@dyrected/core 2.5.55 → 2.5.58

package/dist/server.js

@@ -346,6 +346,9 @@ async function evaluateAccess(expression, context) {
   if (typeof expression === "boolean") return expression;
   try {
     const result = await jexl2.eval(expression, context);
+    if (result && typeof result === "object" && !Array.isArray(result)) {
+      return result;
+    }
     return !!result;
   } catch (err) {
     console.error("[dyrected/core] Jexl evaluation failed:", err);
@@ -353,6 +356,173 @@ async function evaluateAccess(expression, context) {
   }
 }
 
+// src/auth/access.ts
+function isNamedAccessPolicy(value) {
+  return !!value && typeof value === "object" && "policy" in value && typeof value.policy === "string";
+}
+async function resolveAccess(config, access, args) {
+  if (access === void 0 || access === null) return void 0;
+  if (typeof access === "boolean" || typeof access === "string") {
+    return evaluateAccess(access, args);
+  }
+  if (typeof access === "function") {
+    try {
+      return await access(args);
+    } catch (err) {
+      console.error("[dyrected/core] Functional access check failed:", err);
+      return false;
+    }
+  }
+  if (isNamedAccessPolicy(access)) {
+    const resolver = config.accessPolicies?.[access.policy];
+    if (!resolver) {
+      console.error(`[dyrected/core] Unknown access policy "${access.policy}".`);
+      return false;
+    }
+    try {
+      return await resolver({ ...args, params: access.params });
+    } catch (err) {
+      console.error(`[dyrected/core] Access policy "${access.policy}" failed:`, err);
+      return false;
+    }
+  }
+  return false;
+}
+
+// src/utils/access-control.ts
+function toHookRequestContext(req) {
+  return {
+    query: req.query(),
+    headers: req.header(),
+    raw: req.raw
+  };
+}
+async function resolveBooleanAccess(config, access, args) {
+  const result = await resolveAccess(config, access, args);
+  if (result === void 0) return true;
+  return typeof result === "boolean" ? result : false;
+}
+async function matchesAccessConstraint(config, collection, id, constraint) {
+  if (!config.db) return false;
+  const match = await config.db.find({
+    collection,
+    where: { AND: [{ id: { equals: id } }, constraint] },
+    limit: 1
+  });
+  return match.total > 0;
+}
+async function resolveCollectionAccess(config, collection, action, access, args) {
+  const result = await resolveAccess(config, access, args);
+  if (result === void 0) return { allowed: true };
+  if (typeof result === "boolean") return { allowed: result };
+  if (action === "read" && !args.id) {
+    return { allowed: true, constraint: result };
+  }
+  if (!args.id) {
+    return { allowed: false };
+  }
+  return {
+    allowed: await matchesAccessConstraint(config, collection, args.id, result)
+  };
+}
+async function applyFieldReadAccess(context, doc) {
+  if (!doc || typeof doc !== "object") return doc;
+  const result = { ...doc };
+  for (const field of context.fields) {
+    if (field.type === "row" && field.fields) {
+      Object.assign(result, await applyFieldReadAccess({ ...context, fields: field.fields }, result));
+      continue;
+    }
+    if (!field.name) continue;
+    const value = result[field.name];
+    const canRead = await resolveBooleanAccess(context.config, field.access?.read, {
+      user: context.user,
+      req: context.req,
+      doc: context.doc,
+      data: context.data
+    });
+    if (!canRead) {
+      delete result[field.name];
+      continue;
+    }
+    if (value === void 0 || value === null) continue;
+    if (field.type === "object" && field.fields && typeof value === "object" && !Array.isArray(value)) {
+      result[field.name] = await applyFieldReadAccess({ ...context, fields: field.fields }, value);
+      continue;
+    }
+    if (field.type === "array" && field.fields && Array.isArray(value)) {
+      result[field.name] = await Promise.all(
+        value.map(
+          (item) => typeof item === "object" && item !== null ? applyFieldReadAccess({ ...context, fields: field.fields }, item) : item
+        )
+      );
+      continue;
+    }
+    if (field.type === "blocks" && field.blocks && Array.isArray(value)) {
+      result[field.name] = await Promise.all(
+        value.map(async (item) => {
