@easy-cms/core 0.33.0 → 0.35.0

package/dist/index.js

@@ -253,14 +253,19 @@ function andWhere(where, constraint) {
   return where === void 0 ? constraint : { and: [where, constraint] };
 }
 var FieldAccessChecker = class {
-  constructor(kind, args) {
+  /** `rules`: the user's role's rules for top-level fields (`auth.rbac`), on top of `access`. */
+  constructor(kind, args, rules) {
     this.kind = kind;
     this.args = args;
+    this.rules = rules;
   }
   kind;
   args;
+  rules;
   cache = /* @__PURE__ */ new Map();
   async allows(field) {
+    const rule = this.rules?.get(field);
+    if (rule === "hidden" || rule === "read" && this.kind === "update") return false;
     const fn = field.access?.[this.kind];
     if (!fn) return true;
     let allowed2 = this.cache.get(field);
@@ -327,6 +332,7 @@ var WEBHOOK_DELIVERIES = "webhook-deliveries";
 var EMAIL_DELIVERIES = "email-deliveries";
 var DATABASE_BACKUPS = "database-backups";
 var ROLES = "user-roles";
+var USER_IDENTITIES = "user-identities";
 var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SESSIONS,
   LOGIN_ATTEMPTS,
@@ -335,9 +341,27 @@ var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   WEBHOOK_DELIVERIES,
   EMAIL_DELIVERIES,
   DATABASE_BACKUPS,
-  ROLES
+  ROLES,
+  USER_IDENTITIES
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
+var CREATED_BY_FIELD = {
+  name: "createdBy",
+  type: "relationship",
+  to: USERS,
+  position: "sidebar",
+  access: { update: () => false },
+  label: { en: "Created by", th: "\u0E2A\u0E23\u0E49\u0E32\u0E07\u0E42\u0E14\u0E22" }
+};
+function withCreatedBy(config) {
+  if (config.auth?.rbac !== true) return config;
+  return {
+    ...config,
+    collections: (config.collections ?? []).map(
+      (c) => c.slug === USERS || c.fields?.some((f) => f.name === CREATED_BY_FIELD.name) ? c : { ...c, fields: [...c.fields, CREATED_BY_FIELD] }
+    )
+  };
+}
 var adminOrSelf = ({ user }) => {
   if (!user) return false;
   if (user.role === "admin") return true;
@@ -578,6 +602,18 @@ var databaseBackupsCollection = {
     { name: "downloadedAt", type: "text" }
   ]
 };
+var userIdentitiesCollection = {
+  slug: USER_IDENTITIES,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    { name: "user", type: "relationship", to: USERS, required: true, index: true },
+    // The provider's id (`google`) and its id for the account (`sub`).
+    { name: "provider", type: "text", required: true, index: true },
+    { name: "subject", type: "text", required: true, index: true },
+    { name: "email", type: "text" },
+    { name: "lastUsedAt", type: "text" }
+  ]
+};
 var emailDeliveriesCollection = {
   slug: EMAIL_DELIVERIES,
   access: { read: nobody, create: nobody, update: nobody, delete: nobody },
@@ -620,7 +656,17 @@ var DEFAULT_PASSWORD_EMAILS = {
     ],
     { label: "Set a new password", url }
   ),
-  invite: ({ url = "", locale, expiresAt, user }) => locale === "th" ? email(
+  invite: ({ url = "", locale, expiresAt, user, sso }) => sso ? locale === "th" ? email(
+    "\u0E04\u0E38\u0E13\u0E44\u0E14\u0E49\u0E23\u0E31\u0E1A\u0E40\u0E0A\u0E34\u0E0D\u0E43\u0E2B\u0E49\u0E43\u0E0A\u0E49\u0E07\u0E32\u0E19\u0E23\u0E30\u0E1A\u0E1A\u0E08\u0E31\u0E14\u0E01\u0E32\u0E23\u0E40\u0E19\u0E37\u0E49\u0E2D\u0E2B\u0E32",
+    [`\u0E21\u0E35\u0E1A\u0E31\u0E0D\u0E0A\u0E35\u0E2A\u0E33\u0E2B\u0E23\u0E31\u0E1A ${user.email} \u0E23\u0E2D\u0E04\u0E38\u0E13\u0E2D\u0E22\u0E39\u0E48 \u0E40\u0E02\u0E49\u0E32\u0E2A\u0E39\u0E48\u0E23\u0E30\u0E1A\u0E1A\u0E14\u0E49\u0E27\u0E22 ${sso.join(" \u0E2B\u0E23\u0E37\u0E2D ")} \u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E40\u0E23\u0E34\u0E48\u0E21\u0E43\u0E0A\u0E49\u0E07\u0E32\u0E19`],
+    { label: "\u0E40\u0E02\u0E49\u0E32\u0E2A\u0E39\u0E48\u0E23\u0E30\u0E1A\u0E1A", url }
+  ) : email(
+    "You're invited to the content admin",
+    [
+      `An account for ${user.email} is waiting for you. Sign in with ${sso.join(" or ")} to start.`
+    ],
+    { label: "Sign in", url }
+  ) : locale === "th" ? email(
     "\u0E04\u0E38\u0E13\u0E44\u0E14\u0E49\u0E23\u0E31\u0E1A\u0E40\u0E0A\u0E34\u0E0D\u0E43\u0E2B\u0E49\u0E43\u0E0A\u0E49\u0E07\u0E32\u0E19\u0E23\u0E30\u0E1A\u0E1A\u0E08\u0E31\u0E14\u0E01\u0E32\u0E23\u0E40\u0E19\u0E37\u0E49\u0E2D\u0E2B\u0E32",
     [
       `\u0E21\u0E35\u0E1A\u0E31\u0E0D\u0E0A\u0E35\u0E2A\u0E33\u0E2B\u0E23\u0E31\u0E1A ${user.email} \u0E23\u0E2D\u0E04\u0E38\u0E13\u0E2D\u0E22\u0E39\u0E48 \u0E15\u0E31\u0E49\u0E07\u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E48\u0E32\u0E19\u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E40\u0E23\u0E34\u0E48\u0E21\u0E43\u0E0A\u0E49\u0E07\u0E32\u0E19`,
@@ -689,6 +735,9 @@ async function fakeVerify(password) {
   return false;
 }
 
+// src/auth/sso.ts
+import { createHmac as createHmac2, randomBytes as randomBytes4 } from "crypto";
+
 // src/auth/tokens.ts
 import { createHash as createHash2, createHmac, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual3 } from "crypto";
 function newToken() {
@@ -770,14 +819,279 @@ function passwordTokenMatches(secret, token, fingerprint) {
   return safeEqual(token.slice(dot + 1), hmac(secret, `password:${payload}:${fingerprint}`));
 }
 
+// src/auth/sso.ts
+var SSO_COOKIE = "ecms-sso";
+var PENDING_TTL = 10 * 6e4;
+var random = () => randomBytes4(32).toString("base64url");
+function sign(secret, payload) {
+  return createHmac2("sha256", secret).update(`sso:${payload}`).digest("base64url");
+}
+function seal(secret, pending) {
+  const payload = Buffer.from(JSON.stringify(pending)).toString("base64url");
+  return `${payload}.${sign(secret, payload)}`;
+}
+function unseal(secret, value) {
+  if (!value) return null;
+  const dot = value.lastIndexOf(".");
+  if (dot <= 0) return null;
+  const payload = value.slice(0, dot);
+  if (!safeEqual(value.slice(dot + 1), sign(secret, payload))) return null;
+  try {
+    const pending = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    return typeof pending.e === "number" && pending.e > Date.now() ? pending : null;
+  } catch {
+    return null;
+  }
+}
+var SingleSignOn = class {
+  constructor(cms) {
+    this.cms = cms;
+  }
+  cms;
+  get config() {
+    return this.cms.config;
+  }
+  get enabled() {
+    return this.config.auth.providers.length > 0;
+  }
+  providers() {
+    return this.config.auth.providers.map((p) => ({
+      id: p.id,
+      name: p.name,
+      icon: p.icon ?? "key"
+    }));
+  }
+  /** Whether a user may sign in with a password (`auth.password: false` leaves only admins). */
+  passwordAllowed(user) {
+    return this.config.auth.password || user.role === "admin";
+  }
+  /** `<serverURL><api>/auth/<id>/callback`, or `null` without `serverURL` in production. */
+  callbackURL(provider, origin) {
+    const base = this.cms.auth.passwordLinkBase(origin);
+    return base ? `${base}${this.config.routes.api}/auth/${provider}/callback` : null;
+  }
+  /**
+   * Starts signing in (or, with `user`, linking an account): the provider's URL to send the
+   * browser to, and the sealed value of the cookie that must come back with it.
