@easy-cms/core 0.33.0 → 0.34.0

package/dist/index.d.ts

@@ -744,6 +744,9 @@ type GlobalInput<C extends Config, S extends GlobalSlug<C>> = Partial<Simplify<F
 /** What a role may do with a collection or global, ticked in Settings → Roles. */
 declare const ROLE_OPERATIONS: readonly ["read", "create", "update", "delete", "publish"];
 type RoleOperation = (typeof ROLE_OPERATIONS)[number];
+/** A field a role may only read, or not see at all; fields not listed follow the collection. */
+type FieldRule = 'read' | 'hidden';
+type FieldRules = Readonly<Record<string, Readonly<Record<string, FieldRule>>>>;
 /**
  * Stored in a role's `permissions`. Anything not listed is not allowed. A slug listed with no
  * operations has been looked at and given nothing (it is not "new" in Settings → Roles).
@@ -753,6 +756,13 @@ interface RolePermissions {
     readonly globals?: Readonly<Record<string, readonly RoleOperation[]>>;
     /** Admin pages: `status`, `deliveries`, `page:<path>` (`admin.pages`), `widget:<tag>` (`admin.dashboard`). */
     readonly admin?: readonly string[];
+    /** Operations of `collections` allowed only on the role's own documents (see `admin.ownerField`). */
+    readonly own?: Readonly<Record<string, readonly RoleOperation[]>>;
+    /** Top-level fields the role may only read or not see, by collection or global slug. */
+    readonly fields?: {
+        readonly collections?: FieldRules;
+        readonly globals?: FieldRules;
+    };
 }
 /** One role as Settings → Roles shows it (`GET <api>/admin/roles`). */
 interface AdminRole {
@@ -767,6 +777,15 @@ interface AdminRole {
     permissions: RolePermissions;
     updatedAt: string;
 }
+/** A top-level field whose permission can be set per role. */
+interface AdminRoleField {
+    name: string;
+    label?: Label;
+    /** Required without a default value: roles that create documents must be able to fill it. */
+    required: boolean;
+    /** The collection's owner field (`admin.ownerField`). */
+    owner?: boolean;
+}
 /** A row of the permissions table. */
 interface AdminRoleTarget {
     slug: string;
@@ -774,6 +793,7 @@ interface AdminRoleTarget {
     ops: RoleOperation[];
     /** No role has been given anything here yet (added to the config since). */
     new: boolean;
+    fields: AdminRoleField[];
 }
 /** A page or dashboard panel that can be given to roles. */
 interface AdminRoleView {
@@ -787,6 +807,8 @@ interface AdminRoles {
     collections: (AdminRoleTarget & {
         /** Collections its relationship and upload fields point to. */
         references: string[];
+        /** Can be limited to own documents: the field that names the owner (`createdBy` by default). */
+        owner?: string;
     })[];
     globals: AdminRoleTarget[];
     views: AdminRoleView[];
@@ -808,11 +830,12 @@ interface AdminRoleChange {
 declare class Roles {
     private readonly config;
     private readonly db;
+    private readonly log?;
     readonly enabled: boolean;
     private readonly versions;
     private cache;
     private synced;
-    constructor(config: ResolvedConfig, db: Database);
+    constructor(config: ResolvedConfig, db: Database, log?: ((message: string) => void) | undefined);
     /**
      * Whether the user's role allows an operation: `true`, `false`, or for their own account
      * (users without read or update on `users`) a constraint to it.
@@ -827,6 +850,25 @@ declare class Roles {
      * it; without roles, nobody else (`status`, `deliveries`) or everybody (plugin pages).
      */
     canView(user: AuthUser, id: string): Promise<boolean>;
+    /**
+     * The field that names a collection's owner, for "own documents only": `admin.ownerField`, or
+     * `createdBy`. `undefined` without roles, and for users and collections roles don't cover.
+     */
+    ownerOf(slug: string): string | undefined;
+    /**
+     * The user's field rules (top-level fields their role may only read, or not see), for field
+     * access checks. Roles that may update only their own documents can't change the owner field.
+     */
+    fieldRules(user: AuthUser | null): Promise<ReadonlyMap<Field, FieldRule> | undefined>;
+    /** A new document is its creator's: sets `createdBy`, and an empty owner field. */
+    fillOwner(slug: string, data: Record<string, unknown>, user: AuthUser | null): void;
+    /** Documents a user owns, by collection (`createdBy` and owner fields), for deleting them. */
+    owned(userId: ID): Promise<{
+        collection: string;
+        count: number;
+    }[]>;
+    /** Gives a deleted user's documents to another user, or to nobody (`null`). */
+    transfer(from: ID, to: ID | null): Promise<void>;
     /** Forgets cached permissions, after a role changed. */
     invalidate(): void;
     /**
@@ -835,6 +877,12 @@ declare class Roles {
      */
     sync(): Promise<void>;
     private addMissing;
+    /**
+     * Documents from before roles have no `createdBy`: it is filled from who saved their first
+     * version, for collections with versions. Only while no document of the collection has one,
+     * so it runs once (and finds nothing to do afterwards).
+     */
+    private backfillCreators;
     /** Whether a role exists (users can only be given existing roles). */
     exists(key: string): Promise<boolean>;
     /** Roles a user can be given, those of `auth.roles` first; `name` may be empty. */
@@ -860,6 +908,15 @@ declare class Roles {
     private everything;
     /** Keeps only known collections, globals, operations and pages; `read` comes with the others. */
     private clean;
+    /**
+     * Keeps rules for known top-level fields. A field that must be filled in (required, without a
+     * default) can't be read-only or hidden for a role that creates documents.
+     */
+    private cleanRules;
+    /** Fields that name a collection's owner (`createdBy`, and `admin.ownerField`). */
+    private ownerColumns;
+    /** Sets one field of every matching document, keeping the rest as stored. */
+    private setWhere;
     private cleanName;
     private permissionsOf;
     private load;
@@ -1107,7 +1164,13 @@ declare class EasyCMS<C extends Config = Config> {
     private previewURL;
     private versionTarget;
     private updateDocument;
-    delete<S extends Slug<C>>(collection: S, id: ID, options?: AccessOptions): Promise<Doc<C, S>>;
+    /**
+     * Deletes a document. Deleting a user with roles from the admin (`auth.rbac`): `transferTo`
+     * gives the documents they own to another user; without it they have no owner.
