@easy-cms/core 0.34.0 → 0.36.0

package/dist/index.js

@@ -129,197 +129,9 @@ function cleanPermissions(value, known) {
   };
 }
 
-// src/errors.ts
-var ConfigError = class _ConfigError extends Error {
-  issues;
-  constructor(issues) {
-    super(_ConfigError.format(issues));
-    this.name = "ConfigError";
-    this.issues = issues;
-  }
-  static format(issues) {
-    const lines = issues.map((issue) => {
-      const hint = issue.hint ? `
-    \u2192 ${issue.hint}` : "";
-      return `  \u2022 ${issue.path}: ${issue.message}${hint}`;
-    });
-    const noun = issues.length === 1 ? "problem" : "problems";
-    return `Invalid Easy CMS config (${issues.length} ${noun}):
-${lines.join("\n")}`;
-  }
-};
-var EasyCMSError = class extends Error {
-  status;
-  constructor(message2, status) {
-    super(message2);
-    this.name = "EasyCMSError";
-    this.status = status;
-  }
-};
-var ValidationError = class extends EasyCMSError {
-  errors;
-  constructor(collection2, errors) {
-    const list = errors.map((e) => `${e.field}: ${e.message}`).join("; ");
-    super(`Invalid data for "${collection2}": ${list}`, 400);
-    this.name = "ValidationError";
-    this.errors = errors;
-  }
-};
-var NotFoundError = class extends EasyCMSError {
-  constructor(collection2, id) {
-    super(`No document with id ${JSON.stringify(id)} in "${collection2}"`, 404);
-    this.name = "NotFoundError";
-  }
-};
-var QueryError = class extends EasyCMSError {
-  constructor(message2) {
-    super(message2, 400);
-    this.name = "QueryError";
-  }
-};
-var SchemaError = class extends EasyCMSError {
-  constructor(message2) {
-    super(message2, 500);
-    this.name = "SchemaError";
-  }
-};
-var UnauthorizedError = class extends EasyCMSError {
-  constructor(message2 = "You must be logged in") {
-    super(message2, 401);
-    this.name = "UnauthorizedError";
-  }
-};
-var ForbiddenError = class extends EasyCMSError {
-  constructor(message2 = "You are not allowed to do this") {
-    super(message2, 403);
-    this.name = "ForbiddenError";
-  }
-};
-var TooManyRequestsError = class extends EasyCMSError {
-  constructor(message2) {
-    super(message2, 429);
-    this.name = "TooManyRequestsError";
-  }
-};
-var PayloadTooLargeError = class extends EasyCMSError {
-  constructor(message2) {
-    super(message2, 413);
-    this.name = "PayloadTooLargeError";
-  }
-};
-
-// src/fields.ts
-var isHasMany = (field) => (field.type === "select" || field.type === "relationship" || field.type === "upload") && field.hasMany === true;
-function mimeAllowedBy(mimeType, patterns) {
-  const type = mimeType.toLowerCase();
-  return patterns.some((pattern) => {
-    const p = pattern.toLowerCase();
-    return p.endsWith("/*") ? type.startsWith(p.slice(0, -1)) : type === p;
-  });
-}
-var hasRows = (field) => field.type === "array" || field.type === "blocks";
-function rowFields(field, row) {
-  if (field.type === "array") return field.fields;
-  const type = row && typeof row === "object" ? row.blockType : void 0;
-  return field.blocks.find((block) => block.slug === type)?.fields;
-}
-var FIELD_TYPES = [
-  "text",
-  "textarea",
-  "number",
-  "boolean",
-  "date",
-  "email",
-  "json",
-  "select",
-  "slug",
-  "richText",
-  "upload",
-  "relationship",
-  "array",
-  "group",
-  "blocks"
-];
-
-// src/access-control.ts
-async function evaluateAccess(access, args) {
-  const result = await (access ?? isLoggedIn)(args);
-  if (typeof result === "boolean") return result;
-  if (typeof result === "object" && result !== null) return result;
-  throw new QueryError("Access functions must return a boolean or a where query");
-}
-function andWhere(where, constraint) {
-  if (constraint === true) return where;
-  return where === void 0 ? constraint : { and: [where, constraint] };
-}
-var FieldAccessChecker = class {
-  /** `rules`: the user's role's rules for top-level fields (`auth.rbac`), on top of `access`. */
-  constructor(kind, args, rules) {
-    this.kind = kind;
-    this.args = args;
-    this.rules = rules;
-  }
-  kind;
-  args;
-  rules;
-  cache = /* @__PURE__ */ new Map();
-  async allows(field) {
-    const rule = this.rules?.get(field);
-    if (rule === "hidden" || rule === "read" && this.kind === "update") return false;
-    const fn = field.access?.[this.kind];
-    if (!fn) return true;
-    let allowed2 = this.cache.get(field);
-    if (allowed2 === void 0) {
-      allowed2 = await fn(this.args) === true;
-      this.cache.set(field, allowed2);
-    }
-    return allowed2;
-  }
-};
-async function stripFields(fields, doc, read2) {
-  const result = { ...doc };
-  for (const field of fields) {
-    if (!(field.name in result)) continue;
-    if (field.hidden || read2 && !await read2.allows(field)) {
-      delete result[field.name];
-      continue;
-    }
-    const value = result[field.name];
-    if (field.type === "group" && value && typeof value === "object") {
-      result[field.name] = await stripFields(field.fields, value, read2);
-    } else if (hasRows(field) && Array.isArray(value)) {
-      result[field.name] = await Promise.all(
-        value.map((row) => {
-          const fields2 = rowFields(field, row);
-          return fields2 && row && typeof row === "object" ? stripFields(fields2, row, read2) : row;
-        })
-      );
-    }
-  }
-  return result;
-}
-async function filterInput(fields, data, update2) {
-  const result = { ...data };
-  for (const field of fields) {
-    if (!(field.name in result)) continue;
-    if (field.hidden || update2 && !await update2.allows(field)) {
-      delete result[field.name];
-      continue;
-    }
-    const value = result[field.name];
-    if (field.type === "group" && value && typeof value === "object" && !Array.isArray(value)) {
-      result[field.name] = await filterInput(field.fields, value, update2);
-    } else if (hasRows(field) && Array.isArray(value)) {
-      result[field.name] = await Promise.all(
-        value.map((row) => {
-          const fields2 = rowFields(field, row);
-          return fields2 && row && typeof row === "object" ? filterInput(fields2, row, update2) : row;
-        })
-      );
-    }
-  }
-  return result;
-}
+// src/audit.ts
+import { AsyncLocalStorage } from "async_hooks";
+import { createHmac } from "crypto";
 
 // src/builtins.ts
 var USERS = "users";
@@ -332,6 +144,8 @@ var WEBHOOK_DELIVERIES = "webhook-deliveries";
 var EMAIL_DELIVERIES = "email-deliveries";
 var DATABASE_BACKUPS = "database-backups";
 var ROLES = "user-roles";
+var USER_IDENTITIES = "user-identities";
+var AUDIT_LOGS = "audit-logs";
 var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SESSIONS,
   LOGIN_ATTEMPTS,
@@ -340,7 +154,9 @@ var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   WEBHOOK_DELIVERIES,
   EMAIL_DELIVERIES,
   DATABASE_BACKUPS,
-  ROLES
+  ROLES,
+  USER_IDENTITIES,
+  AUDIT_LOGS
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
 var CREATED_BY_FIELD = {
@@ -600,6 +416,38 @@ var databaseBackupsCollection = {
     { name: "downloadedAt", type: "text" }
   ]
 };
+var userIdentitiesCollection = {
+  slug: USER_IDENTITIES,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    { name: "user", type: "relationship", to: USERS, required: true, index: true },
+    // The provider's id (`google`) and its id for the account (`sub`).
+    { name: "provider", type: "text", required: true, index: true },
+    { name: "subject", type: "text", required: true, index: true },
+    { name: "email", type: "text" },
+    { name: "lastUsedAt", type: "text" }
+  ]
+};
+var auditLogsCollection = {
+  slug: AUDIT_LOGS,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    { name: "action", type: "text", required: true, index: true },
+    // A collection slug, `global:<slug>`, or an area (auth, roles, backups…).
+    { name: "target", type: "text", index: true },
+    { name: "doc", type: "text", index: true },
+    { name: "title", type: "text" },
+    { name: "actorId", type: "text" },
+    { name: "actorEmail", type: "text", index: true },
+    // user | api-key | system | scheduler
+    { name: "via", type: "text" },
+    { name: "ip", type: "text" },
+    { name: "userAgent", type: "text" },
+    { name: "changes", type: "json" },
+    { name: "detail", type: "json" },
+    { name: "signature", type: "text" }
+  ]
+};
 var emailDeliveriesCollection = {
   slug: EMAIL_DELIVERIES,
   access: { read: nobody, create: nobody, update: nobody, delete: nobody },
@@ -614,15 +462,517 @@ var emailDeliveriesCollection = {
   ]
 };
 
+// src/audit.ts
+var DEFAULT_AUDIT_KEEP = 365;
+var DEFAULT_FAILED_LOGINS = 20;
+var MAX_VALUE = 500;
+var PAGE = 50;
+var CSV_LIMIT = 1e4;
+var DAY = 864e5;
+var BULKY = /* @__PURE__ */ new Set(["richText", "blocks", "array", "json"]);
+var auditContext = new AsyncLocalStorage();
+function stable(value) {
+  if (value === void 0 || value === null) return "null";
+  if (Array.isArray(value)) return `[${value.map(stable).join(",")}]`;
+  if (typeof value === "object") {
+    const keys = Object.keys(value).filter((k) => value[k] !== void 0).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${stable(value[k])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+var SIGNED = [
+  "action",
+  "target",
+  "doc",
+  "title",
+  "actorId",
+  "actorEmail",
+  "via",
+  "ip",
+  "userAgent",
+  "changes",
+  "detail",
+  "createdAt"
+];
+function cut(value) {
+  if (typeof value === "string")
+    return value.length > MAX_VALUE ? `${value.slice(0, MAX_VALUE)}\u2026` : value;
+  if (value !== null && typeof value === "object") {
+    const json = JSON.stringify(value);
+    return json.length > MAX_VALUE ? "\u2026" : value;
+  }
+  return value;
+}
+var text = (value) => typeof value === "string" && value !== "" ? value : null;
+var AuditLog = class {
+  constructor(cms) {
+    this.cms = cms;
+  }
+  cms;
+  /** Entries that could not be written since the server started. */
+  failures = 0;
+  get enabled() {
+    return this.cms.config.audit !== false;
+  }
+  get settings() {
+    return this.cms.config.audit || {
+      keep: DEFAULT_AUDIT_KEEP,
+      values: true,
+      failedLogins: DEFAULT_FAILED_LOGINS
+    };
+  }
+  /**
+   * Writes an entry. The user defaults to the request's. Never throws: a failure is logged and
+   * counted, and the dashboard says so.