+   */
+  async start(providerId, options) {
+    const provider = this.provider(providerId);
+    const redirectUri = this.callbackURL(provider.id, options.origin);
+    if (!redirectUri)
+      throw new QueryError("Signing in with providers needs `serverURL` in production");
+    const pending = {
+      p: provider.id,
+      s: random(),
+      v: random(),
+      n: random(),
+      r: this.adminPage(options.redirect),
+      ...options.user ? { u: String(options.user.id) } : {},
+      e: Date.now() + PENDING_TTL
+    };
+    const url = await provider.authorizationURL({
+      redirectUri,
+      state: pending.s,
+      codeVerifier: pending.v,
+      nonce: pending.n
+    });
+    return { url: url.toString(), cookie: seal(this.config.secret, pending) };
+  }
+  /**
+   * Finishes at `<api>/auth/<id>/callback`: checks the response, finds (or makes) the user and
+   * starts a session. Returns where to send the browser; failures end on the login page (or the
+   * account page, when linking) with `?sso=<outcome>`.
+   */
+  async finish(providerId, options) {
+    const admin = this.config.admin.path.replace(/\/+$/, "");
+    const pending = unseal(this.config.secret, options.cookie);
+    const back = (page2, outcome) => ({ redirect: `${admin}/${page2}?sso=${outcome}` });
+    const page = pending?.u ? "account" : "login";
+    if (!pending || pending.p !== providerId) return back(page, "expired");
+    const state = options.url.searchParams.get("state") ?? "";
+    if (!safeEqual(state, pending.s)) return back(page, "expired");
+    if (options.url.searchParams.has("error")) return back(page, "cancelled");
+    const provider = this.provider(providerId);
+    const redirectUri = this.callbackURL(provider.id, options.origin);
+    let profile;
+    try {
+      if (!redirectUri) throw new Error("no callback URL");
+      profile = await provider.callback({
+        redirectUri,
+        state: pending.s,
+        codeVerifier: pending.v,
+        nonce: pending.n,
+        url: options.url
+      });
+    } catch (error) {
+      this.cms.logger.warn(
+        `Signing in with ${provider.name} failed: ${error.message || String(error)}`
+      );
+      return back(page, "failed");
+    }
+    const subject = String(profile.subject);
+    const email2 = profile.email?.trim().toLowerCase() || null;
+    if (pending.u) {
+      if (!options.user || String(options.user.id) !== pending.u) return back("account", "failed");
+      const existing = await this.identity(provider.id, subject);
+      if (existing && String(existing.user) !== pending.u) return back("account", "taken");
+      if (!existing) await this.addIdentity(options.user.id, provider.id, subject, email2);
+      return { redirect: `${admin}/account?sso=linked` };
+    }
+    let user = null;
+    const identity = await this.identity(provider.id, subject);
+    if (identity) {
+      user = await this.cms.db.findById({ collection: USERS, id: identity.user });
+    } else {
+      if (!email2 || !profile.emailVerified)
+        return back("login", email2 ? "unverified" : "no-account");
+      user = await this.userByEmail(email2);
+      if (!user) user = await this.signUp(email2, profile.name);
+      if (!user) return back("login", "no-account");
+      await this.addIdentity(user.id, provider.id, subject, email2);
+    }
+    if (!user) return back("login", "no-account");
+    if (user.active === false) return back("login", "inactive");
+    const found = identity ?? await this.identity(provider.id, subject);
+    if (found) {
+      const { id, ...rest } = found;
+      await this.cms.db.update({
+        collection: USER_IDENTITIES,
+        id,
+        data: { ...rest, email: email2, lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }
+      });
+    }
+    return { redirect: pending.r, session: await this.cms.auth.createSession(user.id) };
+  }
+  /** A user's outside accounts. */
+  async identities(userId) {
+    if (!this.enabled) return [];
+    const { docs } = await this.cms.db.find({
+      collection: USER_IDENTITIES,
+      where: { user: { equals: userId } },
+      sort: ["id"],
+      limit: 0,
+      page: 1
+    });
+    return docs.map((row) => ({
+      id: row.id,
+      provider: String(row.provider),
+      name: this.config.auth.providers.find((p) => p.id === row.provider)?.name ?? String(row.provider),
+      email: typeof row.email === "string" ? row.email : null,
+      createdAt: String(row.createdAt),
+      lastUsedAt: typeof row.lastUsedAt === "string" ? row.lastUsedAt : null
+    }));
+  }
+  /**
+   * Unlinks an outside account: the user's own, or anyone's for admins. Refuses to unlink the
+   * last way a user has to sign in.
+   */
+  async unlink(actor, identityId) {
+    if (!this.enabled) throw new NotFoundError(USER_IDENTITIES, identityId);
+    const row = await this.cms.db.findById({ collection: USER_IDENTITIES, id: identityId });
+    if (!row) throw new NotFoundError(USER_IDENTITIES, identityId);
+    const own = String(row.user) === String(actor.id);
+    if (!own && (actor.role !== "admin" || actor.apiKey)) throw new ForbiddenError();
+    const user = await this.cms.db.findById({ collection: USERS, id: row.user });
+    const others = (await this.identities(row.user)).length - 1;
+    const password = !!user?.passwordHash && this.passwordAllowed(user);
+    if (others === 0 && !password)
+      throw new ValidationError(USER_IDENTITIES, [
+        { field: "provider", message: "is the only way left to sign in to this account" }
+      ]);
+    await this.cms.db.delete({ collection: USER_IDENTITIES, id: row.id });
+  }
+  /** Forgets a deleted user's outside accounts. */
+  async forget(userId) {
+    if (!this.enabled) return;
+    for (const identity of await this.identities(userId))
+      await this.cms.db.delete({ collection: USER_IDENTITIES, id: identity.id });
+  }
+  settings(origin) {
+    const { allowSignUp } = this.config.auth;
+    return {
+      providers: this.config.auth.providers.map((p) => ({
+        id: p.id,
+        name: p.name,
+        icon: p.icon ?? "key",
+        callbackURL: this.callbackURL(p.id, origin),
+        details: { ...p.describe?.() ?? {} }
+      })),
+      password: this.config.auth.password ? "everyone" : "admins",
+      signUp: allowSignUp.domains.length > 0 ? { domains: [...allowSignUp.domains], role: allowSignUp.role ?? this.defaultRole() } : null,
+      serverURL: !!this.config.serverURL
+    };
+  }
+  // -------------------------------------------------------------------------
+  provider(id) {
+    const provider = this.config.auth.providers.find((p) => p.id === id);
+    if (!provider) throw new NotFoundError("auth providers", id);
+    return provider;
+  }
+  /** Only pages of the admin: anything else (another site) goes to the admin's home. */
+  adminPage(redirect) {
+    const admin = this.config.admin.path.replace(/\/+$/, "");
+    if (typeof redirect === "string" && (redirect === admin || redirect.startsWith(`${admin}/`)) && !redirect.startsWith("//") && !redirect.includes("\\"))
+      return redirect;
+    return `${admin}/`;
+  }
+  async identity(provider, subject) {
+    const { docs } = await this.cms.db.find({
+      collection: USER_IDENTITIES,
+      where: { and: [{ provider: { equals: provider } }, { subject: { equals: subject } }] },
+      sort: [],
+      limit: 1,
+      page: 1
+    });
+    return docs[0];
+  }
+  async addIdentity(user, provider, subject, email2) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    await this.cms.db.create({
