@easy-cms/core 0.44.0 → 0.46.0

package/dist/index.js

@@ -1,7 +1,8 @@
 // src/access.ts
 var isSystemAdmin = (user) => user?.role === "admin" && !user.apiKey && user.scoped !== true;
 var anyone = () => true;
-var isLoggedIn = ({ user }) => user !== null;
+var isLoggedIn = ({ user }) => user !== null && user.member !== true;
+var isSignedIn = ({ user }) => user !== null;
 var isAdmin = ({ user }) => user?.role === "admin";
 
 // src/api-keys.ts
@@ -192,7 +193,12 @@ var adminOrSelf = ({ user }) => {
 var adminOnly = {
   update: ({ user }) => isSystemAdmin(user)
 };
-function userFields(roles, rbac) {
+var staffOrSelf = ({ user }) => {
+  if (!user) return false;
+  if (user.member !== true) return true;
+  return { id: { equals: user.id } };
+};
+function userFields(roles, rbac, members) {
   const defaultRole = roles.includes("editor") ? "editor" : roles[roles.length - 1];
   return [
     {
@@ -227,6 +233,16 @@ function userFields(roles, rbac) {
       access: adminOnly,
       label: { en: "Active", th: "\u0E43\u0E0A\u0E49\u0E07\u0E32\u0E19" }
     },
+    // Accounts made by signing up (`auth.members.signup`) are `false` until the email is confirmed.
+    ...members ? [
+      {
+        name: "emailVerified",
+        type: "boolean",
+        access: adminOnly,
+        position: "sidebar",
+        label: { en: "Email confirmed", th: "\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E41\u0E25\u0E49\u0E27" }
+      }
+    ] : [],
     { name: "passwordHash", type: "text", hidden: true }
   ];
 }
@@ -239,9 +255,12 @@ function withUsers(config) {
     useAsTitle: "email",
     icon: "users",
     ...custom,
-    fields: [...userFields(roles, config.auth?.rbac === true), ...custom?.fields ?? []],
+    fields: [
+      ...userFields(roles, config.auth?.rbac === true, config.auth?.members?.signup !== void 0),
+      ...custom?.fields ?? []
+    ],
     access: {
-      read: isLoggedIn,
+      read: staffOrSelf,
       create: ({ user }) => isSystemAdmin(user),
       update: adminOrSelf,
       delete: ({ user }) => isSystemAdmin(user),
@@ -427,7 +446,16 @@ function withMedia(config) {
   const customFolders = config.collections?.find((c) => c.slug === MEDIA_FOLDERS);
   const mediaFolders = customFolders ? {
     ...mediaFoldersCollection,
-    fields: [...mediaFoldersCollection.fields, ...customFolders.fields],
+    // A field named like a built-in one changes it (e.g. `key` unique per tenant).
+    fields: [
+      ...mediaFoldersCollection.fields.map((field) => {
+        const own = customFolders.fields.find((f) => f.name === field.name);
+        return own ? { ...field, ...own } : field;
+      }),
+      ...customFolders.fields.filter(
+        (f) => !mediaFoldersCollection.fields.some((b) => b.name === f.name)
+      )
+    ],
     access: { ...mediaFoldersCollection.access, ...customFolders.access },
     hooks: {
       ...customFolders.hooks,
@@ -562,7 +590,9 @@ var auditLogsCollection = {
     { name: "userAgent", type: "text" },
     { name: "changes", type: "json" },
     { name: "detail", type: "json" },
-    { name: "signature", type: "text" }
+    { name: "signature", type: "text" },
+    // The part of the site, e.g. the tenant (`audit.scope`).
+    { name: "scope", type: "text", index: true }
   ]
 };
 var emailDeliveriesCollection = {
@@ -635,7 +665,8 @@ var AuditLog = class {
     return this.cms.config.audit || {
       keep: DEFAULT_AUDIT_KEEP,
       values: true,
-      failedLogins: DEFAULT_FAILED_LOGINS
+      failedLogins: DEFAULT_FAILED_LOGINS,
+      scope: null
     };
   }
   /**
@@ -646,6 +677,7 @@ var AuditLog = class {
     if (!this.enabled) return;
     try {
       const context = auditContext.getStore();
+      const scope = this.scopeOf(entry.context ?? context?.context);
       const user = entry.user !== void 0 ? entry.user : context?.user ?? null;
       const apiKey = user?.apiKey;
       const row = {
@@ -660,7 +692,8 @@ var AuditLog = class {
         userAgent: context?.userAgent ? context.userAgent.slice(0, 200) : null,
         changes: entry.changes && entry.changes.length > 0 ? entry.changes : null,
         detail: apiKey ? { ...entry.detail, apiKey: apiKey.name ?? "" } : entry.detail ?? null,
-        createdAt: (/* @__PURE__ */ new Date()).toISOString()
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...scope ? { scope } : {}
       };
       row.signature = this.sign(row);
       row.updatedAt = row.createdAt;
@@ -676,7 +709,7 @@ var AuditLog = class {
    * A change to a document or global: what changed between `before` and `after`. Internal
    * collections (sessions, versions…) are not logged.
    */
-  async content(config, global2, action, after, before, user) {
+  async content(config, global2, action, after, before, user, context) {
     if (!this.enabled) return;
     if (!global2 && INTERNAL_COLLECTIONS.has(config.slug)) return;
     const doc = after ?? before;
@@ -692,7 +725,8 @@ var AuditLog = class {
       title,
       // A trusted call without a user keeps the request's (or is the system).
       ...user ? { user } : {},
-      changes: action === "delete" ? null : this.diff(config.fields, before ?? {}, after ?? {})
+      changes: action === "delete" ? null : this.diff(config.fields, before ?? {}, after ?? {}),
+      ...context && Object.keys(context).length > 0 ? { context } : {}
     });
   }
   /** Fields whose stored value changed. Hidden ones never (the password only as "changed"). */
@@ -837,8 +871,15 @@ var AuditLog = class {
     return out;
   }
   // -------------------------------------------------------------------------
+  /** The part of the site a context is in (`scope`), or `null`. */
+  scopeOf(context) {
+    const scope = this.settings.scope;
+    return (scope && context ? scope(context) : null) ?? null;
+  }
   sign(row) {
-    const payload = stable(SIGNED.map((key2) => row[key2] ?? null));
+    const values = SIGNED.map((key2) => row[key2] ?? null);
+    if (typeof row.scope === "string" && row.scope) values.push(row.scope);
+    const payload = stable(values);
     return createHmac("sha256", this.cms.config.secret).update(`audit:${payload}`).digest("base64url");
   }
   async lastVerification() {
@@ -866,6 +907,7 @@ var AuditLog = class {
     if (filter.actor) parts.push({ actorEmail: { like: filter.actor } });
     if (filter.from) parts.push({ createdAt: { gte: filter.from } });
     if (filter.to) parts.push({ createdAt: { lte: filter.to } });
+    if (filter.scope) parts.push({ scope: { equals: filter.scope } });
     return parts.length === 0 ? void 0 : parts.length === 1 ? parts[0] : { and: parts };
   }
 };
@@ -1137,6 +1179,7 @@ function sizeKey(filename, size) {
 var PRIVATE_KEY = /^[\p{L}\p{M}\p{N}-]+\.private(-[\p{L}\p{N}_-]+)?\.[a-z0-9]+$/u;
 
 // src/fields.ts
+var uniqueWithinOf = (field) => field.uniqueWithin === void 0 ? [] : [field.uniqueWithin].flat();
 var isHasMany = (field) => (field.type === "select" || field.type === "relationship" || field.type === "upload") && field.hasMany === true;
 function mimeAllowedBy(mimeType, patterns) {
   const type = mimeType.toLowerCase();
@@ -1249,6 +1292,48 @@ async function filterInput(fields, data, update2) {
   return result;
 }
 
