@easy-cms/core 0.32.0 → 0.34.0

package/dist/index.js

@@ -253,14 +253,19 @@ function andWhere(where, constraint) {
   return where === void 0 ? constraint : { and: [where, constraint] };
 }
 var FieldAccessChecker = class {
-  constructor(kind, args) {
+  /** `rules`: the user's role's rules for top-level fields (`auth.rbac`), on top of `access`. */
+  constructor(kind, args, rules) {
     this.kind = kind;
     this.args = args;
+    this.rules = rules;
   }
   kind;
   args;
+  rules;
   cache = /* @__PURE__ */ new Map();
   async allows(field) {
+    const rule = this.rules?.get(field);
+    if (rule === "hidden" || rule === "read" && this.kind === "update") return false;
     const fn = field.access?.[this.kind];
     if (!fn) return true;
     let allowed2 = this.cache.get(field);
@@ -326,6 +331,7 @@ var SCHEDULED_JOBS = "scheduled-jobs";
 var WEBHOOK_DELIVERIES = "webhook-deliveries";
 var EMAIL_DELIVERIES = "email-deliveries";
 var DATABASE_BACKUPS = "database-backups";
+var ROLES = "user-roles";
 var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SESSIONS,
   LOGIN_ATTEMPTS,
@@ -333,9 +339,27 @@ var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SCHEDULED_JOBS,
   WEBHOOK_DELIVERIES,
   EMAIL_DELIVERIES,
-  DATABASE_BACKUPS
+  DATABASE_BACKUPS,
+  ROLES
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
+var CREATED_BY_FIELD = {
+  name: "createdBy",
+  type: "relationship",
+  to: USERS,
+  position: "sidebar",
+  access: { update: () => false },
+  label: { en: "Created by", th: "\u0E2A\u0E23\u0E49\u0E32\u0E07\u0E42\u0E14\u0E22" }
+};
+function withCreatedBy(config) {
+  if (config.auth?.rbac !== true) return config;
+  return {
+    ...config,
+    collections: (config.collections ?? []).map(
+      (c) => c.slug === USERS || c.fields?.some((f) => f.name === CREATED_BY_FIELD.name) ? c : { ...c, fields: [...c.fields, CREATED_BY_FIELD] }
+    )
+  };
+}
 var adminOrSelf = ({ user }) => {
   if (!user) return false;
   if (user.role === "admin") return true;
@@ -344,7 +368,8 @@ var adminOrSelf = ({ user }) => {
 var adminOnly = {
   update: ({ user }) => user?.role === "admin"
 };
-function userFields(roles) {
+function userFields(roles, rbac) {
+  const defaultRole = roles.includes("editor") ? "editor" : roles[roles.length - 1];
   return [
     {
       name: "email",
@@ -354,12 +379,20 @@ function userFields(roles) {
       label: { en: "Email", th: "\u0E2D\u0E35\u0E40\u0E21\u0E25" }
     },
     { name: "name", type: "text", label: { en: "Name", th: "\u0E0A\u0E37\u0E48\u0E2D" } },
-    {
+    // With roles from the admin (`auth.rbac`), any role in Settings → Roles: checked on save.
+    rbac ? {
+      name: "role",
+      type: "text",
+      required: true,
+      defaultValue: defaultRole,
+      access: adminOnly,
+      label: { en: "Role", th: "\u0E1A\u0E17\u0E1A\u0E32\u0E17" }
+    } : {
       name: "role",
       type: "select",
       options: roles,
       required: true,
-      defaultValue: roles.includes("editor") ? "editor" : roles[roles.length - 1],
+      defaultValue: defaultRole,
       access: adminOnly,
       label: { en: "Role", th: "\u0E1A\u0E17\u0E1A\u0E32\u0E17" }
     },
@@ -382,7 +415,7 @@ function withUsers(config) {
     useAsTitle: "email",
     icon: "users",
     ...custom,
-    fields: [...userFields(roles), ...custom?.fields ?? []],
+    fields: [...userFields(roles, config.auth?.rbac === true), ...custom?.fields ?? []],
     access: {
       read: isLoggedIn,
       create: isAdmin,
@@ -1350,6 +1383,7 @@ async function runBackup(cms, record) {
     const filename = filenameFor(cms, started);
     const key2 = await storage.get(filename) ? filename.replace(/\.db\.gz$/, `-${row.id}.db.gz`) : filename;
     await storage.put(key2, data, { contentType: "application/gzip" });
+    await pruneBackups(cms, 1);
     row = await update(cms, row, {
       state: "done",
       filename: key2,
@@ -1357,7 +1391,6 @@ async function runBackup(cms, record) {
       finishedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
     cms.logger.info(`Backup ${key2} written (${data.byteLength} bytes)`);
-    await pruneBackups(cms);
   } catch (error) {
     await update(cms, row, {
       state: "failed",
@@ -1369,8 +1402,8 @@ async function runBackup(cms, record) {
     await rm2(dir, { recursive: true, force: true });
   }
 }
-async function pruneBackups(cms) {
-  const keep = cms.config.backups?.keep ?? DEFAULT_BACKUP_KEEP;
+async function pruneBackups(cms, room = 0) {
+  const keep = Math.max(0, (cms.config.backups?.keep ?? DEFAULT_BACKUP_KEEP) - room);
   const storage = await backupStorage(cms);
   const { docs } = await cms.db.find({
     collection: DATABASE_BACKUPS,
@@ -1690,7 +1723,7 @@ function parseId(value) {
 async function validateFields(fields, input, options, prefix = "") {
   const data = {};
   const errors = [];
-  const references = [];
+  const references2 = [];
   for (const field of fields) {
     const path = prefix + field.name;
     const raw = input[field.name];
@@ -1708,7 +1741,7 @@ async function validateFields(fields, input, options, prefix = "") {
       );
       data[field.name] = sub.data;
       errors.push(...sub.errors);
-      references.push(...sub.references);
+      references2.push(...sub.references);
       continue;
     }
     const localization = options.localization;
@@ -1738,7 +1771,7 @@ async function validateFields(fields, input, options, prefix = "") {
           options,
           failLocale,
           errors,
-          references
+          references2
         );
         if (normalized === void 0) continue;
         out[locale] = normalized;
@@ -1755,12 +1788,12 @@ async function validateFields(fields, input, options, prefix = "") {
       if (!field.required) await runCustom(field, null, options, fail);
       continue;
     }
-    const value = await normalizeValue(field, raw, path, options, fail, errors, references);
+    const value = await normalizeValue(field, raw, path, options, fail, errors, references2);
     if (value === void 0) continue;
     data[field.name] = value;
     await runCustom(field, value, options, fail);
   }
-  return { data, errors, references };
+  return { data, errors, references: references2 };
 }
 async function runCustom(field, value, options, fail) {
   if (!field.validate) return;
@@ -1768,7 +1801,7 @@ async function runCustom(field, value, options, fail) {
   const result = await validate(value, { data: options.root, operation: options.operation });
   if (result !== true) fail(typeof result === "string" ? result : "is invalid");
 }
-async function normalizeValue(field, raw, path, options, fail, errors, references) {
+async function normalizeValue(field, raw, path, options, fail, errors, references2) {
   switch (field.type) {
     case "text":
     case "textarea":
@@ -1830,7 +1863,7 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
         if (id === void 0)
           return fail(`must be ${many ? "ids" : "an id"} of "${target}" documents`);
         ids.push(id);
-        references.push({
+        references2.push({
           field: path,
           collection: target,
           id,
@@ -1854,19 +1887,19 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
         }
         const sub = await validateFields(field.fields, row, options, `${path}.${i}.`);
         errors.push(...sub.errors);
-        references.push(...sub.references);
+        references2.push(...sub.references);
         const id = typeof row.id === "string" && row.id !== "" ? row.id : randomUUID();
         rows.push({ id, ...sub.data });
       }
       return rows;
     }
     case "blocks":
-      return normalizeBlocks(field, raw, path, options, fail, errors, references);
+      return normalizeBlocks(field, raw, path, options, fail, errors, references2);
     case "group":
       return raw;
   }
 }
-async function normalizeBlocks(field, raw, path, options, fail, errors, references) {
+async function normalizeBlocks(field, raw, path, options, fail, errors, references2) {
   if (!Array.isArray(raw)) return fail("must be an array of blocks");
   if (field.minRows !== void 0 && raw.length < field.minRows)
     return fail(`must have at least ${field.minRows} blocks`);
@@ -1884,7 +1917,7 @@ async function normalizeBlocks(field, raw, path, options, fail, errors, referenc
     }
     const sub = await validateFields(fields, row, options, `${path}.${i}.`);
     errors.push(...sub.errors);
-    references.push(...sub.references);
+    references2.push(...sub.references);
     const id = typeof row.id === "string" && row.id !== "" ? row.id : randomUUID();
     rows.push({ id, blockType: row.blockType, ...sub.data });
   }
@@ -2168,6 +2201,681 @@ import { existsSync } from "fs";
 import { resolve as resolve2 } from "path";
 import { createJiti } from "jiti";
 
+// src/versions.ts
+var DEFAULT_MAX_VERSIONS = 50;
+function versionLimit(config) {
+  const versions = config.versions;
+  if (!versions) return void 0;
+  return versions === true ? DEFAULT_MAX_VERSIONS : versions.max ?? DEFAULT_MAX_VERSIONS;
+}
+var collectionParent = (slug2) => slug2;
+var globalParent = (slug2) => `global:${slug2}`;
+function snapshotOf(fields, doc) {
+  const hidden = new Set(fields.filter((f) => f.hidden).map((f) => f.name));
+  const snapshot = {};
+  for (const [key2, value] of Object.entries(doc)) {
+    if (key2 === "id" || key2 === "createdAt" || key2 === "updatedAt" || hidden.has(key2)) continue;
+    snapshot[key2] = value;
+  }
+  return snapshot;
+}
+var toSummary = (row) => ({
+  id: row.id,
+  status: row.status ?? null,
+  latest: row.latest === true,
