@easy-cms/core 0.32.0 → 0.33.0

package/dist/index.js

@@ -326,6 +326,7 @@ var SCHEDULED_JOBS = "scheduled-jobs";
 var WEBHOOK_DELIVERIES = "webhook-deliveries";
 var EMAIL_DELIVERIES = "email-deliveries";
 var DATABASE_BACKUPS = "database-backups";
+var ROLES = "user-roles";
 var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SESSIONS,
   LOGIN_ATTEMPTS,
@@ -333,7 +334,8 @@ var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SCHEDULED_JOBS,
   WEBHOOK_DELIVERIES,
   EMAIL_DELIVERIES,
-  DATABASE_BACKUPS
+  DATABASE_BACKUPS,
+  ROLES
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
 var adminOrSelf = ({ user }) => {
@@ -344,7 +346,8 @@ var adminOrSelf = ({ user }) => {
 var adminOnly = {
   update: ({ user }) => user?.role === "admin"
 };
-function userFields(roles) {
+function userFields(roles, rbac) {
+  const defaultRole = roles.includes("editor") ? "editor" : roles[roles.length - 1];
   return [
     {
       name: "email",
@@ -354,12 +357,20 @@ function userFields(roles) {
       label: { en: "Email", th: "\u0E2D\u0E35\u0E40\u0E21\u0E25" }
     },
     { name: "name", type: "text", label: { en: "Name", th: "\u0E0A\u0E37\u0E48\u0E2D" } },
-    {
+    // With roles from the admin (`auth.rbac`), any role in Settings → Roles: checked on save.
+    rbac ? {
+      name: "role",
+      type: "text",
+      required: true,
+      defaultValue: defaultRole,
+      access: adminOnly,
+      label: { en: "Role", th: "\u0E1A\u0E17\u0E1A\u0E32\u0E17" }
+    } : {
       name: "role",
       type: "select",
       options: roles,
       required: true,
-      defaultValue: roles.includes("editor") ? "editor" : roles[roles.length - 1],
+      defaultValue: defaultRole,
       access: adminOnly,
       label: { en: "Role", th: "\u0E1A\u0E17\u0E1A\u0E32\u0E17" }
     },
@@ -382,7 +393,7 @@ function withUsers(config) {
     useAsTitle: "email",
     icon: "users",
     ...custom,
-    fields: [...userFields(roles), ...custom?.fields ?? []],
+    fields: [...userFields(roles, config.auth?.rbac === true), ...custom?.fields ?? []],
     access: {
       read: isLoggedIn,
       create: isAdmin,
@@ -1690,7 +1701,7 @@ function parseId(value) {
 async function validateFields(fields, input, options, prefix = "") {
   const data = {};
   const errors = [];
-  const references = [];
+  const references2 = [];
   for (const field of fields) {
     const path = prefix + field.name;
     const raw = input[field.name];
@@ -1708,7 +1719,7 @@ async function validateFields(fields, input, options, prefix = "") {
       );
       data[field.name] = sub.data;
       errors.push(...sub.errors);
-      references.push(...sub.references);
+      references2.push(...sub.references);
       continue;
     }
     const localization = options.localization;
@@ -1738,7 +1749,7 @@ async function validateFields(fields, input, options, prefix = "") {
           options,
           failLocale,
           errors,
-          references
+          references2
         );
         if (normalized === void 0) continue;
         out[locale] = normalized;
@@ -1755,12 +1766,12 @@ async function validateFields(fields, input, options, prefix = "") {
       if (!field.required) await runCustom(field, null, options, fail);
       continue;
     }
-    const value = await normalizeValue(field, raw, path, options, fail, errors, references);
+    const value = await normalizeValue(field, raw, path, options, fail, errors, references2);
     if (value === void 0) continue;
     data[field.name] = value;
     await runCustom(field, value, options, fail);
   }
-  return { data, errors, references };
+  return { data, errors, references: references2 };
 }
 async function runCustom(field, value, options, fail) {
   if (!field.validate) return;
@@ -1768,7 +1779,7 @@ async function runCustom(field, value, options, fail) {
   const result = await validate(value, { data: options.root, operation: options.operation });
   if (result !== true) fail(typeof result === "string" ? result : "is invalid");
 }
-async function normalizeValue(field, raw, path, options, fail, errors, references) {
+async function normalizeValue(field, raw, path, options, fail, errors, references2) {
   switch (field.type) {
     case "text":
     case "textarea":
@@ -1830,7 +1841,7 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
         if (id === void 0)
           return fail(`must be ${many ? "ids" : "an id"} of "${target}" documents`);
         ids.push(id);
-        references.push({
+        references2.push({
           field: path,
           collection: target,
           id,
@@ -1854,19 +1865,19 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
         }
         const sub = await validateFields(field.fields, row, options, `${path}.${i}.`);
         errors.push(...sub.errors);
-        references.push(...sub.references);
+        references2.push(...sub.references);
         const id = typeof row.id === "string" && row.id !== "" ? row.id : randomUUID();
         rows.push({ id, ...sub.data });
       }
       return rows;
     }
     case "blocks":
-      return normalizeBlocks(field, raw, path, options, fail, errors, references);
+      return normalizeBlocks(field, raw, path, options, fail, errors, references2);
     case "group":
       return raw;
   }
 }
-async function normalizeBlocks(field, raw, path, options, fail, errors, references) {
+async function normalizeBlocks(field, raw, path, options, fail, errors, references2) {
   if (!Array.isArray(raw)) return fail("must be an array of blocks");
   if (field.minRows !== void 0 && raw.length < field.minRows)
     return fail(`must have at least ${field.minRows} blocks`);
@@ -1884,7 +1895,7 @@ async function normalizeBlocks(field, raw, path, options, fail, errors, referenc
     }
     const sub = await validateFields(fields, row, options, `${path}.${i}.`);
     errors.push(...sub.errors);
