@easy-cms/core 0.43.0 → 0.45.0

package/dist/index.js

@@ -1,4 +1,5 @@
 // src/access.ts
+var isSystemAdmin = (user) => user?.role === "admin" && !user.apiKey && user.scoped !== true;
 var anyone = () => true;
 var isLoggedIn = ({ user }) => user !== null;
 var isAdmin = ({ user }) => user?.role === "admin";
@@ -41,8 +42,7 @@ function keyAllows(user, target, operation) {
   const allowed2 = key2.permissions.globals?.[target.global];
   return allowed2?.includes(operation) ?? false;
 }
-var isAdmin2 = (user) => user?.role === "admin";
-var ownKeys = ({ user }) => !user || user.apiKey ? false : isAdmin2(user) ? true : { user: { equals: user.id } };
+var ownKeys = ({ user }) => !user || user.apiKey ? false : isSystemAdmin(user) ? true : { user: { equals: user.id } };
 var system = { update: () => false };
 var apiKeysCollection = {
   slug: API_KEYS,
@@ -99,14 +99,17 @@ var apiKeysCollection = {
     { name: "keyHash", type: "text", hidden: true }
   ],
   hooks: {
-    // Only real collections, globals and operations are kept.
+    // Only real collections, globals and operations are kept. A key keeps the context it was
+    // created in (`createApiKey`), whatever its permissions are changed to.
     beforeChange: [
-      ({ data, cms }) => data.permissions === void 0 ? data : {
-        ...data,
-        permissions: cleanPermissions(data.permissions, {
+      ({ data, cms, operation, originalDoc }) => {
+        if (data.permissions === void 0) return data;
+        const context = operation === "create" ? data.permissions.context : originalDoc?.permissions?.context;
+        const permissions = cleanPermissions(data.permissions, {
           collections: cms.config.collections.map((c) => c.slug),
           globals: cms.config.globals.map((g) => g.slug)
-        })
+        });
+        return { ...data, permissions: context ? { ...permissions, context } : permissions };
       }
     ]
   }
@@ -183,11 +186,11 @@ function withCreatedBy(config) {
 }
 var adminOrSelf = ({ user }) => {
   if (!user) return false;
-  if (user.role === "admin") return true;
+  if (isSystemAdmin(user)) return true;
   return { id: { equals: user.id } };
 };
 var adminOnly = {
-  update: ({ user }) => user?.role === "admin"
+  update: ({ user }) => isSystemAdmin(user)
 };
 function userFields(roles, rbac) {
   const defaultRole = roles.includes("editor") ? "editor" : roles[roles.length - 1];
@@ -239,9 +242,9 @@ function withUsers(config) {
     fields: [...userFields(roles, config.auth?.rbac === true), ...custom?.fields ?? []],
     access: {
       read: isLoggedIn,
-      create: isAdmin,
+      create: ({ user }) => isSystemAdmin(user),
       update: adminOrSelf,
-      delete: isAdmin,
+      delete: ({ user }) => isSystemAdmin(user),
       ...custom?.access
     }
   };
@@ -421,13 +424,37 @@ function withMedia(config) {
       ]
     }
   };
-  const others = (config.collections ?? []).filter((c) => c.slug !== MEDIA);
+  const customFolders = config.collections?.find((c) => c.slug === MEDIA_FOLDERS);
+  const mediaFolders = customFolders ? {
+    ...mediaFoldersCollection,
+    // A field named like a built-in one changes it (e.g. `key` unique per tenant).
+    fields: [
+      ...mediaFoldersCollection.fields.map((field) => {
+        const own = customFolders.fields.find((f) => f.name === field.name);
+        return own ? { ...field, ...own } : field;
+      }),
+      ...customFolders.fields.filter(
+        (f) => !mediaFoldersCollection.fields.some((b) => b.name === f.name)
+      )
+    ],
+    access: { ...mediaFoldersCollection.access, ...customFolders.access },
+    hooks: {
+      ...customFolders.hooks,
+      afterRead: [
+        ...mediaFoldersCollection.hooks?.afterRead ?? [],
+        ...customFolders.hooks?.afterRead ?? []
+      ]
+    }
+  } : mediaFoldersCollection;
+  const others = (config.collections ?? []).filter(
+    (c) => c.slug !== MEDIA && c.slug !== MEDIA_FOLDERS
+  );
   return {
     ...config,
     collections: [
       ...others.slice(0, 1),
       media,
-      ...folders ? [mediaFoldersCollection] : [],
+      ...folders ? [mediaFolders] : [],
       ...others.slice(1)
     ]
   };
@@ -544,7 +571,9 @@ var auditLogsCollection = {
     { name: "userAgent", type: "text" },
     { name: "changes", type: "json" },
     { name: "detail", type: "json" },
-    { name: "signature", type: "text" }
+    { name: "signature", type: "text" },
+    // The part of the site, e.g. the tenant (`audit.scope`).
+    { name: "scope", type: "text", index: true }
   ]
 };
 var emailDeliveriesCollection = {
@@ -617,7 +646,8 @@ var AuditLog = class {
     return this.cms.config.audit || {
       keep: DEFAULT_AUDIT_KEEP,
       values: true,
-      failedLogins: DEFAULT_FAILED_LOGINS
+      failedLogins: DEFAULT_FAILED_LOGINS,
+      scope: null
     };
   }
   /**
@@ -628,6 +658,7 @@ var AuditLog = class {
     if (!this.enabled) return;
     try {
       const context = auditContext.getStore();
+      const scope = this.scopeOf(entry.context ?? context?.context);
       const user = entry.user !== void 0 ? entry.user : context?.user ?? null;
       const apiKey = user?.apiKey;
       const row = {
@@ -642,7 +673,8 @@ var AuditLog = class {
         userAgent: context?.userAgent ? context.userAgent.slice(0, 200) : null,
         changes: entry.changes && entry.changes.length > 0 ? entry.changes : null,
         detail: apiKey ? { ...entry.detail, apiKey: apiKey.name ?? "" } : entry.detail ?? null,
-        createdAt: (/* @__PURE__ */ new Date()).toISOString()
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...scope ? { scope } : {}
       };
       row.signature = this.sign(row);
       row.updatedAt = row.createdAt;
@@ -658,7 +690,7 @@ var AuditLog = class {
    * A change to a document or global: what changed between `before` and `after`. Internal
    * collections (sessions, versions…) are not logged.
    */
-  async content(config, global2, action, after, before, user) {
+  async content(config, global2, action, after, before, user, context) {
     if (!this.enabled) return;
     if (!global2 && INTERNAL_COLLECTIONS.has(config.slug)) return;
     const doc = after ?? before;
@@ -674,7 +706,8 @@ var AuditLog = class {
       title,
       // A trusted call without a user keeps the request's (or is the system).
