@easy-cms/core 0.45.0 → 0.46.0

package/dist/index.js

@@ -1,7 +1,8 @@
 // src/access.ts
 var isSystemAdmin = (user) => user?.role === "admin" && !user.apiKey && user.scoped !== true;
 var anyone = () => true;
-var isLoggedIn = ({ user }) => user !== null;
+var isLoggedIn = ({ user }) => user !== null && user.member !== true;
+var isSignedIn = ({ user }) => user !== null;
 var isAdmin = ({ user }) => user?.role === "admin";
 
 // src/api-keys.ts
@@ -192,7 +193,12 @@ var adminOrSelf = ({ user }) => {
 var adminOnly = {
   update: ({ user }) => isSystemAdmin(user)
 };
-function userFields(roles, rbac) {
+var staffOrSelf = ({ user }) => {
+  if (!user) return false;
+  if (user.member !== true) return true;
+  return { id: { equals: user.id } };
+};
+function userFields(roles, rbac, members) {
   const defaultRole = roles.includes("editor") ? "editor" : roles[roles.length - 1];
   return [
     {
@@ -227,6 +233,16 @@ function userFields(roles, rbac) {
       access: adminOnly,
       label: { en: "Active", th: "\u0E43\u0E0A\u0E49\u0E07\u0E32\u0E19" }
     },
+    // Accounts made by signing up (`auth.members.signup`) are `false` until the email is confirmed.
+    ...members ? [
+      {
+        name: "emailVerified",
+        type: "boolean",
+        access: adminOnly,
+        position: "sidebar",
+        label: { en: "Email confirmed", th: "\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E41\u0E25\u0E49\u0E27" }
+      }
+    ] : [],
     { name: "passwordHash", type: "text", hidden: true }
   ];
 }
@@ -239,9 +255,12 @@ function withUsers(config) {
     useAsTitle: "email",
     icon: "users",
     ...custom,
-    fields: [...userFields(roles, config.auth?.rbac === true), ...custom?.fields ?? []],
+    fields: [
+      ...userFields(roles, config.auth?.rbac === true, config.auth?.members?.signup !== void 0),
+      ...custom?.fields ?? []
+    ],
     access: {
-      read: isLoggedIn,
+      read: staffOrSelf,
       create: ({ user }) => isSystemAdmin(user),
       update: adminOrSelf,
       delete: ({ user }) => isSystemAdmin(user),
@@ -1273,6 +1292,48 @@ async function filterInput(fields, data, update2) {
   return result;
 }
 
+// src/spam.ts
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var MAX_AGE = 24 * 36e5;
+var sign = (secret, value) => createHmac2("sha256", secret).update(value).digest("base64url");
+function formToken(secret, purpose, now = Date.now()) {
+  return `${now}.${sign(secret, `${purpose}:${now}`)}`;
+}
+function checkFormToken(secret, purpose, token, minTime, now = Date.now()) {
+  if (typeof token !== "string") return "invalid";
+  const [time, signature] = token.split(".");
+  const issued = Number(time);
+  if (!Number.isFinite(issued) || !signature) return "invalid";
+  const expected = Buffer.from(sign(secret, `${purpose}:${issued}`));
+  const given = Buffer.from(signature);
+  if (expected.length !== given.length || !timingSafeEqual2(expected, given)) return "invalid";
+  if (now - issued < minTime) return "too-fast";
+  if (now - issued > MAX_AGE) return "expired";
+  return "ok";
+}
+function rateKeys(secret, subject, window, now = Date.now()) {
+  const bucket = Math.floor(now / (window * 1e3));
+  const key2 = (b) => sign(secret, `${subject}:${b}`).slice(0, 32);
+  return { current: key2(bucket), previous: key2(bucket - 1) };
+}
+function honeypotName(names2) {
+  return ["website", "homepage", "url_address"].find((n) => !names2.includes(n)) ?? "hp_field";
+}
+async function verifyTurnstile(secretKey, response, ip, fetcher = fetch) {
+  if (typeof response !== "string" || !response) return false;
+  const body = new URLSearchParams({ secret: secretKey, response, ...ip ? { remoteip: ip } : {} });
+  try {
+    const result = await fetcher("https://challenges.cloudflare.com/turnstile/v0/siteverify", {
+      method: "POST",
+      body,
+      signal: AbortSignal.timeout(1e4)
+    });
+    return (await result.json()).success === true;
+  } catch {
+    return false;
+  }
+}
+
 // src/auth/cookie.ts
 var SESSION_COOKIE = "ecms-session";
 
@@ -1289,6 +1350,21 @@ function email(subject, lines, button) {
 var hours = (expiresAt) => Math.max(1, Math.round(((expiresAt?.getTime() ?? Date.now()) - Date.now()) / 36e5));
 var days = (expiresAt) => Math.max(1, Math.round(hours(expiresAt) / 24));
 var DEFAULT_PASSWORD_EMAILS = {
+  verifyEmail: ({ url = "", locale, expiresAt }) => locale === "th" ? email(
+    "\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E02\u0E2D\u0E07\u0E04\u0E38\u0E13",
+    [
+      "\u0E02\u0E2D\u0E1A\u0E04\u0E38\u0E13\u0E17\u0E35\u0E48\u0E2A\u0E21\u0E31\u0E04\u0E23\u0E2A\u0E21\u0E32\u0E0A\u0E34\u0E01 \u0E01\u0E14\u0E1B\u0E38\u0E48\u0E21\u0E14\u0E49\u0E32\u0E19\u0E25\u0E48\u0E32\u0E07\u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E41\u0E25\u0E30\u0E40\u0E02\u0E49\u0E32\u0E2A\u0E39\u0E48\u0E23\u0E30\u0E1A\u0E1A",
+      `\u0E25\u0E34\u0E07\u0E01\u0E4C\u0E19\u0E35\u0E49\u0E43\u0E0A\u0E49\u0E44\u0E14\u0E49\u0E20\u0E32\u0E22\u0E43\u0E19 ${days(expiresAt)} \u0E27\u0E31\u0E19 \u0E16\u0E49\u0E32\u0E04\u0E38\u0E13\u0E44\u0E21\u0E48\u0E44\u0E14\u0E49\u0E2A\u0E21\u0E31\u0E04\u0E23 \u0E44\u0E21\u0E48\u0E15\u0E49\u0E2D\u0E07\u0E17\u0E33\u0E2D\u0E30\u0E44\u0E23`
+    ],
+    { label: "\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E2D\u0E35\u0E40\u0E21\u0E25", url }
+  ) : email(
+    "Confirm your email",