+   */
+  async record(entry) {
+    if (!this.enabled) return;
+    try {
+      const context = auditContext.getStore();
+      const user = entry.user !== void 0 ? entry.user : context?.user ?? null;
+      const apiKey = user?.apiKey;
+      const row = {
+        action: entry.action,
+        target: entry.target ?? null,
+        doc: entry.doc === void 0 || entry.doc === null ? null : String(entry.doc),
+        title: entry.title ? cut(entry.title) : null,
+        actorId: user ? String(user.id) : null,
+        actorEmail: user?.email ?? entry.email ?? null,
+        via: apiKey ? "api-key" : context?.via === "scheduler" ? "scheduler" : user ? "user" : "system",
+        ip: context?.ip ?? null,
+        userAgent: context?.userAgent ? context.userAgent.slice(0, 200) : null,
+        changes: entry.changes && entry.changes.length > 0 ? entry.changes : null,
+        detail: apiKey ? { ...entry.detail, apiKey: apiKey.name ?? "" } : entry.detail ?? null,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      row.signature = this.sign(row);
+      row.updatedAt = row.createdAt;
+      await this.cms.db.create({ collection: AUDIT_LOGS, data: row });
+    } catch (error) {
+      this.failures++;
+      this.cms.logger.error(
+        `Audit log: could not write "${entry.action}": ${error.message}`
+      );
+    }
+  }
+  /**
+   * A change to a document or global: what changed between `before` and `after`. Internal
+   * collections (sessions, versions…) are not logged.
+   */
+  async content(config, global2, action, after, before, user) {
+    if (!this.enabled) return;
+    if (!global2 && INTERNAL_COLLECTIONS.has(config.slug)) return;
+    const doc = after ?? before;
+    const titleField = global2 ? void 0 : config.useAsTitle;
+    const rawTitle = titleField ? doc?.[titleField] : void 0;
+    const title = typeof rawTitle === "string" ? rawTitle : rawTitle && typeof rawTitle === "object" ? text(
+      Object.values(rawTitle).find((v) => typeof v === "string")
+    ) : null;
+    await this.record({
+      action,
+      target: global2 ? `global:${config.slug}` : config.slug,
+      doc: global2 ? null : doc?.id ?? null,
+      title,
+      // A trusted call without a user keeps the request's (or is the system).
+      ...user ? { user } : {},
+      changes: action === "delete" ? null : this.diff(config.fields, before ?? {}, after ?? {})
+    });
+  }
+  /** Fields whose stored value changed. Hidden ones never (the password only as "changed"). */
+  diff(fields, before, after) {
+    const values = this.settings.values;
+    const out = [];
+    for (const field of fields) {
+      if (field.hidden) continue;
+      const a = before[field.name];
+      const b = after[field.name];
+      if (stable(a) === stable(b)) continue;
+      if (!values || BULKY.has(field.type)) out.push({ field: field.name });
+      else out.push({ field: field.name, before: cut(a ?? null), after: cut(b ?? null) });
+    }
+    if (before.passwordHash !== after.passwordHash && (before.passwordHash || after.passwordHash))
+      out.push({ field: "password" });
+    return out;
+  }
+  async list(filter, page = 1) {
+    const result = await this.cms.db.find({
+      collection: AUDIT_LOGS,
+      where: this.where(filter),
+      sort: ["-id"],
+      limit: PAGE,
+      page
+    });
+    return {
+      docs: result.docs.map(toEntry),
+      page: result.page,
+      totalPages: result.totalPages,
+      totalDocs: result.totalDocs
+    };
+  }
+  /** The filtered entries as CSV (the newest 10,000). */
+  async csv(filter) {
+    const { docs } = await this.cms.db.find({
+      collection: AUDIT_LOGS,
+      where: this.where(filter),
+      sort: ["-id"],
+      limit: CSV_LIMIT,
+      page: 1
+    });
+    const cell = (value) => {
+      const s = value === null || value === void 0 ? "" : typeof value === "string" ? value : JSON.stringify(value);
+      const safe = /^[=+\-@\t\r]/.test(s) ? `'${s}` : s;
+      return /[",\n\r]/.test(safe) ? `"${safe.replaceAll('"', '""')}"` : safe;
+    };
+    const lines = [
+      ["at", "action", "target", "doc", "title", "actor", "via", "ip", "changes", "detail"].join(
+        ","
+      ),
+      ...docs.map(toEntry).map(
+        (e) => [
+          e.at,
+          e.action,
+          e.target,
+          e.doc,
+          e.title,
+          e.actor.email,
+          e.actor.via,
+          e.actor.ip,
+          e.changes,
+          e.detail
+        ].map(cell).join(",")
+      )
+    ];
+    return `${lines.join("\r\n")}\r
+`;
+  }
+  /** Checks every entry's signature, and that no ids are missing. */
+  async verify() {
+    const invalid = [];
+    let checked = 0;
+    let gaps = 0;
+    let previous;
+    for (let page = 1; ; page++) {
+      const result = await this.cms.db.find({
+        collection: AUDIT_LOGS,
+        sort: ["id"],
+        limit: 500,
+        page
+      });
+      for (const row of result.docs) {
+        checked++;
+        if (row.signature !== this.sign(row)) invalid.push(row.id);
+        const id = Number(row.id);
+        if (previous !== void 0 && Number.isInteger(id) && id > previous + 1)
+          gaps += id - previous - 1;
+        previous = id;
+      }
+      if (page >= result.totalPages) break;
+    }
+    const verification = { checked, invalid, gaps, at: (/* @__PURE__ */ new Date()).toISOString() };
+    await this.record({
+      action: "audit.verify",
+      target: "audit",
+      detail: { checked, invalid: invalid.length, gaps }
+    });
+    return verification;
+  }
+  /**
+   * Daily upkeep from `runJobs`: deletes entries older than `keep` days, then verifies the log.
+   * Runs when the last check is more than a day old.
+   */
+  async upkeep(now = /* @__PURE__ */ new Date()) {
+    if (!this.enabled) return;
+    const last = await this.lastVerification();
+    if (last && now.getTime() - Date.parse(last.at) < DAY) return;
+    const keep = this.settings.keep;
+    if (keep > 0) {
+      const before = new Date(now.getTime() - keep * DAY).toISOString();
+      for (; ; ) {
+        const { docs } = await this.cms.db.find({
+          collection: AUDIT_LOGS,
+          where: { createdAt: { lt: before } },
+          sort: ["id"],
+          limit: 500,
+          page: 1
+        });
+        for (const row of docs) await this.cms.db.delete({ collection: AUDIT_LOGS, id: row.id });
+        if (docs.length < 500) break;
+      }
+    }
+    await auditContext.run({ via: "scheduler", user: null }, () => this.verify());
+  }
+  /** What the dashboard warns about: many failed logins, entries not written, a failed check. */
+  async attention(now = /* @__PURE__ */ new Date()) {
+    if (!this.enabled) return [];
+    const out = [];
+    const hour = new Date(now.getTime() - 36e5).toISOString();
+    const failed = await this.cms.db.count({
+      collection: AUDIT_LOGS,
+      where: {
+        and: [{ action: { in: ["login.failed", "sso.failed"] } }, { createdAt: { gte: hour } }]
+      }
+    });
+    if (failed >= this.settings.failedLogins) out.push({ id: "failed-logins", count: failed });
+    if (this.failures > 0) out.push({ id: "audit-failures", count: this.failures });
+    const last = await this.lastVerification();
+    if (last && last.invalid > 0)
+      out.push({ id: "audit-tampered", invalid: last.invalid, at: last.at });
+    return out;
+  }
+  // -------------------------------------------------------------------------
+  sign(row) {
+    const payload = stable(SIGNED.map((key2) => row[key2] ?? null));
+    return createHmac("sha256", this.cms.config.secret).update(`audit:${payload}`).digest("base64url");
+  }
+  async lastVerification() {
+    const { docs } = await this.cms.db.find({
+      collection: AUDIT_LOGS,
+      where: { action: { equals: "audit.verify" } },
+      sort: ["-id"],
+      limit: 1,
+      page: 1
+    });
+    const row = docs[0];
+    if (!row) return null;
+    const detail = row.detail ?? {};
+    return { at: String(row.createdAt), invalid: detail.invalid ?? 0 };
+  }
+  where(filter) {
+    const parts = [];
+    if (filter.action) {
+      parts.push({
+        or: [{ action: { equals: filter.action } }, { action: { like: `${filter.action}.` } }]
+      });
+    }
+    if (filter.target) parts.push({ target: { equals: filter.target } });
+    if (filter.doc) parts.push({ doc: { equals: filter.doc } });
+    if (filter.actor) parts.push({ actorEmail: { like: filter.actor } });
+    if (filter.from) parts.push({ createdAt: { gte: filter.from } });
+    if (filter.to) parts.push({ createdAt: { lte: filter.to } });
+    return parts.length === 0 ? void 0 : parts.length === 1 ? parts[0] : { and: parts };
+  }
+};
+function toEntry(row) {
+  return {
+    id: row.id,
+    at: String(row.createdAt),
+    action: String(row.action),
+    target: text(row.target),
+    doc: text(row.doc),
+    title: text(row.title),
+    actor: {
+      id: text(row.actorId),
+      email: text(row.actorEmail),
+      via: String(row.via ?? "system"),
+      ip: text(row.ip),
+      userAgent: text(row.userAgent)
+    },
+    changes: row.changes ?? null,
+    detail: row.detail ?? null
+  };
+}
+
+// src/errors.ts
+var ConfigError = class _ConfigError extends Error {
+  issues;
+  constructor(issues) {
+    super(_ConfigError.format(issues));
+    this.name = "ConfigError";
+    this.issues = issues;
+  }
+  static format(issues) {
+    const lines = issues.map((issue) => {
+      const hint = issue.hint ? `
+    \u2192 ${issue.hint}` : "";
+      return `  \u2022 ${issue.path}: ${issue.message}${hint}`;
+    });
+    const noun = issues.length === 1 ? "problem" : "problems";
+    return `Invalid Easy CMS config (${issues.length} ${noun}):
+${lines.join("\n")}`;
+  }
+};
+var EasyCMSError = class extends Error {
+  status;
+  constructor(message2, status) {
+    super(message2);
+    this.name = "EasyCMSError";
+    this.status = status;
+  }
+};
+var ValidationError = class extends EasyCMSError {
+  errors;
+  constructor(collection2, errors) {
+    const list = errors.map((e) => `${e.field}: ${e.message}`).join("; ");
+    super(`Invalid data for "${collection2}": ${list}`, 400);
+    this.name = "ValidationError";
+    this.errors = errors;
+  }
+};
+var NotFoundError = class extends EasyCMSError {
+  constructor(collection2, id) {
+    super(`No document with id ${JSON.stringify(id)} in "${collection2}"`, 404);
+    this.name = "NotFoundError";
+  }
+};
+var QueryError = class extends EasyCMSError {
+  constructor(message2) {
+    super(message2, 400);