+     */
+    delete<S extends Slug<C>>(collection: S, id: ID, options?: AccessOptions & {
+        transferTo?: ID | null;
+    }): Promise<Doc<C, S>>;
     findGlobal<S extends GSlug<C>>(slug: S, options?: ReadOptions): Promise<GDoc<C, S>>;
     updateGlobal<S extends GSlug<C>>(slug: S, data: GInput<C, S>, options?: DepthOptions): Promise<GDoc<C, S>>;
     /** Takes a global off the site (`status: 'draft'`). See `unpublish`. */
@@ -1244,6 +1307,13 @@ declare class EasyCMS<C extends Config = Config> {
     private checkDocumentAccess;
     private checkGlobalAccess;
     private fieldChecker;
+    /**
+     * Refuses filtering or sorting by fields the caller may not read: the results would tell
+     * their values. Checks each field along a dotted path, through groups, arrays and blocks.
+     */
+    private checkQueryFields;
+    /** `checkGrant` for one document: a role limited to its own documents must own it. */
+    private checkDocumentGrant;
     /** Runs afterRead hooks, populates relationships and removes what the caller may not see. */
     private output;
     /** Creates a document: access, input filtering, hooks, validation, then afterChange. */
@@ -1638,6 +1708,11 @@ interface CollectionAdmin extends ContainerAdmin {
      */
     readonly group?: 'settings';
     readonly list?: CollectionListAdmin;
+    /**
+     * With `auth.rbac`: the relationship field to `users` that names a document's owner, e.g.
+     * `author`, for roles given "own documents only". Default: who created it (`createdBy`).
+     */
+    readonly ownerField?: string;
 }
 interface CollectionListAdmin {
     /**
@@ -2427,6 +2502,8 @@ interface AdminCollection {
         delete: boolean;
         publish: boolean;
     };
+    /** With `auth.rbac`: the field naming a document's owner (`createdBy` or `admin.ownerField`). */
+    owner?: string;
 }
 interface AdminGlobal {
     slug: string;
@@ -2491,6 +2568,8 @@ interface AdminSchema {
         email: boolean;
         roles: boolean;
     };
+    /** Roles from the admin are on (`auth.rbac`): documents have owners. */
+    rbac: boolean;
     /** Pages this user may open (`admin.pages`). */
     pages: AdminPageRef[];
     /** Dashboard panels this user may see (`admin.dashboard`). */
@@ -2589,4 +2668,4 @@ declare function validateConfig(config: Config): ConfigIssue[];
 /** The version of `@easy-cms/core`, set when the package is built. */
 declare const VERSION: string;
 
-export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminAttention, type AdminBackup, type AdminBackups, type AdminBrand, type AdminCollection, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminDeliveries, type AdminDelivery, type AdminEmail, type AdminEmailDelivery, type AdminField, type AdminGlobal, type AdminIcon, type AdminLocale, type AdminPage, type AdminPageRef, type AdminRole, type AdminRoleChange, type AdminRoleTarget, type AdminRoleView, type AdminRoles, type AdminSchema, type AdminStatus, type AdminViewAccess, type AdminWebhookDelivery, type AdminWidgetRef, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, Auth, type AuthConfig, type AuthUser, BUILTIN_COLLECTIONS, type BackupState, type BackupsConfig, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, type CustomField, type CustomFieldTypes, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_PASSWORD_EMAILS, DEFAULT_TOKEN_EXPIRATION, type DashboardWidget, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DeliveryKind, type DeliveryState, type DepthOptions, type DocumentOf, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailCheck, type EmailField, type EmailMessage, type EmailSetting, type Endpoint, type EndpointRequest, FIELD_TYPES, FIELD_TYPE_BASES, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, type FieldError, type FieldType, type FieldTypeBase, type FieldTypeDefinition, type FieldTypeValidateContext, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type InferCollection, type InferGlobal, type JsonField, type Label, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, type MediaSize, type MigrationInfo, NotFoundError, type NumberField, type Operation, type PaginatedDocs, type PasswordEmail, type PasswordEmailArgs, type PasswordEmailFn, type PasswordLinkOptions, PayloadTooLargeError, type Plugin, type PluginInfo, type PluginTypes, type PreviewTarget, type PreviewURL, QueryError, ROLE_OPERATIONS, type RawDocument, type ReadOptions, type RelationshipField, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoleOperation, type RolePermissions, Roles, type RoutesConfig, SESSION_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SelectField, type SelectOption, type Session, type SlugField, type SlugOf, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, type TypedPlugin, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, type UploadFromURLConfig, VERSION, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, configSignature, consoleEmail, consoleLogger, copyDatabase, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, defineFieldType, definePlugin, fillMissing, findConfigFile, generateSlugs, generateTypes, hasRows, hashPassword, imageDimensions, importConfig, isAdmin, isHasMany, isLoggedIn, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, mimeAllowedBy, parseId, populate, readCookie, resolveAdminModule, resolveConfig, rowFields, silentLogger, singularize, slugify, sniffMimeType, validateConfig, validateFields, verifyPassword, writeBackupFile };
+export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminAttention, type AdminBackup, type AdminBackups, type AdminBrand, type AdminCollection, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminDeliveries, type AdminDelivery, type AdminEmail, type AdminEmailDelivery, type AdminField, type AdminGlobal, type AdminIcon, type AdminLocale, type AdminPage, type AdminPageRef, type AdminRole, type AdminRoleChange, type AdminRoleField, type AdminRoleTarget, type AdminRoleView, type AdminRoles, type AdminSchema, type AdminStatus, type AdminViewAccess, type AdminWebhookDelivery, type AdminWidgetRef, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, Auth, type AuthConfig, type AuthUser, BUILTIN_COLLECTIONS, type BackupState, type BackupsConfig, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, type CustomField, type CustomFieldTypes, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_PASSWORD_EMAILS, DEFAULT_TOKEN_EXPIRATION, type DashboardWidget, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DeliveryKind, type DeliveryState, type DepthOptions, type DocumentOf, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailCheck, type EmailField, type EmailMessage, type EmailSetting, type Endpoint, type EndpointRequest, FIELD_TYPES, FIELD_TYPE_BASES, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, type FieldError, type FieldRule, type FieldType, type