@easy-cms/core 0.47.3 → 0.48.0

package/dist/index.d.ts

@@ -137,7 +137,7 @@ interface UserIdentity {
     lastUsedAt: string | null;
 }
 /** Why a sign-in did not work, as `?sso=` on the page it ends on. */
-type SsoOutcome = 'linked' | 'cancelled' | 'expired' | 'failed' | 'no-account' | 'unverified' | 'inactive' | 'taken';
+type SsoOutcome = 'linked' | 'cancelled' | 'expired' | 'failed' | 'no-account' | 'link-first' | 'unverified' | 'inactive' | 'taken';
 /** Single sign-on with `auth.providers`. Available as `cms.auth.sso`. */
 declare class SingleSignOn {
     private readonly cms;
@@ -195,6 +195,8 @@ declare class SingleSignOn {
     private userByEmail;
     /** A new account for people from `allowSignUp.domains`. */
     private signUp;
+    /** A site member (`auth.members`): matched by email, like any shop or site account. */
+    private isMember;
     private defaultRole;
 }
 
@@ -287,6 +289,12 @@ declare class Auth {
      */
     private memberLink;
     hasUsers(): Promise<boolean>;
+    private warnedNoClientIp;
+    /**
+     * Without the client's address, failed logins count per email only, so anyone can lock an
+     * account for a while. Said once, in production.
+     */
+    private warnNoClientIp;
     /** Ends the session for a signed token. Unknown tokens are ignored. */
     logout(signedToken: string): Promise<void>;
     /**
@@ -1225,6 +1233,8 @@ declare class MediaFolders {
 interface StoredFile {
     readonly body: Uint8Array;
     readonly size: number;
+    /** The type the storage serves the file with, when it says (checked after direct uploads). */
+    readonly contentType?: string;
 }
 /** Where uploaded files live. Keys are generated by Easy CMS: `<name>-<random>.<ext>`. */
 interface StorageAdapter {
@@ -1633,6 +1643,11 @@ declare class EasyCMS<C extends Config = Config> {
     /** The global's pending draft when it has one (see `withDrafts`), otherwise `saved`. */
     private globalDraft;
     private saveGlobal;
+    /**
+     * Users changing their own password or email say their current password first, so a session
+     * someone else got hold of can't lock them out. Admins changing other users don't.
+     */
+    private checkOwnCredentials;
     /**
      * What `user` may do with one document. Resolves `where`-style access
      * against the document, so the admin UI can hide actions precisely.
@@ -2066,7 +2081,10 @@ interface BlocksField extends BaseField<'blocks', never> {
 declare const uniqueWithinOf: (field: Field) => readonly string[];
 /** Fields with `hasMany`: their value is a list of options, documents or files. */
 declare const isHasMany: (field: Field) => boolean;
-/** Whether a MIME type is one of `patterns` (`image/*` matches every image). */
+/**
+ * Whether a MIME type is one of `patterns` (`image/*` matches every image but SVG, which can
+ * carry scripts and is allowed only when listed by name: `image/svg+xml`).
+ */
 declare function mimeAllowedBy(mimeType: string, patterns: readonly string[]): boolean;
 /** Fields whose value is a list of rows: `array` and `blocks`. */
 declare const hasRows: (field: Field) => field is ArrayField | BlocksField;
@@ -2286,6 +2304,12 @@ interface AuthProvider {
     }): Promise<AuthProviderProfile>;
     /** For Settings → SSO: what it connects to, never secrets. */
     describe?(): Readonly<Record<string, string>>;
+    /**
+     * Signs staff who have an account in by their verified email the first time, without linking
+     * the provider from their account page. Only for a provider whose emails your organization
+     * controls (e.g. its Google Workspace). Default `false`; site members are always matched.
+     */
+    readonly linkByEmail?: boolean;
 }
 
