@easy-cms/core 0.35.0 → 0.36.0

package/dist/index.js

@@ -129,197 +129,9 @@ function cleanPermissions(value, known) {
   };
 }
 
-// src/errors.ts
-var ConfigError = class _ConfigError extends Error {
-  issues;
-  constructor(issues) {
-    super(_ConfigError.format(issues));
-    this.name = "ConfigError";
-    this.issues = issues;
-  }
-  static format(issues) {
-    const lines = issues.map((issue) => {
-      const hint = issue.hint ? `
-    \u2192 ${issue.hint}` : "";
-      return `  \u2022 ${issue.path}: ${issue.message}${hint}`;
-    });
-    const noun = issues.length === 1 ? "problem" : "problems";
-    return `Invalid Easy CMS config (${issues.length} ${noun}):
-${lines.join("\n")}`;
-  }
-};
-var EasyCMSError = class extends Error {
-  status;
-  constructor(message2, status) {
-    super(message2);
-    this.name = "EasyCMSError";
-    this.status = status;
-  }
-};
-var ValidationError = class extends EasyCMSError {
-  errors;
-  constructor(collection2, errors) {
-    const list = errors.map((e) => `${e.field}: ${e.message}`).join("; ");
-    super(`Invalid data for "${collection2}": ${list}`, 400);
-    this.name = "ValidationError";
-    this.errors = errors;
-  }
-};
-var NotFoundError = class extends EasyCMSError {
-  constructor(collection2, id) {
-    super(`No document with id ${JSON.stringify(id)} in "${collection2}"`, 404);
-    this.name = "NotFoundError";
-  }
-};
-var QueryError = class extends EasyCMSError {
-  constructor(message2) {
-    super(message2, 400);
-    this.name = "QueryError";
-  }
-};
-var SchemaError = class extends EasyCMSError {
-  constructor(message2) {
-    super(message2, 500);
-    this.name = "SchemaError";
-  }
-};
-var UnauthorizedError = class extends EasyCMSError {
-  constructor(message2 = "You must be logged in") {
-    super(message2, 401);
-    this.name = "UnauthorizedError";
-  }
-};
-var ForbiddenError = class extends EasyCMSError {
-  constructor(message2 = "You are not allowed to do this") {
-    super(message2, 403);
-    this.name = "ForbiddenError";
-  }
-};
-var TooManyRequestsError = class extends EasyCMSError {
-  constructor(message2) {
-    super(message2, 429);
-    this.name = "TooManyRequestsError";
-  }
-};
-var PayloadTooLargeError = class extends EasyCMSError {
-  constructor(message2) {
-    super(message2, 413);
-    this.name = "PayloadTooLargeError";
-  }
-};
-
-// src/fields.ts
-var isHasMany = (field) => (field.type === "select" || field.type === "relationship" || field.type === "upload") && field.hasMany === true;
-function mimeAllowedBy(mimeType, patterns) {
-  const type = mimeType.toLowerCase();
-  return patterns.some((pattern) => {
-    const p = pattern.toLowerCase();
-    return p.endsWith("/*") ? type.startsWith(p.slice(0, -1)) : type === p;
-  });
-}
-var hasRows = (field) => field.type === "array" || field.type === "blocks";
-function rowFields(field, row) {
-  if (field.type === "array") return field.fields;
-  const type = row && typeof row === "object" ? row.blockType : void 0;
-  return field.blocks.find((block) => block.slug === type)?.fields;
-}
-var FIELD_TYPES = [
-  "text",
-  "textarea",
-  "number",
-  "boolean",
-  "date",
-  "email",
-  "json",
-  "select",
-  "slug",
-  "richText",
-  "upload",
-  "relationship",
-  "array",
-  "group",
-  "blocks"
-];
-
-// src/access-control.ts
-async function evaluateAccess(access, args) {
-  const result = await (access ?? isLoggedIn)(args);
-  if (typeof result === "boolean") return result;
-  if (typeof result === "object" && result !== null) return result;
-  throw new QueryError("Access functions must return a boolean or a where query");
-}
-function andWhere(where, constraint) {
-  if (constraint === true) return where;
-  return where === void 0 ? constraint : { and: [where, constraint] };
-}
-var FieldAccessChecker = class {
-  /** `rules`: the user's role's rules for top-level fields (`auth.rbac`), on top of `access`. */
-  constructor(kind, args, rules) {
-    this.kind = kind;
-    this.args = args;
-    this.rules = rules;
-  }
-  kind;
-  args;
-  rules;
-  cache = /* @__PURE__ */ new Map();
-  async allows(field) {
-    const rule = this.rules?.get(field);
-    if (rule === "hidden" || rule === "read" && this.kind === "update") return false;
-    const fn = field.access?.[this.kind];
-    if (!fn) return true;
-    let allowed2 = this.cache.get(field);
-    if (allowed2 === void 0) {
-      allowed2 = await fn(this.args) === true;
-      this.cache.set(field, allowed2);
-    }
-    return allowed2;
-  }
-};
-async function stripFields(fields, doc, read2) {
-  const result = { ...doc };
-  for (const field of fields) {
-    if (!(field.name in result)) continue;
-    if (field.hidden || read2 && !await read2.allows(field)) {
-      delete result[field.name];
-      continue;
-    }
-    const value = result[field.name];
-    if (field.type === "group" && value && typeof value === "object") {
-      result[field.name] = await stripFields(field.fields, value, read2);
-    } else if (hasRows(field) && Array.isArray(value)) {
-      result[field.name] = await Promise.all(
-        value.map((row) => {
-          const fields2 = rowFields(field, row);
-          return fields2 && row && typeof row === "object" ? stripFields(fields2, row, read2) : row;
-        })
-      );
-    }
-  }
-  return result;
-}
-async function filterInput(fields, data, update2) {
-  const result = { ...data };
-  for (const field of fields) {
-    if (!(field.name in result)) continue;
-    if (field.hidden || update2 && !await update2.allows(field)) {
-      delete result[field.name];
-      continue;
-    }
-    const value = result[field.name];
-    if (field.type === "group" && value && typeof value === "object" && !Array.isArray(value)) {
-      result[field.name] = await filterInput(field.fields, value, update2);
-    } else if (hasRows(field) && Array.isArray(value)) {
-      result[field.name] = await Promise.all(
-        value.map((row) => {
-          const fields2 = rowFields(field, row);
-          return fields2 && row && typeof row === "object" ? filterInput(fields2, row, update2) : row;
-        })
-      );
-    }
-  }
-  return result;
-}
+// src/audit.ts
+import { AsyncLocalStorage } from "async_hooks";
+import { createHmac } from "crypto";
 
 // src/builtins.ts
 var USERS = "users";
@@ -333,6 +145,7 @@ var EMAIL_DELIVERIES = "email-deliveries";
 var DATABASE_BACKUPS = "database-backups";
 var ROLES = "user-roles";
 var USER_IDENTITIES = "user-identities";
+var AUDIT_LOGS = "audit-logs";
 var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SESSIONS,
   LOGIN_ATTEMPTS,
@@ -342,7 +155,8 @@ var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   EMAIL_DELIVERIES,
   DATABASE_BACKUPS,
   ROLES,
-  USER_IDENTITIES
+  USER_IDENTITIES,
+  AUDIT_LOGS
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
 var CREATED_BY_FIELD = {
@@ -567,66 +381,588 @@ var scheduledJobsCollection = {
     { name: "author", type: "number" }
   ]
 };
-var webhookDeliveriesCollection = {
-  slug: WEBHOOK_DELIVERIES,
-  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
-  fields: [
-    { name: "url", type: "text", required: true },
-    { name: "event", type: "text", required: true },
-    // The JSON body as first sent: retries are byte-for-byte the same, signature included.
-    { name: "body", type: "textarea", required: true },
-    { name: "delivery", type: "text", required: true },
-    { name: "attempts", type: "number", required: true },
-    { name: "nextAttemptAt", type: "text", required: true, index: true },
-    // pending | failed
-    { name: "state", type: "text", required: true, index: true },
-    { name: "error", type: "text" }
-  ]
+var webhookDeliveriesCollection = {
+  slug: WEBHOOK_DELIVERIES,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    { name: "url", type: "text", required: true },
+    { name: "event", type: "text", required: true },
+    // The JSON body as first sent: retries are byte-for-byte the same, signature included.