+// src/spam.ts
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var MAX_AGE = 24 * 36e5;
+var sign = (secret, value) => createHmac2("sha256", secret).update(value).digest("base64url");
+function formToken(secret, purpose, now = Date.now()) {
+  return `${now}.${sign(secret, `${purpose}:${now}`)}`;
+}
+function checkFormToken(secret, purpose, token, minTime, now = Date.now()) {
+  if (typeof token !== "string") return "invalid";
+  const [time, signature] = token.split(".");
+  const issued = Number(time);
+  if (!Number.isFinite(issued) || !signature) return "invalid";
+  const expected = Buffer.from(sign(secret, `${purpose}:${issued}`));
+  const given = Buffer.from(signature);
+  if (expected.length !== given.length || !timingSafeEqual2(expected, given)) return "invalid";
+  if (now - issued < minTime) return "too-fast";
+  if (now - issued > MAX_AGE) return "expired";
+  return "ok";
+}
+function rateKeys(secret, subject, window, now = Date.now()) {
+  const bucket = Math.floor(now / (window * 1e3));
+  const key2 = (b) => sign(secret, `${subject}:${b}`).slice(0, 32);
+  return { current: key2(bucket), previous: key2(bucket - 1) };
+}
+function honeypotName(names2) {
+  return ["website", "homepage", "url_address"].find((n) => !names2.includes(n)) ?? "hp_field";
+}
+async function verifyTurnstile(secretKey, response, ip, fetcher = fetch) {
+  if (typeof response !== "string" || !response) return false;
+  const body = new URLSearchParams({ secret: secretKey, response, ...ip ? { remoteip: ip } : {} });
+  try {
+    const result = await fetcher("https://challenges.cloudflare.com/turnstile/v0/siteverify", {
+      method: "POST",
+      body,
+      signal: AbortSignal.timeout(1e4)
+    });
+    return (await result.json()).success === true;
+  } catch {
+    return false;
+  }
+}
+
 // src/auth/cookie.ts
 var SESSION_COOKIE = "ecms-session";
 
@@ -1265,6 +1350,21 @@ function email(subject, lines, button) {
 var hours = (expiresAt) => Math.max(1, Math.round(((expiresAt?.getTime() ?? Date.now()) - Date.now()) / 36e5));
 var days = (expiresAt) => Math.max(1, Math.round(hours(expiresAt) / 24));
 var DEFAULT_PASSWORD_EMAILS = {
+  verifyEmail: ({ url = "", locale, expiresAt }) => locale === "th" ? email(
+    "\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E02\u0E2D\u0E07\u0E04\u0E38\u0E13",
+    [
+      "\u0E02\u0E2D\u0E1A\u0E04\u0E38\u0E13\u0E17\u0E35\u0E48\u0E2A\u0E21\u0E31\u0E04\u0E23\u0E2A\u0E21\u0E32\u0E0A\u0E34\u0E01 \u0E01\u0E14\u0E1B\u0E38\u0E48\u0E21\u0E14\u0E49\u0E32\u0E19\u0E25\u0E48\u0E32\u0E07\u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E41\u0E25\u0E30\u0E40\u0E02\u0E49\u0E32\u0E2A\u0E39\u0E48\u0E23\u0E30\u0E1A\u0E1A",
+      `\u0E25\u0E34\u0E07\u0E01\u0E4C\u0E19\u0E35\u0E49\u0E43\u0E0A\u0E49\u0E44\u0E14\u0E49\u0E20\u0E32\u0E22\u0E43\u0E19 ${days(expiresAt)} \u0E27\u0E31\u0E19 \u0E16\u0E49\u0E32\u0E04\u0E38\u0E13\u0E44\u0E21\u0E48\u0E44\u0E14\u0E49\u0E2A\u0E21\u0E31\u0E04\u0E23 \u0E44\u0E21\u0E48\u0E15\u0E49\u0E2D\u0E07\u0E17\u0E33\u0E2D\u0E30\u0E44\u0E23`
+    ],
+    { label: "\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E2D\u0E35\u0E40\u0E21\u0E25", url }
+  ) : email(
+    "Confirm your email",
+    [
+      "Thanks for signing up. Confirm your email to sign in.",
+      `The link works within ${days(expiresAt)} day(s). If you didn't sign up, ignore this email.`
+    ],
+    { label: "Confirm email", url }
+  ),
   resetPassword: ({ url = "", locale, expiresAt }) => locale === "th" ? email(
     "\u0E15\u0E31\u0E49\u0E07\u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E48\u0E32\u0E19\u0E43\u0E2B\u0E21\u0E48",
     [
@@ -1315,7 +1415,7 @@ var DEFAULT_PASSWORD_EMAILS = {
 };
 
 // src/auth/password.ts
-import { randomBytes as randomBytes2, scrypt, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { randomBytes as randomBytes2, scrypt, timingSafeEqual as timingSafeEqual3 } from "crypto";
 var MIN_PASSWORD_LENGTH = 8;
 var N = 2 ** 17;
 var R = 8;
@@ -1350,7 +1450,7 @@ async function verifyPassword(password, stored) {
     Number(p),
     expected.length
   );
-  return key2.length === expected.length && timingSafeEqual2(key2, expected);
+  return key2.length === expected.length && timingSafeEqual3(key2, expected);
 }
 var dummyHash;
 async function fakeVerify(password) {
@@ -1360,10 +1460,10 @@ async function fakeVerify(password) {
 }
 
 // src/auth/sso.ts
-import { createHmac as createHmac3, randomBytes as randomBytes4 } from "crypto";
+import { createHmac as createHmac4, randomBytes as randomBytes4 } from "crypto";
 
 // src/auth/tokens.ts
-import { createHash as createHash2, createHmac as createHmac2, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHash as createHash2, createHmac as createHmac3, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual4 } from "crypto";
 function newToken() {
   return randomBytes3(32).toString("base64url");
 }
@@ -1371,7 +1471,7 @@ function hashToken(token) {
   return createHash2("sha256").update(token).digest("hex");
 }
 function hmac(secret, value) {
-  return createHmac2("sha256", secret).update(value).digest("base64url");
+  return createHmac3("sha256", secret).update(value).digest("base64url");
 }
 function signToken(secret, token) {
   return `${token}.${hmac(secret, `session:${token}`)}`;
@@ -1388,7 +1488,7 @@ function csrfToken(secret, token) {
 function safeEqual(a, b) {
   const left = Buffer.from(a);
   const right = Buffer.from(b);
-  return left.length === right.length && timingSafeEqual3(left, right);
+  return left.length === right.length && timingSafeEqual4(left, right);
 }
 function signPreviewToken(secret, target, expiresAt) {
   const payload = Buffer.from(
@@ -1430,7 +1530,7 @@ function readPasswordToken(token) {
   try {
     const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
     if (typeof data.u !== "string" || typeof data.e !== "number") return null;
-    if (data.p !== "reset" && data.p !== "invite") return null;
+    if (data.p !== "reset" && data.p !== "invite" && data.p !== "verify") return null;
     return { userId: data.u, purpose: data.p, expiresAt: data.e, payload };
   } catch {
     return null;
@@ -1447,19 +1547,19 @@ function passwordTokenMatches(secret, token, fingerprint) {
 var SSO_COOKIE = "ecms-sso";
 var PENDING_TTL = 10 * 6e4;
 var random = () => randomBytes4(32).toString("base64url");
-function sign(secret, payload) {
-  return createHmac3("sha256", secret).update(`sso:${payload}`).digest("base64url");
+function sign2(secret, payload) {
+  return createHmac4("sha256", secret).update(`sso:${payload}`).digest("base64url");
 }
 function seal(secret, pending) {
   const payload = Buffer.from(JSON.stringify(pending)).toString("base64url");
-  return `${payload}.${sign(secret, payload)}`;
+  return `${payload}.${sign2(secret, payload)}`;
 }
 function unseal(secret, value) {
   if (!value) return null;
   const dot = value.lastIndexOf(".");
   if (dot <= 0) return null;
   const payload = value.slice(0, dot);
-  if (!safeEqual(value.slice(dot + 1), sign(secret, payload))) return null;
+  if (!safeEqual(value.slice(dot + 1), sign2(secret, payload))) return null;
   try {
     const pending = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
     return typeof pending.e === "number" && pending.e > Date.now() ? pending : null;
@@ -1737,6 +1837,16 @@ var SingleSignOn = class {
 