 interface ConfigIssue {
@@ -2957,6 +2981,8 @@ interface EndpointRequest {
     readonly cms: EasyCMS;
     /** The request's JSON body, which must be an object (at most 1 MB). */
     json(): Promise<Record<string, unknown>>;
+    /** The request's body as text, as sent (at most 1 MB), e.g. to check a webhook's signature. */
+    text(): Promise<string>;
 }
 /**
  * Work that runs with the scheduled jobs: every minute in a server, or each time a cron calls
@@ -3373,9 +3399,20 @@ interface ApiHandlerOptions {
      * Takes precedence over `trustProxy`.
      */
     readonly getClientIp?: (request: Request) => string | undefined;
-    /** Use the first `X-Forwarded-For` address. Only behind a proxy you trust (Vercel, Netlify…). */
+    /**
+     * Behind a proxy that adds the client's address to `X-Forwarded-For`: the last address in it
+     * (the one the proxy added; earlier ones come from the client and can say anything). Vercel
+     * and Netlify are recognized without it.
+     */
     readonly trustProxy?: boolean;
 }
+/**
+ * The client's address from `X-Forwarded-For` as the nearest proxy wrote it: its last entry.
+ * Earlier entries were sent by the client, so they can't be trusted.
+ */
+declare function forwardedClientIp(value: string | null | undefined): string | undefined;
+/** The client's address on hosting platforms that set it themselves: Vercel, Netlify. */
+declare function platformClientIp(headers: Headers): string | undefined;
 /**
  * The REST API as a `(Request) => Response` handler for a framework's route, on the shared
  * instance (`sharedEasyCMS`). Mount it at `routes.api` (default `/api/cms`), for every method.
@@ -3414,7 +3451,10 @@ declare function expandMimeTypes(patterns: readonly string[]): string[];
  * tells CSV from plain text, which have the same contents.
  */
 declare function sniffMimeType(data: Uint8Array, name?: string): string | undefined;
-/** `image/*` style matching; group names (`documents`…) stand for their types. */
+/**
+ * `image/*` style matching; group names (`documents`…) stand for their types. A wildcard leaves
+ * out SVG, which can carry scripts: it is allowed only when listed as `image/svg+xml`.
+ */
 declare function mimeAllowed(type: string, allowed: readonly string[]): boolean;
 /** Width and height of PNG, GIF, JPEG and WebP images without decoding them. */
 declare function imageDimensions(data: Uint8Array, type: string): {
@@ -3925,4 +3965,4 @@ declare function validateConfig(config: Config): ConfigIssue[];
 /** The version of `@easy-cms/core`, set when the package is built. */
 declare const VERSION: string;
 