+    { name: "body", type: "textarea", required: true },
+    { name: "delivery", type: "text", required: true },
+    { name: "attempts", type: "number", required: true },
+    { name: "nextAttemptAt", type: "text", required: true, index: true },
+    // pending | failed
+    { name: "state", type: "text", required: true, index: true },
+    { name: "error", type: "text" }
+  ]
+};
+var databaseBackupsCollection = {
+  slug: DATABASE_BACKUPS,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    // pending | running | done | failed
+    { name: "state", type: "text", required: true, index: true },
+    // manual | scheduled
+    { name: "trigger", type: "text", required: true },
+    { name: "filename", type: "text" },
+    { name: "size", type: "number" },
+    { name: "startedAt", type: "text", index: true },
+    { name: "finishedAt", type: "text" },
+    { name: "error", type: "text" },
+    // Who started it (email), for manual ones.
+    { name: "author", type: "text" },
+    { name: "downloadedBy", type: "text" },
+    { name: "downloadedAt", type: "text" }
+  ]
+};
+var userIdentitiesCollection = {
+  slug: USER_IDENTITIES,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    { name: "user", type: "relationship", to: USERS, required: true, index: true },
+    // The provider's id (`google`) and its id for the account (`sub`).
+    { name: "provider", type: "text", required: true, index: true },
+    { name: "subject", type: "text", required: true, index: true },
+    { name: "email", type: "text" },
+    { name: "lastUsedAt", type: "text" }
+  ]
+};
+var auditLogsCollection = {
+  slug: AUDIT_LOGS,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    { name: "action", type: "text", required: true, index: true },
+    // A collection slug, `global:<slug>`, or an area (auth, roles, backups…).
+    { name: "target", type: "text", index: true },
+    { name: "doc", type: "text", index: true },
+    { name: "title", type: "text" },
+    { name: "actorId", type: "text" },
+    { name: "actorEmail", type: "text", index: true },
+    // user | api-key | system | scheduler
+    { name: "via", type: "text" },
+    { name: "ip", type: "text" },
+    { name: "userAgent", type: "text" },
+    { name: "changes", type: "json" },
+    { name: "detail", type: "json" },
+    { name: "signature", type: "text" }
+  ]
+};
+var emailDeliveriesCollection = {
+  slug: EMAIL_DELIVERIES,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    // The message as JSON.
+    { name: "message", type: "textarea", required: true },
+    { name: "attempts", type: "number", required: true },
+    { name: "nextAttemptAt", type: "text", required: true, index: true },
+    // pending | failed
+    { name: "state", type: "text", required: true, index: true },
+    { name: "error", type: "text" }
+  ]
+};
+
+// src/audit.ts
+var DEFAULT_AUDIT_KEEP = 365;
+var DEFAULT_FAILED_LOGINS = 20;
+var MAX_VALUE = 500;
+var PAGE = 50;
+var CSV_LIMIT = 1e4;
+var DAY = 864e5;
+var BULKY = /* @__PURE__ */ new Set(["richText", "blocks", "array", "json"]);
+var auditContext = new AsyncLocalStorage();
+function stable(value) {
+  if (value === void 0 || value === null) return "null";
+  if (Array.isArray(value)) return `[${value.map(stable).join(",")}]`;
+  if (typeof value === "object") {
+    const keys = Object.keys(value).filter((k) => value[k] !== void 0).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${stable(value[k])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+var SIGNED = [
+  "action",
+  "target",
+  "doc",
+  "title",
+  "actorId",
+  "actorEmail",
+  "via",
+  "ip",
+  "userAgent",
+  "changes",
+  "detail",
+  "createdAt"
+];
+function cut(value) {
+  if (typeof value === "string")
+    return value.length > MAX_VALUE ? `${value.slice(0, MAX_VALUE)}\u2026` : value;
+  if (value !== null && typeof value === "object") {
+    const json = JSON.stringify(value);
+    return json.length > MAX_VALUE ? "\u2026" : value;
+  }
+  return value;
+}
+var text = (value) => typeof value === "string" && value !== "" ? value : null;
+var AuditLog = class {
+  constructor(cms) {
+    this.cms = cms;
+  }
+  cms;
+  /** Entries that could not be written since the server started. */
+  failures = 0;
+  get enabled() {
+    return this.cms.config.audit !== false;
+  }
+  get settings() {
+    return this.cms.config.audit || {
+      keep: DEFAULT_AUDIT_KEEP,
+      values: true,
+      failedLogins: DEFAULT_FAILED_LOGINS
+    };
+  }
+  /**
+   * Writes an entry. The user defaults to the request's. Never throws: a failure is logged and
+   * counted, and the dashboard says so.
+   */
+  async record(entry) {
+    if (!this.enabled) return;
+    try {
+      const context = auditContext.getStore();
+      const user = entry.user !== void 0 ? entry.user : context?.user ?? null;
+      const apiKey = user?.apiKey;
+      const row = {
+        action: entry.action,
+        target: entry.target ?? null,
+        doc: entry.doc === void 0 || entry.doc === null ? null : String(entry.doc),
+        title: entry.title ? cut(entry.title) : null,
+        actorId: user ? String(user.id) : null,
+        actorEmail: user?.email ?? entry.email ?? null,
+        via: apiKey ? "api-key" : context?.via === "scheduler" ? "scheduler" : user ? "user" : "system",
+        ip: context?.ip ?? null,
+        userAgent: context?.userAgent ? context.userAgent.slice(0, 200) : null,
+        changes: entry.changes && entry.changes.length > 0 ? entry.changes : null,
+        detail: apiKey ? { ...entry.detail, apiKey: apiKey.name ?? "" } : entry.detail ?? null,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      row.signature = this.sign(row);
+      row.updatedAt = row.createdAt;
+      await this.cms.db.create({ collection: AUDIT_LOGS, data: row });
+    } catch (error) {
+      this.failures++;
+      this.cms.logger.error(
+        `Audit log: could not write "${entry.action}": ${error.message}`
+      );
+    }
+  }
+  /**
+   * A change to a document or global: what changed between `before` and `after`. Internal
+   * collections (sessions, versions…) are not logged.
+   */
+  async content(config, global2, action, after, before, user) {
+    if (!this.enabled) return;
+    if (!global2 && INTERNAL_COLLECTIONS.has(config.slug)) return;
+    const doc = after ?? before;
+    const titleField = global2 ? void 0 : config.useAsTitle;
+    const rawTitle = titleField ? doc?.[titleField] : void 0;
+    const title = typeof rawTitle === "string" ? rawTitle : rawTitle && typeof rawTitle === "object" ? text(
+      Object.values(rawTitle).find((v) => typeof v === "string")
+    ) : null;
+    await this.record({
+      action,
+      target: global2 ? `global:${config.slug}` : config.slug,
+      doc: global2 ? null : doc?.id ?? null,
+      title,
+      // A trusted call without a user keeps the request's (or is the system).
+      ...user ? { user } : {},
+      changes: action === "delete" ? null : this.diff(config.fields, before ?? {}, after ?? {})
+    });
+  }
+  /** Fields whose stored value changed. Hidden ones never (the password only as "changed"). */
+  diff(fields, before, after) {
+    const values = this.settings.values;
+    const out = [];
+    for (const field of fields) {
+      if (field.hidden) continue;
+      const a = before[field.name];
+      const b = after[field.name];
+      if (stable(a) === stable(b)) continue;
+      if (!values || BULKY.has(field.type)) out.push({ field: field.name });
+      else out.push({ field: field.name, before: cut(a ?? null), after: cut(b ?? null) });
+    }
+    if (before.passwordHash !== after.passwordHash && (before.passwordHash || after.passwordHash))
+      out.push({ field: "password" });
+    return out;
+  }
+  async list(filter, page = 1) {
+    const result = await this.cms.db.find({
+      collection: AUDIT_LOGS,
+      where: this.where(filter),
+      sort: ["-id"],
+      limit: PAGE,
+      page
+    });
+    return {
+      docs: result.docs.map(toEntry),
+      page: result.page,
+      totalPages: result.totalPages,
+      totalDocs: result.totalDocs
+    };
+  }
+  /** The filtered entries as CSV (the newest 10,000). */
+  async csv(filter) {
+    const { docs } = await this.cms.db.find({
+      collection: AUDIT_LOGS,
+      where: this.where(filter),
+      sort: ["-id"],
+      limit: CSV_LIMIT,
+      page: 1
+    });
+    const cell = (value) => {
+      const s = value === null || value === void 0 ? "" : typeof value === "string" ? value : JSON.stringify(value);
+      const safe = /^[=+\-@\t\r]/.test(s) ? `'${s}` : s;
+      return /[",\n\r]/.test(safe) ? `"${safe.replaceAll('"', '""')}"` : safe;
+    };
+    const lines = [
+      ["at", "action", "target", "doc", "title", "actor", "via", "ip", "changes", "detail"].join(
+        ","
+      ),
+      ...docs.map(toEntry).map(
+        (e) => [
+          e.at,
+          e.action,
+          e.target,
+          e.doc,
+          e.title,
+          e.actor.email,
+          e.actor.via,
+          e.actor.ip,
+          e.changes,
+          e.detail
+        ].map(cell).join(",")
+      )
+    ];
+    return `${lines.join("\r\n")}\r
+`;
+  }
+  /** Checks every entry's signature, and that no ids are missing. */
+  async verify() {
+    const invalid = [];
+    let checked = 0;
+    let gaps = 0;
+    let previous;
+    for (let page = 1; ; page++) {
+      const result = await this.cms.db.find({
+        collection: AUDIT_LOGS,
+        sort: ["id"],
+        limit: 500,
+        page
+      });
+      for (const row of result.docs) {
+        checked++;
+        if (row.signature !== this.sign(row)) invalid.push(row.id);
+        const id = Number(row.id);
+        if (previous !== void 0 && Number.isInteger(id) && id > previous + 1)
+          gaps += id - previous - 1;
+        previous = id;
+      }
+      if (page >= result.totalPages) break;
+    }
+    const verification = { checked, invalid, gaps, at: (/* @__PURE__ */ new Date()).toISOString() };
+    await this.record({
+      action: "audit.verify",
+      target: "audit",
+      detail: { checked, invalid: invalid.length, gaps }
+    });
+    return verification;
+  }
+  /**
+   * Daily upkeep from `runJobs`: deletes entries older than `keep` days, then verifies the log.