+          if (typeof item !== "object" || item === null) return item;
+          const typedItem = item;
+          const block = field.blocks?.find((candidate) => candidate.slug === typedItem.blockType);
+          if (!block) return item;
+          return applyFieldReadAccess({ ...context, fields: block.fields }, typedItem);
+        })
+      );
+    }
+  }
+  return result;
+}
+async function applyFieldWriteAccess(context, data) {
+  if (!data || typeof data !== "object") return data;
+  const result = { ...data };
+  for (const field of context.fields) {
+    if (field.type === "row" && field.fields) {
+      Object.assign(result, await applyFieldWriteAccess({ ...context, fields: field.fields }, result));
+      continue;
+    }
+    if (!field.name || !(field.name in result)) continue;
+    const canUpdate = await resolveBooleanAccess(context.config, field.access?.update, {
+      user: context.user,
+      req: context.req,
+      doc: context.doc,
+      data: context.data
+    });
+    if (!canUpdate) {
+      delete result[field.name];
+      continue;
+    }
+    const value = result[field.name];
+    if (value === void 0 || value === null) continue;
+    if (field.type === "object" && field.fields && typeof value === "object" && !Array.isArray(value)) {
+      result[field.name] = await applyFieldWriteAccess({ ...context, fields: field.fields }, value);
+      continue;
+    }
+    if (field.type === "array" && field.fields && Array.isArray(value)) {
+      result[field.name] = await Promise.all(
+        value.map(
+          (item) => typeof item === "object" && item !== null ? applyFieldWriteAccess({ ...context, fields: field.fields }, item) : item
+        )
+      );
+      continue;
+    }
+    if (field.type === "blocks" && field.blocks && Array.isArray(value)) {
+      result[field.name] = await Promise.all(
+        value.map(async (item) => {
+          if (typeof item !== "object" || item === null) return item;
+          const typedItem = item;
+          const block = field.blocks?.find((candidate) => candidate.slug === typedItem.blockType);
+          if (!block) return item;
+          return applyFieldWriteAccess({ ...context, fields: block.fields }, typedItem);
+        })
+      );
+    }
+  }
+  return result;
+}
+function mergeWhereConstraint(where, constraint) {
+  return where ? { AND: [where, constraint] } : constraint;
+}
+
 // src/controllers/collection.controller.ts
 var CollectionController = class {
   collection;
@@ -368,11 +538,23 @@ var CollectionController = class {
     return config.adminAuth?.providers?.find((p) => p.members) || null;
   }
   toHookRequestContext(c) {
-    return {
-      query: c.req.query(),
-      headers: c.req.header(),
-      raw: c.req.raw
-    };
+    return toHookRequestContext(c.req);
+  }
+  async evaluateAccess(c, action, options = {}) {
+    const config = c.get("config");
+    return resolveCollectionAccess(
+      config,
+      this.collection.slug,
+      action,
+      this.collection.access?.[action],
+      {
+        id: options.id,
+        user: c.get("user"),
+        req: this.toHookRequestContext(c),
+        doc: options.doc ?? void 0,
+        data: options.data
+      }
+    );
   }
   async find(c) {
     const config = c.get("config");
@@ -452,6 +634,13 @@ var CollectionController = class {
     if (this.collection.workflow && !canViewWorkflowDraft(this.collection.workflow, user)) {
       where = where ? { AND: [where, { __published: { exists: true } }] } : { __published: { exists: true } };
     }
+    const access = await this.evaluateAccess(c, "read");
+    if (!access.allowed) {
+      return c.json({ error: true, message: `Access denied: read on ${this.collection.slug}` }, 403);
+    }
+    if (access.constraint) {
+      where = mergeWhereConstraint(where, access.constraint);
+    }
     let result = await db.find({
       collection: this.collection.slug,
       limit,
@@ -484,7 +673,14 @@ var CollectionController = class {
         db: readonlyDb
       });
       const docWithFieldHooks = await executeFieldAfterRead(this.collection.fields, docWithCollectionHooks, user, readonlyDb);
-      processedDocs.push(docWithFieldHooks);
+      const docWithFieldAccess = await applyFieldReadAccess({
+        config,
