@cosmicdrift/kumiko-samples 0.377.0 → 0.379.0

package/packages/bundled-features/src/template-resolver/handlers/document-base.ts

@@ -5,10 +5,11 @@ import {
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
-import type { DocumentHtmlKind } from "../constants.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
 import { isHiddenSystemDraft, toWorkingRow } from "../template-draft.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
+import type { DocumentHtmlKind } from "../web/constants.ts";
 import { parseStoredJson } from "./template-gates.ts";
 
 export type DocumentBase = {
@@ -45,7 +46,12 @@ export async function loadDocumentBase(
     tenantId: user.tenantId,
     ...where,
   });
-  if (own !== undefined && !isSystemOnlyTemplateHiddenFrom(user, ctx.registry, own)) {
+  // A locked override is neither shown nor edited by a non-SystemAdmin; the served system default is.
+  const ownIsVisible =
+    own !== undefined &&
+    !isSystemOnlyTemplateHiddenFrom(user, ctx.registry, own) &&
+    isRowServedTo(deliveryPolicyOf(ctx.registry), user, own);
+  if (own !== undefined && ownIsVisible) {
     const working = toWorkingRow(own, user.tenantId);
     return {
       rowId: String(own.id),

package/packages/bundled-features/src/template-resolver/handlers/document-blocks.query.ts

@@ -1,11 +1,11 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { DOCUMENT_HTML_KINDS } from "../constants.ts";
-import { documentBlocksForKind } from "../document-blocks.ts";
 import { documentBlocksOf } from "../document-ops.ts";
 import { parseDocumentJson } from "../document-sanitizer.ts";
 import { resolveTemplateVariables } from "../template-validation.ts";
+import { DOCUMENT_HTML_KINDS } from "../web/constants.ts";
+import { documentBlocksForKind } from "../web/document-blocks.ts";
 import { loadDocumentBase } from "./document-base.ts";
 import { localeSchema, templateSlugSchema } from "./shared.ts";
 import { knownResourceKeysFor } from "./validate.query.ts";

package/packages/bundled-features/src/template-resolver/handlers/export-bundle.query.ts

@@ -3,16 +3,18 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { filterDeliveredTo } from "../api.ts";
 import {
   isFileAttachmentEntry,
   isPdfAttachmentLink,
   type LinkedResourceEntry,
   parseLinkedResourceEntries,
 } from "../linked-resources.ts";
-import { TemplateResolverErrors } from "../qualified-names.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
 import type { TemplateBundle } from "../template-bundle.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
 import { readTemplateResource } from "../template-resources.ts";
+import { TemplateResolverErrors } from "../web/qualified-names.ts";
 import { kindSchema, templateSlugSchema } from "./shared.ts";
 import { parseStoredJson, storedRecord } from "./template-gates.ts";
 
@@ -94,7 +96,8 @@ export const exportBundleQuery = defineQueryHandler({
         ? { tenantId: SYSTEM_TENANT_ID, slug, kind, scope: "system", status: "active" }
         : { tenantId: query.user.tenantId, slug, kind, scope: "tenant" },
     );
-    const rows = found
+    const policy = deliveryPolicyOf(ctx.registry);
+    const rows = (await filterDeliveredTo(ctx.db, policy, query.user, found))
       .filter((row) => row.status !== "archived")
       .sort((a, b) => a.locale.localeCompare(b.locale));
     const first = rows[0];

package/packages/bundled-features/src/template-resolver/handlers/find-by-id.query.ts

@@ -2,6 +2,7 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
 import { draftViewerTenantId, isHiddenSystemDraft, toWorkingRow } from "../template-draft.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
 