+   * Runs when the last check is more than a day old.
+   */
+  async upkeep(now = /* @__PURE__ */ new Date()) {
+    if (!this.enabled) return;
+    const last = await this.lastVerification();
+    if (last && now.getTime() - Date.parse(last.at) < DAY) return;
+    const keep = this.settings.keep;
+    if (keep > 0) {
+      const before = new Date(now.getTime() - keep * DAY).toISOString();
+      for (; ; ) {
+        const { docs } = await this.cms.db.find({
+          collection: AUDIT_LOGS,
+          where: { createdAt: { lt: before } },
+          sort: ["id"],
+          limit: 500,
+          page: 1
+        });
+        for (const row of docs) await this.cms.db.delete({ collection: AUDIT_LOGS, id: row.id });
+        if (docs.length < 500) break;
+      }
+    }
+    await auditContext.run({ via: "scheduler", user: null }, () => this.verify());
+  }
+  /** What the dashboard warns about: many failed logins, entries not written, a failed check. */
+  async attention(now = /* @__PURE__ */ new Date()) {
+    if (!this.enabled) return [];
+    const out = [];
+    const hour = new Date(now.getTime() - 36e5).toISOString();
+    const failed = await this.cms.db.count({
+      collection: AUDIT_LOGS,
+      where: {
+        and: [{ action: { in: ["login.failed", "sso.failed"] } }, { createdAt: { gte: hour } }]
+      }
+    });
+    if (failed >= this.settings.failedLogins) out.push({ id: "failed-logins", count: failed });
+    if (this.failures > 0) out.push({ id: "audit-failures", count: this.failures });
+    const last = await this.lastVerification();
+    if (last && last.invalid > 0)
+      out.push({ id: "audit-tampered", invalid: last.invalid, at: last.at });
+    return out;
+  }
+  // -------------------------------------------------------------------------
+  sign(row) {
+    const payload = stable(SIGNED.map((key2) => row[key2] ?? null));
+    return createHmac("sha256", this.cms.config.secret).update(`audit:${payload}`).digest("base64url");
+  }
+  async lastVerification() {
+    const { docs } = await this.cms.db.find({
+      collection: AUDIT_LOGS,
+      where: { action: { equals: "audit.verify" } },
+      sort: ["-id"],
+      limit: 1,
+      page: 1
+    });
+    const row = docs[0];
+    if (!row) return null;
+    const detail = row.detail ?? {};
+    return { at: String(row.createdAt), invalid: detail.invalid ?? 0 };
+  }
+  where(filter) {
+    const parts = [];
+    if (filter.action) {
+      parts.push({
+        or: [{ action: { equals: filter.action } }, { action: { like: `${filter.action}.` } }]
+      });
+    }
+    if (filter.target) parts.push({ target: { equals: filter.target } });
+    if (filter.doc) parts.push({ doc: { equals: filter.doc } });
+    if (filter.actor) parts.push({ actorEmail: { like: filter.actor } });
+    if (filter.from) parts.push({ createdAt: { gte: filter.from } });
+    if (filter.to) parts.push({ createdAt: { lte: filter.to } });
+    return parts.length === 0 ? void 0 : parts.length === 1 ? parts[0] : { and: parts };
+  }
+};
+function toEntry(row) {
+  return {
+    id: row.id,
+    at: String(row.createdAt),
+    action: String(row.action),
+    target: text(row.target),
+    doc: text(row.doc),
+    title: text(row.title),
+    actor: {
+      id: text(row.actorId),
+      email: text(row.actorEmail),
+      via: String(row.via ?? "system"),
+      ip: text(row.ip),
+      userAgent: text(row.userAgent)
+    },
+    changes: row.changes ?? null,
+    detail: row.detail ?? null
+  };
+}
+
+// src/errors.ts
+var ConfigError = class _ConfigError extends Error {
+  issues;
+  constructor(issues) {
+    super(_ConfigError.format(issues));
+    this.name = "ConfigError";
+    this.issues = issues;
+  }
+  static format(issues) {
+    const lines = issues.map((issue) => {
+      const hint = issue.hint ? `
+    \u2192 ${issue.hint}` : "";
+      return `  \u2022 ${issue.path}: ${issue.message}${hint}`;
+    });
+    const noun = issues.length === 1 ? "problem" : "problems";
+    return `Invalid Easy CMS config (${issues.length} ${noun}):
+${lines.join("\n")}`;
+  }
+};
+var EasyCMSError = class extends Error {
+  status;
+  constructor(message2, status) {
+    super(message2);
+    this.name = "EasyCMSError";
+    this.status = status;
+  }
+};
+var ValidationError = class extends EasyCMSError {
+  errors;
+  constructor(collection2, errors) {
+    const list = errors.map((e) => `${e.field}: ${e.message}`).join("; ");
+    super(`Invalid data for "${collection2}": ${list}`, 400);
+    this.name = "ValidationError";
+    this.errors = errors;
+  }
+};
+var NotFoundError = class extends EasyCMSError {
+  constructor(collection2, id) {
+    super(`No document with id ${JSON.stringify(id)} in "${collection2}"`, 404);
+    this.name = "NotFoundError";
+  }
+};
+var QueryError = class extends EasyCMSError {
+  constructor(message2) {
+    super(message2, 400);
+    this.name = "QueryError";
+  }
+};
+var SchemaError = class extends EasyCMSError {
+  constructor(message2) {
+    super(message2, 500);
+    this.name = "SchemaError";
+  }
+};
+var UnauthorizedError = class extends EasyCMSError {
+  constructor(message2 = "You must be logged in") {
+    super(message2, 401);
+    this.name = "UnauthorizedError";
+  }
+};
+var ForbiddenError = class extends EasyCMSError {
+  constructor(message2 = "You are not allowed to do this") {
+    super(message2, 403);
+    this.name = "ForbiddenError";
+  }
 };
-var databaseBackupsCollection = {
-  slug: DATABASE_BACKUPS,
-  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
-  fields: [
-    // pending | running | done | failed
-    { name: "state", type: "text", required: true, index: true },
-    // manual | scheduled
-    { name: "trigger", type: "text", required: true },
-    { name: "filename", type: "text" },
-    { name: "size", type: "number" },
-    { name: "startedAt", type: "text", index: true },
-    { name: "finishedAt", type: "text" },
-    { name: "error", type: "text" },
-    // Who started it (email), for manual ones.
-    { name: "author", type: "text" },
-    { name: "downloadedBy", type: "text" },
-    { name: "downloadedAt", type: "text" }
-  ]
+var TooManyRequestsError = class extends EasyCMSError {
+  constructor(message2) {
+    super(message2, 429);
+    this.name = "TooManyRequestsError";
+  }
 };
-var userIdentitiesCollection = {
-  slug: USER_IDENTITIES,
-  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
-  fields: [
-    { name: "user", type: "relationship", to: USERS, required: true, index: true },
-    // The provider's id (`google`) and its id for the account (`sub`).