       ...user ? { user } : {},
-      changes: action === "delete" ? null : this.diff(config.fields, before ?? {}, after ?? {})
+      changes: action === "delete" ? null : this.diff(config.fields, before ?? {}, after ?? {}),
+      ...context && Object.keys(context).length > 0 ? { context } : {}
     });
   }
   /** Fields whose stored value changed. Hidden ones never (the password only as "changed"). */
@@ -819,8 +852,15 @@ var AuditLog = class {
     return out;
   }
   // -------------------------------------------------------------------------
+  /** The part of the site a context is in (`scope`), or `null`. */
+  scopeOf(context) {
+    const scope = this.settings.scope;
+    return (scope && context ? scope(context) : null) ?? null;
+  }
   sign(row) {
-    const payload = stable(SIGNED.map((key2) => row[key2] ?? null));
+    const values = SIGNED.map((key2) => row[key2] ?? null);
+    if (typeof row.scope === "string" && row.scope) values.push(row.scope);
+    const payload = stable(values);
     return createHmac("sha256", this.cms.config.secret).update(`audit:${payload}`).digest("base64url");
   }
   async lastVerification() {
@@ -848,6 +888,7 @@ var AuditLog = class {
     if (filter.actor) parts.push({ actorEmail: { like: filter.actor } });
     if (filter.from) parts.push({ createdAt: { gte: filter.from } });
     if (filter.to) parts.push({ createdAt: { lte: filter.to } });
+    if (filter.scope) parts.push({ scope: { equals: filter.scope } });
     return parts.length === 0 ? void 0 : parts.length === 1 ? parts[0] : { and: parts };
   }
 };
@@ -1119,6 +1160,7 @@ function sizeKey(filename, size) {
 var PRIVATE_KEY = /^[\p{L}\p{M}\p{N}-]+\.private(-[\p{L}\p{N}_-]+)?\.[a-z0-9]+$/u;
 
 // src/fields.ts
+var uniqueWithinOf = (field) => field.uniqueWithin === void 0 ? [] : [field.uniqueWithin].flat();
 var isHasMany = (field) => (field.type === "select" || field.type === "relationship" || field.type === "upload") && field.hasMany === true;
 function mimeAllowedBy(mimeType, patterns) {
   const type = mimeType.toLowerCase();
@@ -2872,7 +2914,7 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
           field: path,
           collection: target,
           id,
-          ...field.type === "relationship" && field.filterOptions ? { filterOptions: field.filterOptions } : {},
+          ...field.filterOptions ? { filterOptions: field.filterOptions } : {},
           ...field.type === "upload" && field.mimeTypes ? { mimeTypes: field.mimeTypes } : {},
           ...field.type === "upload" && field.folder && field.folderOnly ? { folderOnly: field.folder } : {}
         });
@@ -3358,7 +3400,8 @@ var MediaFolders = class {
         name: String(doc.name ?? ""),
         key: typeof doc.key === "string" && doc.key ? doc.key : null,
         private: doc.private === true,
-        permissions: permissions && typeof permissions === "object" && !Array.isArray(permissions) ? permissions : null
+        permissions: permissions && typeof permissions === "object" && !Array.isArray(permissions) ? permissions : null,
+        doc
       });
     }
     this.cache = { at: Date.now(), rows };
@@ -3428,18 +3471,15 @@ var MediaFolders = class {
     });
     return this.within(rows, [id]).map((f) => ({ id: f, private: this.privateIn(rows, f) }));
   }
-  /**
-   * The folder with this key (`folder: 'banners'` on upload fields), made at the top level when
-   * there is none yet.
-   */
-  async keyed(key2) {
-    const find = async () => [...(await this.rows()).values()].find((r) => r.key === key2);
+  async keyed(key2, scope = {}, create = true) {
+    const find = async () => [...(await this.rows()).values()].find((r) => r.key === key2 && inScope(r.doc, scope));
     let found = await find();
     if (!found) {
       this.invalidate();
       found = await find();
     }
     if (found) return found.id;
+    if (!create) return null;
     const now = (/* @__PURE__ */ new Date()).toISOString();
     try {
       const doc = await this.db.create({
@@ -3450,6 +3490,7 @@ var MediaFolders = class {
           parent: null,
           permissions: null,
           private: false,
+          ...scope,
           createdAt: now,
           updatedAt: now
         }
@@ -3464,10 +3505,10 @@ var MediaFolders = class {
     }
   }
   /** Whether a file in `folder` is in the folder with this key, or below it. */
-  async inKeyed(key2, folder) {
+  async inKeyed(key2, folder, scope = {}) {
     if (folder === null) return false;
     const rows = await this.rows();
-    const root = [...rows.values()].find((r) => r.key === key2);
+    const root = [...rows.values()].find((r) => r.key === key2 && inScope(r.doc, scope));
     return !!root && this.within(rows, [root.id]).some((id) => String(id) === String(folder));
   }
   /** The user's level in a folder (`null`: the top level). */
@@ -3592,6 +3633,11 @@ var MediaFolders = class {
     return this.rows();
   }
 };
+function inScope(row, scope) {
+  return Object.entries(scope).every(
+    ([name, value]) => value === null || value === void 0 ? row[name] === null || row[name] === void 0 : String(row[name]) === String(value)
+  );
+}
 
 // src/populate.ts
 var DEFAULT_DEPTH = 1;
@@ -4079,8 +4125,10 @@ var Roles = class {
    * it; without roles, nobody else (`status`, `deliveries`) or everybody (plugin pages).
    */
   async canView(user, id) {
-    if (user.role === "admin" && !user.apiKey) return true;
+    if (isSystemAdmin(user)) return true;
     if (user.apiKey) return false;
+    if (id === "audit" && user.role === "admin" && user.scoped === true && this.config.audit !== false && typeof this.config.audit.scope === "function")
+      return true;
     if (!this.enabled) return id.startsWith("page:") || id.startsWith("widget:");
     return (await this.permissionsOf(user.role)).admin?.includes(id) ?? false;
   }
@@ -4866,6 +4914,14 @@ function validateAdmin(config, add) {
       "e.g. siteUrl: 'https://example.com'"
     );
   }
+  const switcher = admin.switcher;
+  if (switcher !== void 0 && switcher !== null) {
+    const { cookie: cookie2, options } = switcher;
+    if (typeof cookie2 !== "string" || !/^[A-Za-z0-9_-]+$/.test(cookie2))
+      add("admin.switcher.cookie", "must be a cookie name (letters, digits, - and _)");
+    if (typeof options !== "string" || !options.startsWith("/"))
+      add("admin.switcher.options", 'must be a path under the API starting with "/"');
+  }
   const modules = admin.modules;
   if (modules !== void 0) {
     if (!Array.isArray(modules)) {
@@ -5501,6 +5557,22 @@ function validateField(field, path, siblings, collectionSlugs, add) {
       if (cell !== void 0) validateComponent(cell, `${path}.admin.cell`, add);
     }
   }
+  if (field.uniqueWithin !== void 0) {
+    if (!field.unique && field.type !== "slug")
+      add(`${path}.uniqueWithin`, "needs `unique: true` (or a slug field)");
+    else
+      for (const name of [field.uniqueWithin].flat()) {
+        const scope = siblings.get(name);
+        if (!scope || scope === field) {
+          add(`${path}.uniqueWithin`, `no sibling field named "${name}"`);
+        } else if (!["relationship", "select", "text", "number"].includes(scope.type) || "hasMany" in scope && scope.hasMany || scope.localized) {
+          add(
+            `${path}.uniqueWithin`,
+            `"${name}" must be a single, unlocalized relationship, select, text or number field`
+          );
+        }
+      }
+  }
   switch (field.type) {
     case "text":
     case "textarea":
@@ -5521,17 +5593,6 @@ function validateField(field, path, siblings, collectionSlugs, add) {
           add(`${path}.from`, `"${field.from}" must be a text field (got ${source.type})`);
         }
       }
-      if (field.uniqueWithin !== void 0) {
-        const scope = siblings.get(field.uniqueWithin);
-        if (!scope || scope === field) {
-          add(`${path}.uniqueWithin`, `no sibling field named "${field.uniqueWithin}"`);
-        } else if (!["relationship", "select", "text", "number"].includes(scope.type) || "hasMany" in scope && scope.hasMany || scope.localized) {
-          add(
-            `${path}.uniqueWithin`,
-            `"${field.uniqueWithin}" must be a single, unlocalized relationship, select, text or number field`
-          );
-        }
-      }
       break;
     case "relationship":
       if (typeof field.to !== "string" || !collectionSlugs.has(field.to)) {
@@ -5822,7 +5883,8 @@ async function resolveConfig(input) {
       menu: config.admin?.menu ?? [],
       modules: config.admin?.modules ?? [],
       pages: config.admin?.pages ?? [],
-      dashboard: config.admin?.dashboard ?? []
+      dashboard: config.admin?.dashboard ?? [],
+      switcher: config.admin?.switcher ?? null
     },
     upload: {
       dir: config.upload?.dir ?? "uploads",
@@ -5885,7 +5947,8 @@ function resolveAudit(audit) {
   return {
     keep: audit.keep ?? DEFAULT_AUDIT_KEEP,
     values: audit.values !== false,
-    failedLogins: audit.failedLogins ?? DEFAULT_FAILED_LOGINS
+    failedLogins: audit.failedLogins ?? DEFAULT_FAILED_LOGINS,
+    scope: audit.scope ?? null
   };
 }
 
@@ -5969,6 +6032,29 @@ var EasyCMS = class {
     );
     this.auth = new Auth(this);
   }
+  /**
+   * The user and context of a request, as the REST API works them out: its session cookie or
+   * Bearer token, then `onRequest`. For framework routes and server code that act for a visitor;
+   * pass both to the Local API with `overrideAccess: false`.