+  author: row.author ?? null,
+  createdAt: String(row.createdAt)
+});
+var VersionStore = class {
+  constructor(db) {
+    this.db = db;
+  }
+  db;
+  /** Saves a new latest version and deletes the oldest beyond `max`. */
+  async save(args) {
+    const { parent, doc } = args;
+    const previous = await this.db.find({
+      collection: VERSIONS,
+      where: { and: [...this.of(parent, doc), { latest: { equals: true } }] },
+      sort: [],
+      limit: 0,
+      page: 1
+    });
+    for (const row of previous.docs) {
+      await this.db.update({ collection: VERSIONS, id: row.id, data: { ...row, latest: false } });
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const created = await this.db.create({
+      collection: VERSIONS,
+      data: {
+        parent,
+        doc,
+        status: args.status,
+        latest: true,
+        author: args.author,
+        snapshot: args.snapshot,
+        createdAt: now,
+        updatedAt: now
+      }
+    });
+    await this.prune(parent, doc, args.max);
+    return toSummary(created);
+  }
+  /** The latest version of each document, keyed by document id. */
+  async latest(parent, docs) {
+    const result = /* @__PURE__ */ new Map();
+    if (docs.length === 0) return result;
+    const rows = await this.db.find({
+      collection: VERSIONS,
+      where: {
+        and: [
+          { parent: { equals: parent } },
+          { doc: { in: [...docs] } },
+          { latest: { equals: true } }
+        ]
+      },
+      sort: [],
+      limit: 0,
+      page: 1
+    });
+    for (const row of rows.docs) result.set(String(row.doc), this.toVersion(row));
+    return result;
+  }
+  async list(parent, doc, limit, page) {
+    const found = await this.db.find({
+      collection: VERSIONS,
+      where: { and: this.of(parent, doc) },
+      sort: ["-id"],
+      limit,
+      page
+    });
+    return { ...found, docs: found.docs.map(toSummary) };
+  }
+  async get(parent, doc, id) {
+    const found = await this.db.find({
+      collection: VERSIONS,
+      where: { and: [...this.of(parent, doc), { id: { equals: id } }] },
+      sort: [],
+      limit: 1,
+      page: 1
+    });
+    const row = found.docs[0];
+    return row ? this.toVersion(row) : null;
+  }
+  async deleteAll(parent, doc) {
+    const rows = await this.db.find({
+      collection: VERSIONS,
+      where: { and: this.of(parent, doc) },
+      sort: [],
+      limit: 0,
+      page: 1
+    });
+    for (const row of rows.docs) await this.db.delete({ collection: VERSIONS, id: row.id });
+  }
+  async prune(parent, doc, max) {
+    const rows = await this.db.find({
+      collection: VERSIONS,
+      where: { and: this.of(parent, doc) },
+      sort: ["-id"],
+      limit: 0,
+      page: 1
+    });
+    for (const row of rows.docs.slice(max)) {
+      await this.db.delete({ collection: VERSIONS, id: row.id });
+    }
+  }
+  of(parent, doc) {
+    return [{ parent: { equals: parent } }, { doc: { equals: doc } }];
+  }
+  toVersion(row) {
+    return { ...toSummary(row), data: row.snapshot ?? {} };
+  }
+};
+
+// src/roles.ts
+var ROLE_OPERATIONS = ["read", "create", "update", "delete", "publish"];
+var GLOBAL_OPERATIONS = ["read", "update", "publish"];
+var OWN_OPERATIONS = ["read", "update", "delete", "publish"];
+var KEY = /^[a-z][a-z0-9-]{0,31}$/;
+var HISTORY = 50;
+var TTL = 3e4;
+var rolesCollection = {
+  slug: ROLES,
+  access: { read: () => false, create: () => false, update: () => false, delete: () => false },
+  fields: [
+    { name: "key", type: "text", required: true, unique: true },
+    { name: "name", type: "text" },
+    { name: "permissions", type: "json" }
+  ]
+};
+function governed(slug2) {
+  return !INTERNAL_COLLECTIONS.has(slug2) && slug2 !== API_KEYS;
+}
+function ruleFields(fields) {
+  return fields.filter((f) => !f.hidden && f.name !== "createdBy");
+}
+function references(fields, out = /* @__PURE__ */ new Set()) {
+  for (const field of fields) {
+    if (field.type === "relationship") out.add(field.to);
+    else if (field.type === "upload") out.add("media");
+    else if (field.type === "group" || field.type === "array") references(field.fields, out);
+    else if (field.type === "blocks") for (const b of field.blocks) references(b.fields, out);
+  }
+  return out;
+}
+var viewId = {
+  page: (path) => `page:${path}`,
+  widget: (tag) => `widget:${tag}`
+};
+var tagOf = (component) => typeof component === "string" ? component : component.tag;
+var Roles = class {
+  constructor(config, db, log) {
+    this.config = config;
+    this.db = db;
+    this.log = log;
+    this.enabled = config.auth.rbac;
+    this.versions = new VersionStore(db);
+  }
+  config;
+  db;
+  log;
+  enabled;
+  versions;
+  cache;
+  synced;
+  /**
+   * Whether the user's role allows an operation: `true`, `false`, or for their own account
+   * (users without read or update on `users`) a constraint to it.
+   */
+  async allows(user, target, operation) {
+    if (!this.enabled || !user || user.role === "admin") return true;
+    if ("collection" in target && !governed(target.collection)) return true;
+    const permissions = await this.permissionsOf(user.role);
+    const ops = "collection" in target ? permissions.collections?.[target.collection] : permissions.globals?.[target.global];
+    if (ops?.includes(operation)) {
+      if ("collection" in target && permissions.own?.[target.collection]?.includes(operation)) {
+        const owner = this.ownerOf(target.collection);
+        if (owner && operation !== "create") return { [owner]: { equals: user.id } };
+      }
+      return true;
+    }
+    if ("collection" in target && target.collection === USERS) {
+      if (operation === "read" || operation === "update") return { id: { equals: user.id } };
+    }
+    return false;
+  }
+  /**
+   * Whether the user may open an admin page: admins always; with roles, those whose role has
+   * it; without roles, nobody else (`status`, `deliveries`) or everybody (plugin pages).
+   */
+  async canView(user, id) {
+    if (user.role === "admin" && !user.apiKey) return true;
+    if (user.apiKey) return false;
+    if (!this.enabled) return id.startsWith("page:") || id.startsWith("widget:");
+    return (await this.permissionsOf(user.role)).admin?.includes(id) ?? false;
+  }
+  /**
+   * The field that names a collection's owner, for "own documents only": `admin.ownerField`, or
+   * `createdBy`. `undefined` without roles, and for users and collections roles don't cover.
+   */
+  ownerOf(slug2) {
+    if (!this.enabled || slug2 === USERS || !governed(slug2)) return void 0;
+    const config = this.config.collections.find((c) => c.slug === slug2);
+    if (!config) return void 0;
+    return config.admin?.ownerField ?? "createdBy";
+  }
+  /**
+   * The user's field rules (top-level fields their role may only read, or not see), for field
+   * access checks. Roles that may update only their own documents can't change the owner field.
+   */
+  async fieldRules(user) {
+    if (!this.enabled || !user || user.role === "admin") return void 0;
+    await this.load();
+    const cache = this.cache;
+    const cached = cache?.rules.get(user.role);
+    if (cached) return cached;
+    const permissions = await this.permissionsOf(user.role);
+    const rules = /* @__PURE__ */ new Map();
+    const add = (fields, set) => {
+      for (const field of fields) {
+        const rule = set?.[field.name];
+        if (rule === "read" || rule === "hidden") rules.set(field, rule);
+      }
+    };
+    for (const c of this.config.collections) {
+      if (!governed(c.slug)) continue;
+      add(c.fields, permissions.fields?.collections?.[c.slug]);
+      const ownerField = c.admin?.ownerField;
+      if (ownerField && permissions.own?.[c.slug]?.includes("update")) {
+        const field = c.fields.find((f) => f.name === ownerField);
+        if (field && !rules.has(field)) rules.set(field, "read");
+      }
+    }
+    for (const g of this.config.globals) add(g.fields, permissions.fields?.globals?.[g.slug]);
+    cache?.rules.set(user.role, rules);
+    return rules;
+  }
+  /** A new document is its creator's: sets `createdBy`, and an empty owner field. */
+  fillOwner(slug2, data, user) {
+    if (!user || !this.ownerOf(slug2)) return;
+    data.createdBy ??= user.id;
+    const ownerField = this.config.collections.find((c) => c.slug === slug2)?.admin?.ownerField;
+    if (ownerField && (data[ownerField] === void 0 || data[ownerField] === null))
+      data[ownerField] = user.id;
+  }
+  /** Documents a user owns, by collection (`createdBy` and owner fields), for deleting them. */
+  async owned(userId) {
+    const out = [];
+    for (const c of this.config.collections) {
+      const columns = this.ownerColumns(c.slug);
+      if (columns.length === 0) continue;
+      const count = await this.db.count({
+        collection: c.slug,
+        where: { or: columns.map((column) => ({ [column]: { equals: userId } })) }
+      });
+      if (count > 0) out.push({ collection: c.slug, count });
+    }
+    return out;
+  }
+  /** Gives a deleted user's documents to another user, or to nobody (`null`). */
+  async transfer(from, to) {
+    for (const c of this.config.collections) {
+      for (const column of this.ownerColumns(c.slug))
+        await this.setWhere(c.slug, { [column]: { equals: from } }, column, to);
+    }
+  }
+  /** Forgets cached permissions, after a role changed. */
+  invalidate() {
+    this.cache = void 0;
+  }
+  /**
+   * Adds the roles of `auth.roles` that are missing; on the first start, gives them everything.