-    { name: "provider", type: "text", required: true, index: true },
-    { name: "subject", type: "text", required: true, index: true },
-    { name: "email", type: "text" },
-    { name: "lastUsedAt", type: "text" }
-  ]
+var PayloadTooLargeError = class extends EasyCMSError {
+  constructor(message2) {
+    super(message2, 413);
+    this.name = "PayloadTooLargeError";
+  }
 };
-var emailDeliveriesCollection = {
-  slug: EMAIL_DELIVERIES,
-  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
-  fields: [
-    // The message as JSON.
-    { name: "message", type: "textarea", required: true },
-    { name: "attempts", type: "number", required: true },
-    { name: "nextAttemptAt", type: "text", required: true, index: true },
-    // pending | failed
-    { name: "state", type: "text", required: true, index: true },
-    { name: "error", type: "text" }
-  ]
+
+// src/fields.ts
+var isHasMany = (field) => (field.type === "select" || field.type === "relationship" || field.type === "upload") && field.hasMany === true;
+function mimeAllowedBy(mimeType, patterns) {
+  const type = mimeType.toLowerCase();
+  return patterns.some((pattern) => {
+    const p = pattern.toLowerCase();
+    return p.endsWith("/*") ? type.startsWith(p.slice(0, -1)) : type === p;
+  });
+}
+var hasRows = (field) => field.type === "array" || field.type === "blocks";
+function rowFields(field, row) {
+  if (field.type === "array") return field.fields;
+  const type = row && typeof row === "object" ? row.blockType : void 0;
+  return field.blocks.find((block) => block.slug === type)?.fields;
+}
+var FIELD_TYPES = [
+  "text",
+  "textarea",
+  "number",
+  "boolean",
+  "date",
+  "email",
+  "json",
+  "select",
+  "slug",
+  "richText",
+  "upload",
+  "relationship",
+  "array",
+  "group",
+  "blocks"
+];
+
+// src/access-control.ts
+async function evaluateAccess(access, args) {
+  const result = await (access ?? isLoggedIn)(args);
+  if (typeof result === "boolean") return result;
+  if (typeof result === "object" && result !== null) return result;
+  throw new QueryError("Access functions must return a boolean or a where query");
+}
+function andWhere(where, constraint) {
+  if (constraint === true) return where;
+  return where === void 0 ? constraint : { and: [where, constraint] };
+}
+var FieldAccessChecker = class {
+  /** `rules`: the user's role's rules for top-level fields (`auth.rbac`), on top of `access`. */
+  constructor(kind, args, rules) {
+    this.kind = kind;
+    this.args = args;
+    this.rules = rules;
+  }
+  kind;
+  args;
+  rules;
+  cache = /* @__PURE__ */ new Map();
+  async allows(field) {
+    const rule = this.rules?.get(field);
+    if (rule === "hidden" || rule === "read" && this.kind === "update") return false;
+    const fn = field.access?.[this.kind];
+    if (!fn) return true;
+    let allowed2 = this.cache.get(field);
+    if (allowed2 === void 0) {
+      allowed2 = await fn(this.args) === true;
+      this.cache.set(field, allowed2);
+    }
+    return allowed2;
+  }
 };
+async function stripFields(fields, doc, read2) {
+  const result = { ...doc };
+  for (const field of fields) {
+    if (!(field.name in result)) continue;
+    if (field.hidden || read2 && !await read2.allows(field)) {
+      delete result[field.name];
+      continue;
+    }
+    const value = result[field.name];
+    if (field.type === "group" && value && typeof value === "object") {
+      result[field.name] = await stripFields(field.fields, value, read2);
+    } else if (hasRows(field) && Array.isArray(value)) {
+      result[field.name] = await Promise.all(
+        value.map((row) => {
+          const fields2 = rowFields(field, row);
+          return fields2 && row && typeof row === "object" ? stripFields(fields2, row, read2) : row;
+        })
+      );
+    }
+  }
+  return result;
+}
+async function filterInput(fields, data, update2) {
+  const result = { ...data };
+  for (const field of fields) {
+    if (!(field.name in result)) continue;
+    if (field.hidden || update2 && !await update2.allows(field)) {
+      delete result[field.name];
+      continue;
+    }
+    const value = result[field.name];
+    if (field.type === "group" && value && typeof value === "object" && !Array.isArray(value)) {
+      result[field.name] = await filterInput(field.fields, value, update2);
+    } else if (hasRows(field) && Array.isArray(value)) {
+      result[field.name] = await Promise.all(
+        value.map((row) => {
+          const fields2 = rowFields(field, row);
+          return fields2 && row && typeof row === "object" ? filterInput(fields2, row, update2) : row;
+        })
+      );
+    }
+  }
+  return result;
+}
 
 // src/auth/emails.ts
 var esc = (value) => value.replace(
@@ -634,9 +970,9 @@ var esc = (value) => value.replace(
   (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]
 );
 function email(subject, lines, button) {
-  const text = [...lines, ...button ? ["", button.url] : []].join("\n");
+  const text2 = [...lines, ...button ? ["", button.url] : []].join("\n");
   const html = `<div style="font-family:system-ui,sans-serif;font-size:15px;line-height:1.5;color:#1f2328">${lines.map((line) => `<p>${esc(line)}</p>`).join("")}${button ? `<p><a href="${esc(button.url)}" style="display:inline-block;padding:10px 18px;border-radius:8px;background:#2f6f5e;color:#fff;text-decoration:none;font-weight:600">${esc(button.label)}</a></p><p style="font-size:13px;color:#656d76">${esc(button.url)}</p>` : ""}</div>`;
-  return { subject, text, html };
+  return { subject, text: text2, html };
 }
 var hours = (expiresAt) => Math.max(1, Math.round(((expiresAt?.getTime() ?? Date.now()) - Date.now()) / 36e5));
 var days = (expiresAt) => Math.max(1, Math.round(hours(expiresAt) / 24));
@@ -736,10 +1072,10 @@ async function fakeVerify(password) {
 }
 
 // src/auth/sso.ts
-import { createHmac as createHmac2, randomBytes as randomBytes4 } from "crypto";
+import { createHmac as createHmac3, randomBytes as randomBytes4 } from "crypto";
 
 // src/auth/tokens.ts
-import { createHash as createHash2, createHmac, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHash as createHash2, createHmac as createHmac2, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual3 } from "crypto";
 function newToken() {
   return randomBytes3(32).toString("base64url");
 }
@@ -747,7 +1083,7 @@ function hashToken(token) {
   return createHash2("sha256").update(token).digest("hex");
 }
 function hmac(secret, value) {
-  return createHmac("sha256", secret).update(value).digest("base64url");
+  return createHmac2("sha256", secret).update(value).digest("base64url");
 }
 function signToken(secret, token) {
   return `${token}.${hmac(secret, `session:${token}`)}`;
@@ -824,7 +1160,7 @@ var SSO_COOKIE = "ecms-sso";
 var PENDING_TTL = 10 * 6e4;
 var random = () => randomBytes4(32).toString("base64url");
 function sign(secret, payload) {
-  return createHmac2("sha256", secret).update(`sso:${payload}`).digest("base64url");
+  return createHmac3("sha256", secret).update(`sso:${payload}`).digest("base64url");
 }
 function seal(secret, pending) {
   const payload = Buffer.from(JSON.stringify(pending)).toString("base64url");
@@ -904,12 +1240,21 @@ var SingleSignOn = class {
   async finish(providerId, options) {
     const admin = this.config.admin.path.replace(/\/+$/, "");
     const pending = unseal(this.config.secret, options.cookie);
-    const back = (page2, outcome) => ({ redirect: `${admin}/${page2}?sso=${outcome}` });
+    let email2 = null;
+    const back = async (page2, outcome) => {
+      await this.cms.audit.record({
+        action: "sso.failed",
+        target: "auth",
+        ...page2 === "login" ? { user: null, email: email2 } : {},
+        detail: { provider: providerId, outcome }
+      });
+      return { redirect: `${admin}/${page2}?sso=${outcome}` };
+    };
     const page = pending?.u ? "account" : "login";
-    if (!pending || pending.p !== providerId) return back(page, "expired");
+    if (!pending || pending.p !== providerId) return await back(page, "expired");
     const state = options.url.searchParams.get("state") ?? "";
-    if (!safeEqual(state, pending.s)) return back(page, "expired");
-    if (options.url.searchParams.has("error")) return back(page, "cancelled");
+    if (!safeEqual(state, pending.s)) return await back(page, "expired");
+    if (options.url.searchParams.has("error")) return await back(page, "cancelled");
     const provider = this.provider(providerId);
     const redirectUri = this.callbackURL(provider.id, options.origin);
     let profile;
@@ -926,15 +1271,22 @@ var SingleSignOn = class {
       this.cms.logger.warn(
         `Signing in with ${provider.name} failed: ${error.message || String(error)}`
       );
-      return back(page, "failed");
+      return await back(page, "failed");
     }
     const subject = String(profile.subject);
-    const email2 = profile.email?.trim().toLowerCase() || null;
+    email2 = profile.email?.trim().toLowerCase() || null;
     if (pending.u) {
-      if (!options.user || String(options.user.id) !== pending.u) return back("account", "failed");