+      collection: USER_IDENTITIES,
+      data: { user, provider, subject, email: email2, lastUsedAt: now, createdAt: now, updatedAt: now }
+    });
+  }
+  async userByEmail(email2) {
+    const { docs } = await this.cms.db.find({
+      collection: USERS,
+      where: { email: { equals: email2 } },
+      sort: [],
+      limit: 1,
+      page: 1
+    });
+    return docs[0] ?? null;
+  }
+  /** A new account for people from `allowSignUp.domains`. */
+  async signUp(email2, name) {
+    const { domains, role } = this.config.auth.allowSignUp;
+    const domain = email2.slice(email2.lastIndexOf("@") + 1);
+    if (!domains.some((d) => d.toLowerCase() === domain)) return null;
+    const created = await this.cms.create(USERS, {
+      email: email2,
+      role: role ?? this.defaultRole(),
+      active: true,
+      ...name ? { name } : {}
+    });
+    this.cms.logger.info(`${email2} signed up with a provider`);
+    return this.cms.db.findById({ collection: USERS, id: created.id });
+  }
+  defaultRole() {
+    const roles = this.config.auth.roles;
+    return roles.includes("editor") ? "editor" : roles[roles.length - 1];
+  }
+};
+
 // src/auth/auth.ts
 var INVALID = "Invalid email or password";
 var RESET_REQUESTS = 3;
 var Auth = class {
   constructor(cms) {
     this.cms = cms;
+    this.sso = new SingleSignOn(cms);
   }
   cms;
+  /** Signing in with outside accounts (`auth.providers`). */
+  sso;
   get db() {
     return this.cms.db;
   }
@@ -804,6 +1118,10 @@ var Auth = class {
       throw new UnauthorizedError(INVALID);
     }
     await this.clearFailures(key2);
+    if (!this.sso.passwordAllowed(user))
+      throw new UnauthorizedError(
+        `Sign in with ${this.config.auth.providers.map((p) => p.name).join(" or ")}`
+      );
     await this.deleteExpiredSessions(user.id);
     return this.startSession(user);
   }
@@ -903,7 +1221,7 @@ var Auth = class {
     if (recent >= RESET_REQUESTS) return;
     await this.recordFailure(key2);
     const user = await this.findByEmail(email2);
-    if (!user || user.active === false) return;
+    if (!user || user.active === false || !this.sso.passwordAllowed(user)) return;
     await this.mailPasswordLink(user, user.passwordHash ? "reset" : "invite", args);
   }
   /**
@@ -959,7 +1277,7 @@ var Auth = class {
     if (!claims || claims.expiresAt <= Date.now()) return null;
     const id = /^\d+$/.test(claims.userId) ? Number(claims.userId) : claims.userId;
     const user = await this.db.findById({ collection: USERS, id });
-    if (!user || user.active === false) return null;
+    if (!user || user.active === false || !this.sso.passwordAllowed(user)) return null;
     const fingerprint = passwordFingerprint(user.passwordHash);
     if (!passwordTokenMatches(this.config.secret, token, fingerprint)) return null;
     return { user, purpose: claims.purpose };
@@ -974,13 +1292,14 @@ var Auth = class {
       expiresAt,
       fingerprint: passwordFingerprint(user.passwordHash)
     });
-    const url = `${base}${this.config.admin.path}/reset-password?token=${encodeURIComponent(token)}`;
+    const sso = this.sso.passwordAllowed(user) ? void 0 : this.config.auth.providers.map((p) => p.name);
+    const url = sso ? `${base}${this.config.admin.path}/login` : `${base}${this.config.admin.path}/reset-password?token=${encodeURIComponent(token)}`;
     const write = purpose === "invite" ? this.config.auth.emails.invite ?? DEFAULT_PASSWORD_EMAILS.invite : this.config.auth.emails.resetPassword ?? DEFAULT_PASSWORD_EMAILS.resetPassword;
     const content = await write({
       user: await this.toAuthUser(user),
       url,
       locale: this.localeOf(options.locale),
-      expiresAt: new Date(expiresAt)
+      ...sso ? { sso } : { expiresAt: new Date(expiresAt) }
     });
     await this.cms.sendEmail({ to: String(user.email), ...content });
   }
@@ -1361,6 +1680,7 @@ async function runBackup(cms, record) {
     const filename = filenameFor(cms, started);
     const key2 = await storage.get(filename) ? filename.replace(/\.db\.gz$/, `-${row.id}.db.gz`) : filename;
     await storage.put(key2, data, { contentType: "application/gzip" });
+    await pruneBackups(cms, 1);
     row = await update(cms, row, {
       state: "done",
       filename: key2,
@@ -1368,7 +1688,6 @@ async function runBackup(cms, record) {
       finishedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
     cms.logger.info(`Backup ${key2} written (${data.byteLength} bytes)`);
-    await pruneBackups(cms);
   } catch (error) {
     await update(cms, row, {
       state: "failed",
@@ -1380,8 +1699,8 @@ async function runBackup(cms, record) {
     await rm2(dir, { recursive: true, force: true });
   }
 }
-async function pruneBackups(cms) {
-  const keep = cms.config.backups?.keep ?? DEFAULT_BACKUP_KEEP;
+async function pruneBackups(cms, room = 0) {
+  const keep = Math.max(0, (cms.config.backups?.keep ?? DEFAULT_BACKUP_KEEP) - room);
   const storage = await backupStorage(cms);
   const { docs } = await cms.db.find({
     collection: DATABASE_BACKUPS,
@@ -2313,6 +2632,7 @@ var VersionStore = class {
 // src/roles.ts
 var ROLE_OPERATIONS = ["read", "create", "update", "delete", "publish"];
 var GLOBAL_OPERATIONS = ["read", "update", "publish"];
+var OWN_OPERATIONS = ["read", "update", "delete", "publish"];
 var KEY = /^[a-z][a-z0-9-]{0,31}$/;
 var HISTORY = 50;
 var TTL = 3e4;
@@ -2328,6 +2648,9 @@ var rolesCollection = {
 function governed(slug2) {
   return !INTERNAL_COLLECTIONS.has(slug2) && slug2 !== API_KEYS;
 }
+function ruleFields(fields) {
+  return fields.filter((f) => !f.hidden && f.name !== "createdBy");
+}
 function references(fields, out = /* @__PURE__ */ new Set()) {
   for (const field of fields) {
     if (field.type === "relationship") out.add(field.to);
@@ -2343,14 +2666,16 @@ var viewId = {
 };
 var tagOf = (component) => typeof component === "string" ? component : component.tag;
 var Roles = class {
-  constructor(config, db) {
+  constructor(config, db, log) {
     this.config = config;
     this.db = db;
+    this.log = log;
     this.enabled = config.auth.rbac;
     this.versions = new VersionStore(db);
   }
   config;
   db;
+  log;
   enabled;
   versions;
   cache;
@@ -2364,7 +2689,13 @@ var Roles = class {
     if ("collection" in target && !governed(target.collection)) return true;
     const permissions = await this.permissionsOf(user.role);
     const ops = "collection" in target ? permissions.collections?.[target.collection] : permissions.globals?.[target.global];
-    if (ops?.includes(operation)) return true;
+    if (ops?.includes(operation)) {
+      if ("collection" in target && permissions.own?.[target.collection]?.includes(operation)) {
+        const owner = this.ownerOf(target.collection);
+        if (owner && operation !== "create") return { [owner]: { equals: user.id } };
+      }
+      return true;
+    }
     if ("collection" in target && target.collection === USERS) {
       if (operation === "read" || operation === "update") return { id: { equals: user.id } };
     }
@@ -2380,6 +2711,76 @@ var Roles = class {
     if (!this.enabled) return id.startsWith("page:") || id.startsWith("widget:");
     return (await this.permissionsOf(user.role)).admin?.includes(id) ?? false;
   }
+  /**
+   * The field that names a collection's owner, for "own documents only": `admin.ownerField`, or
+   * `createdBy`. `undefined` without roles, and for users and collections roles don't cover.