+    [
+      "Thanks for signing up. Confirm your email to sign in.",
+      `The link works within ${days(expiresAt)} day(s). If you didn't sign up, ignore this email.`
+    ],
+    { label: "Confirm email", url }
+  ),
   resetPassword: ({ url = "", locale, expiresAt }) => locale === "th" ? email(
     "\u0E15\u0E31\u0E49\u0E07\u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E48\u0E32\u0E19\u0E43\u0E2B\u0E21\u0E48",
     [
@@ -1339,7 +1415,7 @@ var DEFAULT_PASSWORD_EMAILS = {
 };
 
 // src/auth/password.ts
-import { randomBytes as randomBytes2, scrypt, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { randomBytes as randomBytes2, scrypt, timingSafeEqual as timingSafeEqual3 } from "crypto";
 var MIN_PASSWORD_LENGTH = 8;
 var N = 2 ** 17;
 var R = 8;
@@ -1374,7 +1450,7 @@ async function verifyPassword(password, stored) {
     Number(p),
     expected.length
   );
-  return key2.length === expected.length && timingSafeEqual2(key2, expected);
+  return key2.length === expected.length && timingSafeEqual3(key2, expected);
 }
 var dummyHash;
 async function fakeVerify(password) {
@@ -1384,10 +1460,10 @@ async function fakeVerify(password) {
 }
 
 // src/auth/sso.ts
-import { createHmac as createHmac3, randomBytes as randomBytes4 } from "crypto";
+import { createHmac as createHmac4, randomBytes as randomBytes4 } from "crypto";
 
 // src/auth/tokens.ts
-import { createHash as createHash2, createHmac as createHmac2, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHash as createHash2, createHmac as createHmac3, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual4 } from "crypto";
 function newToken() {
   return randomBytes3(32).toString("base64url");
 }
@@ -1395,7 +1471,7 @@ function hashToken(token) {
   return createHash2("sha256").update(token).digest("hex");
 }
 function hmac(secret, value) {
-  return createHmac2("sha256", secret).update(value).digest("base64url");
+  return createHmac3("sha256", secret).update(value).digest("base64url");
 }
 function signToken(secret, token) {
   return `${token}.${hmac(secret, `session:${token}`)}`;
@@ -1412,7 +1488,7 @@ function csrfToken(secret, token) {
 function safeEqual(a, b) {
   const left = Buffer.from(a);
   const right = Buffer.from(b);
-  return left.length === right.length && timingSafeEqual3(left, right);
+  return left.length === right.length && timingSafeEqual4(left, right);
 }
 function signPreviewToken(secret, target, expiresAt) {
   const payload = Buffer.from(
@@ -1454,7 +1530,7 @@ function readPasswordToken(token) {
   try {
     const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
     if (typeof data.u !== "string" || typeof data.e !== "number") return null;
-    if (data.p !== "reset" && data.p !== "invite") return null;
+    if (data.p !== "reset" && data.p !== "invite" && data.p !== "verify") return null;
     return { userId: data.u, purpose: data.p, expiresAt: data.e, payload };
   } catch {
     return null;
@@ -1471,19 +1547,19 @@ function passwordTokenMatches(secret, token, fingerprint) {
 var SSO_COOKIE = "ecms-sso";
 var PENDING_TTL = 10 * 6e4;
 var random = () => randomBytes4(32).toString("base64url");
-function sign(secret, payload) {
-  return createHmac3("sha256", secret).update(`sso:${payload}`).digest("base64url");
+function sign2(secret, payload) {
+  return createHmac4("sha256", secret).update(`sso:${payload}`).digest("base64url");
 }
 function seal(secret, pending) {
   const payload = Buffer.from(JSON.stringify(pending)).toString("base64url");
-  return `${payload}.${sign(secret, payload)}`;
+  return `${payload}.${sign2(secret, payload)}`;
 }
 function unseal(secret, value) {
   if (!value) return null;
   const dot = value.lastIndexOf(".");
   if (dot <= 0) return null;
   const payload = value.slice(0, dot);
-  if (!safeEqual(value.slice(dot + 1), sign(secret, payload))) return null;
+  if (!safeEqual(value.slice(dot + 1), sign2(secret, payload))) return null;
   try {
     const pending = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
     return typeof pending.e === "number" && pending.e > Date.now() ? pending : null;
@@ -1761,6 +1837,16 @@ var SingleSignOn = class {
 
 // src/auth/auth.ts
 var INVALID = "Invalid email or password";
+var SIGNUP_FORM = "easy-cms-signup";
+var SIGNUP_MIN_TIME = 2e3;
+var SIGNUP_HONEYPOT = "website";
+function asMember(user, memberRoles) {
+  const member = memberRoles.includes(String(user.role));
+  if (member === (user.member === true)) return user;
+  if (member) return { ...user, member: true };
+  const { member: _member, ...rest } = user;
+  return rest;
+}
 var RESET_REQUESTS = 3;
 var Auth = class {
   constructor(cms) {
@@ -1810,6 +1896,16 @@ var Auth = class {
       throw new UnauthorizedError(INVALID);
     }
     await this.clearFailures(key2);
+    if (user.emailVerified === false) {
+      await this.cms.audit.record({
+        action: "login.failed",
+        target: "auth",
+        user: null,
+        email: email2,
+        detail: { reason: "email not confirmed" }
+      });
+      throw new UnauthorizedError("Confirm your email first: follow the link we sent you");
+    }
     if (!this.sso.passwordAllowed(user)) {
       await this.cms.audit.record({
         action: "login.failed",
@@ -1852,6 +1948,136 @@ var Auth = class {
     const raw = await this.db.findById({ collection: USERS, id: user.id });