FieldTypeBase, type FieldTypeDefinition, type FieldTypeValidateContext, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type InferCollection, type InferGlobal, type JsonField, type Label, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, type MediaSize, type MigrationInfo, NotFoundError, type NumberField, type Operation, type PaginatedDocs, type PasswordEmail, type PasswordEmailArgs, type PasswordEmailFn, type PasswordLinkOptions, PayloadTooLargeError, type Plugin, type PluginInfo, type PluginTypes, type PreviewTarget, type PreviewURL, QueryError, ROLE_OPERATIONS, type RawDocument, type ReadOptions, type RelationshipField, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoleOperation, type RolePermissions, Roles, type RoutesConfig, SESSION_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SelectField, type SelectOption, type Session, type SlugField, type SlugOf, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, type TypedPlugin, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, type UploadFromURLConfig, VERSION, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, configSignature, consoleEmail, consoleLogger, copyDatabase, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, defineFieldType, definePlugin, fillMissing, findConfigFile, generateSlugs, generateTypes, hasRows, hashPassword, imageDimensions, importConfig, isAdmin, isHasMany, isLoggedIn, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, mimeAllowedBy, parseId, populate, readCookie, resolveAdminModule, resolveConfig, rowFields, silentLogger, singularize, slugify, sniffMimeType, validateConfig, validateFields, verifyPassword, writeBackupFile };

package/dist/index.js

@@ -253,14 +253,19 @@ function andWhere(where, constraint) {
   return where === void 0 ? constraint : { and: [where, constraint] };
 }
 var FieldAccessChecker = class {
-  constructor(kind, args) {
+  /** `rules`: the user's role's rules for top-level fields (`auth.rbac`), on top of `access`. */
+  constructor(kind, args, rules) {
     this.kind = kind;
     this.args = args;
+    this.rules = rules;
   }
   kind;
   args;
+  rules;
   cache = /* @__PURE__ */ new Map();
   async allows(field) {
+    const rule = this.rules?.get(field);
+    if (rule === "hidden" || rule === "read" && this.kind === "update") return false;
     const fn = field.access?.[this.kind];
     if (!fn) return true;
     let allowed2 = this.cache.get(field);
@@ -338,6 +343,23 @@ var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   ROLES
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
+var CREATED_BY_FIELD = {
+  name: "createdBy",
+  type: "relationship",
+  to: USERS,
+  position: "sidebar",
+  access: { update: () => false },
+  label: { en: "Created by", th: "\u0E2A\u0E23\u0E49\u0E32\u0E07\u0E42\u0E14\u0E22" }
+};
+function withCreatedBy(config) {
+  if (config.auth?.rbac !== true) return config;
+  return {
+    ...config,
+    collections: (config.collections ?? []).map(
+      (c) => c.slug === USERS || c.fields?.some((f) => f.name === CREATED_BY_FIELD.name) ? c : { ...c, fields: [...c.fields, CREATED_BY_FIELD] }
+    )
+  };
+}
 var adminOrSelf = ({ user }) => {
   if (!user) return false;
   if (user.role === "admin") return true;
@@ -1361,6 +1383,7 @@ async function runBackup(cms, record) {
     const filename = filenameFor(cms, started);
     const key2 = await storage.get(filename) ? filename.replace(/\.db\.gz$/, `-${row.id}.db.gz`) : filename;
     await storage.put(key2, data, { contentType: "application/gzip" });
+    await pruneBackups(cms, 1);
     row = await update(cms, row, {
       state: "done",
       filename: key2,
@@ -1368,7 +1391,6 @@ async function runBackup(cms, record) {
       finishedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
     cms.logger.info(`Backup ${key2} written (${data.byteLength} bytes)`);
-    await pruneBackups(cms);
   } catch (error) {
     await update(cms, row, {
       state: "failed",
@@ -1380,8 +1402,8 @@ async function runBackup(cms, record) {
     await rm2(dir, { recursive: true, force: true });
   }
 }
-async function pruneBackups(cms) {
-  const keep = cms.config.backups?.keep ?? DEFAULT_BACKUP_KEEP;
+async function pruneBackups(cms, room = 0) {
+  const keep = Math.max(0, (cms.config.backups?.keep ?? DEFAULT_BACKUP_KEEP) - room);
   const storage = await backupStorage(cms);
   const { docs } = await cms.db.find({
     collection: DATABASE_BACKUPS,
@@ -2313,6 +2335,7 @@ var VersionStore = class {
 // src/roles.ts
 var ROLE_OPERATIONS = ["read", "create", "update", "delete", "publish"];
 var GLOBAL_OPERATIONS = ["read", "update", "publish"];
+var OWN_OPERATIONS = ["read", "update", "delete", "publish"];
 var KEY = /^[a-z][a-z0-9-]{0,31}$/;
 var HISTORY = 50;
 var TTL = 3e4;
@@ -2328,6 +2351,9 @@ var rolesCollection = {
 function governed(slug2) {
   return !INTERNAL_COLLECTIONS.has(slug2) && slug2 !== API_KEYS;
 }
+function ruleFields(fields) {
+  return fields.filter((f) => !f.hidden && f.name !== "createdBy");
+}
 function references(fields, out = /* @__PURE__ */ new Set()) {
   for (const field of fields) {
     if (field.type === "relationship") out.add(field.to);
@@ -2343,14 +2369,16 @@ var viewId = {
 };
 var tagOf = (component) => typeof component === "string" ? component : component.tag;
 var Roles = class {
-  constructor(config, db) {
+  constructor(config, db, log) {
     this.config = config;
     this.db = db;
+    this.log = log;
     this.enabled = config.auth.rbac;
     this.versions = new VersionStore(db);
   }
   config;
   db;
+  log;
   enabled;
   versions;
   cache;
@@ -2364,7 +2392,13 @@ var Roles = class {
     if ("collection" in target && !governed(target.collection)) return true;
     const permissions = await this.permissionsOf(user.role);
     const ops = "collection" in target ? permissions.collections?.[target.collection] : permissions.globals?.[target.global];
-    if (ops?.includes(operation)) return true;
+    if (ops?.includes(operation)) {
+      if ("collection" in target && permissions.own?.[target.collection]?.includes(operation)) {
+        const owner = this.ownerOf(target.collection);
+        if (owner && operation !== "create") return { [owner]: { equals: user.id } };
+      }
+      return true;
+    }
     if ("collection" in target && target.collection === USERS) {
       if (operation === "read" || operation === "update") return { id: { equals: user.id } };
     }
@@ -2380,6 +2414,76 @@ var Roles = class {
     if (!this.enabled) return id.startsWith("page:") || id.startsWith("widget:");
     return (await this.permissionsOf(user.role)).admin?.includes(id) ?? false;
   }
+  /**
+   * The field that names a collection's owner, for "own documents only": `admin.ownerField`, or
+   * `createdBy`. `undefined` without roles, and for users and collections roles don't cover.