+   */
+  async forRequest(request) {
+    const headers = request instanceof Headers ? request : request.headers;
+    const url = request instanceof Headers ? void 0 : new URL(request.url);
+    return this.applyOnRequest(headers, url, await this.auth.userFromHeaders(headers));
+  }
+  /** @internal `onRequest` of the config, for a request whose user is known. */
+  async applyOnRequest(headers, url, user) {
+    const result = await this.config.onRequest?.({
+      headers,
+      url,
+      user,
+      cms: this
+    });
+    return {
+      user: result?.user !== void 0 ? result.user : user,
+      context: result?.context ?? NO_CONTEXT
+    };
+  }
   async find(collection2, options = {}) {
     const config = this.collection(collection2);
     const guard = guardOf(options);
@@ -6222,6 +6308,7 @@ var EasyCMS = class {
     await this.checkGrant(guard, { collection: MEDIA }, "create");
     const allowed2 = await evaluateAccess(this.collection(MEDIA).access?.create, {
       user: guard.user,
+      context: guard.context,
       data
     });
     if (allowed2 !== true) throw deny(guard.user);
@@ -6259,7 +6346,11 @@ var EasyCMS = class {
     const fromURL = this.config.upload.fromURL;
     if (guard.enforce) {
       await this.checkGrant(guard, { collection: MEDIA }, "create");
-      const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data });
+      const allowed2 = await evaluateAccess(config.access?.create, {
+        user: guard.user,
+        context: guard.context,
+        data
+      });
       if (allowed2 !== true) throw deny(guard.user);
       if (!fromURL)
         throw new ValidationError(MEDIA, [
@@ -6291,7 +6382,10 @@ var EasyCMS = class {
     const config = this.collection(API_KEYS);
     const guard = guardOf(options);
     if (guard.enforce) {
-      const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user });
+      const allowed2 = await evaluateAccess(config.access?.create, {
+        user: guard.user,
+        context: guard.context
+      });
       if (allowed2 !== true) throw deny(guard.user);
     }
     const owner = guard.enforce ? guard.user?.id : data.user;
@@ -6303,7 +6397,12 @@ var EasyCMS = class {
       config,
       {
         name: data.name,
-        permissions: data.permissions ?? {},
+        // The context it is created in (e.g. a tenant) stays with the key. Requests can't name
+        // one; trusted calls may.
+        permissions: {
+          ...withoutContext(data.permissions),
+          ...guard.enforce ? Object.keys(guard.context).length > 0 ? { context: guard.context } : {} : data.permissions?.context ? { context: data.permissions.context } : {}
+        },
         expiresAt: expiresAt ?? null,
         prefix,
         user: owner
@@ -6564,7 +6663,11 @@ var EasyCMS = class {
     if (id === null) {
       if (guard.enforce) {
         await this.checkGrant(guard, { collection: collection2 }, "create");
-        const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data: raw });
+        const allowed2 = await evaluateAccess(config.access?.create, {
+          user: guard.user,
+          context: guard.context,
+          data: raw
+        });
         if (allowed2 !== true) throw deny(guard.user);
       }
     } else {
@@ -6620,8 +6723,9 @@ var EasyCMS = class {
       raw,
       await this.fieldChecker("update", guard, void 0, raw)
     );
-    const saved = await this.db.findGlobal({ slug: slug2 }) ?? {};
-    const current = await this.globalDraft(config, saved);
+    const key2 = this.globalKey(config, guard);
+    const saved = (key2 ? await this.db.findGlobal({ slug: key2 }) : null) ?? {};
+    const current = await this.globalDraft(config, saved, key2);
     const merged = generateSlugs(
       config.fields,
       applyDefaults(
@@ -6719,7 +6823,7 @@ var EasyCMS = class {
       "update",
       parsed,
       options,
-      guard.user
+      guard
     );
     prepared = await this.transform(
       config.hooks?.beforeChange,
@@ -6853,8 +6957,12 @@ var EasyCMS = class {
     const config = this.global(slug2);
     const guard = guardOf(options);
     await this.checkGlobalAccess(config, "read", guard);
-    const saved = await this.db.findGlobal({ slug: slug2 });
-    const stored = saved && options.draft ? await this.globalDraft(config, saved) : saved;
+    return this.readGlobal(config, this.globalKey(config, guard), guard, options);
+  }
+  /** A global as stored under `key` (see `globalKey`); empty when there is no key. */
+  async readGlobal(config, key2, guard, options) {
+    const saved = key2 ? await this.db.findGlobal({ slug: key2 }) : null;
+    const stored = saved && options.draft ? await this.globalDraft(config, saved, key2) : saved;
     const data = fillMissing(
       config.fields,
       applyDefaults(config.fields, stored ?? {}, this.config.localization)
@@ -6867,6 +6975,27 @@ var EasyCMS = class {
     const { id: _id, ...doc } = out;
     return doc;
   }
+  /**
+   * Where a global is kept: its slug, or `<slug>@<scope>` for globals with `scope` (e.g. one per
+   * tenant). `null` when the call has no scope: reads give the global empty. `scope` is given by
+   * scheduled jobs, which have no request.
+   */
+  globalKey(config, guard, scope) {
+    if (scope !== void 0) return `${config.slug}@${scope}`;
+    if (!config.scope) return config.slug;
+    const own = config.scope({ context: guard.context, user: guard.user });
+    if (own === void 0) return config.slug;
+    return own === null ? null : `${config.slug}@${own}`;
+  }
+  /** `globalKey` for changes, which need a scope. */
+  writeKey(config, guard, scope) {
+    const key2 = this.globalKey(config, guard, scope);
+    if (key2 === null)
+      throw new QueryError(
+        `"${config.slug}" has a value per scope (e.g. per tenant): choose one to change it`
+      );
+    return key2;
+  }
   async updateGlobal(slug2, data, options = {}) {
     return this.saveGlobal(slug2, asObject(data, slug2), options);
   }
@@ -6880,20 +7009,21 @@ var EasyCMS = class {
     const config = this.global(slug2);
     const guard = guardOf(options);
     await this.checkGlobalAccess(config, "update", guard);
-    const saved = await this.db.findGlobal({ slug: slug2 });
-    if (saved && await this.globalDraft(config, saved) !== saved) {
-      await this.saveVersion(config, globalParent(slug2), 0, saved, guard);
+    const key2 = this.writeKey(config, guard);
+    const saved = await this.db.findGlobal({ slug: key2 });
+    if (saved && await this.globalDraft(config, saved, key2) !== saved) {
+      await this.saveVersion(config, globalParent(key2), 0, saved, guard);
     }
     return this.findGlobal(slug2, { ...options, draft: true });
   }
   /** Saved versions of a global, newest first. Needs update access. */
   async findGlobalVersions(slug2, options = {}) {
-    await this.globalVersionTarget(slug2, options);
-    return this.versions.list(globalParent(slug2), 0, options.limit ?? 20, options.page ?? 1);
+    const { key: key2 } = await this.globalVersionTarget(slug2, options);
+    return this.versions.list(globalParent(key2), 0, options.limit ?? 20, options.page ?? 1);
   }
   async findGlobalVersion(slug2, versionId, options = {}) {
-    const config = await this.globalVersionTarget(slug2, options);
-    const version = await this.versions.get(globalParent(slug2), 0, versionId);
+    const { config, key: key2 } = await this.globalVersionTarget(slug2, options);
+    const version = await this.versions.get(globalParent(key2), 0, versionId);
     if (!version) return null;
     const data = fillMissing(
       config.fields,
@@ -6908,8 +7038,8 @@ var EasyCMS = class {
   }
   /** Makes an old version of a global current (as a draft when the global has drafts). */
   async restoreGlobalVersion(slug2, versionId, options = {}) {
-    const config = await this.globalVersionTarget(slug2, options);
-    const version = await this.versions.get(globalParent(slug2), 0, versionId);
+    const { config, key: key2 } = await this.globalVersionTarget(slug2, options);
+    const version = await this.versions.get(globalParent(key2), 0, versionId);