+      if (!options.user || String(options.user.id) !== pending.u)
+        return await back("account", "failed");
       const existing = await this.identity(provider.id, subject);
-      if (existing && String(existing.user) !== pending.u) return back("account", "taken");
+      if (existing && String(existing.user) !== pending.u) return await back("account", "taken");
       if (!existing) await this.addIdentity(options.user.id, provider.id, subject, email2);
+      await this.cms.audit.record({
+        action: "sso.link",
+        target: "auth",
+        user: options.user,
+        detail: { provider: provider.id, email: email2 }
+      });
       return { redirect: `${admin}/account?sso=linked` };
     }
     let user = null;
@@ -943,14 +1295,14 @@ var SingleSignOn = class {
       user = await this.cms.db.findById({ collection: USERS, id: identity.user });
     } else {
       if (!email2 || !profile.emailVerified)
-        return back("login", email2 ? "unverified" : "no-account");
+        return await back("login", email2 ? "unverified" : "no-account");
       user = await this.userByEmail(email2);
       if (!user) user = await this.signUp(email2, profile.name);
-      if (!user) return back("login", "no-account");
+      if (!user) return await back("login", "no-account");
       await this.addIdentity(user.id, provider.id, subject, email2);
     }
-    if (!user) return back("login", "no-account");
-    if (user.active === false) return back("login", "inactive");
+    if (!user) return await back("login", "no-account");
+    if (user.active === false) return await back("login", "inactive");
     const found = identity ?? await this.identity(provider.id, subject);
     if (found) {
       const { id, ...rest } = found;
@@ -960,7 +1312,14 @@ var SingleSignOn = class {
         data: { ...rest, email: email2, lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }
       });
     }
-    return { redirect: pending.r, session: await this.cms.auth.createSession(user.id) };
+    const session = await this.cms.auth.createSession(user.id);
+    await this.cms.audit.record({
+      action: "sso.login",
+      target: "auth",
+      user: session.user,
+      detail: { provider: provider.id, email: email2 }
+    });
+    return { redirect: pending.r, session };
   }
   /** A user's outside accounts. */
   async identities(userId) {
@@ -999,6 +1358,13 @@ var SingleSignOn = class {
         { field: "provider", message: "is the only way left to sign in to this account" }
       ]);
     await this.cms.db.delete({ collection: USER_IDENTITIES, id: row.id });
+    await this.cms.audit.record({
+      action: "sso.unlink",
+      target: USERS,
+      doc: row.user,
+      title: typeof user?.email === "string" ? user.email : null,
+      detail: { provider: String(row.provider), email: row.email ?? null }
+    });
   }
   /** Forgets a deleted user's outside accounts. */
   async forget(userId) {
@@ -1103,7 +1469,12 @@ var Auth = class {
     const email2 = typeof args.email === "string" ? args.email.trim().toLowerCase() : "";
     const password = typeof args.password === "string" ? args.password : "";
     const key2 = `${email2}|${args.ip ?? ""}`;
-    await this.checkRateLimit(key2);
+    try {
+      await this.checkRateLimit(key2);
+    } catch (error) {
+      await this.cms.audit.record({ action: "login.locked", target: "auth", user: null, email: email2 });
+      throw error;
+    }
     const [user] = email2 ? (await this.db.find({
       collection: USERS,
       where: { email: { equals: email2 } },
@@ -1115,15 +1486,34 @@ var Auth = class {
     const valid = user && hash && password ? await verifyPassword(password, hash) : await fakeVerify(password);
     if (!user || !valid || user.active === false) {
       await this.recordFailure(key2);
+      await this.cms.audit.record({
+        action: "login.failed",
+        target: "auth",
+        user: null,
+        email: email2,
+        detail: {
+          reason: !user ? "unknown email" : user.active === false ? "deactivated" : "wrong password"
+        }
+      });
       throw new UnauthorizedError(INVALID);
     }
     await this.clearFailures(key2);
-    if (!this.sso.passwordAllowed(user))
+    if (!this.sso.passwordAllowed(user)) {
+      await this.cms.audit.record({
+        action: "login.failed",
+        target: "auth",
+        user: null,
+        email: email2,
+        detail: { reason: "passwords are off" }
+      });
       throw new UnauthorizedError(
         `Sign in with ${this.config.auth.providers.map((p) => p.name).join(" or ")}`
       );
+    }
     await this.deleteExpiredSessions(user.id);
-    return this.startSession(user);
+    const session = await this.startSession(user);
+    await this.cms.audit.record({ action: "login", target: "auth", user: session.user });
+    return session;
   }
   /** Creates the first admin. Only works while there are no users. */
   async registerFirstUser(args) {
@@ -1146,7 +1536,15 @@ var Auth = class {
     const token = unsignToken(this.config.secret, signedToken);
     if (!token) return;
     const session = await this.findSession(token);
-    if (session) await this.db.delete({ collection: SESSIONS, id: session.id });
+    if (!session) return;
+    await this.db.delete({ collection: SESSIONS, id: session.id });
+    const user = await this.db.findById({ collection: USERS, id: session.user });
+    if (user)
+      await this.cms.audit.record({
+        action: "logout",
+        target: "auth",
+        user: await this.toAuthUser(user)
+      });
   }
   /**
    * Returns the user for a signed session token, or for an API key (`ecms_…`, with `apiKey` set
@@ -1220,6 +1618,7 @@ var Auth = class {
     });
     if (recent >= RESET_REQUESTS) return;
     await this.recordFailure(key2);
+    await this.cms.audit.record({ action: "password.forgot", target: "auth", user: null, email: email2 });
     const user = await this.findByEmail(email2);
     if (!user || user.active === false || !this.sso.passwordAllowed(user)) return;
     await this.mailPasswordLink(user, user.passwordHash ? "reset" : "invite", args);
@@ -1238,6 +1637,13 @@ var Auth = class {
     if (user.active === false) throw new QueryError("This user is deactivated");
     const purpose = user.passwordHash ? "reset" : "invite";
     await this.mailPasswordLink(user, purpose, options);
+    await this.cms.audit.record({
+      action: "password.link",
+      target: USERS,
+      doc: user.id,
+      title: String(user.email),
+      detail: { purpose }
+    });
     return purpose;
   }
   /** The user and purpose of a valid, unused password link, or `null`. */
@@ -1263,6 +1669,12 @@ var Auth = class {
     await this.clearFailures(key2);
     const user = await this.db.findById({ collection: USERS, id: found.user.id });
     const session = await this.startSession(user);
+    await this.cms.audit.record({
+      action: "password.reset",
+      target: "auth",
+      user: session.user,
+      detail: { purpose: found.purpose }
+    });
     if (found.purpose === "reset") {
       const content = await (this.config.auth.emails.passwordChanged ?? DEFAULT_PASSWORD_EMAILS.passwordChanged)({
         user: await this.toAuthUser(user),
@@ -1579,26 +1991,26 @@ async function writeBackupFile(cms, file) {
       });
   }
 }
-var slug = (text) => text.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "easy-cms";
+var slug = (text2) => text2.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "easy-cms";
 function filenameFor(cms, date) {
   const pad = (n) => String(n).padStart(2, "0");
   const stamp = `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}-${pad(date.getHours())}${pad(date.getMinutes())}`;
   return `${slug(cms.config.admin.brand.name || "easy-cms")}-${stamp}.db.gz`;
 }
 function toAdmin(row) {
-  const text = (value) => typeof value === "string" && value !== "" ? value : null;
+  const text2 = (value) => typeof value === "string" && value !== "" ? value : null;
   return {
     id: row.id,
     state: ["pending", "running", "done", "failed"].includes(row.state) ? row.state : "failed",
     trigger: row.trigger === "scheduled" ? "scheduled" : "manual",
-    filename: text(row.filename),
+    filename: text2(row.filename),
     size: typeof row.size === "number" ? row.size : null,
-    startedAt: text(row.startedAt),
-    finishedAt: text(row.finishedAt),
-    error: text(row.error),
-    author: text(row.author),
-    downloadedBy: text(row.downloadedBy),
-    downloadedAt: text(row.downloadedAt)
+    startedAt: text2(row.startedAt),
+    finishedAt: text2(row.finishedAt),
+    error: text2(row.error),
+    author: text2(row.author),
+    downloadedBy: text2(row.downloadedBy),
+    downloadedAt: text2(row.downloadedAt)
   };
 }
 async function update(cms, row, data) {
@@ -1915,8 +2327,8 @@ function itemsOf(field, n) {
   return `${n} ${unit}${n === 1 ? "" : "s"}`;
 }
 var isEmpty = (value) => value === void 0 || value === null || value === "";
-function slugify(text) {
-  return text.normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{M}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "");