@@ -15,7 +16,7 @@ export const findByIdQuery = defineQueryHandler({
   schema: z.object({ id: z.string().min(1) }),
   access: { roles: ["TenantAdmin", "SystemAdmin", "User"] },
   description:
-    "Reads the version of one template resource an editor works on, by row id: the open draft if there is one (status draft), else the stored version, with content, variable schema and scope, but only when it belongs to the caller's tenant or is a served system default (a never-served system draft is visible to a SystemAdmin only); `active` is the version number and since-time the resolver serves, null when none is served. Use it to load a template into the admin editor.",
+    "Reads the version of one template resource an editor works on, by row id: the open draft if there is one (status draft), else the stored version, with content, variable schema and scope, but only when it belongs to the caller's tenant or is a served system default (an override of a template that is not tenantEditable is not delivered and is visible to a SystemAdmin only) (a never-served system draft is visible to a SystemAdmin only); `active` is the version number and since-time the resolver serves, null when none is served. Use it to load a template into the admin editor.",
   handler: async (query, ctx) => {
     const stored = await fetchOne<TemplateResourceRow>(ctx.db, templateResourcesTable, {
       id: query.payload.id,
@@ -23,7 +24,8 @@ export const findByIdQuery = defineQueryHandler({
     if (
       !stored ||
       isHiddenSystemDraft(query.user, stored) ||
-      isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, stored)
+      isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, stored) ||
+      !isRowServedTo(deliveryPolicyOf(ctx.registry), query.user, stored)
     ) {
       return null;
     }

package/packages/bundled-features/src/template-resolver/handlers/import-bundle.write.ts

@@ -1,33 +1,42 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { templateBundleSchema } from "../template-bundle.ts";
+import {
+  refuseTemplateEdit,
+  type TemplateEditPolicy,
+  templateEditAccess,
+} from "../template-edit-policy.ts";
 import { importTemplateBundle, prepareTemplateBundleBeforeTransaction } from "./bundle-import.ts";
 
-export const importBundleWrite = defineWriteHandler({
-  name: "import-bundle",
-  schema: z.object({ bundle: templateBundleSchema, overwrite: z.boolean().default(false) }),
-  access: { roles: ["TenantAdmin", "SystemAdmin"] },
-  description:
-    "Imports a template bundle (all locales plus resource files, as produced by export-bundle) into the caller's tenant as drafts; it refuses a locale that already has an override unless overwrite is set, and publish makes the drafts live.",
-  beforeTransaction: (event, ctx) =>
-    prepareTemplateBundleBeforeTransaction({
-      ctx,
-      user: event.user,
-      tenantId: event.user.tenantId,
-      scope: "tenant",
-      status: "draft",
-      bundle: event.payload.bundle,
-      overwrite: event.payload.overwrite,
-    }),
-  handler: (event, ctx) =>
-    importTemplateBundle({
-      ctx,
-      user: event.user,
-      tenantId: event.user.tenantId,
-      scope: "tenant",
-      status: "draft",
-      bundle: event.payload.bundle,
-      overwrite: event.payload.overwrite,
-      prepared: event.prepared,
-    }),
-});
+export function makeImportBundleWrite(policy: TemplateEditPolicy) {
+  return defineWriteHandler({
+    name: "import-bundle",
+    schema: z.object({ bundle: templateBundleSchema, overwrite: z.boolean().default(false) }),
+    access: templateEditAccess(policy.tenantEditable),
+    description:
+      "Imports a template bundle (all locales plus resource files, as produced by export-bundle) into the caller's tenant as drafts; it refuses a locale that already has an override unless overwrite is set, and publish makes the drafts live. Outside the templates the app lists in tenantEditable only a SystemAdmin may use it.",
+    beforeTransaction: async (event, ctx) =>
+      refuseTemplateEdit(policy, event.user, event.payload.bundle) ??
+      prepareTemplateBundleBeforeTransaction({
+        ctx,
+        user: event.user,
+        tenantId: event.user.tenantId,
+        scope: "tenant",
+        status: "draft",
+        bundle: event.payload.bundle,
+        overwrite: event.payload.overwrite,
+      }),
+    handler: async (event, ctx) =>
+      refuseTemplateEdit(policy, event.user, event.payload.bundle) ??
+      importTemplateBundle({
+        ctx,
+        user: event.user,
+        tenantId: event.user.tenantId,
+        scope: "tenant",
+        status: "draft",
+        bundle: event.payload.bundle,
+        overwrite: event.payload.overwrite,
+        prepared: event.prepared,
+      }),
+  });
+}

package/packages/bundled-features/src/template-resolver/handlers/layout-source.query.ts