+   * Runs once, on first use (not on startup: `easy-cms migrate` opens the CMS before the table exists).
+   */
+  sync() {
+    this.synced ??= this.addMissing().catch((error) => {
+      this.synced = void 0;
+      throw error;
+    });
+    return this.synced;
+  }
+  async addMissing() {
+    if (!this.enabled) return;
+    const rows = await this.rows();
+    const first = rows.length === 0;
+    const known = new Set(rows.map((r) => String(r.key)));
+    for (const key2 of this.config.auth.roles) {
+      if (known.has(key2)) continue;
+      try {
+        await this.insert(key2, "", first && key2 !== "admin" ? this.everything() : {}, null);
+      } catch (error) {
+        if (!(await this.rows()).some((r) => r.key === key2)) throw error;
+      }
+    }
+    this.invalidate();
+    await this.backfillCreators();
+  }
+  /**
+   * Documents from before roles have no `createdBy`: it is filled from who saved their first
+   * version, for collections with versions. Only while no document of the collection has one,
+   * so it runs once (and finds nothing to do afterwards).
+   */
+  async backfillCreators() {
+    for (const c of this.config.collections) {
+      if (!c.versions || !this.ownerOf(c.slug)) continue;
+      if (await this.db.count({ collection: c.slug, where: { createdBy: { exists: true } } }) > 0)
+        continue;
+      const versions = await this.db.find({
+        collection: VERSIONS,
+        where: { and: [{ parent: { equals: c.slug } }, { author: { exists: true } }] },
+        sort: ["id"],
+        limit: 0,
+        page: 1
+      });
+      const first = /* @__PURE__ */ new Map();
+      for (const v of versions.docs) {
+        if (!first.has(v.doc) && v.author !== null) first.set(v.doc, v.author);
+      }
+      let filled = 0;
+      for (const [doc, author] of first) {
+        const row = await this.db.findById({ collection: c.slug, id: doc });
+        if (!row || row.createdBy !== null && row.createdBy !== void 0) continue;
+        const { id, ...rest } = row;
+        await this.db.update({ collection: c.slug, id, data: { ...rest, createdBy: author } });
+        filled++;
+      }
+      if (filled > 0) this.log?.(`Set who created ${filled} ${c.slug} from their history`);
+    }
+  }
+  /** Whether a role exists (users can only be given existing roles). */
+  async exists(key2) {
+    if (!this.enabled) return this.config.auth.roles.includes(key2);
+    return (await this.load()).has(key2);
+  }
+  /** Roles a user can be given, those of `auth.roles` first; `name` may be empty. */
+  async options() {
+    if (!this.enabled) return this.config.auth.roles.map((key2) => ({ key: key2, name: "" }));
+    await this.sync();
+    return (await this.rows()).map((row) => ({ key: String(row.key), name: typeof row.name === "string" ? row.name : "" })).sort((a, b) => rank(a, this.config) - rank(b, this.config) || a.key.localeCompare(b.key));
+  }
+  // --- Settings → Roles ----------------------------------------------------
+  async list() {
+    await this.sync();
+    const rows = await this.rows();
+    const counts = /* @__PURE__ */ new Map();
+    for (const row of rows) {
+      counts.set(
+        String(row.key),
+        await this.db.count({ collection: USERS, where: { role: { equals: row.key } } })
+      );
+    }
+    const roles = rows.map((row) => this.toRole(row, counts.get(String(row.key)) ?? 0)).sort((a, b) => rank(a, this.config) - rank(b, this.config) || a.key.localeCompare(b.key));
+    const decided = roles.filter((r) => r.key !== "admin").map((r) => r.permissions);
+    const seen = (group, slug2) => decided.some((p) => p[group]?.[slug2] !== void 0);
+    return {
+      roles,
+      collections: this.config.collections.filter((c) => governed(c.slug)).map((c) => {
+        const owner = this.ownerOf(c.slug);
+        return {
+          slug: c.slug,
+          ops: ROLE_OPERATIONS.filter((op) => op !== "publish" || c.drafts === true),
+          new: !seen("collections", c.slug),
+          references: [...references(ruleFields(c.fields))].filter(
+            (s) => s !== c.slug && governed(s)
+          ),
+          fields: adminFields(c.fields, c.admin?.ownerField),
+          ...owner ? { owner } : {}
+        };
+      }),
+      globals: this.config.globals.map((g) => ({
+        slug: g.slug,
+        ops: GLOBAL_OPERATIONS.filter((op) => op !== "publish" || g.drafts === true),
+        new: !seen("globals", g.slug),
+        fields: adminFields(g.fields, void 0)
+      })),
+      views: this.views()
+    };
+  }
+  async create(input, author) {
+    await this.sync();
+    const key2 = typeof input.key === "string" ? input.key.trim() : "";
+    if (!KEY.test(key2)) {
+      throw new ValidationError(ROLES, [
+        { field: "key", message: 'lowercase letters, digits and "-", starting with a letter' }
+      ]);
+    }
+    if ((await this.rows()).some((r) => r.key === key2))
+      throw new ValidationError(ROLES, [{ field: "key", message: "is already used" }]);
+    const row = await this.insert(
+      key2,
+      this.cleanName(input.name),
+      this.clean(input.permissions),
+      author.id
+    );
+    return this.toRole(row, 0);
+  }
+  async update(id, input, author) {
+    const row = await this.row(id);
+    const data = { ...row, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    if (input.name !== void 0) data.name = this.cleanName(input.name);
+    if (input.permissions !== void 0) {
+      if (row.key === "admin")
+        throw new EasyCMSError("Admins may always do everything; their role cannot be changed", 400);
+      data.permissions = this.clean(input.permissions);
+    }
+    const { id: _id, ...rest } = data;
+    const saved = await this.db.update({ collection: ROLES, id: row.id, data: rest });
+    await this.record(saved, author.id);
+    this.invalidate();
+    return this.toRole(saved, await this.users(String(row.key)));
+  }
+  async delete(id) {
+    const row = await this.row(id);
+    const key2 = String(row.key);
+    if (this.config.auth.roles.includes(key2))
+      throw new EasyCMSError(`"${key2}" is in auth.roles and cannot be deleted`, 400);
+    const users = await this.users(key2);
+    if (users > 0)
+      throw new EasyCMSError(`${users} user(s) have this role; give them another role first`, 409);
+    await this.db.delete({ collection: ROLES, id: row.id });
+    await this.versions.deleteAll(ROLES, row.id);
+    this.invalidate();
+  }
+  async history(id) {
+    const row = await this.row(id);
+    const list = await this.versions.list(ROLES, row.id, HISTORY, 1);
+    const emails = /* @__PURE__ */ new Map();
+    const out = [];
+    for (const summary of list.docs) {
+      const version = await this.versions.get(ROLES, row.id, summary.id);
+      if (!version) continue;
+      let author = null;
+      if (summary.author !== null) {
+        const k = String(summary.author);
+        if (!emails.has(k)) {
+          const user = await this.db.findById({ collection: USERS, id: summary.author });
+          emails.set(k, typeof user?.email === "string" ? user.email : null);
+        }
+        author = emails.get(k) ?? null;
+      }
+      out.push({
+        id: summary.id,
+        author,
+        createdAt: summary.createdAt,
+        name: String(version.data.name ?? ""),
+        permissions: version.data.permissions ?? {}
+      });
+    }
+    return out;
+  }
+  // -------------------------------------------------------------------------
+  /** Pages and panels roles can be given. */
+  views() {
+    return [
+      { id: "status" },
+      ...this.config.collections.some(
+        (c) => c.slug === WEBHOOK_DELIVERIES || c.slug === EMAIL_DELIVERIES
+      ) ? [{ id: "deliveries" }] : [],
+      ...this.config.admin.pages.map((page) => ({ id: viewId.page(page.path), label: page.label })),
+      ...this.config.admin.dashboard.map((widget) => ({
+        id: viewId.widget(tagOf(widget.component)),
+        ...widget.label !== void 0 ? { label: widget.label } : {}
+      }))
+    ];
+  }
+  /** Every collection and global, and the plugin pages and panels: what roles had before roles. */
+  everything() {
+    const collections = {};
+    for (const c of this.config.collections) {
+      if (governed(c.slug))
+        collections[c.slug] = ROLE_OPERATIONS.filter((op) => op !== "publish" || c.drafts === true);
+    }
+    const globals = {};
+    for (const g of this.config.globals)
+      globals[g.slug] = GLOBAL_OPERATIONS.filter((op) => op !== "publish" || g.drafts === true);
+    const admin = this.views().map((v) => v.id).filter((id) => id.startsWith("page:") || id.startsWith("widget:"));
+    return { collections, globals, admin };
+  }
+  /** Keeps only known collections, globals, operations and pages; `read` comes with the others. */