-    references.push(...sub.references);
+    references2.push(...sub.references);
     const id = typeof row.id === "string" && row.id !== "" ? row.id : randomUUID();
     rows.push({ id, blockType: row.blockType, ...sub.data });
   }
@@ -2168,6 +2179,487 @@ import { existsSync } from "fs";
 import { resolve as resolve2 } from "path";
 import { createJiti } from "jiti";
 
+// src/versions.ts
+var DEFAULT_MAX_VERSIONS = 50;
+function versionLimit(config) {
+  const versions = config.versions;
+  if (!versions) return void 0;
+  return versions === true ? DEFAULT_MAX_VERSIONS : versions.max ?? DEFAULT_MAX_VERSIONS;
+}
+var collectionParent = (slug2) => slug2;
+var globalParent = (slug2) => `global:${slug2}`;
+function snapshotOf(fields, doc) {
+  const hidden = new Set(fields.filter((f) => f.hidden).map((f) => f.name));
+  const snapshot = {};
+  for (const [key2, value] of Object.entries(doc)) {
+    if (key2 === "id" || key2 === "createdAt" || key2 === "updatedAt" || hidden.has(key2)) continue;
+    snapshot[key2] = value;
+  }
+  return snapshot;
+}
+var toSummary = (row) => ({
+  id: row.id,
+  status: row.status ?? null,
+  latest: row.latest === true,
+  author: row.author ?? null,
+  createdAt: String(row.createdAt)
+});
+var VersionStore = class {
+  constructor(db) {
+    this.db = db;
+  }
+  db;
+  /** Saves a new latest version and deletes the oldest beyond `max`. */
+  async save(args) {
+    const { parent, doc } = args;
+    const previous = await this.db.find({
+      collection: VERSIONS,
+      where: { and: [...this.of(parent, doc), { latest: { equals: true } }] },
+      sort: [],
+      limit: 0,
+      page: 1
+    });
+    for (const row of previous.docs) {
+      await this.db.update({ collection: VERSIONS, id: row.id, data: { ...row, latest: false } });
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const created = await this.db.create({
+      collection: VERSIONS,
+      data: {
+        parent,
+        doc,
+        status: args.status,
+        latest: true,
+        author: args.author,
+        snapshot: args.snapshot,
+        createdAt: now,
+        updatedAt: now
+      }
+    });
+    await this.prune(parent, doc, args.max);
+    return toSummary(created);
+  }
+  /** The latest version of each document, keyed by document id. */
+  async latest(parent, docs) {
+    const result = /* @__PURE__ */ new Map();
+    if (docs.length === 0) return result;
+    const rows = await this.db.find({
+      collection: VERSIONS,
+      where: {
+        and: [
+          { parent: { equals: parent } },
+          { doc: { in: [...docs] } },
+          { latest: { equals: true } }
+        ]
+      },
+      sort: [],
+      limit: 0,
+      page: 1
+    });
+    for (const row of rows.docs) result.set(String(row.doc), this.toVersion(row));
+    return result;
+  }
+  async list(parent, doc, limit, page) {
+    const found = await this.db.find({
+      collection: VERSIONS,
+      where: { and: this.of(parent, doc) },
+      sort: ["-id"],
+      limit,
+      page
+    });
+    return { ...found, docs: found.docs.map(toSummary) };
+  }
+  async get(parent, doc, id) {
+    const found = await this.db.find({
+      collection: VERSIONS,
+      where: { and: [...this.of(parent, doc), { id: { equals: id } }] },
+      sort: [],
+      limit: 1,
+      page: 1
+    });
+    const row = found.docs[0];
+    return row ? this.toVersion(row) : null;
+  }
+  async deleteAll(parent, doc) {
+    const rows = await this.db.find({
+      collection: VERSIONS,
+      where: { and: this.of(parent, doc) },
+      sort: [],
+      limit: 0,
+      page: 1
+    });
+    for (const row of rows.docs) await this.db.delete({ collection: VERSIONS, id: row.id });
+  }
+  async prune(parent, doc, max) {
+    const rows = await this.db.find({
+      collection: VERSIONS,
+      where: { and: this.of(parent, doc) },
+      sort: ["-id"],
+      limit: 0,
+      page: 1
+    });
+    for (const row of rows.docs.slice(max)) {
+      await this.db.delete({ collection: VERSIONS, id: row.id });
+    }
+  }
+  of(parent, doc) {
+    return [{ parent: { equals: parent } }, { doc: { equals: doc } }];
+  }
+  toVersion(row) {
+    return { ...toSummary(row), data: row.snapshot ?? {} };
+  }
+};
+
+// src/roles.ts
+var ROLE_OPERATIONS = ["read", "create", "update", "delete", "publish"];
+var GLOBAL_OPERATIONS = ["read", "update", "publish"];
+var KEY = /^[a-z][a-z0-9-]{0,31}$/;
+var HISTORY = 50;
+var TTL = 3e4;
+var rolesCollection = {
+  slug: ROLES,
+  access: { read: () => false, create: () => false, update: () => false, delete: () => false },
+  fields: [
+    { name: "key", type: "text", required: true, unique: true },
+    { name: "name", type: "text" },
+    { name: "permissions", type: "json" }
+  ]
+};
+function governed(slug2) {
+  return !INTERNAL_COLLECTIONS.has(slug2) && slug2 !== API_KEYS;
+}
+function references(fields, out = /* @__PURE__ */ new Set()) {
+  for (const field of fields) {
+    if (field.type === "relationship") out.add(field.to);
+    else if (field.type === "upload") out.add("media");
+    else if (field.type === "group" || field.type === "array") references(field.fields, out);
+    else if (field.type === "blocks") for (const b of field.blocks) references(b.fields, out);
+  }
+  return out;
+}
+var viewId = {
+  page: (path) => `page:${path}`,
+  widget: (tag) => `widget:${tag}`
+};
+var tagOf = (component) => typeof component === "string" ? component : component.tag;
+var Roles = class {
+  constructor(config, db) {
+    this.config = config;
+    this.db = db;
+    this.enabled = config.auth.rbac;
+    this.versions = new VersionStore(db);
+  }
+  config;
+  db;
+  enabled;
+  versions;
+  cache;
+  synced;
+  /**
+   * Whether the user's role allows an operation: `true`, `false`, or for their own account
+   * (users without read or update on `users`) a constraint to it.