+        fields: this.collection.fields,
+        user,
+        req: this.toHookRequestContext(c),
+        doc: docWithFieldHooks
+      }, docWithFieldHooks);
+      processedDocs.push(docWithFieldAccess);
     }
     result.docs = processedDocs;
     if (depth > 0) {
@@ -529,6 +725,10 @@ var CollectionController = class {
       doc = materializeWorkflowDocument(doc, this.collection.workflow, user);
       if (!doc) return c.json({ message: "Not Found" }, 404);
     }
+    const access = await this.evaluateAccess(c, "read", { id, doc });
+    if (!access.allowed) {
+      return c.json({ error: true, message: `Access denied: read on ${this.collection.slug}` }, 403);
+    }
     const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
     const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
       doc: docWithDefaults,
@@ -537,17 +737,24 @@ var CollectionController = class {
       db: readonlyDb
     });
     const docWithFieldHooks = await executeFieldAfterRead(this.collection.fields, docWithCollectionHooks, user, readonlyDb);
-    if (depth > 0 && docWithFieldHooks) {
+    const docWithFieldAccess = await applyFieldReadAccess({
+      config,
+      fields: this.collection.fields,
+      user,
+      req: this.toHookRequestContext(c),
+      doc: docWithFieldHooks
+    }, docWithFieldHooks);
+    if (depth > 0 && docWithFieldAccess) {
       const populationService = new PopulationService(db, config.collections);
       const populatedDoc = await populationService.populate({
-        data: docWithFieldHooks,
+        data: docWithFieldAccess,
         fields: this.collection.fields,
         currentDepth: 0,
         maxDepth: depth
       });
       return c.json(populatedDoc);
     }
-    return c.json(docWithFieldHooks);
+    return c.json(docWithFieldAccess);
   }
   async create(c) {
     const config = c.get("config");
@@ -586,9 +793,20 @@ var CollectionController = class {
     if (this.collection.workflow) {
       data = initializeWorkflowDocument(data, this.collection.workflow);
     }
+    const createAccess = await this.evaluateAccess(c, "create", { data });
+    if (!createAccess.allowed) {
+      return c.json({ error: true, message: `Access denied: create on ${this.collection.slug}` }, 403);
+    }
     if (this.collection.auth && data.password) {
       data.password = await hashPassword(data.password);
     }
+    data = await applyFieldWriteAccess({
+      config,
+      fields: this.collection.fields,
+      user,
+      req: this.toHookRequestContext(c),
+      data
+    }, data);
     data = await executeFieldBeforeChange(this.collection.fields, data, null, user, readonlyDb);
     data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
       data,
@@ -623,7 +841,14 @@ var CollectionController = class {
       db: readonlyDb
     });
     const finalDoc = await executeFieldAfterRead(this.collection.fields, readDoc, user, readonlyDb);
-    return c.json(finalDoc, 201);
+    const accessibleDoc = await applyFieldReadAccess({
+      config,
+      fields: this.collection.fields,
+      user,
+      req: this.toHookRequestContext(c),
+      doc: finalDoc
+    }, finalDoc);
+    return c.json(accessibleDoc, 201);
   }
   async upload(c) {
     const config = c.get("config");
@@ -666,6 +891,17 @@ var CollectionController = class {
       createdBy: user?.sub ?? null,
       updatedBy: user?.sub ?? null
     };
+    const createAccess = await this.evaluateAccess(c, "create", { data });
+    if (!createAccess.allowed) {
+      return c.json({ error: true, message: `Access denied: create on ${this.collection.slug}` }, 403);
+    }
+    data = await applyFieldWriteAccess({
+      config,
+      fields: this.collection.fields,
+      user,
+      req: this.toHookRequestContext(c),
+      data
+    }, data);
     data = await executeFieldBeforeChange(this.collection.fields, data, null, user, readonlyDb);
     data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
       data,
@@ -693,7 +929,14 @@ var CollectionController = class {
       db: readonlyDb
     });
     const finalDoc = await executeFieldAfterRead(this.collection.fields, readDoc, user, readonlyDb);
-    return c.json(finalDoc, 201);
+    const accessibleDoc = await applyFieldReadAccess({
+      config,