 // src/auth/auth.ts
 var INVALID = "Invalid email or password";
+var SIGNUP_FORM = "easy-cms-signup";
+var SIGNUP_MIN_TIME = 2e3;
+var SIGNUP_HONEYPOT = "website";
+function asMember(user, memberRoles) {
+  const member = memberRoles.includes(String(user.role));
+  if (member === (user.member === true)) return user;
+  if (member) return { ...user, member: true };
+  const { member: _member, ...rest } = user;
+  return rest;
+}
 var RESET_REQUESTS = 3;
 var Auth = class {
   constructor(cms) {
@@ -1786,6 +1896,16 @@ var Auth = class {
       throw new UnauthorizedError(INVALID);
     }
     await this.clearFailures(key2);
+    if (user.emailVerified === false) {
+      await this.cms.audit.record({
+        action: "login.failed",
+        target: "auth",
+        user: null,
+        email: email2,
+        detail: { reason: "email not confirmed" }
+      });
+      throw new UnauthorizedError("Confirm your email first: follow the link we sent you");
+    }
     if (!this.sso.passwordAllowed(user)) {
       await this.cms.audit.record({
         action: "login.failed",
@@ -1828,6 +1948,136 @@ var Auth = class {
     const raw = await this.db.findById({ collection: USERS, id: user.id });
     return this.startSession(raw);
   }
+  // --- Members signing up (`auth.members.signup`) ---------------------------------------------
+  /** What a sign-up form needs: a token proving when it was loaded, and Turnstile's site key. */
+  signupForm() {
+    const signup = this.config.auth.members.signup;
+    if (!signup) throw new NotFoundError(USERS, "signup");
+    return {
+      token: formToken(this.config.secret, SIGNUP_FORM),
+      turnstile: signup.turnstile?.siteKey ?? null,
+      verifyEmail: signup.verifyEmail !== false
+    };
+  }
+  /**
+   * Creates a member's account (`auth.members.signup`). With `verifyEmail` (the default), emails
+   * a link to confirm the address and answers the same whether or not the email has an account;
+   * otherwise starts a session. Throws `ValidationError` for spam checks and bad input.
+   */
+  async signup(args) {
+    const signup = this.config.auth.members.signup;
+    if (!signup) throw new NotFoundError(USERS, "signup");
+    const key2 = `signup|${args.ip ?? ""}`;
+    await this.checkRateLimit(key2);
+    const refuse = (field, message2) => new ValidationError(USERS, [{ field, message: message2 }]);
+    if (typeof args.honeypot === "string" && args.honeypot !== "") {
+      await this.recordFailure(key2);
+      throw refuse("form", "could not be sent");
+    }
+    const checked = checkFormToken(this.config.secret, SIGNUP_FORM, args.token, SIGNUP_MIN_TIME);
+    if (checked !== "ok")
+      throw refuse(
+        "form",
+        checked === "expired" ? "was open too long: reload the page" : "could not be sent"
+      );
+    if (signup.turnstile && !await verifyTurnstile(signup.turnstile.secretKey, args.turnstile, args.ip))
+      throw refuse("turnstile", "is not complete");
+    await this.recordFailure(key2);
+    const email2 = typeof args.email === "string" ? args.email.trim().toLowerCase() : "";
+    const verify = signup.verifyEmail !== false;
+    if (verify && !this.canSendPasswordLinks(args.origin))
+      throw new QueryError("Signing up needs `email` in the config, and a site URL in production");
+    const existing = email2 ? await this.findByEmail(email2) : void 0;
+    if (existing && verify) {
+      if (existing.emailVerified === false && existing.active !== false)
+        await this.mailVerifyLink(existing, args);
+      return { verify: true };
+    }
+    const created = await this.cms.create(
+      USERS,
+      {
+        email: email2,
+        password: args.password,
+        role: signup.role,
+        active: true,
+        emailVerified: !verify,
+        ...typeof args.name === "string" && args.name.trim() ? { name: args.name.trim() } : {}
+      },
+      { context: args.context ?? {} }
+    );
+    const user = await this.db.findById({ collection: USERS, id: created.id });
+    await this.cms.audit.record({
+      action: "signup",
+      target: "auth",
+      user: await this.toAuthUser(user)
+    });
+    if (verify) {
+      await this.mailVerifyLink(user, args);
+      return { verify: true };
+    }
+    return { ...await this.startSession(user), verify: false };
+  }
+  /** Confirms a member's email from the link, and signs them in. */
+  async verifyEmail(args) {
+    const key2 = `verify-token|${args.ip ?? ""}`;
+    await this.checkRateLimit(key2);
+    const token = String(args.token ?? "");
+    const claims = readPasswordToken(token);
+    const id = claims && (/^\d+$/.test(claims.userId) ? Number(claims.userId) : claims.userId);
+    const user = claims && claims.purpose === "verify" && claims.expiresAt > Date.now() && id !== null ? await this.db.findById({ collection: USERS, id }) : null;
+    if (!user || user.active === false || !passwordTokenMatches(this.config.secret, token, passwordFingerprint(user.passwordHash))) {
+      await this.recordFailure(key2);
+      throw new ValidationError(USERS, [
+        { field: "token", message: "This link has expired or is not valid" }
+      ]);
+    }
+    await this.clearFailures(key2);
+    if (user.emailVerified === false) {
+      const { id: _id, ...rest } = user;
+      await this.db.update({
+        collection: USERS,
+        id: user.id,
+        data: { ...rest, emailVerified: true }
+      });
+    }
+    const session = await this.startSession(
+      await this.db.findById({ collection: USERS, id: user.id })
+    );
+    await this.cms.audit.record({ action: "email.verified", target: "auth", user: session.user });
+    return session;
+  }
+  async mailVerifyLink(user, options) {
+    const expiresAt = Date.now() + this.config.auth.inviteExpiration * 1e3;
+    const token = signPasswordToken(this.config.secret, {
+      userId: String(user.id),
+      purpose: "verify",
+      expiresAt,
+      fingerprint: passwordFingerprint(user.passwordHash)
+    });
+    const url = this.memberLink("verifyEmail", token, options.origin);
+    const write = this.config.auth.members.emails?.verifyEmail ?? DEFAULT_PASSWORD_EMAILS.verifyEmail;
+    const content = await write({
+      user: await this.toAuthUser(user),
+      url,
+      locale: this.localeOf(options.locale),
+      expiresAt: new Date(expiresAt)
+    });
+    await this.cms.sendEmail({ to: String(user.email), ...content });
+  }
+  /**
+   * A link to one of the site's pages for members (`auth.members.pages`), else to the admin's
+   * page of the same purpose.
+   */
+  memberLink(page, token, origin) {
+    const target = this.config.auth.members.pages?.[page];
+    const query = `token=${encodeURIComponent(token)}`;
+    if (target && /^https?:\/\//.test(target))
+      return `${target}${target.includes("?") ? "&" : "?"}${query}`;
+    const site = (this.config.admin.siteUrl || "").replace(/\/+$/, "");
+    const base = site || this.passwordLinkBase(origin);
+    const path = target ?? `${this.config.admin.path}/${page === "verifyEmail" ? "verify-email" : "reset-password"}`;
+    return `${base}${path.startsWith("/") ? "" : "/"}${path}${path.includes("?") ? "&" : "?"}${query}`;
+  }
   async hasUsers() {
     return await this.db.count({ collection: USERS }) > 0;
   }
@@ -2000,7 +2250,7 @@ var Auth = class {
   }
   async passwordTokenUser(token) {
     const claims = readPasswordToken(token);
-    if (!claims || claims.expiresAt <= Date.now()) return null;
+    if (!claims || claims.purpose === "verify" || claims.expiresAt <= Date.now()) return null;
     const id = /^\d+$/.test(claims.userId) ? Number(claims.userId) : claims.userId;
     const user = await this.db.findById({ collection: USERS, id });
     if (!user || user.active === false || !this.sso.passwordAllowed(user)) return null;
@@ -2019,7 +2269,8 @@ var Auth = class {
       fingerprint: passwordFingerprint(user.passwordHash)
     });
     const sso = this.sso.passwordAllowed(user) ? void 0 : this.config.auth.providers.map((p) => p.name);
-    const url = sso ? `${base}${this.config.admin.path}/login` : `${base}${this.config.admin.path}/reset-password?token=${encodeURIComponent(token)}`;
+    const member = this.config.auth.members.roles.includes(String(user.role));
+    const url = sso ? `${base}${this.config.admin.path}/login` : member ? this.memberLink("resetPassword", token, options.origin) : `${base}${this.config.admin.path}/reset-password?token=${encodeURIComponent(token)}`;
     const write = purpose === "invite" ? this.config.auth.emails.invite ?? DEFAULT_PASSWORD_EMAILS.invite : this.config.auth.emails.resetPassword ?? DEFAULT_PASSWORD_EMAILS.resetPassword;
     const content = await write({
       user: await this.toAuthUser(user),
@@ -2112,7 +2363,8 @@ var Auth = class {
   }
   async toAuthUser(user) {
     const fields = this.cms.collection(USERS).fields;
-    return await stripFields(fields, user);
+    const stripped = await stripFields(fields, user);
+    return asMember(stripped, this.config.auth.members.roles);
   }
   async deleteExpiredSessions(userId) {
     const expired = await this.db.find({
@@ -2890,7 +3142,7 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
           field: path,
           collection: target,
           id,
-          ...field.type === "relationship" && field.filterOptions ? { filterOptions: field.filterOptions } : {},
+          ...field.filterOptions ? { filterOptions: field.filterOptions } : {},
           ...field.type === "upload" && field.mimeTypes ? { mimeTypes: field.mimeTypes } : {},
           ...field.type === "upload" && field.folder && field.folderOnly ? { folderOnly: field.folder } : {}
         });
@@ -3221,7 +3473,7 @@ function applyFieldTypes(config) {
 }
 