+   */
+  async allows(user, target, operation) {
+    if (!this.enabled || !user || user.role === "admin") return true;
+    if ("collection" in target && !governed(target.collection)) return true;
+    const permissions = await this.permissionsOf(user.role);
+    const ops = "collection" in target ? permissions.collections?.[target.collection] : permissions.globals?.[target.global];
+    if (ops?.includes(operation)) return true;
+    if ("collection" in target && target.collection === USERS) {
+      if (operation === "read" || operation === "update") return { id: { equals: user.id } };
+    }
+    return false;
+  }
+  /**
+   * Whether the user may open an admin page: admins always; with roles, those whose role has
+   * it; without roles, nobody else (`status`, `deliveries`) or everybody (plugin pages).
+   */
+  async canView(user, id) {
+    if (user.role === "admin" && !user.apiKey) return true;
+    if (user.apiKey) return false;
+    if (!this.enabled) return id.startsWith("page:") || id.startsWith("widget:");
+    return (await this.permissionsOf(user.role)).admin?.includes(id) ?? false;
+  }
+  /** Forgets cached permissions, after a role changed. */
+  invalidate() {
+    this.cache = void 0;
+  }
+  /**
+   * Adds the roles of `auth.roles` that are missing; on the first start, gives them everything.
+   * Runs once, on first use (not on startup: `easy-cms migrate` opens the CMS before the table exists).
+   */
+  sync() {
+    this.synced ??= this.addMissing().catch((error) => {
+      this.synced = void 0;
+      throw error;
+    });
+    return this.synced;
+  }
+  async addMissing() {
+    if (!this.enabled) return;
+    const rows = await this.rows();
+    const first = rows.length === 0;
+    const known = new Set(rows.map((r) => String(r.key)));
+    for (const key2 of this.config.auth.roles) {
+      if (known.has(key2)) continue;
+      try {
+        await this.insert(key2, "", first && key2 !== "admin" ? this.everything() : {}, null);
+      } catch (error) {
+        if (!(await this.rows()).some((r) => r.key === key2)) throw error;
+      }
+    }
+    this.invalidate();
+  }
+  /** Whether a role exists (users can only be given existing roles). */
+  async exists(key2) {
+    if (!this.enabled) return this.config.auth.roles.includes(key2);
+    return (await this.load()).has(key2);
+  }
+  /** Roles a user can be given, those of `auth.roles` first; `name` may be empty. */
+  async options() {
+    if (!this.enabled) return this.config.auth.roles.map((key2) => ({ key: key2, name: "" }));
+    await this.sync();
+    return (await this.rows()).map((row) => ({ key: String(row.key), name: typeof row.name === "string" ? row.name : "" })).sort((a, b) => rank(a, this.config) - rank(b, this.config) || a.key.localeCompare(b.key));
+  }
+  // --- Settings → Roles ----------------------------------------------------
+  async list() {
+    await this.sync();
+    const rows = await this.rows();
+    const counts = /* @__PURE__ */ new Map();
+    for (const row of rows) {
+      counts.set(
+        String(row.key),
+        await this.db.count({ collection: USERS, where: { role: { equals: row.key } } })
+      );
+    }
+    const roles = rows.map((row) => this.toRole(row, counts.get(String(row.key)) ?? 0)).sort((a, b) => rank(a, this.config) - rank(b, this.config) || a.key.localeCompare(b.key));
+    const decided = roles.filter((r) => r.key !== "admin").map((r) => r.permissions);
+    const seen = (group, slug2) => decided.some((p) => p[group]?.[slug2] !== void 0);
+    return {
+      roles,
+      collections: this.config.collections.filter((c) => governed(c.slug)).map((c) => ({
+        slug: c.slug,
+        ops: ROLE_OPERATIONS.filter((op) => op !== "publish" || c.drafts === true),
+        new: !seen("collections", c.slug),
+        references: [...references(c.fields)].filter((s) => s !== c.slug && governed(s))
+      })),
+      globals: this.config.globals.map((g) => ({
+        slug: g.slug,
+        ops: GLOBAL_OPERATIONS.filter((op) => op !== "publish" || g.drafts === true),
+        new: !seen("globals", g.slug)
+      })),
+      views: this.views()
+    };
+  }
+  async create(input, author) {
+    await this.sync();
+    const key2 = typeof input.key === "string" ? input.key.trim() : "";
+    if (!KEY.test(key2)) {
+      throw new ValidationError(ROLES, [
+        { field: "key", message: 'lowercase letters, digits and "-", starting with a letter' }
+      ]);
+    }
+    if ((await this.rows()).some((r) => r.key === key2))
+      throw new ValidationError(ROLES, [{ field: "key", message: "is already used" }]);
+    const row = await this.insert(
+      key2,
+      this.cleanName(input.name),
+      this.clean(input.permissions),
+      author.id
+    );
+    return this.toRole(row, 0);
+  }
+  async update(id, input, author) {
+    const row = await this.row(id);
+    const data = { ...row, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    if (input.name !== void 0) data.name = this.cleanName(input.name);
+    if (input.permissions !== void 0) {
+      if (row.key === "admin")
+        throw new EasyCMSError("Admins may always do everything; their role cannot be changed", 400);
+      data.permissions = this.clean(input.permissions);
+    }
+    const { id: _id, ...rest } = data;
+    const saved = await this.db.update({ collection: ROLES, id: row.id, data: rest });
+    await this.record(saved, author.id);
+    this.invalidate();
+    return this.toRole(saved, await this.users(String(row.key)));
+  }
+  async delete(id) {
+    const row = await this.row(id);
+    const key2 = String(row.key);
+    if (this.config.auth.roles.includes(key2))
+      throw new EasyCMSError(`"${key2}" is in auth.roles and cannot be deleted`, 400);
+    const users = await this.users(key2);
+    if (users > 0)
+      throw new EasyCMSError(`${users} user(s) have this role; give them another role first`, 409);
+    await this.db.delete({ collection: ROLES, id: row.id });
+    await this.versions.deleteAll(ROLES, row.id);
+    this.invalidate();
+  }
+  async history(id) {
+    const row = await this.row(id);
+    const list = await this.versions.list(ROLES, row.id, HISTORY, 1);
+    const emails = /* @__PURE__ */ new Map();
+    const out = [];