+   */
+  ownerOf(slug2) {
+    if (!this.enabled || slug2 === USERS || !governed(slug2)) return void 0;
+    const config = this.config.collections.find((c) => c.slug === slug2);
+    if (!config) return void 0;
+    return config.admin?.ownerField ?? "createdBy";
+  }
+  /**
+   * The user's field rules (top-level fields their role may only read, or not see), for field
+   * access checks. Roles that may update only their own documents can't change the owner field.
+   */
+  async fieldRules(user) {
+    if (!this.enabled || !user || user.role === "admin") return void 0;
+    await this.load();
+    const cache = this.cache;
+    const cached = cache?.rules.get(user.role);
+    if (cached) return cached;
+    const permissions = await this.permissionsOf(user.role);
+    const rules = /* @__PURE__ */ new Map();
+    const add = (fields, set) => {
+      for (const field of fields) {
+        const rule = set?.[field.name];
+        if (rule === "read" || rule === "hidden") rules.set(field, rule);
+      }
+    };
+    for (const c of this.config.collections) {
+      if (!governed(c.slug)) continue;
+      add(c.fields, permissions.fields?.collections?.[c.slug]);
+      const ownerField = c.admin?.ownerField;
+      if (ownerField && permissions.own?.[c.slug]?.includes("update")) {
+        const field = c.fields.find((f) => f.name === ownerField);
+        if (field && !rules.has(field)) rules.set(field, "read");
+      }
+    }
+    for (const g of this.config.globals) add(g.fields, permissions.fields?.globals?.[g.slug]);
+    cache?.rules.set(user.role, rules);
+    return rules;
+  }
+  /** A new document is its creator's: sets `createdBy`, and an empty owner field. */
+  fillOwner(slug2, data, user) {
+    if (!user || !this.ownerOf(slug2)) return;
+    data.createdBy ??= user.id;
+    const ownerField = this.config.collections.find((c) => c.slug === slug2)?.admin?.ownerField;
+    if (ownerField && (data[ownerField] === void 0 || data[ownerField] === null))
+      data[ownerField] = user.id;
+  }
+  /** Documents a user owns, by collection (`createdBy` and owner fields), for deleting them. */
+  async owned(userId) {
+    const out = [];
+    for (const c of this.config.collections) {
+      const columns = this.ownerColumns(c.slug);
+      if (columns.length === 0) continue;
+      const count = await this.db.count({
+        collection: c.slug,
+        where: { or: columns.map((column) => ({ [column]: { equals: userId } })) }
+      });
+      if (count > 0) out.push({ collection: c.slug, count });
+    }
+    return out;
+  }
+  /** Gives a deleted user's documents to another user, or to nobody (`null`). */
+  async transfer(from, to) {
+    for (const c of this.config.collections) {
+      for (const column of this.ownerColumns(c.slug))
+        await this.setWhere(c.slug, { [column]: { equals: from } }, column, to);
+    }
+  }
   /** Forgets cached permissions, after a role changed. */
   invalidate() {
     this.cache = void 0;
@@ -2409,6 +2513,39 @@ var Roles = class {
       }
     }
     this.invalidate();
+    await this.backfillCreators();
+  }
+  /**
+   * Documents from before roles have no `createdBy`: it is filled from who saved their first
+   * version, for collections with versions. Only while no document of the collection has one,
+   * so it runs once (and finds nothing to do afterwards).