+      fields: this.collection.fields,
+      user,
+      req: this.toHookRequestContext(c),
+      doc: finalDoc
+    }, finalDoc);
+    return c.json(accessibleDoc, 201);
   }
   async update(c) {
     const config = c.get("config");
@@ -731,10 +974,22 @@ var CollectionController = class {
     });
     const originalDoc = await db.findOne({ collection: this.collection.slug, id });
     if (!originalDoc) return c.json({ message: "Not Found" }, 404);
+    const updateAccess = await this.evaluateAccess(c, "update", { id, doc: originalDoc, data });
+    if (!updateAccess.allowed) {
+      return c.json({ error: true, message: `Access denied: update on ${this.collection.slug}` }, 403);
+    }
     let before = null;
     if (this.collection.audit) {
       before = originalDoc;
     }
+    data = await applyFieldWriteAccess({
+      config,
+      fields: this.collection.fields,
+      user,
+      req: this.toHookRequestContext(c),
+      doc: originalDoc,
+      data
+    }, data);
     data = await executeFieldBeforeChange(this.collection.fields, data, originalDoc, user, readonlyDb);
     data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
       data,
@@ -770,7 +1025,14 @@ var CollectionController = class {
       db: readonlyDb
     });
     const finalDoc = await executeFieldAfterRead(this.collection.fields, readDoc, user, readonlyDb);
-    return c.json(finalDoc);
+    const accessibleDoc = await applyFieldReadAccess({
+      config,
+      fields: this.collection.fields,
+      user,
+      req: this.toHookRequestContext(c),
+      doc: finalDoc
+    }, finalDoc);
+    return c.json(accessibleDoc);
   }
   async transition(c) {
     const config = c.get("config");
@@ -807,7 +1069,7 @@ var CollectionController = class {
     const readAccess = this.collection.access?.read;
     if (readAccess !== void 0 && readAccess !== null) {
       const args = { user: c.get("user"), req: c.req, doc: document };
-      const result2 = typeof readAccess === "function" ? await readAccess(args) : await evaluateAccess(readAccess, args);
+      const result2 = await resolveAccess(config, readAccess, args);
       let allowed = result2 === true;
       if (result2 && typeof result2 === "object") {
         const match = await config.db.find({
@@ -918,6 +1180,10 @@ var CollectionController = class {
     const user = c.get("user");
     const doc = await db.findOne({ collection: this.collection.slug, id });
     if (!doc) return c.json({ message: "Not Found" }, 404);
+    const deleteAccess = await this.evaluateAccess(c, "delete", { id, doc });
+    if (!deleteAccess.allowed) {
+      return c.json({ error: true, message: `Access denied: delete on ${this.collection.slug}` }, 403);
+    }
     let before = null;
     if (this.collection.audit) {
       before = doc;
@@ -977,6 +1243,11 @@ var CollectionController = class {
           failed.push({ id, error: "Not Found" });
           continue;
         }
+        const deleteAccess = await this.evaluateAccess(c, "delete", { id, doc });
+        if (!deleteAccess.allowed) {
+          failed.push({ id, error: "Access denied" });
+          continue;
+        }
         let before = null;
         if (this.collection.audit) {
           before = doc;
@@ -1070,6 +1341,14 @@ var GlobalController = class {
       await db.updateGlobal({ slug: this.global.slug, data: this.global.initialData });
       data = this.global.initialData;
     }
+    const canRead = await resolveBooleanAccess(config, this.global.access?.read, {
+      user,
+      req: toHookRequestContext(c.req),
+      doc: data
+    });
+    if (!canRead) {
+      return c.json({ error: true, message: `Access denied: read on ${this.global.slug}` }, 403);
+    }
     const dataWithDefaults = DefaultsService.apply(this.global.fields, data);
     const docWithCollectionHooks = await runCollectionHooks(this.global.hooks?.afterRead, {
       doc: dataWithDefaults,
@@ -1078,17 +1357,24 @@ var GlobalController = class {
       db: readonlyDb
     });
     const docWithFieldHooks = await executeFieldAfterRead(this.global.fields, docWithCollectionHooks, user, readonlyDb);
-    if (depth > 0 && docWithFieldHooks) {
+    const docWithFieldAccess = await applyFieldReadAccess({
+      config,
+      fields: this.global.fields,
