@easy-cms/core 0.22.2 → 0.24.0

package/dist/index.d.ts

@@ -56,6 +56,30 @@ declare const anyone: Access;
 declare const isLoggedIn: Access;
 declare const isAdmin: Access;
 
+/** What the email functions in `auth.emails` receive. */
+interface PasswordEmailArgs {
+    readonly user: AuthUser;
+    /** The page that sets the password; absent for `passwordChanged`. */
+    readonly url?: string;
+    /** The admin language for the text: `en` or `th`. */
+    readonly locale: string;
+    /** When the link stops working. */
+    readonly expiresAt?: Date;
+}
+/** An email's content: a subject, and text and/or HTML. */
+interface PasswordEmail {
+    readonly subject: string;
+    readonly text: string;
+    readonly html?: string;
+}
+type PasswordEmailFn = (args: PasswordEmailArgs) => PasswordEmail | Promise<PasswordEmail>;
+/** The default emails, in English and Thai. */
+declare const DEFAULT_PASSWORD_EMAILS: {
+    resetPassword: PasswordEmailFn;
+    invite: PasswordEmailFn;
+    passwordChanged: PasswordEmailFn;
+};
+
 interface Logger {
     info(message: string): void;
     warn(message: string): void;
@@ -237,6 +261,8 @@ type PreviewTarget = {
 } | {
     readonly global: string;
 };
+/** Why a password link was sent: a forgotten password, or an invitation to a new account. */
+type PasswordPurpose = 'reset' | 'invite';
 
 interface LoginArgs {
     readonly email: string;
@@ -252,6 +278,13 @@ interface Session {
     readonly csrfToken: string;
     readonly expiresAt: string;
 }
+/** Where a password link is opened from, and the language of its email. */
+interface PasswordLinkOptions {
+    /** The request's origin: used for the link only in development, when `serverURL` is not set. */
+    readonly origin?: string | undefined;
+    /** `en` or `th`. Default: `admin.locale`. */
+    readonly locale?: string | undefined;
+}
 /** Login, logout and session verification. Available as `cms.auth`. */
 declare class Auth {
     private readonly cms;
@@ -280,6 +313,48 @@ declare class Auth {
     createSession(userId: ID): Promise<Session>;
     /** Signs a user out everywhere. */
     revokeSessions(userId: ID): Promise<void>;
+    /**
+     * The origin password links point to: `serverURL`, or the request's origin in development. In
+     * production the request's Host can't be trusted (a forged one would send the link elsewhere).
+     */
+    passwordLinkBase(origin?: string): string | null;
+    /** Whether "forgot password" and invitations work: `email` is set and links have an origin. */
+    canSendPasswordLinks(origin?: string): boolean;
+    /**
+     * Emails a link to set a new password, if an active account has this email. Always resolves the
+     * same way, so callers can't tell whether the email has an account; extra requests within
+     * `lockWindow` are ignored.
+     */
+    requestPasswordReset(args: PasswordLinkOptions & {
+        email: string;
+        ip?: string | undefined;
+    }): Promise<void>;
+    /**
+     * Emails a user a link to set their password: an invitation if they have none yet, else a
+     * reset link. For admins (the REST API checks the role). Returns which one was sent.
+     */
+    sendPasswordLink(userId: ID, options?: PasswordLinkOptions): Promise<PasswordPurpose>;
+    /** The user and purpose of a valid, unused password link, or `null`. */
+    checkPasswordToken(token: string): Promise<{
+        user: AuthUser;
+        purpose: PasswordPurpose;
+    } | null>;
+    /**
+     * Sets the password from a link, ends every session of the account and starts one here.
+     * Throws `ValidationError` when the link expired or was used, or the password is too short.
+     */
+    resetPassword(args: {
+        token: string;
+        password: string;
+        ip?: string | undefined;
+        locale?: string | undefined;
+    }): Promise<Session & {
+        purpose: PasswordPurpose;
+    }>;
+    private passwordTokenUser;
+    private mailPasswordLink;
+    private localeOf;
+    private findByEmail;
     /** The owner of an API key, limited by the key; `null` when unknown, expired or disabled. */
     private verifyApiKey;
     private startSession;
@@ -415,7 +490,9 @@ type FieldValue<F extends Field, C extends Config = Config> = F extends {
     readonly type: 'richText';
 } ? RichTextDocument : F extends {
     readonly type: 'upload';
-} ? ID | MediaDocument : F extends {
+} ? F extends {
+    readonly hasMany: true;
+} ? (ID | MediaDocument)[] : ID | MediaDocument : F extends {
     readonly type: 'relationship';
     readonly to: infer S;
 } ? F extends {
@@ -504,7 +581,9 @@ type InputValue<F extends Field> = F extends {
     readonly hasMany: true;
 } ? Readonly<SelectValue<F>> : F extends {
     readonly type: 'upload';
-} ? ID : F extends {
+} ? F extends {
+    readonly hasMany: true;
+} ? readonly ID[] : ID : F extends {
     readonly type: 'date';
 } ? string | Date : F extends {
     readonly type: 'array';
@@ -537,14 +616,17 @@ type StatusInput<T> = T extends {
 } ? {
     status?: 'draft' | 'published';
 } : unknown;
-/** Users are created with a password, which is hashed and never returned. */
+/**
+ * A user's password, hashed and never returned. Optional when creating: a user without one sets
+ * it from an invitation link.