 // src/local-api.ts
-import { createHmac as createHmac5, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual4 } from "crypto";
+import { createHmac as createHmac6, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual5 } from "crypto";
 
 // src/localization.ts
 var ALL_LOCALES = "all";
@@ -3376,7 +3628,8 @@ var MediaFolders = class {
         name: String(doc.name ?? ""),
         key: typeof doc.key === "string" && doc.key ? doc.key : null,
         private: doc.private === true,
-        permissions: permissions && typeof permissions === "object" && !Array.isArray(permissions) ? permissions : null
+        permissions: permissions && typeof permissions === "object" && !Array.isArray(permissions) ? permissions : null,
+        doc
       });
     }
     this.cache = { at: Date.now(), rows };
@@ -3446,18 +3699,15 @@ var MediaFolders = class {
     });
     return this.within(rows, [id]).map((f) => ({ id: f, private: this.privateIn(rows, f) }));
   }
-  /**
-   * The folder with this key (`folder: 'banners'` on upload fields), made at the top level when
-   * there is none yet.
-   */
-  async keyed(key2) {
-    const find = async () => [...(await this.rows()).values()].find((r) => r.key === key2);
+  async keyed(key2, scope = {}, create = true) {
+    const find = async () => [...(await this.rows()).values()].find((r) => r.key === key2 && inScope(r.doc, scope));
     let found = await find();
     if (!found) {
       this.invalidate();
       found = await find();
     }
     if (found) return found.id;
+    if (!create) return null;
     const now = (/* @__PURE__ */ new Date()).toISOString();
     try {
       const doc = await this.db.create({
@@ -3468,6 +3718,7 @@ var MediaFolders = class {
           parent: null,
           permissions: null,
           private: false,
+          ...scope,
           createdAt: now,
           updatedAt: now
         }
@@ -3482,10 +3733,10 @@ var MediaFolders = class {
     }
   }
   /** Whether a file in `folder` is in the folder with this key, or below it. */
-  async inKeyed(key2, folder) {
+  async inKeyed(key2, folder, scope = {}) {
     if (folder === null) return false;
     const rows = await this.rows();
-    const root = [...rows.values()].find((r) => r.key === key2);
+    const root = [...rows.values()].find((r) => r.key === key2 && inScope(r.doc, scope));
     return !!root && this.within(rows, [root.id]).some((id) => String(id) === String(folder));
   }
   /** The user's level in a folder (`null`: the top level). */
@@ -3610,6 +3861,11 @@ var MediaFolders = class {
     return this.rows();
   }
 };
+function inScope(row, scope) {
+  return Object.entries(scope).every(
+    ([name, value]) => value === null || value === void 0 ? row[name] === null || row[name] === void 0 : String(row[name]) === String(value)
+  );
+}
 
 // src/populate.ts
 var DEFAULT_DEPTH = 1;
@@ -4099,6 +4355,8 @@ var Roles = class {
   async canView(user, id) {
     if (isSystemAdmin(user)) return true;
     if (user.apiKey) return false;
+    if (id === "audit" && user.role === "admin" && user.scoped === true && this.config.audit !== false && typeof this.config.audit.scope === "function")
+      return true;
     if (!this.enabled) return id.startsWith("page:") || id.startsWith("widget:");
     return (await this.permissionsOf(user.role)).admin?.includes(id) ?? false;
   }
@@ -4580,7 +4838,7 @@ function rank(role, config) {
 }
 