+   */
+  ownerOf(slug2) {
+    if (!this.enabled || slug2 === USERS || !governed(slug2)) return void 0;
+    const config = this.config.collections.find((c) => c.slug === slug2);
+    if (!config) return void 0;
+    return config.admin?.ownerField ?? "createdBy";
+  }
+  /**
+   * The user's field rules (top-level fields their role may only read, or not see), for field
+   * access checks. Roles that may update only their own documents can't change the owner field.
+   */
+  async fieldRules(user) {
+    if (!this.enabled || !user || user.role === "admin") return void 0;
+    await this.load();
+    const cache = this.cache;
+    const cached = cache?.rules.get(user.role);
+    if (cached) return cached;
+    const permissions = await this.permissionsOf(user.role);
+    const rules = /* @__PURE__ */ new Map();
+    const add = (fields, set) => {
+      for (const field of fields) {
+        const rule = set?.[field.name];
+        if (rule === "read" || rule === "hidden") rules.set(field, rule);
+      }
+    };
+    for (const c of this.config.collections) {
+      if (!governed(c.slug)) continue;
+      add(c.fields, permissions.fields?.collections?.[c.slug]);
+      const ownerField = c.admin?.ownerField;
+      if (ownerField && permissions.own?.[c.slug]?.includes("update")) {
+        const field = c.fields.find((f) => f.name === ownerField);
+        if (field && !rules.has(field)) rules.set(field, "read");
+      }
+    }
+    for (const g of this.config.globals) add(g.fields, permissions.fields?.globals?.[g.slug]);
+    cache?.rules.set(user.role, rules);
+    return rules;
+  }
+  /** A new document is its creator's: sets `createdBy`, and an empty owner field. */
+  fillOwner(slug2, data, user) {
+    if (!user || !this.ownerOf(slug2)) return;
+    data.createdBy ??= user.id;
+    const ownerField = this.config.collections.find((c) => c.slug === slug2)?.admin?.ownerField;
+    if (ownerField && (data[ownerField] === void 0 || data[ownerField] === null))
+      data[ownerField] = user.id;
+  }
+  /** Documents a user owns, by collection (`createdBy` and owner fields), for deleting them. */
+  async owned(userId) {
+    const out = [];
+    for (const c of this.config.collections) {
+      const columns = this.ownerColumns(c.slug);
+      if (columns.length === 0) continue;
+      const count = await this.db.count({
+        collection: c.slug,
+        where: { or: columns.map((column) => ({ [column]: { equals: userId } })) }
+      });
+      if (count > 0) out.push({ collection: c.slug, count });
+    }
+    return out;
+  }
+  /** Gives a deleted user's documents to another user, or to nobody (`null`). */
+  async transfer(from, to) {
+    for (const c of this.config.collections) {
+      for (const column of this.ownerColumns(c.slug))
+        await this.setWhere(c.slug, { [column]: { equals: from } }, column, to);
+    }
+  }
   /** Forgets cached permissions, after a role changed. */
   invalidate() {
     this.cache = void 0;
@@ -2409,6 +2810,39 @@ var Roles = class {
       }
     }
     this.invalidate();
+    await this.backfillCreators();
+  }
+  /**
+   * Documents from before roles have no `createdBy`: it is filled from who saved their first
+   * version, for collections with versions. Only while no document of the collection has one,
+   * so it runs once (and finds nothing to do afterwards).
+   */
+  async backfillCreators() {
+    for (const c of this.config.collections) {
+      if (!c.versions || !this.ownerOf(c.slug)) continue;
+      if (await this.db.count({ collection: c.slug, where: { createdBy: { exists: true } } }) > 0)
+        continue;
+      const versions = await this.db.find({
+        collection: VERSIONS,
+        where: { and: [{ parent: { equals: c.slug } }, { author: { exists: true } }] },
+        sort: ["id"],
+        limit: 0,
+        page: 1
+      });
+      const first = /* @__PURE__ */ new Map();
+      for (const v of versions.docs) {
+        if (!first.has(v.doc) && v.author !== null) first.set(v.doc, v.author);
+      }
+      let filled = 0;
+      for (const [doc, author] of first) {
+        const row = await this.db.findById({ collection: c.slug, id: doc });
+        if (!row || row.createdBy !== null && row.createdBy !== void 0) continue;
+        const { id, ...rest } = row;
+        await this.db.update({ collection: c.slug, id, data: { ...rest, createdBy: author } });
+        filled++;
+      }
+      if (filled > 0) this.log?.(`Set who created ${filled} ${c.slug} from their history`);
+    }
   }
   /** Whether a role exists (users can only be given existing roles). */
   async exists(key2) {
@@ -2437,16 +2871,24 @@ var Roles = class {
     const seen = (group, slug2) => decided.some((p) => p[group]?.[slug2] !== void 0);
     return {
       roles,
-      collections: this.config.collections.filter((c) => governed(c.slug)).map((c) => ({
-        slug: c.slug,
-        ops: ROLE_OPERATIONS.filter((op) => op !== "publish" || c.drafts === true),
-        new: !seen("collections", c.slug),
-        references: [...references(c.fields)].filter((s) => s !== c.slug && governed(s))
-      })),
+      collections: this.config.collections.filter((c) => governed(c.slug)).map((c) => {
+        const owner = this.ownerOf(c.slug);
+        return {
+          slug: c.slug,
+          ops: ROLE_OPERATIONS.filter((op) => op !== "publish" || c.drafts === true),
+          new: !seen("collections", c.slug),
+          references: [...references(ruleFields(c.fields))].filter(
+            (s) => s !== c.slug && governed(s)
+          ),
+          fields: adminFields(c.fields, c.admin?.ownerField),
+          ...owner ? { owner } : {}
+        };
+      }),
       globals: this.config.globals.map((g) => ({
         slug: g.slug,
         ops: GLOBAL_OPERATIONS.filter((op) => op !== "publish" || g.drafts === true),
-        new: !seen("globals", g.slug)
+        new: !seen("globals", g.slug),
+        fields: adminFields(g.fields, void 0)
       })),
       views: this.views()
     };
@@ -2560,9 +3002,9 @@ var Roles = class {
       for (const [slug2, ops] of Object.entries(group)) {
         const valid = allowed2.get(slug2);
         if (!valid || !Array.isArray(ops)) continue;
-        const picked = valid.filter((op) => ops.includes(op));
-        if (picked.length > 0 && !picked.includes("read")) picked.unshift("read");
-        out[slug2] = picked;
+        const picked2 = valid.filter((op) => ops.includes(op));
+        if (picked2.length > 0 && !picked2.includes("read")) picked2.unshift("read");
+        out[slug2] = picked2;
       }
       return out;
     };
@@ -2584,11 +3026,71 @@ var Roles = class {
         input.admin.filter((id) => typeof id === "string" && views.has(id))
       )
     ] : [];
-    return {
+    const picked = {
       collections: pick(input.collections, collections),
-      globals: pick(input.globals, globals),
-      admin
+      globals: pick(input.globals, globals)
+    };
+    const own = {};
+    if (typeof input.own === "object" && input.own !== null) {
+      for (const [slug2, ops] of Object.entries(input.own)) {
+        const granted = picked.collections[slug2];
+        if (!granted || !this.ownerOf(slug2) || !Array.isArray(ops)) continue;
+        const valid = OWN_OPERATIONS.filter((op) => granted.includes(op) && ops.includes(op));
+        if (valid.length > 0) own[slug2] = valid;
+      }
+    }
+    const fields = {
+      collections: this.cleanRules(
+        input.fields?.collections,
+        this.config.collections.filter((c) => governed(c.slug)),
+        picked.collections
+      ),
+      globals: this.cleanRules(
+        input.fields?.globals,
+        this.config.globals,
+        void 0
+      )
     };
+    return { ...picked, admin, own, fields };
+  }
+  /**
+   * Keeps rules for known top-level fields. A field that must be filled in (required, without a
+   * default) can't be read-only or hidden for a role that creates documents.