+ */
 type PasswordInput<S, Required extends boolean> = S extends 'users' ? Required extends true ? {
     password: string;
 } : {
     password?: string;
 } : unknown;
 /** Data accepted by `create`, e.g. `CreateInput<typeof config, 'posts'>`. */
-type CreateInput<C extends Config, S extends CollectionSlug<C>> = Simplify<FieldsInput<CollectionBySlug<C, S>['fields']> & StatusInput<CollectionBySlug<C, S>> & PasswordInput<S, true>>;
+type CreateInput<C extends Config, S extends CollectionSlug<C>> = Simplify<FieldsInput<CollectionBySlug<C, S>['fields']> & StatusInput<CollectionBySlug<C, S>> & PasswordInput<S, false>>;
 /** Data accepted by `update`: any subset of `CreateInput`. */
 type UpdateInput<C extends Config, S extends CollectionSlug<C>> = Partial<CreateInput<C, S>>;
 /** Data accepted by `updateGlobal`. */
@@ -1037,8 +1119,19 @@ interface RichTextDocument {
 }
 interface RichTextField extends BaseField<'richText', RichTextDocument> {
 }
-/** References a document in the built-in `media` collection. */
+/** References a document in the built-in `media` collection: a file or an image. */
 interface UploadField extends BaseField<'upload', never> {
+    /** Several files, e.g. a gallery: the value is a list, in the order editors arrange. */
+    readonly hasMany?: boolean;
+    /** With `hasMany`: the fewest files. */
+    readonly minRows?: number;
+    /** With `hasMany`: the most files. */
+    readonly maxRows?: number;
+    /**
+     * The file types allowed, e.g. `['image/*']` or `['image/*', 'application/pdf']`. The admin
+     * offers only these, and saving refuses others.
+     */
+    readonly mimeTypes?: readonly string[];
 }
 interface FilterOptionsArgs {
     /** The document being edited; `undefined` while it is being created. */
@@ -1055,6 +1148,10 @@ interface RelationshipField extends BaseField<'relationship', never> {
     /** Slug of the target collection. */
     readonly to: string;
     readonly hasMany?: boolean;
+    /** With `hasMany`: the fewest documents. */
+    readonly minRows?: number;
+    /** With `hasMany`: the most documents. */
+    readonly maxRows?: number;
     readonly filterOptions?: FilterOptions;
 }
 interface ArrayField extends BaseField<'array', never> {
@@ -1084,6 +1181,10 @@ interface BlocksField extends BaseField<'blocks', never> {
     readonly minRows?: number;
     readonly maxRows?: number;
 }
+/** Fields with `hasMany`: their value is a list of options, documents or files. */
+declare const isHasMany: (field: Field) => boolean;
+/** Whether a MIME type is one of `patterns` (`image/*` matches every image). */
+declare function mimeAllowedBy(mimeType: string, patterns: readonly string[]): boolean;
 /** Fields whose value is a list of rows: `array` and `blocks`. */
 declare const hasRows: (field: Field) => field is ArrayField | BlocksField;
 /** The fields of one row of an `array` or `blocks` field (`undefined` for an unknown block). */
@@ -1347,6 +1448,19 @@ interface AuthConfig {
      * Needed when the admin or frontend is served from another origin, or behind a proxy that rewrites the host.
      */
     readonly trustedOrigins?: readonly string[];
+    /**
+     * How long a "forgot password" link works, in seconds. Default 1 hour. Links work once: setting
+     * the password ends them. Needs `email` and, in production, `serverURL` for the link.
+     */
+    readonly resetPasswordExpiration?: number;
+    /** How long an invitation link works, in seconds. Default 7 days. */
+    readonly inviteExpiration?: number;
+    /** Your own text for the password emails, e.g. in your brand's voice. Default: English or Thai. */
+    readonly emails?: {
+        readonly resetPassword?: PasswordEmailFn;
+        readonly invite?: PasswordEmailFn;
+        readonly passwordChanged?: PasswordEmailFn;
+    };
 }
 /** What an endpoint's handler receives. */
 interface EndpointRequest {
@@ -1623,6 +1737,8 @@ interface Reference {
     readonly id: ID;
     /** The relationship's `filterOptions`, checked when saving. */
     readonly filterOptions?: FilterOptions;
+    /** The upload's `mimeTypes`, checked when saving. */
+    readonly mimeTypes?: readonly string[];
 }
 interface ValidateOptions {
     readonly operation: 'create' | 'update';
@@ -1732,6 +1848,8 @@ interface AdminField {
     }[];
     hasMany?: boolean;
     to?: string;
+    /** An upload's allowed file types, e.g. `image/*`. */
+    mimeTypes?: string[];
     /** A relationship with `filterOptions`: the picker asks the server which documents fit. */
     filtered?: boolean;
     from?: string;
@@ -1811,6 +1929,8 @@ interface AdminGlobal {
 }
 interface AdminSchema {
     locale: AdminLocale;
+    /** Admins can email users links to set their password (needs `email` and `serverURL`). */
+    passwordLinks: boolean;
     /** Menu order of collections (`admin.menu`); unlisted ones follow. */
     menu: string[];
     /** Content locales, when the config has `localization`. */
@@ -1859,4 +1979,4 @@ declare const BUILTIN_COLLECTIONS: readonly ["users", "media"];
 /** Checks a config and returns every problem found. An empty array means it is valid. */
 declare function validateConfig(config: Config): ConfigIssue[];
 