     return this.startSession(raw);
   }
+  // --- Members signing up (`auth.members.signup`) ---------------------------------------------
+  /** What a sign-up form needs: a token proving when it was loaded, and Turnstile's site key. */
+  signupForm() {
+    const signup = this.config.auth.members.signup;
+    if (!signup) throw new NotFoundError(USERS, "signup");
+    return {
+      token: formToken(this.config.secret, SIGNUP_FORM),
+      turnstile: signup.turnstile?.siteKey ?? null,
+      verifyEmail: signup.verifyEmail !== false
+    };
+  }
+  /**
+   * Creates a member's account (`auth.members.signup`). With `verifyEmail` (the default), emails
+   * a link to confirm the address and answers the same whether or not the email has an account;
+   * otherwise starts a session. Throws `ValidationError` for spam checks and bad input.
+   */
+  async signup(args) {
+    const signup = this.config.auth.members.signup;
+    if (!signup) throw new NotFoundError(USERS, "signup");
+    const key2 = `signup|${args.ip ?? ""}`;
+    await this.checkRateLimit(key2);
+    const refuse = (field, message2) => new ValidationError(USERS, [{ field, message: message2 }]);
+    if (typeof args.honeypot === "string" && args.honeypot !== "") {
+      await this.recordFailure(key2);
+      throw refuse("form", "could not be sent");
+    }
+    const checked = checkFormToken(this.config.secret, SIGNUP_FORM, args.token, SIGNUP_MIN_TIME);
+    if (checked !== "ok")
+      throw refuse(
+        "form",
+        checked === "expired" ? "was open too long: reload the page" : "could not be sent"
+      );
+    if (signup.turnstile && !await verifyTurnstile(signup.turnstile.secretKey, args.turnstile, args.ip))
+      throw refuse("turnstile", "is not complete");
+    await this.recordFailure(key2);
+    const email2 = typeof args.email === "string" ? args.email.trim().toLowerCase() : "";
+    const verify = signup.verifyEmail !== false;
+    if (verify && !this.canSendPasswordLinks(args.origin))
+      throw new QueryError("Signing up needs `email` in the config, and a site URL in production");
+    const existing = email2 ? await this.findByEmail(email2) : void 0;
+    if (existing && verify) {
+      if (existing.emailVerified === false && existing.active !== false)
+        await this.mailVerifyLink(existing, args);
+      return { verify: true };
+    }
+    const created = await this.cms.create(
+      USERS,
+      {
+        email: email2,
+        password: args.password,
+        role: signup.role,
+        active: true,
+        emailVerified: !verify,
+        ...typeof args.name === "string" && args.name.trim() ? { name: args.name.trim() } : {}
+      },
+      { context: args.context ?? {} }
+    );
+    const user = await this.db.findById({ collection: USERS, id: created.id });
+    await this.cms.audit.record({
+      action: "signup",
+      target: "auth",
+      user: await this.toAuthUser(user)
+    });
+    if (verify) {
+      await this.mailVerifyLink(user, args);
+      return { verify: true };
+    }
+    return { ...await this.startSession(user), verify: false };
+  }
+  /** Confirms a member's email from the link, and signs them in. */
+  async verifyEmail(args) {
+    const key2 = `verify-token|${args.ip ?? ""}`;
+    await this.checkRateLimit(key2);
+    const token = String(args.token ?? "");
+    const claims = readPasswordToken(token);
+    const id = claims && (/^\d+$/.test(claims.userId) ? Number(claims.userId) : claims.userId);
+    const user = claims && claims.purpose === "verify" && claims.expiresAt > Date.now() && id !== null ? await this.db.findById({ collection: USERS, id }) : null;
+    if (!user || user.active === false || !passwordTokenMatches(this.config.secret, token, passwordFingerprint(user.passwordHash))) {
+      await this.recordFailure(key2);
+      throw new ValidationError(USERS, [
+        { field: "token", message: "This link has expired or is not valid" }
+      ]);
+    }
+    await this.clearFailures(key2);
+    if (user.emailVerified === false) {
+      const { id: _id, ...rest } = user;
+      await this.db.update({
+        collection: USERS,
+        id: user.id,
+        data: { ...rest, emailVerified: true }
+      });
+    }
+    const session = await this.startSession(
+      await this.db.findById({ collection: USERS, id: user.id })
+    );
+    await this.cms.audit.record({ action: "email.verified", target: "auth", user: session.user });
+    return session;
+  }
+  async mailVerifyLink(user, options) {
+    const expiresAt = Date.now() + this.config.auth.inviteExpiration * 1e3;
+    const token = signPasswordToken(this.config.secret, {
+      userId: String(user.id),
+      purpose: "verify",
+      expiresAt,
+      fingerprint: passwordFingerprint(user.passwordHash)
+    });
+    const url = this.memberLink("verifyEmail", token, options.origin);
+    const write = this.config.auth.members.emails?.verifyEmail ?? DEFAULT_PASSWORD_EMAILS.verifyEmail;
+    const content = await write({
+      user: await this.toAuthUser(user),
+      url,
+      locale: this.localeOf(options.locale),
+      expiresAt: new Date(expiresAt)
+    });
+    await this.cms.sendEmail({ to: String(user.email), ...content });
+  }
+  /**
+   * A link to one of the site's pages for members (`auth.members.pages`), else to the admin's
+   * page of the same purpose.