+      user,
+      req: toHookRequestContext(c.req),
+      doc: docWithFieldHooks
+    }, docWithFieldHooks);
+    if (depth > 0 && docWithFieldAccess) {
       const populationService = new PopulationService(db, config.collections);
       const populatedData = await populationService.populate({
-        data: docWithFieldHooks,
+        data: docWithFieldAccess,
         fields: this.global.fields,
         currentDepth: 0,
         maxDepth: depth
       });
       return c.json(populatedData);
     }
-    return c.json(docWithFieldHooks);
+    return c.json(docWithFieldAccess);
   }
   async update(c) {
     const config = c.get("config");
@@ -1098,7 +1384,24 @@ var GlobalController = class {
     const body = await c.req.json();
     const user = c.get("user");
     const originalDoc = await db.getGlobal({ slug: this.global.slug }) || {};
-    let data = await executeFieldBeforeChange(this.global.fields, body, originalDoc, user, readonlyDb);
+    const canUpdate = await resolveBooleanAccess(config, this.global.access?.update, {
+      user,
+      req: toHookRequestContext(c.req),
+      doc: originalDoc,
+      data: body
+    });
+    if (!canUpdate) {
+      return c.json({ error: true, message: `Access denied: update on ${this.global.slug}` }, 403);
+    }
+    let sanitizedBody = await applyFieldWriteAccess({
+      config,
+      fields: this.global.fields,
+      user,
+      req: toHookRequestContext(c.req),
+      doc: originalDoc,
+      data: body
+    }, body);
+    let data = await executeFieldBeforeChange(this.global.fields, sanitizedBody, originalDoc, user, readonlyDb);
     data = await runCollectionHooks(this.global.hooks?.beforeChange, {
       data,
       doc: originalDoc,
@@ -1123,7 +1426,14 @@ var GlobalController = class {
       db: readonlyDb
     });
     const finalDoc = await executeFieldAfterRead(this.global.fields, readDoc, user, readonlyDb);
-    return c.json(finalDoc);
+    const accessibleDoc = await applyFieldReadAccess({
+      config,
+      fields: this.global.fields,
+      user,
+      req: toHookRequestContext(c.req),
+      doc: finalDoc
+    }, finalDoc);
+    return c.json(accessibleDoc);
   }
   async seed(c) {
     const config = c.get("config");
@@ -1305,7 +1615,7 @@ var MediaController = class {
 import { SignJWT, jwtVerify, decodeJwt } from "jose";
 import { TextEncoder } from "util";
 function getSecret() {
-  const secret = process.env.DYRECTED_JWT_SECRET || process.env.JWT_SECRET;
+  const secret = process.env.DYRECTED_JWT_SECRET;
   if (!secret) {
     throw new Error(
       "[dyrected/core] DYRECTED_JWT_SECRET is not set. Add it to your environment variables to enable auth collections."
@@ -2180,7 +2490,7 @@ var AdminAuthController = class {
     return state;
   }
   getStateSecret() {
-    const secret = process.env.DYRECTED_JWT_SECRET || process.env.JWT_SECRET;
+    const secret = process.env.DYRECTED_JWT_SECRET;
     if (!secret) {
       throw new Error("[dyrected/core] DYRECTED_JWT_SECRET is not set.");
     }
@@ -2198,7 +2508,7 @@ import { SignJWT as SignJWT3, jwtVerify as jwtVerify3 } from "jose";
 import { TextEncoder as TextEncoder3 } from "util";
 var PreviewController = class {
   getSecret() {
-    const secret = process.env.DYRECTED_JWT_SECRET || process.env.JWT_SECRET || "dyrected-preview-secret-change-me";
+    const secret = process.env.DYRECTED_JWT_SECRET || "dyrected-preview-secret-change-me";
     return new TextEncoder3().encode(secret);
   }
   /**
@@ -2237,30 +2547,74 @@ var PreviewController = class {
 };
 
 // src/middleware/auth.ts
-function requireAuth() {
+function getBearerToken(c) {
+  const authHeader = c.req.header("Authorization");
+  return authHeader?.replace(/^Bearer\s+/i, "") || void 0;
+}
+async function resolveUser(token, config) {
+  const payload = await verifyCollectionToken(token);
+  if (payload.purpose) {
+    return payload;
+  }
+  const db = config?.db;
+  if (!db) {
+    return payload;
+  }
+  let doc;
+  try {
+    doc = await db.findOne({
+      collection: payload.collection,
+      id: payload.sub
+    });
+  } catch (err) {
+    console.error("[dyrected/core] Failed to hydrate user from token:", err);
+    return payload;
+  }
+  if (!doc) {
+    return null;
+  }