+function slugify(text2) {
+  return text2.normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{M}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "");
 }
 function applyDefaults(fields, data, localization = null) {
   const result = { ...data };
@@ -2666,16 +3078,18 @@ var viewId = {
 };
 var tagOf = (component) => typeof component === "string" ? component : component.tag;
 var Roles = class {
-  constructor(config, db, log) {
+  constructor(config, db, log, audit) {
     this.config = config;
     this.db = db;
     this.log = log;
+    this.audit = audit;
     this.enabled = config.auth.rbac;
     this.versions = new VersionStore(db);
   }
   config;
   db;
   log;
+  audit;
   enabled;
   versions;
   cache;
@@ -2909,6 +3323,7 @@ var Roles = class {
       this.clean(input.permissions),
       author.id
     );
+    await this.audit?.({ action: "role.create", target: "roles", doc: row.id, title: key2 });
     return this.toRole(row, 0);
   }
   async update(id, input, author) {
@@ -2923,6 +3338,18 @@ var Roles = class {
     const { id: _id, ...rest } = data;
     const saved = await this.db.update({ collection: ROLES, id: row.id, data: rest });
     await this.record(saved, author.id);
+    const changes = [];
+    if ((row.name ?? "") !== (saved.name ?? ""))
+      changes.push({ field: "name", before: row.name ?? "", after: saved.name ?? "" });
+    if (JSON.stringify(row.permissions ?? {}) !== JSON.stringify(saved.permissions ?? {}))
+      changes.push({ field: "permissions" });
+    await this.audit?.({
+      action: "role.update",
+      target: "roles",
+      doc: row.id,
+      title: String(row.key),
+      changes
+    });
     this.invalidate();
     return this.toRole(saved, await this.users(String(row.key)));
   }
@@ -2936,6 +3363,7 @@ var Roles = class {
       throw new EasyCMSError(`${users} user(s) have this role; give them another role first`, 409);
     await this.db.delete({ collection: ROLES, id: row.id });
     await this.versions.deleteAll(ROLES, row.id);
+    await this.audit?.({ action: "role.delete", target: "roles", doc: row.id, title: key2 });
     this.invalidate();
   }
   async history(id) {
@@ -2970,6 +3398,7 @@ var Roles = class {
   views() {
     return [
       { id: "status" },
+      ...this.config.audit ? [{ id: "audit" }] : [],
       ...this.config.collections.some(
         (c) => c.slug === WEBHOOK_DELIVERIES || c.slug === EMAIL_DELIVERIES
       ) ? [{ id: "deliveries" }] : [],
@@ -3174,7 +3603,7 @@ function rank(role, config) {
 }
 
 // src/webhooks.ts
-import { createHmac as createHmac3, randomUUID as randomUUID2 } from "crypto";
+import { createHmac as createHmac4, randomUUID as randomUUID2 } from "crypto";
 var WEBHOOK_EVENTS = [
   "create",
   "update",
@@ -3318,7 +3747,7 @@ var Webhooks = class {
       ...hook.headers
     };
     if (hook.secret) {
-      headers["x-easy-cms-signature"] = `sha256=${createHmac3("sha256", hook.secret).update(body).digest("hex")}`;
+      headers["x-easy-cms-signature"] = `sha256=${createHmac4("sha256", hook.secret).update(body).digest("hex")}`;
     }
     try {
       const response = await this.fetcher(hook.url, {
@@ -3366,6 +3795,7 @@ var RESERVED_SLUGS = /* @__PURE__ */ new Set([
   "database-backups",
   "user-roles",
   "user-identities",
+  "audit-logs",
   "api-keys",
   "jobs",
   "auth",
@@ -3390,6 +3820,7 @@ function validateConfig(config) {
   validateAdminViews(config, add);
   validateUpload(config, add);
   validateBackups(config, add);
+  validateAudit(config, add);
   validateAuth(config, add);
   validateCors(config.cors, add);
   validateLocalization(config, add);
@@ -3874,6 +4305,22 @@ function validateUpload(config, add) {
     add("upload.fromURL.allowPrivate", "must be true or false");
 }
 var HOST_PATTERN = /^(\*|(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*)$/i;
+function validateAudit(config, add) {
+  const audit = config.audit;
+  if (audit !== void 0 && typeof audit !== "boolean") {
+    const a = audit;
+    if (typeof a !== "object" || a === null)
+      add("audit", "must be true or { keep, values, failedLogins }");
+    else {
+      if (a.keep !== void 0 && !(Number.isInteger(a.keep) && a.keep >= 0))
+        add("audit.keep", "must be a number of days (0: keep all)");
+      if (a.values !== void 0 && typeof a.values !== "boolean")
+        add("audit.values", "must be true or false");
+      if (a.failedLogins !== void 0 && !(Number.isInteger(a.failedLogins) && a.failedLogins > 0))
+        add("audit.failedLogins", "must be a positive number");
+    }
+  }
+}
 function validateBackups(config, add) {
   const backups = config.backups;
   if (backups === void 0) return;
@@ -4393,6 +4840,7 @@ async function resolveConfig(input) {
       inviteExpiration: config.auth?.inviteExpiration ?? 7 * 24 * 60 * 60,
       emails: config.auth?.emails ?? {}
     },
+    audit: config.audit ? resolveAudit(config.audit === true ? {} : config.audit) : false,
     collections: [
       ...config.collections ?? [],
       ...internalCollections,
@@ -4404,7 +4852,8 @@ async function resolveConfig(input) {
       ...config.email ? [emailDeliveriesCollection] : [],
       databaseBackupsCollection,
       ...config.auth?.rbac ? [rolesCollection] : [],
-      ...(config.auth?.providers?.length ?? 0) > 0 ? [userIdentitiesCollection] : []
+      ...(config.auth?.providers?.length ?? 0) > 0 ? [userIdentitiesCollection] : [],
+      ...config.audit ? [auditLogsCollection] : []
     ],
     globals: config.globals ?? [],
     endpoints: config.endpoints ?? [],
@@ -4423,6 +4872,13 @@ function usesVersions(config) {
 function usesSchedule(config) {
   return [...config.collections ?? [], ...config.globals ?? []].some((c) => c.schedule);
 }
+function resolveAudit(audit) {
+  return {
+    keep: audit.keep ?? DEFAULT_AUDIT_KEEP,
+    values: audit.values !== false,
+    failedLogins: audit.failedLogins ?? DEFAULT_FAILED_LOGINS
+  };
+}
 
 // src/load-config.ts
 var CONFIG_FILE_NAMES = [
@@ -4606,13 +5062,13 @@ function sniffMimeType(data) {
   if (ascii(data, 0, 5) === "%PDF-") return "application/pdf";
   const head = data.subarray(0, 4096);
   if (head.includes(0)) return void 0;
-  let text;
+  let text2;
   try {
-    text = new TextDecoder("utf-8", { fatal: true }).decode(head);
+    text2 = new TextDecoder("utf-8", { fatal: true }).decode(head);
   } catch {
     return void 0;
   }
-  const trimmed = text.replace(/^/, "").trimStart();
+  const trimmed = text2.replace(/^/, "").trimStart();
   if (/^(<\?xml[^>]*>\s*)?(<!--[\s\S]*?-->\s*)*(<!DOCTYPE svg[^>]*>\s*)?<svg[\s>]/i.test(trimmed))
     return "image/svg+xml";
   return "text/plain";
@@ -4988,6 +5444,8 @@ var EasyCMS = class {
   cwd;
   /** Roles and their permissions (`auth.rbac`, Settings → Roles). */
   roles;
+  /** Who did what (`audit`, Settings → Audit log). */
+  audit;
   versions;
   webhooks;
   mailer;
@@ -4998,7 +5456,13 @@ var EasyCMS = class {
     this.storage = storage;
     this.cwd = cwd;
     this.versions = new VersionStore(db);
-    this.roles = new Roles(config, db, (message2) => logger.info(message2));
+    this.roles = new Roles(
+      config,
+      db,
+      (message2) => logger.info(message2),
+      (entry) => this.audit.record(entry)
+    );
+    this.audit = new AuditLog(this);
     this.webhooks = new Webhooks(
       config.webhooks ?? [],
       logger,
@@ -5480,6 +5944,7 @@ var EasyCMS = class {
         operation: "update"
       });
       this.emit(config, "draft", draft);
+      await this.audited(config, "draft", draft, current, guard, mode);
       const [out2] = await this.output(config, [draft], guard, {
         ...options,
         draft: true
@@ -5502,6 +5967,7 @@ var EasyCMS = class {
       operation: "update"
     });
     this.emit(config, "update", doc, existing.status);
+    await this.audited(config, "update", doc, current, guard, mode);
     const [out] = await this.output(config, [doc], guard, { ...options, draft: true });
     return out;
   }
@@ -5546,6 +6012,7 @@ var EasyCMS = class {
       doc: existing
     });
     this.emit(config, "delete", existing);
+    await this.audited(config, "delete", existing, existing, guard);
     const [out] = await this.output(config, [existing], guard, { depth: 0, draft: true });
     return out;
   }
@@ -5675,6 +6142,7 @@ var EasyCMS = class {
         operation: "update"
       });
       this.emit(config, "draft", draft);
+      await this.audited(config, "draft", draft, current, guard, mode);
       return this.findGlobal(slug2, { ...options, draft: true });
     }
     const doc = await this.db.updateGlobal({ slug: slug2, data: { ...prepared, updatedAt: now } });
@@ -5686,6 +6154,7 @@ var EasyCMS = class {
       operation: "update"
     });
     this.emit(config, "update", doc, existing.status);
+    await this.audited(config, "update", doc, current, guard, mode);
     return this.findGlobal(slug2, { ...options, draft: true });
   }
   /**
@@ -5787,16 +6256,19 @@ var EasyCMS = class {
    * scheduler and the cron endpoint (`GET <api>/jobs/run`) call.