+  clean(value) {
+    const input = typeof value === "object" && value !== null ? value : {};
+    const pick = (group, allowed2) => {
+      const out = {};
+      if (typeof group !== "object" || group === null) return out;
+      for (const [slug2, ops] of Object.entries(group)) {
+        const valid = allowed2.get(slug2);
+        if (!valid || !Array.isArray(ops)) continue;
+        const picked2 = valid.filter((op) => ops.includes(op));
+        if (picked2.length > 0 && !picked2.includes("read")) picked2.unshift("read");
+        out[slug2] = picked2;
+      }
+      return out;
+    };
+    const collections = new Map(
+      this.config.collections.filter((c) => governed(c.slug)).map((c) => [
+        c.slug,
+        ROLE_OPERATIONS.filter((op) => op !== "publish" || c.drafts === true)
+      ])
+    );
+    const globals = new Map(
+      this.config.globals.map((g) => [
+        g.slug,
+        GLOBAL_OPERATIONS.filter((op) => op !== "publish" || g.drafts === true)
+      ])
+    );
+    const views = new Set(this.views().map((v) => v.id));
+    const admin = Array.isArray(input.admin) ? [
+      ...new Set(
+        input.admin.filter((id) => typeof id === "string" && views.has(id))
+      )
+    ] : [];
+    const picked = {
+      collections: pick(input.collections, collections),
+      globals: pick(input.globals, globals)
+    };
+    const own = {};
+    if (typeof input.own === "object" && input.own !== null) {
+      for (const [slug2, ops] of Object.entries(input.own)) {
+        const granted = picked.collections[slug2];
+        if (!granted || !this.ownerOf(slug2) || !Array.isArray(ops)) continue;
+        const valid = OWN_OPERATIONS.filter((op) => granted.includes(op) && ops.includes(op));
+        if (valid.length > 0) own[slug2] = valid;
+      }
+    }
+    const fields = {
+      collections: this.cleanRules(
+        input.fields?.collections,
+        this.config.collections.filter((c) => governed(c.slug)),
+        picked.collections
+      ),
+      globals: this.cleanRules(
+        input.fields?.globals,
+        this.config.globals,
+        void 0
+      )
+    };
+    return { ...picked, admin, own, fields };
+  }
+  /**
+   * Keeps rules for known top-level fields. A field that must be filled in (required, without a
+   * default) can't be read-only or hidden for a role that creates documents.
+   */
+  cleanRules(value, containers, granted) {
+    const out = {};
+    if (typeof value !== "object" || value === null) return out;
+    for (const [slug2, rules] of Object.entries(value)) {
+      const container = containers.find((c) => c.slug === slug2);
+      if (!container || typeof rules !== "object" || rules === null) continue;
+      const set = {};
+      for (const field of ruleFields(container.fields)) {
+        const rule = rules[field.name];
+        if (rule !== "read" && rule !== "hidden") continue;
+        if (granted?.[slug2]?.includes("create") && mustFill(field))
+          throw new ValidationError(ROLES, [
+            {
+              field: `fields.${slug2}.${field.name}`,
+              message: "is required: roles that create documents must be able to fill it"
+            }
+          ]);
+        set[field.name] = rule;
+      }
+      if (Object.keys(set).length > 0) out[slug2] = set;
+    }
+    return out;
+  }
+  /** Fields that name a collection's owner (`createdBy`, and `admin.ownerField`). */
+  ownerColumns(slug2) {
+    if (!this.ownerOf(slug2)) return [];
+    const ownerField = this.config.collections.find((c) => c.slug === slug2)?.admin?.ownerField;
+    return ownerField ? ["createdBy", ownerField] : ["createdBy"];
+  }
+  /** Sets one field of every matching document, keeping the rest as stored. */
+  async setWhere(collection2, where, field, value) {
+    const { docs } = await this.db.find({ collection: collection2, where, sort: ["id"], limit: 0, page: 1 });
+    for (const { id, ...rest } of docs)
+      await this.db.update({ collection: collection2, id, data: { ...rest, [field]: value } });
+  }
+  cleanName(value) {
+    if (value === void 0 || value === null) return "";
+    if (typeof value !== "string" || value.trim().length > 60)
+      throw new ValidationError(ROLES, [
+        { field: "name", message: "must be at most 60 characters" }
+      ]);
+    return value.trim();
+  }
+  async permissionsOf(key2) {
+    return (await this.load()).get(key2) ?? {};
+  }
+  async load() {
+    if (this.cache && Date.now() - this.cache.at < TTL) return this.cache.byKey;
+    await this.sync();
+    const byKey = /* @__PURE__ */ new Map();
+    for (const row of await this.rows())
+      byKey.set(String(row.key), row.permissions ?? {});
+    this.cache = { at: Date.now(), byKey, rules: /* @__PURE__ */ new Map() };
+    return byKey;
+  }
+  async rows() {
+    return (await this.db.find({ collection: ROLES, sort: ["id"], limit: 0, page: 1 })).docs;
+  }
+  async row(id) {
+    const row = await this.db.findById({ collection: ROLES, id });
+    if (!row) throw new NotFoundError(ROLES, id);
+    return row;
+  }
+  users(key2) {
+    return this.db.count({ collection: USERS, where: { role: { equals: key2 } } });
+  }
+  async insert(key2, name, permissions, author) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const row = await this.db.create({
+      collection: ROLES,
+      data: { key: key2, name, permissions, createdAt: now, updatedAt: now }
+    });
+    await this.record(row, author);
+    this.invalidate();
+    return row;
+  }
+  /** Keeps the role as saved, for its history. */
+  async record(row, author) {
+    await this.versions.save({
+      parent: ROLES,
+      doc: row.id,
+      status: null,
+      snapshot: { name: row.name ?? "", permissions: row.permissions ?? {} },
+      author,
+      max: HISTORY
+    });
+  }
+  toRole(row, users) {
+    const key2 = String(row.key);
+    return {
+      id: row.id,
+      key: key2,
+      name: typeof row.name === "string" ? row.name : "",
+      system: this.config.auth.roles.includes(key2),
+      users,
+      permissions: row.permissions ?? {},
+      updatedAt: String(row.updatedAt)
+    };
+  }
+};
+function mustFill(field) {
+  return field.required === true && field.defaultValue === void 0;
+}
+function adminFields(fields, ownerField) {
+  return ruleFields(fields).map((f) => ({
+    name: f.name,
+    ...f.label !== void 0 ? { label: f.label } : {},
+    required: mustFill(f),
+    ...f.name === ownerField ? { owner: true } : {}
+  }));
+}
+function rank(role, config) {
+  const index = config.auth.roles.indexOf(role.key);
+  return index === -1 ? config.auth.roles.length : index;
+}
+
 // src/webhooks.ts
 import { createHmac as createHmac2, randomUUID as randomUUID2 } from "crypto";
 var WEBHOOK_EVENTS = [
@@ -2359,6 +3067,7 @@ var RESERVED_SLUGS = /* @__PURE__ */ new Set([
   "webhook-deliveries",
   "email-deliveries",
   "database-backups",
+  "user-roles",
   "api-keys",
   "jobs",
   "migrations",
@@ -2415,7 +3124,10 @@ function validateConfig(config) {
   if (apiKeys !== void 0 && typeof apiKeys !== "boolean") add("apiKeys", "must be true or false");
   collections.forEach((collection2, i) => {
     const path = `collections.${collection2.slug ?? `[${i}]`}`;
-    validateContainer(collection2, path, collectionSlugs, add);
+    validateContainer(collection2, path, collectionSlugs, add, {
+      collection: true,
+      rbac: config.auth?.rbac === true
+    });
     validateUseAsTitle(collection2, path, add);
     validateIcon(collection2, path, add);
     const editIn = collection2.editIn;
@@ -2424,7 +3136,10 @@ function validateConfig(config) {
   });
   globals.forEach((global2, i) => {
     const path = `globals.${global2.slug ?? `[${i}]`}`;
-    validateContainer(global2, path, collectionSlugs, add);
+    validateContainer(global2, path, collectionSlugs, add, {
+      collection: false,
+      rbac: config.auth?.rbac === true
+    });
     validateIcon(global2, path, add);
   });
   const plugins = config.plugins;
@@ -2563,6 +3278,7 @@ function validateAdminViews(config, add) {
         "e.g. dashboard: [{ component: 'ecms-stats-widget' }]"
       );
     } else {
+      const tags = /* @__PURE__ */ new Set();
       widgets2.forEach((widget, i) => {
         const path = `admin.dashboard[${i}]`;
         if (typeof widget !== "object" || widget === null) {
@@ -2573,6 +3289,19 @@ function validateAdminViews(config, add) {
         validateComponent(w.component, `${path}.component`, add);
         if (w.width !== void 0 && w.width !== "half" && w.width !== "full")
           add(`${path}.width`, 'must be "half" or "full"');
+        if (w.label !== void 0 && !(typeof w.label === "string" && w.label.trim() !== "") && !(typeof w.label === "object" && w.label !== null && !Array.isArray(w.label)))