+   */
+  cleanRules(value, containers, granted) {
+    const out = {};
+    if (typeof value !== "object" || value === null) return out;
+    for (const [slug2, rules] of Object.entries(value)) {
+      const container = containers.find((c) => c.slug === slug2);
+      if (!container || typeof rules !== "object" || rules === null) continue;
+      const set = {};
+      for (const field of ruleFields(container.fields)) {
+        const rule = rules[field.name];
+        if (rule !== "read" && rule !== "hidden") continue;
+        if (granted?.[slug2]?.includes("create") && mustFill(field))
+          throw new ValidationError(ROLES, [
+            {
+              field: `fields.${slug2}.${field.name}`,
+              message: "is required: roles that create documents must be able to fill it"
+            }
+          ]);
+        set[field.name] = rule;
+      }
+      if (Object.keys(set).length > 0) out[slug2] = set;
+    }
+    return out;
+  }
+  /** Fields that name a collection's owner (`createdBy`, and `admin.ownerField`). */
+  ownerColumns(slug2) {
+    if (!this.ownerOf(slug2)) return [];
+    const ownerField = this.config.collections.find((c) => c.slug === slug2)?.admin?.ownerField;
+    return ownerField ? ["createdBy", ownerField] : ["createdBy"];
+  }
+  /** Sets one field of every matching document, keeping the rest as stored. */
+  async setWhere(collection2, where, field, value) {
+    const { docs } = await this.db.find({ collection: collection2, where, sort: ["id"], limit: 0, page: 1 });
+    for (const { id, ...rest } of docs)
+      await this.db.update({ collection: collection2, id, data: { ...rest, [field]: value } });
   }
   cleanName(value) {
     if (value === void 0 || value === null) return "";
@@ -2607,7 +3109,7 @@ var Roles = class {
     const byKey = /* @__PURE__ */ new Map();
     for (const row of await this.rows())
       byKey.set(String(row.key), row.permissions ?? {});
-    this.cache = { at: Date.now(), byKey };
+    this.cache = { at: Date.now(), byKey, rules: /* @__PURE__ */ new Map() };
     return byKey;
   }
   async rows() {
@@ -2655,13 +3157,24 @@ var Roles = class {
     };
   }
 };
+function mustFill(field) {
+  return field.required === true && field.defaultValue === void 0;
+}
+function adminFields(fields, ownerField) {
+  return ruleFields(fields).map((f) => ({
+    name: f.name,
+    ...f.label !== void 0 ? { label: f.label } : {},
+    required: mustFill(f),
+    ...f.name === ownerField ? { owner: true } : {}
+  }));
+}
 function rank(role, config) {
   const index = config.auth.roles.indexOf(role.key);
   return index === -1 ? config.auth.roles.length : index;
 }
 
 // src/webhooks.ts
-import { createHmac as createHmac2, randomUUID as randomUUID2 } from "crypto";
+import { createHmac as createHmac3, randomUUID as randomUUID2 } from "crypto";
 var WEBHOOK_EVENTS = [
   "create",
   "update",
@@ -2805,7 +3318,7 @@ var Webhooks = class {
       ...hook.headers
     };
     if (hook.secret) {
-      headers["x-easy-cms-signature"] = `sha256=${createHmac2("sha256", hook.secret).update(body).digest("hex")}`;
+      headers["x-easy-cms-signature"] = `sha256=${createHmac3("sha256", hook.secret).update(body).digest("hex")}`;
     }
     try {
       const response = await this.fetcher(hook.url, {
@@ -2852,8 +3365,10 @@ var RESERVED_SLUGS = /* @__PURE__ */ new Set([
   "email-deliveries",
   "database-backups",
   "user-roles",
+  "user-identities",
   "api-keys",
   "jobs",
+  "auth",
   "migrations",
   "access"
 ]);
@@ -2908,7 +3423,10 @@ function validateConfig(config) {
   if (apiKeys !== void 0 && typeof apiKeys !== "boolean") add("apiKeys", "must be true or false");
   collections.forEach((collection2, i) => {
     const path = `collections.${collection2.slug ?? `[${i}]`}`;
-    validateContainer(collection2, path, collectionSlugs, add);
+    validateContainer(collection2, path, collectionSlugs, add, {
+      collection: true,
+      rbac: config.auth?.rbac === true
+    });
     validateUseAsTitle(collection2, path, add);
     validateIcon(collection2, path, add);
     const editIn = collection2.editIn;
@@ -2917,7 +3435,10 @@ function validateConfig(config) {
   });
   globals.forEach((global2, i) => {
     const path = `globals.${global2.slug ?? `[${i}]`}`;
-    validateContainer(global2, path, collectionSlugs, add);
+    validateContainer(global2, path, collectionSlugs, add, {
+      collection: false,
+      rbac: config.auth?.rbac === true
+    });
     validateIcon(global2, path, add);
   });
   const plugins = config.plugins;
@@ -3095,6 +3616,52 @@ function validateAuth(config, add) {
   if (auth === void 0) return;
   if (auth.rbac !== void 0 && typeof auth.rbac !== "boolean")
     add("auth.rbac", "must be true or false");
+  if (auth.password !== void 0 && typeof auth.password !== "boolean")
+    add("auth.password", "must be true or false");
+  const providers = auth.providers;
+  if (providers !== void 0) {
+    if (!Array.isArray(providers)) {
+      add(
+        "auth.providers",
+        "must be an array",
+        "e.g. providers: [google({ clientId, clientSecret })]"
+      );
+    } else {
+      const ids = /* @__PURE__ */ new Set();
+      providers.forEach((provider, i) => {
+        const p = provider;
+        const path = `auth.providers[${i}]`;
+        if (typeof p !== "object" || p === null || typeof p.authorizationURL !== "function" || typeof p.callback !== "function") {
+          add(
+            path,
+            "must be a provider",
+            "e.g. google({ clientId, clientSecret }) from @easy-cms/auth-oauth"
+          );
+          return;
+        }
+        if (typeof p.id !== "string" || !PAGE_PATH.test(p.id))
+          add(`${path}.id`, 'must be lowercase letters, digits and "-"');
+        else if (ids.has(p.id))
+          add(`${path}.id`, `"${p.id}" is used by another provider`, "give one of them its own id");
+        else ids.add(p.id);
+        if (typeof p.name !== "string" || p.name.trim() === "")
+          add(`${path}.name`, "must be a name");
+      });
+    }
+  }
+  const signUp = auth.allowSignUp;
+  if (signUp !== void 0) {
+    if (typeof signUp !== "object" || signUp === null || !Array.isArray(signUp.domains) || signUp.domains.some((d) => typeof d !== "string" || !/^[a-z0-9.-]+\.[a-z]{2,}$/i.test(d)))
+      add("auth.allowSignUp.domains", "must be email domains", "e.g. domains: ['example.com']");
+    if (signUp?.role === "admin")
+      add("auth.allowSignUp.role", `can't be "admin"`, "make admins by hand, in Settings \u2192 Users");
+    else if (signUp?.role !== void 0 && (typeof signUp.role !== "string" || !auth.rbac && !(auth.roles ?? ["admin", "editor"]).includes(signUp.role)))
+      add("auth.allowSignUp.role", "must be one of auth.roles");
+    if (!Array.isArray(providers) || providers.length === 0)
+      add("auth.allowSignUp", "needs auth.providers");
+  }
+  if (auth.password === false && (!Array.isArray(providers) || providers.length === 0))
+    add("auth.password", "false needs auth.providers", "otherwise only admins could sign in");
   if (auth.roles !== void 0) {
     const roles = auth.roles;
     if (!Array.isArray(roles) || roles.some((r) => typeof r !== "string" || r === "")) {
@@ -3361,7 +3928,7 @@ function checkSlug(container, path, seen, add) {
   seen.add(slug2);
   return slug2;
 }
-function validateContainer(container, path, collectionSlugs, add) {
+function validateContainer(container, path, collectionSlugs, add, { collection: collection2, rbac }) {
   if (!Array.isArray(container.fields)) {
