@easy-cms/core 0.44.0 → 0.45.0

package/dist/index.d.ts

@@ -1087,9 +1087,15 @@ declare class MediaFolders {
      * The folder with this key (`folder: 'banners'` on upload fields), made at the top level when
      * there is none yet.
      */
-    keyed(key: string): Promise<ID>;
+    /**
+     * The folder with this key, made when first needed. `scope`: the values the key is unique
+     * within (`uniqueWithin` of the `key` field, e.g. the tenant), given to a new folder too.
+     * `null` when there is none and `create` is false.
+     */
+    keyed(key: string, scope?: Readonly<Record<string, unknown>>): Promise<ID>;
+    keyed(key: string, scope: Readonly<Record<string, unknown>>, create: boolean): Promise<ID | null>;
     /** Whether a file in `folder` is in the folder with this key, or below it. */
-    inKeyed(key: string, folder: ID | null): Promise<boolean>;
+    inKeyed(key: string, folder: ID | null, scope?: Readonly<Record<string, unknown>>): Promise<boolean>;
     /** The user's level in a folder (`null`: the top level). */
     level(user: AuthUser | null, id: ID | null): Promise<FolderLevel | 'none'>;
     /**
@@ -1673,6 +1679,23 @@ declare class EasyCMS<C extends Config = Config> {
     private makeSlugsUnique;
     private checkUnique;
     private isTaken;
+    /**
+     * What folder keys are unique within for a call (`uniqueWithin` of the `key` field of media
+     * folders, e.g. the tenant): the value a folder made by this call would get from its hooks.
+     */
+    private folderScope;
+    /**
+     * Where a unique field's values must differ for a call (`uniqueWithin`, e.g. the tenant): the
+     * value a document created by this call would get there from its hooks, as `{ [field]: value }`;
+     * `{}` when the field is unique everywhere. For finding documents by such a field, e.g. a page
+     * by its path in the current tenant.
+     */
+    uniqueScope(collection: string, field: string, options?: Pick<AccessOptions, 'user' | 'context'>): Promise<Record<string, unknown>>;
+    /**
+     * @internal The id of the media folder with this key (`folder` of upload fields), made when
+     * needed; `null` when the call has no scope to make it in (e.g. all tenants) and none exists.
+     */
+    keyedFolder(key: string, options?: AccessOptions): Promise<ID | null>;
     /** Each reference is one its relationship's `filterOptions` allow. */
     private checkFilterOptions;
     private checkReferences;
@@ -1711,6 +1734,23 @@ interface FieldAdmin {
     readonly after?: readonly AdminComponent[];
     /** Shows the value in the admin's lists (e.g. a color swatch). Default: the plain value. */
     readonly cell?: AdminComponent;
+    /**
+     * A column of the list at first (each user can change it): `true`, or per request, e.g.
+     * only when the admin shows every tenant.
+     */
+    readonly column?: boolean | ((args: AdminFieldArgs) => boolean | Promise<boolean>);
+    /** Relationships: offer to create the related document in place. Default true. */
+    readonly allowCreate?: boolean;
+    /**
+     * The value a new document's form starts with, worked out for each user, e.g. from the
+     * request's context. The server's own default (`defaultValue`, hooks) still applies.
+     */
+    readonly defaultValue?: (args: AdminFieldArgs) => unknown;
+}
+/** What per-request admin options of a field receive. */
+interface AdminFieldArgs {
+    readonly user: AuthUser;
+    readonly context: RequestContext;
 }
 /**
  * Field types that packages add (`fieldTypes` in the config), for the types inferred from the
@@ -1741,11 +1781,11 @@ interface BaseField<TType extends string, TValue> {
     readonly required?: boolean;
     readonly unique?: boolean;
     /**
-     * With `unique` (or on a slug field): the name of a sibling field (e.g. `parent` or `tenant`)
+     * With `unique` (or on a slug field): a sibling field (e.g. `parent` or `tenant`), or several,
      * whose documents only need to differ among themselves, so `/about/team` and `/careers/team`
-     * can both be `team`. A single, unlocalized relationship, select, text or number field.
+     * can both be `team`. Single, unlocalized relationship, select, text or number fields.