+          add(`${path}.label`, "must be a string or { en, th }");
+        const component = w.component;
+        const tag = typeof component === "string" ? component : component?.tag;
+        if (config.auth?.rbac === true && typeof tag === "string") {
+          if (tags.has(tag))
+            add(
+              `${path}.component`,
+              `another panel uses "${tag}"`,
+              "with auth.rbac, roles are given panels by their tag: use one tag per panel"
+            );
+          tags.add(tag);
+        }
         access(w.access, path);
       });
     }
@@ -2586,6 +3315,8 @@ function validateIcon(container, path, add) {
 function validateAuth(config, add) {
   const auth = config.auth;
   if (auth === void 0) return;
+  if (auth.rbac !== void 0 && typeof auth.rbac !== "boolean")
+    add("auth.rbac", "must be true or false");
   if (auth.roles !== void 0) {
     const roles = auth.roles;
     if (!Array.isArray(roles) || roles.some((r) => typeof r !== "string" || r === "")) {
@@ -2852,7 +3583,7 @@ function checkSlug(container, path, seen, add) {
   seen.add(slug2);
   return slug2;
 }
-function validateContainer(container, path, collectionSlugs, add) {
+function validateContainer(container, path, collectionSlugs, add, { collection: collection2, rbac }) {
   if (!Array.isArray(container.fields)) {
     add(`${path}.fields`, "must be an array");
     return;
@@ -2889,8 +3620,25 @@ function validateContainer(container, path, collectionSlugs, add) {
         add(`${path}.admin.group`, `must be 'settings' (got ${JSON.stringify(group)})`);
       const list = admin.list;
       if (list !== void 0) validateList(list, container, `${path}.admin.list`, add);
+      const owner = admin.ownerField;
+      if (owner !== void 0) {
+        const field = container.fields.find((f) => f.name === owner);
+        if (!collection2 || container.slug === "users" || field?.type !== "relationship" || field.to !== "users" || field.hasMany)
+          add(
+            `${path}.admin.ownerField`,
+            'must name a relationship field to "users" (not hasMany) of a collection',
+            "e.g. { name: 'author', type: 'relationship', to: 'users' }"
+          );
+      }
     }
   }
+  const createdBy = container.fields.find((f) => f.name === CREATED_BY_FIELD.name);
+  if (rbac && createdBy && createdBy !== CREATED_BY_FIELD)
+    add(
+      `${path}.fields.createdBy`,
+      '"createdBy" is added by Easy CMS with auth.rbac',
+      "rename the field; to use it as the owner, set admin.ownerField"
+    );
   const reserved = new Set(SYSTEM_FIELD_NAMES);
   if (container.drafts) reserved.add("status");
   validateFields2(container.fields, `${path}.fields`, reserved, collectionSlugs, add);
@@ -3244,7 +3992,7 @@ async function resolveConfig(input) {
   if (resolved.has(input)) return input;
   let config = await applyPlugins(input);
   if (typeof config === "object" && config !== null && Array.isArray(config.collections ?? [])) {
-    config = withMedia(withUsers(config));
+    config = withCreatedBy(withMedia(withUsers(config)));
   }
   const applied = applyFieldTypes(config);
   config = applied.config;
@@ -3280,6 +4028,7 @@ async function resolveConfig(input) {
     },
     auth: {
       roles: config.auth?.roles ?? DEFAULT_ROLES,
+      rbac: config.auth?.rbac === true,
       tokenExpiration: config.auth?.tokenExpiration ?? DEFAULT_TOKEN_EXPIRATION,
       maxLoginAttempts: config.auth?.maxLoginAttempts ?? 5,
       lockWindow: config.auth?.lockWindow ?? 15 * 60,
@@ -3291,12 +4040,14 @@ async function resolveConfig(input) {
     collections: [
       ...config.collections ?? [],
       ...internalCollections,
-      ...usesVersions(config) ? [versionsCollection] : [],
+      // Roles keep their history as versions.
+      ...usesVersions(config) || config.auth?.rbac ? [versionsCollection] : [],
       ...usesSchedule(config) ? [scheduledJobsCollection] : [],
       ...(config.webhooks?.length ?? 0) > 0 ? [webhookDeliveriesCollection] : [],
       ...config.apiKeys ? [apiKeysCollection] : [],
       ...config.email ? [emailDeliveriesCollection] : [],
-      databaseBackupsCollection
+      databaseBackupsCollection,
+      ...config.auth?.rbac ? [rolesCollection] : []
     ],
     globals: config.globals ?? [],
     endpoints: config.endpoints ?? [],
@@ -3841,137 +4592,6 @@ function read(response, maxBytes, deadline) {
   });
 }
 
-// src/versions.ts
-var DEFAULT_MAX_VERSIONS = 50;
-function versionLimit(config) {
-  const versions = config.versions;
-  if (!versions) return void 0;
-  return versions === true ? DEFAULT_MAX_VERSIONS : versions.max ?? DEFAULT_MAX_VERSIONS;
-}
-var collectionParent = (slug2) => slug2;
-var globalParent = (slug2) => `global:${slug2}`;
-function snapshotOf(fields, doc) {
-  const hidden = new Set(fields.filter((f) => f.hidden).map((f) => f.name));
-  const snapshot = {};
-  for (const [key2, value] of Object.entries(doc)) {
-    if (key2 === "id" || key2 === "createdAt" || key2 === "updatedAt" || hidden.has(key2)) continue;
-    snapshot[key2] = value;
-  }
-  return snapshot;
-}
-var toSummary = (row) => ({
-  id: row.id,
-  status: row.status ?? null,
-  latest: row.latest === true,
-  author: row.author ?? null,
-  createdAt: String(row.createdAt)
-});
-var VersionStore = class {
-  constructor(db) {
-    this.db = db;
-  }
-  db;
-  /** Saves a new latest version and deletes the oldest beyond `max`. */
-  async save(args) {
-    const { parent, doc } = args;
-    const previous = await this.db.find({
-      collection: VERSIONS,
-      where: { and: [...this.of(parent, doc), { latest: { equals: true } }] },
-      sort: [],
-      limit: 0,
-      page: 1
-    });
-    for (const row of previous.docs) {
-      await this.db.update({ collection: VERSIONS, id: row.id, data: { ...row, latest: false } });
-    }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const created = await this.db.create({
-      collection: VERSIONS,
-      data: {
-        parent,
-        doc,
-        status: args.status,
-        latest: true,
-        author: args.author,
-        snapshot: args.snapshot,
-        createdAt: now,
-        updatedAt: now
-      }
-    });
-    await this.prune(parent, doc, args.max);
-    return toSummary(created);
-  }
-  /** The latest version of each document, keyed by document id. */
-  async latest(parent, docs) {
-    const result = /* @__PURE__ */ new Map();
-    if (docs.length === 0) return result;
-    const rows = await this.db.find({
-      collection: VERSIONS,
-      where: {
-        and: [
-          { parent: { equals: parent } },
-          { doc: { in: [...docs] } },
-          { latest: { equals: true } }
-        ]
-      },
-      sort: [],
-      limit: 0,
-      page: 1
-    });
-    for (const row of rows.docs) result.set(String(row.doc), this.toVersion(row));
-    return result;
-  }
-  async list(parent, doc, limit, page) {
-    const found = await this.db.find({
-      collection: VERSIONS,
-      where: { and: this.of(parent, doc) },
-      sort: ["-id"],
-      limit,
-      page
-    });
-    return { ...found, docs: found.docs.map(toSummary) };
-  }
-  async get(parent, doc, id) {
-    const found = await this.db.find({
-      collection: VERSIONS,
-      where: { and: [...this.of(parent, doc), { id: { equals: id } }] },
-      sort: [],
-      limit: 1,
-      page: 1
-    });
-    const row = found.docs[0];
-    return row ? this.toVersion(row) : null;
-  }
-  async deleteAll(parent, doc) {
-    const rows = await this.db.find({
-      collection: VERSIONS,
-      where: { and: this.of(parent, doc) },
-      sort: [],
-      limit: 0,
-      page: 1
-    });
-    for (const row of rows.docs) await this.db.delete({ collection: VERSIONS, id: row.id });
-  }
-  async prune(parent, doc, max) {
-    const rows = await this.db.find({
-      collection: VERSIONS,
-      where: { and: this.of(parent, doc) },
-      sort: ["-id"],
-      limit: 0,
-      page: 1
-    });
-    for (const row of rows.docs.slice(max)) {
-      await this.db.delete({ collection: VERSIONS, id: row.id });
-    }
-  }
-  of(parent, doc) {
-    return [{ parent: { equals: parent } }, { doc: { equals: doc } }];
-  }
-  toVersion(row) {
-    return { ...toSummary(row), data: row.snapshot ?? {} };
-  }
-};
-
 // src/local-api.ts
 async function createEasyCMS(config, options = {}) {
   const resolved3 = await resolveConfig(config);
@@ -4009,6 +4629,8 @@ var EasyCMS = class {
   storage;
   /** Project root: relative paths in the config (e.g. `admin.modules`) start here. */
   cwd;
+  /** Roles and their permissions (`auth.rbac`, Settings → Roles). */
+  roles;
   versions;
   webhooks;
   mailer;
@@ -4019,6 +4641,7 @@ var EasyCMS = class {
     this.storage = storage;
     this.cwd = cwd;
     this.versions = new VersionStore(db);