+    this.name = "QueryError";
+  }
+};
+var SchemaError = class extends EasyCMSError {
+  constructor(message2) {
+    super(message2, 500);
+    this.name = "SchemaError";
+  }
+};
+var UnauthorizedError = class extends EasyCMSError {
+  constructor(message2 = "You must be logged in") {
+    super(message2, 401);
+    this.name = "UnauthorizedError";
+  }
+};
+var ForbiddenError = class extends EasyCMSError {
+  constructor(message2 = "You are not allowed to do this") {
+    super(message2, 403);
+    this.name = "ForbiddenError";
+  }
+};
+var TooManyRequestsError = class extends EasyCMSError {
+  constructor(message2) {
+    super(message2, 429);
+    this.name = "TooManyRequestsError";
+  }
+};
+var PayloadTooLargeError = class extends EasyCMSError {
+  constructor(message2) {
+    super(message2, 413);
+    this.name = "PayloadTooLargeError";
+  }
+};
+
+// src/fields.ts
+var isHasMany = (field) => (field.type === "select" || field.type === "relationship" || field.type === "upload") && field.hasMany === true;
+function mimeAllowedBy(mimeType, patterns) {
+  const type = mimeType.toLowerCase();
+  return patterns.some((pattern) => {
+    const p = pattern.toLowerCase();
+    return p.endsWith("/*") ? type.startsWith(p.slice(0, -1)) : type === p;
+  });
+}
+var hasRows = (field) => field.type === "array" || field.type === "blocks";
+function rowFields(field, row) {
+  if (field.type === "array") return field.fields;
+  const type = row && typeof row === "object" ? row.blockType : void 0;
+  return field.blocks.find((block) => block.slug === type)?.fields;
+}
+var FIELD_TYPES = [
+  "text",
+  "textarea",
+  "number",
+  "boolean",
+  "date",
+  "email",
+  "json",
+  "select",
+  "slug",
+  "richText",
+  "upload",
+  "relationship",
+  "array",
+  "group",
+  "blocks"
+];
+
+// src/access-control.ts
+async function evaluateAccess(access, args) {
+  const result = await (access ?? isLoggedIn)(args);
+  if (typeof result === "boolean") return result;
+  if (typeof result === "object" && result !== null) return result;
+  throw new QueryError("Access functions must return a boolean or a where query");
+}
+function andWhere(where, constraint) {
+  if (constraint === true) return where;
+  return where === void 0 ? constraint : { and: [where, constraint] };
+}
+var FieldAccessChecker = class {
+  /** `rules`: the user's role's rules for top-level fields (`auth.rbac`), on top of `access`. */
+  constructor(kind, args, rules) {
+    this.kind = kind;
+    this.args = args;
+    this.rules = rules;
+  }
+  kind;
+  args;
+  rules;
+  cache = /* @__PURE__ */ new Map();
+  async allows(field) {
+    const rule = this.rules?.get(field);
+    if (rule === "hidden" || rule === "read" && this.kind === "update") return false;
+    const fn = field.access?.[this.kind];
+    if (!fn) return true;
+    let allowed2 = this.cache.get(field);
+    if (allowed2 === void 0) {
+      allowed2 = await fn(this.args) === true;
+      this.cache.set(field, allowed2);
+    }
+    return allowed2;
+  }
+};
+async function stripFields(fields, doc, read2) {
+  const result = { ...doc };
+  for (const field of fields) {
+    if (!(field.name in result)) continue;
+    if (field.hidden || read2 && !await read2.allows(field)) {
+      delete result[field.name];
+      continue;
+    }
+    const value = result[field.name];
+    if (field.type === "group" && value && typeof value === "object") {
+      result[field.name] = await stripFields(field.fields, value, read2);
+    } else if (hasRows(field) && Array.isArray(value)) {
+      result[field.name] = await Promise.all(
+        value.map((row) => {
+          const fields2 = rowFields(field, row);
+          return fields2 && row && typeof row === "object" ? stripFields(fields2, row, read2) : row;
+        })
+      );
+    }
+  }
+  return result;
+}
+async function filterInput(fields, data, update2) {
+  const result = { ...data };
+  for (const field of fields) {
+    if (!(field.name in result)) continue;
+    if (field.hidden || update2 && !await update2.allows(field)) {
+      delete result[field.name];
+      continue;
+    }
+    const value = result[field.name];
+    if (field.type === "group" && value && typeof value === "object" && !Array.isArray(value)) {
+      result[field.name] = await filterInput(field.fields, value, update2);
+    } else if (hasRows(field) && Array.isArray(value)) {
+      result[field.name] = await Promise.all(
+        value.map((row) => {
+          const fields2 = rowFields(field, row);
+          return fields2 && row && typeof row === "object" ? filterInput(fields2, row, update2) : row;
+        })
+      );
+    }
+  }
+  return result;
+}
+
 // src/auth/emails.ts
 var esc = (value) => value.replace(
   /[&<>"']/g,
   (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]
 );
 function email(subject, lines, button) {
-  const text = [...lines, ...button ? ["", button.url] : []].join("\n");
+  const text2 = [...lines, ...button ? ["", button.url] : []].join("\n");
   const html = `<div style="font-family:system-ui,sans-serif;font-size:15px;line-height:1.5;color:#1f2328">${lines.map((line) => `<p>${esc(line)}</p>`).join("")}${button ? `<p><a href="${esc(button.url)}" style="display:inline-block;padding:10px 18px;border-radius:8px;background:#2f6f5e;color:#fff;text-decoration:none;font-weight:600">${esc(button.label)}</a></p><p style="font-size:13px;color:#656d76">${esc(button.url)}</p>` : ""}</div>`;
-  return { subject, text, html };
+  return { subject, text: text2, html };
 }
 var hours = (expiresAt) => Math.max(1, Math.round(((expiresAt?.getTime() ?? Date.now()) - Date.now()) / 36e5));
 var days = (expiresAt) => Math.max(1, Math.round(hours(expiresAt) / 24));
@@ -642,7 +992,17 @@ var DEFAULT_PASSWORD_EMAILS = {
     ],
     { label: "Set a new password", url }
   ),
-  invite: ({ url = "", locale, expiresAt, user }) => locale === "th" ? email(
+  invite: ({ url = "", locale, expiresAt, user, sso }) => sso ? locale === "th" ? email(
+    "\u0E04\u0E38\u0E13\u0E44\u0E14\u0E49\u0E23\u0E31\u0E1A\u0E40\u0E0A\u0E34\u0E0D\u0E43\u0E2B\u0E49\u0E43\u0E0A\u0E49\u0E07\u0E32\u0E19\u0E23\u0E30\u0E1A\u0E1A\u0E08\u0E31\u0E14\u0E01\u0E32\u0E23\u0E40\u0E19\u0E37\u0E49\u0E2D\u0E2B\u0E32",
+    [`\u0E21\u0E35\u0E1A\u0E31\u0E0D\u0E0A\u0E35\u0E2A\u0E33\u0E2B\u0E23\u0E31\u0E1A ${user.email} \u0E23\u0E2D\u0E04\u0E38\u0E13\u0E2D\u0E22\u0E39\u0E48 \u0E40\u0E02\u0E49\u0E32\u0E2A\u0E39\u0E48\u0E23\u0E30\u0E1A\u0E1A\u0E14\u0E49\u0E27\u0E22 ${sso.join(" \u0E2B\u0E23\u0E37\u0E2D ")} \u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E40\u0E23\u0E34\u0E48\u0E21\u0E43\u0E0A\u0E49\u0E07\u0E32\u0E19`],
+    { label: "\u0E40\u0E02\u0E49\u0E32\u0E2A\u0E39\u0E48\u0E23\u0E30\u0E1A\u0E1A", url }
+  ) : email(
+    "You're invited to the content admin",
+    [
+      `An account for ${user.email} is waiting for you. Sign in with ${sso.join(" or ")} to start.`
+    ],
+    { label: "Sign in", url }
+  ) : locale === "th" ? email(
     "\u0E04\u0E38\u0E13\u0E44\u0E14\u0E49\u0E23\u0E31\u0E1A\u0E40\u0E0A\u0E34\u0E0D\u0E43\u0E2B\u0E49\u0E43\u0E0A\u0E49\u0E07\u0E32\u0E19\u0E23\u0E30\u0E1A\u0E1A\u0E08\u0E31\u0E14\u0E01\u0E32\u0E23\u0E40\u0E19\u0E37\u0E49\u0E2D\u0E2B\u0E32",
     [
       `\u0E21\u0E35\u0E1A\u0E31\u0E0D\u0E0A\u0E35\u0E2A\u0E33\u0E2B\u0E23\u0E31\u0E1A ${user.email} \u0E23\u0E2D\u0E04\u0E38\u0E13\u0E2D\u0E22\u0E39\u0E48 \u0E15\u0E31\u0E49\u0E07\u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E48\u0E32\u0E19\u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E40\u0E23\u0E34\u0E48\u0E21\u0E43\u0E0A\u0E49\u0E07\u0E32\u0E19`,
@@ -711,8 +1071,11 @@ async function fakeVerify(password) {
   return false;
 }
 
+// src/auth/sso.ts
+import { createHmac as createHmac3, randomBytes as randomBytes4 } from "crypto";
+
 // src/auth/tokens.ts
-import { createHash as createHash2, createHmac, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHash as createHash2, createHmac as createHmac2, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual3 } from "crypto";
 function newToken() {
   return randomBytes3(32).toString("base64url");
 }
@@ -720,7 +1083,7 @@ function hashToken(token) {
   return createHash2("sha256").update(token).digest("hex");
 }
 function hmac(secret, value) {
-  return createHmac("sha256", secret).update(value).digest("base64url");
+  return createHmac2("sha256", secret).update(value).digest("base64url");
 }
 function signToken(secret, token) {
   return `${token}.${hmac(secret, `session:${token}`)}`;
@@ -792,14 +1155,309 @@ function passwordTokenMatches(secret, token, fingerprint) {
   return safeEqual(token.slice(dot + 1), hmac(secret, `password:${payload}:${fingerprint}`));
 }
 
+// src/auth/sso.ts
+var SSO_COOKIE = "ecms-sso";
+var PENDING_TTL = 10 * 6e4;
+var random = () => randomBytes4(32).toString("base64url");
+function sign(secret, payload) {
+  return createHmac3("sha256", secret).update(`sso:${payload}`).digest("base64url");
+}
+function seal(secret, pending) {
+  const payload = Buffer.from(JSON.stringify(pending)).toString("base64url");
+  return `${payload}.${sign(secret, payload)}`;
+}
+function unseal(secret, value) {
+  if (!value) return null;
+  const dot = value.lastIndexOf(".");
+  if (dot <= 0) return null;
+  const payload = value.slice(0, dot);
+  if (!safeEqual(value.slice(dot + 1), sign(secret, payload))) return null;
+  try {
+    const pending = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    return typeof pending.e === "number" && pending.e > Date.now() ? pending : null;
+  } catch {
+    return null;
+  }
+}
+var SingleSignOn = class {
+  constructor(cms) {
+    this.cms = cms;
+  }
+  cms;
+  get config() {
+    return this.cms.config;
+  }
+  get enabled() {
+    return this.config.auth.providers.length > 0;
+  }
+  providers() {
+    return this.config.auth.providers.map((p) => ({
+      id: p.id,
+      name: p.name,
+      icon: p.icon ?? "key"
+    }));
+  }
+  /** Whether a user may sign in with a password (`auth.password: false` leaves only admins). */
+  passwordAllowed(user) {
+    return this.config.auth.password || user.role === "admin";
+  }
+  /** `<serverURL><api>/auth/<id>/callback`, or `null` without `serverURL` in production. */
+  callbackURL(provider, origin) {
+    const base = this.cms.auth.passwordLinkBase(origin);
+    return base ? `${base}${this.config.routes.api}/auth/${provider}/callback` : null;
+  }
+  /**
+   * Starts signing in (or, with `user`, linking an account): the provider's URL to send the
+   * browser to, and the sealed value of the cookie that must come back with it.