+  const { password: _password, ...safe } = doc;
+  return {
+    ...safe,
+    sub: payload.sub,
+    email: payload.email ?? safe.email,
+    collection: payload.collection
+  };
+}
+function requireAuth(config) {
   return async (c, next) => {
-    const authHeader = c.req.header("Authorization");
-    const token = authHeader?.replace(/^Bearer\s+/i, "");
+    if (c.get("user")) {
+      return next();
+    }
+    const token = getBearerToken(c);
     if (!token) {
       return c.json({ error: true, message: "Authentication required." }, 401);
     }
+    let user;
     try {
-      const user = await verifyCollectionToken(token);
-      c.set("user", user);
-      await next();
+      user = await resolveUser(token, config ?? c.get("config"));
     } catch {
       return c.json({ error: true, message: "Invalid or expired token." }, 401);
     }
+    if (!user) {
+      return c.json({ error: true, message: "Invalid or expired token." }, 401);
+    }
+    c.set("user", user);
+    await next();
   };
 }
-function optionalAuth() {
+function optionalAuth(config) {
   return async (c, next) => {
-    const authHeader = c.req.header("Authorization");
-    const token = authHeader?.replace(/^Bearer\s+/i, "");
+    if (c.get("user")) {
+      return next();
+    }
+    const token = getBearerToken(c);
     if (token) {
       try {
-        const user = await verifyCollectionToken(token);
-        c.set("user", user);
+        const user = await resolveUser(token, config ?? c.get("config"));
+        if (user) {
+          c.set("user", user);
+        }
       } catch {
       }
     }
@@ -2323,37 +2677,23 @@ function getSwaggerHtml(specUrl) {
 }
 
 // src/router.ts
-function accessGate(target, action) {
+function accessGate(config, target, action) {
   return async (c, next) => {
     const user = c.get("user");
     const accessExpr = target.access?.[action];
     if (accessExpr === void 0 || accessExpr === null) {
       return await next();
     }
-    const accessArgs = { user, req: c.req, doc: null };
-    const allowed = await evaluateAccess(accessExpr, accessArgs);
+    const allowed = await resolveBooleanAccess(config, accessExpr, {
+      user,
+      req: toHookRequestContext(c.req)
+    });
     if (!allowed) {
       return c.json({ error: true, message: `Access denied: ${action} on ${target.slug}` }, 403);
     }
     await next();
   };
 }
-async function checkAccess(access, accessArgs) {
-  if (access === void 0 || access === null) return true;
-  if (typeof access === "function") {
-    try {
-      const result = await access(accessArgs);
-      return typeof result === "boolean" ? result : !!result;
-    } catch (err) {
-      console.error("[dyrected/core] Functional access check failed:", err);
-      return false;
-    }
-  }
-  if (typeof access === "string" || typeof access === "boolean") {
-    return evaluateAccess(access, accessArgs);
-  }
-  return true;
-}
 function serializeFieldForApi(f) {
   if (!f) return f;
   const serialized = { ...f };
@@ -2382,7 +2722,7 @@ function serializeFieldForApi(f) {
   return serialized;
 }
 function registerRoutes(app, config) {
-  app.get("/api/schemas", optionalAuth(), async (c) => {
+  app.get("/api/schemas", optionalAuth(config), async (c) => {
     const siteId = c.req.header("X-Site-Id");
     let collections = [...config.collections];
     let globals = [...config.globals];
@@ -2398,11 +2738,11 @@ function registerRoutes(app, config) {
       }
     }
     const user = c.get("user");
-    const accessArgs = { user, req: c.req, doc: null };
+    const accessArgs = { user, req: toHookRequestContext(c.req) };
     const serializeAccess = async (access) => {
       if (typeof access === "string") return access;
       if (typeof access === "boolean") return access;
-      return checkAccess(access, accessArgs);
+      return resolveBooleanAccess(config, access, accessArgs);
     };
     const filteredCollections = await Promise.all(collections.filter((col) => !siteId || col.shared || !col.siteId || col.siteId === siteId).map(async (col) => ({
       slug: col.slug,
@@ -2488,7 +2828,7 @@ function registerRoutes(app, config) {
       adminAuth: getPublicAdminAuthConfig(config.adminAuth, collections)
     });
   });
-  app.get("/api/dyrected/options/:collection/:field", optionalAuth(), async (c) => {