+   */
+  memberLink(page, token, origin) {
+    const target = this.config.auth.members.pages?.[page];
+    const query = `token=${encodeURIComponent(token)}`;
+    if (target && /^https?:\/\//.test(target))
+      return `${target}${target.includes("?") ? "&" : "?"}${query}`;
+    const site = (this.config.admin.siteUrl || "").replace(/\/+$/, "");
+    const base = site || this.passwordLinkBase(origin);
+    const path = target ?? `${this.config.admin.path}/${page === "verifyEmail" ? "verify-email" : "reset-password"}`;
+    return `${base}${path.startsWith("/") ? "" : "/"}${path}${path.includes("?") ? "&" : "?"}${query}`;
+  }
   async hasUsers() {
     return await this.db.count({ collection: USERS }) > 0;
   }
@@ -2024,7 +2250,7 @@ var Auth = class {
   }
   async passwordTokenUser(token) {
     const claims = readPasswordToken(token);
-    if (!claims || claims.expiresAt <= Date.now()) return null;
+    if (!claims || claims.purpose === "verify" || claims.expiresAt <= Date.now()) return null;
     const id = /^\d+$/.test(claims.userId) ? Number(claims.userId) : claims.userId;
     const user = await this.db.findById({ collection: USERS, id });
     if (!user || user.active === false || !this.sso.passwordAllowed(user)) return null;
@@ -2043,7 +2269,8 @@ var Auth = class {
       fingerprint: passwordFingerprint(user.passwordHash)
     });
     const sso = this.sso.passwordAllowed(user) ? void 0 : this.config.auth.providers.map((p) => p.name);
-    const url = sso ? `${base}${this.config.admin.path}/login` : `${base}${this.config.admin.path}/reset-password?token=${encodeURIComponent(token)}`;
+    const member = this.config.auth.members.roles.includes(String(user.role));
+    const url = sso ? `${base}${this.config.admin.path}/login` : member ? this.memberLink("resetPassword", token, options.origin) : `${base}${this.config.admin.path}/reset-password?token=${encodeURIComponent(token)}`;
     const write = purpose === "invite" ? this.config.auth.emails.invite ?? DEFAULT_PASSWORD_EMAILS.invite : this.config.auth.emails.resetPassword ?? DEFAULT_PASSWORD_EMAILS.resetPassword;
     const content = await write({
       user: await this.toAuthUser(user),
@@ -2136,7 +2363,8 @@ var Auth = class {
   }
   async toAuthUser(user) {
     const fields = this.cms.collection(USERS).fields;
-    return await stripFields(fields, user);
+    const stripped = await stripFields(fields, user);
+    return asMember(stripped, this.config.auth.members.roles);
   }
   async deleteExpiredSessions(userId) {
     const expired = await this.db.find({
@@ -3245,7 +3473,7 @@ function applyFieldTypes(config) {
 }
 
 // src/local-api.ts
-import { createHmac as createHmac5, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual4 } from "crypto";
+import { createHmac as createHmac6, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual5 } from "crypto";
 
 // src/localization.ts
 var ALL_LOCALES = "all";
@@ -4610,7 +4838,7 @@ function rank(role, config) {
 }
 
 // src/webhooks.ts
-import { createHmac as createHmac4, randomUUID as randomUUID2 } from "crypto";
+import { createHmac as createHmac5, randomUUID as randomUUID2 } from "crypto";
 var WEBHOOK_EVENTS = [
   "create",
   "update",
@@ -4754,7 +4982,7 @@ var Webhooks = class {
       ...hook.headers
     };
     if (hook.secret) {
-      headers["x-easy-cms-signature"] = `sha256=${createHmac4("sha256", hook.secret).update(body).digest("hex")}`;
+      headers["x-easy-cms-signature"] = `sha256=${createHmac5("sha256", hook.secret).update(body).digest("hex")}`;
     }
     try {
       const response = await this.fetcher(hook.url, {
@@ -4780,7 +5008,9 @@ var Webhooks = class {
   }
 };
 var later2 = (from, ms) => new Date(from.getTime() + ms).toISOString();
+var isContentEvent = (event) => WEBHOOK_EVENTS.includes(event);
 function matches(hook, payload) {
+  if (!isContentEvent(payload.event)) return hook.events?.includes(payload.event) === true;
   if (hook.events && !hook.events.includes(payload.event)) return false;
   if (payload.collection !== void 0)
     return !hook.collections || hook.collections.includes(payload.collection);
@@ -4857,6 +5087,8 @@ function validateConfig(config) {
   });
   validateEndpoints(config, collectionSlugs, add);
   validateCommands(config, add);
+  validateJobs(config, add);
+  validateEvents(config, add);
   const apiKeys = config.apiKeys;
   if (apiKeys !== void 0 && typeof apiKeys !== "boolean") add("apiKeys", "must be true or false");
   collections.forEach((collection2, i) => {
@@ -5118,6 +5350,7 @@ function validateAuth(config, add) {
       add("auth.roles", 'must include "admin"', "e.g. roles: ['admin', 'editor']");
     }
   }
+  validateMembers(auth.members, auth.roles ?? ["admin", "editor"], add);
   for (const key2 of [
     "tokenExpiration",
     "maxLoginAttempts",
@@ -5176,6 +5409,31 @@ var LOCALIZABLE = /* @__PURE__ */ new Set([
   "blocks",
   "array"
 ]);