     add(`${path}.fields`, "must be an array");
     return;
@@ -3398,8 +3965,25 @@ function validateContainer(container, path, collectionSlugs, add) {
         add(`${path}.admin.group`, `must be 'settings' (got ${JSON.stringify(group)})`);
       const list = admin.list;
       if (list !== void 0) validateList(list, container, `${path}.admin.list`, add);
+      const owner = admin.ownerField;
+      if (owner !== void 0) {
+        const field = container.fields.find((f) => f.name === owner);
+        if (!collection2 || container.slug === "users" || field?.type !== "relationship" || field.to !== "users" || field.hasMany)
+          add(
+            `${path}.admin.ownerField`,
+            'must name a relationship field to "users" (not hasMany) of a collection',
+            "e.g. { name: 'author', type: 'relationship', to: 'users' }"
+          );
+      }
     }
   }
+  const createdBy = container.fields.find((f) => f.name === CREATED_BY_FIELD.name);
+  if (rbac && createdBy && createdBy !== CREATED_BY_FIELD)
+    add(
+      `${path}.fields.createdBy`,
+      '"createdBy" is added by Easy CMS with auth.rbac',
+      "rename the field; to use it as the owner, set admin.ownerField"
+    );
   const reserved = new Set(SYSTEM_FIELD_NAMES);
   if (container.drafts) reserved.add("status");
   validateFields2(container.fields, `${path}.fields`, reserved, collectionSlugs, add);
@@ -3604,7 +4188,15 @@ function validateComponents(components, path, add) {
 }
 var ENDPOINT_METHODS = ["get", "post", "put", "patch", "delete"];
 var ENDPOINT_SEGMENT = /^(:[A-Za-z_][A-Za-z0-9_]*|[A-Za-z0-9._~-]+)$/;
-var RESERVED_ENDPOINT_ROOTS = /* @__PURE__ */ new Set(["users", "globals", "admin", "jobs", "media", "api-keys"]);
+var RESERVED_ENDPOINT_ROOTS = /* @__PURE__ */ new Set([
+  "users",
+  "globals",
+  "admin",
+  "jobs",
+  "media",
+  "api-keys",
+  "auth"
+]);
 function validateCommands(config, add) {
   const commands = config.commands;
   if (commands === void 0) return;
@@ -3753,7 +4345,7 @@ async function resolveConfig(input) {
   if (resolved.has(input)) return input;
   let config = await applyPlugins(input);
   if (typeof config === "object" && config !== null && Array.isArray(config.collections ?? [])) {
-    config = withMedia(withUsers(config));
+    config = withCreatedBy(withMedia(withUsers(config)));
   }
   const applied = applyFieldTypes(config);
   config = applied.config;
@@ -3790,6 +4382,9 @@ async function resolveConfig(input) {
     auth: {
       roles: config.auth?.roles ?? DEFAULT_ROLES,
       rbac: config.auth?.rbac === true,
+      providers: config.auth?.providers ?? [],
+      allowSignUp: config.auth?.allowSignUp ?? { domains: [] },
+      password: config.auth?.password !== false,
       tokenExpiration: config.auth?.tokenExpiration ?? DEFAULT_TOKEN_EXPIRATION,
       maxLoginAttempts: config.auth?.maxLoginAttempts ?? 5,
       lockWindow: config.auth?.lockWindow ?? 15 * 60,
@@ -3808,7 +4403,8 @@ async function resolveConfig(input) {
       ...config.apiKeys ? [apiKeysCollection] : [],
       ...config.email ? [emailDeliveriesCollection] : [],
       databaseBackupsCollection,
-      ...config.auth?.rbac ? [rolesCollection] : []
+      ...config.auth?.rbac ? [rolesCollection] : [],
+      ...(config.auth?.providers?.length ?? 0) > 0 ? [userIdentitiesCollection] : []
     ],
     globals: config.globals ?? [],
     endpoints: config.endpoints ?? [],
@@ -3874,7 +4470,7 @@ async function loadConfig(options = {}) {
 }
 
 // src/local-api.ts
-import { randomBytes as randomBytes4 } from "crypto";
+import { randomBytes as randomBytes5 } from "crypto";
 
 // src/localization.ts
 var ALL_LOCALES = "all";
@@ -4071,10 +4667,10 @@ function imageDimensions(data, type) {
   }
   return void 0;
 }
-function storageKey(originalName, type, random) {
+function storageKey(originalName, type, random2) {
   const name = originalName.split(/[\\/]/).pop() ?? "";
   const base = name.replace(/(?<=.)\.[^.]*$/, "").normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{M}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "file";
-  return `${base}-${random}.${EXTENSIONS[type] ?? "bin"}`;
+  return `${base}-${random2}.${EXTENSIONS[type] ?? "bin"}`;
 }
 
 // src/populate.ts
@@ -4402,7 +4998,7 @@ var EasyCMS = class {
     this.storage = storage;
     this.cwd = cwd;
     this.versions = new VersionStore(db);
-    this.roles = new Roles(config, db);
+    this.roles = new Roles(config, db, (message2) => logger.info(message2));
     this.webhooks = new Webhooks(
       config.webhooks ?? [],
       logger,
@@ -4429,6 +5025,7 @@ var EasyCMS = class {
       options
     );
     const requested = options.sort === void 0 ? ["-createdAt"] : [options.sort].flat();
+    await this.checkQueryFields(config, guard, void 0, requested);
     const locale = this.localeOf(options);
     const sort = locale === void 0 ? requested : localizeSort(
       config.fields,
@@ -4512,8 +5109,8 @@ var EasyCMS = class {
         }
       ]);
     }
-    const random = randomBytes4(4).toString("hex");
-    const filename = storageKey(file.name, mimeType, random);
+    const random2 = randomBytes5(4).toString("hex");
+    const filename = storageKey(file.name, mimeType, random2);
     const stored = [];
     try {
       await this.storage.put(filename, file.data, { contentType: mimeType });
@@ -4723,7 +5320,7 @@ var EasyCMS = class {
     const filtered = await filterInput(
       config.fields,
       input,
-      this.fieldChecker("update", guard, parsed, input)
+      await this.fieldChecker("update", guard, parsed, input)
     );
     const localized = this.toMaps(config, filtered, base ?? {}, options);
     const merged = base ? mergeForUpdate(config.fields, base, localized) : applyDefaults(config.fields, localized, this.config.localization);
@@ -4763,7 +5360,7 @@ var EasyCMS = class {
     const input = await filterInput(
       config.fields,
       raw,
-      this.fieldChecker("update", guard, void 0, raw)
+      await this.fieldChecker("update", guard, void 0, raw)
     );
     const saved = await this.db.findGlobal({ slug: slug2 }) ?? {};
     const current = await this.globalDraft(config, saved);
@@ -4828,7 +5425,7 @@ var EasyCMS = class {
     if (!existing || parsed === void 0) throw new NotFoundError(collection2, id);
     await this.checkDocumentAccess(config, "update", guard, parsed, raw);
     if (config.drafts && (mode === "unpublish" || raw.status === "published"))
-      await this.checkGrant(guard, { collection: collection2 }, "publish");
+      await this.checkDocumentGrant(guard, collection2, "publish", parsed);
     const [drafted] = await this.withDrafts(config, [existing]);
     const live = options.live === true && mode === "save";
     const current = live ? existing : drafted;
@@ -4840,7 +5437,7 @@ var EasyCMS = class {
     const filtered = await filterInput(
       config.fields,
       input,
-      this.fieldChecker("update", guard, parsed, input)
+      await this.fieldChecker("update", guard, parsed, input)
     );
     const localized = mode === "restore" ? filtered : this.toMaps(config, filtered, current, options);
     let merged = mergeForUpdate(config.fields, current, localized);
@@ -4908,6 +5505,10 @@ var EasyCMS = class {
     const [out] = await this.output(config, [doc], guard, { ...options, draft: true });
     return out;
   }
+  /**
+   * Deletes a document. Deleting a user with roles from the admin (`auth.rbac`): `transferTo`
+   * gives the documents they own to another user; without it they have no owner.