-export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminBrand, type AdminCollection, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminField, type AdminGlobal, type AdminIcon, type AdminLocale, type AdminSchema, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, Auth, type AuthConfig, type AuthUser, BUILTIN_COLLECTIONS, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_TOKEN_EXPIRATION, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DepthOptions, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailField, type EmailMessage, type Endpoint, type EndpointRequest, FIELD_TYPES, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, type FieldError, type FieldType, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type InferCollection, type InferGlobal, type JsonField, type Label, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, type MediaSize, type MigrationInfo, NotFoundError, type NumberField, type Operation, type PaginatedDocs, PayloadTooLargeError, type Plugin, type PreviewTarget, type PreviewURL, QueryError, type RawDocument, type ReadOptions, type RelationshipField, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoutesConfig, SESSION_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SelectField, type SelectOption, type Session, type SlugField, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, configSignature, consoleEmail, consoleLogger, copyDatabase, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, fillMissing, findConfigFile, generateSlugs, generateTypes, hasRows, hashPassword, imageDimensions, importConfig, isAdmin, isLoggedIn, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, parseId, populate, readCookie, resolveAdminModule, resolveConfig, rowFields, silentLogger, singularize, slugify, sniffMimeType, validateConfig, validateFields, verifyPassword };
+export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminBrand, type AdminCollection, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminField, type AdminGlobal, type AdminIcon, type AdminLocale, type AdminSchema, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, Auth, type AuthConfig, type AuthUser, BUILTIN_COLLECTIONS, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_PASSWORD_EMAILS, DEFAULT_TOKEN_EXPIRATION, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DepthOptions, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailField, type EmailMessage, type Endpoint, type EndpointRequest, FIELD_TYPES, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, type FieldError, type FieldType, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type InferCollection, type InferGlobal, type JsonField, type Label, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, type MediaSize, type MigrationInfo, NotFoundError, type NumberField, type Operation, type PaginatedDocs, type PasswordEmail, type PasswordEmailArgs, type PasswordEmailFn, type PasswordLinkOptions, PayloadTooLargeError, type Plugin, type PreviewTarget, type PreviewURL, QueryError, type RawDocument, type ReadOptions, type RelationshipField, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoutesConfig, SESSION_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SelectField, type SelectOption, type Session, type SlugField, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, configSignature, consoleEmail, consoleLogger, copyDatabase, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, fillMissing, findConfigFile, generateSlugs, generateTypes, hasRows, hashPassword, imageDimensions, importConfig, isAdmin, isHasMany, isLoggedIn, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, mimeAllowedBy, parseId, populate, readCookie, resolveAdminModule, resolveConfig, rowFields, silentLogger, singularize, slugify, sniffMimeType, validateConfig, validateFields, verifyPassword };

package/dist/index.js

@@ -209,6 +209,14 @@ var PayloadTooLargeError = class extends EasyCMSError {
 };
 
 // src/fields.ts
+var isHasMany = (field) => (field.type === "select" || field.type === "relationship" || field.type === "upload") && field.hasMany === true;
+function mimeAllowedBy(mimeType, patterns) {
+  const type = mimeType.toLowerCase();
+  return patterns.some((pattern) => {
+    const p = pattern.toLowerCase();
+    return p.endsWith("/*") ? type.startsWith(p.slice(0, -1)) : type === p;
+  });
+}
 var hasRows = (field) => field.type === "array" || field.type === "blocks";
 function rowFields(field, row) {
   if (field.type === "array") return field.fields;
@@ -552,6 +560,58 @@ var emailDeliveriesCollection = {
   ]
 };
 
+// src/auth/emails.ts
+var esc = (value) => value.replace(
+  /[&<>"']/g,
+  (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]
+);
+function email(subject, lines, button) {
+  const text = [...lines, ...button ? ["", button.url] : []].join("\n");
+  const html = `<div style="font-family:system-ui,sans-serif;font-size:15px;line-height:1.5;color:#1f2328">${lines.map((line) => `<p>${esc(line)}</p>`).join("")}${button ? `<p><a href="${esc(button.url)}" style="display:inline-block;padding:10px 18px;border-radius:8px;background:#2f6f5e;color:#fff;text-decoration:none;font-weight:600">${esc(button.label)}</a></p><p style="font-size:13px;color:#656d76">${esc(button.url)}</p>` : ""}</div>`;
+  return { subject, text, html };
+}
+var hours = (expiresAt) => Math.max(1, Math.round(((expiresAt?.getTime() ?? Date.now()) - Date.now()) / 36e5));
+var days = (expiresAt) => Math.max(1, Math.round(hours(expiresAt) / 24));
+var DEFAULT_PASSWORD_EMAILS = {
+  resetPassword: ({ url = "", locale, expiresAt }) => locale === "th" ? email(
+    "\u0E15\u0E31\u0E49\u0E07\u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E48\u0E32\u0E19\u0E43\u0E2B\u0E21\u0E48",
+    [
+      "\u0E21\u0E35\u0E04\u0E33\u0E02\u0E2D\u0E15\u0E31\u0E49\u0E07\u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E48\u0E32\u0E19\u0E43\u0E2B\u0E21\u0E48\u0E2A\u0E33\u0E2B\u0E23\u0E31\u0E1A\u0E1A\u0E31\u0E0D\u0E0A\u0E35\u0E02\u0E2D\u0E07\u0E04\u0E38\u0E13",
+      `\u0E25\u0E34\u0E07\u0E01\u0E4C\u0E19\u0E35\u0E49\u0E43\u0E0A\u0E49\u0E44\u0E14\u0E49\u0E04\u0E23\u0E31\u0E49\u0E07\u0E40\u0E14\u0E35\u0E22\u0E27\u0E20\u0E32\u0E22\u0E43\u0E19 ${hours(expiresAt)} \u0E0A\u0E31\u0E48\u0E27\u0E42\u0E21\u0E07 \u0E16\u0E49\u0E32\u0E04\u0E38\u0E13\u0E44\u0E21\u0E48\u0E44\u0E14\u0E49\u0E02\u0E2D \u0E44\u0E21\u0E48\u0E15\u0E49\u0E2D\u0E07\u0E17\u0E33\u0E2D\u0E30\u0E44\u0E23 \u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E48\u0E32\u0E19\u0E40\u0E14\u0E34\u0E21\u0E22\u0E31\u0E07\u0E43\u0E0A\u0E49\u0E44\u0E14\u0E49`
+    ],