+    for (const summary of list.docs) {
+      const version = await this.versions.get(ROLES, row.id, summary.id);
+      if (!version) continue;
+      let author = null;
+      if (summary.author !== null) {
+        const k = String(summary.author);
+        if (!emails.has(k)) {
+          const user = await this.db.findById({ collection: USERS, id: summary.author });
+          emails.set(k, typeof user?.email === "string" ? user.email : null);
+        }
+        author = emails.get(k) ?? null;
+      }
+      out.push({
+        id: summary.id,
+        author,
+        createdAt: summary.createdAt,
+        name: String(version.data.name ?? ""),
+        permissions: version.data.permissions ?? {}
+      });
+    }
+    return out;
+  }
+  // -------------------------------------------------------------------------
+  /** Pages and panels roles can be given. */
+  views() {
+    return [
+      { id: "status" },
+      ...this.config.collections.some(
+        (c) => c.slug === WEBHOOK_DELIVERIES || c.slug === EMAIL_DELIVERIES
+      ) ? [{ id: "deliveries" }] : [],
+      ...this.config.admin.pages.map((page) => ({ id: viewId.page(page.path), label: page.label })),
+      ...this.config.admin.dashboard.map((widget) => ({
+        id: viewId.widget(tagOf(widget.component)),
+        ...widget.label !== void 0 ? { label: widget.label } : {}
+      }))
+    ];
+  }
+  /** Every collection and global, and the plugin pages and panels: what roles had before roles. */
+  everything() {
+    const collections = {};
+    for (const c of this.config.collections) {
+      if (governed(c.slug))
+        collections[c.slug] = ROLE_OPERATIONS.filter((op) => op !== "publish" || c.drafts === true);
+    }
+    const globals = {};
+    for (const g of this.config.globals)
+      globals[g.slug] = GLOBAL_OPERATIONS.filter((op) => op !== "publish" || g.drafts === true);
+    const admin = this.views().map((v) => v.id).filter((id) => id.startsWith("page:") || id.startsWith("widget:"));
+    return { collections, globals, admin };
+  }
+  /** Keeps only known collections, globals, operations and pages; `read` comes with the others. */
+  clean(value) {
+    const input = typeof value === "object" && value !== null ? value : {};
+    const pick = (group, allowed2) => {
+      const out = {};
+      if (typeof group !== "object" || group === null) return out;
+      for (const [slug2, ops] of Object.entries(group)) {
+        const valid = allowed2.get(slug2);
+        if (!valid || !Array.isArray(ops)) continue;
+        const picked = valid.filter((op) => ops.includes(op));
+        if (picked.length > 0 && !picked.includes("read")) picked.unshift("read");
+        out[slug2] = picked;
+      }
+      return out;
+    };
+    const collections = new Map(
+      this.config.collections.filter((c) => governed(c.slug)).map((c) => [
+        c.slug,
+        ROLE_OPERATIONS.filter((op) => op !== "publish" || c.drafts === true)
+      ])
+    );
+    const globals = new Map(
+      this.config.globals.map((g) => [
+        g.slug,
+        GLOBAL_OPERATIONS.filter((op) => op !== "publish" || g.drafts === true)
+      ])
+    );
+    const views = new Set(this.views().map((v) => v.id));
+    const admin = Array.isArray(input.admin) ? [
+      ...new Set(
+        input.admin.filter((id) => typeof id === "string" && views.has(id))
+      )
+    ] : [];
+    return {
+      collections: pick(input.collections, collections),
+      globals: pick(input.globals, globals),
+      admin
+    };
+  }
+  cleanName(value) {
+    if (value === void 0 || value === null) return "";
+    if (typeof value !== "string" || value.trim().length > 60)
+      throw new ValidationError(ROLES, [
+        { field: "name", message: "must be at most 60 characters" }
+      ]);
+    return value.trim();
+  }
+  async permissionsOf(key2) {
+    return (await this.load()).get(key2) ?? {};
+  }
+  async load() {
+    if (this.cache && Date.now() - this.cache.at < TTL) return this.cache.byKey;
+    await this.sync();
+    const byKey = /* @__PURE__ */ new Map();
+    for (const row of await this.rows())
+      byKey.set(String(row.key), row.permissions ?? {});
+    this.cache = { at: Date.now(), byKey };
+    return byKey;
+  }
+  async rows() {
+    return (await this.db.find({ collection: ROLES, sort: ["id"], limit: 0, page: 1 })).docs;
+  }
+  async row(id) {
+    const row = await this.db.findById({ collection: ROLES, id });
+    if (!row) throw new NotFoundError(ROLES, id);
+    return row;
+  }
+  users(key2) {
+    return this.db.count({ collection: USERS, where: { role: { equals: key2 } } });
+  }
+  async insert(key2, name, permissions, author) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const row = await this.db.create({
+      collection: ROLES,
+      data: { key: key2, name, permissions, createdAt: now, updatedAt: now }
+    });
+    await this.record(row, author);
+    this.invalidate();
+    return row;
+  }
+  /** Keeps the role as saved, for its history. */
+  async record(row, author) {
+    await this.versions.save({
+      parent: ROLES,
+      doc: row.id,
+      status: null,
+      snapshot: { name: row.name ?? "", permissions: row.permissions ?? {} },
+      author,
+      max: HISTORY
+    });
+  }
+  toRole(row, users) {
+    const key2 = String(row.key);
+    return {
+      id: row.id,
+      key: key2,
+      name: typeof row.name === "string" ? row.name : "",
+      system: this.config.auth.roles.includes(key2),
+      users,
+      permissions: row.permissions ?? {},
+      updatedAt: String(row.updatedAt)
+    };
+  }
+};
+function rank(role, config) {
+  const index = config.auth.roles.indexOf(role.key);
+  return index === -1 ? config.auth.roles.length : index;
+}
+
 // src/webhooks.ts
 import { createHmac as createHmac2, randomUUID as randomUUID2 } from "crypto";
 var WEBHOOK_EVENTS = [
@@ -2359,6 +2851,7 @@ var RESERVED_SLUGS = /* @__PURE__ */ new Set([
   "webhook-deliveries",
   "email-deliveries",
   "database-backups",
+  "user-roles",
   "api-keys",
   "jobs",
   "migrations",
@@ -2563,6 +3056,7 @@ function validateAdminViews(config, add) {
         "e.g. dashboard: [{ component: 'ecms-stats-widget' }]"
       );
     } else {
+      const tags = /* @__PURE__ */ new Set();