-export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminAttention, type AdminBackup, type AdminBackups, type AdminBrand, type AdminCollection, type AdminCommand, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminDeliveries, type AdminDelivery, type AdminEmail, type AdminEmailDelivery, type AdminField, type AdminFieldArgs, type AdminGlobal, type AdminIcon, type AdminLayoutNode, type AdminLocale, type AdminNavGroup, type AdminNavItem, type AdminNavNode, type AdminPage, type AdminPageRef, type AdminRole, type AdminRoleChange, type AdminRoleField, type AdminRoleTarget, type AdminRoleView, type AdminRoles, type AdminSchema, type AdminSso, type AdminStatus, type AdminSwitcher, type AdminViewAccess, type AdminWebhookDelivery, type AdminWidgetRef, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiHandlerOptions, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, type AuditChange, type AuditConfig, type AuditEntry, AuditLog, type AuditPage, type AuditVerification, Auth, type AuthConfig, type AuthProvider, type AuthProviderProfile, type AuthProviderRequest, type AuthUser, BUILTIN_COLLECTIONS, BUILTIN_NAV, type BackupState, type BackupsConfig, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinMediaFoldersCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, type CustomField, type CustomFieldTypes, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_PASSWORD_EMAILS, DEFAULT_TOKEN_EXPIRATION, type DashboardWidget, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DeliveryKind, type DeliveryState, type DepthOptions, type DirectUpload, type DocumentOf, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailCheck, type EmailField, type EmailMessage, type EmailSetting, type Endpoint, type EndpointRequest, FIELD_TYPES, FIELD_TYPE_BASES, FOLDER_LEVELS, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, FieldCondition, type FieldError, type FieldRule, type FieldType, type FieldTypeBase, type FieldTypeDefinition, type FieldTypeValidateContext, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, type FolderLevel, type FolderPermissions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type IncrementOptions, type InferCollection, type InferGlobal, type JobConfig, type JsonField, type Label, type LayoutNode, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MEDIA_FOLDERS, MIME_GROUPS, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, MediaFolders, type MediaSize, type MembersConfig, type MembersSignup, type MigrationInfo, type NavGroup, NotFoundError, type NumberField, type OnRequest, type OnRequestArgs, type Operation, type PaginatedDocs, type PasswordEmail, type PasswordEmailArgs, type PasswordEmailFn, type PasswordLinkOptions, PayloadTooLargeError, type Plugin, type PluginInfo, type PluginTypes, type PreviewTarget, type PreviewURL, QueryError, ROLE_OPERATIONS, type RawDocument, type ReadOptions, type RelationshipField, type RequestContext, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoleOperation, type RolePermissions, Roles, type RoutesConfig, SESSION_COOKIE, SSO_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SearchHit, type SelectField, type SelectOption, type Session, type SidebarPanel, type SignupArgs, type SignupResult, type SlugField, type SlugOf, type SsoOutcome, type SsoProviderRef, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, type TypedPlugin, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, type UploadFromURLConfig, type UserIdentity, VERSION, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, checkFormToken, configSignature, consoleEmail, consoleLogger, copyDatabase, createApiHandler, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, defineFieldType, definePlugin, expandMimeTypes, fillMissing, findConfigFile, formToken, generateSlugs, generateTypes, hasRows, hashPassword, honeypotName, imageDimensions, importConfig, isAdmin, isHasMany, isLoggedIn, isSignedIn, isSystemAdmin, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, mimeAllowedBy, parseId, populate, rateKeys, readCookie, resolveAdminModule, resolveConfig, rowFields, sharedEasyCMS, silentLogger, singularize, slugify, sniffMimeType, uniqueWithinOf, validateConfig, validateFields, verifyPassword, verifyTurnstile, writeBackupFile };
+export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminAttention, type AdminBackup, type AdminBackups, type AdminBrand, type AdminCollection, type AdminCommand, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminDeliveries, type AdminDelivery, type AdminEmail, type AdminEmailDelivery, type AdminField, type AdminFieldArgs, type AdminGlobal, type AdminIcon, type AdminLayoutNode, type AdminLocale, type AdminNavGroup, type AdminNavItem, type AdminNavNode, type AdminPage, type AdminPageRef, type AdminRole, type AdminRoleChange, type AdminRoleField, type AdminRoleTarget, type AdminRoleView, type AdminRoles, type AdminSchema, type AdminSso, type AdminStatus, type AdminSwitcher, type AdminViewAccess, type AdminWebhookDelivery, type AdminWidgetRef, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiHandlerOptions, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, type AuditChange, type AuditConfig, type AuditEntry, AuditLog, type AuditPage, type AuditVerification, Auth, type AuthConfig, type AuthProvider, type AuthProviderProfile, type AuthProviderRequest, type AuthUser, BUILTIN_COLLECTIONS, BUILTIN_NAV, type BackupState, type BackupsConfig, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinMediaFoldersCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, type CustomField, type CustomFieldTypes, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_PASSWORD_EMAILS, DEFAULT_TOKEN_EXPIRATION, type DashboardWidget, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DeliveryKind, type DeliveryState, type DepthOptions, type DirectUpload, type DocumentOf, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailCheck, type EmailField, type EmailMessage, type EmailSetting, type Endpoint, type EndpointRequest, FIELD_TYPES, FIELD_TYPE_BASES, FOLDER_LEVELS, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, FieldCondition, type FieldError, type FieldRule, type FieldType, type FieldTypeBase, type FieldTypeDefinition, type FieldTypeValidateContext, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, type FolderLevel, type FolderPermissions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type IncrementOptions, type InferCollection, type InferGlobal, type JobConfig, type JsonField, type Label, type LayoutNode, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MEDIA_FOLDERS, MIME_GROUPS, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, MediaFolders, type MediaSize, type MembersConfig, type MembersSignup, type MigrationInfo, type NavGroup, NotFoundError, type NumberField, type OnRequest, type OnRequestArgs, type Operation, type PaginatedDocs, type PasswordEmail, type PasswordEmailArgs, type PasswordEmailFn, type PasswordLinkOptions, PayloadTooLargeError, type Plugin, type PluginInfo, type PluginTypes, type PreviewTarget, type PreviewURL, QueryError, ROLE_OPERATIONS, type RawDocument, type ReadOptions, type RelationshipField, type RequestContext, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoleOperation, type RolePermissions, Roles, type RoutesConfig, SESSION_COOKIE, SSO_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SearchHit, type SelectField, type SelectOption, type Session, type SidebarPanel, type SignupArgs, type SignupResult, type SlugField, type SlugOf, type SsoOutcome, type SsoProviderRef, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, type TypedPlugin, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, type UploadFromURLConfig, type UserIdentity, VERSION, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, checkFormToken, configSignature, consoleEmail, consoleLogger, copyDatabase, createApiHandler, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, defineFieldType, definePlugin, expandMimeTypes, fillMissing, findConfigFile, formToken, forwardedClientIp, generateSlugs, generateTypes, hasRows, hashPassword, honeypotName, imageDimensions, importConfig, isAdmin, isHasMany, isLoggedIn, isSignedIn, isSystemAdmin, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, mimeAllowedBy, parseId, platformClientIp, populate, rateKeys, readCookie, resolveAdminModule, resolveConfig, rowFields, sharedEasyCMS, silentLogger, singularize, slugify, sniffMimeType, uniqueWithinOf, validateConfig, validateFields, verifyPassword, verifyTurnstile, writeBackupFile };