@@ -1,9 +1,10 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { FALLBACK_LOCALE } from "../constants.ts";
+import { filterDeliveredTo } from "../api.ts";
 import { type LayoutRegions, readLayoutRegions } from "../layout-regions.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
 import {
   type ActiveInfo,
   draftViewerTenantId,
@@ -12,6 +13,7 @@ import {
   type WorkingRow,
 } from "../template-draft.ts";
 import { type MailLayoutMeta, readMailLayoutMeta } from "../template-meta.ts";
+import { FALLBACK_LOCALE } from "../web/constants.ts";
 import { localeSchema, templateSlugSchema } from "./shared.ts";
 import { parseStoredJson } from "./template-gates.ts";
 
@@ -141,10 +143,13 @@ export const layoutSourceQuery = defineQueryHandler({
   handler: async (query, ctx): Promise<LayoutSourceResponse> => {
     const { kind, slug, locale } = query.payload;
     const isSystemAdmin = query.user.roles.includes("SystemAdmin");
-    const rows = await selectMany<TemplateResourceRow>(ctx.db, templateResourcesTable, {
-      kind,
-      slug,
-    });
+    const policy = deliveryPolicyOf(ctx.registry);
+    const rows = await filterDeliveredTo(
+      ctx.db,
+      policy,
+      query.user,
+      await selectMany<TemplateResourceRow>(ctx.db, templateResourcesTable, { kind, slug }),
+    );
     const { tenantRow, systemRow } = pickEditedRows(rows, query.user, locale);
     return buildLayoutSource({ kind, locale, isSystemAdmin, tenantRow, systemRow });
   },

package/packages/bundled-features/src/template-resolver/handlers/list.query.ts

@@ -1,10 +1,11 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { TEMPLATE_KINDS, TEMPLATE_STATUSES } from "../constants.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
 import { isHiddenSystemDraft } from "../template-draft.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
+import { TEMPLATE_KINDS, TEMPLATE_STATUSES } from "../web/constants.ts";
 
 // ctx.db is tenant-scoped even for SystemAdmin: every caller sees its own
 // tenant's rows plus the system defaults, never another tenant's rows.
@@ -45,11 +46,13 @@ export const listQuery = defineQueryHandler({
       limit: 500,
     })) as TemplateResourceRow[];
 
+    const deliveryPolicy = deliveryPolicyOf(ctx.registry);
     return rows
       .filter(
         (row) =>
           !isHiddenSystemDraft(query.user, row) &&
-          !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row),
+          !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row) &&
+          isRowServedTo(deliveryPolicy, query.user, row),
       )
       .map((row) => ({
         id: String(row.id),

package/packages/bundled-features/src/template-resolver/handlers/overview.query.ts

@@ -1,8 +1,12 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { DEFAULT_MAIL_LAYOUT_SLUG, FALLBACK_LOCALE, type TemplateStatus } from "../constants.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import {
+  deliveryPolicyOf,
+  isTenantOverrideServed,
+  type TemplateDeliveryPolicy,
+} from "../template-delivery-policy.ts";
 import {
   activeSinceOf,
   activeVersionOf,
@@ -11,14 +15,21 @@ import {
   parseTemplateDraft,
   servedVersionOf,
 } from "../template-draft.ts";
+import { mayEditTemplate, type TemplateEditPolicy } from "../template-edit-policy.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
 import { collectTemplateUsage, type EffectiveMailLayoutSlugs } from "../template-usage.ts";
+import {
+  DEFAULT_MAIL_LAYOUT_SLUG,
+  FALLBACK_LOCALE,
+  type TemplateStatus,
+} from "../web/constants.ts";
 import { storedRecord } from "./template-gates.ts";
 
 const OVERVIEW_KINDS = ["mail", "document-pdf", "mail-layout", "pdf-layout"] as const;
 type OverviewKind = (typeof OVERVIEW_KINDS)[number];
 
 const OVERVIEW_ROW_LIMIT = 5000;
+const LOCKED_OVERRIDE_I18N_KEY = "templateResolver.overview.lockedOverride";
 