 // src/webhooks.ts
-import { createHmac as createHmac4, randomUUID as randomUUID2 } from "crypto";
+import { createHmac as createHmac5, randomUUID as randomUUID2 } from "crypto";
 var WEBHOOK_EVENTS = [
   "create",
   "update",
@@ -4724,7 +4982,7 @@ var Webhooks = class {
       ...hook.headers
     };
     if (hook.secret) {
-      headers["x-easy-cms-signature"] = `sha256=${createHmac4("sha256", hook.secret).update(body).digest("hex")}`;
+      headers["x-easy-cms-signature"] = `sha256=${createHmac5("sha256", hook.secret).update(body).digest("hex")}`;
     }
     try {
       const response = await this.fetcher(hook.url, {
@@ -4750,7 +5008,9 @@ var Webhooks = class {
   }
 };
 var later2 = (from, ms) => new Date(from.getTime() + ms).toISOString();
+var isContentEvent = (event) => WEBHOOK_EVENTS.includes(event);
 function matches(hook, payload) {
+  if (!isContentEvent(payload.event)) return hook.events?.includes(payload.event) === true;
   if (hook.events && !hook.events.includes(payload.event)) return false;
   if (payload.collection !== void 0)
     return !hook.collections || hook.collections.includes(payload.collection);
@@ -4827,6 +5087,8 @@ function validateConfig(config) {
   });
   validateEndpoints(config, collectionSlugs, add);
   validateCommands(config, add);
+  validateJobs(config, add);
+  validateEvents(config, add);
   const apiKeys = config.apiKeys;
   if (apiKeys !== void 0 && typeof apiKeys !== "boolean") add("apiKeys", "must be true or false");
   collections.forEach((collection2, i) => {
@@ -5088,6 +5350,7 @@ function validateAuth(config, add) {
       add("auth.roles", 'must include "admin"', "e.g. roles: ['admin', 'editor']");
     }
   }
+  validateMembers(auth.members, auth.roles ?? ["admin", "editor"], add);
   for (const key2 of [
     "tokenExpiration",
     "maxLoginAttempts",
@@ -5146,6 +5409,31 @@ var LOCALIZABLE = /* @__PURE__ */ new Set([
   "blocks",
   "array"
 ]);
+function validateMembers(members, roles, add) {
+  if (members === void 0) return;
+  const { roles: memberRoles, signup, pages: pages2 } = members ?? {};
+  if (!Array.isArray(memberRoles) || memberRoles.some((r) => typeof r !== "string")) {
+    add("auth.members.roles", "must be an array of roles", "e.g. roles: ['customer']");
+    return;
+  }
+  for (const role of memberRoles) {
+    if (role === "admin") add("auth.members.roles", `can't include "admin"`);
+    else if (!roles.includes(role))
+      add("auth.members.roles", `"${role}" must be one of auth.roles too`);
+  }
+  if (signup !== void 0) {
+    const { role, verifyEmail: verifyEmail2, turnstile } = signup ?? {};
+    if (typeof role !== "string" || !memberRoles.includes(role))
+      add("auth.members.signup.role", "must be one of auth.members.roles");
+    if (verifyEmail2 !== void 0 && typeof verifyEmail2 !== "boolean")
+      add("auth.members.signup.verifyEmail", "must be true or false");
+    if (turnstile !== void 0 && (typeof turnstile?.siteKey !== "string" || typeof turnstile?.secretKey !== "string"))
+      add("auth.members.signup.turnstile", "needs siteKey and secretKey");
+  }
+  for (const [key2, value] of Object.entries(pages2 ?? {}))
+    if (value !== void 0 && typeof value !== "string")
+      add(`auth.members.pages.${key2}`, "must be a path or URL", "e.g. '/account/verify'");
+}
 function validateLocalization(config, add) {
   const localization = config.localization;
   if (localization !== void 0 && localization !== null) {
@@ -5227,14 +5515,19 @@ function validateWebhooks(config, add) {
     ...(config.collections ?? []).map((c) => c?.slug)
   ]);
   const globals = new Set((config.globals ?? []).map((g) => g?.slug));
+  const custom = new Set(config.events ?? []);
   for (const [i, hook] of hooks.entries()) {
     const path = `webhooks[${i}]`;
     if (typeof hook?.url !== "string" || !/^https?:\/\/\S+$/.test(hook.url)) {
       add(`${path}.url`, "must be an http(s) URL");
     }
     for (const event of hook?.events ?? []) {
-      if (!WEBHOOK_EVENTS.includes(event))
-        add(`${path}.events`, `unknown event "${event}"`, `use: ${WEBHOOK_EVENTS.join(", ")}`);
+      if (!WEBHOOK_EVENTS.includes(event) && !custom.has(event))
+        add(
+          `${path}.events`,
+          `unknown event "${event}"`,
+          `use: ${[...WEBHOOK_EVENTS, ...custom].join(", ")}`
+        );
     }
     for (const slug2 of hook?.collections ?? [])
       if (!collections.has(slug2)) add(`${path}.collections`, `unknown collection "${slug2}"`);
@@ -5428,8 +5721,12 @@ function validateContainer(container, path, collectionSlugs, add, { collection:
       const sidebar = admin.sidebar;
       if (sidebar !== void 0) validateComponents(sidebar, `${path}.admin.sidebar`, add);
       const group = admin.group;
-      if (group !== void 0 && group !== "settings")
-        add(`${path}.admin.group`, `must be 'settings' (got ${JSON.stringify(group)})`);
+      if (group !== void 0 && group !== "settings" && !(collection2 && typeof group === "string" && group !== "") && !(collection2 && typeof group === "object" && group !== null && Object.values(group).every((v) => typeof v === "string")))
+        add(
+          `${path}.admin.group`,
+          `must be 'settings' or a label (got ${JSON.stringify(group)})`,
+          "e.g. group: { en: 'Shop', th: '\u0E23\u0E49\u0E32\u0E19\u0E04\u0E49\u0E32' }"
+        );
       const list = admin.list;
       if (list !== void 0) validateList(list, container, `${path}.admin.list`, add);
       const owner = admin.ownerField;
@@ -5528,17 +5825,20 @@ function validateField(field, path, siblings, collectionSlugs, add) {
     }
   }
   if (field.uniqueWithin !== void 0) {
-    const scope = siblings.get(field.uniqueWithin);
-    if (!field.unique && field.type !== "slug") {
+    if (!field.unique && field.type !== "slug")
       add(`${path}.uniqueWithin`, "needs `unique: true` (or a slug field)");
-    } else if (!scope || scope === field) {
-      add(`${path}.uniqueWithin`, `no sibling field named "${field.uniqueWithin}"`);
-    } else if (!["relationship", "select", "text", "number"].includes(scope.type) || "hasMany" in scope && scope.hasMany || scope.localized) {
-      add(
-        `${path}.uniqueWithin`,
-        `"${field.uniqueWithin}" must be a single, unlocalized relationship, select, text or number field`
-      );
-    }
+    else
+      for (const name of [field.uniqueWithin].flat()) {
+        const scope = siblings.get(name);
+        if (!scope || scope === field) {
+          add(`${path}.uniqueWithin`, `no sibling field named "${name}"`);
+        } else if (!["relationship", "select", "text", "number"].includes(scope.type) || "hasMany" in scope && scope.hasMany || scope.localized) {
+          add(
+            `${path}.uniqueWithin`,
+            `"${name}" must be a single, unlocalized relationship, select, text or number field`
+          );
+        }
+      }
   }
   switch (field.type) {
     case "text":
@@ -5697,6 +5997,38 @@ function validateCommands(config, add) {
     if (typeof run !== "function") add(`${path}.run`, "must be a function");
   });
 }
+function validateJobs(config, add) {
+  const jobs = config.jobs;
+  if (jobs === void 0) return;
+  if (!Array.isArray(jobs)) {
+    add("jobs", "must be an array", "e.g. jobs: [{ name: 'shop:clean-up', every: 3600, run }]");
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  jobs.forEach((job, i) => {
+    const path = `jobs[${i}]`;
+    const { name, every, run } = job ?? {};
+    if (typeof name !== "string" || !/^[a-z][a-z0-9-]*(:[a-z0-9-]+)*$/.test(name))
+      add(`${path}.name`, "must be lowercase letters, digits, - and :", "e.g. 'shop:clean-up'");
+    else if (seen.has(name)) add(`${path}.name`, `"${name}" is already used by another job`);
+    else seen.add(name);
+    if (every !== void 0 && (typeof every !== "number" || !(every > 0)))
+      add(`${path}.every`, "must be a number of seconds above 0");
+    if (typeof run !== "function") add(`${path}.run`, "must be a function");
+  });
+}
+function validateEvents(config, add) {
+  const events = config.events;
+  if (events === void 0) return;
+  if (!Array.isArray(events)) {
+    add("events", "must be an array", "e.g. events: ['order.paid']");
+    return;
+  }
+  events.forEach((event, i) => {
+    if (typeof event !== "string" || !/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/.test(event))
+      add(`events[${i}]`, "must be named <area>.<what> in lowercase", "e.g. 'order.paid'");
+  });
+}
 function validateEndpoints(config, collectionSlugs, add) {
   const endpoints = config.endpoints;
   if (endpoints === void 0) return;
@@ -5876,7 +6208,8 @@ async function resolveConfig(input) {
       trustedOrigins: config.auth?.trustedOrigins ?? [],
       resetPasswordExpiration: config.auth?.resetPasswordExpiration ?? 60 * 60,
       inviteExpiration: config.auth?.inviteExpiration ?? 7 * 24 * 60 * 60,
-      emails: config.auth?.emails ?? {}
+      emails: config.auth?.emails ?? {},
+      members: config.auth?.members ?? { roles: [] }
     },
     audit: config.audit ? resolveAudit(config.audit === true ? {} : config.audit) : false,
     collections: [
@@ -5896,6 +6229,8 @@ async function resolveConfig(input) {
     globals: config.globals ?? [],
     endpoints: config.endpoints ?? [],
     commands: config.commands ?? [],
+    events: config.events ?? [],
+    jobs: config.jobs ?? [],
     installedPlugins: (plugins ?? []).map(
       (plugin) => typeof plugin === "function" && plugin.info ? { ...plugin.info } : {}
     ),
@@ -5914,7 +6249,8 @@ function resolveAudit(audit) {
   return {
     keep: audit.keep ?? DEFAULT_AUDIT_KEEP,
     values: audit.values !== false,
-    failedLogins: audit.failedLogins ?? DEFAULT_FAILED_LOGINS
+    failedLogins: audit.failedLogins ?? DEFAULT_FAILED_LOGINS,
+    scope: audit.scope ?? null
   };
 }
 