+    this.roles = new Roles(config, db, (message2) => logger.info(message2));
     this.webhooks = new Webhooks(
       config.webhooks ?? [],
       logger,
@@ -4045,6 +4668,7 @@ var EasyCMS = class {
       options
     );
     const requested = options.sort === void 0 ? ["-createdAt"] : [options.sort].flat();
+    await this.checkQueryFields(config, guard, void 0, requested);
     const locale = this.localeOf(options);
     const sort = locale === void 0 ? requested : localizeSort(
       config.fields,
@@ -4109,7 +4733,7 @@ var EasyCMS = class {
     const config = this.collection(MEDIA);
     const guard = guardOf(options);
     if (guard.enforce) {
-      this.checkKey(guard, { collection: MEDIA }, "create");
+      await this.checkGrant(guard, { collection: MEDIA }, "create");
       const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data });
       if (allowed2 !== true) throw deny(guard.user);
     }
@@ -4169,7 +4793,7 @@ var EasyCMS = class {
     const guard = guardOf(options);
     const fromURL = this.config.upload.fromURL;
     if (guard.enforce) {
-      this.checkKey(guard, { collection: MEDIA }, "create");
+      await this.checkGrant(guard, { collection: MEDIA }, "create");
       const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data });
       if (allowed2 !== true) throw deny(guard.user);
       if (!fromURL)
@@ -4324,7 +4948,7 @@ var EasyCMS = class {
     let parsed;
     if (id === null) {
       if (guard.enforce) {
-        this.checkKey(guard, { collection: collection2 }, "create");
+        await this.checkGrant(guard, { collection: collection2 }, "create");
         const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data: raw });
         if (allowed2 !== true) throw deny(guard.user);
       }
@@ -4339,7 +4963,7 @@ var EasyCMS = class {
     const filtered = await filterInput(
       config.fields,
       input,
-      this.fieldChecker("update", guard, parsed, input)
+      await this.fieldChecker("update", guard, parsed, input)
     );
     const localized = this.toMaps(config, filtered, base ?? {}, options);
     const merged = base ? mergeForUpdate(config.fields, base, localized) : applyDefaults(config.fields, localized, this.config.localization);
@@ -4379,7 +5003,7 @@ var EasyCMS = class {
     const input = await filterInput(
       config.fields,
       raw,
-      this.fieldChecker("update", guard, void 0, raw)
+      await this.fieldChecker("update", guard, void 0, raw)
     );
     const saved = await this.db.findGlobal({ slug: slug2 }) ?? {};
     const current = await this.globalDraft(config, saved);
@@ -4444,7 +5068,7 @@ var EasyCMS = class {
     if (!existing || parsed === void 0) throw new NotFoundError(collection2, id);
     await this.checkDocumentAccess(config, "update", guard, parsed, raw);
     if (config.drafts && (mode === "unpublish" || raw.status === "published"))
-      this.checkKey(guard, { collection: collection2 }, "publish");
+      await this.checkDocumentGrant(guard, collection2, "publish", parsed);
     const [drafted] = await this.withDrafts(config, [existing]);
     const live = options.live === true && mode === "save";
     const current = live ? existing : drafted;
@@ -4456,7 +5080,7 @@ var EasyCMS = class {
     const filtered = await filterInput(
       config.fields,
       input,
-      this.fieldChecker("update", guard, parsed, input)
+      await this.fieldChecker("update", guard, parsed, input)
     );
     const localized = mode === "restore" ? filtered : this.toMaps(config, filtered, current, options);
     let merged = mergeForUpdate(config.fields, current, localized);
@@ -4524,6 +5148,10 @@ var EasyCMS = class {
     const [out] = await this.output(config, [doc], guard, { ...options, draft: true });
     return out;
   }
+  /**
+   * Deletes a document. Deleting a user with roles from the admin (`auth.rbac`): `transferTo`
+   * gives the documents they own to another user; without it they have no owner.
+   */
   async delete(collection2, id, options = {}) {
     const config = this.collection(collection2);
     const guard = guardOf(options);
@@ -4535,7 +5163,19 @@ var EasyCMS = class {
       await this.guardLastAdmin(parsed, existing, { ...existing, active: false });
     const base = this.hookArgs(config, guard);
     for (const hook of config.hooks?.beforeDelete ?? []) await hook({ ...base, id: parsed });
-    if (config.slug === USERS) await this.auth.revokeSessions(parsed);
+    if (config.slug === USERS) {
+      const to = options.transferTo;
+      if (to !== void 0 && to !== null) {
+        const target = parseId(to);
+        const heir = target === void 0 ? null : await this.db.findById({ collection: USERS, id: target });
+        if (!heir || String(heir.id) === String(parsed))
+          throw new ValidationError(USERS, [
+            { field: "transferTo", message: "must be another existing user" }
+          ]);
+        await this.roles.transfer(parsed, heir.id);
+      } else await this.roles.transfer(parsed, null);
+      await this.auth.revokeSessions(parsed);
+    }
     await this.db.delete({ collection: collection2, id: parsed });
     if (versionLimit(config)) await this.versions.deleteAll(collectionParent(collection2), parsed);
     if (config.schedule) {
@@ -4639,11 +5279,11 @@ var EasyCMS = class {
     const guard = guardOf(options);
     await this.checkGlobalAccess(config, "update", guard);
     if (config.drafts && (mode === "unpublish" || raw.status === "published"))
-      this.checkKey(guard, { global: slug2 }, "publish");
+      await this.checkGrant(guard, { global: slug2 }, "publish");
     const input = await filterInput(
       config.fields,
       raw,
-      this.fieldChecker("update", guard, void 0, raw)
+      await this.fieldChecker("update", guard, void 0, raw)
     );
     const existing = await this.db.findGlobal({ slug: slug2 }) ?? {};
     const current = await this.globalDraft(config, existing);
@@ -4928,14 +5568,14 @@ var EasyCMS = class {
     const existing = parsed === void 0 ? null : await this.db.findById({ collection: collection2, id: parsed });
     if (!existing || parsed === void 0) throw new NotFoundError(collection2, id);
     await this.checkDocumentAccess(config, "update", guardOf(options), parsed, void 0);
-    this.checkKey(guardOf(options), { collection: collection2 }, "publish");
+    await this.checkDocumentGrant(guardOf(options), collection2, "publish", parsed);
     return { config, parsed };
   }
   async globalScheduleTarget(slug2, options) {
     const config = this.global(slug2);
     if (!config.schedule) throw new QueryError(`"${slug2}" has no schedule`);
     await this.checkGlobalAccess(config, "update", guardOf(options));
-    this.checkKey(guardOf(options), { global: slug2 }, "publish");
+    await this.checkGrant(guardOf(options), { global: slug2 }, "publish");
   }
   async addJob(parent, doc, job, options) {
     const runAt = new Date(job.at);
@@ -4981,20 +5621,21 @@ var EasyCMS = class {
       page: 1
     });
     const allowed2 = /* @__PURE__ */ new Map();
-    const may = async (parent) => {
+    const may2 = async (parent) => {
       if (!guard.enforce) return true;
       const cached = allowed2.get(parent);
       if (cached !== void 0) return cached;
       const config = parent.startsWith("global:") ? this.config.globals.find((g) => g.slug === parent.slice("global:".length)) : this.config.collections.find((c) => c.slug === parent);
       const access = config ? await evaluateAccess(config.access?.update, { user: guard.user }) : false;
-      const result = access !== false;
+      const target = parent.startsWith("global:") ? { global: parent.slice("global:".length) } : { collection: parent };
+      const result = access !== false && await this.roles.allows(guard.user, target, "update") !== false;
       allowed2.set(parent, result);
       return result;
     };
     const jobs = [];
     for (const row of rows.docs) {
       const parent = String(row.parent);
-      if (!await may(parent)) continue;
+      if (!await may2(parent)) continue;
       const target = parent.startsWith("global:") ? { global: parent.slice("global:".length) } : { collection: parent };
       jobs.push({ ...toJob(row), ...target, doc: row.doc });
       if (jobs.length === limit) break;
@@ -5079,28 +5720,37 @@ var EasyCMS = class {
     if (!config) throw new QueryError(`Unknown global "${slug2}"`);
     return config;
   }
-  /** Refuses what a request's API key does not allow (see `ApiKeyPermissions`). */
-  checkKey(guard, target, operation) {
-    if (!guard.enforce || keyAllows(guard.user, target, operation)) return;
+  /**
+   * Refuses what a request's API key (see `ApiKeyPermissions`) or the user's role (`auth.rbac`)
+   * does not allow. Returns a constraint when the role allows only the user's own account.