+   */
   async delete(collection2, id, options = {}) {
     const config = this.collection(collection2);
     const guard = guardOf(options);
@@ -4919,7 +5520,20 @@ var EasyCMS = class {
       await this.guardLastAdmin(parsed, existing, { ...existing, active: false });
     const base = this.hookArgs(config, guard);
     for (const hook of config.hooks?.beforeDelete ?? []) await hook({ ...base, id: parsed });
-    if (config.slug === USERS) await this.auth.revokeSessions(parsed);
+    if (config.slug === USERS) {
+      const to = options.transferTo;
+      if (to !== void 0 && to !== null) {
+        const target = parseId(to);
+        const heir = target === void 0 ? null : await this.db.findById({ collection: USERS, id: target });
+        if (!heir || String(heir.id) === String(parsed))
+          throw new ValidationError(USERS, [
+            { field: "transferTo", message: "must be another existing user" }
+          ]);
+        await this.roles.transfer(parsed, heir.id);
+      } else await this.roles.transfer(parsed, null);
+      await this.auth.revokeSessions(parsed);
+      await this.auth.sso.forget(parsed);
+    }
     await this.db.delete({ collection: collection2, id: parsed });
     if (versionLimit(config)) await this.versions.deleteAll(collectionParent(collection2), parsed);
     if (config.schedule) {
@@ -5027,7 +5641,7 @@ var EasyCMS = class {
     const input = await filterInput(
       config.fields,
       raw,
-      this.fieldChecker("update", guard, void 0, raw)
+      await this.fieldChecker("update", guard, void 0, raw)
     );
     const existing = await this.db.findGlobal({ slug: slug2 }) ?? {};
     const current = await this.globalDraft(config, existing);
@@ -5312,7 +5926,7 @@ var EasyCMS = class {
     const existing = parsed === void 0 ? null : await this.db.findById({ collection: collection2, id: parsed });
     if (!existing || parsed === void 0) throw new NotFoundError(collection2, id);
     await this.checkDocumentAccess(config, "update", guardOf(options), parsed, void 0);
-    await this.checkGrant(guardOf(options), { collection: collection2 }, "publish");
+    await this.checkDocumentGrant(guardOf(options), collection2, "publish", parsed);
     return { config, parsed };
   }
   async globalScheduleTarget(slug2, options) {
@@ -5483,6 +6097,7 @@ var EasyCMS = class {
     const own = await this.checkGrant(guard, { collection: config.slug }, "read");
     const access = await evaluateAccess(config.access?.read, { user: guard.user });
     if (access === false) throw deny(guard.user);
+    await this.checkQueryFields(config, guard, where);
     return andWhere(andWhere(where, access), own);
   }
   async checkDocumentAccess(config, operation, guard, id, data) {
@@ -5512,17 +6127,52 @@ var EasyCMS = class {
       throw new QueryError(`${operation} access of global "${config.slug}" must return a boolean`);
     if (!access) throw deny(guard.user);
   }
-  fieldChecker(kind, guard, id, data) {
+  async fieldChecker(kind, guard, id, data) {
     if (!guard.enforce) return void 0;
-    return new FieldAccessChecker(kind, {
-      user: guard.user,
-      ...id !== void 0 ? { id } : {},
-      ...data ? { data } : {}
+    return new FieldAccessChecker(
+      kind,
+      {
+        user: guard.user,
+        ...id !== void 0 ? { id } : {},
+        ...data ? { data } : {}
+      },
+      await this.roles.fieldRules(guard.user)
+    );
+  }
+  /**
+   * Refuses filtering or sorting by fields the caller may not read: the results would tell
+   * their values. Checks each field along a dotted path, through groups, arrays and blocks.
+   */
+  async checkQueryFields(config, guard, where, sort = []) {
+    if (!guard.enforce) return;
+    const paths = [...wherePaths(where), ...sort.map((s) => s.replace(/^-/, ""))];
+    if (paths.length === 0) return;
+    const read2 = await this.fieldChecker("read", guard, void 0, void 0);
+    for (const path of paths) {
+      let fields = config.fields;
+      for (const name of path.split(".")) {
+        if (!fields) break;
+        const field = fields.find((f) => f.name === name);
+        if (!field) break;
+        if (field.hidden || read2 && !await read2.allows(field))
+          throw new ForbiddenError(`You may not filter or sort by "${path}"`);
+        fields = field.type === "group" || field.type === "array" ? field.fields : field.type === "blocks" ? field.blocks.flatMap((b) => b.fields) : void 0;
+      }
+    }
+  }
+  /** `checkGrant` for one document: a role limited to its own documents must own it. */
+  async checkDocumentGrant(guard, collection2, operation, id) {
+    const own = await this.checkGrant(guard, { collection: collection2 }, operation);
+    if (own === true) return;
+    const matches2 = await this.db.count({
+      collection: collection2,
+      where: andWhere(own, { id: { equals: id } })
     });
+    if (matches2 === 0) throw deny(guard.user);
   }
   /** Runs afterRead hooks, populates relationships and removes what the caller may not see. */
   async output(config, docs, guard, options) {
-    const read2 = this.fieldChecker("read", guard, void 0, void 0);
+    const read2 = await this.fieldChecker("read", guard, void 0, void 0);
     const finish = async (target, doc) => {
       const hooked = await this.transform(
         target.hooks?.afterRead,
@@ -5572,8 +6222,9 @@ var EasyCMS = class {
     const filtered = await filterInput(
       config.fields,
       input,
-      this.fieldChecker("update", guard, void 0, input)
+      await this.fieldChecker("update", guard, void 0, input)
     );
+    this.roles.fillOwner(collection2, filtered, guard.user ?? hookGuard?.user ?? null);
     const base = this.hookArgs(config, hookGuard ?? guard);
     let data = applyDefaults(
       config.fields,
@@ -5944,6 +6595,16 @@ function loadSharp() {
   );
   return sharpModule;
 }
+function wherePaths(where) {
+  if (!where) return [];
+  const out = [];
+  for (const [key2, value] of Object.entries(where)) {
+    if (key2 === "and" || key2 === "or") {
+      for (const sub of value ?? []) out.push(...wherePaths(sub));
+    } else out.push(key2);
+  }
+  return out;
+}
 function guardOf(options) {
   return { enforce: options.overrideAccess === false, user: options.user ?? null };
 }
@@ -6215,10 +6876,11 @@ function componentRef(component) {
 async function allowed(access, user) {
   return await evaluateAccess(access, { user }) !== false;
 }
-async function serializeFields(fields, update2, localized) {
+async function serializeFields(fields, checks, localized) {
+  const { update: update2 } = checks;
   const out = [];
   for (const field of fields) {
-    if (field.hidden) continue;
+    if (field.hidden || !await checks.read.allows(field)) continue;
     const f = { name: field.name, type: field.type };
     if (field.label !== void 0) f.label = field.label;
     if (field.required) f.required = true;
@@ -6271,7 +6933,7 @@ async function serializeFields(fields, update2, localized) {
       case "array":
         if (field.minRows !== void 0) f.minRows = field.minRows;
         if (field.maxRows !== void 0) f.maxRows = field.maxRows;
-        f.fields = await serializeFields(field.fields, update2, localized);
+        f.fields = await serializeFields(field.fields, checks, localized);
         break;
       case "blocks":
         if (field.minRows !== void 0) f.minRows = field.minRows;
@@ -6280,28 +6942,31 @@ async function serializeFields(fields, update2, localized) {
           field.blocks.map(async (block) => ({
             slug: block.slug,
             ...block.labels ? { labels: block.labels } : {},
-            fields: await serializeFields(block.fields, update2, localized)
+            fields: await serializeFields(block.fields, checks, localized)
           }))
         );
         break;
       case "group":
-        f.fields = await serializeFields(field.fields, update2, localized);
+        f.fields = await serializeFields(field.fields, checks, localized);
         break;
     }
     out.push(f);
   }
   return out;
 }
+async function checkers(cms, user) {
+  const rules = await cms.roles.fieldRules(user);
+  return {
+    update: new FieldAccessChecker("update", { user }, rules),
+    read: new FieldAccessChecker("read", { user }, rules)
+  };
+}
 async function may(cms, access, user, target, operation) {
   return await allowed(access, user) && await cms.roles.allows(user, target, operation) !== false;
 }
 async function collection(cms, config, user, localized, roles) {