@@ -5934,7 +6270,7 @@ async function createEasyCMS(config, options = {}) {
     interactive: options.interactive ?? false
   });
   const cms = new EasyCMS(resolved3, db, logger, storage, cwd);
-  const scheduling = [...resolved3.collections, ...resolved3.globals].some((c) => c.schedule) || (resolved3.webhooks?.length ?? 0) > 0 || resolved3.email !== void 0;
+  const scheduling = [...resolved3.collections, ...resolved3.globals].some((c) => c.schedule) || (resolved3.webhooks?.length ?? 0) > 0 || resolved3.email !== void 0 || resolved3.jobs.length > 0;
   if (scheduling && options.scheduler !== false) cms.startScheduler();
   return cms;
 }
@@ -6016,8 +6352,10 @@ var EasyCMS = class {
       user,
       cms: this
     });
+    const changed = result?.user !== void 0 ? result.user : user;
     return {
-      user: result?.user !== void 0 ? result.user : user,
+      // `onRequest` may change the role (e.g. per tenant): membership follows it.
+      user: changed && asMember(changed, this.config.auth.members.roles),
       context: result?.context ?? NO_CONTEXT
     };
   }
@@ -6283,7 +6621,7 @@ var EasyCMS = class {
   /** A value with its HMAC (`secret`), for `purpose` only: `<base64url JSON>.<signature>`. */
   sign(purpose, value) {
     const payload = Buffer.from(JSON.stringify(value)).toString("base64url");
-    const mac = createHmac5("sha256", this.config.secret).update(`${purpose}:${payload}`);
+    const mac = createHmac6("sha256", this.config.secret).update(`${purpose}:${payload}`);
     return `${payload}.${mac.digest("base64url")}`;
   }
   /** The value of a token made by `sign`, or `undefined` when it isn't genuine. */
@@ -6291,10 +6629,10 @@ var EasyCMS = class {
     const [payload, signature] = String(token).split(".");
     if (!payload || !signature) return void 0;
     const expected = Buffer.from(
-      createHmac5("sha256", this.config.secret).update(`${purpose}:${payload}`).digest("base64url")
+      createHmac6("sha256", this.config.secret).update(`${purpose}:${payload}`).digest("base64url")
     );
     const given = Buffer.from(signature);
-    if (expected.length !== given.length || !timingSafeEqual4(expected, given)) return void 0;
+    if (expected.length !== given.length || !timingSafeEqual5(expected, given)) return void 0;
     try {
       return JSON.parse(Buffer.from(payload, "base64url").toString());
     } catch {
@@ -6413,10 +6751,10 @@ var EasyCMS = class {
     if (!signature || !Number.isInteger(at) || at < Date.now() / 1e3) return false;
     const expected = Buffer.from(this.mediaSignature(key2, at));
     const given = Buffer.from(signature);
-    return expected.length === given.length && timingSafeEqual4(expected, given);
+    return expected.length === given.length && timingSafeEqual5(expected, given);
   }
   mediaSignature(key2, expires) {
-    return createHmac5("sha256", this.config.secret).update(`media:${key2}:${expires}`).digest("base64url");
+    return createHmac6("sha256", this.config.secret).update(`media:${key2}:${expires}`).digest("base64url");
   }
   /**
    * How many documents use any of these files in a top-level upload field (rich text and fields
@@ -6540,6 +6878,17 @@ var EasyCMS = class {
   async update(collection2, id, data, options = {}) {
     return await this.updateDocument(collection2, id, asObject(data, collection2), options);
   }
+  /**
+   * Adds `by` (negative to take away) to a top-level number field in one database statement, so
+   * concurrent calls never lose a change, e.g. stock or a counter. Skips hooks, validation, access
+   * and versions. Returns the new value, or `null` when `min` / `max` would be passed.
+   */
+  async increment(collection2, id, field, by, options = {}) {
+    this.collection(collection2);
+    const parsed = parseId(id);
+    if (parsed === void 0) throw new NotFoundError(collection2, id);
+    return this.db.increment({ collection: collection2, id: parsed, field, by, ...options });
+  }
   /**
    * Takes a document off the site: its status becomes `draft`. With versions and drafts, a plain
    * `update` with `status: 'draft'` only saves a draft and leaves the published document live;
@@ -6812,7 +7161,7 @@ var EasyCMS = class {
         previousDoc: current,
         operation: "update"
       });
-      this.emit(config, "draft", draft);
+      this.emitChange(config, "draft", draft);
       await this.audited(config, "draft", draft, current, guard, mode);
       const [out2] = await this.output(config, [draft], guard, {
         ...options,
@@ -6840,11 +7189,9 @@ var EasyCMS = class {
         Object.assign(prepared, moved.patch);
       }
     }
-    const doc = await this.db.update({
-      collection: collection2,
-      id: parsed,
-      data: { ...prepared, createdAt: existing.createdAt, updatedAt: now }
-    });
+    const data = { ...prepared, createdAt: existing.createdAt, updatedAt: now };
+    const doc = options.where ? await this.db.update({ collection: collection2, id: parsed, data, where: options.where }) : await this.db.update({ collection: collection2, id: parsed, data });
+    if (!doc) return null;
     if (moved) await moved.cleanUp();
     if (collection2 === MEDIA_FOLDERS) {
       this.folders.invalidate();
@@ -6859,7 +7206,7 @@ var EasyCMS = class {
       previousDoc: current,
       operation: "update"
     });
-    this.emit(config, "update", doc, existing.status);
+    this.emitChange(config, "update", doc, existing.status);
     await this.audited(config, "update", doc, current, guard, mode);
     const [out] = await this.output(config, [doc], guard, { ...options, draft: true });
     return out;
@@ -6914,7 +7261,7 @@ var EasyCMS = class {
       id: parsed,
       doc: existing
     });
-    this.emit(config, "delete", existing);
+    this.emitChange(config, "delete", existing);
     await this.audited(config, "delete", existing, existing, guard);
     const [out] = await this.output(config, [existing], guard, { depth: 0, draft: true });
     return out;
@@ -7072,7 +7419,7 @@ var EasyCMS = class {
         previousDoc: current,
         operation: "update"
       });
-      this.emit(config, "draft", draft);
+      this.emitChange(config, "draft", draft);
       await this.audited(config, "draft", draft, current, guard, mode);
       return this.readGlobal(config, key2, guard, { ...options, draft: true });
     }
@@ -7084,7 +7431,7 @@ var EasyCMS = class {
       previousDoc: current,
       operation: "update"
     });
-    this.emit(config, "update", doc, existing.status);
+    this.emitChange(config, "update", doc, existing.status);
     await this.audited(config, "update", doc, current, guard, mode);
     return this.readGlobal(config, key2, guard, { ...options, draft: true });
   }
@@ -7197,10 +7544,45 @@ var EasyCMS = class {
       return {
         ...scheduled,
         webhooks: await this.retryWebhooks(now),
-        emails: await this.mailer.retry(now)
+        emails: await this.mailer.retry(now),
+        jobs: await this.runConfigJobs(now)
       };
     });
   }
+  /** `jobs` of the config that are due; when each last ran is kept in the database. */
+  async runConfigJobs(now) {
+    const { jobs } = this.config;
+    if (jobs.length === 0) return { ran: 0, failed: 0 };
+    const last = await this.db.findGlobal({ slug: JOB_RUNS }) ?? {};
+    const runs = {};
+    for (const [name, at] of Object.entries(last)) if (typeof at === "string") runs[name] = at;
+    let ran = 0;
+    let failed = 0;
+    for (const job of jobs) {
+      const previous = runs[job.name];
+      if (job.every !== void 0 && previous !== void 0 && now.getTime() - Date.parse(previous) < job.every * 1e3)
+        continue;
+      runs[job.name] = now.toISOString();
+      try {
+        await job.run({ cms: this, now });
+        ran++;
+      } catch (error) {
+        failed++;
+        this.logger.error(`Job ${job.name} failed: ${error.message}`);
+      }
+    }
+    await this.db.updateGlobal({ slug: JOB_RUNS, data: { ...runs, updatedAt: now.toISOString() } });
+    return { ran, failed };
+  }
+  /**
+   * Sends an event of the app or a plugin (`events` in the config, e.g. `order.paid`) to the
+   * webhooks that list it. Returns at once; deliveries are queued and retried like content changes.
+   */
+  emit(event, data, about) {
+    if (!this.config.events.includes(event))
+      throw new QueryError(`Unknown event "${event}": add it to \`events\` in the config`);
+    this.webhooks.emit(event, about ?? {}, data);
+  }
   /**
    * Tries webhook deliveries that are due for another attempt. Deliveries are kept in the
    * database until they succeed, so they survive restarts.
@@ -7710,7 +8092,7 @@ var EasyCMS = class {
       doc,
       operation: "create"
     });
-    this.emit(config, "create", doc);
+    this.emitChange(config, "create", doc);
     await this.audited(config, "create", doc, void 0, hookGuard ?? guard);
     const [out] = await this.output(config, [doc], hookGuard ?? guard, { ...options, draft: true });
     return out;
@@ -7768,7 +8150,7 @@ var EasyCMS = class {
     });
   }
   /** Sends webhook events for a change; `before` is the stored status before it, if any. */
-  emit(config, event, doc, before) {
+  emitChange(config, event, doc, before) {
     const isGlobal = !this.config.collections.includes(config);
     if (!isGlobal && INTERNAL_COLLECTIONS.has(config.slug)) return;
     const body = isGlobal ? { ...snapshotOf(config.fields, doc), updatedAt: doc.updatedAt } : {
@@ -7809,7 +8191,8 @@ var EasyCMS = class {
       action,
       event === "delete" ? void 0 : doc,
       event === "create" ? void 0 : previous,
-      guard.user
+      guard.user,
+      guard.context
     );
   }
   /** Records a version after a save, when the collection or global keeps versions. */
@@ -7919,7 +8302,7 @@ var EasyCMS = class {
       await this.makeSlugsUnique(config, clean2, selfId);
       errors.push(...await this.checkUnique(config, clean2, selfId));
     }
-    errors.push(...await this.checkReferences(result.references));
+    errors.push(...await this.checkReferences(result.references, guard));
     if (errors.length === 0)
       errors.push(...await this.checkFilterOptions(result.references, selfId, guard));