+   */
+  async checkGrant(guard, target, operation) {
+    if (!guard.enforce) return true;
     const name = "collection" in target ? target.collection : target.global;
-    throw new ForbiddenError(`This API key may not ${operation} "${name}"`);
+    if (!keyAllows(guard.user, target, operation))
+      throw new ForbiddenError(`This API key may not ${operation} "${name}"`);
+    const role = await this.roles.allows(guard.user, target, operation);
+    if (role === false) throw deny(guard.user);
+    return role;
   }
   /** The query constraint read access adds, or `undefined` when there is none. Throws when denied. */
   async readWhere(config, guard, where) {
     if (!guard.enforce) return where;
-    this.checkKey(guard, { collection: config.slug }, "read");
+    const own = await this.checkGrant(guard, { collection: config.slug }, "read");
     const access = await evaluateAccess(config.access?.read, { user: guard.user });
     if (access === false) throw deny(guard.user);
-    return andWhere(where, access);
+    await this.checkQueryFields(config, guard, where);
+    return andWhere(andWhere(where, access), own);
   }
   async checkDocumentAccess(config, operation, guard, id, data) {
     if (!guard.enforce) return;
-    this.checkKey(guard, { collection: config.slug }, operation);
-    const access = await evaluateAccess(config.access?.[operation], {
+    const own = await this.checkGrant(guard, { collection: config.slug }, operation);
+    const allowed2 = await evaluateAccess(config.access?.[operation], {
       user: guard.user,
       id,
       ...data ? { data } : {}
     });
+    const access = allowed2 === false ? false : andWhere(own === true ? void 0 : own, allowed2) ?? true;
     if (access === true) return;
     if (access !== false) {
       const matches2 = await this.db.count({
@@ -5113,23 +5763,58 @@ var EasyCMS = class {
   }
   async checkGlobalAccess(config, operation, guard) {
     if (!guard.enforce) return;
-    this.checkKey(guard, { global: config.slug }, operation);
+    await this.checkGrant(guard, { global: config.slug }, operation);
     const access = await evaluateAccess(config.access?.[operation], { user: guard.user });
     if (typeof access === "object")
       throw new QueryError(`${operation} access of global "${config.slug}" must return a boolean`);
     if (!access) throw deny(guard.user);
   }
-  fieldChecker(kind, guard, id, data) {
+  async fieldChecker(kind, guard, id, data) {
     if (!guard.enforce) return void 0;
-    return new FieldAccessChecker(kind, {
-      user: guard.user,
-      ...id !== void 0 ? { id } : {},
-      ...data ? { data } : {}
+    return new FieldAccessChecker(
+      kind,
+      {
+        user: guard.user,
+        ...id !== void 0 ? { id } : {},
+        ...data ? { data } : {}
+      },
+      await this.roles.fieldRules(guard.user)
+    );
+  }
+  /**
+   * Refuses filtering or sorting by fields the caller may not read: the results would tell
+   * their values. Checks each field along a dotted path, through groups, arrays and blocks.
+   */
+  async checkQueryFields(config, guard, where, sort = []) {
+    if (!guard.enforce) return;
+    const paths = [...wherePaths(where), ...sort.map((s) => s.replace(/^-/, ""))];
+    if (paths.length === 0) return;
+    const read2 = await this.fieldChecker("read", guard, void 0, void 0);
+    for (const path of paths) {
+      let fields = config.fields;
+      for (const name of path.split(".")) {
+        if (!fields) break;
+        const field = fields.find((f) => f.name === name);
+        if (!field) break;
+        if (field.hidden || read2 && !await read2.allows(field))
+          throw new ForbiddenError(`You may not filter or sort by "${path}"`);
+        fields = field.type === "group" || field.type === "array" ? field.fields : field.type === "blocks" ? field.blocks.flatMap((b) => b.fields) : void 0;
+      }
+    }
+  }
+  /** `checkGrant` for one document: a role limited to its own documents must own it. */
+  async checkDocumentGrant(guard, collection2, operation, id) {
+    const own = await this.checkGrant(guard, { collection: collection2 }, operation);
+    if (own === true) return;
+    const matches2 = await this.db.count({
+      collection: collection2,
+      where: andWhere(own, { id: { equals: id } })
     });
+    if (matches2 === 0) throw deny(guard.user);
   }
   /** Runs afterRead hooks, populates relationships and removes what the caller may not see. */
   async output(config, docs, guard, options) {
-    const read2 = this.fieldChecker("read", guard, void 0, void 0);
+    const read2 = await this.fieldChecker("read", guard, void 0, void 0);
     const finish = async (target, doc) => {
       const hooked = await this.transform(
         target.hooks?.afterRead,
@@ -5167,9 +5852,9 @@ var EasyCMS = class {
     const guard = guardOf(options);
     const collection2 = config.slug;
     if (guard.enforce) {
-      this.checkKey(guard, { collection: collection2 }, "create");
+      await this.checkGrant(guard, { collection: collection2 }, "create");
       if (config.drafts && raw.status === "published")
-        this.checkKey(guard, { collection: collection2 }, "publish");
+        await this.checkGrant(guard, { collection: collection2 }, "publish");
       const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data: raw });
       if (typeof allowed2 === "object")
         throw new QueryError(`create access of "${collection2}" must return a boolean`);
@@ -5179,8 +5864,9 @@ var EasyCMS = class {
     const filtered = await filterInput(
       config.fields,
       input,
-      this.fieldChecker("update", guard, void 0, input)
+      await this.fieldChecker("update", guard, void 0, input)
     );
+    this.roles.fillOwner(collection2, filtered, guard.user ?? hookGuard?.user ?? null);
     const base = this.hookArgs(config, hookGuard ?? guard);
     let data = applyDefaults(
       config.fields,
@@ -5388,6 +6074,8 @@ var EasyCMS = class {
       }
       clean2.status = status;
     }
+    if (config.slug === USERS && this.roles.enabled && typeof clean2.role === "string" && !await this.roles.exists(clean2.role))
+      errors.push({ field: "role", message: `there is no role "${clean2.role}"` });
     const isCollection = this.config.collections.includes(config);
     if (isCollection && errors.length === 0) {
       await this.makeSlugsUnique(config, clean2, selfId);
@@ -5474,11 +6162,11 @@ var EasyCMS = class {
     return await this.db.count({ collection: collection2, where }) > 0;
   }
   /** Each reference is one its relationship's `filterOptions` allow. */
-  async checkFilterOptions(references, selfId, user) {
+  async checkFilterOptions(references2, selfId, user) {
     const errors = [];
     const cms = this;
     const allowed2 = /* @__PURE__ */ new Map();
-    for (const ref of references) {
+    for (const ref of references2) {
       const filter = ref.filterOptions;
       if (!filter) continue;
       if (!allowed2.has(filter)) allowed2.set(filter, await filter({ id: selfId, user, cms }));
@@ -5496,9 +6184,9 @@ var EasyCMS = class {
     }
     return errors;
   }
-  async checkReferences(references) {
+  async checkReferences(references2) {
     const byCollection = /* @__PURE__ */ new Map();
-    for (const ref of references) {
+    for (const ref of references2) {
       if (!this.config.collections.some((c) => c.slug === ref.collection)) continue;
       byCollection.set(ref.collection, [...byCollection.get(ref.collection) ?? [], ref]);
     }
@@ -5549,6 +6237,16 @@ function loadSharp() {
   );
   return sharpModule;
 }
+function wherePaths(where) {
+  if (!where) return [];
+  const out = [];
+  for (const [key2, value] of Object.entries(where)) {
+    if (key2 === "and" || key2 === "or") {
+      for (const sub of value ?? []) out.push(...wherePaths(sub));
+    } else out.push(key2);
+  }
+  return out;
+}
 function guardOf(options) {
   return { enforce: options.overrideAccess === false, user: options.user ?? null };
 }
@@ -5820,10 +6518,11 @@ function componentRef(component) {
 async function allowed(access, user) {
   return await evaluateAccess(access, { user }) !== false;
 }
-async function serializeFields(fields, update2, localized) {
+async function serializeFields(fields, checks, localized) {
+  const { update: update2 } = checks;
   const out = [];
   for (const field of fields) {
-    if (field.hidden) continue;
+    if (field.hidden || !await checks.read.allows(field)) continue;
     const f = { name: field.name, type: field.type };
     if (field.label !== void 0) f.label = field.label;
     if (field.required) f.required = true;
@@ -5876,7 +6575,7 @@ async function serializeFields(fields, update2, localized) {
       case "array":
         if (field.minRows !== void 0) f.minRows = field.minRows;
         if (field.maxRows !== void 0) f.maxRows = field.maxRows;
-        f.fields = await serializeFields(field.fields, update2, localized);
+        f.fields = await serializeFields(field.fields, checks, localized);
         break;
       case "blocks":
         if (field.minRows !== void 0) f.minRows = field.minRows;
@@ -5885,35 +6584,51 @@ async function serializeFields(fields, update2, localized) {
           field.blocks.map(async (block) => ({
             slug: block.slug,
             ...block.labels ? { labels: block.labels } : {},
-            fields: await serializeFields(block.fields, update2, localized)
+            fields: await serializeFields(block.fields, checks, localized)
           }))
         );
         break;
       case "group":
-        f.fields = await serializeFields(field.fields, update2, localized);
+        f.fields = await serializeFields(field.fields, checks, localized);
         break;
     }
     out.push(f);
   }
   return out;
 }
-async function collection(config, user, localized) {