      */
-    readonly uniqueWithin?: string;
+    readonly uniqueWithin?: string | readonly string[];
     readonly index?: boolean;
     readonly defaultValue?: TValue;
     readonly validate?: FieldValidate<TValue>;
@@ -1825,6 +1865,8 @@ interface UploadField extends BaseField<'upload', never> {
     readonly folder?: string;
     /** With `folder`: only files in that folder (and its subfolders) may be chosen. */
     readonly folderOnly?: boolean;
+    /** Which media documents may be chosen, as for relationships: offered and checked on save. */
+    readonly filterOptions?: FilterOptions;
 }
 interface FilterOptionsArgs {
     /** The document being edited; `undefined` while it is being created. */
@@ -1876,6 +1918,8 @@ interface BlocksField extends BaseField<'blocks', never> {
     readonly minRows?: number;
     readonly maxRows?: number;
 }
+/** The fields `uniqueWithin` names, as a list. */
+declare const uniqueWithinOf: (field: Field) => readonly string[];
 /** Fields with `hasMany`: their value is a list of options, documents or files. */
 declare const isHasMany: (field: Field) => boolean;
 /** Whether a MIME type is one of `patterns` (`image/*` matches every image). */
@@ -1896,6 +1940,12 @@ interface AuditConfig {
     readonly values?: boolean;
     /** Failed logins within an hour that the dashboard warns about. Default 20. */
     readonly failedLogins?: number;
+    /**
+     * The part of the site an entry belongs to, from the request's context, e.g. its tenant
+     * (usually set by a plugin). Users whose role holds in a part only (`scoped`) see that part's
+     * entries; others see the chosen part's, or all.
+     */
+    readonly scope?: ((context: RequestContext) => string | null | undefined) | null;
 }
 /** A field that changed: values before and after, unless they are not kept. */
 interface AuditChange {
@@ -1943,6 +1993,8 @@ interface AuditFilter {
     /** ISO dates. */
     from?: string | null;
     to?: string | null;
+    /** Only entries of this part of the site (`scope`). */
+    scope?: string | null;
 }
 /** `POST <api>/admin/audit/verify`. */
 interface AuditVerification {
@@ -1979,12 +2031,14 @@ declare class AuditLog {
         email?: string | null;
         changes?: AuditChange[] | null;
         detail?: Record<string, unknown> | null;
+        /** The call's context, when it is not the request's. */
+        context?: RequestContext;
     }): Promise<void>;
     /**
      * A change to a document or global: what changed between `before` and `after`. Internal
      * collections (sessions, versions…) are not logged.
      */
-    content(config: CollectionConfig | GlobalConfig, global: boolean, action: string, after: Record<string, unknown> | undefined, before: Record<string, unknown> | undefined, user: AuthUser | null): Promise<void>;
+    content(config: CollectionConfig | GlobalConfig, global: boolean, action: string, after: Record<string, unknown> | undefined, before: Record<string, unknown> | undefined, user: AuthUser | null, context?: RequestContext): Promise<void>;
     /** Fields whose stored value changed. Hidden ones never (the password only as "changed"). */
     diff(fields: readonly Field[], before: Record<string, unknown>, after: Record<string, unknown>): AuditChange[];
     list(filter: AuditFilter, page?: number): Promise<AuditPage>;
@@ -2009,6 +2063,8 @@ declare class AuditLog {
         invalid: number;
         at: string;
     })[]>;
+    /** The part of the site a context is in (`scope`), or `null`. */
+    scopeOf(context: RequestContext | undefined): string | null;
     private sign;
     private lastVerification;
     private where;
@@ -2299,6 +2355,16 @@ interface CollectionAdmin extends ContainerAdmin {
      * `author`, for roles given "own documents only". Default: who created it (`createdBy`).
      */
     readonly ownerField?: string;
+    /**
+     * Deleting asks more than "Are you sure?", for documents that take much with them (e.g. a
+     * tenant): `typeTitle` has the user type the document's title; `impact` is a path under the
+     * API, called with `?id=`, that returns `{ message }` (a label) saying what will be lost.
+     * Documents are then deleted one at a time, not from a selection.
+     */
+    readonly confirmDelete?: {
+        readonly typeTitle?: boolean;
+        readonly impact?: string;
+    };
 }
 interface CollectionListAdmin {
     /**
@@ -3199,6 +3265,10 @@ interface AdminField {
         after?: AdminComponentRef[];
         cell?: AdminComponentRef;
     };
+    /** A column of the list at first (`admin.column`). */
+    column?: boolean;
+    /** A relationship that offers no "Create" in place (`admin.allowCreate: false`). */
+    noCreate?: boolean;
     /** A field of an added type (`fieldTypes`), e.g. `color`; `type` is the base it's stored as. */
     customType?: string;
 }
@@ -3236,6 +3306,11 @@ interface AdminCollection {
     };
     /** With `auth.rbac`: the field naming a document's owner (`createdBy` or `admin.ownerField`). */
     owner?: string;
+    /** Deleting asks to type the title, and says what goes too (`admin.confirmDelete`). */
+    confirmDelete?: {
+        typeTitle?: boolean;
+        impact?: string;
+    };
 }
 interface AdminGlobal {
     slug: string;
@@ -3437,4 +3512,4 @@ declare function validateConfig(config: Config): ConfigIssue[];