+    { label: "\u0E15\u0E31\u0E49\u0E07\u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E48\u0E32\u0E19\u0E43\u0E2B\u0E21\u0E48", url }
+  ) : email(
+    "Reset your password",
+    [
+      "Someone asked to reset the password of your account.",
+      `The link works once, within ${hours(expiresAt)} hour(s). If it wasn't you, ignore this email: your password stays the same.`
+    ],
+    { label: "Set a new password", url }
+  ),
+  invite: ({ url = "", locale, expiresAt, user }) => locale === "th" ? email(
+    "\u0E04\u0E38\u0E13\u0E44\u0E14\u0E49\u0E23\u0E31\u0E1A\u0E40\u0E0A\u0E34\u0E0D\u0E43\u0E2B\u0E49\u0E43\u0E0A\u0E49\u0E07\u0E32\u0E19\u0E23\u0E30\u0E1A\u0E1A\u0E08\u0E31\u0E14\u0E01\u0E32\u0E23\u0E40\u0E19\u0E37\u0E49\u0E2D\u0E2B\u0E32",
+    [
+      `\u0E21\u0E35\u0E1A\u0E31\u0E0D\u0E0A\u0E35\u0E2A\u0E33\u0E2B\u0E23\u0E31\u0E1A ${user.email} \u0E23\u0E2D\u0E04\u0E38\u0E13\u0E2D\u0E22\u0E39\u0E48 \u0E15\u0E31\u0E49\u0E07\u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E48\u0E32\u0E19\u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E40\u0E23\u0E34\u0E48\u0E21\u0E43\u0E0A\u0E49\u0E07\u0E32\u0E19`,
+      `\u0E25\u0E34\u0E07\u0E01\u0E4C\u0E19\u0E35\u0E49\u0E43\u0E0A\u0E49\u0E44\u0E14\u0E49\u0E20\u0E32\u0E22\u0E43\u0E19 ${days(expiresAt)} \u0E27\u0E31\u0E19`
+    ],
+    { label: "\u0E15\u0E31\u0E49\u0E07\u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E48\u0E32\u0E19", url }
+  ) : email(
+    "You're invited to the content admin",
+    [
+      `An account for ${user.email} is waiting for you. Set a password to start.`,
+      `The link works within ${days(expiresAt)} day(s).`
+    ],
+    { label: "Set your password", url }
+  ),
+  passwordChanged: ({ locale }) => locale === "th" ? email("\u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E48\u0E32\u0E19\u0E02\u0E2D\u0E07\u0E04\u0E38\u0E13\u0E16\u0E39\u0E01\u0E40\u0E1B\u0E25\u0E35\u0E48\u0E22\u0E19\u0E41\u0E25\u0E49\u0E27", [
+    "\u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E48\u0E32\u0E19\u0E02\u0E2D\u0E07\u0E1A\u0E31\u0E0D\u0E0A\u0E35\u0E04\u0E38\u0E13\u0E40\u0E1E\u0E34\u0E48\u0E07\u0E16\u0E39\u0E01\u0E40\u0E1B\u0E25\u0E35\u0E48\u0E22\u0E19 \u0E41\u0E25\u0E30\u0E17\u0E38\u0E01\u0E40\u0E04\u0E23\u0E37\u0E48\u0E2D\u0E07\u0E17\u0E35\u0E48 login \u0E2D\u0E22\u0E39\u0E48\u0E16\u0E39\u0E01\u0E2D\u0E2D\u0E01\u0E08\u0E32\u0E01\u0E23\u0E30\u0E1A\u0E1A\u0E41\u0E25\u0E49\u0E27",
+    "\u0E16\u0E49\u0E32\u0E04\u0E38\u0E13\u0E44\u0E21\u0E48\u0E44\u0E14\u0E49\u0E40\u0E1B\u0E25\u0E35\u0E48\u0E22\u0E19\u0E40\u0E2D\u0E07 \u0E43\u0E2B\u0E49\u0E02\u0E2D\u0E15\u0E31\u0E49\u0E07\u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E48\u0E32\u0E19\u0E43\u0E2B\u0E21\u0E48\u0E17\u0E31\u0E19\u0E17\u0E35\u0E41\u0E25\u0E30\u0E41\u0E08\u0E49\u0E07\u0E1C\u0E39\u0E49\u0E14\u0E39\u0E41\u0E25\u0E23\u0E30\u0E1A\u0E1A"
+  ]) : email("Your password was changed", [
+    "The password of your account was just changed, and every device that was logged in has been signed out.",
+    "If it wasn't you, reset your password now and tell your administrator."
+  ])
+};
+
 // src/auth/password.ts
 import { randomBytes as randomBytes2, scrypt, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var MIN_PASSWORD_LENGTH = 8;
@@ -649,9 +709,38 @@ function verifyPreviewToken(secret, token, now = Date.now()) {
     return null;
   }
 }
+function passwordFingerprint(passwordHash) {
+  return createHash2("sha256").update(typeof passwordHash === "string" ? passwordHash : "no-password").digest("base64url").slice(0, 22);
+}
+function signPasswordToken(secret, args) {
+  const payload = Buffer.from(
+    JSON.stringify({ u: args.userId, p: args.purpose, e: args.expiresAt })
+  ).toString("base64url");
+  return `${payload}.${hmac(secret, `password:${payload}:${args.fingerprint}`)}`;
+}
+function readPasswordToken(token) {
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0) return null;
+  const payload = token.slice(0, dot);
+  try {
+    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (typeof data.u !== "string" || typeof data.e !== "number") return null;
+    if (data.p !== "reset" && data.p !== "invite") return null;
+    return { userId: data.u, purpose: data.p, expiresAt: data.e, payload };
+  } catch {
+    return null;
+  }
+}
+function passwordTokenMatches(secret, token, fingerprint) {
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0) return false;
+  const payload = token.slice(0, dot);
+  return safeEqual(token.slice(dot + 1), hmac(secret, `password:${payload}:${fingerprint}`));
+}
 
 // src/auth/auth.ts
 var INVALID = "Invalid email or password";
+var RESET_REQUESTS = 3;
 var Auth = class {
   constructor(cms) {
     this.cms = cms;
@@ -665,13 +754,13 @@ var Auth = class {
   }
   /** Checks credentials and starts a session. Throws `UnauthorizedError` or `TooManyRequestsError`. */
   async login(args) {
-    const email = typeof args.email === "string" ? args.email.trim().toLowerCase() : "";
+    const email2 = typeof args.email === "string" ? args.email.trim().toLowerCase() : "";
     const password = typeof args.password === "string" ? args.password : "";
-    const key2 = `${email}|${args.ip ?? ""}`;
+    const key2 = `${email2}|${args.ip ?? ""}`;
     await this.checkRateLimit(key2);
-    const [user] = email ? (await this.db.find({
+    const [user] = email2 ? (await this.db.find({
       collection: USERS,
-      where: { email: { equals: email } },
+      where: { email: { equals: email2 } },
       sort: [],
       limit: 1,
       page: 1
@@ -751,6 +840,131 @@ var Auth = class {
     for (const session of sessions.docs)
       await this.db.delete({ collection: SESSIONS, id: session.id });
   }
+  // --- Password links: forgotten passwords and invitations ------------------------------------
+  /**
+   * The origin password links point to: `serverURL`, or the request's origin in development. In
+   * production the request's Host can't be trusted (a forged one would send the link elsewhere).
