHandle, deliveryPolicy };
   });
 }

package/packages/bundled-features/src/template-resolver/handlers/by-slug.query.ts

@@ -1,8 +1,10 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { TEXT_BLOCK_KIND } from "../constants.ts";
+import { isRowDeliveredTo } from "../api.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
+import { TEXT_BLOCK_KIND } from "../web/constants.ts";
 
 // Public read of a single text-block by (tenantId, slug, locale). Anonymous
 // must be listed explicitly — `openToAll` alone is auth-only (regression
@@ -39,6 +41,9 @@ export const bySlugQuery = defineQueryHandler({
     });
 
     if (!row) return null;
+    if (!(await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), query.user, row))) {
+      return null;
+    }
     return {
       slug: row.slug,
       locale: row.locale,

package/packages/bundled-features/src/template-resolver/handlers/by-tenant.query.ts

@@ -2,8 +2,10 @@ import { castTenantRows, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { TEXT_BLOCK_KIND } from "../constants.ts";
+import { filterDeliveredTo } from "../api.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
+import { TEXT_BLOCK_KIND } from "../web/constants.ts";
 
 // All text-blocks of one tenant — feeds the public content tree sidebar.
 // Anonymous is listed explicitly so no-JWT visitors get the sidebar on public
@@ -39,8 +41,10 @@ export const byTenantQuery = defineQueryHandler({
     const rows = castTenantRows<TemplateResourceRow>(
       await selectMany(ctx.db, templateResourcesTable, { tenantId, kind: TEXT_BLOCK_KIND }),
     );
+    const policy = deliveryPolicyOf(ctx.registry);
+    const served = await filterDeliveredTo(ctx.db, policy, query.user, rows);
     return {
-      blocks: rows.map((row) => ({
+      blocks: served.map((row) => ({
         slug: row.slug,
         locale: row.locale,
         title: row.title,

package/packages/bundled-features/src/template-resolver/handlers/collection-item.query.ts

@@ -4,10 +4,10 @@ import {
   defineQueryHandler,
 } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { DEFAULT_COLLECTION_ACCESS } from "../web/constants.ts";
 import {
   type CollectionEntryRow,
   collectionStore,
-  DEFAULT_COLLECTION_ACCESS,
   toCollectionEntry,
 } from "./collection-shared.ts";
 

package/packages/bundled-features/src/template-resolver/handlers/collection-list.query.ts

@@ -4,10 +4,10 @@ import {
   defineQueryHandler,
 } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { DEFAULT_COLLECTION_ACCESS } from "../web/constants.ts";
 import {
   type CollectionEntryRow,
   collectionStore,
-  DEFAULT_COLLECTION_ACCESS,
   toCollectionEntry,
 } from "./collection-shared.ts";
 

package/packages/bundled-features/src/template-resolver/handlers/collection-set.write.ts

@@ -7,13 +7,11 @@ import {
 import { ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.ts";
-import { isCollectionRefusedKind } from "../constants.ts";
+import { systemTemplateExists } from "../api.ts";
 import { documentViolationsToFieldIssues, sanitizeTemplateBody } from "../document-sanitizer.ts";
-import {
-  type CollectionEntryRow,
-  collectionStore,
-  DEFAULT_COLLECTION_ACCESS,
-} from "./collection-shared.ts";
+import { refuseTemplateEdit, type TemplateEditPolicy } from "../template-edit-policy.ts";
+import { DEFAULT_COLLECTION_ACCESS, isCollectionRefusedKind } from "../web/constants.ts";
+import { type CollectionEntryRow, collectionStore } from "./collection-shared.ts";
 import { contentFormatSchema, folderSchema, localeSchema, slugSchema } from "./shared.ts";
 
 // Upsert inside one collection. Mirrors set.write for text-blocks, but the
@@ -23,7 +21,10 @@ import { contentFormatSchema, folderSchema, localeSchema, slugSchema } from "./s
 //
 // Like set.write this publishes on save (status active, empty variableSchema)
 // — the draft stage lives on upsertTenant + publish.
-export function makeCollectionSetWrite(collection: ContentCollectionDefinition) {
+export function makeCollectionSetWrite(
+  collection: ContentCollectionDefinition,
+  editPolicy: TemplateEditPolicy,
+) {
   const store = collectionStore(collection);
   return defineWriteHandler({
     name: `${collection.id}-set`,
@@ -79,6 +80,18 @@ export function makeCollectionSetWrite(collection: ContentCollectionDefinition)
         );
       }
 