+   */
+  async backfillCreators() {
+    for (const c of this.config.collections) {
+      if (!c.versions || !this.ownerOf(c.slug)) continue;
+      if (await this.db.count({ collection: c.slug, where: { createdBy: { exists: true } } }) > 0)
+        continue;
+      const versions = await this.db.find({
+        collection: VERSIONS,
+        where: { and: [{ parent: { equals: c.slug } }, { author: { exists: true } }] },
+        sort: ["id"],
+        limit: 0,
+        page: 1
+      });
+      const first = /* @__PURE__ */ new Map();
+      for (const v of versions.docs) {
+        if (!first.has(v.doc) && v.author !== null) first.set(v.doc, v.author);
+      }
+      let filled = 0;
+      for (const [doc, author] of first) {
+        const row = await this.db.findById({ collection: c.slug, id: doc });
+        if (!row || row.createdBy !== null && row.createdBy !== void 0) continue;
+        const { id, ...rest } = row;
+        await this.db.update({ collection: c.slug, id, data: { ...rest, createdBy: author } });
+        filled++;
+      }
+      if (filled > 0) this.log?.(`Set who created ${filled} ${c.slug} from their history`);
+    }
   }
   /** Whether a role exists (users can only be given existing roles). */
   async exists(key2) {
@@ -2437,16 +2574,24 @@ var Roles = class {
     const seen = (group, slug2) => decided.some((p) => p[group]?.[slug2] !== void 0);
     return {
       roles,
-      collections: this.config.collections.filter((c) => governed(c.slug)).map((c) => ({
-        slug: c.slug,
-        ops: ROLE_OPERATIONS.filter((op) => op !== "publish" || c.drafts === true),
-        new: !seen("collections", c.slug),
-        references: [...references(c.fields)].filter((s) => s !== c.slug && governed(s))
-      })),
+      collections: this.config.collections.filter((c) => governed(c.slug)).map((c) => {
+        const owner = this.ownerOf(c.slug);
+        return {
+          slug: c.slug,
+          ops: ROLE_OPERATIONS.filter((op) => op !== "publish" || c.drafts === true),
+          new: !seen("collections", c.slug),
+          references: [...references(ruleFields(c.fields))].filter(
+            (s) => s !== c.slug && governed(s)
+          ),
+          fields: adminFields(c.fields, c.admin?.ownerField),
+          ...owner ? { owner } : {}
+        };
+      }),
       globals: this.config.globals.map((g) => ({
         slug: g.slug,
         ops: GLOBAL_OPERATIONS.filter((op) => op !== "publish" || g.drafts === true),
-        new: !seen("globals", g.slug)
+        new: !seen("globals", g.slug),
+        fields: adminFields(g.fields, void 0)
       })),
       views: this.views()
     };
@@ -2560,9 +2705,9 @@ var Roles = class {
       for (const [slug2, ops] of Object.entries(group)) {
         const valid = allowed2.get(slug2);
         if (!valid || !Array.isArray(ops)) continue;
-        const picked = valid.filter((op) => ops.includes(op));
-        if (picked.length > 0 && !picked.includes("read")) picked.unshift("read");
-        out[slug2] = picked;
+        const picked2 = valid.filter((op) => ops.includes(op));
+        if (picked2.length > 0 && !picked2.includes("read")) picked2.unshift("read");
+        out[slug2] = picked2;
       }
       return out;
     };
@@ -2584,11 +2729,71 @@ var Roles = class {
         input.admin.filter((id) => typeof id === "string" && views.has(id))
       )
     ] : [];
-    return {
+    const picked = {
       collections: pick(input.collections, collections),
-      globals: pick(input.globals, globals),
-      admin
+      globals: pick(input.globals, globals)
     };
+    const own = {};
+    if (typeof input.own === "object" && input.own !== null) {
+      for (const [slug2, ops] of Object.entries(input.own)) {
+        const granted = picked.collections[slug2];
+        if (!granted || !this.ownerOf(slug2) || !Array.isArray(ops)) continue;
+        const valid = OWN_OPERATIONS.filter((op) => granted.includes(op) && ops.includes(op));
+        if (valid.length > 0) own[slug2] = valid;
+      }
+    }
+    const fields = {
+      collections: this.cleanRules(
+        input.fields?.collections,
+        this.config.collections.filter((c) => governed(c.slug)),
+        picked.collections
+      ),
+      globals: this.cleanRules(
+        input.fields?.globals,
+        this.config.globals,
+        void 0
+      )
+    };
+    return { ...picked, admin, own, fields };
+  }
+  /**
+   * Keeps rules for known top-level fields. A field that must be filled in (required, without a
+   * default) can't be read-only or hidden for a role that creates documents.
+   */
+  cleanRules(value, containers, granted) {
+    const out = {};
+    if (typeof value !== "object" || value === null) return out;
+    for (const [slug2, rules] of Object.entries(value)) {
+      const container = containers.find((c) => c.slug === slug2);
+      if (!container || typeof rules !== "object" || rules === null) continue;
+      const set = {};
+      for (const field of ruleFields(container.fields)) {
+        const rule = rules[field.name];
+        if (rule !== "read" && rule !== "hidden") continue;
+        if (granted?.[slug2]?.includes("create") && mustFill(field))
+          throw new ValidationError(ROLES, [
+            {
+              field: `fields.${slug2}.${field.name}`,
+              message: "is required: roles that create documents must be able to fill it"
+            }
+          ]);
+        set[field.name] = rule;
+      }
+      if (Object.keys(set).length > 0) out[slug2] = set;
+    }
+    return out;
+  }
+  /** Fields that name a collection's owner (`createdBy`, and `admin.ownerField`). */
+  ownerColumns(slug2) {
+    if (!this.ownerOf(slug2)) return [];
+    const ownerField = this.config.collections.find((c) => c.slug === slug2)?.admin?.ownerField;
+    return ownerField ? ["createdBy", ownerField] : ["createdBy"];
+  }
+  /** Sets one field of every matching document, keeping the rest as stored. */
+  async setWhere(collection2, where, field, value) {
+    const { docs } = await this.db.find({ collection: collection2, where, sort: ["id"], limit: 0, page: 1 });
+    for (const { id, ...rest } of docs)
+      await this.db.update({ collection: collection2, id, data: { ...rest, [field]: value } });
   }
   cleanName(value) {
     if (value === void 0 || value === null) return "";
@@ -2607,7 +2812,7 @@ var Roles = class {
     const byKey = /* @__PURE__ */ new Map();
     for (const row of await this.rows())
       byKey.set(String(row.key), row.permissions ?? {});
-    this.cache = { at: Date.now(), byKey };
+    this.cache = { at: Date.now(), byKey, rules: /* @__PURE__ */ new Map() };