+   */
+  passwordLinkBase(origin) {
+    const configured = this.config.serverURL;
+    if (configured) return configured.replace(/\/+$/, "");
+    if (process.env.NODE_ENV !== "production" && origin) return origin;
+    return null;
+  }
+  /** Whether "forgot password" and invitations work: `email` is set and links have an origin. */
+  canSendPasswordLinks(origin) {
+    return this.config.email !== void 0 && this.passwordLinkBase(origin) !== null;
+  }
+  /**
+   * Emails a link to set a new password, if an active account has this email. Always resolves the
+   * same way, so callers can't tell whether the email has an account; extra requests within
+   * `lockWindow` are ignored.
+   */
+  async requestPasswordReset(args) {
+    const email2 = typeof args.email === "string" ? args.email.trim().toLowerCase() : "";
+    if (!email2 || !this.canSendPasswordLinks(args.origin)) return;
+    const key2 = `reset:${email2}|${args.ip ?? ""}`;
+    const recent = await this.db.count({
+      collection: LOGIN_ATTEMPTS,
+      where: { key: { equals: key2 }, createdAt: { gt: this.windowStart() } }
+    });
+    if (recent >= RESET_REQUESTS) return;
+    await this.recordFailure(key2);
+    const user = await this.findByEmail(email2);
+    if (!user || user.active === false) return;
+    await this.mailPasswordLink(user, user.passwordHash ? "reset" : "invite", args);
+  }
+  /**
+   * Emails a user a link to set their password: an invitation if they have none yet, else a
+   * reset link. For admins (the REST API checks the role). Returns which one was sent.
+   */
+  async sendPasswordLink(userId, options = {}) {
+    if (!this.canSendPasswordLinks(options.origin))
+      throw new QueryError(
+        "Password links need `email` in the config, and `serverURL` in production"
+      );
+    const user = await this.db.findById({ collection: USERS, id: userId });
+    if (!user) throw new NotFoundError(USERS, userId);
+    if (user.active === false) throw new QueryError("This user is deactivated");
+    const purpose = user.passwordHash ? "reset" : "invite";
+    await this.mailPasswordLink(user, purpose, options);
+    return purpose;
+  }
+  /** The user and purpose of a valid, unused password link, or `null`. */
+  async checkPasswordToken(token) {
+    const found = await this.passwordTokenUser(token);
+    return found ? { user: await this.toAuthUser(found.user), purpose: found.purpose } : null;
+  }
+  /**
+   * Sets the password from a link, ends every session of the account and starts one here.
+   * Throws `ValidationError` when the link expired or was used, or the password is too short.
+   */
+  async resetPassword(args) {
+    const key2 = `reset-token|${args.ip ?? ""}`;
+    await this.checkRateLimit(key2);
+    const found = await this.passwordTokenUser(String(args.token ?? ""));
+    if (!found) {
+      await this.recordFailure(key2);
+      throw new ValidationError(USERS, [
+        { field: "token", message: "This link has expired or was already used" }
+      ]);
+    }
+    await this.cms.update(USERS, found.user.id, { password: args.password });
+    await this.clearFailures(key2);
+    const user = await this.db.findById({ collection: USERS, id: found.user.id });
+    const session = await this.startSession(user);
+    if (found.purpose === "reset") {
+      const content = await (this.config.auth.emails.passwordChanged ?? DEFAULT_PASSWORD_EMAILS.passwordChanged)({
+        user: await this.toAuthUser(user),
+        locale: this.localeOf(args.locale)
+      });
+      await this.cms.sendEmail({ to: String(user.email), ...content });
+    }
+    return { ...session, purpose: found.purpose };
+  }
+  async passwordTokenUser(token) {
+    const claims = readPasswordToken(token);
+    if (!claims || claims.expiresAt <= Date.now()) return null;
+    const id = /^\d+$/.test(claims.userId) ? Number(claims.userId) : claims.userId;
+    const user = await this.db.findById({ collection: USERS, id });
+    if (!user || user.active === false) return null;
+    const fingerprint = passwordFingerprint(user.passwordHash);
+    if (!passwordTokenMatches(this.config.secret, token, fingerprint)) return null;
+    return { user, purpose: claims.purpose };
+  }
+  async mailPasswordLink(user, purpose, options) {
+    const base = this.passwordLinkBase(options.origin);
+    const seconds = purpose === "invite" ? this.config.auth.inviteExpiration : this.config.auth.resetPasswordExpiration;
+    const expiresAt = Date.now() + seconds * 1e3;
+    const token = signPasswordToken(this.config.secret, {
+      userId: String(user.id),
+      purpose,
+      expiresAt,
+      fingerprint: passwordFingerprint(user.passwordHash)
+    });
+    const url = `${base}${this.config.admin.path}/reset-password?token=${encodeURIComponent(token)}`;
+    const write = purpose === "invite" ? this.config.auth.emails.invite ?? DEFAULT_PASSWORD_EMAILS.invite : this.config.auth.emails.resetPassword ?? DEFAULT_PASSWORD_EMAILS.resetPassword;
+    const content = await write({
+      user: await this.toAuthUser(user),
+      url,
+      locale: this.localeOf(options.locale),
+      expiresAt: new Date(expiresAt)
+    });
+    await this.cms.sendEmail({ to: String(user.email), ...content });
+  }
+  localeOf(locale) {
+    return locale === "th" || locale === "en" ? locale : this.config.admin.locale;
+  }
+  async findByEmail(email2) {
+    const { docs } = await this.db.find({
+      collection: USERS,
+      where: { email: { equals: email2 } },
+      sort: [],
+      limit: 1,
+      page: 1
+    });
+    return docs[0];
+  }
   /** The owner of an API key, limited by the key; `null` when unknown, expired or disabled. */
   async verifyApiKey(token) {