    */
   async runJobs(now = /* @__PURE__ */ new Date()) {
-    const scheduled = await this.runScheduled(now);
-    await this.pruneFailedDeliveries(now);
-    await runDueBackups(this, now).catch(
-      (error) => this.logger.error(`Backups: ${error.message}`)
-    );
-    return {
-      ...scheduled,
-      webhooks: await this.retryWebhooks(now),
-      emails: await this.mailer.retry(now)
-    };
+    return auditContext.run({ via: "scheduler", user: null }, async () => {
+      const scheduled = await this.runScheduled(now);
+      await this.pruneFailedDeliveries(now);
+      await runDueBackups(this, now).catch(
+        (error) => this.logger.error(`Backups: ${error.message}`)
+      );
+      await this.audit.upkeep(now).catch((error) => this.logger.error(`Audit log: ${error.message}`));
+      return {
+        ...scheduled,
+        webhooks: await this.retryWebhooks(now),
+        emails: await this.mailer.retry(now)
+      };
+    });
   }
   /**
    * Tries webhook deliveries that are due for another attempt. Deliveries are kept in the
@@ -5961,6 +6433,13 @@ var EasyCMS = class {
         updatedAt: now
       }
     });
+    await this.audit.record({
+      action: "schedule",
+      target: parent,
+      ...parent.startsWith("global:") ? {} : { doc },
+      ...guardOf(options).user ? { user: guardOf(options).user } : {},
+      detail: { action: job.action, at: runAt.toISOString() }
+    });
     return toJob(row);
   }
   /**
@@ -6020,6 +6499,12 @@ var EasyCMS = class {
     const job = (await this.pendingJobs(parent, doc)).find((j) => String(j.id) === String(jobId));
     if (!job) throw new NotFoundError("scheduled job", jobId);
     await this.db.delete({ collection: SCHEDULED_JOBS, id: job.id });
+    await this.audit.record({
+      action: "unschedule",
+      target: parent,
+      ...parent.startsWith("global:") ? {} : { doc },
+      detail: { action: job.action, at: job.runAt }
+    });
   }
   /**
    * @internal One attempt now for a saved webhook delivery or email (the admin's Retry): removed
@@ -6264,6 +6749,7 @@ var EasyCMS = class {
       operation: "create"
     });
     this.emit(config, "create", doc);
+    await this.audited(config, "create", doc, void 0, hookGuard ?? guard);
     const [out] = await this.output(config, [doc], hookGuard ?? guard, { ...options, draft: true });
     return out;
   }
@@ -6337,6 +6823,31 @@ var EasyCMS = class {
     if (after !== "published" && before === "published")
       this.webhooks.emit("unpublish", target, body);
   }
+  /**
+   * Writes the audit log entry for a change (`audit`): publishing, unpublishing and restoring
+   * are told apart from other saves.
+   */
+  async audited(config, event, doc, previous, guard, mode = "save") {
+    if (!this.audit.enabled) return;
+    let action = event;
+    if (event === "update" || event === "draft") {
+      const was = previous?.status;
+      if (mode === "restore") action = "restore";
+      else if (config.drafts && doc.status === "published" && was !== "published")
+        action = "publish";
+      else if (config.drafts && event === "update" && doc.status !== "published" && was === "published")
+        action = "unpublish";
+    }
+    const global2 = !this.config.collections.includes(config);
+    await this.audit.content(
+      config,
+      global2,
+      action,
+      event === "delete" ? void 0 : doc,
+      event === "create" ? void 0 : previous,
+      guard.user
+    );
+  }
   /** Records a version after a save, when the collection or global keeps versions. */
   async saveVersion(config, parent, id, doc, guard) {
     const max = versionLimit(config);
@@ -6679,9 +7190,9 @@ var PER_PAGE = 50;
 var collectionOf = (kind) => kind === "webhook" ? WEBHOOK_DELIVERIES : EMAIL_DELIVERIES;
 var exists = (cms, kind) => cms.config.collections.some((c) => c.slug === collectionOf(kind));
 var isDeliveryKind = (value) => value === "webhook" || value === "email";
-function parse(text) {
+function parse(text2) {
   try {
-    const value = JSON.parse(String(text ?? ""));
+    const value = JSON.parse(String(text2 ?? ""));
     return typeof value === "object" && value !== null ? value : {};
   } catch {
     return {};
@@ -6848,7 +7359,7 @@ async function sendTestEmail(cms, user, to, locale) {
   const th = locale === "th" || locale !== "en" && cms.config.admin.locale === "th";
   const time = (/* @__PURE__ */ new Date()).toISOString();
   const subject = th ? `\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E17\u0E14\u0E2A\u0E2D\u0E1A\u0E08\u0E32\u0E01 ${site}` : `Test email from ${site}`;
-  const text = th ? `\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E19\u0E35\u0E49\u0E2A\u0E48\u0E07\u0E08\u0E32\u0E01\u0E2B\u0E19\u0E49\u0E32 \u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32 \u2192 \u0E2D\u0E35\u0E40\u0E21\u0E25 \u0E02\u0E2D\u0E07 ${site} \u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E17\u0E14\u0E2A\u0E2D\u0E1A\u0E01\u0E32\u0E23\u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32
+  const text2 = th ? `\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E19\u0E35\u0E49\u0E2A\u0E48\u0E07\u0E08\u0E32\u0E01\u0E2B\u0E19\u0E49\u0E32 \u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32 \u2192 \u0E2D\u0E35\u0E40\u0E21\u0E25 \u0E02\u0E2D\u0E07 ${site} \u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E17\u0E14\u0E2A\u0E2D\u0E1A\u0E01\u0E32\u0E23\u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32
 
 \u0E2A\u0E48\u0E07\u0E42\u0E14\u0E22: ${user.email}
 Adapter: ${adapter.name ?? "custom"}
@@ -6860,7 +7371,7 @@ Adapter: ${adapter.name ?? "custom"}
 From: ${from}
 Time: ${time}`;
   try {
-    await adapter.send({ to: address, subject, text, from });
+    await adapter.send({ to: address, subject, text: text2, from });
     return { ok: true };
   } catch (error) {
     return { ok: false, error: message(error) };
@@ -7037,7 +7548,8 @@ async function adminSchema(cms, user, origin) {
     backups: admin,
     email: admin,
     roles: admin && cms.roles.enabled,
-    sso: admin && cms.auth.sso.enabled
+    sso: admin && cms.auth.sso.enabled,
+    audit: cms.audit.enabled && await cms.roles.canView(user, "audit")
   };
   const roles = await cms.roles.options();
   return {
@@ -7099,16 +7611,16 @@ async function widgets(cms, user) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.35.0" : "0.0.0-dev";
+var VERSION = true ? "0.36.0" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
-var DAY = 864e5;
+var DAY2 = 864e5;
 var has = (cms, slug2) => cms.config.collections.some((c) => c.slug === slug2);
 async function adminStatus(cms) {
   const config = cms.config;
   const attention = [];
   const now = Date.now();
-  const weekAgo = new Date(now - 7 * DAY).toISOString();
+  const weekAgo = new Date(now - 7 * DAY2).toISOString();
   if (has(cms, WEBHOOK_DELIVERIES)) {
     const failed = await cms.db.find({
       collection: WEBHOOK_DELIVERIES,
@@ -7158,6 +7670,7 @@ async function adminStatus(cms) {
   }
   const backups = await backupAttention(cms);
   if (backups) attention.push(backups);
+  attention.push(...await cms.audit.attention());
   if (!config.email) attention.push({ id: "no-email" });
   if (!config.serverURL && process.env.NODE_ENV === "production")
     attention.push({ id: "no-server-url" });
@@ -7367,7 +7880,15 @@ async function respond(cms, request, url, path, root, options, production) {
     const ctx = { request, url, user, via: user ? via : null, token, headers };
     const method = request.method.toUpperCase();
     if (method !== "GET" && method !== "HEAD") checkCsrf(cms, ctx);