     return byKey;
   }
   async rows() {
@@ -2655,6 +2860,17 @@ var Roles = class {
     };
   }
 };
+function mustFill(field) {
+  return field.required === true && field.defaultValue === void 0;
+}
+function adminFields(fields, ownerField) {
+  return ruleFields(fields).map((f) => ({
+    name: f.name,
+    ...f.label !== void 0 ? { label: f.label } : {},
+    required: mustFill(f),
+    ...f.name === ownerField ? { owner: true } : {}
+  }));
+}
 function rank(role, config) {
   const index = config.auth.roles.indexOf(role.key);
   return index === -1 ? config.auth.roles.length : index;
@@ -2908,7 +3124,10 @@ function validateConfig(config) {
   if (apiKeys !== void 0 && typeof apiKeys !== "boolean") add("apiKeys", "must be true or false");
   collections.forEach((collection2, i) => {
     const path = `collections.${collection2.slug ?? `[${i}]`}`;
-    validateContainer(collection2, path, collectionSlugs, add);
+    validateContainer(collection2, path, collectionSlugs, add, {
+      collection: true,
+      rbac: config.auth?.rbac === true
+    });
     validateUseAsTitle(collection2, path, add);
     validateIcon(collection2, path, add);
     const editIn = collection2.editIn;
@@ -2917,7 +3136,10 @@ function validateConfig(config) {
   });
   globals.forEach((global2, i) => {
     const path = `globals.${global2.slug ?? `[${i}]`}`;
-    validateContainer(global2, path, collectionSlugs, add);
+    validateContainer(global2, path, collectionSlugs, add, {
+      collection: false,
+      rbac: config.auth?.rbac === true
+    });
     validateIcon(global2, path, add);
   });
   const plugins = config.plugins;
@@ -3361,7 +3583,7 @@ function checkSlug(container, path, seen, add) {
   seen.add(slug2);
   return slug2;
 }
-function validateContainer(container, path, collectionSlugs, add) {
+function validateContainer(container, path, collectionSlugs, add, { collection: collection2, rbac }) {
   if (!Array.isArray(container.fields)) {
     add(`${path}.fields`, "must be an array");
     return;
@@ -3398,8 +3620,25 @@ function validateContainer(container, path, collectionSlugs, add) {
         add(`${path}.admin.group`, `must be 'settings' (got ${JSON.stringify(group)})`);
       const list = admin.list;
       if (list !== void 0) validateList(list, container, `${path}.admin.list`, add);
+      const owner = admin.ownerField;
+      if (owner !== void 0) {
+        const field = container.fields.find((f) => f.name === owner);
+        if (!collection2 || container.slug === "users" || field?.type !== "relationship" || field.to !== "users" || field.hasMany)
+          add(
+            `${path}.admin.ownerField`,
+            'must name a relationship field to "users" (not hasMany) of a collection',
+            "e.g. { name: 'author', type: 'relationship', to: 'users' }"
+          );
+      }
     }
   }
+  const createdBy = container.fields.find((f) => f.name === CREATED_BY_FIELD.name);
+  if (rbac && createdBy && createdBy !== CREATED_BY_FIELD)
+    add(
+      `${path}.fields.createdBy`,
+      '"createdBy" is added by Easy CMS with auth.rbac',
+      "rename the field; to use it as the owner, set admin.ownerField"
+    );
   const reserved = new Set(SYSTEM_FIELD_NAMES);
   if (container.drafts) reserved.add("status");
   validateFields2(container.fields, `${path}.fields`, reserved, collectionSlugs, add);
@@ -3753,7 +3992,7 @@ async function resolveConfig(input) {
   if (resolved.has(input)) return input;
   let config = await applyPlugins(input);
   if (typeof config === "object" && config !== null && Array.isArray(config.collections ?? [])) {
-    config = withMedia(withUsers(config));
+    config = withCreatedBy(withMedia(withUsers(config)));
   }
   const applied = applyFieldTypes(config);
   config = applied.config;
@@ -4402,7 +4641,7 @@ var EasyCMS = class {
     this.storage = storage;
     this.cwd = cwd;
     this.versions = new VersionStore(db);
-    this.roles = new Roles(config, db);
+    this.roles = new Roles(config, db, (message2) => logger.info(message2));
     this.webhooks = new Webhooks(
       config.webhooks ?? [],
       logger,
@@ -4429,6 +4668,7 @@ var EasyCMS = class {
       options
     );
     const requested = options.sort === void 0 ? ["-createdAt"] : [options.sort].flat();
+    await this.checkQueryFields(config, guard, void 0, requested);
     const locale = this.localeOf(options);
     const sort = locale === void 0 ? requested : localizeSort(
       config.fields,
@@ -4723,7 +4963,7 @@ var EasyCMS = class {
     const filtered = await filterInput(
       config.fields,
       input,
-      this.fieldChecker("update", guard, parsed, input)
+      await this.fieldChecker("update", guard, parsed, input)
     );
     const localized = this.toMaps(config, filtered, base ?? {}, options);
     const merged = base ? mergeForUpdate(config.fields, base, localized) : applyDefaults(config.fields, localized, this.config.localization);
@@ -4763,7 +5003,7 @@ var EasyCMS = class {
     const input = await filterInput(
       config.fields,
       raw,
-      this.fieldChecker("update", guard, void 0, raw)
+      await this.fieldChecker("update", guard, void 0, raw)
     );
     const saved = await this.db.findGlobal({ slug: slug2 }) ?? {};
     const current = await this.globalDraft(config, saved);
@@ -4828,7 +5068,7 @@ var EasyCMS = class {
     if (!existing || parsed === void 0) throw new NotFoundError(collection2, id);
     await this.checkDocumentAccess(config, "update", guard, parsed, raw);
     if (config.drafts && (mode === "unpublish" || raw.status === "published"))
-      await this.checkGrant(guard, { collection: collection2 }, "publish");
+      await this.checkDocumentGrant(guard, collection2, "publish", parsed);
     const [drafted] = await this.withDrafts(config, [existing]);
     const live = options.live === true && mode === "save";
     const current = live ? existing : drafted;
@@ -4840,7 +5080,7 @@ var EasyCMS = class {
     const filtered = await filterInput(
       config.fields,
       input,
-      this.fieldChecker("update", guard, parsed, input)
+      await this.fieldChecker("update", guard, parsed, input)
     );
     const localized = mode === "restore" ? filtered : this.toMaps(config, filtered, current, options);
     let merged = mergeForUpdate(config.fields, current, localized);
@@ -4908,6 +5148,10 @@ var EasyCMS = class {
     const [out] = await this.output(config, [doc], guard, { ...options, draft: true });
     return out;
   }
+  /**
+   * Deletes a document. Deleting a user with roles from the admin (`auth.rbac`): `transferTo`
+   * gives the documents they own to another user; without it they have no owner.