     if (!this.cms.config.collections.some((c) => c.slug === API_KEYS)) return null;
@@ -997,6 +1211,10 @@ async function copyDatabase(source, target, options = {}) {
 import { randomUUID } from "crypto";
 var EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 var isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function itemsOf(field, n) {
+  const unit = field.type === "upload" ? "file" : field.type === "relationship" ? "document" : "row";
+  return `${n} ${unit}${n === 1 ? "" : "s"}`;
+}
 var isEmpty = (value) => value === void 0 || value === null || value === "";
 function slugify(text) {
   return text.normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{M}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "");
@@ -1162,6 +1380,8 @@ async function validateFields(fields, input, options, prefix = "") {
     }
     if (isEmpty(raw) || Array.isArray(raw) && raw.length === 0) {
       if (field.required && !options.skipRequired) fail("is required");
+      else if (!options.skipRequired && "minRows" in field && field.minRows)
+        fail(`must have at least ${itemsOf(field, field.minRows)}`);
       data[field.name] = hasRows(field) || isHasMany(field) ? [] : null;
       if (!field.required) await runCustom(field, null, options, fail);
       continue;
@@ -1173,9 +1393,6 @@ async function validateFields(fields, input, options, prefix = "") {
   }
   return { data, errors, references };
 }
-function isHasMany(field) {
-  return (field.type === "select" || field.type === "relationship") && field.hasMany === true;
-}
 async function runCustom(field, value, options, fail) {
   if (!field.validate) return;
   const validate = field.validate;
@@ -1231,9 +1448,13 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
     case "upload":
     case "relationship": {
       const target = field.type === "upload" ? "media" : field.to;
-      const many = field.type === "relationship" && field.hasMany === true;
+      const many = field.hasMany === true;
       const values = many ? raw : [raw];
       if (!Array.isArray(values)) return fail("must be an array of ids");
+      if (many && field.minRows !== void 0 && values.length < field.minRows)
+        return fail(`must have at least ${itemsOf(field, field.minRows)}`);
+      if (many && field.maxRows !== void 0 && values.length > field.maxRows)
+        return fail(`must have at most ${itemsOf(field, field.maxRows)}`);
       const ids = [];
       for (const item of values) {
         const id = parseId(isPlainObject(item) ? item.id : item);
@@ -1244,7 +1465,8 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
           field: path,
           collection: target,
           id,
-          ...field.type === "relationship" && field.filterOptions ? { filterOptions: field.filterOptions } : {}
+          ...field.type === "relationship" && field.filterOptions ? { filterOptions: field.filterOptions } : {},
+          ...field.type === "upload" && field.mimeTypes ? { mimeTypes: field.mimeTypes } : {}
         });
       }
       return many ? ids : ids[0];
@@ -1785,12 +2007,36 @@ function validateAuth(config, add) {
       add("auth.roles", 'must include "admin"', "e.g. roles: ['admin', 'editor']");
     }
   }
-  for (const key2 of ["tokenExpiration", "maxLoginAttempts", "lockWindow"]) {
+  for (const key2 of [
+    "tokenExpiration",
+    "maxLoginAttempts",
+    "lockWindow",
+    "resetPasswordExpiration",
+    "inviteExpiration"
+  ]) {
     const value = auth[key2];
     if (value !== void 0 && !(Number.isInteger(value) && value > 0)) {
       add(`auth.${key2}`, "must be a positive integer");
     }
   }
+  if (auth.emails !== void 0) {
+    const emails = auth.emails;
+    if (typeof emails !== "object" || emails === null) add("auth.emails", "must be an object");
+    else
+      for (const [name, fn] of Object.entries(emails)) {
+        if (!["resetPassword", "invite", "passwordChanged"].includes(name))
+          add(
+            `auth.emails.${name}`,
+            "unknown email",
+            "use resetPassword, invite or passwordChanged"
+          );
+        else if (typeof fn !== "function")
+          add(
+            `auth.emails.${name}`,
+            "must be a function ({ user, url, locale }) => { subject, text }"
+          );
+      }
+  }
   if (auth.trustedOrigins !== void 0) {
     for (const [i, origin] of auth.trustedOrigins.entries()) {
       if (typeof origin !== "string" || !/^https?:\/\/[^/]+$/.test(origin)) {
@@ -1882,8 +2128,8 @@ function validateLocalization(config, add) {
   for (const [i, g] of (config.globals ?? []).entries()) walk(g?.fields, `globals[${i}].fields`);
 }
 function validateWebhooks(config, add) {
-  const email = config.email;
-  if (email !== void 0 && (typeof email !== "object" || email === null || typeof email.send !== "function"))
+  const email2 = config.email;
+  if (email2 !== void 0 && (typeof email2 !== "object" || email2 === null || typeof email2.send !== "function"))
     add(
       "email",
       "must be an email adapter with a send() function",
@@ -2060,6 +2306,13 @@ function validateList(list, container, path, add) {
     );
   }
 }
+function validateManyRange(field, path, add) {
+  if ((field.minRows !== void 0 || field.maxRows !== void 0) && !field.hasMany) {
+    add(path, "minRows and maxRows need hasMany: true");
+    return;
+  }
+  checkRange(field.minRows, field.maxRows, "minRows", "maxRows", path, add);
+}
 function validateField(field, path, siblings, collectionSlugs, add) {
   const position = field.position;
   if (position !== void 0 && position !== "sidebar") {
@@ -2115,6 +2368,16 @@ function validateField(field, path, siblings, collectionSlugs, add) {
           `use one of: ${[...collectionSlugs].join(", ")}`
         );