       widgets2.forEach((widget, i) => {
         const path = `admin.dashboard[${i}]`;
         if (typeof widget !== "object" || widget === null) {
@@ -2573,6 +3067,19 @@ function validateAdminViews(config, add) {
         validateComponent(w.component, `${path}.component`, add);
         if (w.width !== void 0 && w.width !== "half" && w.width !== "full")
           add(`${path}.width`, 'must be "half" or "full"');
+        if (w.label !== void 0 && !(typeof w.label === "string" && w.label.trim() !== "") && !(typeof w.label === "object" && w.label !== null && !Array.isArray(w.label)))
+          add(`${path}.label`, "must be a string or { en, th }");
+        const component = w.component;
+        const tag = typeof component === "string" ? component : component?.tag;
+        if (config.auth?.rbac === true && typeof tag === "string") {
+          if (tags.has(tag))
+            add(
+              `${path}.component`,
+              `another panel uses "${tag}"`,
+              "with auth.rbac, roles are given panels by their tag: use one tag per panel"
+            );
+          tags.add(tag);
+        }
         access(w.access, path);
       });
     }
@@ -2586,6 +3093,8 @@ function validateIcon(container, path, add) {
 function validateAuth(config, add) {
   const auth = config.auth;
   if (auth === void 0) return;
+  if (auth.rbac !== void 0 && typeof auth.rbac !== "boolean")
+    add("auth.rbac", "must be true or false");
   if (auth.roles !== void 0) {
     const roles = auth.roles;
     if (!Array.isArray(roles) || roles.some((r) => typeof r !== "string" || r === "")) {
@@ -3280,6 +3789,7 @@ async function resolveConfig(input) {
     },
     auth: {
       roles: config.auth?.roles ?? DEFAULT_ROLES,
+      rbac: config.auth?.rbac === true,
       tokenExpiration: config.auth?.tokenExpiration ?? DEFAULT_TOKEN_EXPIRATION,
       maxLoginAttempts: config.auth?.maxLoginAttempts ?? 5,
       lockWindow: config.auth?.lockWindow ?? 15 * 60,
@@ -3291,12 +3801,14 @@ async function resolveConfig(input) {
     collections: [
       ...config.collections ?? [],
       ...internalCollections,
-      ...usesVersions(config) ? [versionsCollection] : [],
+      // Roles keep their history as versions.
+      ...usesVersions(config) || config.auth?.rbac ? [versionsCollection] : [],
       ...usesSchedule(config) ? [scheduledJobsCollection] : [],
       ...(config.webhooks?.length ?? 0) > 0 ? [webhookDeliveriesCollection] : [],
       ...config.apiKeys ? [apiKeysCollection] : [],
       ...config.email ? [emailDeliveriesCollection] : [],
-      databaseBackupsCollection
+      databaseBackupsCollection,
+      ...config.auth?.rbac ? [rolesCollection] : []
     ],
     globals: config.globals ?? [],
     endpoints: config.endpoints ?? [],
@@ -3841,137 +4353,6 @@ function read(response, maxBytes, deadline) {
   });
 }
 
-// src/versions.ts
-var DEFAULT_MAX_VERSIONS = 50;
-function versionLimit(config) {
-  const versions = config.versions;
-  if (!versions) return void 0;
-  return versions === true ? DEFAULT_MAX_VERSIONS : versions.max ?? DEFAULT_MAX_VERSIONS;
-}
-var collectionParent = (slug2) => slug2;
-var globalParent = (slug2) => `global:${slug2}`;
-function snapshotOf(fields, doc) {
-  const hidden = new Set(fields.filter((f) => f.hidden).map((f) => f.name));
-  const snapshot = {};
-  for (const [key2, value] of Object.entries(doc)) {
-    if (key2 === "id" || key2 === "createdAt" || key2 === "updatedAt" || hidden.has(key2)) continue;
-    snapshot[key2] = value;
-  }
-  return snapshot;
-}
-var toSummary = (row) => ({
-  id: row.id,
-  status: row.status ?? null,
-  latest: row.latest === true,
-  author: row.author ?? null,
-  createdAt: String(row.createdAt)
-});
-var VersionStore = class {
-  constructor(db) {
-    this.db = db;
-  }
-  db;
-  /** Saves a new latest version and deletes the oldest beyond `max`. */
-  async save(args) {
-    const { parent, doc } = args;
-    const previous = await this.db.find({
-      collection: VERSIONS,
-      where: { and: [...this.of(parent, doc), { latest: { equals: true } }] },
-      sort: [],
-      limit: 0,
-      page: 1
-    });
-    for (const row of previous.docs) {
-      await this.db.update({ collection: VERSIONS, id: row.id, data: { ...row, latest: false } });
-    }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const created = await this.db.create({
-      collection: VERSIONS,
-      data: {
-        parent,
-        doc,
-        status: args.status,
-        latest: true,
-        author: args.author,
-        snapshot: args.snapshot,
-        createdAt: now,
-        updatedAt: now
-      }
-    });
-    await this.prune(parent, doc, args.max);
-    return toSummary(created);
-  }
-  /** The latest version of each document, keyed by document id. */
-  async latest(parent, docs) {
-    const result = /* @__PURE__ */ new Map();
-    if (docs.length === 0) return result;
-    const rows = await this.db.find({
-      collection: VERSIONS,
-      where: {
-        and: [
-          { parent: { equals: parent } },
-          { doc: { in: [...docs] } },
-          { latest: { equals: true } }
-        ]
-      },
-      sort: [],
-      limit: 0,
-      page: 1
-    });
-    for (const row of rows.docs) result.set(String(row.doc), this.toVersion(row));
-    return result;
-  }
-  async list(parent, doc, limit, page) {
-    const found = await this.db.find({
-      collection: VERSIONS,
-      where: { and: this.of(parent, doc) },
-      sort: ["-id"],
-      limit,
-      page
-    });
-    return { ...found, docs: found.docs.map(toSummary) };
-  }
-  async get(parent, doc, id) {
-    const found = await this.db.find({
-      collection: VERSIONS,
-      where: { and: [...this.of(parent, doc), { id: { equals: id } }] },
-      sort: [],
-      limit: 1,
-      page: 1
-    });
-    const row = found.docs[0];
-    return row ? this.toVersion(row) : null;
-  }
-  async deleteAll(parent, doc) {
-    const rows = await this.db.find({
-      collection: VERSIONS,
-      where: { and: this.of(parent, doc) },
-      sort: [],
-      limit: 0,
-      page: 1
-    });
-    for (const row of rows.docs) await this.db.delete({ collection: VERSIONS, id: row.id });
-  }
-  async prune(parent, doc, max) {
-    const rows = await this.db.find({