+async function checkers(cms, user) {
+  const rules = await cms.roles.fieldRules(user);
+  return {
+    update: new FieldAccessChecker("update", { user }, rules),
+    read: new FieldAccessChecker("read", { user }, rules)
+  };
+}
+async function may(cms, access, user, target, operation) {
+  return await allowed(access, user) && await cms.roles.allows(user, target, operation) !== false;
+}
+async function collection(cms, config, user, localized, roles) {
+  const target = { collection: config.slug };
+  const fields = await serializeFields(config.fields, await checkers(cms, user), localized);
+  if (config.slug === USERS && cms.roles.enabled) {
+    const role = fields.find((f) => f.name === "role");
+    if (role) {
+      role.type = "select";
+      role.options = roles.map((r) => ({ label: r.name || r.key, value: r.key }));
+    }
+  }
   const result = {
     slug: config.slug,
     drafts: config.drafts === true,
     versions: Boolean(config.versions),
     preview: typeof config.preview === "function",
     schedule: config.schedule === true,
-    fields: await serializeFields(
-      config.fields,
-      new FieldAccessChecker("update", { user }),
-      localized
-    ),
+    fields,
     permissions: {
-      read: await allowed(config.access?.read, user),
-      create: await allowed(config.access?.create, user),
-      update: await allowed(config.access?.update, user),
-      delete: await allowed(config.access?.delete, user)
+      read: await may(cms, config.access?.read, user, target, "read"),
+      create: await may(cms, config.access?.create, user, target, "create"),
+      update: await may(cms, config.access?.update, user, target, "update"),
+      delete: await may(cms, config.access?.delete, user, target, "delete"),
+      publish: config.drafts === true && await may(cms, config.access?.update, user, target, "publish")
     }
   };
   if (config.labels) result.labels = config.labels;
@@ -5923,25 +6638,26 @@ async function collection(config, user, localized) {
   if (config.admin?.group === "settings" || SETTINGS.has(config.slug)) result.group = "settings";
   if (config.admin?.list?.tree) result.tree = config.admin.list.tree;
   if (config.admin?.list?.sort) result.defaultSort = config.admin.list.sort;
+  const owner = cms.roles.ownerOf(config.slug);
+  if (owner && fields.some((f) => f.name === owner)) result.owner = owner;
   if (config.editIn === "drawer" && !result.drafts && !result.versions && !result.preview)
     result.editIn = "drawer";
   return result;
 }
-async function global(config, user, localized) {
+async function global(cms, config, user, localized) {
+  const target = { global: config.slug };
+  const checks = await checkers(cms, user);
   const result = {
     slug: config.slug,
     drafts: config.drafts === true,
     versions: Boolean(config.versions),
     preview: typeof config.preview === "function",
     schedule: config.schedule === true,
-    fields: await serializeFields(
-      config.fields,
-      new FieldAccessChecker("update", { user }),
-      localized
-    ),
+    fields: await serializeFields(config.fields, checks, localized),
     permissions: {
-      read: await allowed(config.access?.read, user),
-      update: await allowed(config.access?.update, user)
+      read: await may(cms, config.access?.read, user, target, "read"),
+      update: await may(cms, config.access?.update, user, target, "update"),
+      publish: config.drafts === true && await may(cms, config.access?.update, user, target, "publish")
     }
   };
   if (config.label !== void 0) result.label = config.label;
@@ -5953,16 +6669,32 @@ async function adminSchema(cms, user, origin) {
   const collections = cms.config.collections.filter((c) => !INTERNAL_COLLECTIONS.has(c.slug));
   const localization = cms.config.localization;
   const localized = localization !== null;
+  const admin = user.role === "admin" && !user.apiKey;
+  const deliveries = cms.config.collections.some(
+    (c) => c.slug === WEBHOOK_DELIVERIES || c.slug === EMAIL_DELIVERIES
+  );
+  const views = {
+    status: await cms.roles.canView(user, "status"),
+    deliveries: deliveries && await cms.roles.canView(user, "deliveries"),
+    backups: admin,
+    email: admin,
+    roles: admin && cms.roles.enabled
+  };
+  const roles = await cms.roles.options();
   return {
     locale: cms.config.admin.locale,
     passwordLinks: cms.auth.canSendPasswordLinks(origin),
     menu: [...cms.config.admin.menu],
     localization: localization ? { locales: [...localization.locales], defaultLocale: localization.defaultLocale } : null,
-    collections: await Promise.all(collections.map((c) => collection(c, user, localized))),
-    globals: await Promise.all(cms.config.globals.map((g) => global(g, user, localized))),
+    collections: await Promise.all(
+      collections.map((c) => collection(cms, c, user, localized, roles))
+    ),
+    globals: await Promise.all(cms.config.globals.map((g) => global(cms, g, user, localized))),
     modules: adminModuleUrls(cms),
     uploadFromURL: cms.config.upload.fromURL !== void 0,
-    ...user.role === "admin" && !user.apiKey ? {
+    views,
+    rbac: cms.roles.enabled,
+    ...views.deliveries ? {
       deliveries: {
         webhook: cms.config.collections.some((c) => c.slug === WEBHOOK_DELIVERIES),
         email: cms.config.collections.some((c) => c.slug === EMAIL_DELIVERIES)
@@ -5983,7 +6715,8 @@ async function shown(access, user) {
 async function pages(cms, user) {
   const out = [];
   for (const page of cms.config.admin.pages) {
-    if (!await shown(page.access, user)) continue;
+    if (!await shown(page.access, user) || !await cms.roles.canView(user, `page:${page.path}`))
+      continue;
     out.push({
       path: page.path,
       label: page.label,
@@ -5997,14 +6730,16 @@ async function pages(cms, user) {
 async function widgets(cms, user) {
   const out = [];
   for (const widget of cms.config.admin.dashboard) {
-    if (!await shown(widget.access, user)) continue;
+    const tag = typeof widget.component === "string" ? widget.component : widget.component.tag;
+    if (!await shown(widget.access, user) || !await cms.roles.canView(user, `widget:${tag}`))
+      continue;
     out.push({ component: componentRef(widget.component), width: widget.width ?? "half" });
   }
   return out;
 }
 
 // src/version.ts
-var VERSION = true ? "0.32.0" : "0.0.0-dev";
+var VERSION = true ? "0.34.0" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
 var DAY = 864e5;
@@ -6495,9 +7230,44 @@ async function route(cms, ctx, method, segments, options) {
     }
     throw new HttpError("Not found", 404);
   }
-  if (first === "admin" && second === "deliveries") {
+  if (first === "admin" && second === "owned" && third !== void 0 && segments.length === 3) {
     if (!ctx.user) throw new UnauthorizedError();
     if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+    if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+    const parsed = parseId(third);
+    if (parsed === void 0) throw new HttpError("Not found", 404);
+    return { body: await cms.roles.owned(parsed) };
+  }
+  if (first === "admin" && second === "roles") {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+    if (!cms.roles.enabled) throw new HttpError("Not found", 404);
+    const [, , id2, action, extra] = segments;
+    if (extra !== void 0) throw new HttpError("Not found", 404);
+    if (id2 === void 0) {
+      if (method === "GET") return { body: await cms.roles.list() };
+      if (method === "POST")
+        return { status: 201, body: await cms.roles.create(await readJson(ctx.request), ctx.user) };
+      throw methodNotAllowed(ctx, "GET, POST");
+    }
+    const parsed = parseId(id2);
+    if (parsed === void 0) throw new HttpError("Not found", 404);
+    if (action === "history") {
+      if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+      return { body: await cms.roles.history(parsed) };
+    }
+    if (action !== void 0) throw new HttpError("Not found", 404);
+    if (method === "PATCH")
+      return { body: await cms.roles.update(parsed, await readJson(ctx.request), ctx.user) };
+    if (method === "DELETE") {
+      await cms.roles.delete(parsed);
+      return { body: { deleted: 1 } };
+    }
+    throw methodNotAllowed(ctx, "PATCH, DELETE");
+  }
+  if (first === "admin" && second === "deliveries") {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (!await cms.roles.canView(ctx.user, "deliveries")) throw new ForbiddenError();
     const [, , kind, id2, action, extra] = segments;
     if (kind === void 0) {
       if (method !== "GET") throw methodNotAllowed(ctx, "GET");
@@ -6547,7 +7317,7 @@ async function route(cms, ctx, method, segments, options) {
       return { body: new Response(file.body, { headers }) };
     }
     if (second === "status" && third === void 0) {
-      if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+      if (!await cms.roles.canView(ctx.user, "status")) throw new ForbiddenError();
       return { body: await adminStatus(cms) };
     }
     if (second === "scheduled" && third === void 0)
@@ -6672,7 +7442,9 @@ async function route(cms, ctx, method, segments, options) {
     return { body: doc };
   }
   if (method === "DELETE") {
-    return { body: await cms.delete(collection2, id, access) };
+    const to = collection2 === USERS ? ctx.url.searchParams.get("transferTo") : null;
+    const transferTo = to === null ? {} : { transferTo: to === "none" ? null : parseId(to) ?? to };
+    return { body: await cms.delete(collection2, id, { ...access, ...transferTo }) };
   }
   throw methodNotAllowed(ctx, "GET, PATCH, DELETE");
 }
@@ -7157,6 +7929,8 @@ export {
   NotFoundError,
   PayloadTooLargeError,
   QueryError,
+  ROLE_OPERATIONS,
+  Roles,
   SESSION_COOKIE,
   SchemaError,
   TooManyRequestsError,