+  app.get("/api/dyrected/options/:collection/:field", optionalAuth(config), async (c) => {
     const { collection: colSlug, field: fieldName } = c.req.param();
     const siteId = c.req.header("X-Site-Id");
     let collections = [...config.collections];
@@ -2502,8 +2842,10 @@ function registerRoutes(app, config) {
     if (collection) {
       const accessExpr = collection.access?.read;
       if (accessExpr !== void 0 && accessExpr !== null) {
-        const accessArgs = { user, req: c.req, doc: null };
-        const allowed = await checkAccess(accessExpr, accessArgs);
+        const allowed = await resolveBooleanAccess(config, accessExpr, {
+          user,
+          req: toHookRequestContext(c.req)
+        });
         if (!allowed) {
           return c.json({ error: true, message: `Access denied: read on ${colSlug}` }, 403);
         }
@@ -2521,8 +2863,10 @@ function registerRoutes(app, config) {
       }
       const accessExpr = glb.access?.read;
       if (accessExpr !== void 0 && accessExpr !== null) {
-        const accessArgs = { user, req: c.req, doc: null };
-        const allowed = await checkAccess(accessExpr, accessArgs);
+        const allowed = await resolveBooleanAccess(config, accessExpr, {
+          user,
+          req: toHookRequestContext(c.req)
+        });
         if (!allowed) {
           return c.json({ error: true, message: `Access denied: read on global ${colSlug}` }, 403);
         }
@@ -2566,7 +2910,7 @@ function registerRoutes(app, config) {
   app.get("/api/docs", (c) => {
     return c.html(getSwaggerHtml());
   });
-  app.get("/api/preferences/:key", requireAuth(), async (c) => {
+  app.get("/api/preferences/:key", requireAuth(config), async (c) => {
     const db = config.db;
     const user = c.get("user");
     const key = c.req.param("key");
@@ -2591,7 +2935,7 @@ function registerRoutes(app, config) {
     const globalValue = await getGlobalPreference();
     return c.json({ key, value: globalValue });
   });
-  app.put("/api/preferences/:key", requireAuth(), async (c) => {
+  app.put("/api/preferences/:key", requireAuth(config), async (c) => {
     const db = config.db;
     const user = c.get("user");
     const key = c.req.param("key");
@@ -2631,7 +2975,7 @@ function registerRoutes(app, config) {
     });
     return c.json({ key, value: body.value });
   });
-  app.delete("/api/preferences/:key", requireAuth(), async (c) => {
+  app.delete("/api/preferences/:key", requireAuth(config), async (c) => {
     const db = config.db;
     const user = c.get("user");
     const key = c.req.param("key");
@@ -2671,10 +3015,10 @@ function registerRoutes(app, config) {
     for (const col of uploadCollections) {
       const mediaController = new MediaController(col.slug);
       const prefix = `/api/collections/${col.slug}`;
-      app.get(`${prefix}/media`, accessGate(col, "read"), (c) => mediaController.find(c));
+      app.get(`${prefix}/media`, accessGate(config, col, "read"), (c) => mediaController.find(c));
       app.get(`${prefix}/media/:filename{.+$}`, (c) => mediaController.serve(c));
-      app.post(`${prefix}/media`, accessGate(col, "create"), (c) => mediaController.upload(c));
-      app.delete(`${prefix}/media/:id`, accessGate(col, "delete"), (c) => mediaController.delete(c));
+      app.post(`${prefix}/media`, accessGate(config, col, "create"), (c) => mediaController.upload(c));
+      app.delete(`${prefix}/media/:id`, accessGate(config, col, "delete"), (c) => mediaController.delete(c));
     }
   }
   const adminAuthController = new AdminAuthController(config);
@@ -2691,43 +3035,43 @@ function registerRoutes(app, config) {
     app.post(`${path}/logout`, (c) => authController.logout(c));
     app.get(`${path}/init`, (c) => authController.init(c));
     app.post(`${path}/first-user`, (c) => authController.registerFirstUser(c));
-    app.get(`${path}/me`, requireAuth(), (c) => authController.me(c));
-    app.post(`${path}/refresh-token`, requireAuth(), (c) => authController.refreshToken(c));
+    app.get(`${path}/me`, requireAuth(config), (c) => authController.me(c));
+    app.post(`${path}/refresh-token`, requireAuth(config), (c) => authController.refreshToken(c));
     app.post(`${path}/forgot-password`, (c) => authController.forgotPassword(c));