+   */
   async delete(collection2, id, options = {}) {
     const config = this.collection(collection2);
     const guard = guardOf(options);
@@ -4919,7 +5163,19 @@ var EasyCMS = class {
       await this.guardLastAdmin(parsed, existing, { ...existing, active: false });
     const base = this.hookArgs(config, guard);
     for (const hook of config.hooks?.beforeDelete ?? []) await hook({ ...base, id: parsed });
-    if (config.slug === USERS) await this.auth.revokeSessions(parsed);
+    if (config.slug === USERS) {
+      const to = options.transferTo;
+      if (to !== void 0 && to !== null) {
+        const target = parseId(to);
+        const heir = target === void 0 ? null : await this.db.findById({ collection: USERS, id: target });
+        if (!heir || String(heir.id) === String(parsed))
+          throw new ValidationError(USERS, [
+            { field: "transferTo", message: "must be another existing user" }
+          ]);
+        await this.roles.transfer(parsed, heir.id);
+      } else await this.roles.transfer(parsed, null);
+      await this.auth.revokeSessions(parsed);
+    }
     await this.db.delete({ collection: collection2, id: parsed });
     if (versionLimit(config)) await this.versions.deleteAll(collectionParent(collection2), parsed);
     if (config.schedule) {
@@ -5027,7 +5283,7 @@ var EasyCMS = class {
     const input = await filterInput(
       config.fields,
       raw,
-      this.fieldChecker("update", guard, void 0, raw)
+      await this.fieldChecker("update", guard, void 0, raw)
     );
     const existing = await this.db.findGlobal({ slug: slug2 }) ?? {};
     const current = await this.globalDraft(config, existing);
@@ -5312,7 +5568,7 @@ var EasyCMS = class {
     const existing = parsed === void 0 ? null : await this.db.findById({ collection: collection2, id: parsed });
     if (!existing || parsed === void 0) throw new NotFoundError(collection2, id);
     await this.checkDocumentAccess(config, "update", guardOf(options), parsed, void 0);
-    await this.checkGrant(guardOf(options), { collection: collection2 }, "publish");
+    await this.checkDocumentGrant(guardOf(options), collection2, "publish", parsed);
     return { config, parsed };
   }
   async globalScheduleTarget(slug2, options) {
@@ -5483,6 +5739,7 @@ var EasyCMS = class {
     const own = await this.checkGrant(guard, { collection: config.slug }, "read");
     const access = await evaluateAccess(config.access?.read, { user: guard.user });
     if (access === false) throw deny(guard.user);
+    await this.checkQueryFields(config, guard, where);
     return andWhere(andWhere(where, access), own);
   }
   async checkDocumentAccess(config, operation, guard, id, data) {
@@ -5512,17 +5769,52 @@ var EasyCMS = class {
       throw new QueryError(`${operation} access of global "${config.slug}" must return a boolean`);
     if (!access) throw deny(guard.user);
   }
-  fieldChecker(kind, guard, id, data) {
+  async fieldChecker(kind, guard, id, data) {
     if (!guard.enforce) return void 0;
-    return new FieldAccessChecker(kind, {
-      user: guard.user,
-      ...id !== void 0 ? { id } : {},
-      ...data ? { data } : {}
+    return new FieldAccessChecker(
+      kind,
+      {
+        user: guard.user,
+        ...id !== void 0 ? { id } : {},
+        ...data ? { data } : {}
+      },
+      await this.roles.fieldRules(guard.user)
+    );
+  }
+  /**
+   * Refuses filtering or sorting by fields the caller may not read: the results would tell
+   * their values. Checks each field along a dotted path, through groups, arrays and blocks.
+   */
+  async checkQueryFields(config, guard, where, sort = []) {
+    if (!guard.enforce) return;
+    const paths = [...wherePaths(where), ...sort.map((s) => s.replace(/^-/, ""))];
+    if (paths.length === 0) return;
+    const read2 = await this.fieldChecker("read", guard, void 0, void 0);
+    for (const path of paths) {
+      let fields = config.fields;
+      for (const name of path.split(".")) {
+        if (!fields) break;
+        const field = fields.find((f) => f.name === name);
+        if (!field) break;
+        if (field.hidden || read2 && !await read2.allows(field))
+          throw new ForbiddenError(`You may not filter or sort by "${path}"`);
+        fields = field.type === "group" || field.type === "array" ? field.fields : field.type === "blocks" ? field.blocks.flatMap((b) => b.fields) : void 0;
+      }
+    }
+  }
+  /** `checkGrant` for one document: a role limited to its own documents must own it. */
+  async checkDocumentGrant(guard, collection2, operation, id) {
+    const own = await this.checkGrant(guard, { collection: collection2 }, operation);
+    if (own === true) return;
+    const matches2 = await this.db.count({
+      collection: collection2,
+      where: andWhere(own, { id: { equals: id } })
     });
+    if (matches2 === 0) throw deny(guard.user);
   }
   /** Runs afterRead hooks, populates relationships and removes what the caller may not see. */
   async output(config, docs, guard, options) {
-    const read2 = this.fieldChecker("read", guard, void 0, void 0);
+    const read2 = await this.fieldChecker("read", guard, void 0, void 0);
     const finish = async (target, doc) => {
       const hooked = await this.transform(
         target.hooks?.afterRead,
@@ -5572,8 +5864,9 @@ var EasyCMS = class {
     const filtered = await filterInput(
       config.fields,
       input,
-      this.fieldChecker("update", guard, void 0, input)
+      await this.fieldChecker("update", guard, void 0, input)
     );
+    this.roles.fillOwner(collection2, filtered, guard.user ?? hookGuard?.user ?? null);
     const base = this.hookArgs(config, hookGuard ?? guard);
     let data = applyDefaults(
       config.fields,
@@ -5944,6 +6237,16 @@ function loadSharp() {
   );
   return sharpModule;
 }
+function wherePaths(where) {
+  if (!where) return [];
+  const out = [];
+  for (const [key2, value] of Object.entries(where)) {
+    if (key2 === "and" || key2 === "or") {