+   */
+  async start(providerId, options) {
+    const provider = this.provider(providerId);
+    const redirectUri = this.callbackURL(provider.id, options.origin);
+    if (!redirectUri)
+      throw new QueryError("Signing in with providers needs `serverURL` in production");
+    const pending = {
+      p: provider.id,
+      s: random(),
+      v: random(),
+      n: random(),
+      r: this.adminPage(options.redirect),
+      ...options.user ? { u: String(options.user.id) } : {},
+      e: Date.now() + PENDING_TTL
+    };
+    const url = await provider.authorizationURL({
+      redirectUri,
+      state: pending.s,
+      codeVerifier: pending.v,
+      nonce: pending.n
+    });
+    return { url: url.toString(), cookie: seal(this.config.secret, pending) };
+  }
+  /**
+   * Finishes at `<api>/auth/<id>/callback`: checks the response, finds (or makes) the user and
+   * starts a session. Returns where to send the browser; failures end on the login page (or the
+   * account page, when linking) with `?sso=<outcome>`.
+   */
+  async finish(providerId, options) {
+    const admin = this.config.admin.path.replace(/\/+$/, "");
+    const pending = unseal(this.config.secret, options.cookie);
+    let email2 = null;
+    const back = async (page2, outcome) => {
+      await this.cms.audit.record({
+        action: "sso.failed",
+        target: "auth",
+        ...page2 === "login" ? { user: null, email: email2 } : {},
+        detail: { provider: providerId, outcome }
+      });
+      return { redirect: `${admin}/${page2}?sso=${outcome}` };
+    };
+    const page = pending?.u ? "account" : "login";
+    if (!pending || pending.p !== providerId) return await back(page, "expired");
+    const state = options.url.searchParams.get("state") ?? "";
+    if (!safeEqual(state, pending.s)) return await back(page, "expired");
+    if (options.url.searchParams.has("error")) return await back(page, "cancelled");
+    const provider = this.provider(providerId);
+    const redirectUri = this.callbackURL(provider.id, options.origin);
+    let profile;
+    try {
+      if (!redirectUri) throw new Error("no callback URL");
+      profile = await provider.callback({
+        redirectUri,
+        state: pending.s,
+        codeVerifier: pending.v,
+        nonce: pending.n,
+        url: options.url
+      });
+    } catch (error) {
+      this.cms.logger.warn(
+        `Signing in with ${provider.name} failed: ${error.message || String(error)}`
+      );
+      return await back(page, "failed");
+    }
+    const subject = String(profile.subject);
+    email2 = profile.email?.trim().toLowerCase() || null;
+    if (pending.u) {
+      if (!options.user || String(options.user.id) !== pending.u)
+        return await back("account", "failed");
+      const existing = await this.identity(provider.id, subject);
+      if (existing && String(existing.user) !== pending.u) return await back("account", "taken");
+      if (!existing) await this.addIdentity(options.user.id, provider.id, subject, email2);
+      await this.cms.audit.record({
+        action: "sso.link",
+        target: "auth",
+        user: options.user,
+        detail: { provider: provider.id, email: email2 }
+      });
+      return { redirect: `${admin}/account?sso=linked` };
+    }
+    let user = null;
+    const identity = await this.identity(provider.id, subject);
+    if (identity) {
+      user = await this.cms.db.findById({ collection: USERS, id: identity.user });
+    } else {
+      if (!email2 || !profile.emailVerified)
+        return await back("login", email2 ? "unverified" : "no-account");
+      user = await this.userByEmail(email2);
+      if (!user) user = await this.signUp(email2, profile.name);
+      if (!user) return await back("login", "no-account");
+      await this.addIdentity(user.id, provider.id, subject, email2);
+    }
+    if (!user) return await back("login", "no-account");
+    if (user.active === false) return await back("login", "inactive");
+    const found = identity ?? await this.identity(provider.id, subject);
+    if (found) {
+      const { id, ...rest } = found;
+      await this.cms.db.update({
+        collection: USER_IDENTITIES,
+        id,
+        data: { ...rest, email: email2, lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }
+      });
+    }
+    const session = await this.cms.auth.createSession(user.id);
+    await this.cms.audit.record({
+      action: "sso.login",
+      target: "auth",
+      user: session.user,
+      detail: { provider: provider.id, email: email2 }
+    });
+    return { redirect: pending.r, session };
+  }
+  /** A user's outside accounts. */
+  async identities(userId) {
+    if (!this.enabled) return [];
+    const { docs } = await this.cms.db.find({
+      collection: USER_IDENTITIES,
+      where: { user: { equals: userId } },
+      sort: ["id"],
+      limit: 0,
+      page: 1
+    });
+    return docs.map((row) => ({
+      id: row.id,
+      provider: String(row.provider),
+      name: this.config.auth.providers.find((p) => p.id === row.provider)?.name ?? String(row.provider),
+      email: typeof row.email === "string" ? row.email : null,
+      createdAt: String(row.createdAt),
+      lastUsedAt: typeof row.lastUsedAt === "string" ? row.lastUsedAt : null
+    }));
+  }
+  /**
+   * Unlinks an outside account: the user's own, or anyone's for admins. Refuses to unlink the
+   * last way a user has to sign in.
+   */
+  async unlink(actor, identityId) {
+    if (!this.enabled) throw new NotFoundError(USER_IDENTITIES, identityId);
+    const row = await this.cms.db.findById({ collection: USER_IDENTITIES, id: identityId });
+    if (!row) throw new NotFoundError(USER_IDENTITIES, identityId);
+    const own = String(row.user) === String(actor.id);
+    if (!own && (actor.role !== "admin" || actor.apiKey)) throw new ForbiddenError();
+    const user = await this.cms.db.findById({ collection: USERS, id: row.user });
+    const others = (await this.identities(row.user)).length - 1;
+    const password = !!user?.passwordHash && this.passwordAllowed(user);
+    if (others === 0 && !password)
+      throw new ValidationError(USER_IDENTITIES, [
+        { field: "provider", message: "is the only way left to sign in to this account" }
+      ]);
+    await this.cms.db.delete({ collection: USER_IDENTITIES, id: row.id });
+    await this.cms.audit.record({
+      action: "sso.unlink",
+      target: USERS,
+      doc: row.user,
+      title: typeof user?.email === "string" ? user.email : null,
+      detail: { provider: String(row.provider), email: row.email ?? null }
+    });
+  }
+  /** Forgets a deleted user's outside accounts. */
+  async forget(userId) {
+    if (!this.enabled) return;
+    for (const identity of await this.identities(userId))
+      await this.cms.db.delete({ collection: USER_IDENTITIES, id: identity.id });
+  }
+  settings(origin) {
+    const { allowSignUp } = this.config.auth;
+    return {
+      providers: this.config.auth.providers.map((p) => ({
+        id: p.id,
+        name: p.name,
+        icon: p.icon ?? "key",
+        callbackURL: this.callbackURL(p.id, origin),
+        details: { ...p.describe?.() ?? {} }
+      })),
+      password: this.config.auth.password ? "everyone" : "admins",
+      signUp: allowSignUp.domains.length > 0 ? { domains: [...allowSignUp.domains], role: allowSignUp.role ?? this.defaultRole() } : null,
+      serverURL: !!this.config.serverURL
+    };
+  }
+  // -------------------------------------------------------------------------
+  provider(id) {
+    const provider = this.config.auth.providers.find((p) => p.id === id);
+    if (!provider) throw new NotFoundError("auth providers", id);
+    return provider;
+  }
+  /** Only pages of the admin: anything else (another site) goes to the admin's home. */
+  adminPage(redirect) {
+    const admin = this.config.admin.path.replace(/\/+$/, "");
+    if (typeof redirect === "string" && (redirect === admin || redirect.startsWith(`${admin}/`)) && !redirect.startsWith("//") && !redirect.includes("\\"))
+      return redirect;
+    return `${admin}/`;
+  }
+  async identity(provider, subject) {
+    const { docs } = await this.cms.db.find({
+      collection: USER_IDENTITIES,
+      where: { and: [{ provider: { equals: provider } }, { subject: { equals: subject } }] },
+      sort: [],
+      limit: 1,
+      page: 1
+    });
+    return docs[0];
+  }
+  async addIdentity(user, provider, subject, email2) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    await this.cms.db.create({
+      collection: USER_IDENTITIES,
+      data: { user, provider, subject, email: email2, lastUsedAt: now, createdAt: now, updatedAt: now }
+    });
+  }
+  async userByEmail(email2) {
+    const { docs } = await this.cms.db.find({
+      collection: USERS,
+      where: { email: { equals: email2 } },
+      sort: [],
+      limit: 1,
+      page: 1
+    });
+    return docs[0] ?? null;
+  }
+  /** A new account for people from `allowSignUp.domains`. */
+  async signUp(email2, name) {
+    const { domains, role } = this.config.auth.allowSignUp;
+    const domain = email2.slice(email2.lastIndexOf("@") + 1);
+    if (!domains.some((d) => d.toLowerCase() === domain)) return null;
+    const created = await this.cms.create(USERS, {
+      email: email2,
+      role: role ?? this.defaultRole(),
+      active: true,
+      ...name ? { name } : {}
+    });
+    this.cms.logger.info(`${email2} signed up with a provider`);
+    return this.cms.db.findById({ collection: USERS, id: created.id });
+  }
+  defaultRole() {
+    const roles = this.config.auth.roles;
+    return roles.includes("editor") ? "editor" : roles[roles.length - 1];
+  }
+};
+
 // src/auth/auth.ts
 var INVALID = "Invalid email or password";
 var RESET_REQUESTS = 3;
 var Auth = class {
   constructor(cms) {
     this.cms = cms;
+    this.sso = new SingleSignOn(cms);
   }
   cms;
+  /** Signing in with outside accounts (`auth.providers`). */
+  sso;
   get db() {
     return this.cms.db;
   }
@@ -811,7 +1469,12 @@ var Auth = class {
     const email2 = typeof args.email === "string" ? args.email.trim().toLowerCase() : "";
     const password = typeof args.password === "string" ? args.password : "";
     const key2 = `${email2}|${args.ip ?? ""}`;
-    await this.checkRateLimit(key2);
+    try {
+      await this.checkRateLimit(key2);
+    } catch (error) {
+      await this.cms.audit.record({ action: "login.locked", target: "auth", user: null, email: email2 });
+      throw error;
+    }
     const [user] = email2 ? (await this.db.find({
       collection: USERS,
       where: { email: { equals: email2 } },
@@ -823,11 +1486,34 @@ var Auth = class {
     const valid = user && hash && password ? await verifyPassword(password, hash) : await fakeVerify(password);