     if (!version) throw new NotFoundError(`${slug2} version`, versionId);
     const { status: _status, ...data } = version.data;
     return this.saveGlobal(
@@ -6922,20 +7052,22 @@ var EasyCMS = class {
   async globalVersionTarget(slug2, options) {
     const config = this.global(slug2);
     if (!versionLimit(config)) throw new QueryError(`"${slug2}" has no versions`);
-    await this.checkGlobalAccess(config, "update", guardOf(options));
-    return config;
+    const guard = guardOf(options);
+    await this.checkGlobalAccess(config, "update", guard);
+    return { config, key: this.writeKey(config, guard) };
   }
   /** The global's pending draft when it has one (see `withDrafts`), otherwise `saved`. */
-  async globalDraft(config, saved) {
-    if (!this.separateDrafts(config) || saved.status !== "published") return saved;
-    const version = (await this.versions.latest(globalParent(config.slug), [0])).get("0");
+  async globalDraft(config, saved, key2) {
+    if (!key2 || !this.separateDrafts(config) || saved.status !== "published") return saved;
+    const version = (await this.versions.latest(globalParent(key2), [0])).get("0");
     if (version?.status !== "draft") return saved;
     return { ...version.data, updatedAt: version.createdAt, status: "draft" };
   }
-  async saveGlobal(slug2, raw, options, mode = "save") {
+  async saveGlobal(slug2, raw, options, mode = "save", scope) {
     const config = this.global(slug2);
     const guard = guardOf(options);
     await this.checkGlobalAccess(config, "update", guard);
+    const key2 = this.writeKey(config, guard, scope);
     if (config.drafts && (mode === "unpublish" || raw.status === "published"))
       await this.checkGrant(guard, { global: slug2 }, "publish");
     const input = await filterInput(
@@ -6943,8 +7075,8 @@ var EasyCMS = class {
       raw,
       await this.fieldChecker("update", guard, void 0, raw)
     );
-    const existing = await this.db.findGlobal({ slug: slug2 }) ?? {};
-    const current = await this.globalDraft(config, existing);
+    const existing = await this.db.findGlobal({ slug: key2 }) ?? {};
+    const current = await this.globalDraft(config, existing, key2);
     const localized = mode === "restore" ? input : this.toMaps(config, input, current, options);
     const merged = generateSlugs(
       config.fields,
@@ -6957,7 +7089,7 @@ var EasyCMS = class {
     );
     if (config.drafts) merged.status = input.status ?? current.status ?? "draft";
     const base = this.hookArgs(config, guard);
-    let prepared = await this.prepare(config, merged, "update", void 0, options, guard.user);
+    let prepared = await this.prepare(config, merged, "update", void 0, options, guard);
     prepared = await this.transform(
       config.hooks?.beforeChange,
       "data",
@@ -6967,7 +7099,7 @@ var EasyCMS = class {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     if (mode !== "unpublish" && this.separateDrafts(config) && existing.status === "published" && prepared.status === "draft") {
       const draft = { ...prepared, updatedAt: now };
-      await this.saveVersion(config, globalParent(slug2), 0, draft, guard);
+      await this.saveVersion(config, globalParent(key2), 0, draft, guard);
       await this.notify(config.hooks?.afterChange, "afterChange", slug2, {
         ...base,
         doc: draft,
@@ -6976,10 +7108,10 @@ var EasyCMS = class {
       });
       this.emit(config, "draft", draft);
       await this.audited(config, "draft", draft, current, guard, mode);
-      return this.findGlobal(slug2, { ...options, draft: true });
+      return this.readGlobal(config, key2, guard, { ...options, draft: true });
     }
-    const doc = await this.db.updateGlobal({ slug: slug2, data: { ...prepared, updatedAt: now } });
-    await this.saveVersion(config, globalParent(slug2), 0, doc, guard);
+    const doc = await this.db.updateGlobal({ slug: key2, data: { ...prepared, updatedAt: now } });
+    await this.saveVersion(config, globalParent(key2), 0, doc, guard);
     await this.notify(config.hooks?.afterChange, "afterChange", slug2, {
       ...base,
       doc,
@@ -6988,17 +7120,17 @@ var EasyCMS = class {
     });
     this.emit(config, "update", doc, existing.status);
     await this.audited(config, "update", doc, current, guard, mode);
-    return this.findGlobal(slug2, { ...options, draft: true });
+    return this.readGlobal(config, key2, guard, { ...options, draft: true });
   }
   /**
    * What `user` may do with one document. Resolves `where`-style access
    * against the document, so the admin UI can hide actions precisely.
    */
-  async documentPermissions(collection2, id, user) {
+  async documentPermissions(collection2, id, user, context = NO_CONTEXT) {
     const config = this.collection(collection2);
     const parsed = parseId(id);
     if (parsed === void 0) return { update: false, delete: false };
-    const guard = { enforce: true, user };
+    const guard = { enforce: true, user, context };
     const check2 = (operation) => this.checkDocumentAccess(config, operation, guard, parsed, void 0).then(
       () => true,
       (error) => {
@@ -7166,9 +7298,10 @@ var EasyCMS = class {
       const action = row.action;
       try {
         if (parent.startsWith("global:")) {
-          const slug2 = parent.slice("global:".length);
-          if (action === "publish") await this.saveGlobal(slug2, { status: "published" }, {});
-          else await this.saveGlobal(slug2, { status: "draft" }, {}, "unpublish");
+          const { slug: slug2, scope } = splitGlobalKey(parent.slice("global:".length));
+          if (action === "publish")
+            await this.saveGlobal(slug2, { status: "published" }, {}, "save", scope);
+          else await this.saveGlobal(slug2, { status: "draft" }, {}, "unpublish", scope);
         } else if (action === "publish") {
           await this.updateDocument(parent, row.doc, { status: "published" }, { depth: 0 });
         } else {
@@ -7213,16 +7346,16 @@ var EasyCMS = class {
     await this.removeJob(collection2, parsed, jobId);
   }
   async scheduleGlobal(slug2, job, options = {}) {
-    await this.globalScheduleTarget(slug2, options);
-    return this.addJob(`global:${slug2}`, 0, job, options);
+    const key2 = await this.globalScheduleTarget(slug2, options);
+    return this.addJob(`global:${key2}`, 0, job, options);
   }
   async scheduledGlobal(slug2, options = {}) {
-    await this.globalScheduleTarget(slug2, options);
-    return this.pendingJobs(`global:${slug2}`, 0);
+    const key2 = await this.globalScheduleTarget(slug2, options);
+    return this.pendingJobs(`global:${key2}`, 0);
   }
   async cancelGlobalSchedule(slug2, jobId, options = {}) {
-    await this.globalScheduleTarget(slug2, options);
-    await this.removeJob(`global:${slug2}`, 0, jobId);
+    const key2 = await this.globalScheduleTarget(slug2, options);
+    await this.removeJob(`global:${key2}`, 0, jobId);
   }
   async scheduleTarget(collection2, id, options) {
     const config = this.collection(collection2);
@@ -7237,8 +7370,10 @@ var EasyCMS = class {
   async globalScheduleTarget(slug2, options) {
     const config = this.global(slug2);
     if (!config.schedule) throw new QueryError(`"${slug2}" has no schedule`);
-    await this.checkGlobalAccess(config, "update", guardOf(options));
-    await this.checkGrant(guardOf(options), { global: slug2 }, "publish");
+    const guard = guardOf(options);
+    await this.checkGlobalAccess(config, "update", guard);
+    await this.checkGrant(guard, { global: slug2 }, "publish");
+    return this.writeKey(config, guard);
   }
   async addJob(parent, doc, job, options) {
     const runAt = new Date(job.at);
@@ -7295,9 +7430,16 @@ var EasyCMS = class {
       if (!guard.enforce) return true;
       const cached = allowed2.get(parent);
       if (cached !== void 0) return cached;
-      const config = parent.startsWith("global:") ? this.config.globals.find((g) => g.slug === parent.slice("global:".length)) : this.config.collections.find((c) => c.slug === parent);
-      const access = config ? await evaluateAccess(config.access?.update, { user: guard.user }) : false;