 /** The version of `@easy-cms/core`, set when the package is built. */
 declare const VERSION: string;
 
-export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminAttention, type AdminBackup, type AdminBackups, type AdminBrand, type AdminCollection, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminDeliveries, type AdminDelivery, type AdminEmail, type AdminEmailDelivery, type AdminField, type AdminGlobal, type AdminIcon, type AdminLocale, type AdminPage, type AdminPageRef, type AdminRole, type AdminRoleChange, type AdminRoleField, type AdminRoleTarget, type AdminRoleView, type AdminRoles, type AdminSchema, type AdminSso, type AdminStatus, type AdminSwitcher, type AdminViewAccess, type AdminWebhookDelivery, type AdminWidgetRef, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiHandlerOptions, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, type AuditChange, type AuditConfig, type AuditEntry, AuditLog, type AuditPage, type AuditVerification, Auth, type AuthConfig, type AuthProvider, type AuthProviderProfile, type AuthProviderRequest, type AuthUser, BUILTIN_COLLECTIONS, type BackupState, type BackupsConfig, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinMediaFoldersCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, type CustomField, type CustomFieldTypes, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_PASSWORD_EMAILS, DEFAULT_TOKEN_EXPIRATION, type DashboardWidget, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DeliveryKind, type DeliveryState, type DepthOptions, type DirectUpload, type DocumentOf, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailCheck, type EmailField, type EmailMessage, type EmailSetting, type Endpoint, type EndpointRequest, FIELD_TYPES, FIELD_TYPE_BASES, FOLDER_LEVELS, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, type FieldError, type FieldRule, type FieldType, type FieldTypeBase, type FieldTypeDefinition, type FieldTypeValidateContext, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, type FolderLevel, type FolderPermissions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type InferCollection, type InferGlobal, type JsonField, type Label, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MEDIA_FOLDERS, MIME_GROUPS, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, MediaFolders, type MediaSize, type MigrationInfo, NotFoundError, type NumberField, type OnRequest, type OnRequestArgs, type Operation, type PaginatedDocs, type PasswordEmail, type PasswordEmailArgs, type PasswordEmailFn, type PasswordLinkOptions, PayloadTooLargeError, type Plugin, type PluginInfo, type PluginTypes, type PreviewTarget, type PreviewURL, QueryError, ROLE_OPERATIONS, type RawDocument, type ReadOptions, type RelationshipField, type RequestContext, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoleOperation, type RolePermissions, Roles, type RoutesConfig, SESSION_COOKIE, SSO_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SelectField, type SelectOption, type Session, type SlugField, type SlugOf, type SsoOutcome, type SsoProviderRef, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, type TypedPlugin, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, type UploadFromURLConfig, type UserIdentity, VERSION, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, configSignature, consoleEmail, consoleLogger, copyDatabase, createApiHandler, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, defineFieldType, definePlugin, expandMimeTypes, fillMissing, findConfigFile, generateSlugs, generateTypes, hasRows, hashPassword, imageDimensions, importConfig, isAdmin, isHasMany, isLoggedIn, isSystemAdmin, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, mimeAllowedBy, parseId, populate, readCookie, resolveAdminModule, resolveConfig, rowFields, sharedEasyCMS, silentLogger, singularize, slugify, sniffMimeType, validateConfig, validateFields, verifyPassword, writeBackupFile };
+export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminAttention, type AdminBackup, type AdminBackups, type AdminBrand, type AdminCollection, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminDeliveries, type AdminDelivery, type AdminEmail, type AdminEmailDelivery, type AdminField, type AdminFieldArgs, type AdminGlobal, type AdminIcon, type AdminLocale, type AdminPage, type AdminPageRef, type AdminRole, type AdminRoleChange, type AdminRoleField, type AdminRoleTarget, type AdminRoleView, type AdminRoles, type AdminSchema, type AdminSso, type AdminStatus, type AdminSwitcher, type AdminViewAccess, type AdminWebhookDelivery, type AdminWidgetRef, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiHandlerOptions, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, type AuditChange, type AuditConfig, type AuditEntry, AuditLog, type AuditPage, type AuditVerification, Auth, type AuthConfig, type AuthProvider, type AuthProviderProfile, type AuthProviderRequest, type AuthUser, BUILTIN_COLLECTIONS, type BackupState, type BackupsConfig, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinMediaFoldersCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, type CustomField, type CustomFieldTypes, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_PASSWORD_EMAILS, DEFAULT_TOKEN_EXPIRATION, type DashboardWidget, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DeliveryKind, type DeliveryState, type DepthOptions, type DirectUpload, type