     if (!user || !valid || user.active === false) {
       await this.recordFailure(key2);
+      await this.cms.audit.record({
+        action: "login.failed",
+        target: "auth",
+        user: null,
+        email: email2,
+        detail: {
+          reason: !user ? "unknown email" : user.active === false ? "deactivated" : "wrong password"
+        }
+      });
       throw new UnauthorizedError(INVALID);
     }
     await this.clearFailures(key2);
+    if (!this.sso.passwordAllowed(user)) {
+      await this.cms.audit.record({
+        action: "login.failed",
+        target: "auth",
+        user: null,
+        email: email2,
+        detail: { reason: "passwords are off" }
+      });
+      throw new UnauthorizedError(
+        `Sign in with ${this.config.auth.providers.map((p) => p.name).join(" or ")}`
+      );
+    }
     await this.deleteExpiredSessions(user.id);
-    return this.startSession(user);
+    const session = await this.startSession(user);
+    await this.cms.audit.record({ action: "login", target: "auth", user: session.user });
+    return session;
   }
   /** Creates the first admin. Only works while there are no users. */
   async registerFirstUser(args) {
@@ -850,7 +1536,15 @@ var Auth = class {
     const token = unsignToken(this.config.secret, signedToken);
     if (!token) return;
     const session = await this.findSession(token);
-    if (session) await this.db.delete({ collection: SESSIONS, id: session.id });
+    if (!session) return;
+    await this.db.delete({ collection: SESSIONS, id: session.id });
+    const user = await this.db.findById({ collection: USERS, id: session.user });
+    if (user)
+      await this.cms.audit.record({
+        action: "logout",
+        target: "auth",
+        user: await this.toAuthUser(user)
+      });
   }
   /**
    * Returns the user for a signed session token, or for an API key (`ecms_…`, with `apiKey` set
@@ -924,8 +1618,9 @@ var Auth = class {
     });
     if (recent >= RESET_REQUESTS) return;
     await this.recordFailure(key2);
+    await this.cms.audit.record({ action: "password.forgot", target: "auth", user: null, email: email2 });
     const user = await this.findByEmail(email2);
-    if (!user || user.active === false) return;
+    if (!user || user.active === false || !this.sso.passwordAllowed(user)) return;
     await this.mailPasswordLink(user, user.passwordHash ? "reset" : "invite", args);
   }
   /**
@@ -942,6 +1637,13 @@ var Auth = class {
     if (user.active === false) throw new QueryError("This user is deactivated");
     const purpose = user.passwordHash ? "reset" : "invite";
     await this.mailPasswordLink(user, purpose, options);
+    await this.cms.audit.record({
+      action: "password.link",
+      target: USERS,
+      doc: user.id,
+      title: String(user.email),
+      detail: { purpose }
+    });
     return purpose;
   }
   /** The user and purpose of a valid, unused password link, or `null`. */
@@ -967,6 +1669,12 @@ var Auth = class {
     await this.clearFailures(key2);
     const user = await this.db.findById({ collection: USERS, id: found.user.id });
     const session = await this.startSession(user);
+    await this.cms.audit.record({
+      action: "password.reset",
+      target: "auth",
+      user: session.user,
+      detail: { purpose: found.purpose }
+    });
     if (found.purpose === "reset") {
       const content = await (this.config.auth.emails.passwordChanged ?? DEFAULT_PASSWORD_EMAILS.passwordChanged)({
         user: await this.toAuthUser(user),
@@ -981,7 +1689,7 @@ var Auth = class {
     if (!claims || claims.expiresAt <= Date.now()) return null;
     const id = /^\d+$/.test(claims.userId) ? Number(claims.userId) : claims.userId;
     const user = await this.db.findById({ collection: USERS, id });
-    if (!user || user.active === false) return null;
+    if (!user || user.active === false || !this.sso.passwordAllowed(user)) return null;
     const fingerprint = passwordFingerprint(user.passwordHash);
     if (!passwordTokenMatches(this.config.secret, token, fingerprint)) return null;
     return { user, purpose: claims.purpose };
@@ -996,13 +1704,14 @@ var Auth = class {
       expiresAt,
       fingerprint: passwordFingerprint(user.passwordHash)
     });
-    const url = `${base}${this.config.admin.path}/reset-password?token=${encodeURIComponent(token)}`;
+    const sso = this.sso.passwordAllowed(user) ? void 0 : this.config.auth.providers.map((p) => p.name);
+    const url = sso ? `${base}${this.config.admin.path}/login` : `${base}${this.config.admin.path}/reset-password?token=${encodeURIComponent(token)}`;
     const write = purpose === "invite" ? this.config.auth.emails.invite ?? DEFAULT_PASSWORD_EMAILS.invite : this.config.auth.emails.resetPassword ?? DEFAULT_PASSWORD_EMAILS.resetPassword;
     const content = await write({
       user: await this.toAuthUser(user),
       url,
       locale: this.localeOf(options.locale),
-      expiresAt: new Date(expiresAt)
+      ...sso ? { sso } : { expiresAt: new Date(expiresAt) }
     });
     await this.cms.sendEmail({ to: String(user.email), ...content });
   }
@@ -1282,26 +1991,26 @@ async function writeBackupFile(cms, file) {
       });
   }
 }
-var slug = (text) => text.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "easy-cms";
+var slug = (text2) => text2.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "easy-cms";
 function filenameFor(cms, date) {
   const pad = (n) => String(n).padStart(2, "0");
   const stamp = `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}-${pad(date.getHours())}${pad(date.getMinutes())}`;
   return `${slug(cms.config.admin.brand.name || "easy-cms")}-${stamp}.db.gz`;
 }
 function toAdmin(row) {
-  const text = (value) => typeof value === "string" && value !== "" ? value : null;
+  const text2 = (value) => typeof value === "string" && value !== "" ? value : null;
   return {
     id: row.id,
     state: ["pending", "running", "done", "failed"].includes(row.state) ? row.state : "failed",
     trigger: row.trigger === "scheduled" ? "scheduled" : "manual",
-    filename: text(row.filename),
+    filename: text2(row.filename),
     size: typeof row.size === "number" ? row.size : null,
-    startedAt: text(row.startedAt),
-    finishedAt: text(row.finishedAt),
-    error: text(row.error),
-    author: text(row.author),
-    downloadedBy: text(row.downloadedBy),
-    downloadedAt: text(row.downloadedAt)
+    startedAt: text2(row.startedAt),
+    finishedAt: text2(row.finishedAt),
+    error: text2(row.error),
+    author: text2(row.author),
+    downloadedBy: text2(row.downloadedBy),
+    downloadedAt: text2(row.downloadedAt)
   };
 }
 async function update(cms, row, data) {
@@ -1618,8 +2327,8 @@ function itemsOf(field, n) {
   return `${n} ${unit}${n === 1 ? "" : "s"}`;
 }
 var isEmpty = (value) => value === void 0 || value === null || value === "";
-function slugify(text) {
-  return text.normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{M}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "");
+function slugify(text2) {
+  return text2.normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{M}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "");
 }
 function applyDefaults(fields, data, localization = null) {
   const result = { ...data };
@@ -2369,16 +3078,18 @@ var viewId = {
 };
 var tagOf = (component) => typeof component === "string" ? component : component.tag;
 var Roles = class {
-  constructor(config, db, log) {
+  constructor(config, db, log, audit) {
     this.config = config;
     this.db = db;
     this.log = log;
+    this.audit = audit;
     this.enabled = config.auth.rbac;
     this.versions = new VersionStore(db);
   }
   config;
   db;
   log;
+  audit;
   enabled;
   versions;
   cache;
@@ -2612,6 +3323,7 @@ var Roles = class {
       this.clean(input.permissions),
       author.id
     );
+    await this.audit?.({ action: "role.create", target: "roles", doc: row.id, title: key2 });
     return this.toRole(row, 0);
   }
   async update(id, input, author) {
@@ -2626,6 +3338,18 @@ var Roles = class {
     const { id: _id, ...rest } = data;
     const saved = await this.db.update({ collection: ROLES, id: row.id, data: rest });
     await this.record(saved, author.id);
+    const changes = [];
+    if ((row.name ?? "") !== (saved.name ?? ""))
+      changes.push({ field: "name", before: row.name ?? "", after: saved.name ?? "" });
+    if (JSON.stringify(row.permissions ?? {}) !== JSON.stringify(saved.permissions ?? {}))
+      changes.push({ field: "permissions" });
+    await this.audit?.({
+      action: "role.update",
+      target: "roles",
+      doc: row.id,
+      title: String(row.key),
+      changes
+    });
     this.invalidate();
     return this.toRole(saved, await this.users(String(row.key)));
   }
@@ -2639,6 +3363,7 @@ var Roles = class {
       throw new EasyCMSError(`${users} user(s) have this role; give them another role first`, 409);
     await this.db.delete({ collection: ROLES, id: row.id });
     await this.versions.deleteAll(ROLES, row.id);
+    await this.audit?.({ action: "role.delete", target: "roles", doc: row.id, title: key2 });
     this.invalidate();
   }
   async history(id) {
@@ -2673,6 +3398,7 @@ var Roles = class {
   views() {
     return [
       { id: "status" },
+      ...this.config.audit ? [{ id: "audit" }] : [],
       ...this.config.collections.some(
         (c) => c.slug === WEBHOOK_DELIVERIES || c.slug === EMAIL_DELIVERIES
       ) ? [{ id: "deliveries" }] : [],
@@ -2877,7 +3603,7 @@ function rank(role, config) {
 }
 
 // src/webhooks.ts
-import { createHmac as createHmac2, randomUUID as randomUUID2 } from "crypto";
+import { createHmac as createHmac4, randomUUID as randomUUID2 } from "crypto";
 var WEBHOOK_EVENTS = [
   "create",
   "update",
@@ -3021,7 +3747,7 @@ var Webhooks = class {
       ...hook.headers
     };
     if (hook.secret) {
-      headers["x-easy-cms-signature"] = `sha256=${createHmac2("sha256", hook.secret).update(body).digest("hex")}`;
+      headers["x-easy-cms-signature"] = `sha256=${createHmac4("sha256", hook.secret).update(body).digest("hex")}`;
     }
     try {
       const response = await this.fetcher(hook.url, {
@@ -3068,8 +3794,11 @@ var RESERVED_SLUGS = /* @__PURE__ */ new Set([
   "email-deliveries",
   "database-backups",
   "user-roles",
+  "user-identities",
+  "audit-logs",
   "api-keys",
   "jobs",
+  "auth",
   "migrations",
   "access"
 ]);
@@ -3091,6 +3820,7 @@ function validateConfig(config) {
   validateAdminViews(config, add);
   validateUpload(config, add);
   validateBackups(config, add);
+  validateAudit(config, add);
   validateAuth(config, add);
   validateCors(config.cors, add);
   validateLocalization(config, add);
@@ -3317,6 +4047,52 @@ function validateAuth(config, add) {
   if (auth === void 0) return;