     if (errors.length > 0) throw new ValidationError(config.slug, errors);
@@ -7949,7 +8332,11 @@ var EasyCMS = class {
   async makeSlugsUnique(config, data, selfId) {
     for (const field of config.fields) {
       if (field.type !== "slug") continue;
-      const scope = field.uniqueWithin === void 0 ? void 0 : { [field.uniqueWithin]: { equals: data[field.uniqueWithin] ?? null } };
+      const scope = field.uniqueWithin === void 0 ? void 0 : {
+        and: uniqueWithinOf(field).map((name) => ({
+          [name]: { equals: data[name] ?? null }
+        }))
+      };
       const unique = async (path, base) => {
         let candidate = base;
         for (let n = 2; await this.isTaken(config.slug, path, candidate, selfId, scope); n++) {
@@ -7980,7 +8367,11 @@ var EasyCMS = class {
         locale === this.config.localization?.defaultLocale ? field.name : `${field.name}.${locale}`,
         v
       ]) : [[field.name, field.name, value]];
-      const scope = field.uniqueWithin === void 0 ? void 0 : { [field.uniqueWithin]: { equals: data[field.uniqueWithin] ?? null } };
+      const scope = field.uniqueWithin === void 0 ? void 0 : {
+        and: uniqueWithinOf(field).map((name) => ({
+          [name]: { equals: data[name] ?? null }
+        }))
+      };
       for (const [path, errorField, v] of checks) {
         if (v === null || v === void 0) continue;
         if (await this.isTaken(config.slug, path, v, selfId, scope)) {
@@ -8000,6 +8391,46 @@ var EasyCMS = class {
     };
     return await this.db.count({ collection: collection2, where }) > 0;
   }
+  /**
+   * What folder keys are unique within for a call (`uniqueWithin` of the `key` field of media
+   * folders, e.g. the tenant): the value a folder made by this call would get from its hooks.
+   */
+  async folderScope(guard) {
+    return this.uniqueScope(MEDIA_FOLDERS, "key", guard);
+  }
+  /**
+   * Where a unique field's values must differ for a call (`uniqueWithin`, e.g. the tenant): the
+   * value a document created by this call would get there from its hooks, as `{ [field]: value }`;
+   * `{}` when the field is unique everywhere. For finding documents by such a field, e.g. a page
+   * by its path in the current tenant.
+   */
+  async uniqueScope(collection2, field, options = {}) {
+    const config = this.config.collections.find((c) => c.slug === collection2);
+    const target = config?.fields.find((f) => f.name === field);
+    const within = target ? uniqueWithinOf(target) : [];
+    if (!config || within.length === 0) return {};
+    const guard = {
+      enforce: false,
+      user: options.user ?? null,
+      context: options.context ?? NO_CONTEXT
+    };
+    const data = await this.transform(
+      config.hooks?.beforeValidate,
+      "data",
+      { ...this.hookArgs(config, guard), operation: "create" },
+      {}
+    ).catch(() => ({}));
+    return Object.fromEntries(within.map((name) => [name, data[name] ?? null]));
+  }
+  /**
+   * @internal The id of the media folder with this key (`folder` of upload fields), made when
+   * needed; `null` when the call has no scope to make it in (e.g. all tenants) and none exists.
+   */
+  async keyedFolder(key2, options = {}) {
+    const scope = await this.folderScope(guardOf(options));
+    const complete = Object.values(scope).every((v) => v !== null && v !== void 0);
+    return this.folders.keyed(key2, scope, complete);
+  }
   /** Each reference is one its relationship's `filterOptions` allow. */
   async checkFilterOptions(references2, selfId, guard) {
     const errors = [];
@@ -8025,7 +8456,7 @@ var EasyCMS = class {
     }
     return errors;
   }
-  async checkReferences(references2) {
+  async checkReferences(references2, guard) {
     const byCollection = /* @__PURE__ */ new Map();
     for (const ref of references2) {
       if (!this.config.collections.some((c) => c.slug === ref.collection)) continue;
@@ -8054,7 +8485,8 @@ var EasyCMS = class {
         }
         if (ref.folderOnly && this.folders.enabled && !await this.folders.inKeyed(
           ref.folderOnly,
-          doc.folder ?? null
+          doc.folder ?? null,
+          await this.folderScope(guard)
         ))
           errors.push({
             field: ref.field,
@@ -8144,6 +8576,7 @@ var UPLOAD_URL_SECONDS = 15 * 60;
 var UPLOAD_TICKET_SECONDS = 24 * 60 * 60;
 var SNIFF_BYTES = 64 * 1024;
 var MAX_FILES_TO_MOVE = 200;
+var JOB_RUNS = "easy-cms:jobs";
 function durationSeconds(value) {
   const match = typeof value === "string" ? /^(\d+)\s*([smhd])$/.exec(value.trim()) : null;
   const seconds = typeof value === "number" ? value : match ? Number(match[1]) * { s: 1, m: 60, h: 3600, d: 86400 }[match[2]] : Number.NaN;
@@ -8400,7 +8833,7 @@ function componentRef(component) {
 async function allowed(access, user, context) {
   return await evaluateAccess(access, { user, context }) !== false;
 }
-async function serializeFields(fields, checks, localized, folderId) {
+async function serializeFields(fields, checks, localized, folderId, who) {
   const { update: update2 } = checks;
   const out = [];
   for (const field of fields) {
@@ -8410,6 +8843,13 @@ async function serializeFields(fields, checks, localized, folderId) {
     if (field.required) f.required = true;
     if (field.unique) f.unique = true;
     if (field.defaultValue !== void 0) f.defaultValue = field.defaultValue;
+    if (field.admin?.defaultValue) {
+      const value = await field.admin.defaultValue(who);
+      if (value !== void 0) f.defaultValue = value;
+    }
+    const column = field.admin?.column;
+    if (column === true || typeof column === "function" && await column(who)) f.column = true;
+    if (field.admin?.allowCreate === false) f.noCreate = true;
     if (!await update2.allows(field)) f.readOnly = true;
     if (field.localized && localized) f.localized = true;
     if (field.position === "sidebar") f.position = "sidebar";
@@ -8450,16 +8890,19 @@ async function serializeFields(fields, checks, localized, folderId) {
       case "upload":
         f.to = "media";
         if (field.hasMany) f.hasMany = true;
+        if (field.filterOptions) f.filtered = true;
         if (field.minRows !== void 0) f.minRows = field.minRows;
         if (field.maxRows !== void 0) f.maxRows = field.maxRows;
         if (field.mimeTypes) f.mimeTypes = expandMimeTypes(field.mimeTypes);
-        if (field.folder && folderId)
-          f.folder = { id: await folderId(field.folder), only: field.folderOnly === true };
+        if (field.folder && folderId) {
+          const id = await folderId(field.folder);
+          if (id !== null) f.folder = { id, only: field.folderOnly === true };
+        }
         break;
       case "array":
         if (field.minRows !== void 0) f.minRows = field.minRows;
         if (field.maxRows !== void 0) f.maxRows = field.maxRows;
-        f.fields = await serializeFields(field.fields, checks, localized, folderId);
+        f.fields = await serializeFields(field.fields, checks, localized, folderId, who);
         break;
       case "blocks":
         if (field.minRows !== void 0) f.minRows = field.minRows;
@@ -8468,12 +8911,12 @@ async function serializeFields(fields, checks, localized, folderId) {
           field.blocks.map(async (block) => ({
             slug: block.slug,
             ...block.labels ? { labels: block.labels } : {},
-            fields: await serializeFields(block.fields, checks, localized, folderId)
+            fields: await serializeFields(block.fields, checks, localized, folderId, who)
           }))
         );
         break;
       case "group":
-        f.fields = await serializeFields(field.fields, checks, localized, folderId);
+        f.fields = await serializeFields(field.fields, checks, localized, folderId, who);
         break;
     }
     out.push(f);
@@ -8496,7 +8939,8 @@ async function collection(cms, config, user, localized, roles, context) {
     config.fields,
     await checkers(cms, user, context),
     localized,
-    folderIds(cms)
+    folderIds(cms, user, context),
+    { user, context }
   );
   if (config.slug === USERS && cms.roles.enabled) {
     const role = fields.find((f) => f.name === "role");
@@ -8524,9 +8968,12 @@ async function collection(cms, config, user, localized, roles, context) {
   if (config.useAsTitle) result.useAsTitle = config.useAsTitle;
   if (config.icon) result.icon = config.icon;
   if (config.admin?.sidebar?.length) result.sidebar = config.admin.sidebar.map(componentRef);
-  if (config.admin?.group === "settings" || SETTINGS.has(config.slug)) result.group = "settings";
+  const group = config.admin?.group;
+  if (group === "settings" || SETTINGS.has(config.slug)) result.group = "settings";
+  else if (group !== void 0) result.section = group;
   if (config.admin?.list?.tree) result.tree = config.admin.list.tree;
   if (config.admin?.list?.sort) result.defaultSort = config.admin.list.sort;
+  if (config.admin?.confirmDelete) result.confirmDelete = { ...config.admin.confirmDelete };
   const owner = cms.roles.ownerOf(config.slug);
   if (owner && fields.some((f) => f.name === owner)) result.owner = owner;
   if (config.editIn === "drawer" && !result.drafts && !result.versions && !result.preview)
@@ -8542,7 +8989,10 @@ async function global(cms, config, user, localized, context) {
     versions: Boolean(config.versions),
     preview: typeof config.preview === "function",
     schedule: config.schedule === true,
-    fields: await serializeFields(config.fields, checks, localized, folderIds(cms)),
+    fields: await serializeFields(config.fields, checks, localized, folderIds(cms, user, context), {
+      user,
+      context
+    }),
     permissions: {
       read: await may(cms, config.access?.read, user, target, "read", context),
       update: await may(cms, config.access?.update, user, target, "update", context),
@@ -8643,12 +9093,12 @@ async function widgets(cms, user) {
   }
   return out;
 }
-function folderIds(cms) {
-  return cms.folders.enabled ? (key2) => cms.folders.keyed(key2) : void 0;
+function folderIds(cms, user, context) {
+  return cms.folders.enabled ? (key2) => cms.keyedFolder(key2, { user, context }) : void 0;
 }
 