-      const target = parent.startsWith("global:") ? { global: parent.slice("global:".length) } : { collection: parent };
+      const global2 = parent.startsWith("global:") ? this.config.globals.find(
+        (g) => g.slug === splitGlobalKey(parent.slice("global:".length)).slug
+      ) : void 0;
+      if (global2 && this.globalKey(global2, guard) !== parent.slice("global:".length)) {
+        allowed2.set(parent, false);
+        return false;
+      }
+      const config = parent.startsWith("global:") ? global2 : this.config.collections.find((c) => c.slug === parent);
+      const access = config ? await evaluateAccess(config.access?.update, { user: guard.user, context: guard.context }) : false;
+      const target = parent.startsWith("global:") ? { global: splitGlobalKey(parent.slice("global:".length)).slug } : { collection: parent };
       const result = access !== false && await this.roles.allows(guard.user, target, "update") !== false;
       allowed2.set(parent, result);
       return result;
@@ -7306,7 +7448,7 @@ var EasyCMS = class {
     for (const row of rows.docs) {
       const parent = String(row.parent);
       if (!await may2(parent)) continue;
-      const target = parent.startsWith("global:") ? { global: parent.slice("global:".length) } : { collection: parent };
+      const target = parent.startsWith("global:") ? { global: splitGlobalKey(parent.slice("global:".length)).slug } : { collection: parent };
       jobs.push({ ...toJob(row), ...target, doc: row.doc });
       if (jobs.length === limit) break;
     }
@@ -7418,7 +7560,10 @@ var EasyCMS = class {
   async readWhere(config, guard, where) {
     if (!guard.enforce) return where;
     const own = await this.checkGrant(guard, { collection: config.slug }, "read");
-    const access = await evaluateAccess(config.access?.read, { user: guard.user });
+    const access = await evaluateAccess(config.access?.read, {
+      user: guard.user,
+      context: guard.context
+    });
     if (access === false) throw deny(guard.user);
     await this.checkQueryFields(config, guard, where);
     return andWhere(andWhere(where, access), own);
@@ -7428,6 +7573,7 @@ var EasyCMS = class {
     const own = await this.checkGrant(guard, { collection: config.slug }, operation);
     const allowed2 = await evaluateAccess(config.access?.[operation], {
       user: guard.user,
+      context: guard.context,
       id,
       ...data ? { data } : {}
     });
@@ -7445,7 +7591,10 @@ var EasyCMS = class {
   async checkGlobalAccess(config, operation, guard) {
     if (!guard.enforce) return;
     await this.checkGrant(guard, { global: config.slug }, operation);
-    const access = await evaluateAccess(config.access?.[operation], { user: guard.user });
+    const access = await evaluateAccess(config.access?.[operation], {
+      user: guard.user,
+      context: guard.context
+    });
     if (typeof access === "object")
       throw new QueryError(`${operation} access of global "${config.slug}" must return a boolean`);
     if (!access) throw deny(guard.user);
@@ -7456,6 +7605,7 @@ var EasyCMS = class {
       kind,
       {
         user: guard.user,
+        context: guard.context,
         ...id !== void 0 ? { id } : {},
         ...data ? { data } : {}
       },
@@ -7536,7 +7686,11 @@ var EasyCMS = class {
       await this.checkGrant(guard, { collection: collection2 }, "create");
       if (config.drafts && raw.status === "published")
         await this.checkGrant(guard, { collection: collection2 }, "publish");
-      const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data: raw });
+      const allowed2 = await evaluateAccess(config.access?.create, {
+        user: guard.user,
+        context: guard.context,
+        data: raw
+      });
       if (typeof allowed2 === "object")
         throw new QueryError(`create access of "${collection2}" must return a boolean`);
       if (!allowed2) throw deny(guard.user);
@@ -7568,7 +7722,7 @@ var EasyCMS = class {
       "create",
       void 0,
       options,
-      (hookGuard ?? guard).user
+      hookGuard ?? guard
     );
     prepared = await this.transform(
       config.hooks?.beforeChange,
@@ -7689,7 +7843,8 @@ var EasyCMS = class {
       action,
       event === "delete" ? void 0 : doc,
       event === "create" ? void 0 : previous,
-      guard.user
+      guard.user,
+      guard.context
     );
   }
   /** Records a version after a save, when the collection or global keeps versions. */
@@ -7706,7 +7861,12 @@ var EasyCMS = class {
     });
   }
   hookArgs(config, guard) {
-    return { user: guard.user, cms: this, slug: config.slug };
+    return {
+      user: guard.user,
+      cms: this,
+      slug: config.slug,
+      context: guard.context
+    };
   }
   /**
    * Runs hooks that may replace a value, passed as `data` (before hooks) or `doc` (afterRead).
@@ -7768,7 +7928,7 @@ var EasyCMS = class {
     return result;
   }
   /** Validates, checks uniqueness and references. Returns clean data or throws `ValidationError`. */
-  async prepare(config, data, operation, selfId, options = {}, user = null) {
+  async prepare(config, data, operation, selfId, options = {}, guard = { user: null, context: NO_CONTEXT }) {
     const isDraft = config.drafts === true && (data.status ?? "draft") === "draft";
     const locale = this.localeOf(options);
     const result = await validateFields(config.fields, data, {
@@ -7794,9 +7954,9 @@ var EasyCMS = class {
       await this.makeSlugsUnique(config, clean2, selfId);
       errors.push(...await this.checkUnique(config, clean2, selfId));
     }
-    errors.push(...await this.checkReferences(result.references));
+    errors.push(...await this.checkReferences(result.references, guard));
     if (errors.length === 0)
-      errors.push(...await this.checkFilterOptions(result.references, selfId, user));
+      errors.push(...await this.checkFilterOptions(result.references, selfId, guard));
     if (errors.length > 0) throw new ValidationError(config.slug, errors);
     return clean2;
   }
@@ -7824,7 +7984,11 @@ var EasyCMS = class {
   async makeSlugsUnique(config, data, selfId) {
     for (const field of config.fields) {
       if (field.type !== "slug") continue;
-      const scope = field.uniqueWithin === void 0 ? void 0 : { [field.uniqueWithin]: { equals: data[field.uniqueWithin] ?? null } };
+      const scope = field.uniqueWithin === void 0 ? void 0 : {
+        and: uniqueWithinOf(field).map((name) => ({
+          [name]: { equals: data[name] ?? null }
+        }))
+      };
       const unique = async (path, base) => {
         let candidate = base;
         for (let n = 2; await this.isTaken(config.slug, path, candidate, selfId, scope); n++) {
@@ -7855,9 +8019,14 @@ var EasyCMS = class {
         locale === this.config.localization?.defaultLocale ? field.name : `${field.name}.${locale}`,
         v
       ]) : [[field.name, field.name, value]];
+      const scope = field.uniqueWithin === void 0 ? void 0 : {
+        and: uniqueWithinOf(field).map((name) => ({
+          [name]: { equals: data[name] ?? null }
+        }))
+      };
       for (const [path, errorField, v] of checks) {
         if (v === null || v === void 0) continue;
-        if (await this.isTaken(config.slug, path, v, selfId)) {
+        if (await this.isTaken(config.slug, path, v, selfId, scope)) {
           errors.push({ field: errorField, message: "must be unique" });
         }
       }
@@ -7874,15 +8043,57 @@ var EasyCMS = class {
     };
     return await this.db.count({ collection: collection2, where }) > 0;
   }
+  /**
+   * What folder keys are unique within for a call (`uniqueWithin` of the `key` field of media
+   * folders, e.g. the tenant): the value a folder made by this call would get from its hooks.
+   */
+  async folderScope(guard) {
+    return this.uniqueScope(MEDIA_FOLDERS, "key", guard);
+  }
+  /**
+   * Where a unique field's values must differ for a call (`uniqueWithin`, e.g. the tenant): the
+   * value a document created by this call would get there from its hooks, as `{ [field]: value }`;
+   * `{}` when the field is unique everywhere. For finding documents by such a field, e.g. a page
+   * by its path in the current tenant.