DocumentOf, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailCheck, type EmailField, type EmailMessage, type EmailSetting, type Endpoint, type EndpointRequest, FIELD_TYPES, FIELD_TYPE_BASES, FOLDER_LEVELS, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, type FieldError, type FieldRule, type FieldType, type FieldTypeBase, type FieldTypeDefinition, type FieldTypeValidateContext, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, type FolderLevel, type FolderPermissions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type InferCollection, type InferGlobal, type JsonField, type Label, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MEDIA_FOLDERS, MIME_GROUPS, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, MediaFolders, type MediaSize, type MigrationInfo, NotFoundError, type NumberField, type OnRequest, type OnRequestArgs, type Operation, type PaginatedDocs, type PasswordEmail, type PasswordEmailArgs, type PasswordEmailFn, type PasswordLinkOptions, PayloadTooLargeError, type Plugin, type PluginInfo, type PluginTypes, type PreviewTarget, type PreviewURL, QueryError, ROLE_OPERATIONS, type RawDocument, type ReadOptions, type RelationshipField, type RequestContext, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoleOperation, type RolePermissions, Roles, type RoutesConfig, SESSION_COOKIE, SSO_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SelectField, type SelectOption, type Session, type SlugField, type SlugOf, type SsoOutcome, type SsoProviderRef, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, type TypedPlugin, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, type UploadFromURLConfig, type UserIdentity, VERSION, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, configSignature, consoleEmail, consoleLogger, copyDatabase, createApiHandler, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, defineFieldType, definePlugin, expandMimeTypes, fillMissing, findConfigFile, generateSlugs, generateTypes, hasRows, hashPassword, imageDimensions, importConfig, isAdmin, isHasMany, isLoggedIn, isSystemAdmin, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, mimeAllowedBy, parseId, populate, readCookie, resolveAdminModule, resolveConfig, rowFields, sharedEasyCMS, silentLogger, singularize, slugify, sniffMimeType, uniqueWithinOf, validateConfig, validateFields, verifyPassword, writeBackupFile };

package/dist/index.js

@@ -427,7 +427,16 @@ function withMedia(config) {
   const customFolders = config.collections?.find((c) => c.slug === MEDIA_FOLDERS);
   const mediaFolders = customFolders ? {
     ...mediaFoldersCollection,
-    fields: [...mediaFoldersCollection.fields, ...customFolders.fields],
+    // A field named like a built-in one changes it (e.g. `key` unique per tenant).
+    fields: [
+      ...mediaFoldersCollection.fields.map((field) => {
+        const own = customFolders.fields.find((f) => f.name === field.name);
+        return own ? { ...field, ...own } : field;
+      }),
+      ...customFolders.fields.filter(
+        (f) => !mediaFoldersCollection.fields.some((b) => b.name === f.name)
+      )
+    ],
     access: { ...mediaFoldersCollection.access, ...customFolders.access },
     hooks: {
       ...customFolders.hooks,
@@ -562,7 +571,9 @@ var auditLogsCollection = {
     { name: "userAgent", type: "text" },
     { name: "changes", type: "json" },
     { name: "detail", type: "json" },
-    { name: "signature", type: "text" }
+    { name: "signature", type: "text" },
+    // The part of the site, e.g. the tenant (`audit.scope`).
+    { name: "scope", type: "text", index: true }
   ]
 };
 var emailDeliveriesCollection = {
@@ -635,7 +646,8 @@ var AuditLog = class {
     return this.cms.config.audit || {
       keep: DEFAULT_AUDIT_KEEP,
       values: true,
-      failedLogins: DEFAULT_FAILED_LOGINS
+      failedLogins: DEFAULT_FAILED_LOGINS,
+      scope: null
     };
   }
   /**
@@ -646,6 +658,7 @@ var AuditLog = class {
     if (!this.enabled) return;
     try {
       const context = auditContext.getStore();
+      const scope = this.scopeOf(entry.context ?? context?.context);
       const user = entry.user !== void 0 ? entry.user : context?.user ?? null;
       const apiKey = user?.apiKey;
       const row = {
@@ -660,7 +673,8 @@ var AuditLog = class {
         userAgent: context?.userAgent ? context.userAgent.slice(0, 200) : null,
         changes: entry.changes && entry.changes.length > 0 ? entry.changes : null,
         detail: apiKey ? { ...entry.detail, apiKey: apiKey.name ?? "" } : entry.detail ?? null,
-        createdAt: (/* @__PURE__ */ new Date()).toISOString()
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...scope ? { scope } : {}
       };
       row.signature = this.sign(row);
       row.updatedAt = row.createdAt;
@@ -676,7 +690,7 @@ var AuditLog = class {
    * A change to a document or global: what changed between `before` and `after`. Internal
    * collections (sessions, versions…) are not logged.
    */
-  async content(config, global2, action, after, before, user) {
+  async content(config, global2, action, after, before, user, context) {
     if (!this.enabled) return;
     if (!global2 && INTERNAL_COLLECTIONS.has(config.slug)) return;
     const doc = after ?? before;
@@ -692,7 +706,8 @@ var AuditLog = class {
       title,
       // A trusted call without a user keeps the request's (or is the system).