   if (auth.rbac !== void 0 && typeof auth.rbac !== "boolean")
     add("auth.rbac", "must be true or false");
+  if (auth.password !== void 0 && typeof auth.password !== "boolean")
+    add("auth.password", "must be true or false");
+  const providers = auth.providers;
+  if (providers !== void 0) {
+    if (!Array.isArray(providers)) {
+      add(
+        "auth.providers",
+        "must be an array",
+        "e.g. providers: [google({ clientId, clientSecret })]"
+      );
+    } else {
+      const ids = /* @__PURE__ */ new Set();
+      providers.forEach((provider, i) => {
+        const p = provider;
+        const path = `auth.providers[${i}]`;
+        if (typeof p !== "object" || p === null || typeof p.authorizationURL !== "function" || typeof p.callback !== "function") {
+          add(
+            path,
+            "must be a provider",
+            "e.g. google({ clientId, clientSecret }) from @easy-cms/auth-oauth"
+          );
+          return;
+        }
+        if (typeof p.id !== "string" || !PAGE_PATH.test(p.id))
+          add(`${path}.id`, 'must be lowercase letters, digits and "-"');
+        else if (ids.has(p.id))
+          add(`${path}.id`, `"${p.id}" is used by another provider`, "give one of them its own id");
+        else ids.add(p.id);
+        if (typeof p.name !== "string" || p.name.trim() === "")
+          add(`${path}.name`, "must be a name");
+      });
+    }
+  }
+  const signUp = auth.allowSignUp;
+  if (signUp !== void 0) {
+    if (typeof signUp !== "object" || signUp === null || !Array.isArray(signUp.domains) || signUp.domains.some((d) => typeof d !== "string" || !/^[a-z0-9.-]+\.[a-z]{2,}$/i.test(d)))
+      add("auth.allowSignUp.domains", "must be email domains", "e.g. domains: ['example.com']");
+    if (signUp?.role === "admin")
+      add("auth.allowSignUp.role", `can't be "admin"`, "make admins by hand, in Settings \u2192 Users");
+    else if (signUp?.role !== void 0 && (typeof signUp.role !== "string" || !auth.rbac && !(auth.roles ?? ["admin", "editor"]).includes(signUp.role)))
+      add("auth.allowSignUp.role", "must be one of auth.roles");
+    if (!Array.isArray(providers) || providers.length === 0)
+      add("auth.allowSignUp", "needs auth.providers");
+  }
+  if (auth.password === false && (!Array.isArray(providers) || providers.length === 0))
+    add("auth.password", "false needs auth.providers", "otherwise only admins could sign in");
   if (auth.roles !== void 0) {
     const roles = auth.roles;
     if (!Array.isArray(roles) || roles.some((r) => typeof r !== "string" || r === "")) {
@@ -3529,6 +4305,22 @@ function validateUpload(config, add) {
     add("upload.fromURL.allowPrivate", "must be true or false");
 }
 var HOST_PATTERN = /^(\*|(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*)$/i;
+function validateAudit(config, add) {
+  const audit = config.audit;
+  if (audit !== void 0 && typeof audit !== "boolean") {
+    const a = audit;
+    if (typeof a !== "object" || a === null)
+      add("audit", "must be true or { keep, values, failedLogins }");
+    else {
+      if (a.keep !== void 0 && !(Number.isInteger(a.keep) && a.keep >= 0))
+        add("audit.keep", "must be a number of days (0: keep all)");
+      if (a.values !== void 0 && typeof a.values !== "boolean")
+        add("audit.values", "must be true or false");
+      if (a.failedLogins !== void 0 && !(Number.isInteger(a.failedLogins) && a.failedLogins > 0))
+        add("audit.failedLogins", "must be a positive number");
+    }
+  }
+}
 function validateBackups(config, add) {
   const backups = config.backups;
   if (backups === void 0) return;
@@ -3843,7 +4635,15 @@ function validateComponents(components, path, add) {
 }
 var ENDPOINT_METHODS = ["get", "post", "put", "patch", "delete"];
 var ENDPOINT_SEGMENT = /^(:[A-Za-z_][A-Za-z0-9_]*|[A-Za-z0-9._~-]+)$/;
-var RESERVED_ENDPOINT_ROOTS = /* @__PURE__ */ new Set(["users", "globals", "admin", "jobs", "media", "api-keys"]);
+var RESERVED_ENDPOINT_ROOTS = /* @__PURE__ */ new Set([
+  "users",
+  "globals",
+  "admin",
+  "jobs",
+  "media",
+  "api-keys",
+  "auth"
+]);
 function validateCommands(config, add) {
   const commands = config.commands;
   if (commands === void 0) return;
@@ -4029,6 +4829,9 @@ async function resolveConfig(input) {
     auth: {
       roles: config.auth?.roles ?? DEFAULT_ROLES,
       rbac: config.auth?.rbac === true,
+      providers: config.auth?.providers ?? [],
+      allowSignUp: config.auth?.allowSignUp ?? { domains: [] },
+      password: config.auth?.password !== false,
       tokenExpiration: config.auth?.tokenExpiration ?? DEFAULT_TOKEN_EXPIRATION,
       maxLoginAttempts: config.auth?.maxLoginAttempts ?? 5,
       lockWindow: config.auth?.lockWindow ?? 15 * 60,
@@ -4037,6 +4840,7 @@ async function resolveConfig(input) {
       inviteExpiration: config.auth?.inviteExpiration ?? 7 * 24 * 60 * 60,
       emails: config.auth?.emails ?? {}
     },
+    audit: config.audit ? resolveAudit(config.audit === true ? {} : config.audit) : false,
     collections: [
       ...config.collections ?? [],
       ...internalCollections,
@@ -4047,7 +4851,9 @@ async function resolveConfig(input) {
       ...config.apiKeys ? [apiKeysCollection] : [],
       ...config.email ? [emailDeliveriesCollection] : [],
       databaseBackupsCollection,
-      ...config.auth?.rbac ? [rolesCollection] : []
+      ...config.auth?.rbac ? [rolesCollection] : [],
+      ...(config.auth?.providers?.length ?? 0) > 0 ? [userIdentitiesCollection] : [],
+      ...config.audit ? [auditLogsCollection] : []
     ],
     globals: config.globals ?? [],
     endpoints: config.endpoints ?? [],
@@ -4066,6 +4872,13 @@ function usesVersions(config) {
 function usesSchedule(config) {
   return [...config.collections ?? [], ...config.globals ?? []].some((c) => c.schedule);
 }
+function resolveAudit(audit) {
+  return {
+    keep: audit.keep ?? DEFAULT_AUDIT_KEEP,
+    values: audit.values !== false,
+    failedLogins: audit.failedLogins ?? DEFAULT_FAILED_LOGINS
+  };
+}
 
 // src/load-config.ts
 var CONFIG_FILE_NAMES = [
@@ -4113,7 +4926,7 @@ async function loadConfig(options = {}) {
 }
 
 // src/local-api.ts
-import { randomBytes as randomBytes4 } from "crypto";
+import { randomBytes as randomBytes5 } from "crypto";
 
 // src/localization.ts
 var ALL_LOCALES = "all";
@@ -4249,13 +5062,13 @@ function sniffMimeType(data) {
   if (ascii(data, 0, 5) === "%PDF-") return "application/pdf";
   const head = data.subarray(0, 4096);
   if (head.includes(0)) return void 0;
-  let text;
+  let text2;
   try {
-    text = new TextDecoder("utf-8", { fatal: true }).decode(head);
+    text2 = new TextDecoder("utf-8", { fatal: true }).decode(head);
   } catch {
     return void 0;
   }
-  const trimmed = text.replace(/^/, "").trimStart();
+  const trimmed = text2.replace(/^/, "").trimStart();
   if (/^(<\?xml[^>]*>\s*)?(<!--[\s\S]*?-->\s*)*(<!DOCTYPE svg[^>]*>\s*)?<svg[\s>]/i.test(trimmed))
     return "image/svg+xml";
   return "text/plain";
@@ -4310,10 +5123,10 @@ function imageDimensions(data, type) {
   }
   return void 0;
 }
-function storageKey(originalName, type, random) {
+function storageKey(originalName, type, random2) {
   const name = originalName.split(/[\\/]/).pop() ?? "";
   const base = name.replace(/(?<=.)\.[^.]*$/, "").normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{M}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "file";
-  return `${base}-${random}.${EXTENSIONS[type] ?? "bin"}`;
+  return `${base}-${random2}.${EXTENSIONS[type] ?? "bin"}`;
 }
 
 // src/populate.ts
@@ -4631,6 +5444,8 @@ var EasyCMS = class {
   cwd;
   /** Roles and their permissions (`auth.rbac`, Settings → Roles). */
   roles;
+  /** Who did what (`audit`, Settings → Audit log). */
+  audit;
   versions;
   webhooks;
   mailer;
@@ -4641,7 +5456,13 @@ var EasyCMS = class {
     this.storage = storage;
     this.cwd = cwd;
     this.versions = new VersionStore(db);
-    this.roles = new Roles(config, db, (message2) => logger.info(message2));
+    this.roles = new Roles(
+      config,
+      db,
+      (message2) => logger.info(message2),
+      (entry) => this.audit.record(entry)
+    );
+    this.audit = new AuditLog(this);
     this.webhooks = new Webhooks(
       config.webhooks ?? [],
       logger,
@@ -4752,8 +5573,8 @@ var EasyCMS = class {
         }
       ]);
     }
-    const random = randomBytes4(4).toString("hex");
-    const filename = storageKey(file.name, mimeType, random);
+    const random2 = randomBytes5(4).toString("hex");
+    const filename = storageKey(file.name, mimeType, random2);
     const stored = [];
     try {
       await this.storage.put(filename, file.data, { contentType: mimeType });
@@ -5123,6 +5944,7 @@ var EasyCMS = class {
         operation: "update"
       });
       this.emit(config, "draft", draft);
+      await this.audited(config, "draft", draft, current, guard, mode);
       const [out2] = await this.output(config, [draft], guard, {
         ...options,
         draft: true
@@ -5145,6 +5967,7 @@ var EasyCMS = class {
       operation: "update"
     });
     this.emit(config, "update", doc, existing.status);
+    await this.audited(config, "update", doc, current, guard, mode);
     const [out] = await this.output(config, [doc], guard, { ...options, draft: true });
     return out;
   }
@@ -5175,6 +5998,7 @@ var EasyCMS = class {
         await this.roles.transfer(parsed, heir.id);
       } else await this.roles.transfer(parsed, null);
       await this.auth.revokeSessions(parsed);
+      await this.auth.sso.forget(parsed);
     }
     await this.db.delete({ collection: collection2, id: parsed });
     if (versionLimit(config)) await this.versions.deleteAll(collectionParent(collection2), parsed);
@@ -5188,6 +6012,7 @@ var EasyCMS = class {
       doc: existing
     });
     this.emit(config, "delete", existing);
+    await this.audited(config, "delete", existing, existing, guard);
     const [out] = await this.output(config, [existing], guard, { depth: 0, draft: true });
     return out;
   }
@@ -5317,6 +6142,7 @@ var EasyCMS = class {
         operation: "update"
       });
       this.emit(config, "draft", draft);
+      await this.audited(config, "draft", draft, current, guard, mode);
       return this.findGlobal(slug2, { ...options, draft: true });
     }
     const doc = await this.db.updateGlobal({ slug: slug2, data: { ...prepared, updatedAt: now } });
@@ -5328,6 +6154,7 @@ var EasyCMS = class {
       operation: "update"
     });
     this.emit(config, "update", doc, existing.status);
+    await this.audited(config, "update", doc, current, guard, mode);
     return this.findGlobal(slug2, { ...options, draft: true });
   }
   /**
@@ -5429,16 +6256,19 @@ var EasyCMS = class {
    * scheduler and the cron endpoint (`GET <api>/jobs/run`) call.