+      // The collection's access must not open a system template that the app did not unlock.
+      if (
+        collection.ownership !== "user" &&
+        (await systemTemplateExists(db, collection.kind, event.payload.slug))
+      ) {
+        const refused = refuseTemplateEdit(editPolicy, event.user, {
+          slug: event.payload.slug,
+          kind: collection.kind,
+        });
+        if (refused) return refused;
+      }
+
       const existing = await fetchOne<CollectionEntryRow>(db, store.table, {
         tenantId,
         slug: event.payload.slug,

package/packages/bundled-features/src/template-resolver/handlers/collection-shared.ts

@@ -1,7 +1,6 @@
 import type { EventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import type {
-  AccessRule,
   ContentCollectionDefinition,
   SessionUser,
   TenantId,
@@ -11,11 +10,6 @@ import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { templateResourceEntity, templateResourcesTable } from "../table.ts";
 import { userContentEntriesTable, userContentEntryEntity } from "../user-content-table.ts";
 
-// Applies when an app mounts a collection without saying who may reach it.
-// Deliberately narrow: a collection whose access nobody decided should be
-// invisible to normal users rather than open by default.
-export const DEFAULT_COLLECTION_ACCESS: AccessRule = { roles: ["TenantAdmin", "SystemAdmin"] };
-
 const templateExecutor = createEventStoreExecutor(templateResourcesTable, templateResourceEntity, {
   entityName: "template-resource",
 });

package/packages/bundled-features/src/template-resolver/handlers/copy-locale.write.ts

@@ -16,17 +16,22 @@ import {
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.ts";
-import { CONTENT_FORMATS, type ContentFormat } from "../constants.ts";
 import { type LinkedResourceEntry, parseLinkedResourceEntries } from "../linked-resources.ts";
-import { TemplateResolverErrors } from "../qualified-names.ts";
 import {
   createLinkedResourceCopies,
   prepareLinkedResourceCopiesBeforeTransaction,
 } from "../store-template-resource.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
 import { toWorkingRow, type WorkingRow } from "../template-draft.ts";
+import {
+  refuseTemplateEdit,
+  type TemplateEditPolicy,
+  templateEditAccess,
+} from "../template-edit-policy.ts";
 import { attachTemplateResources } from "../template-resources.ts";
 import { resolveTemplateVariables } from "../template-validation.ts";
+import { CONTENT_FORMATS, type ContentFormat } from "../web/constants.ts";
+import { TemplateResolverErrors } from "../web/qualified-names.ts";
 import { targetExistsIssue } from "./bundle-import.ts";
 import { kindSchema, localeSchema, templateSlugSchema } from "./shared.ts";
 import { parseStoredJson, storedRecord } from "./template-gates.ts";
@@ -97,6 +102,7 @@ type CopyRequest = {
 // Runs before the upload (reject early, store nothing) and again in the transaction on the fresh rows.
 async function checkCopyRequest(
   ctx: WriteCtx,
+  policy: TemplateEditPolicy,
   event: {
     readonly user: SessionUser;
     readonly payload: z.infer<typeof copyLocaleSchema>;
@@ -113,6 +119,7 @@ async function checkCopyRequest(
   }
   const tenantId = scope === "system" ? SYSTEM_TENANT_ID : event.user.tenantId;
   const refused =
+    (scope === "tenant" ? refuseTemplateEdit(policy, event.user, { slug, kind }) : null) ??
     refuseTenantScopeUnderSystemTenant(scope, tenantId) ??
     refuseSystemOnlyTenantOverride(ctx.registry, scope, slug, kind);
   if (refused !== null) return refused;
@@ -155,62 +162,64 @@ async function checkCopyRequest(
   };
 }
 