 export type OverviewOrigin = "tenant" | "system";
 export type OverviewKindGroup = "mail" | "pdf" | "layout";
@@ -44,6 +55,13 @@ export type OverviewRow = {
   readonly activeSince: string | null;
   readonly systemVersion: number | null;
   readonly layoutSlug: string | null;
+  /** SystemAdmin only: a tenant override is stored but not delivered because the template is not unlocked for tenants. */
+  readonly lockedOverride: boolean;
+  readonly lockedOverrideI18nKey: string | null;
+  /** Tenant row a reset acts on (resetToSystem takes a row id, the overview row is a slug group); set only while a system version exists to fall back to. */
+  readonly lockedOverrideId: string | null;
+  /** False when a locked override has no system version to fall back to, so a reset would be refused. */
+  readonly canResetLockedOverride: boolean;
   readonly modifiedAt: string;
   readonly usedBy: readonly OverviewUsage[];
   readonly usedByCount: number;
@@ -87,23 +105,54 @@ function preferredRow(rows: readonly TemplateResourceRow[]): TemplateResourceRow
   );
 }
 
-type EffectiveRows = { readonly origin: OverviewOrigin; readonly rows: TemplateResourceRow[] };
+type EffectiveRows = {
+  readonly origin: OverviewOrigin;
+  readonly rows: TemplateResourceRow[];
+  readonly lockedOverride: boolean;
+  readonly lockedOverrideId: string | null;
+};
 
-function effectiveRowsOf(rows: readonly TemplateResourceRow[]): EffectiveRows | null {
+// A tenant row of a template that is not unlocked is not delivered, so the system version is the effective one.
+function effectiveRowsOf(
+  rows: readonly TemplateResourceRow[],
+  policy: TemplateDeliveryPolicy,
+): EffectiveRows | null {
   const tenantRows = rows.filter((row) => row.scope === "tenant");
   const systemRows = rows.filter((row) => row.scope === "system");
   const live = (list: TemplateResourceRow[]) => list.filter((row) => row.status !== "archived");
   const liveTenant = live(tenantRows);
-  if (liveTenant.length > 0) return { origin: "tenant", rows: liveTenant };
+  const tenantServed = tenantRows.every((row) => isTenantOverrideServed(policy, row));
+  if (!tenantServed && liveTenant.length > 0) {
+    const liveSystem = live(systemRows);
+    if (systemRows.length === 0)
+      return { origin: "tenant", rows: liveTenant, lockedOverride: true, lockedOverrideId: null };
+    const lockedRow = preferredRow(liveTenant);
+    return {
+      origin: "system",
+      rows: liveSystem.length > 0 ? liveSystem : systemRows,
+      lockedOverride: true,
+      lockedOverrideId: lockedRow === undefined ? null : String(lockedRow.id),
+    };
+  }
+  if (liveTenant.length > 0)
+    return { origin: "tenant", rows: liveTenant, lockedOverride: false, lockedOverrideId: null };
   if (systemRows.length > 0) {
     const liveSystem = live(systemRows);
-    return { origin: "system", rows: liveSystem.length > 0 ? liveSystem : systemRows };
+    return {
+      origin: "system",
+      rows: liveSystem.length > 0 ? liveSystem : systemRows,
+      lockedOverride: false,
+      lockedOverrideId: null,
+    };
   }
-  return tenantRows.length > 0 ? { origin: "tenant", rows: tenantRows } : null;
+  return tenantRows.length > 0
+    ? { origin: "tenant", rows: tenantRows, lockedOverride: false, lockedOverrideId: null }
+    : null;
 }
 