       ...user ? { user } : {},
-      changes: action === "delete" ? null : this.diff(config.fields, before ?? {}, after ?? {})
+      changes: action === "delete" ? null : this.diff(config.fields, before ?? {}, after ?? {}),
+      ...context && Object.keys(context).length > 0 ? { context } : {}
     });
   }
   /** Fields whose stored value changed. Hidden ones never (the password only as "changed"). */
@@ -837,8 +852,15 @@ var AuditLog = class {
     return out;
   }
   // -------------------------------------------------------------------------
+  /** The part of the site a context is in (`scope`), or `null`. */
+  scopeOf(context) {
+    const scope = this.settings.scope;
+    return (scope && context ? scope(context) : null) ?? null;
+  }
   sign(row) {
-    const payload = stable(SIGNED.map((key2) => row[key2] ?? null));
+    const values = SIGNED.map((key2) => row[key2] ?? null);
+    if (typeof row.scope === "string" && row.scope) values.push(row.scope);
+    const payload = stable(values);
     return createHmac("sha256", this.cms.config.secret).update(`audit:${payload}`).digest("base64url");
   }
   async lastVerification() {
@@ -866,6 +888,7 @@ var AuditLog = class {
     if (filter.actor) parts.push({ actorEmail: { like: filter.actor } });
     if (filter.from) parts.push({ createdAt: { gte: filter.from } });
     if (filter.to) parts.push({ createdAt: { lte: filter.to } });
+    if (filter.scope) parts.push({ scope: { equals: filter.scope } });
     return parts.length === 0 ? void 0 : parts.length === 1 ? parts[0] : { and: parts };
   }
 };
@@ -1137,6 +1160,7 @@ function sizeKey(filename, size) {
 var PRIVATE_KEY = /^[\p{L}\p{M}\p{N}-]+\.private(-[\p{L}\p{N}_-]+)?\.[a-z0-9]+$/u;
 
 // src/fields.ts
+var uniqueWithinOf = (field) => field.uniqueWithin === void 0 ? [] : [field.uniqueWithin].flat();
 var isHasMany = (field) => (field.type === "select" || field.type === "relationship" || field.type === "upload") && field.hasMany === true;
 function mimeAllowedBy(mimeType, patterns) {
   const type = mimeType.toLowerCase();
@@ -2890,7 +2914,7 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
           field: path,
           collection: target,
           id,
-          ...field.type === "relationship" && field.filterOptions ? { filterOptions: field.filterOptions } : {},
+          ...field.filterOptions ? { filterOptions: field.filterOptions } : {},
           ...field.type === "upload" && field.mimeTypes ? { mimeTypes: field.mimeTypes } : {},
           ...field.type === "upload" && field.folder && field.folderOnly ? { folderOnly: field.folder } : {}
         });
@@ -3376,7 +3400,8 @@ var MediaFolders = class {
         name: String(doc.name ?? ""),
         key: typeof doc.key === "string" && doc.key ? doc.key : null,
         private: doc.private === true,
-        permissions: permissions && typeof permissions === "object" && !Array.isArray(permissions) ? permissions : null
+        permissions: permissions && typeof permissions === "object" && !Array.isArray(permissions) ? permissions : null,
+        doc
       });
     }
     this.cache = { at: Date.now(), rows };
@@ -3446,18 +3471,15 @@ var MediaFolders = class {
     });
     return this.within(rows, [id]).map((f) => ({ id: f, private: this.privateIn(rows, f) }));
   }
-  /**
-   * The folder with this key (`folder: 'banners'` on upload fields), made at the top level when
-   * there is none yet.
-   */
-  async keyed(key2) {
-    const find = async () => [...(await this.rows()).values()].find((r) => r.key === key2);
+  async keyed(key2, scope = {}, create = true) {
+    const find = async () => [...(await this.rows()).values()].find((r) => r.key === key2 && inScope(r.doc, scope));
     let found = await find();
     if (!found) {
       this.invalidate();
       found = await find();
     }
     if (found) return found.id;
+    if (!create) return null;
     const now = (/* @__PURE__ */ new Date()).toISOString();
     try {
       const doc = await this.db.create({
@@ -3468,6 +3490,7 @@ var MediaFolders = class {
           parent: null,
           permissions: null,
           private: false,
+          ...scope,
           createdAt: now,
           updatedAt: now
         }
@@ -3482,10 +3505,10 @@ var MediaFolders = class {
     }
   }
   /** Whether a file in `folder` is in the folder with this key, or below it. */
-  async inKeyed(key2, folder) {
+  async inKeyed(key2, folder, scope = {}) {
     if (folder === null) return false;
     const rows = await this.rows();
-    const root = [...rows.values()].find((r) => r.key === key2);
+    const root = [...rows.values()].find((r) => r.key === key2 && inScope(r.doc, scope));
     return !!root && this.within(rows, [root.id]).some((id) => String(id) === String(folder));
   }
   /** The user's level in a folder (`null`: the top level). */
@@ -3610,6 +3633,11 @@ var MediaFolders = class {
     return this.rows();
   }
 };
+function inScope(row, scope) {
+  return Object.entries(scope).every(