+   */
+  async uniqueScope(collection2, field, options = {}) {
+    const config = this.config.collections.find((c) => c.slug === collection2);
+    const target = config?.fields.find((f) => f.name === field);
+    const within = target ? uniqueWithinOf(target) : [];
+    if (!config || within.length === 0) return {};
+    const guard = {
+      enforce: false,
+      user: options.user ?? null,
+      context: options.context ?? NO_CONTEXT
+    };
+    const data = await this.transform(
+      config.hooks?.beforeValidate,
+      "data",
+      { ...this.hookArgs(config, guard), operation: "create" },
+      {}
+    ).catch(() => ({}));
+    return Object.fromEntries(within.map((name) => [name, data[name] ?? null]));
+  }
+  /**
+   * @internal The id of the media folder with this key (`folder` of upload fields), made when
+   * needed; `null` when the call has no scope to make it in (e.g. all tenants) and none exists.
+   */
+  async keyedFolder(key2, options = {}) {
+    const scope = await this.folderScope(guardOf(options));
+    const complete = Object.values(scope).every((v) => v !== null && v !== void 0);
+    return this.folders.keyed(key2, scope, complete);
+  }
   /** Each reference is one its relationship's `filterOptions` allow. */
-  async checkFilterOptions(references2, selfId, user) {
+  async checkFilterOptions(references2, selfId, guard) {
     const errors = [];
     const cms = this;
+    const { user, context } = guard;
     const allowed2 = /* @__PURE__ */ new Map();
     for (const ref of references2) {
       const filter = ref.filterOptions;
       if (!filter) continue;
-      if (!allowed2.has(filter)) allowed2.set(filter, await filter({ id: selfId, user, cms }));
+      if (!allowed2.has(filter))
+        allowed2.set(filter, await filter({ id: selfId, user, cms, context }));
       const where = allowed2.get(filter);
       if (where === true) continue;
       const target = this.config.collections.find((c) => c.slug === ref.collection);
@@ -7897,7 +8108,7 @@ var EasyCMS = class {
     }
     return errors;
   }
-  async checkReferences(references2) {
+  async checkReferences(references2, guard) {
     const byCollection = /* @__PURE__ */ new Map();
     for (const ref of references2) {
       if (!this.config.collections.some((c) => c.slug === ref.collection)) continue;
@@ -7926,7 +8137,8 @@ var EasyCMS = class {
         }
         if (ref.folderOnly && this.folders.enabled && !await this.folders.inKeyed(
           ref.folderOnly,
-          doc.folder ?? null
+          doc.folder ?? null,
+          await this.folderScope(guard)
         ))
           errors.push({
             field: ref.field,
@@ -7968,8 +8180,21 @@ function wherePaths(where) {
   }
   return out;
 }
+var NO_CONTEXT = Object.freeze({});
+function withoutContext(permissions) {
+  const { context: _context, ...rest } = permissions ?? {};
+  return rest;
+}
+function splitGlobalKey(key2) {
+  const at = key2.indexOf("@");
+  return at < 0 ? { slug: key2 } : { slug: key2.slice(0, at), scope: key2.slice(at + 1) };
+}
 function guardOf(options) {
-  return { enforce: options.overrideAccess === false, user: options.user ?? null };
+  return {
+    enforce: options.overrideAccess === false,
+    user: options.user ?? null,
+    context: options.context ?? NO_CONTEXT
+  };
 }
 function deny(user) {
   return user ? new ForbiddenError() : new UnauthorizedError();
@@ -8256,10 +8481,10 @@ function componentRef(component) {
   if (typeof component === "string") return { tag: component };
   return component.props ? { tag: component.tag, props: JSON.parse(JSON.stringify(component.props)) } : { tag: component.tag };
 }
-async function allowed(access, user) {
-  return await evaluateAccess(access, { user }) !== false;
+async function allowed(access, user, context) {
+  return await evaluateAccess(access, { user, context }) !== false;
 }
-async function serializeFields(fields, checks, localized, folderId) {
+async function serializeFields(fields, checks, localized, folderId, who) {
   const { update: update2 } = checks;
   const out = [];
   for (const field of fields) {
@@ -8269,6 +8494,13 @@ async function serializeFields(fields, checks, localized, folderId) {
     if (field.required) f.required = true;
     if (field.unique) f.unique = true;
     if (field.defaultValue !== void 0) f.defaultValue = field.defaultValue;
+    if (field.admin?.defaultValue) {
+      const value = await field.admin.defaultValue(who);
+      if (value !== void 0) f.defaultValue = value;
+    }
+    const column = field.admin?.column;
+    if (column === true || typeof column === "function" && await column(who)) f.column = true;
+    if (field.admin?.allowCreate === false) f.noCreate = true;
     if (!await update2.allows(field)) f.readOnly = true;
     if (field.localized && localized) f.localized = true;
     if (field.position === "sidebar") f.position = "sidebar";
@@ -8309,16 +8541,19 @@ async function serializeFields(fields, checks, localized, folderId) {
       case "upload":
         f.to = "media";
         if (field.hasMany) f.hasMany = true;
+        if (field.filterOptions) f.filtered = true;
         if (field.minRows !== void 0) f.minRows = field.minRows;
         if (field.maxRows !== void 0) f.maxRows = field.maxRows;
         if (field.mimeTypes) f.mimeTypes = expandMimeTypes(field.mimeTypes);
-        if (field.folder && folderId)
-          f.folder = { id: await folderId(field.folder), only: field.folderOnly === true };
+        if (field.folder && folderId) {
+          const id = await folderId(field.folder);
+          if (id !== null) f.folder = { id, only: field.folderOnly === true };
+        }
         break;
       case "array":
         if (field.minRows !== void 0) f.minRows = field.minRows;
         if (field.maxRows !== void 0) f.maxRows = field.maxRows;
-        f.fields = await serializeFields(field.fields, checks, localized, folderId);
+        f.fields = await serializeFields(field.fields, checks, localized, folderId, who);
         break;
       case "blocks":
         if (field.minRows !== void 0) f.minRows = field.minRows;
@@ -8327,35 +8562,36 @@ async function serializeFields(fields, checks, localized, folderId) {
           field.blocks.map(async (block) => ({
             slug: block.slug,
             ...block.labels ? { labels: block.labels } : {},
-            fields: await serializeFields(block.fields, checks, localized, folderId)
+            fields: await serializeFields(block.fields, checks, localized, folderId, who)
           }))
         );
         break;
       case "group":
-        f.fields = await serializeFields(field.fields, checks, localized, folderId);
+        f.fields = await serializeFields(field.fields, checks, localized, folderId, who);
         break;
     }
     out.push(f);
   }
   return out;
 }
-async function checkers(cms, user) {
+async function checkers(cms, user, context) {
   const rules = await cms.roles.fieldRules(user);
   return {
-    update: new FieldAccessChecker("update", { user }, rules),
-    read: new FieldAccessChecker("read", { user }, rules)
+    update: new FieldAccessChecker("update", { user, context }, rules),
+    read: new FieldAccessChecker("read", { user, context }, rules)
   };
 }
-async function may(cms, access, user, target, operation) {
-  return await allowed(access, user) && await cms.roles.allows(user, target, operation) !== false;
+async function may(cms, access, user, target, operation, context) {
+  return await allowed(access, user, context) && await cms.roles.allows(user, target, operation) !== false;
 }
-async function collection(cms, config, user, localized, roles) {
+async function collection(cms, config, user, localized, roles, context) {
   const target = { collection: config.slug };
   const fields = await serializeFields(
     config.fields,
-    await checkers(cms, user),
+    await checkers(cms, user, context),
     localized,
-    folderIds(cms)
+    folderIds(cms, user, context),
+    { user, context }
   );
   if (config.slug === USERS && cms.roles.enabled) {
     const role = fields.find((f) => f.name === "role");
@@ -8372,11 +8608,11 @@ async function collection(cms, config, user, localized, roles) {
     schedule: config.schedule === true,
     fields,
     permissions: {
-      read: await may(cms, config.access?.read, user, target, "read"),
-      create: await may(cms, config.access?.create, user, target, "create"),
-      update: await may(cms, config.access?.update, user, target, "update"),
-      delete: await may(cms, config.access?.delete, user, target, "delete"),
-      publish: config.drafts === true && await may(cms, config.access?.update, user, target, "publish")
+      read: await may(cms, config.access?.read, user, target, "read", context),
+      create: await may(cms, config.access?.create, user, target, "create", context),
+      update: await may(cms, config.access?.update, user, target, "update", context),
+      delete: await may(cms, config.access?.delete, user, target, "delete", context),
+      publish: config.drafts === true && await may(cms, config.access?.update, user, target, "publish", context)
     }
   };
   if (config.labels) result.labels = config.labels;
@@ -8386,26 +8622,30 @@ async function collection(cms, config, user, localized, roles) {
   if (config.admin?.group === "settings" || SETTINGS.has(config.slug)) result.group = "settings";
   if (config.admin?.list?.tree) result.tree = config.admin.list.tree;