-export const copyLocaleWrite = defineWriteHandler({
-  name: "copy-locale",
-  schema: copyLocaleSchema,
-  access: { roles: ["TenantAdmin", "SystemAdmin"] },
-  description:
-    "Copies the text of one locale of a template into another locale as a draft override of the caller's tenant, taking the tenant's own row or else the system default as the source; use it as the starting point for a translation. It refuses an existing target unless overwrite is set. With scope system (SystemAdmin only) both source and target are system-default rows and the target lands as a system draft; any other caller gets a 403.",
-  beforeTransaction: async (event, ctx) => {
-    const request = await checkCopyRequest(ctx, event);
-    if (!request.isSuccess) return request;
-    if (!request.data.sourceIsForeign) return { isSuccess: true, data: [] };
-    return prepareLinkedResourceCopiesBeforeTransaction({
-      ctx,
-      user: event.user,
-      tenantId: request.data.tenantId,
-      resources: request.data.sourceResources,
-    });
-  },
-  handler: async (event, ctx) => {
-    const { slug, kind, toLocale } = event.payload;
-    const request = await checkCopyRequest(ctx, event);
-    if (!request.isSuccess) return request;
-    const { scope, tenantId, source, contentFormat, sourceResources, sourceIsForeign } =
-      request.data;
+export function makeCopyLocaleWrite(policy: TemplateEditPolicy) {
+  return defineWriteHandler({
+    name: "copy-locale",
+    schema: copyLocaleSchema,
+    access: templateEditAccess(policy.tenantEditable),
+    description:
+      "Copies the text of one locale of a template into another locale as a draft override of the caller's tenant, taking the tenant's own row or else the system default as the source; use it as the starting point for a translation. It refuses an existing target unless overwrite is set. With scope system (SystemAdmin only) both source and target are system-default rows and the target lands as a system draft; any other caller gets a 403. A TenantAdmin may copy only templates the app lists in tenantEditable, otherwise SystemAdmin only.",
+    beforeTransaction: async (event, ctx) => {
+      const request = await checkCopyRequest(ctx, policy, event);
+      if (!request.isSuccess) return request;
+      if (!request.data.sourceIsForeign) return { isSuccess: true, data: [] };
+      return prepareLinkedResourceCopiesBeforeTransaction({
+        ctx,
+        user: event.user,
+        tenantId: request.data.tenantId,
+        resources: request.data.sourceResources,
+      });
+    },
+    handler: async (event, ctx) => {
+      const { slug, kind, toLocale } = event.payload;
+      const request = await checkCopyRequest(ctx, policy, event);
+      if (!request.isSuccess) return request;
+      const { scope, tenantId, source, contentFormat, sourceResources, sourceIsForeign } =
+        request.data;
 
-    const variableSchema = storedRecord(source.variableSchema);
-    const written = await writeTemplateRow({
-      ctx,
-      user: event.user,
-      tenantId,
-      scope,
-      status: "draft",
-      variables: resolveTemplateVariables(ctx.registry, slug, variableSchema),
-      payload: {
-        slug,
-        kind,
-        locale: toLocale,
-        content: source.content,
-        contentFormat,
-        variableSchema,
-        meta: parseStoredJson(source.meta),
-        title: source.title,
-        folder: source.folder,
-      },
-    });
-    if (!written.isSuccess) return written;
-    const resources = sourceIsForeign
-      ? await createLinkedResourceCopies({ ctx, user: event.user, tenantId }, event.prepared)
-      : { isSuccess: true as const, data: sourceResources };
-    if (!resources.isSuccess) return resources;
-    const attached = await attachTemplateResources(ctx, {
-      user: event.user,
-      tenantId,
-      templateId: written.data.id,
-      resources: resources.data,
-    });
-    if (!attached.isSuccess) return attached;
-    return written;
-  },
-});
+      const variableSchema = storedRecord(source.variableSchema);
+      const written = await writeTemplateRow({
+        ctx,
+        user: event.user,
+        tenantId,
+        scope,
+        status: "draft",
+        variables: resolveTemplateVariables(ctx.registry, slug, variableSchema),
+        payload: {
+          slug,
+          kind,
+          locale: toLocale,
+          content: source.content,
+          contentFormat,
+          variableSchema,
+          meta: parseStoredJson(source.meta),
+          title: source.title,
+          folder: source.folder,
+        },
+      });
+      if (!written.isSuccess) return written;
+      const resources = sourceIsForeign
+        ? await createLinkedResourceCopies({ ctx, user: event.user, tenantId }, event.prepared)
+        : { isSuccess: true as const, data: sourceResources };
+      if (!resources.isSuccess) return resources;
+      const attached = await attachTemplateResources(ctx, {
+        user: event.user,
+        tenantId,
+        templateId: written.data.id,
+        resources: resources.data,
+      });
+      if (!attached.isSuccess) return attached;
+      return written;
+    },
+  });
+}

package/packages/bundled-features/src/template-resolver/handlers/diff-to-system.query.ts