+    ([name, value]) => value === null || value === void 0 ? row[name] === null || row[name] === void 0 : String(row[name]) === String(value)
+  );
+}
 
 // src/populate.ts
 var DEFAULT_DEPTH = 1;
@@ -4099,6 +4127,8 @@ var Roles = class {
   async canView(user, id) {
     if (isSystemAdmin(user)) return true;
     if (user.apiKey) return false;
+    if (id === "audit" && user.role === "admin" && user.scoped === true && this.config.audit !== false && typeof this.config.audit.scope === "function")
+      return true;
     if (!this.enabled) return id.startsWith("page:") || id.startsWith("widget:");
     return (await this.permissionsOf(user.role)).admin?.includes(id) ?? false;
   }
@@ -5528,17 +5558,20 @@ function validateField(field, path, siblings, collectionSlugs, add) {
     }
   }
   if (field.uniqueWithin !== void 0) {
-    const scope = siblings.get(field.uniqueWithin);
-    if (!field.unique && field.type !== "slug") {
+    if (!field.unique && field.type !== "slug")
       add(`${path}.uniqueWithin`, "needs `unique: true` (or a slug field)");
-    } else if (!scope || scope === field) {
-      add(`${path}.uniqueWithin`, `no sibling field named "${field.uniqueWithin}"`);
-    } else if (!["relationship", "select", "text", "number"].includes(scope.type) || "hasMany" in scope && scope.hasMany || scope.localized) {
-      add(
-        `${path}.uniqueWithin`,
-        `"${field.uniqueWithin}" must be a single, unlocalized relationship, select, text or number field`
-      );
-    }
+    else
+      for (const name of [field.uniqueWithin].flat()) {
+        const scope = siblings.get(name);
+        if (!scope || scope === field) {
+          add(`${path}.uniqueWithin`, `no sibling field named "${name}"`);
+        } else if (!["relationship", "select", "text", "number"].includes(scope.type) || "hasMany" in scope && scope.hasMany || scope.localized) {
+          add(
+            `${path}.uniqueWithin`,
+            `"${name}" must be a single, unlocalized relationship, select, text or number field`
+          );
+        }
+      }
   }
   switch (field.type) {
     case "text":
@@ -5914,7 +5947,8 @@ function resolveAudit(audit) {
   return {
     keep: audit.keep ?? DEFAULT_AUDIT_KEEP,
     values: audit.values !== false,
-    failedLogins: audit.failedLogins ?? DEFAULT_FAILED_LOGINS
+    failedLogins: audit.failedLogins ?? DEFAULT_FAILED_LOGINS,
+    scope: audit.scope ?? null
   };
 }
 
@@ -7809,7 +7843,8 @@ var EasyCMS = class {
       action,
       event === "delete" ? void 0 : doc,
       event === "create" ? void 0 : previous,
-      guard.user
+      guard.user,
+      guard.context
     );
   }
   /** Records a version after a save, when the collection or global keeps versions. */
@@ -7919,7 +7954,7 @@ var EasyCMS = class {
       await this.makeSlugsUnique(config, clean2, selfId);
       errors.push(...await this.checkUnique(config, clean2, selfId));
     }
-    errors.push(...await this.checkReferences(result.references));
+    errors.push(...await this.checkReferences(result.references, guard));
     if (errors.length === 0)
       errors.push(...await this.checkFilterOptions(result.references, selfId, guard));
     if (errors.length > 0) throw new ValidationError(config.slug, errors);
@@ -7949,7 +7984,11 @@ var EasyCMS = class {
   async makeSlugsUnique(config, data, selfId) {
     for (const field of config.fields) {
       if (field.type !== "slug") continue;
-      const scope = field.uniqueWithin === void 0 ? void 0 : { [field.uniqueWithin]: { equals: data[field.uniqueWithin] ?? null } };
+      const scope = field.uniqueWithin === void 0 ? void 0 : {
+        and: uniqueWithinOf(field).map((name) => ({
+          [name]: { equals: data[name] ?? null }
+        }))
+      };
       const unique = async (path, base) => {
         let candidate = base;
         for (let n = 2; await this.isTaken(config.slug, path, candidate, selfId, scope); n++) {
@@ -7980,7 +8019,11 @@ var EasyCMS = class {
         locale === this.config.localization?.defaultLocale ? field.name : `${field.name}.${locale}`,
         v
       ]) : [[field.name, field.name, value]];
-      const scope = field.uniqueWithin === void 0 ? void 0 : { [field.uniqueWithin]: { equals: data[field.uniqueWithin] ?? null } };
+      const scope = field.uniqueWithin === void 0 ? void 0 : {
+        and: uniqueWithinOf(field).map((name) => ({
+          [name]: { equals: data[name] ?? null }
+        }))
+      };
       for (const [path, errorField, v] of checks) {
         if (v === null || v === void 0) continue;
         if (await this.isTaken(config.slug, path, v, selfId, scope)) {
@@ -8000,6 +8043,46 @@ var EasyCMS = class {
     };
     return await this.db.count({ collection: collection2, where }) > 0;
   }
+  /**
+   * What folder keys are unique within for a call (`uniqueWithin` of the `key` field of media
+   * folders, e.g. the tenant): the value a folder made by this call would get from its hooks.