   if (config.admin?.list?.sort) result.defaultSort = config.admin.list.sort;
+  if (config.admin?.confirmDelete) result.confirmDelete = { ...config.admin.confirmDelete };
   const owner = cms.roles.ownerOf(config.slug);
   if (owner && fields.some((f) => f.name === owner)) result.owner = owner;
   if (config.editIn === "drawer" && !result.drafts && !result.versions && !result.preview)
     result.editIn = "drawer";
   return result;
 }
-async function global(cms, config, user, localized) {
+async function global(cms, config, user, localized, context) {
   const target = { global: config.slug };
-  const checks = await checkers(cms, user);
+  const checks = await checkers(cms, user, context);
   const result = {
     slug: config.slug,
     drafts: config.drafts === true,
     versions: Boolean(config.versions),
     preview: typeof config.preview === "function",
     schedule: config.schedule === true,
-    fields: await serializeFields(config.fields, checks, localized, folderIds(cms)),
+    fields: await serializeFields(config.fields, checks, localized, folderIds(cms, user, context), {
+      user,
+      context
+    }),
     permissions: {
-      read: await may(cms, config.access?.read, user, target, "read"),
-      update: await may(cms, config.access?.update, user, target, "update"),
-      publish: config.drafts === true && await may(cms, config.access?.update, user, target, "publish")
+      read: await may(cms, config.access?.read, user, target, "read", context),
+      update: await may(cms, config.access?.update, user, target, "update", context),
+      publish: config.drafts === true && await may(cms, config.access?.update, user, target, "publish", context)
     }
   };
   if (config.label !== void 0) result.label = config.label;
@@ -8413,11 +8653,11 @@ async function global(cms, config, user, localized) {
   if (config.admin?.sidebar?.length) result.sidebar = config.admin.sidebar.map(componentRef);
   return result;
 }
-async function adminSchema(cms, user, origin) {
+async function adminSchema(cms, user, origin, context = {}) {
   const collections = cms.config.collections.filter((c) => !INTERNAL_COLLECTIONS.has(c.slug));
   const localization = cms.config.localization;
   const localized = localization !== null;
-  const admin = user.role === "admin" && !user.apiKey;
+  const admin = isSystemAdmin(user);
   const deliveries = cms.config.collections.some(
     (c) => c.slug === WEBHOOK_DELIVERIES || c.slug === EMAIL_DELIVERIES
   );
@@ -8433,13 +8673,16 @@ async function adminSchema(cms, user, origin) {
   const roles = await cms.roles.options();
   return {
     locale: cms.config.admin.locale,
+    switcher: cms.config.admin.switcher,
     passwordLinks: cms.auth.canSendPasswordLinks(origin),
     menu: [...cms.config.admin.menu],
     localization: localization ? { locales: [...localization.locales], defaultLocale: localization.defaultLocale } : null,
     collections: await Promise.all(
-      collections.map((c) => collection(cms, c, user, localized, roles))
+      collections.map((c) => collection(cms, c, user, localized, roles, context))
+    ),
+    globals: await Promise.all(
+      cms.config.globals.map((g) => global(cms, g, user, localized, context))
     ),
-    globals: await Promise.all(cms.config.globals.map((g) => global(cms, g, user, localized))),
     modules: adminModuleUrls(cms),
     uploadFromURL: cms.config.upload.fromURL !== void 0,
     upload: {
@@ -8499,12 +8742,12 @@ async function widgets(cms, user) {
   }
   return out;
 }
-function folderIds(cms) {
-  return cms.folders.enabled ? (key2) => cms.folders.keyed(key2) : void 0;
+function folderIds(cms, user, context) {
+  return cms.folders.enabled ? (key2) => cms.keyedFolder(key2, { user, context }) : void 0;
 }
 
 // src/version.ts
-var VERSION = true ? "0.43.0" : "0.0.0-dev";
+var VERSION = true ? "0.45.0" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
 var DAY2 = 864e5;
@@ -8592,7 +8835,7 @@ function fieldAt(fields, path) {
   }
   return found;
 }
-async function pickerFilter(cms, url, target, user) {
+async function pickerFilter(cms, url, target, user, context = {}) {
   const forCollection = url.searchParams.get("filterFor");
   const forGlobal = url.searchParams.get("filterForGlobal");
   const spec = forCollection ?? forGlobal;
@@ -8601,12 +8844,13 @@ async function pickerFilter(cms, url, target, user) {
   const slug2 = dot > 0 ? spec.slice(0, dot) : "";
   const owner = forCollection !== null ? cms.config.collections.find((c) => c.slug === slug2) : cms.config.globals.find((g) => g.slug === slug2);
   const field = owner ? fieldAt(owner.fields, spec.slice(dot + 1)) : void 0;
-  if (field?.type !== "relationship" || field.to !== target)
+  const to = field?.type === "upload" ? "media" : field?.type === "relationship" ? field.to : null;
+  if (!field || field.type !== "relationship" && field.type !== "upload" || to !== target)
     throw new QueryError(`filterFor: no relationship to "${target}" at "${spec}"`);
   if (!field.filterOptions) return void 0;
   const rawId = url.searchParams.get("filterId");
   const id = rawId === null || rawId === "" ? void 0 : /^\d+$/.test(rawId) ? Number(rawId) : rawId;
-  const where = await field.filterOptions({ id, user, cms });
+  const where = await field.filterOptions({ id, user, cms, context });
   return where === true ? void 0 : where;
 }
 
@@ -8766,14 +9010,24 @@ async function respond(cms, request, url, path, root, options, production) {
     if (path === null) throw new HttpError("Not found", 404);
     const segments = pathSegments(path);
     const { token, via } = readToken(request);
-    const user = token ? await cms.auth.verify(token) : null;
-    if (!user && via === "bearer" && token?.startsWith("ecms_"))
+    const signedIn = token ? await cms.auth.verify(token) : null;
+    if (!signedIn && via === "bearer" && token?.startsWith("ecms_"))
       throw new UnauthorizedError("Invalid or expired API key");
-    const ctx = { request, url, user, via: user ? via : null, token, headers };
+    const { user, context } = await cms.applyOnRequest(request.headers, url, signedIn);
+    const ctx = {
+      request,
+      url,
+      user,
+      context,
+      via: signedIn ? via : null,
+      token,
+      headers
+    };
     const method = request.method.toUpperCase();
     if (method !== "GET" && method !== "HEAD") checkCsrf(cms, ctx);
     const audit = {
       user,
+      context,
       ip: options.getClientIp?.(request),
       userAgent: request.headers.get("user-agent")
     };
@@ -8833,6 +9087,7 @@ async function customEndpoint(cms, ctx, method, segments, root, options) {
       url: ctx.url,
       params,
       user: ctx.user,
+      context: ctx.context,
       ip: options.getClientIp?.(ctx.request),
       cms,
       json: () => readJson(ctx.request)
@@ -8859,7 +9114,12 @@ function matchPath(path, segments) {
 }
 async function route(cms, ctx, method, segments, options) {
   const [first, second, third] = segments;
-  const access = { overrideAccess: false, user: ctx.user, ...parseLocale(ctx.url) };
+  const access = {
+    overrideAccess: false,
+    user: ctx.user,
+    context: ctx.context,
+    ...parseLocale(ctx.url)
+  };
   const draft = ctx.user !== null && ctx.url.searchParams.get("draft") === "true";
   if (segments.length === 0) throw new HttpError("Not found", 404);
   if (first === "auth") return ssoRoute(cms, ctx, method, segments);
@@ -8957,14 +9217,14 @@ async function route(cms, ctx, method, segments, options) {
     const secret = cms.config.cronSecret ?? process.env.CRON_SECRET;
     const header = ctx.request.headers.get("authorization") ?? "";
     const byCron = !!secret && safeEqual(header, `Bearer ${secret}`);
-    if (!byCron && ctx.user?.role !== "admin") {
+    if (!byCron && !isSystemAdmin(ctx.user)) {
       throw ctx.user ? new HttpError("Forbidden", 403) : new UnauthorizedError();
     }
     return { body: await cms.runJobs() };
   }
   if (first === "admin" && second === "backups") {
     if (!ctx.user) throw new UnauthorizedError();
-    if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+    if (!isSystemAdmin(ctx.user)) throw new ForbiddenError();
     const [, , id2, action, extra] = segments;
     if (extra !== void 0) throw new HttpError("Not found", 404);
     if (id2 === void 0) {
@@ -9006,7 +9266,7 @@ async function route(cms, ctx, method, segments, options) {
   }
   if (first === "admin" && second === "email") {
     if (!ctx.user) throw new UnauthorizedError();
-    if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+    if (!isSystemAdmin(ctx.user)) throw new ForbiddenError();
     const [, , action, extra] = segments;
     if (extra !== void 0) throw new HttpError("Not found", 404);
     if (action === void 0) {
@@ -9025,7 +9285,7 @@ async function route(cms, ctx, method, segments, options) {
   }
   if (first === "admin" && second === "sso" && third === void 0) {
     if (!ctx.user) throw new UnauthorizedError();
-    if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+    if (!isSystemAdmin(ctx.user)) throw new ForbiddenError();
     if (method !== "GET") throw methodNotAllowed(ctx, "GET");
     return { body: cms.auth.sso.settings(ctx.url.origin) };
   }
@@ -9040,8 +9300,11 @@ async function route(cms, ctx, method, segments, options) {
       doc: q.get("doc"),
       actor: q.get("actor"),
       from: q.get("from"),
-      to: q.get("to")
+      to: q.get("to"),
+      // Users of a part of the site (e.g. one tenant) see its entries; others the chosen part's.