+function validateMembers(members, roles, add) {
+  if (members === void 0) return;
+  const { roles: memberRoles, signup, pages: pages2 } = members ?? {};
+  if (!Array.isArray(memberRoles) || memberRoles.some((r) => typeof r !== "string")) {
+    add("auth.members.roles", "must be an array of roles", "e.g. roles: ['customer']");
+    return;
+  }
+  for (const role of memberRoles) {
+    if (role === "admin") add("auth.members.roles", `can't include "admin"`);
+    else if (!roles.includes(role))
+      add("auth.members.roles", `"${role}" must be one of auth.roles too`);
+  }
+  if (signup !== void 0) {
+    const { role, verifyEmail: verifyEmail2, turnstile } = signup ?? {};
+    if (typeof role !== "string" || !memberRoles.includes(role))
+      add("auth.members.signup.role", "must be one of auth.members.roles");
+    if (verifyEmail2 !== void 0 && typeof verifyEmail2 !== "boolean")
+      add("auth.members.signup.verifyEmail", "must be true or false");
+    if (turnstile !== void 0 && (typeof turnstile?.siteKey !== "string" || typeof turnstile?.secretKey !== "string"))
+      add("auth.members.signup.turnstile", "needs siteKey and secretKey");
+  }
+  for (const [key2, value] of Object.entries(pages2 ?? {}))
+    if (value !== void 0 && typeof value !== "string")
+      add(`auth.members.pages.${key2}`, "must be a path or URL", "e.g. '/account/verify'");
+}
 function validateLocalization(config, add) {
   const localization = config.localization;
   if (localization !== void 0 && localization !== null) {
@@ -5257,14 +5515,19 @@ function validateWebhooks(config, add) {
     ...(config.collections ?? []).map((c) => c?.slug)
   ]);
   const globals = new Set((config.globals ?? []).map((g) => g?.slug));
+  const custom = new Set(config.events ?? []);
   for (const [i, hook] of hooks.entries()) {
     const path = `webhooks[${i}]`;
     if (typeof hook?.url !== "string" || !/^https?:\/\/\S+$/.test(hook.url)) {
       add(`${path}.url`, "must be an http(s) URL");
     }
     for (const event of hook?.events ?? []) {
-      if (!WEBHOOK_EVENTS.includes(event))
-        add(`${path}.events`, `unknown event "${event}"`, `use: ${WEBHOOK_EVENTS.join(", ")}`);
+      if (!WEBHOOK_EVENTS.includes(event) && !custom.has(event))
+        add(
+          `${path}.events`,
+          `unknown event "${event}"`,
+          `use: ${[...WEBHOOK_EVENTS, ...custom].join(", ")}`
+        );
     }
     for (const slug2 of hook?.collections ?? [])
       if (!collections.has(slug2)) add(`${path}.collections`, `unknown collection "${slug2}"`);
@@ -5458,8 +5721,12 @@ function validateContainer(container, path, collectionSlugs, add, { collection:
       const sidebar = admin.sidebar;
       if (sidebar !== void 0) validateComponents(sidebar, `${path}.admin.sidebar`, add);
       const group = admin.group;
-      if (group !== void 0 && group !== "settings")
-        add(`${path}.admin.group`, `must be 'settings' (got ${JSON.stringify(group)})`);
+      if (group !== void 0 && group !== "settings" && !(collection2 && typeof group === "string" && group !== "") && !(collection2 && typeof group === "object" && group !== null && Object.values(group).every((v) => typeof v === "string")))
+        add(
+          `${path}.admin.group`,
+          `must be 'settings' or a label (got ${JSON.stringify(group)})`,
+          "e.g. group: { en: 'Shop', th: '\u0E23\u0E49\u0E32\u0E19\u0E04\u0E49\u0E32' }"
+        );
       const list = admin.list;
       if (list !== void 0) validateList(list, container, `${path}.admin.list`, add);
       const owner = admin.ownerField;
@@ -5730,6 +5997,38 @@ function validateCommands(config, add) {
     if (typeof run !== "function") add(`${path}.run`, "must be a function");
   });
 }
+function validateJobs(config, add) {
+  const jobs = config.jobs;
+  if (jobs === void 0) return;
+  if (!Array.isArray(jobs)) {
+    add("jobs", "must be an array", "e.g. jobs: [{ name: 'shop:clean-up', every: 3600, run }]");
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  jobs.forEach((job, i) => {
+    const path = `jobs[${i}]`;
+    const { name, every, run } = job ?? {};
+    if (typeof name !== "string" || !/^[a-z][a-z0-9-]*(:[a-z0-9-]+)*$/.test(name))
+      add(`${path}.name`, "must be lowercase letters, digits, - and :", "e.g. 'shop:clean-up'");
+    else if (seen.has(name)) add(`${path}.name`, `"${name}" is already used by another job`);
+    else seen.add(name);
+    if (every !== void 0 && (typeof every !== "number" || !(every > 0)))
+      add(`${path}.every`, "must be a number of seconds above 0");
+    if (typeof run !== "function") add(`${path}.run`, "must be a function");
+  });
+}
+function validateEvents(config, add) {
+  const events = config.events;
+  if (events === void 0) return;
+  if (!Array.isArray(events)) {
+    add("events", "must be an array", "e.g. events: ['order.paid']");
+    return;
+  }
+  events.forEach((event, i) => {