+   */
+  async folderScope(guard) {
+    return this.uniqueScope(MEDIA_FOLDERS, "key", guard);
+  }
+  /**
+   * Where a unique field's values must differ for a call (`uniqueWithin`, e.g. the tenant): the
+   * value a document created by this call would get there from its hooks, as `{ [field]: value }`;
+   * `{}` when the field is unique everywhere. For finding documents by such a field, e.g. a page
+   * by its path in the current tenant.
+   */
+  async uniqueScope(collection2, field, options = {}) {
+    const config = this.config.collections.find((c) => c.slug === collection2);
+    const target = config?.fields.find((f) => f.name === field);
+    const within = target ? uniqueWithinOf(target) : [];
+    if (!config || within.length === 0) return {};
+    const guard = {
+      enforce: false,
+      user: options.user ?? null,
+      context: options.context ?? NO_CONTEXT
+    };
+    const data = await this.transform(
+      config.hooks?.beforeValidate,
+      "data",
+      { ...this.hookArgs(config, guard), operation: "create" },
+      {}
+    ).catch(() => ({}));
+    return Object.fromEntries(within.map((name) => [name, data[name] ?? null]));
+  }
+  /**
+   * @internal The id of the media folder with this key (`folder` of upload fields), made when
+   * needed; `null` when the call has no scope to make it in (e.g. all tenants) and none exists.
+   */
+  async keyedFolder(key2, options = {}) {
+    const scope = await this.folderScope(guardOf(options));
+    const complete = Object.values(scope).every((v) => v !== null && v !== void 0);
+    return this.folders.keyed(key2, scope, complete);
+  }
   /** Each reference is one its relationship's `filterOptions` allow. */
   async checkFilterOptions(references2, selfId, guard) {
     const errors = [];
@@ -8025,7 +8108,7 @@ var EasyCMS = class {
     }
     return errors;
   }
-  async checkReferences(references2) {
+  async checkReferences(references2, guard) {
     const byCollection = /* @__PURE__ */ new Map();
     for (const ref of references2) {
       if (!this.config.collections.some((c) => c.slug === ref.collection)) continue;
@@ -8054,7 +8137,8 @@ var EasyCMS = class {
         }
         if (ref.folderOnly && this.folders.enabled && !await this.folders.inKeyed(
           ref.folderOnly,
-          doc.folder ?? null
+          doc.folder ?? null,
+          await this.folderScope(guard)
         ))
           errors.push({
             field: ref.field,
@@ -8400,7 +8484,7 @@ function componentRef(component) {
 async function allowed(access, user, context) {
   return await evaluateAccess(access, { user, context }) !== false;
 }
-async function serializeFields(fields, checks, localized, folderId) {
+async function serializeFields(fields, checks, localized, folderId, who) {
   const { update: update2 } = checks;
   const out = [];
   for (const field of fields) {
@@ -8410,6 +8494,13 @@ async function serializeFields(fields, checks, localized, folderId) {
     if (field.required) f.required = true;
     if (field.unique) f.unique = true;
     if (field.defaultValue !== void 0) f.defaultValue = field.defaultValue;
+    if (field.admin?.defaultValue) {
+      const value = await field.admin.defaultValue(who);
+      if (value !== void 0) f.defaultValue = value;
+    }
+    const column = field.admin?.column;
+    if (column === true || typeof column === "function" && await column(who)) f.column = true;
+    if (field.admin?.allowCreate === false) f.noCreate = true;
     if (!await update2.allows(field)) f.readOnly = true;
     if (field.localized && localized) f.localized = true;
     if (field.position === "sidebar") f.position = "sidebar";
@@ -8450,16 +8541,19 @@ async function serializeFields(fields, checks, localized, folderId) {
       case "upload":
         f.to = "media";
         if (field.hasMany) f.hasMany = true;
+        if (field.filterOptions) f.filtered = true;
         if (field.minRows !== void 0) f.minRows = field.minRows;
         if (field.maxRows !== void 0) f.maxRows = field.maxRows;
         if (field.mimeTypes) f.mimeTypes = expandMimeTypes(field.mimeTypes);
-        if (field.folder && folderId)
-          f.folder = { id: await folderId(field.folder), only: field.folderOnly === true };
+        if (field.folder && folderId) {
+          const id = await folderId(field.folder);
+          if (id !== null) f.folder = { id, only: field.folderOnly === true };
+        }
         break;
       case "array":
         if (field.minRows !== void 0) f.minRows = field.minRows;
         if (field.maxRows !== void 0) f.maxRows = field.maxRows;
-        f.fields = await serializeFields(field.fields, checks, localized, folderId);
+        f.fields = await serializeFields(field.fields, checks, localized, folderId, who);
         break;
       case "blocks":