 export function effectiveMailLayoutSlugs(
   rows: readonly TemplateResourceRow[],
+  policy: TemplateDeliveryPolicy,
 ): EffectiveMailLayoutSlugs {
   const byLocale = new Map<string, TemplateResourceRow[]>();
   for (const row of rows) {
@@ -113,7 +162,10 @@ export function effectiveMailLayoutSlugs(
   }
   const bySlug = new Map<string, Map<string, string>>();
   for (const group of byLocale.values()) {
-    const effective = effectiveRowsOf(group)?.rows[0];
+    const effectiveRows = effectiveRowsOf(group, policy);
+    // A locked tenant row without a system row is not delivered, so it names no layout.
+    if (effectiveRows?.lockedOverride && effectiveRows.origin === "tenant") continue;
+    const effective = effectiveRows?.rows[0];
     // All-archived: the renderer falls back to the code-registered template.
     if (effective === undefined || effective.status === "archived") continue;
     const locales = bySlug.get(effective.slug) ?? new Map<string, string>();
@@ -190,6 +242,7 @@ function versionFieldsOf(
 function buildDrafts(
   groups: ReadonlyMap<string, readonly TemplateResourceRow[]>,
   user: { readonly tenantId: string; readonly roles: readonly string[] },
+  policy: TemplateDeliveryPolicy,
 ): {
   readonly drafts: OverviewDraft[];
   readonly layoutSlugByDocument: Map<string, string>;
@@ -197,7 +250,7 @@ function buildDrafts(
   const layoutSlugByDocument = new Map<string, string>();
   const drafts: OverviewDraft[] = [];
   for (const [id, groupRows] of groups) {
-    const effective = effectiveRowsOf(groupRows);
+    const effective = effectiveRowsOf(groupRows, policy);
     const preferred = effective === null ? undefined : preferredRow(effective.rows);
     if (effective === null || preferred === undefined) continue;
     if (!isOverviewKind(preferred.kind) || !isTemplateStatus(preferred.status)) continue;
@@ -217,6 +270,10 @@ function buildDrafts(
       status: preferred.status,
       ...versionFieldsOf(user, preferred, groupRows),
       layoutSlug,
+      lockedOverride: effective.lockedOverride,
+      lockedOverrideI18nKey: effective.lockedOverride ? LOCKED_OVERRIDE_I18N_KEY : null,
+      lockedOverrideId: effective.lockedOverrideId,
+      canResetLockedOverride: effective.lockedOverrideId !== null,
       modifiedAt: modifiedAtOf(preferred),
     });
   }
@@ -271,68 +328,73 @@ const filterSchema = z.object({
   value: z.array(z.string()),
 });
 
-export const overviewQuery = defineQueryHandler({
-  name: "overview",
-  schema: z.object({
-    search: z.string().optional(),
-    filters: z.array(filterSchema).optional(),
-    layoutSlug: z.string().optional(),
-    sort: z.string().optional(),
-    sortDirection: z.enum(["asc", "desc"]).optional(),
-    limit: z.number().int().min(1).max(200).default(50),
-    offset: z.number().int().min(0).optional(),
-    totalCount: z.boolean().optional(),
-  }),
-  access: { roles: ["TenantAdmin", "SystemAdmin"] },
-  description:
-    "Lists mail, PDF and layout templates as one row per slug and kind for the caller's tenant (optionally only the mails and PDFs using one layout slug): where the effective version comes from (own override or system), its locales, status and version (the served one; `draftVersion` is set when an unpublished draft waits beside it, `activeSince` says since when the served version applies), the system version it overrides, the layout it uses and which notifications or templates use it; templates of notifications registered with `systemOnly` are listed for SystemAdmins only; use it to browse and filter all templates at a glance.",
-  handler: async (query, ctx) => {
-    const payload = query.payload;
-    const fetchedRows = await selectMany<TemplateResourceRow>(
-      ctx.db,
-      templateResourcesTable,
-      { kind: { in: [...OVERVIEW_KINDS] } },
-      { orderBy: { col: "id", direction: "asc" }, limit: OVERVIEW_ROW_LIMIT + 1 },
-    );
-    const truncated = fetchedRows.length > OVERVIEW_ROW_LIMIT;
-    const rows = truncated ? fetchedRows.slice(0, OVERVIEW_ROW_LIMIT) : fetchedRows;
-    if (truncated) {
-      ctx.log?.warn("template overview: row limit reached, result is incomplete", {
-        limit: OVERVIEW_ROW_LIMIT,
-      });
-    }
+export function makeOverviewQuery(policy: TemplateEditPolicy) {
+  return defineQueryHandler({
+    name: "overview",
+    schema: z.object({
+      search: z.string().optional(),
+      filters: z.array(filterSchema).optional(),
+      layoutSlug: z.string().optional(),
+      sort: z.string().optional(),
+      sortDirection: z.enum(["asc", "desc"]).optional(),
+      limit: z.number().int().min(1).max(200).default(50),
+      offset: z.number().int().min(0).optional(),
+      totalCount: z.boolean().optional(),
+    }),
+    access: { roles: ["TenantAdmin", "SystemAdmin"] },
+    description:
+      "Lists mail, PDF and layout templates as one row per slug and kind for the caller's tenant (optionally only the mails and PDFs using one layout slug): where the effective version comes from (own override or system), its locales, status and version (the served one; `draftVersion` is set when an unpublished draft waits beside it, `activeSince` says since when the served version applies), the system version it overrides, the layout it uses and which notifications or templates use it; templates of notifications registered with `systemOnly` are listed for SystemAdmins only, and a TenantAdmin sees only the templates the app lists in tenantEditable; a tenant override of a template that is not listed is not delivered, so the row shows the system version with `lockedOverride` true (SystemAdmin only); use it to browse and filter all templates at a glance.",
+    handler: async (query, ctx) => {
+      const payload = query.payload;
+      const fetchedRows = await selectMany<TemplateResourceRow>(
+        ctx.db,
+        templateResourcesTable,
+        { kind: { in: [...OVERVIEW_KINDS] } },
+        { orderBy: { col: "id", direction: "asc" }, limit: OVERVIEW_ROW_LIMIT + 1 },
+      );
+      const truncated = fetchedRows.length > OVERVIEW_ROW_LIMIT;
+      const rows = truncated ? fetchedRows.slice(0, OVERVIEW_ROW_LIMIT) : fetchedRows;
+      if (truncated) {
+        ctx.log?.warn("template overview: row limit reached, result is incomplete", {
+          limit: OVERVIEW_ROW_LIMIT,
+        });
+      }
 