-      collection: VERSIONS,
-      where: { and: this.of(parent, doc) },
-      sort: ["-id"],
-      limit: 0,
-      page: 1
-    });
-    for (const row of rows.docs.slice(max)) {
-      await this.db.delete({ collection: VERSIONS, id: row.id });
-    }
-  }
-  of(parent, doc) {
-    return [{ parent: { equals: parent } }, { doc: { equals: doc } }];
-  }
-  toVersion(row) {
-    return { ...toSummary(row), data: row.snapshot ?? {} };
-  }
-};
-
 // src/local-api.ts
 async function createEasyCMS(config, options = {}) {
   const resolved3 = await resolveConfig(config);
@@ -4009,6 +4390,8 @@ var EasyCMS = class {
   storage;
   /** Project root: relative paths in the config (e.g. `admin.modules`) start here. */
   cwd;
+  /** Roles and their permissions (`auth.rbac`, Settings → Roles). */
+  roles;
   versions;
   webhooks;
   mailer;
@@ -4019,6 +4402,7 @@ var EasyCMS = class {
     this.storage = storage;
     this.cwd = cwd;
     this.versions = new VersionStore(db);
+    this.roles = new Roles(config, db);
     this.webhooks = new Webhooks(
       config.webhooks ?? [],
       logger,
@@ -4109,7 +4493,7 @@ var EasyCMS = class {
     const config = this.collection(MEDIA);
     const guard = guardOf(options);
     if (guard.enforce) {
-      this.checkKey(guard, { collection: MEDIA }, "create");
+      await this.checkGrant(guard, { collection: MEDIA }, "create");
       const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data });
       if (allowed2 !== true) throw deny(guard.user);
     }
@@ -4169,7 +4553,7 @@ var EasyCMS = class {
     const guard = guardOf(options);
     const fromURL = this.config.upload.fromURL;
     if (guard.enforce) {
-      this.checkKey(guard, { collection: MEDIA }, "create");
+      await this.checkGrant(guard, { collection: MEDIA }, "create");
       const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data });
       if (allowed2 !== true) throw deny(guard.user);
       if (!fromURL)
@@ -4324,7 +4708,7 @@ var EasyCMS = class {
     let parsed;
     if (id === null) {
       if (guard.enforce) {
-        this.checkKey(guard, { collection: collection2 }, "create");
+        await this.checkGrant(guard, { collection: collection2 }, "create");
         const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data: raw });
         if (allowed2 !== true) throw deny(guard.user);
       }
@@ -4444,7 +4828,7 @@ var EasyCMS = class {
     if (!existing || parsed === void 0) throw new NotFoundError(collection2, id);
     await this.checkDocumentAccess(config, "update", guard, parsed, raw);
     if (config.drafts && (mode === "unpublish" || raw.status === "published"))
-      this.checkKey(guard, { collection: collection2 }, "publish");
+      await this.checkGrant(guard, { collection: collection2 }, "publish");
     const [drafted] = await this.withDrafts(config, [existing]);
     const live = options.live === true && mode === "save";
     const current = live ? existing : drafted;
@@ -4639,7 +5023,7 @@ var EasyCMS = class {
     const guard = guardOf(options);
     await this.checkGlobalAccess(config, "update", guard);
     if (config.drafts && (mode === "unpublish" || raw.status === "published"))
-      this.checkKey(guard, { global: slug2 }, "publish");
+      await this.checkGrant(guard, { global: slug2 }, "publish");
     const input = await filterInput(
       config.fields,
       raw,
@@ -4928,14 +5312,14 @@ var EasyCMS = class {
     const existing = parsed === void 0 ? null : await this.db.findById({ collection: collection2, id: parsed });
     if (!existing || parsed === void 0) throw new NotFoundError(collection2, id);
     await this.checkDocumentAccess(config, "update", guardOf(options), parsed, void 0);
-    this.checkKey(guardOf(options), { collection: collection2 }, "publish");
+    await this.checkGrant(guardOf(options), { collection: collection2 }, "publish");
     return { config, parsed };
   }
   async globalScheduleTarget(slug2, options) {
     const config = this.global(slug2);
     if (!config.schedule) throw new QueryError(`"${slug2}" has no schedule`);
     await this.checkGlobalAccess(config, "update", guardOf(options));
-    this.checkKey(guardOf(options), { global: slug2 }, "publish");
+    await this.checkGrant(guardOf(options), { global: slug2 }, "publish");
   }
   async addJob(parent, doc, job, options) {
     const runAt = new Date(job.at);
@@ -4981,20 +5365,21 @@ var EasyCMS = class {
       page: 1
     });
     const allowed2 = /* @__PURE__ */ new Map();
-    const may = async (parent) => {
+    const may2 = async (parent) => {
       if (!guard.enforce) return true;
       const cached = allowed2.get(parent);
       if (cached !== void 0) return cached;
       const config = parent.startsWith("global:") ? this.config.globals.find((g) => g.slug === parent.slice("global:".length)) : this.config.collections.find((c) => c.slug === parent);
       const access = config ? await evaluateAccess(config.access?.update, { user: guard.user }) : false;
-      const result = access !== false;
+      const target = parent.startsWith("global:") ? { global: parent.slice("global:".length) } : { collection: parent };
+      const result = access !== false && await this.roles.allows(guard.user, target, "update") !== false;
       allowed2.set(parent, result);
       return result;
     };
     const jobs = [];
     for (const row of rows.docs) {
       const parent = String(row.parent);
-      if (!await may(parent)) continue;
+      if (!await may2(parent)) continue;
       const target = parent.startsWith("global:") ? { global: parent.slice("global:".length) } : { collection: parent };
       jobs.push({ ...toJob(row), ...target, doc: row.doc });
       if (jobs.length === limit) break;
@@ -5079,28 +5464,36 @@ var EasyCMS = class {
     if (!config) throw new QueryError(`Unknown global "${slug2}"`);
     return config;
   }
-  /** Refuses what a request's API key does not allow (see `ApiKeyPermissions`). */
-  checkKey(guard, target, operation) {
-    if (!guard.enforce || keyAllows(guard.user, target, operation)) return;
+  /**
+   * Refuses what a request's API key (see `ApiKeyPermissions`) or the user's role (`auth.rbac`)
+   * does not allow. Returns a constraint when the role allows only the user's own account.