   const target = { collection: config.slug };
-  const fields = await serializeFields(
-    config.fields,
-    new FieldAccessChecker("update", { user }),
-    localized
-  );
+  const fields = await serializeFields(config.fields, await checkers(cms, user), localized);
   if (config.slug === USERS && cms.roles.enabled) {
     const role = fields.find((f) => f.name === "role");
     if (role) {
@@ -6331,23 +6996,22 @@ async function collection(cms, config, user, localized, roles) {
   if (config.admin?.group === "settings" || SETTINGS.has(config.slug)) result.group = "settings";
   if (config.admin?.list?.tree) result.tree = config.admin.list.tree;
   if (config.admin?.list?.sort) result.defaultSort = config.admin.list.sort;
+  const owner = cms.roles.ownerOf(config.slug);
+  if (owner && fields.some((f) => f.name === owner)) result.owner = owner;
   if (config.editIn === "drawer" && !result.drafts && !result.versions && !result.preview)
     result.editIn = "drawer";
   return result;
 }
 async function global(cms, config, user, localized) {
   const target = { global: config.slug };
+  const checks = await checkers(cms, user);
   const result = {
     slug: config.slug,
     drafts: config.drafts === true,
     versions: Boolean(config.versions),
     preview: typeof config.preview === "function",
     schedule: config.schedule === true,
-    fields: await serializeFields(
-      config.fields,
-      new FieldAccessChecker("update", { user }),
-      localized
-    ),
+    fields: await serializeFields(config.fields, checks, localized),
     permissions: {
       read: await may(cms, config.access?.read, user, target, "read"),
       update: await may(cms, config.access?.update, user, target, "update"),
@@ -6372,7 +7036,8 @@ async function adminSchema(cms, user, origin) {
     deliveries: deliveries && await cms.roles.canView(user, "deliveries"),
     backups: admin,
     email: admin,
-    roles: admin && cms.roles.enabled
+    roles: admin && cms.roles.enabled,
+    sso: admin && cms.auth.sso.enabled
   };
   const roles = await cms.roles.options();
   return {
@@ -6387,6 +7052,8 @@ async function adminSchema(cms, user, origin) {
     modules: adminModuleUrls(cms),
     uploadFromURL: cms.config.upload.fromURL !== void 0,
     views,
+    rbac: cms.roles.enabled,
+    providers: cms.auth.sso.providers(),
     ...views.deliveries ? {
       deliveries: {
         webhook: cms.config.collections.some((c) => c.slug === WEBHOOK_DELIVERIES),
@@ -6432,7 +7099,7 @@ async function widgets(cms, user) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.33.0" : "0.0.0-dev";
+var VERSION = true ? "0.35.0" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
 var DAY = 864e5;
@@ -6782,6 +7449,7 @@ async function route(cms, ctx, method, segments, options) {
   const access = { overrideAccess: false, user: ctx.user, ...parseLocale(ctx.url) };
   const draft = ctx.user !== null && ctx.url.searchParams.get("draft") === "true";
   if (segments.length === 0) throw new HttpError("Not found", 404);
+  if (first === "auth") return ssoRoute(cms, ctx, method, segments);
   if (first === USERS && second !== void 0 && third === void 0 && !/^\d+$/.test(second)) {
     switch (`${method} ${second}`) {
       case "POST login": {
@@ -6812,7 +7480,10 @@ async function route(cms, ctx, method, segments, options) {
           body: {
             hasUsers: await cms.auth.hasUsers(),
             // The login page offers "Forgot password?" only when the email can be sent.
-            passwordReset: cms.auth.canSendPasswordLinks(ctx.url.origin)
+            passwordReset: cms.auth.canSendPasswordLinks(ctx.url.origin),
+            // Buttons to sign in with outside accounts; `password: false`: only admins use one.
+            providers: cms.auth.sso.providers(),
+            password: cms.config.auth.password
           }
         };
       // Forgot password: the same answer whether or not the email has an account.
@@ -6923,6 +7594,20 @@ async function route(cms, ctx, method, segments, options) {
     }
     throw new HttpError("Not found", 404);
   }
+  if (first === "admin" && second === "sso" && third === void 0) {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+    if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+    return { body: cms.auth.sso.settings(ctx.url.origin) };
+  }
+  if (first === "admin" && second === "owned" && third !== void 0 && segments.length === 3) {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+    if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+    const parsed = parseId(third);
+    if (parsed === void 0) throw new HttpError("Not found", 404);
+    return { body: await cms.roles.owned(parsed) };
+  }
   if (first === "admin" && second === "roles") {
     if (!ctx.user) throw new UnauthorizedError();
     if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
@@ -7127,7 +7812,9 @@ async function route(cms, ctx, method, segments, options) {
     return { body: doc };
   }
   if (method === "DELETE") {
-    return { body: await cms.delete(collection2, id, access) };
+    const to = collection2 === USERS ? ctx.url.searchParams.get("transferTo") : null;
+    const transferTo = to === null ? {} : { transferTo: to === "none" ? null : parseId(to) ?? to };
+    return { body: await cms.delete(collection2, id, { ...access, ...transferTo }) };
   }
   throw methodNotAllowed(ctx, "GET, PATCH, DELETE");
 }
@@ -7386,6 +8073,67 @@ function cookie(ctx, name, value, opts) {
   if (opts.maxAge !== void 0) parts.push(`Max-Age=${opts.maxAge}`);
   return parts.join("; ");
 }
+async function ssoRoute(cms, ctx, method, segments) {
+  const sso = cms.auth.sso;
+  if (!sso.enabled) throw new HttpError("Not found", 404);
+  const [, second, third, extra] = segments;
+  if (extra !== void 0 || second === void 0) throw new HttpError("Not found", 404);
+  if (second === "identities") {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (third === void 0) {
+      if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+      const asked = ctx.url.searchParams.get("user");
+      const target = asked === null ? ctx.user.id : parseId(asked) ?? asked;
+      if (String(target) !== String(ctx.user.id) && (ctx.user.role !== "admin" || ctx.user.apiKey))
+        throw new ForbiddenError();
+      return { body: await sso.identities(target) };
+    }
+    if (method !== "DELETE") throw methodNotAllowed(ctx, "DELETE");
+    const id = parseId(third);
+    if (id === void 0) throw new HttpError("Not found", 404);
+    await sso.unlink(ctx.user, id);
+    return { body: { deleted: 1 } };
+  }
+  const pendingCookie = (value, maxAge) => cookie(ctx, SSO_COOKIE, value, { httpOnly: true, maxAge });
+  if (third === "login") {
+    if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+    const started = await sso.start(second, {
+      origin: ctx.url.origin,
+      redirect: ctx.url.searchParams.get("redirect")
+    });
+    ctx.headers.append("set-cookie", pendingCookie(started.cookie, 600));
+    return { body: redirectResponse(ctx, started.url) };
+  }
+  if (third === "link") {
+    if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+    if (!ctx.user || ctx.user.apiKey) throw new UnauthorizedError();
+    const started = await sso.start(second, {
+      origin: ctx.url.origin,
+      redirect: null,
+      user: ctx.user
+    });
+    ctx.headers.append("set-cookie", pendingCookie(started.cookie, 600));
+    return { body: { url: started.url } };
+  }
+  if (third === "callback") {
+    if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+    const finished = await sso.finish(second, {
+      url: ctx.url,
+      cookie: readCookie(ctx.request, SSO_COOKIE),
+      origin: ctx.url.origin,
+      user: ctx.user
+    });
+    ctx.headers.append("set-cookie", pendingCookie("", 0));
+    if (finished.session) setSessionCookies(cms, ctx, finished.session);
+    return { body: redirectResponse(ctx, finished.redirect) };
+  }
+  throw new HttpError("Not found", 404);
+}
+function redirectResponse(ctx, location) {
+  const headers = new Headers({ location, "cache-control": "no-store" });
+  for (const value of ctx.headers.getSetCookie()) headers.append("set-cookie", value);
+  return new Response(null, { status: 302, headers });
+}
 function setSessionCookies(cms, ctx, session) {
   const maxAge = cms.config.auth.tokenExpiration;
   ctx.headers.append(
@@ -7615,6 +8363,7 @@ export {
   ROLE_OPERATIONS,
   Roles,
   SESSION_COOKIE,
+  SSO_COOKIE,
   SchemaError,
   TooManyRequestsError,
   UnauthorizedError,