+      scope: cms.audit.scopeOf(ctx.context)
     };
+    if (ctx.user.scoped && !filter.scope) throw new ForbiddenError();
     if (second === "audit.csv" && third === void 0) {
       if (method !== "GET") throw methodNotAllowed(ctx, "GET");
       return {
@@ -9066,7 +9329,7 @@ async function route(cms, ctx, method, segments, options) {
   }
   if (first === "admin" && second === "owned" && third !== void 0 && segments.length === 3) {
     if (!ctx.user) throw new UnauthorizedError();
-    if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+    if (!isSystemAdmin(ctx.user)) throw new ForbiddenError();
     if (method !== "GET") throw methodNotAllowed(ctx, "GET");
     const parsed = parseId(third);
     if (parsed === void 0) throw new HttpError("Not found", 404);
@@ -9080,7 +9343,7 @@ async function route(cms, ctx, method, segments, options) {
   }
   if (first === "admin" && second === "roles") {
     if (!ctx.user) throw new UnauthorizedError();
-    if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+    if (!isSystemAdmin(ctx.user)) throw new ForbiddenError();
     if (!cms.roles.enabled) throw new HttpError("Not found", 404);
     const [, , id2, action, extra] = segments;
     if (extra !== void 0) throw new HttpError("Not found", 404);
@@ -9166,7 +9429,7 @@ async function route(cms, ctx, method, segments, options) {
     if (method !== "GET") throw methodNotAllowed(ctx, "GET");
     if (!ctx.user) throw new UnauthorizedError();
     if (second === "schema" && third === void 0)
-      return { body: await adminSchema(cms, ctx.user, ctx.url.origin) };
+      return { body: await adminSchema(cms, ctx.user, ctx.url.origin, ctx.context) };
     if (second === "modules" && third !== void 0 && segments.length === 3) {
       const index = /^(\d+)\.js$/.exec(third)?.[1];
       const file = index === void 0 ? void 0 : await readAdminModule(cms, Number(index));
@@ -9186,13 +9449,19 @@ async function route(cms, ctx, method, segments, options) {
       return { body: await adminStatus(cms) };
     }
     if (second === "scheduled" && third === void 0)
-      return { body: await cms.upcomingJobs({ user: ctx.user, overrideAccess: false }) };
+      return {
+        body: await cms.upcomingJobs({
+          user: ctx.user,
+          context: ctx.context,
+          overrideAccess: false
+        })
+      };
     const [, , collection3, id2, extra] = segments;
     if (second === "access" && collection3 && id2 && extra === void 0) {
       if (INTERNAL_COLLECTIONS.has(collection3) || !cms.config.collections.some((c) => c.slug === collection3)) {
         throw new HttpError(`Unknown collection "${collection3}"`, 404);
       }
-      return { body: await cms.documentPermissions(collection3, id2, ctx.user) };
+      return { body: await cms.documentPermissions(collection3, id2, ctx.user, ctx.context) };
     }
     throw new HttpError("Not found", 404);
   }
@@ -9297,7 +9566,7 @@ async function route(cms, ctx, method, segments, options) {
   if (second === void 0) {
     if (method === "GET") {
       const query = parseListQuery(ctx.url);
-      const filter = await pickerFilter(cms, ctx.url, collection2, ctx.user);
+      const filter = await pickerFilter(cms, ctx.url, collection2, ctx.user, ctx.context);
       if (filter) query.where = query.where ? { and: [query.where, filter] } : filter;
       return { body: await cms.find(collection2, { ...access, ...query, draft }) };
     }
@@ -9342,12 +9611,17 @@ async function route(cms, ctx, method, segments, options) {
   throw methodNotAllowed(ctx, "GET, PATCH, DELETE");
 }
 async function documentAction(cms, ctx, method, collection2, id, path) {
-  const access = { overrideAccess: false, user: ctx.user, ...parseLocale(ctx.url) };
+  const access = {
+    overrideAccess: false,
+    user: ctx.user,
+    context: ctx.context,
+    ...parseLocale(ctx.url)
+  };
   const depth = parseDepth(ctx.url);
   const [action, versionId, extra] = path;
   if (collection2 === USERS && action === "password-link" && path.length === 1) {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
-    if (ctx.user?.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+    if (!isSystemAdmin(ctx.user)) throw new ForbiddenError();
     const body = await readJson(ctx.request).catch(() => ({}));
     const sent = await cms.auth.sendPasswordLink(/^\d+$/.test(id) ? Number(id) : id, {
       origin: ctx.url.origin,
@@ -9400,7 +9674,12 @@ async function documentAction(cms, ctx, method, collection2, id, path) {
   throw new HttpError("Not found", 404);
 }
 async function globalAction(cms, ctx, method, slug2, path) {
-  const access = { overrideAccess: false, user: ctx.user, ...parseLocale(ctx.url) };
+  const access = {
+    overrideAccess: false,
+    user: ctx.user,
+    context: ctx.context,
+    ...parseLocale(ctx.url)
+  };
   const depth = parseDepth(ctx.url);
   const [action, versionId, extra] = path;
   if (action === "versions" && versionId === void 0) {
@@ -9563,6 +9842,7 @@ async function servePrivateFile(cms, ctx, key2, head) {
       limit: 5,
       depth: 0,
       user: ctx.user,
+      context: ctx.context,
       overrideAccess: false
     });
     const owns = found.docs.some(
@@ -9663,7 +9943,7 @@ async function ssoRoute(cms, ctx, method, segments) {
       if (method !== "GET") throw methodNotAllowed(ctx, "GET");
       const asked = ctx.url.searchParams.get("user");
       const target = asked === null ? ctx.user.id : parseId(asked) ?? asked;
-      if (String(target) !== String(ctx.user.id) && (ctx.user.role !== "admin" || ctx.user.apiKey))
+      if (String(target) !== String(ctx.user.id) && !isSystemAdmin(ctx.user))
         throw new ForbiddenError();
       return { body: await sso.identities(target) };
     }
@@ -10061,6 +10341,7 @@ export {
   isAdmin,
   isHasMany,
   isLoggedIn,
+  isSystemAdmin,
   keyAllows,
   loadConfig,
   localStorage,
@@ -10078,6 +10359,7 @@ export {
   singularize,
   slugify,
   sniffMimeType,
+  uniqueWithinOf,
   validateConfig,
   validateFields,
   verifyPassword,