         if (field.minRows !== void 0) f.minRows = field.minRows;
@@ -8468,12 +8562,12 @@ async function serializeFields(fields, checks, localized, folderId) {
           field.blocks.map(async (block) => ({
             slug: block.slug,
             ...block.labels ? { labels: block.labels } : {},
-            fields: await serializeFields(block.fields, checks, localized, folderId)
+            fields: await serializeFields(block.fields, checks, localized, folderId, who)
           }))
         );
         break;
       case "group":
-        f.fields = await serializeFields(field.fields, checks, localized, folderId);
+        f.fields = await serializeFields(field.fields, checks, localized, folderId, who);
         break;
     }
     out.push(f);
@@ -8496,7 +8590,8 @@ async function collection(cms, config, user, localized, roles, context) {
     config.fields,
     await checkers(cms, user, context),
     localized,
-    folderIds(cms)
+    folderIds(cms, user, context),
+    { user, context }
   );
   if (config.slug === USERS && cms.roles.enabled) {
     const role = fields.find((f) => f.name === "role");
@@ -8527,6 +8622,7 @@ async function collection(cms, config, user, localized, roles, context) {
   if (config.admin?.group === "settings" || SETTINGS.has(config.slug)) result.group = "settings";
   if (config.admin?.list?.tree) result.tree = config.admin.list.tree;
   if (config.admin?.list?.sort) result.defaultSort = config.admin.list.sort;
+  if (config.admin?.confirmDelete) result.confirmDelete = { ...config.admin.confirmDelete };
   const owner = cms.roles.ownerOf(config.slug);
   if (owner && fields.some((f) => f.name === owner)) result.owner = owner;
   if (config.editIn === "drawer" && !result.drafts && !result.versions && !result.preview)
@@ -8542,7 +8638,10 @@ async function global(cms, config, user, localized, context) {
     versions: Boolean(config.versions),
     preview: typeof config.preview === "function",
     schedule: config.schedule === true,
-    fields: await serializeFields(config.fields, checks, localized, folderIds(cms)),
+    fields: await serializeFields(config.fields, checks, localized, folderIds(cms, user, context), {
+      user,
+      context
+    }),
     permissions: {
       read: await may(cms, config.access?.read, user, target, "read", context),
       update: await may(cms, config.access?.update, user, target, "update", context),
@@ -8643,12 +8742,12 @@ async function widgets(cms, user) {
   }
   return out;
 }
-function folderIds(cms) {
-  return cms.folders.enabled ? (key2) => cms.folders.keyed(key2) : void 0;
+function folderIds(cms, user, context) {
+  return cms.folders.enabled ? (key2) => cms.keyedFolder(key2, { user, context }) : void 0;
 }
 
 // src/version.ts
-var VERSION = true ? "0.44.0" : "0.0.0-dev";
+var VERSION = true ? "0.45.0" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
 var DAY2 = 864e5;
@@ -8745,7 +8844,8 @@ async function pickerFilter(cms, url, target, user, context = {}) {
   const slug2 = dot > 0 ? spec.slice(0, dot) : "";
   const owner = forCollection !== null ? cms.config.collections.find((c) => c.slug === slug2) : cms.config.globals.find((g) => g.slug === slug2);
   const field = owner ? fieldAt(owner.fields, spec.slice(dot + 1)) : void 0;
-  if (field?.type !== "relationship" || field.to !== target)
+  const to = field?.type === "upload" ? "media" : field?.type === "relationship" ? field.to : null;
+  if (!field || field.type !== "relationship" && field.type !== "upload" || to !== target)
     throw new QueryError(`filterFor: no relationship to "${target}" at "${spec}"`);
   if (!field.filterOptions) return void 0;
   const rawId = url.searchParams.get("filterId");
@@ -8927,6 +9027,7 @@ async function respond(cms, request, url, path, root, options, production) {
     if (method !== "GET" && method !== "HEAD") checkCsrf(cms, ctx);
     const audit = {
       user,
+      context,
       ip: options.getClientIp?.(request),
       userAgent: request.headers.get("user-agent")
     };
@@ -9199,8 +9300,11 @@ async function route(cms, ctx, method, segments, options) {
       doc: q.get("doc"),
       actor: q.get("actor"),
       from: q.get("from"),
-      to: q.get("to")
+      to: q.get("to"),
+      // Users of a part of the site (e.g. one tenant) see its entries; others the chosen part's.
+      scope: cms.audit.scopeOf(ctx.context)
     };
+    if (ctx.user.scoped && !filter.scope) throw new ForbiddenError();
     if (second === "audit.csv" && third === void 0) {
       if (method !== "GET") throw methodNotAllowed(ctx, "GET");
       return {
@@ -10255,6 +10359,7 @@ export {
   singularize,
   slugify,
   sniffMimeType,
+  uniqueWithinOf,
   validateConfig,
   validateFields,
   verifyPassword,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",