 // src/version.ts
-var VERSION = true ? "0.44.0" : "0.0.0-dev";
+var VERSION = true ? "0.46.0" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
 var DAY2 = 864e5;
@@ -8745,7 +9195,8 @@ async function pickerFilter(cms, url, target, user, context = {}) {
   const slug2 = dot > 0 ? spec.slice(0, dot) : "";
   const owner = forCollection !== null ? cms.config.collections.find((c) => c.slug === slug2) : cms.config.globals.find((g) => g.slug === slug2);
   const field = owner ? fieldAt(owner.fields, spec.slice(dot + 1)) : void 0;
-  if (field?.type !== "relationship" || field.to !== target)
+  const to = field?.type === "upload" ? "media" : field?.type === "relationship" ? field.to : null;
+  if (!field || field.type !== "relationship" && field.type !== "upload" || to !== target)
     throw new QueryError(`filterFor: no relationship to "${target}" at "${spec}"`);
   if (!field.filterOptions) return void 0;
   const rawId = url.searchParams.get("filterId");
@@ -8927,6 +9378,7 @@ async function respond(cms, request, url, path, root, options, production) {
     if (method !== "GET" && method !== "HEAD") checkCsrf(cms, ctx);
     const audit = {
       user,
+      context,
       ip: options.getClientIp?.(request),
       userAgent: request.headers.get("user-agent")
     };
@@ -9019,8 +9471,9 @@ async function route(cms, ctx, method, segments, options) {
     context: ctx.context,
     ...parseLocale(ctx.url)
   };
-  const draft = ctx.user !== null && ctx.url.searchParams.get("draft") === "true";
+  const draft = ctx.user !== null && ctx.user.member !== true && ctx.url.searchParams.get("draft") === "true";
   if (segments.length === 0) throw new HttpError("Not found", 404);
+  if (first === "admin" && ctx.user?.member === true) throw new ForbiddenError();
   if (first === "auth") return ssoRoute(cms, ctx, method, segments);
   if (first === USERS && second !== void 0 && third === void 0 && !/^\d+$/.test(second)) {
     switch (`${method} ${second}`) {
@@ -9093,6 +9546,45 @@ async function route(cms, ctx, method, segments, options) {
           body: { user: session.user, exp: session.expiresAt, csrfToken: session.csrfToken }
         };
       }
+      // Members signing up (`auth.members.signup`): the form's token, then the account.
+      case "GET signup":
+        return { body: cms.auth.signupForm() };
+      case "POST signup": {
+        const body = await readJson(ctx.request);
+        const result = await cms.auth.signup({
+          email: String(body.email ?? ""),
+          password: String(body.password ?? ""),
+          name: typeof body.name === "string" ? body.name : void 0,
+          token: body.token,
+          honeypot: body[SIGNUP_HONEYPOT],
+          turnstile: body.turnstile,
+          ip: options.getClientIp?.(ctx.request),
+          origin: ctx.url.origin,
+          locale: typeof body.locale === "string" ? body.locale : void 0,
+          context: ctx.context
+        });
+        if (result.verify)
+          return {
+            status: 202,
+            body: { verify: true, message: "Check your email for a link to confirm it." }
+          };
+        setSessionCookies(cms, ctx, result);
+        return {
+          status: 201,
+          body: { user: result.user, exp: result.expiresAt, csrfToken: result.csrfToken }
+        };
+      }
+      case "POST verify-email": {
+        const body = await readJson(ctx.request);
+        const session = await cms.auth.verifyEmail({
+          token: String(body.token ?? ""),
+          ip: options.getClientIp?.(ctx.request)
+        });
+        setSessionCookies(cms, ctx, session);
+        return {
+          body: { user: session.user, exp: session.expiresAt, csrfToken: session.csrfToken }
+        };
+      }
       case "POST first-register": {
         const body = await readJson(ctx.request);
         const session = await cms.auth.registerFirstUser({
@@ -9199,8 +9691,11 @@ async function route(cms, ctx, method, segments, options) {
       doc: q.get("doc"),
       actor: q.get("actor"),
       from: q.get("from"),
-      to: q.get("to")
+      to: q.get("to"),
+      // Users of a part of the site (e.g. one tenant) see its entries; others the chosen part's.
+      scope: cms.audit.scopeOf(ctx.context)
     };
+    if (ctx.user.scoped && !filter.scope) throw new ForbiddenError();
     if (second === "audit.csv" && third === void 0) {
       if (method !== "GET") throw methodNotAllowed(ctx, "GET");
       return {
@@ -10214,6 +10709,7 @@ export {
   anyone,
   applyDefaults,
   applyPlugins,
+  checkFormToken,
   configSignature,
   consoleEmail,
   consoleLogger,
@@ -10228,15 +10724,18 @@ export {
   expandMimeTypes,
   fillMissing,
   findConfigFile,
+  formToken,
   generateSlugs,
   generateTypes,
   hasRows,
   hashPassword,
+  honeypotName,
   imageDimensions,
   importConfig,
   isAdmin,
   isHasMany,
   isLoggedIn,
+  isSignedIn,
   isSystemAdmin,
   keyAllows,
   loadConfig,
@@ -10246,6 +10745,7 @@ export {
   mimeAllowedBy,
   parseId,
   populate,
+  rateKeys,
   readCookie,
   resolveAdminModule,
   resolveConfig,
@@ -10255,8 +10755,10 @@ export {
   singularize,
   slugify,
   sniffMimeType,
+  uniqueWithinOf,
   validateConfig,
   validateFields,
   verifyPassword,
+  verifyTurnstile,
   writeBackupFile
 };