    */
   async runJobs(now = /* @__PURE__ */ new Date()) {
-    const scheduled = await this.runScheduled(now);
-    await this.pruneFailedDeliveries(now);
-    await runDueBackups(this, now).catch(
-      (error) => this.logger.error(`Backups: ${error.message}`)
-    );
-    return {
-      ...scheduled,
-      webhooks: await this.retryWebhooks(now),
-      emails: await this.mailer.retry(now)
-    };
+    return auditContext.run({ via: "scheduler", user: null }, async () => {
+      const scheduled = await this.runScheduled(now);
+      await this.pruneFailedDeliveries(now);
+      await runDueBackups(this, now).catch(
+        (error) => this.logger.error(`Backups: ${error.message}`)
+      );
+      await this.audit.upkeep(now).catch((error) => this.logger.error(`Audit log: ${error.message}`));
+      return {
+        ...scheduled,
+        webhooks: await this.retryWebhooks(now),
+        emails: await this.mailer.retry(now)
+      };
+    });
   }
   /**
    * Tries webhook deliveries that are due for another attempt. Deliveries are kept in the
@@ -5603,6 +6433,13 @@ var EasyCMS = class {
         updatedAt: now
       }
     });
+    await this.audit.record({
+      action: "schedule",
+      target: parent,
+      ...parent.startsWith("global:") ? {} : { doc },
+      ...guardOf(options).user ? { user: guardOf(options).user } : {},
+      detail: { action: job.action, at: runAt.toISOString() }
+    });
     return toJob(row);
   }
   /**
@@ -5662,6 +6499,12 @@ var EasyCMS = class {
     const job = (await this.pendingJobs(parent, doc)).find((j) => String(j.id) === String(jobId));
     if (!job) throw new NotFoundError("scheduled job", jobId);
     await this.db.delete({ collection: SCHEDULED_JOBS, id: job.id });
+    await this.audit.record({
+      action: "unschedule",
+      target: parent,
+      ...parent.startsWith("global:") ? {} : { doc },
+      detail: { action: job.action, at: job.runAt }
+    });
   }
   /**
    * @internal One attempt now for a saved webhook delivery or email (the admin's Retry): removed
@@ -5906,6 +6749,7 @@ var EasyCMS = class {
       operation: "create"
     });
     this.emit(config, "create", doc);
+    await this.audited(config, "create", doc, void 0, hookGuard ?? guard);
     const [out] = await this.output(config, [doc], hookGuard ?? guard, { ...options, draft: true });
     return out;
   }
@@ -5979,6 +6823,31 @@ var EasyCMS = class {
     if (after !== "published" && before === "published")
       this.webhooks.emit("unpublish", target, body);
   }
+  /**
+   * Writes the audit log entry for a change (`audit`): publishing, unpublishing and restoring
+   * are told apart from other saves.
+   */
+  async audited(config, event, doc, previous, guard, mode = "save") {
+    if (!this.audit.enabled) return;
+    let action = event;
+    if (event === "update" || event === "draft") {
+      const was = previous?.status;
+      if (mode === "restore") action = "restore";
+      else if (config.drafts && doc.status === "published" && was !== "published")
+        action = "publish";
+      else if (config.drafts && event === "update" && doc.status !== "published" && was === "published")
+        action = "unpublish";
+    }
+    const global2 = !this.config.collections.includes(config);
+    await this.audit.content(
+      config,
+      global2,
+      action,
+      event === "delete" ? void 0 : doc,
+      event === "create" ? void 0 : previous,
+      guard.user
+    );
+  }
   /** Records a version after a save, when the collection or global keeps versions. */
   async saveVersion(config, parent, id, doc, guard) {
     const max = versionLimit(config);
@@ -6321,9 +7190,9 @@ var PER_PAGE = 50;
 var collectionOf = (kind) => kind === "webhook" ? WEBHOOK_DELIVERIES : EMAIL_DELIVERIES;
 var exists = (cms, kind) => cms.config.collections.some((c) => c.slug === collectionOf(kind));
 var isDeliveryKind = (value) => value === "webhook" || value === "email";
-function parse(text) {
+function parse(text2) {
   try {
-    const value = JSON.parse(String(text ?? ""));
+    const value = JSON.parse(String(text2 ?? ""));
     return typeof value === "object" && value !== null ? value : {};
   } catch {
     return {};
@@ -6490,7 +7359,7 @@ async function sendTestEmail(cms, user, to, locale) {
   const th = locale === "th" || locale !== "en" && cms.config.admin.locale === "th";
   const time = (/* @__PURE__ */ new Date()).toISOString();
   const subject = th ? `\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E17\u0E14\u0E2A\u0E2D\u0E1A\u0E08\u0E32\u0E01 ${site}` : `Test email from ${site}`;
-  const text = th ? `\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E19\u0E35\u0E49\u0E2A\u0E48\u0E07\u0E08\u0E32\u0E01\u0E2B\u0E19\u0E49\u0E32 \u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32 \u2192 \u0E2D\u0E35\u0E40\u0E21\u0E25 \u0E02\u0E2D\u0E07 ${site} \u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E17\u0E14\u0E2A\u0E2D\u0E1A\u0E01\u0E32\u0E23\u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32
+  const text2 = th ? `\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E19\u0E35\u0E49\u0E2A\u0E48\u0E07\u0E08\u0E32\u0E01\u0E2B\u0E19\u0E49\u0E32 \u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32 \u2192 \u0E2D\u0E35\u0E40\u0E21\u0E25 \u0E02\u0E2D\u0E07 ${site} \u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E17\u0E14\u0E2A\u0E2D\u0E1A\u0E01\u0E32\u0E23\u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32
 
 \u0E2A\u0E48\u0E07\u0E42\u0E14\u0E22: ${user.email}
 Adapter: ${adapter.name ?? "custom"}
@@ -6502,7 +7371,7 @@ Adapter: ${adapter.name ?? "custom"}
 From: ${from}
 Time: ${time}`;
   try {
-    await adapter.send({ to: address, subject, text, from });
+    await adapter.send({ to: address, subject, text: text2, from });
     return { ok: true };
   } catch (error) {
     return { ok: false, error: message(error) };
@@ -6678,7 +7547,9 @@ async function adminSchema(cms, user, origin) {
     deliveries: deliveries && await cms.roles.canView(user, "deliveries"),
     backups: admin,
     email: admin,
-    roles: admin && cms.roles.enabled
+    roles: admin && cms.roles.enabled,
+    sso: admin && cms.auth.sso.enabled,
+    audit: cms.audit.enabled && await cms.roles.canView(user, "audit")
   };
   const roles = await cms.roles.options();
   return {
@@ -6694,6 +7565,7 @@ async function adminSchema(cms, user, origin) {
     uploadFromURL: cms.config.upload.fromURL !== void 0,
     views,
     rbac: cms.roles.enabled,
+    providers: cms.auth.sso.providers(),
     ...views.deliveries ? {
       deliveries: {
         webhook: cms.config.collections.some((c) => c.slug === WEBHOOK_DELIVERIES),
@@ -6739,16 +7611,16 @@ async function widgets(cms, user) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.34.0" : "0.0.0-dev";
+var VERSION = true ? "0.36.0" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
-var DAY = 864e5;
+var DAY2 = 864e5;
 var has = (cms, slug2) => cms.config.collections.some((c) => c.slug === slug2);
 async function adminStatus(cms) {
   const config = cms.config;
   const attention = [];
   const now = Date.now();
-  const weekAgo = new Date(now - 7 * DAY).toISOString();
+  const weekAgo = new Date(now - 7 * DAY2).toISOString();
   if (has(cms, WEBHOOK_DELIVERIES)) {
     const failed = await cms.db.find({
       collection: WEBHOOK_DELIVERIES,
@@ -6798,6 +7670,7 @@ async function adminStatus(cms) {
   }
   const backups = await backupAttention(cms);
   if (backups) attention.push(backups);
+  attention.push(...await cms.audit.attention());
   if (!config.email) attention.push({ id: "no-email" });
   if (!config.serverURL && process.env.NODE_ENV === "production")
     attention.push({ id: "no-server-url" });
@@ -7007,7 +7880,15 @@ async function respond(cms, request, url, path, root, options, production) {
     const ctx = { request, url, user, via: user ? via : null, token, headers };
     const method = request.method.toUpperCase();
     if (method !== "GET" && method !== "HEAD") checkCsrf(cms, ctx);
-    const result = root ? await customEndpoint(cms, ctx, method, segments, true, options) : await customEndpoint(cms, ctx, method, segments, false, options) ?? await route(cms, ctx, method, segments, options);
+    const audit = {
+      user,
+      ip: options.getClientIp?.(request),
+      userAgent: request.headers.get("user-agent")
+    };
+    const result = await auditContext.run(
+      audit,
+      async () => root ? await customEndpoint(cms, ctx, method, segments, true, options) : await customEndpoint(cms, ctx, method, segments, false, options) ?? await route(cms, ctx, method, segments, options)
+    );
     if (!result) throw new HttpError("Not found", 404);
     if (result.body instanceof Response) return result.body;
     return new Response(JSON.stringify(result.body), { status: result.status ?? 200, headers });
@@ -7089,6 +7970,7 @@ async function route(cms, ctx, method, segments, options) {
   const access = { overrideAccess: false, user: ctx.user, ...parseLocale(ctx.url) };
   const draft = ctx.user !== null && ctx.url.searchParams.get("draft") === "true";
   if (segments.length === 0) throw new HttpError("Not found", 404);
+  if (first === "auth") return ssoRoute(cms, ctx, method, segments);
   if (first === USERS && second !== void 0 && third === void 0 && !/^\d+$/.test(second)) {
     switch (`${method} ${second}`) {
       case "POST login": {
@@ -7119,7 +8001,10 @@ async function route(cms, ctx, method, segments, options) {
           body: {
             hasUsers: await cms.auth.hasUsers(),
             // The login page offers "Forgot password?" only when the email can be sent.