+   */
+  async checkGrant(guard, target, operation) {
+    if (!guard.enforce) return true;
     const name = "collection" in target ? target.collection : target.global;
-    throw new ForbiddenError(`This API key may not ${operation} "${name}"`);
+    if (!keyAllows(guard.user, target, operation))
+      throw new ForbiddenError(`This API key may not ${operation} "${name}"`);
+    const role = await this.roles.allows(guard.user, target, operation);
+    if (role === false) throw deny(guard.user);
+    return role;
   }
   /** The query constraint read access adds, or `undefined` when there is none. Throws when denied. */
   async readWhere(config, guard, where) {
     if (!guard.enforce) return where;
-    this.checkKey(guard, { collection: config.slug }, "read");
+    const own = await this.checkGrant(guard, { collection: config.slug }, "read");
     const access = await evaluateAccess(config.access?.read, { user: guard.user });
     if (access === false) throw deny(guard.user);
-    return andWhere(where, access);
+    return andWhere(andWhere(where, access), own);
   }
   async checkDocumentAccess(config, operation, guard, id, data) {
     if (!guard.enforce) return;
-    this.checkKey(guard, { collection: config.slug }, operation);
-    const access = await evaluateAccess(config.access?.[operation], {
+    const own = await this.checkGrant(guard, { collection: config.slug }, operation);
+    const allowed2 = await evaluateAccess(config.access?.[operation], {
       user: guard.user,
       id,
       ...data ? { data } : {}
     });
+    const access = allowed2 === false ? false : andWhere(own === true ? void 0 : own, allowed2) ?? true;
     if (access === true) return;
     if (access !== false) {
       const matches2 = await this.db.count({
@@ -5113,7 +5506,7 @@ var EasyCMS = class {
   }
   async checkGlobalAccess(config, operation, guard) {
     if (!guard.enforce) return;
-    this.checkKey(guard, { global: config.slug }, operation);
+    await this.checkGrant(guard, { global: config.slug }, operation);
     const access = await evaluateAccess(config.access?.[operation], { user: guard.user });
     if (typeof access === "object")
       throw new QueryError(`${operation} access of global "${config.slug}" must return a boolean`);
@@ -5167,9 +5560,9 @@ var EasyCMS = class {
     const guard = guardOf(options);
     const collection2 = config.slug;
     if (guard.enforce) {
-      this.checkKey(guard, { collection: collection2 }, "create");
+      await this.checkGrant(guard, { collection: collection2 }, "create");
       if (config.drafts && raw.status === "published")
-        this.checkKey(guard, { collection: collection2 }, "publish");
+        await this.checkGrant(guard, { collection: collection2 }, "publish");
       const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data: raw });
       if (typeof allowed2 === "object")
         throw new QueryError(`create access of "${collection2}" must return a boolean`);
@@ -5388,6 +5781,8 @@ var EasyCMS = class {
       }
       clean2.status = status;
     }
+    if (config.slug === USERS && this.roles.enabled && typeof clean2.role === "string" && !await this.roles.exists(clean2.role))
+      errors.push({ field: "role", message: `there is no role "${clean2.role}"` });
     const isCollection = this.config.collections.includes(config);
     if (isCollection && errors.length === 0) {
       await this.makeSlugsUnique(config, clean2, selfId);
@@ -5474,11 +5869,11 @@ var EasyCMS = class {
     return await this.db.count({ collection: collection2, where }) > 0;
   }
   /** Each reference is one its relationship's `filterOptions` allow. */
-  async checkFilterOptions(references, selfId, user) {
+  async checkFilterOptions(references2, selfId, user) {
     const errors = [];
     const cms = this;
     const allowed2 = /* @__PURE__ */ new Map();
-    for (const ref of references) {
+    for (const ref of references2) {
       const filter = ref.filterOptions;
       if (!filter) continue;
       if (!allowed2.has(filter)) allowed2.set(filter, await filter({ id: selfId, user, cms }));
@@ -5496,9 +5891,9 @@ var EasyCMS = class {
     }
     return errors;
   }
-  async checkReferences(references) {
+  async checkReferences(references2) {
     const byCollection = /* @__PURE__ */ new Map();
-    for (const ref of references) {
+    for (const ref of references2) {
       if (!this.config.collections.some((c) => c.slug === ref.collection)) continue;
       byCollection.set(ref.collection, [...byCollection.get(ref.collection) ?? [], ref]);
     }
@@ -5897,23 +6292,36 @@ async function serializeFields(fields, update2, localized) {
   }
   return out;
 }
-async function collection(config, user, localized) {
+async function may(cms, access, user, target, operation) {
+  return await allowed(access, user) && await cms.roles.allows(user, target, operation) !== false;
+}
+async function collection(cms, config, user, localized, roles) {
+  const target = { collection: config.slug };
+  const fields = await serializeFields(
+    config.fields,
+    new FieldAccessChecker("update", { user }),
+    localized
+  );
+  if (config.slug === USERS && cms.roles.enabled) {
+    const role = fields.find((f) => f.name === "role");
+    if (role) {
+      role.type = "select";
+      role.options = roles.map((r) => ({ label: r.name || r.key, value: r.key }));
+    }
+  }
   const result = {
     slug: config.slug,
     drafts: config.drafts === true,
     versions: Boolean(config.versions),
     preview: typeof config.preview === "function",
     schedule: config.schedule === true,
-    fields: await serializeFields(
-      config.fields,
-      new FieldAccessChecker("update", { user }),
-      localized
-    ),
+    fields,
     permissions: {
-      read: await allowed(config.access?.read, user),
-      create: await allowed(config.access?.create, user),
-      update: await allowed(config.access?.update, user),
-      delete: await allowed(config.access?.delete, user)
+      read: await may(cms, config.access?.read, user, target, "read"),
+      create: await may(cms, config.access?.create, user, target, "create"),
+      update: await may(cms, config.access?.update, user, target, "update"),
+      delete: await may(cms, config.access?.delete, user, target, "delete"),