@@ -3,6 +3,7 @@ import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framew
 import { NotFoundError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
 import { isHiddenSystemDraft } from "../template-draft.ts";
 import { buildOverrideDiff } from "./override-diff.ts";
 
@@ -16,7 +17,12 @@ export const diffToSystemQuery = defineQueryHandler({
     const tenantRow = await fetchOne<TemplateResourceRow>(ctx.db, templateResourcesTable, {
       id: query.payload.id,
     });
-    if (!tenantRow || tenantRow.tenantId !== query.user.tenantId || tenantRow.scope !== "tenant") {
+    if (
+      !tenantRow ||
+      tenantRow.tenantId !== query.user.tenantId ||
+      tenantRow.scope !== "tenant" ||
+      !isRowServedTo(deliveryPolicyOf(ctx.registry), query.user, tenantRow)
+    ) {
       throw new NotFoundError("template-resource", query.payload.id);
     }
     const systemRow = await fetchOne<TemplateResourceRow>(ctx.db, templateResourcesTable, {

package/packages/bundled-features/src/template-resolver/handlers/discard-draft.write.ts

@@ -1,20 +1,37 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { TemplateResolverErrors } from "../qualified-names.ts";
+import {
+  refuseMissingTemplate,
+  refuseTemplateEdit,
+  type TemplateEditPolicy,
+} from "../template-edit-policy.ts";
+import { TemplateResolverErrors } from "../web/qualified-names.ts";
 import { executor } from "./shared.ts";
 import { loadTargetRow, type StatusTarget, writeAccessFor } from "./toggle-status.write.ts";
 
-function createDiscardDraftHandler(name: string, target: StatusTarget, description: string) {
+function createDiscardDraftHandler(
+  policy: TemplateEditPolicy,
+  name: string,
+  target: StatusTarget,
+  description: string,
+) {
   return defineWriteHandler({
     name,
     schema: z.object({ id: z.string().min(1) }),
-    access: writeAccessFor(target),
+    access: writeAccessFor(target, policy),
     ...(target === "system" ? { agent: { risk: "high" as const } } : {}),
     description,
     handler: async (event, ctx) => {
       const { db, scoped, row } = await loadTargetRow(ctx, target, event.user, event.payload.id);
-      if (!row) return writeFailure(new NotFoundError("template-resource", event.payload.id));
+      if (!row) {
+        const refused = target === "own" ? refuseMissingTemplate(policy, event.user) : null;
+        return refused ?? writeFailure(new NotFoundError("template-resource", event.payload.id));
+      }
+      if (target === "own") {
+        const refused = refuseTemplateEdit(policy, event.user, row);
+        if (refused !== null) return refused;
+      }
       if (row.draft === null) {
         return writeFailure(
           new ValidationError({
@@ -40,13 +57,19 @@ function createDiscardDraftHandler(name: string, target: StatusTarget, descripti
   });
 }
 
-export const discardDraftWrite = createDiscardDraftHandler(
-  "discard-draft",
-  "own",
-  "Throws away the open draft of one template resource of the caller's tenant so the editor shows the active version again; the served version is untouched. Refused with no_draft when there is no draft.",
-);
-export const discardDraftSystemWrite = createDiscardDraftHandler(
-  "discard-draft-system",
-  "system",
-  "Throws away the open draft of one system-default template; the served version stays. SystemAdmin only, refused with no_draft when there is no draft.",
-);
+export function makeDiscardDraftWrite(policy: TemplateEditPolicy) {
+  return createDiscardDraftHandler(
+    policy,
+    "discard-draft",
+    "own",
+    "Throws away the open draft of one template resource of the caller's tenant so the editor shows the active version again; the served version is untouched. Refused with no_draft when there is no draft. Outside the templates the app lists in tenantEditable only a SystemAdmin may use it.",
+  );
+}
+export function makeDiscardDraftSystemWrite(policy: TemplateEditPolicy) {
+  return createDiscardDraftHandler(
+    policy,
+    "discard-draft-system",
+    "system",
+    "Throws away the open draft of one system-default template; the served version stays. SystemAdmin only, refused with no_draft when there is no draft.",
+  );
+}