+    if (typeof event !== "string" || !/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/.test(event))
+      add(`events[${i}]`, "must be named <area>.<what> in lowercase", "e.g. 'order.paid'");
+  });
+}
 function validateEndpoints(config, collectionSlugs, add) {
   const endpoints = config.endpoints;
   if (endpoints === void 0) return;
@@ -5909,7 +6208,8 @@ async function resolveConfig(input) {
       trustedOrigins: config.auth?.trustedOrigins ?? [],
       resetPasswordExpiration: config.auth?.resetPasswordExpiration ?? 60 * 60,
       inviteExpiration: config.auth?.inviteExpiration ?? 7 * 24 * 60 * 60,
-      emails: config.auth?.emails ?? {}
+      emails: config.auth?.emails ?? {},
+      members: config.auth?.members ?? { roles: [] }
     },
     audit: config.audit ? resolveAudit(config.audit === true ? {} : config.audit) : false,
     collections: [
@@ -5929,6 +6229,8 @@ async function resolveConfig(input) {
     globals: config.globals ?? [],
     endpoints: config.endpoints ?? [],
     commands: config.commands ?? [],
+    events: config.events ?? [],
+    jobs: config.jobs ?? [],
     installedPlugins: (plugins ?? []).map(
       (plugin) => typeof plugin === "function" && plugin.info ? { ...plugin.info } : {}
     ),
@@ -5968,7 +6270,7 @@ async function createEasyCMS(config, options = {}) {
     interactive: options.interactive ?? false
   });
   const cms = new EasyCMS(resolved3, db, logger, storage, cwd);
-  const scheduling = [...resolved3.collections, ...resolved3.globals].some((c) => c.schedule) || (resolved3.webhooks?.length ?? 0) > 0 || resolved3.email !== void 0;
+  const scheduling = [...resolved3.collections, ...resolved3.globals].some((c) => c.schedule) || (resolved3.webhooks?.length ?? 0) > 0 || resolved3.email !== void 0 || resolved3.jobs.length > 0;
   if (scheduling && options.scheduler !== false) cms.startScheduler();
   return cms;
 }
@@ -6050,8 +6352,10 @@ var EasyCMS = class {
       user,
       cms: this
     });
+    const changed = result?.user !== void 0 ? result.user : user;
     return {
-      user: result?.user !== void 0 ? result.user : user,
+      // `onRequest` may change the role (e.g. per tenant): membership follows it.
+      user: changed && asMember(changed, this.config.auth.members.roles),
       context: result?.context ?? NO_CONTEXT
     };
   }
@@ -6317,7 +6621,7 @@ var EasyCMS = class {
   /** A value with its HMAC (`secret`), for `purpose` only: `<base64url JSON>.<signature>`. */
   sign(purpose, value) {
     const payload = Buffer.from(JSON.stringify(value)).toString("base64url");
-    const mac = createHmac5("sha256", this.config.secret).update(`${purpose}:${payload}`);
+    const mac = createHmac6("sha256", this.config.secret).update(`${purpose}:${payload}`);
     return `${payload}.${mac.digest("base64url")}`;
   }
   /** The value of a token made by `sign`, or `undefined` when it isn't genuine. */
@@ -6325,10 +6629,10 @@ var EasyCMS = class {
     const [payload, signature] = String(token).split(".");
     if (!payload || !signature) return void 0;
     const expected = Buffer.from(
-      createHmac5("sha256", this.config.secret).update(`${purpose}:${payload}`).digest("base64url")
+      createHmac6("sha256", this.config.secret).update(`${purpose}:${payload}`).digest("base64url")
     );
     const given = Buffer.from(signature);
-    if (expected.length !== given.length || !timingSafeEqual4(expected, given)) return void 0;
+    if (expected.length !== given.length || !timingSafeEqual5(expected, given)) return void 0;
     try {
       return JSON.parse(Buffer.from(payload, "base64url").toString());
     } catch {
@@ -6447,10 +6751,10 @@ var EasyCMS = class {
     if (!signature || !Number.isInteger(at) || at < Date.now() / 1e3) return false;
     const expected = Buffer.from(this.mediaSignature(key2, at));
     const given = Buffer.from(signature);
-    return expected.length === given.length && timingSafeEqual4(expected, given);
+    return expected.length === given.length && timingSafeEqual5(expected, given);
   }
   mediaSignature(key2, expires) {
-    return createHmac5("sha256", this.config.secret).update(`media:${key2}:${expires}`).digest("base64url");
+    return createHmac6("sha256", this.config.secret).update(`media:${key2}:${expires}`).digest("base64url");
   }
   /**
    * How many documents use any of these files in a top-level upload field (rich text and fields
@@ -6574,6 +6878,17 @@ var EasyCMS = class {
   async update(collection2, id, data, options = {}) {
     return await this.updateDocument(collection2, id, asObject(data, collection2), options);
   }
+  /**
+   * Adds `by` (negative to take away) to a top-level number field in one database statement, so
+   * concurrent calls never lose a change, e.g. stock or a counter. Skips hooks, validation, access
+   * and versions. Returns the new value, or `null` when `min` / `max` would be passed.