-            passwordReset: cms.auth.canSendPasswordLinks(ctx.url.origin)
+            passwordReset: cms.auth.canSendPasswordLinks(ctx.url.origin),
+            // Buttons to sign in with outside accounts; `password: false`: only admins use one.
+            providers: cms.auth.sso.providers(),
+            password: cms.config.auth.password
           }
         };
       // Forgot password: the same answer whether or not the email has an account.
@@ -7188,8 +8073,11 @@ async function route(cms, ctx, method, segments, options) {
     if (extra !== void 0) throw new HttpError("Not found", 404);
     if (id2 === void 0) {
       if (method === "GET") return { body: await listBackups(cms) };
-      if (method === "POST")
-        return { status: 202, body: await startBackup(cms, "manual", ctx.user.email) };
+      if (method === "POST") {
+        const started = await startBackup(cms, "manual", ctx.user.email);
+        await cms.audit.record({ action: "backup.start", target: "backups", doc: started.id });
+        return { status: 202, body: started };
+      }
       throw methodNotAllowed(ctx, "GET, POST");
     }
     const parsed = parseId(id2);
@@ -7197,6 +8085,12 @@ async function route(cms, ctx, method, segments, options) {
     if (action === "download") {
       if (method !== "GET") throw methodNotAllowed(ctx, "GET");
       const file = await downloadBackup(cms, parsed, ctx.user.email);
+      await cms.audit.record({
+        action: "backup.download",
+        target: "backups",
+        doc: parsed,
+        title: file.filename
+      });
       return {
         body: new Response(file.body, {
           headers: {
@@ -7211,6 +8105,7 @@ async function route(cms, ctx, method, segments, options) {
     if (action !== void 0) throw new HttpError("Not found", 404);
     if (method !== "DELETE") throw methodNotAllowed(ctx, "DELETE");
     await deleteBackup(cms, parsed);
+    await cms.audit.record({ action: "backup.delete", target: "backups", doc: parsed });
     return { body: { deleted: 1 } };
   }
   if (first === "admin" && second === "email") {
@@ -7226,10 +8121,53 @@ async function route(cms, ctx, method, segments, options) {
     if (action === "verify") return { body: await verifyEmail(cms) };
     if (action === "test") {
       const body = await readJson(ctx.request);
-      return { body: await sendTestEmail(cms, ctx.user, body.to, body.locale) };
+      const sent = await sendTestEmail(cms, ctx.user, body.to, body.locale);
+      await cms.audit.record({ action: "email.test", target: "email", detail: { ...sent } });
+      return { body: sent };
     }
     throw new HttpError("Not found", 404);
   }
+  if (first === "admin" && second === "sso" && third === void 0) {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+    if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+    return { body: cms.auth.sso.settings(ctx.url.origin) };
+  }
+  if (first === "admin" && (second === "audit" || second === "audit.csv")) {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (!cms.audit.enabled) throw new HttpError("Not found", 404);
+    if (!await cms.roles.canView(ctx.user, "audit")) throw new ForbiddenError();
+    const q = ctx.url.searchParams;
+    const filter = {
+      action: q.get("action"),
+      target: q.get("target"),
+      doc: q.get("doc"),
+      actor: q.get("actor"),
+      from: q.get("from"),
+      to: q.get("to")
+    };
+    if (second === "audit.csv" && third === void 0) {
+      if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+      return {
+        body: new Response(await cms.audit.csv(filter), {
+          headers: {
+            "content-type": "text/csv; charset=utf-8",
+            "content-disposition": `attachment; filename="audit-log-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}.csv"`,
+            "cache-control": "no-store",
+            "x-content-type-options": "nosniff"
+          }
+        })
+      };
+    }
+    if (second === "audit" && third === "verify" && segments.length === 3) {
+      if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+      return { body: await cms.audit.verify() };
+    }
+    if (second !== "audit" || third !== void 0) throw new HttpError("Not found", 404);
+    if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+    const page = Math.max(1, Number.parseInt(q.get("page") ?? "1", 10) || 1);
+    return { body: await cms.audit.list(filter, page) };
+  }
   if (first === "admin" && second === "owned" && third !== void 0 && segments.length === 3) {
     if (!ctx.user) throw new UnauthorizedError();
     if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
@@ -7280,21 +8218,46 @@ async function route(cms, ctx, method, segments, options) {
     if (!isDeliveryKind(kind) || extra !== void 0) throw new HttpError("Not found", 404);
     if (id2 === "retry" && action === void 0) {
       if (method !== "POST") throw methodNotAllowed(ctx, "POST");
-      return { body: await retryFailedDeliveries(cms, kind) };
+      const retried = await retryFailedDeliveries(cms, kind);
+      await cms.audit.record({
+        action: "delivery.retry",
+        target: "deliveries",
+        detail: { kind, all: true }
+      });
+      return { body: retried };
     }
     if (id2 === void 0) {
       if (method !== "DELETE") throw methodNotAllowed(ctx, "DELETE");
-      return { body: await deleteFailedDeliveries(cms, kind) };
+      const deleted = await deleteFailedDeliveries(cms, kind);
+      await cms.audit.record({
+        action: "delivery.delete",
+        target: "deliveries",
+        detail: { kind, all: true }
+      });
+      return { body: deleted };
     }
     const parsed = parseId(id2);
     if (parsed === void 0) throw new HttpError("Not found", 404);
     if (action === "retry") {
       if (method !== "POST") throw methodNotAllowed(ctx, "POST");
-      return { body: await cms.retryDelivery(kind, parsed) };
+      const retried = await cms.retryDelivery(kind, parsed);
+      await cms.audit.record({
+        action: "delivery.retry",
+        target: "deliveries",
+        doc: parsed,
+        detail: { kind }
+      });
+      return { body: retried };
     }
     if (action !== void 0) throw new HttpError("Not found", 404);
     if (method !== "DELETE") throw methodNotAllowed(ctx, "DELETE");
     await deleteDelivery(cms, kind, parsed);
+    await cms.audit.record({
+      action: "delivery.delete",
+      target: "deliveries",
+      doc: parsed,
+      detail: { kind }
+    });
     return { body: { deleted: 1 } };
   }
   if (first === "admin") {
@@ -7680,11 +8643,11 @@ async function readJson(request) {
   }
   const declared = Number(request.headers.get("content-length") ?? 0);
   if (declared > MAX_BODY_BYTES) throw new HttpError("Request body too large", 413);
-  const text = await request.text();
-  if (Buffer.byteLength(text) > MAX_BODY_BYTES) throw new HttpError("Request body too large", 413);
+  const text2 = await request.text();
+  if (Buffer.byteLength(text2) > MAX_BODY_BYTES) throw new HttpError("Request body too large", 413);
   let body;
   try {
-    body = JSON.parse(text);
+    body = JSON.parse(text2);
   } catch {
     throw new HttpError("Request body is not valid JSON", 400);
   }
@@ -7703,6 +8666,67 @@ function cookie(ctx, name, value, opts) {
   if (opts.maxAge !== void 0) parts.push(`Max-Age=${opts.maxAge}`);
   return parts.join("; ");
 }
+async function ssoRoute(cms, ctx, method, segments) {
+  const sso = cms.auth.sso;
+  if (!sso.enabled) throw new HttpError("Not found", 404);
+  const [, second, third, extra] = segments;
+  if (extra !== void 0 || second === void 0) throw new HttpError("Not found", 404);
+  if (second === "identities") {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (third === void 0) {
+      if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+      const asked = ctx.url.searchParams.get("user");
+      const target = asked === null ? ctx.user.id : parseId(asked) ?? asked;
+      if (String(target) !== String(ctx.user.id) && (ctx.user.role !== "admin" || ctx.user.apiKey))
+        throw new ForbiddenError();
+      return { body: await sso.identities(target) };
+    }
+    if (method !== "DELETE") throw methodNotAllowed(ctx, "DELETE");
+    const id = parseId(third);
+    if (id === void 0) throw new HttpError("Not found", 404);
+    await sso.unlink(ctx.user, id);
+    return { body: { deleted: 1 } };
+  }
+  const pendingCookie = (value, maxAge) => cookie(ctx, SSO_COOKIE, value, { httpOnly: true, maxAge });
+  if (third === "login") {
+    if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+    const started = await sso.start(second, {
+      origin: ctx.url.origin,
+      redirect: ctx.url.searchParams.get("redirect")
+    });
+    ctx.headers.append("set-cookie", pendingCookie(started.cookie, 600));
+    return { body: redirectResponse(ctx, started.url) };
+  }
+  if (third === "link") {
+    if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+    if (!ctx.user || ctx.user.apiKey) throw new UnauthorizedError();
+    const started = await sso.start(second, {
+      origin: ctx.url.origin,
+      redirect: null,
+      user: ctx.user
+    });
+    ctx.headers.append("set-cookie", pendingCookie(started.cookie, 600));
+    return { body: { url: started.url } };
+  }
+  if (third === "callback") {
+    if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+    const finished = await sso.finish(second, {
+      url: ctx.url,
+      cookie: readCookie(ctx.request, SSO_COOKIE),
+      origin: ctx.url.origin,
+      user: ctx.user
+    });
+    ctx.headers.append("set-cookie", pendingCookie("", 0));
+    if (finished.session) setSessionCookies(cms, ctx, finished.session);
+    return { body: redirectResponse(ctx, finished.redirect) };
+  }
+  throw new HttpError("Not found", 404);
+}
+function redirectResponse(ctx, location) {
+  const headers = new Headers({ location, "cache-control": "no-store" });
+  for (const value of ctx.headers.getSetCookie()) headers.append("set-cookie", value);
+  return new Response(null, { status: 302, headers });
+}
 function setSessionCookies(cms, ctx, session) {
   const maxAge = cms.config.auth.tokenExpiration;
   ctx.headers.append(
@@ -7902,6 +8926,7 @@ export {
   API_KEYS,
   API_KEY_GLOBAL_OPERATIONS,
   API_KEY_OPERATIONS,
+  AuditLog,
   Auth,
   BUILTIN_COLLECTIONS,
   CONFIG_FILE_NAMES,
@@ -7932,6 +8957,7 @@ export {
   ROLE_OPERATIONS,
   Roles,
   SESSION_COOKIE,
+  SSO_COOKIE,
   SchemaError,
   TooManyRequestsError,
   UnauthorizedError,