+      for (const sub of value ?? []) out.push(...wherePaths(sub));
+    } else out.push(key2);
+  }
+  return out;
+}
 function guardOf(options) {
   return { enforce: options.overrideAccess === false, user: options.user ?? null };
 }
@@ -6215,10 +6518,11 @@ function componentRef(component) {
 async function allowed(access, user) {
   return await evaluateAccess(access, { user }) !== false;
 }
-async function serializeFields(fields, update2, localized) {
+async function serializeFields(fields, checks, localized) {
+  const { update: update2 } = checks;
   const out = [];
   for (const field of fields) {
-    if (field.hidden) continue;
+    if (field.hidden || !await checks.read.allows(field)) continue;
     const f = { name: field.name, type: field.type };
     if (field.label !== void 0) f.label = field.label;
     if (field.required) f.required = true;
@@ -6271,7 +6575,7 @@ async function serializeFields(fields, update2, localized) {
       case "array":
         if (field.minRows !== void 0) f.minRows = field.minRows;
         if (field.maxRows !== void 0) f.maxRows = field.maxRows;
-        f.fields = await serializeFields(field.fields, update2, localized);
+        f.fields = await serializeFields(field.fields, checks, localized);
         break;
       case "blocks":
         if (field.minRows !== void 0) f.minRows = field.minRows;
@@ -6280,28 +6584,31 @@ async function serializeFields(fields, update2, localized) {
           field.blocks.map(async (block) => ({
             slug: block.slug,
             ...block.labels ? { labels: block.labels } : {},
-            fields: await serializeFields(block.fields, update2, localized)
+            fields: await serializeFields(block.fields, checks, localized)
           }))
         );
         break;
       case "group":
-        f.fields = await serializeFields(field.fields, update2, localized);
+        f.fields = await serializeFields(field.fields, checks, localized);
         break;
     }
     out.push(f);
   }
   return out;
 }
+async function checkers(cms, user) {
+  const rules = await cms.roles.fieldRules(user);
+  return {
+    update: new FieldAccessChecker("update", { user }, rules),
+    read: new FieldAccessChecker("read", { user }, rules)
+  };
+}
 async function may(cms, access, user, target, operation) {
   return await allowed(access, user) && await cms.roles.allows(user, target, operation) !== false;
 }
 async function collection(cms, config, user, localized, roles) {
   const target = { collection: config.slug };
-  const fields = await serializeFields(
-    config.fields,
-    new FieldAccessChecker("update", { user }),
-    localized
-  );
+  const fields = await serializeFields(config.fields, await checkers(cms, user), localized);
   if (config.slug === USERS && cms.roles.enabled) {
     const role = fields.find((f) => f.name === "role");
     if (role) {
@@ -6331,23 +6638,22 @@ async function collection(cms, config, user, localized, roles) {
   if (config.admin?.group === "settings" || SETTINGS.has(config.slug)) result.group = "settings";
   if (config.admin?.list?.tree) result.tree = config.admin.list.tree;
   if (config.admin?.list?.sort) result.defaultSort = config.admin.list.sort;
+  const owner = cms.roles.ownerOf(config.slug);
+  if (owner && fields.some((f) => f.name === owner)) result.owner = owner;
   if (config.editIn === "drawer" && !result.drafts && !result.versions && !result.preview)
     result.editIn = "drawer";
   return result;
 }
 async function global(cms, config, user, localized) {
   const target = { global: config.slug };
+  const checks = await checkers(cms, user);
   const result = {
     slug: config.slug,
     drafts: config.drafts === true,
     versions: Boolean(config.versions),
     preview: typeof config.preview === "function",
     schedule: config.schedule === true,
-    fields: await serializeFields(
-      config.fields,
-      new FieldAccessChecker("update", { user }),
-      localized
-    ),
+    fields: await serializeFields(config.fields, checks, localized),
     permissions: {
       read: await may(cms, config.access?.read, user, target, "read"),
       update: await may(cms, config.access?.update, user, target, "update"),
@@ -6387,6 +6693,7 @@ async function adminSchema(cms, user, origin) {
     modules: adminModuleUrls(cms),
     uploadFromURL: cms.config.upload.fromURL !== void 0,
     views,
+    rbac: cms.roles.enabled,
     ...views.deliveries ? {
       deliveries: {
         webhook: cms.config.collections.some((c) => c.slug === WEBHOOK_DELIVERIES),
@@ -6432,7 +6739,7 @@ async function widgets(cms, user) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.33.0" : "0.0.0-dev";
+var VERSION = true ? "0.34.0" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
 var DAY = 864e5;
@@ -6923,6 +7230,14 @@ async function route(cms, ctx, method, segments, options) {
     }
     throw new HttpError("Not found", 404);
   }
+  if (first === "admin" && second === "owned" && third !== void 0 && segments.length === 3) {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+    if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+    const parsed = parseId(third);
+    if (parsed === void 0) throw new HttpError("Not found", 404);
+    return { body: await cms.roles.owned(parsed) };
+  }
   if (first === "admin" && second === "roles") {
     if (!ctx.user) throw new UnauthorizedError();
     if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
@@ -7127,7 +7442,9 @@ async function route(cms, ctx, method, segments, options) {
     return { body: doc };
   }
   if (method === "DELETE") {
-    return { body: await cms.delete(collection2, id, access) };
+    const to = collection2 === USERS ? ctx.url.searchParams.get("transferTo") : null;
+    const transferTo = to === null ? {} : { transferTo: to === "none" ? null : parseId(to) ?? to };
+    return { body: await cms.delete(collection2, id, { ...access, ...transferTo }) };
   }
   throw methodNotAllowed(ctx, "GET, PATCH, DELETE");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",