+   */
+  async increment(collection2, id, field, by, options = {}) {
+    this.collection(collection2);
+    const parsed = parseId(id);
+    if (parsed === void 0) throw new NotFoundError(collection2, id);
+    return this.db.increment({ collection: collection2, id: parsed, field, by, ...options });
+  }
   /**
    * Takes a document off the site: its status becomes `draft`. With versions and drafts, a plain
    * `update` with `status: 'draft'` only saves a draft and leaves the published document live;
@@ -6846,7 +7161,7 @@ var EasyCMS = class {
         previousDoc: current,
         operation: "update"
       });
-      this.emit(config, "draft", draft);
+      this.emitChange(config, "draft", draft);
       await this.audited(config, "draft", draft, current, guard, mode);
       const [out2] = await this.output(config, [draft], guard, {
         ...options,
@@ -6874,11 +7189,9 @@ var EasyCMS = class {
         Object.assign(prepared, moved.patch);
       }
     }
-    const doc = await this.db.update({
-      collection: collection2,
-      id: parsed,
-      data: { ...prepared, createdAt: existing.createdAt, updatedAt: now }
-    });
+    const data = { ...prepared, createdAt: existing.createdAt, updatedAt: now };
+    const doc = options.where ? await this.db.update({ collection: collection2, id: parsed, data, where: options.where }) : await this.db.update({ collection: collection2, id: parsed, data });
+    if (!doc) return null;
     if (moved) await moved.cleanUp();
     if (collection2 === MEDIA_FOLDERS) {
       this.folders.invalidate();
@@ -6893,7 +7206,7 @@ var EasyCMS = class {
       previousDoc: current,
       operation: "update"
     });
-    this.emit(config, "update", doc, existing.status);
+    this.emitChange(config, "update", doc, existing.status);
     await this.audited(config, "update", doc, current, guard, mode);
     const [out] = await this.output(config, [doc], guard, { ...options, draft: true });
     return out;
@@ -6948,7 +7261,7 @@ var EasyCMS = class {
       id: parsed,
       doc: existing
     });
-    this.emit(config, "delete", existing);
+    this.emitChange(config, "delete", existing);
     await this.audited(config, "delete", existing, existing, guard);
     const [out] = await this.output(config, [existing], guard, { depth: 0, draft: true });
     return out;
@@ -7106,7 +7419,7 @@ var EasyCMS = class {
         previousDoc: current,
         operation: "update"
       });
-      this.emit(config, "draft", draft);
+      this.emitChange(config, "draft", draft);
       await this.audited(config, "draft", draft, current, guard, mode);
       return this.readGlobal(config, key2, guard, { ...options, draft: true });
     }
@@ -7118,7 +7431,7 @@ var EasyCMS = class {
       previousDoc: current,
       operation: "update"
     });
-    this.emit(config, "update", doc, existing.status);
+    this.emitChange(config, "update", doc, existing.status);
     await this.audited(config, "update", doc, current, guard, mode);
     return this.readGlobal(config, key2, guard, { ...options, draft: true });
   }
@@ -7231,10 +7544,45 @@ var EasyCMS = class {
       return {
         ...scheduled,
         webhooks: await this.retryWebhooks(now),
-        emails: await this.mailer.retry(now)
+        emails: await this.mailer.retry(now),
+        jobs: await this.runConfigJobs(now)
       };
     });
   }
+  /** `jobs` of the config that are due; when each last ran is kept in the database. */
+  async runConfigJobs(now) {
+    const { jobs } = this.config;
+    if (jobs.length === 0) return { ran: 0, failed: 0 };
+    const last = await this.db.findGlobal({ slug: JOB_RUNS }) ?? {};
+    const runs = {};
+    for (const [name, at] of Object.entries(last)) if (typeof at === "string") runs[name] = at;
+    let ran = 0;
+    let failed = 0;
+    for (const job of jobs) {
+      const previous = runs[job.name];
+      if (job.every !== void 0 && previous !== void 0 && now.getTime() - Date.parse(previous) < job.every * 1e3)
+        continue;
+      runs[job.name] = now.toISOString();
+      try {
+        await job.run({ cms: this, now });
+        ran++;
+      } catch (error) {
+        failed++;
+        this.logger.error(`Job ${job.name} failed: ${error.message}`);
+      }
+    }
+    await this.db.updateGlobal({ slug: JOB_RUNS, data: { ...runs, updatedAt: now.toISOString() } });
+    return { ran, failed };
+  }
+  /**
+   * Sends an event of the app or a plugin (`events` in the config, e.g. `order.paid`) to the
+   * webhooks that list it. Returns at once; deliveries are queued and retried like content changes.
+   */
+  emit(event, data, about) {
+    if (!this.config.events.includes(event))
+      throw new QueryError(`Unknown event "${event}": add it to \`events\` in the config`);
+    this.webhooks.emit(event, about ?? {}, data);
+  }
   /**
    * Tries webhook deliveries that are due for another attempt. Deliveries are kept in the
    * database until they succeed, so they survive restarts.