       }
+      validateManyRange(field, path, add);
+      break;
+    case "upload":
+      validateManyRange(field, path, add);
+      if (field.mimeTypes !== void 0) {
+        const types = field.mimeTypes;
+        if (!Array.isArray(types) || types.length === 0 || !types.every((t) => typeof t === "string" && /^[\w.+-]+\/(\*|[\w.+-]+)$/.test(t))) {
+          add(`${path}.mimeTypes`, "must be a list of MIME types", "e.g. mimeTypes: ['image/*']");
+        }
+      }
       break;
     case "array":
     case "group":
@@ -2367,7 +2630,10 @@ async function resolveConfig(input) {
       tokenExpiration: config.auth?.tokenExpiration ?? DEFAULT_TOKEN_EXPIRATION,
       maxLoginAttempts: config.auth?.maxLoginAttempts ?? 5,
       lockWindow: config.auth?.lockWindow ?? 15 * 60,
-      trustedOrigins: config.auth?.trustedOrigins ?? []
+      trustedOrigins: config.auth?.trustedOrigins ?? [],
+      resetPasswordExpiration: config.auth?.resetPasswordExpiration ?? 60 * 60,
+      inviteExpiration: config.auth?.inviteExpiration ?? 7 * 24 * 60 * 60,
+      emails: config.auth?.emails ?? {}
     },
     collections: [
       ...config.collections ?? [],
@@ -3612,18 +3878,18 @@ var EasyCMS = class {
   /** Emails queued until sent, stored in `email-deliveries`. */
   emailQueue() {
     const collection2 = EMAIL_DELIVERIES;
-    const toRow = (email, createdAt) => {
+    const toRow = (email2, createdAt) => {
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      return { ...email, createdAt: createdAt ?? now, updatedAt: now };
+      return { ...email2, createdAt: createdAt ?? now, updatedAt: now };
     };
     return {
-      add: async (email) => (await this.db.create({ collection: collection2, data: toRow(email) })).id,
-      update: async (id, email) => {
+      add: async (email2) => (await this.db.create({ collection: collection2, data: toRow(email2) })).id,
+      update: async (id, email2) => {
         const current = await this.db.findById({ collection: collection2, id });
         await this.db.update({
           collection: collection2,
           id,
-          data: toRow(email, current?.createdAt)
+          data: toRow(email2, current?.createdAt)
         });
       },
       remove: async (id) => {
@@ -4008,9 +4274,6 @@ var EasyCMS = class {
       if (!allowed2) throw deny(guard.user);
     }
     const { input, password } = splitPassword(config, raw);
-    if (config.slug === USERS && password === void 0) {
-      throw new ValidationError(collection2, [{ field: "password", message: "is required" }]);
-    }
     const filtered = await filterInput(
       config.fields,
       input,
@@ -4343,10 +4606,20 @@ var EasyCMS = class {
         collection: collection2,
         ids: [...new Set(refs.map((r) => r.id))]
       });
-      const ids = new Set(found.map((d) => d.id));
+      const byId = new Map(found.map((d) => [d.id, d]));
       for (const ref of refs) {
-        if (!ids.has(ref.id)) {
+        const doc = byId.get(ref.id);
+        if (!doc) {
           errors.push({ field: ref.field, message: `${collection2} ${ref.id} does not exist` });
+          continue;
+        }
+        const type = typeof doc.mimeType === "string" ? doc.mimeType : "";
+        if (ref.mimeTypes && !mimeAllowedBy(type, ref.mimeTypes)) {
+          const images = ref.mimeTypes.every((t) => t.toLowerCase() === "image/*");
+          errors.push({
+            field: ref.field,
+            message: images ? `must be an image (${doc.filename ?? ref.id} is ${type || "not one"})` : `must be ${ref.mimeTypes.join(", ")} (${doc.filename ?? ref.id} is ${type || "unknown"})`
+          });
         }
       }
     }
@@ -4492,10 +4765,16 @@ async function serializeFields(fields, update, localized) {
       case "relationship":
         f.to = field.to;
         if (field.hasMany) f.hasMany = true;
+        if (field.minRows !== void 0) f.minRows = field.minRows;
+        if (field.maxRows !== void 0) f.maxRows = field.maxRows;
         if (field.filterOptions) f.filtered = true;
         break;
       case "upload":
         f.to = "media";
+        if (field.hasMany) f.hasMany = true;
+        if (field.minRows !== void 0) f.minRows = field.minRows;
+        if (field.maxRows !== void 0) f.maxRows = field.maxRows;
+        if (field.mimeTypes) f.mimeTypes = [...field.mimeTypes];
         break;
       case "array":
         if (field.minRows !== void 0) f.minRows = field.minRows;
@@ -4573,12 +4852,13 @@ async function global(config, user, localized) {
   if (config.admin?.sidebar?.length) result.sidebar = config.admin.sidebar.map(componentRef);
   return result;
 }
-async function adminSchema(cms, user) {
+async function adminSchema(cms, user, origin) {
   const collections = cms.config.collections.filter((c) => !INTERNAL_COLLECTIONS.has(c.slug));
   const localization = cms.config.localization;
   const localized = localization !== null;
   return {
     locale: cms.config.admin.locale,
+    passwordLinks: cms.auth.canSendPasswordLinks(origin),
     menu: [...cms.config.admin.menu],
     localization: localization ? { locales: [...localization.locales], defaultLocale: localization.defaultLocale } : null,
     collections: await Promise.all(collections.map((c) => collection(c, user, localized))),
@@ -4888,7 +5168,46 @@ async function route(cms, ctx, method, segments, options) {
         return { body: { user: ctx.user, ...csrfToken2 ? { csrfToken: csrfToken2 } : {} } };
       }
       case "GET init":
-        return { body: { hasUsers: await cms.auth.hasUsers() } };
+        return {
+          body: {
+            hasUsers: await cms.auth.hasUsers(),
+            // The login page offers "Forgot password?" only when the email can be sent.