+      publish: config.drafts === true && await may(cms, config.access?.update, user, target, "publish")
     }
   };
   if (config.labels) result.labels = config.labels;
@@ -5927,7 +6335,8 @@ async function collection(config, user, localized) {
     result.editIn = "drawer";
   return result;
 }
-async function global(config, user, localized) {
+async function global(cms, config, user, localized) {
+  const target = { global: config.slug };
   const result = {
     slug: config.slug,
     drafts: config.drafts === true,
@@ -5940,8 +6349,9 @@ async function global(config, user, localized) {
       localized
     ),
     permissions: {
-      read: await allowed(config.access?.read, user),
-      update: await allowed(config.access?.update, user)
+      read: await may(cms, config.access?.read, user, target, "read"),
+      update: await may(cms, config.access?.update, user, target, "update"),
+      publish: config.drafts === true && await may(cms, config.access?.update, user, target, "publish")
     }
   };
   if (config.label !== void 0) result.label = config.label;
@@ -5953,16 +6363,31 @@ async function adminSchema(cms, user, origin) {
   const collections = cms.config.collections.filter((c) => !INTERNAL_COLLECTIONS.has(c.slug));
   const localization = cms.config.localization;
   const localized = localization !== null;
+  const admin = user.role === "admin" && !user.apiKey;
+  const deliveries = cms.config.collections.some(
+    (c) => c.slug === WEBHOOK_DELIVERIES || c.slug === EMAIL_DELIVERIES
+  );
+  const views = {
+    status: await cms.roles.canView(user, "status"),
+    deliveries: deliveries && await cms.roles.canView(user, "deliveries"),
+    backups: admin,
+    email: admin,
+    roles: admin && cms.roles.enabled
+  };
+  const roles = await cms.roles.options();
   return {
     locale: cms.config.admin.locale,
     passwordLinks: cms.auth.canSendPasswordLinks(origin),
     menu: [...cms.config.admin.menu],
     localization: localization ? { locales: [...localization.locales], defaultLocale: localization.defaultLocale } : null,
-    collections: await Promise.all(collections.map((c) => collection(c, user, localized))),
-    globals: await Promise.all(cms.config.globals.map((g) => global(g, user, localized))),
+    collections: await Promise.all(
+      collections.map((c) => collection(cms, c, user, localized, roles))
+    ),
+    globals: await Promise.all(cms.config.globals.map((g) => global(cms, g, user, localized))),
     modules: adminModuleUrls(cms),
     uploadFromURL: cms.config.upload.fromURL !== void 0,
-    ...user.role === "admin" && !user.apiKey ? {
+    views,
+    ...views.deliveries ? {
       deliveries: {
         webhook: cms.config.collections.some((c) => c.slug === WEBHOOK_DELIVERIES),
         email: cms.config.collections.some((c) => c.slug === EMAIL_DELIVERIES)
@@ -5983,7 +6408,8 @@ async function shown(access, user) {
 async function pages(cms, user) {
   const out = [];
   for (const page of cms.config.admin.pages) {
-    if (!await shown(page.access, user)) continue;
+    if (!await shown(page.access, user) || !await cms.roles.canView(user, `page:${page.path}`))
+      continue;
     out.push({
       path: page.path,
       label: page.label,
@@ -5997,14 +6423,16 @@ async function pages(cms, user) {
 async function widgets(cms, user) {
   const out = [];
   for (const widget of cms.config.admin.dashboard) {
-    if (!await shown(widget.access, user)) continue;
+    const tag = typeof widget.component === "string" ? widget.component : widget.component.tag;
+    if (!await shown(widget.access, user) || !await cms.roles.canView(user, `widget:${tag}`))
+      continue;
     out.push({ component: componentRef(widget.component), width: widget.width ?? "half" });
   }
   return out;
 }
 
 // src/version.ts
-var VERSION = true ? "0.32.0" : "0.0.0-dev";
+var VERSION = true ? "0.33.0" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
 var DAY = 864e5;
@@ -6495,9 +6923,36 @@ async function route(cms, ctx, method, segments, options) {
     }
     throw new HttpError("Not found", 404);
   }
-  if (first === "admin" && second === "deliveries") {
+  if (first === "admin" && second === "roles") {
     if (!ctx.user) throw new UnauthorizedError();
     if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+    if (!cms.roles.enabled) throw new HttpError("Not found", 404);
+    const [, , id2, action, extra] = segments;
+    if (extra !== void 0) throw new HttpError("Not found", 404);
+    if (id2 === void 0) {
+      if (method === "GET") return { body: await cms.roles.list() };
+      if (method === "POST")
+        return { status: 201, body: await cms.roles.create(await readJson(ctx.request), ctx.user) };
+      throw methodNotAllowed(ctx, "GET, POST");
+    }
+    const parsed = parseId(id2);
+    if (parsed === void 0) throw new HttpError("Not found", 404);
+    if (action === "history") {
+      if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+      return { body: await cms.roles.history(parsed) };
+    }
+    if (action !== void 0) throw new HttpError("Not found", 404);
+    if (method === "PATCH")
+      return { body: await cms.roles.update(parsed, await readJson(ctx.request), ctx.user) };
+    if (method === "DELETE") {
+      await cms.roles.delete(parsed);
+      return { body: { deleted: 1 } };
+    }
+    throw methodNotAllowed(ctx, "PATCH, DELETE");
+  }
+  if (first === "admin" && second === "deliveries") {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (!await cms.roles.canView(ctx.user, "deliveries")) throw new ForbiddenError();
     const [, , kind, id2, action, extra] = segments;
     if (kind === void 0) {
       if (method !== "GET") throw methodNotAllowed(ctx, "GET");
@@ -6547,7 +7002,7 @@ async function route(cms, ctx, method, segments, options) {
       return { body: new Response(file.body, { headers }) };
     }
     if (second === "status" && third === void 0) {
-      if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+      if (!await cms.roles.canView(ctx.user, "status")) throw new ForbiddenError();
       return { body: await adminStatus(cms) };
     }
     if (second === "scheduled" && third === void 0)
@@ -7157,6 +7612,8 @@ export {
   NotFoundError,
   PayloadTooLargeError,
   QueryError,
+  ROLE_OPERATIONS,
+  Roles,
   SESSION_COOKIE,
   SchemaError,
   TooManyRequestsError,