@@ -7744,7 +8092,7 @@ var EasyCMS = class {
       doc,
       operation: "create"
     });
-    this.emit(config, "create", doc);
+    this.emitChange(config, "create", doc);
     await this.audited(config, "create", doc, void 0, hookGuard ?? guard);
     const [out] = await this.output(config, [doc], hookGuard ?? guard, { ...options, draft: true });
     return out;
@@ -7802,7 +8150,7 @@ var EasyCMS = class {
     });
   }
   /** Sends webhook events for a change; `before` is the stored status before it, if any. */
-  emit(config, event, doc, before) {
+  emitChange(config, event, doc, before) {
     const isGlobal = !this.config.collections.includes(config);
     if (!isGlobal && INTERNAL_COLLECTIONS.has(config.slug)) return;
     const body = isGlobal ? { ...snapshotOf(config.fields, doc), updatedAt: doc.updatedAt } : {
@@ -8228,6 +8576,7 @@ var UPLOAD_URL_SECONDS = 15 * 60;
 var UPLOAD_TICKET_SECONDS = 24 * 60 * 60;
 var SNIFF_BYTES = 64 * 1024;
 var MAX_FILES_TO_MOVE = 200;
+var JOB_RUNS = "easy-cms:jobs";
 function durationSeconds(value) {
   const match = typeof value === "string" ? /^(\d+)\s*([smhd])$/.exec(value.trim()) : null;
   const seconds = typeof value === "number" ? value : match ? Number(match[1]) * { s: 1, m: 60, h: 3600, d: 86400 }[match[2]] : Number.NaN;
@@ -8619,7 +8968,9 @@ async function collection(cms, config, user, localized, roles, context) {
   if (config.useAsTitle) result.useAsTitle = config.useAsTitle;
   if (config.icon) result.icon = config.icon;
   if (config.admin?.sidebar?.length) result.sidebar = config.admin.sidebar.map(componentRef);
-  if (config.admin?.group === "settings" || SETTINGS.has(config.slug)) result.group = "settings";
+  const group = config.admin?.group;
+  if (group === "settings" || SETTINGS.has(config.slug)) result.group = "settings";
+  else if (group !== void 0) result.section = group;
   if (config.admin?.list?.tree) result.tree = config.admin.list.tree;
   if (config.admin?.list?.sort) result.defaultSort = config.admin.list.sort;
   if (config.admin?.confirmDelete) result.confirmDelete = { ...config.admin.confirmDelete };
@@ -8747,7 +9098,7 @@ function folderIds(cms, user, context) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.45.0" : "0.0.0-dev";
+var VERSION = true ? "0.46.0" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
 var DAY2 = 864e5;
@@ -9120,8 +9471,9 @@ async function route(cms, ctx, method, segments, options) {
     context: ctx.context,
     ...parseLocale(ctx.url)
   };
-  const draft = ctx.user !== null && ctx.url.searchParams.get("draft") === "true";
+  const draft = ctx.user !== null && ctx.user.member !== true && ctx.url.searchParams.get("draft") === "true";
   if (segments.length === 0) throw new HttpError("Not found", 404);
+  if (first === "admin" && ctx.user?.member === true) throw new ForbiddenError();
   if (first === "auth") return ssoRoute(cms, ctx, method, segments);
   if (first === USERS && second !== void 0 && third === void 0 && !/^\d+$/.test(second)) {
     switch (`${method} ${second}`) {
@@ -9194,6 +9546,45 @@ async function route(cms, ctx, method, segments, options) {
           body: { user: session.user, exp: session.expiresAt, csrfToken: session.csrfToken }
         };
       }
+      // Members signing up (`auth.members.signup`): the form's token, then the account.
+      case "GET signup":
+        return { body: cms.auth.signupForm() };
+      case "POST signup": {
+        const body = await readJson(ctx.request);
+        const result = await cms.auth.signup({
+          email: String(body.email ?? ""),
+          password: String(body.password ?? ""),
+          name: typeof body.name === "string" ? body.name : void 0,
+          token: body.token,
+          honeypot: body[SIGNUP_HONEYPOT],
+          turnstile: body.turnstile,
+          ip: options.getClientIp?.(ctx.request),
+          origin: ctx.url.origin,
+          locale: typeof body.locale === "string" ? body.locale : void 0,
+          context: ctx.context
+        });
+        if (result.verify)
+          return {
+            status: 202,
+            body: { verify: true, message: "Check your email for a link to confirm it." }
+          };
+        setSessionCookies(cms, ctx, result);
+        return {
+          status: 201,
+          body: { user: result.user, exp: result.expiresAt, csrfToken: result.csrfToken }
+        };
+      }
+      case "POST verify-email": {
+        const body = await readJson(ctx.request);
+        const session = await cms.auth.verifyEmail({
+          token: String(body.token ?? ""),
+          ip: options.getClientIp?.(ctx.request)
+        });
+        setSessionCookies(cms, ctx, session);
+        return {
+          body: { user: session.user, exp: session.expiresAt, csrfToken: session.csrfToken }
+        };
+      }
       case "POST first-register": {
         const body = await readJson(ctx.request);
         const session = await cms.auth.registerFirstUser({
@@ -10318,6 +10709,7 @@ export {
   anyone,
   applyDefaults,
   applyPlugins,
+  checkFormToken,
   configSignature,
   consoleEmail,
   consoleLogger,
@@ -10332,15 +10724,18 @@ export {
   expandMimeTypes,
   fillMissing,
   findConfigFile,
+  formToken,
   generateSlugs,
   generateTypes,
   hasRows,
   hashPassword,
+  honeypotName,
   imageDimensions,
   importConfig,
   isAdmin,
   isHasMany,
   isLoggedIn,
+  isSignedIn,
   isSystemAdmin,
   keyAllows,
   loadConfig,
@@ -10350,6 +10745,7 @@ export {
   mimeAllowedBy,
   parseId,
   populate,
+  rateKeys,
   readCookie,
   resolveAdminModule,
   resolveConfig,
@@ -10363,5 +10759,6 @@ export {
   validateConfig,
   validateFields,
   verifyPassword,
+  verifyTurnstile,
   writeBackupFile
 };