+            passwordReset: cms.auth.canSendPasswordLinks(ctx.url.origin)
+          }
+        };
+      // Forgot password: the same answer whether or not the email has an account.
+      case "POST forgot-password": {
+        const body = await readJson(ctx.request);
+        await cms.auth.requestPasswordReset({
+          email: String(body.email ?? ""),
+          ip: options.getClientIp?.(ctx.request),
+          origin: ctx.url.origin,
+          locale: typeof body.locale === "string" ? body.locale : void 0
+        });
+        return { body: { message: "If an account has this email, a link is on its way." } };
+      }
+      // The page behind a password link: which account, and whether the link still works.
+      case "GET reset-password": {
+        const found = await cms.auth.checkPasswordToken(ctx.url.searchParams.get("token") ?? "");
+        if (!found)
+          throw new ValidationError(USERS, [
+            { field: "token", message: "This link has expired or was already used" }
+          ]);
+        return { body: { email: found.user.email, purpose: found.purpose } };
+      }
+      case "POST reset-password": {
+        const body = await readJson(ctx.request);
+        const session = await cms.auth.resetPassword({
+          token: String(body.token ?? ""),
+          password: String(body.password ?? ""),
+          ip: options.getClientIp?.(ctx.request),
+          locale: typeof body.locale === "string" ? body.locale : void 0
+        });
+        setSessionCookies(cms, ctx, session);
+        return {
+          body: { user: session.user, exp: session.expiresAt, csrfToken: session.csrfToken }
+        };
+      }
       case "POST first-register": {
         const body = await readJson(ctx.request);
         const session = await cms.auth.registerFirstUser({
@@ -4919,7 +5238,7 @@ async function route(cms, ctx, method, segments, options) {
     if (method !== "GET") throw methodNotAllowed(ctx, "GET");
     if (!ctx.user) throw new UnauthorizedError();
     if (second === "schema" && third === void 0)
-      return { body: await adminSchema(cms, ctx.user) };
+      return { body: await adminSchema(cms, ctx.user, ctx.url.origin) };
     if (second === "modules" && third !== void 0 && segments.length === 3) {
       const index = /^(\d+)\.js$/.exec(third)?.[1];
       const file = index === void 0 ? void 0 : await readAdminModule(cms, Number(index));
@@ -5055,6 +5374,16 @@ async function documentAction(cms, ctx, method, collection2, id, path) {
   const access = { overrideAccess: false, user: ctx.user, ...parseLocale(ctx.url) };
   const depth = parseDepth(ctx.url);
   const [action, versionId, extra] = path;
+  if (collection2 === USERS && action === "password-link" && path.length === 1) {
+    if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+    if (ctx.user?.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+    const body = await readJson(ctx.request).catch(() => ({}));
+    const sent = await cms.auth.sendPasswordLink(/^\d+$/.test(id) ? Number(id) : id, {
+      origin: ctx.url.origin,
+      locale: typeof body.locale === "string" ? body.locale : void 0
+    });
+    return { body: { sent } };
+  }
   if (action === "versions" && versionId === void 0) {
     if (method !== "GET") throw methodNotAllowed(ctx, "GET");
     return { body: await cms.findVersions(collection2, id, { ...access, ...parsePage(ctx.url) }) };
@@ -5370,8 +5699,10 @@ function fieldType(field, n, indent) {
       const union = field.options.map((o) => quote(typeof o === "string" ? o : o.value)).join(" | ") || "string";
       return field.hasMany ? `(${union})[]` : union;
     }
-    case "upload":
-      return `ID | ${n.collections.get(MEDIA) ?? "Record<string, unknown>"}`;
+    case "upload": {
+      const one = `ID | ${n.collections.get(MEDIA) ?? "Record<string, unknown>"}`;
+      return field.hasMany ? `(${one})[]` : one;
+    }
     case "relationship": {
       const target = n.collections.get(field.to);
       const one = target ? `ID | ${target}` : "ID";
@@ -5403,7 +5734,7 @@ function fieldLines(fields, n, indent) {
   for (const field of fields) {
     if (field.hidden) continue;
     const type = fieldType(field, n, indent);
-    const alwaysPresent = field.type === "array" || field.type === "blocks" || field.type === "group" || (field.type === "select" || field.type === "relationship") && field.hasMany;
+    const alwaysPresent = field.type === "array" || field.type === "blocks" || field.type === "group" || isHasMany(field);
     if (field.required || alwaysPresent) lines.push(`${indent}${key(field.name)}: ${type}`);
     else lines.push(`${indent}${key(field.name)}?: ${type} | null`);
   }
@@ -5496,6 +5827,7 @@ export {
   DEFAULT_DEPTH,
   DEFAULT_MAX_FILE_SIZE,
   DEFAULT_MAX_VERSIONS,
+  DEFAULT_PASSWORD_EMAILS,
   DEFAULT_TOKEN_EXPIRATION,
   EXTENSIONS,
   EasyCMS,
@@ -5536,12 +5868,14 @@ export {
   imageDimensions,
   importConfig,
   isAdmin,
+  isHasMany,
   isLoggedIn,
   keyAllows,
   loadConfig,
   localStorage,
   mergeForUpdate,
   mimeAllowed,
+  mimeAllowedBy,
   parseId,
   populate,
   readCookie,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.22.2",
+  "version": "0.24.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",