     app.post(`${path}/reset-password`, (c) => authController.resetPassword(c));
-    app.post(`${path}/invite`, requireAuth(), (c) => authController.invite(c));
+    app.post(`${path}/invite`, requireAuth(config), (c) => authController.invite(c));
     app.post(`${path}/accept-invite`, (c) => authController.acceptInvite(c));
   }
   for (const collection of config.collections) {
     const path = `/api/collections/${collection.slug}`;
     const controller = new CollectionController(collection);
-    app.get(path, accessGate(collection, "read"), (c) => controller.find(c));
-    app.post(path, accessGate(collection, "create"), (c) => controller.create(c));
-    app.post(`${path}/media`, accessGate(collection, "create"), (c) => controller.create(c));
-    app.delete(`${path}/delete-many`, accessGate(collection, "delete"), (c) => controller.deleteMany(c));
-    app.get(`${path}/:id`, accessGate(collection, "read"), (c) => controller.findOne(c));
-    app.patch(`${path}/:id`, accessGate(collection, "update"), (c) => controller.update(c));
-    app.delete(`${path}/:id`, accessGate(collection, "delete"), (c) => controller.delete(c));
+    app.get(path, (c) => controller.find(c));
+    app.post(path, (c) => controller.create(c));
+    app.post(`${path}/media`, (c) => controller.create(c));
+    app.delete(`${path}/delete-many`, (c) => controller.deleteMany(c));
+    app.get(`${path}/:id`, (c) => controller.findOne(c));
+    app.patch(`${path}/:id`, (c) => controller.update(c));
+    app.delete(`${path}/:id`, (c) => controller.delete(c));
     app.post(`${path}/seed`, (c) => controller.seed(c));
     if (collection.auth) {
-      app.post(`${path}/:id/change-password`, requireAuth(), (c) => controller.changePassword(c));
+      app.post(`${path}/:id/change-password`, requireAuth(config), (c) => controller.changePassword(c));
     }
     if (collection.workflow) {
-      app.post(`${path}/:id/transitions/:transition`, requireAuth(), (c) => controller.transition(c));
-      app.get(`${path}/:id/workflow-history`, requireAuth(), (c) => controller.workflowHistory(c));
+      app.post(`${path}/:id/transitions/:transition`, requireAuth(config), (c) => controller.transition(c));
+      app.get(`${path}/:id/workflow-history`, requireAuth(config), (c) => controller.workflowHistory(c));
     }
   }
   for (const global of config.globals) {
     const path = `/api/globals/${global.slug}`;
     const controller = new GlobalController(global);
-    app.get(path, accessGate(global, "read"), (c) => controller.get(c));
-    app.patch(path, accessGate(global, "update"), (c) => controller.update(c));
+    app.get(path, (c) => controller.get(c));
+    app.patch(path, (c) => controller.update(c));
     app.post(`${path}/seed`, (c) => controller.seed(c));
   }
   const previewController = new PreviewController();
-  app.post("/api/preview-token", requireAuth(), (c) => previewController.createToken(c));
+  app.post("/api/preview-token", requireAuth(config), (c) => previewController.createToken(c));
   app.get("/api/preview-data", (c) => previewController.getData(c));
-  app.post("/api/collections/:slug/:id/transitions/:transition", requireAuth(), async (c) => {
+  app.post("/api/collections/:slug/:id/transitions/:transition", requireAuth(config), async (c) => {
     const slug = c.req.param("slug");
     const siteId = c.req.header("X-Site-Id") || c.get("siteId");
     const config2 = c.get("config");
@@ -2745,7 +3089,7 @@ function registerRoutes(app, config) {
     const controller = new CollectionController(collection);
     return controller.transition(c);
   });
-  app.get("/api/collections/:slug/:id/workflow-history", requireAuth(), async (c) => {
+  app.get("/api/collections/:slug/:id/workflow-history", requireAuth(config), async (c) => {
     const slug = c.req.param("slug");
     const siteId = c.req.header("X-Site-Id") || c.get("siteId");
     const config2 = c.get("config");
@@ -2844,7 +3188,7 @@ async function createDyrectedApp(rawConfig) {
     await config.db.sync(config.collections, config.globals);
   }
   app.use("*", requestId());
-  app.use("*", optionalAuth());
+  app.use("*", optionalAuth(config));
   app.use("*", async (c, next) => {
     const start = Date.now();
     await next();