-    const visibleRows = rows.filter(
-      (row) =>
-        !isHiddenSystemDraft(query.user, row) &&
-        !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row),
-    );
-    const { drafts, layoutSlugByDocument } = buildDrafts(
-      groupBySlugAndKind(visibleRows),
-      query.user,
-    );
-    const effectiveLayouts = effectiveMailLayoutSlugs(visibleRows);
-    const overviewRows = drafts.map((draft) =>
-      withUsage(draft, layoutSlugByDocument, ctx.registry, effectiveLayouts),
-    );
-    const filtered = filterRows(
-      overviewRows,
-      payload.search,
-      payload.filters ?? [],
-      payload.layoutSlug,
-    );
+      const visibleRows = rows.filter(
+        (row) =>
+          !isHiddenSystemDraft(query.user, row) &&
+          !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row) &&
+          mayEditTemplate(policy, query.user, row),
+      );
+      const deliveryPolicy = deliveryPolicyOf(ctx.registry);
+      const { drafts, layoutSlugByDocument } = buildDrafts(
+        groupBySlugAndKind(visibleRows),
+        query.user,
+        deliveryPolicy,
+      );
+      const effectiveLayouts = effectiveMailLayoutSlugs(visibleRows, deliveryPolicy);
+      const overviewRows = drafts.map((draft) =>
+        withUsage(draft, layoutSlugByDocument, ctx.registry, effectiveLayouts),
+      );
+      const filtered = filterRows(
+        overviewRows,
+        payload.search,
+        payload.filters ?? [],
+        payload.layoutSlug,
+      );
 
-    const sortField: SortField =
-      payload.sort !== undefined && isSortField(payload.sort) ? payload.sort : "modifiedAt";
-    const direction = (payload.sortDirection ?? "desc") === "desc" ? -1 : 1;
-    filtered.sort((a, b) => direction * compareBy(sortField, a, b) || a.id.localeCompare(b.id));
+      const sortField: SortField =
+        payload.sort !== undefined && isSortField(payload.sort) ? payload.sort : "modifiedAt";
+      const direction = (payload.sortDirection ?? "desc") === "desc" ? -1 : 1;
+      filtered.sort((a, b) => direction * compareBy(sortField, a, b) || a.id.localeCompare(b.id));
 
-    const offset = payload.offset ?? 0;
-    return {
-      rows: filtered.slice(offset, offset + payload.limit),
-      nextCursor: null,
-      total: filtered.length,
-      truncated,
-    } satisfies OverviewResponse;
-  },
-});
+      const offset = payload.offset ?? 0;
+      return {
+        rows: filtered.slice(offset, offset + payload.limit),
+        nextCursor: null,
+        total: filtered.length,
+        truncated,
+      } satisfies OverviewResponse;
+    },
+  });
+}