-    const result = root ? await customEndpoint(cms, ctx, method, segments, true, options) : await customEndpoint(cms, ctx, method, segments, false, options) ?? await route(cms, ctx, method, segments, options);
+    const audit = {
+      user,
+      ip: options.getClientIp?.(request),
+      userAgent: request.headers.get("user-agent")
+    };
+    const result = await auditContext.run(
+      audit,
+      async () => root ? await customEndpoint(cms, ctx, method, segments, true, options) : await customEndpoint(cms, ctx, method, segments, false, options) ?? await route(cms, ctx, method, segments, options)
+    );
     if (!result) throw new HttpError("Not found", 404);
     if (result.body instanceof Response) return result.body;
     return new Response(JSON.stringify(result.body), { status: result.status ?? 200, headers });
@@ -7552,8 +8073,11 @@ async function route(cms, ctx, method, segments, options) {
     if (extra !== void 0) throw new HttpError("Not found", 404);
     if (id2 === void 0) {
       if (method === "GET") return { body: await listBackups(cms) };
-      if (method === "POST")
-        return { status: 202, body: await startBackup(cms, "manual", ctx.user.email) };
+      if (method === "POST") {
+        const started = await startBackup(cms, "manual", ctx.user.email);
+        await cms.audit.record({ action: "backup.start", target: "backups", doc: started.id });
+        return { status: 202, body: started };
+      }
       throw methodNotAllowed(ctx, "GET, POST");
     }
     const parsed = parseId(id2);
@@ -7561,6 +8085,12 @@ async function route(cms, ctx, method, segments, options) {
     if (action === "download") {
       if (method !== "GET") throw methodNotAllowed(ctx, "GET");
       const file = await downloadBackup(cms, parsed, ctx.user.email);
+      await cms.audit.record({
+        action: "backup.download",
+        target: "backups",
+        doc: parsed,
+        title: file.filename
+      });
       return {
         body: new Response(file.body, {
           headers: {
@@ -7575,6 +8105,7 @@ async function route(cms, ctx, method, segments, options) {
     if (action !== void 0) throw new HttpError("Not found", 404);
     if (method !== "DELETE") throw methodNotAllowed(ctx, "DELETE");
     await deleteBackup(cms, parsed);
+    await cms.audit.record({ action: "backup.delete", target: "backups", doc: parsed });
     return { body: { deleted: 1 } };
   }
   if (first === "admin" && second === "email") {
@@ -7590,7 +8121,9 @@ async function route(cms, ctx, method, segments, options) {
     if (action === "verify") return { body: await verifyEmail(cms) };
     if (action === "test") {
       const body = await readJson(ctx.request);
-      return { body: await sendTestEmail(cms, ctx.user, body.to, body.locale) };
+      const sent = await sendTestEmail(cms, ctx.user, body.to, body.locale);
+      await cms.audit.record({ action: "email.test", target: "email", detail: { ...sent } });
+      return { body: sent };
     }
     throw new HttpError("Not found", 404);
   }
@@ -7600,6 +8133,41 @@ async function route(cms, ctx, method, segments, options) {
     if (method !== "GET") throw methodNotAllowed(ctx, "GET");
     return { body: cms.auth.sso.settings(ctx.url.origin) };
   }
+  if (first === "admin" && (second === "audit" || second === "audit.csv")) {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (!cms.audit.enabled) throw new HttpError("Not found", 404);
+    if (!await cms.roles.canView(ctx.user, "audit")) throw new ForbiddenError();
+    const q = ctx.url.searchParams;
+    const filter = {
+      action: q.get("action"),
+      target: q.get("target"),
+      doc: q.get("doc"),
+      actor: q.get("actor"),
+      from: q.get("from"),
+      to: q.get("to")
+    };
+    if (second === "audit.csv" && third === void 0) {
+      if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+      return {
+        body: new Response(await cms.audit.csv(filter), {
+          headers: {
+            "content-type": "text/csv; charset=utf-8",
+            "content-disposition": `attachment; filename="audit-log-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}.csv"`,
+            "cache-control": "no-store",
+            "x-content-type-options": "nosniff"
+          }
+        })
+      };
+    }
+    if (second === "audit" && third === "verify" && segments.length === 3) {
+      if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+      return { body: await cms.audit.verify() };
+    }
+    if (second !== "audit" || third !== void 0) throw new HttpError("Not found", 404);
+    if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+    const page = Math.max(1, Number.parseInt(q.get("page") ?? "1", 10) || 1);
+    return { body: await cms.audit.list(filter, page) };
+  }
   if (first === "admin" && second === "owned" && third !== void 0 && segments.length === 3) {
     if (!ctx.user) throw new UnauthorizedError();
     if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
@@ -7650,21 +8218,46 @@ async function route(cms, ctx, method, segments, options) {
     if (!isDeliveryKind(kind) || extra !== void 0) throw new HttpError("Not found", 404);
     if (id2 === "retry" && action === void 0) {
       if (method !== "POST") throw methodNotAllowed(ctx, "POST");
-      return { body: await retryFailedDeliveries(cms, kind) };
+      const retried = await retryFailedDeliveries(cms, kind);
+      await cms.audit.record({
+        action: "delivery.retry",
+        target: "deliveries",
+        detail: { kind, all: true }
+      });
+      return { body: retried };
     }
     if (id2 === void 0) {
       if (method !== "DELETE") throw methodNotAllowed(ctx, "DELETE");
-      return { body: await deleteFailedDeliveries(cms, kind) };
+      const deleted = await deleteFailedDeliveries(cms, kind);
+      await cms.audit.record({
+        action: "delivery.delete",
+        target: "deliveries",
+        detail: { kind, all: true }
+      });
+      return { body: deleted };
     }
     const parsed = parseId(id2);
     if (parsed === void 0) throw new HttpError("Not found", 404);
     if (action === "retry") {
       if (method !== "POST") throw methodNotAllowed(ctx, "POST");
-      return { body: await cms.retryDelivery(kind, parsed) };
+      const retried = await cms.retryDelivery(kind, parsed);
+      await cms.audit.record({
+        action: "delivery.retry",
+        target: "deliveries",
+        doc: parsed,
+        detail: { kind }
+      });
+      return { body: retried };
     }
     if (action !== void 0) throw new HttpError("Not found", 404);
     if (method !== "DELETE") throw methodNotAllowed(ctx, "DELETE");
     await deleteDelivery(cms, kind, parsed);
+    await cms.audit.record({
+      action: "delivery.delete",
+      target: "deliveries",
+      doc: parsed,
+      detail: { kind }
+    });
     return { body: { deleted: 1 } };
   }
   if (first === "admin") {
@@ -8050,11 +8643,11 @@ async function readJson(request) {
   }
   const declared = Number(request.headers.get("content-length") ?? 0);
   if (declared > MAX_BODY_BYTES) throw new HttpError("Request body too large", 413);
-  const text = await request.text();
-  if (Buffer.byteLength(text) > MAX_BODY_BYTES) throw new HttpError("Request body too large", 413);
+  const text2 = await request.text();
+  if (Buffer.byteLength(text2) > MAX_BODY_BYTES) throw new HttpError("Request body too large", 413);
   let body;
   try {
-    body = JSON.parse(text);
+    body = JSON.parse(text2);
   } catch {
     throw new HttpError("Request body is not valid JSON", 400);
   }
@@ -8333,6 +8926,7 @@ export {
   API_KEYS,
   API_KEY_GLOBAL_OPERATIONS,
   API_KEY_OPERATIONS,
+  AuditLog,
   Auth,
   BUILTIN_COLLECTIONS,
   CONFIG_FILE_NAMES,