package/dist/index.js

@@ -1112,7 +1112,7 @@ function sniffMimeType(data, name = "") {
 }
 function mimeAllowed(type, allowed2) {
   return expandMimeTypes(allowed2).some(
-    (pattern) => pattern.endsWith("/*") ? type.startsWith(pattern.slice(0, -1)) : pattern === type
+    (pattern) => pattern.endsWith("/*") ? type.startsWith(pattern.slice(0, -1)) && type !== "image/svg+xml" : pattern === type
   );
 }
 function imageDimensions(data, type) {
@@ -1190,9 +1190,10 @@ function mimeAllowedBy(mimeType, patterns) {
   const type = mimeType.toLowerCase();
   return expandMimeTypes(patterns).some((pattern) => {
     const p = pattern.toLowerCase();
-    return p.endsWith("/*") ? type.startsWith(p.slice(0, -1)) : type === p;
+    return p.endsWith("/*") ? type.startsWith(p.slice(0, -1)) && type !== SVG : type === p;
   });
 }
+var SVG = "image/svg+xml";
 var hasRows = (field) => field.type === "array" || field.type === "blocks";
 function rowFields(field, row) {
   if (field.type === "array") return field.fields;
@@ -1690,6 +1691,16 @@ var SingleSignOn = class {
       if (!email2 || !profile.emailVerified)
         return await back("login", email2 ? "unverified" : "no-account");
       user = await this.userByEmail(email2);
+      if (user && !this.isMember(user) && provider.linkByEmail !== true)
+        return await back("login", "link-first");
+      if (user && user.emailVerified === false) {
+        const { id, ...rest } = user;
+        user = await this.cms.db.update({
+          collection: USERS,
+          id,
+          data: { ...rest, emailVerified: true, passwordHash: null }
+        });
+      }
       if (!user) user = await this.signUp(email2, profile.name);
       if (!user) return await back("login", "no-account");
       await this.addIdentity(user.id, provider.id, subject, email2);
@@ -1742,7 +1753,7 @@ var SingleSignOn = class {
     const row = await this.cms.db.findById({ collection: USER_IDENTITIES, id: identityId });
     if (!row) throw new NotFoundError(USER_IDENTITIES, identityId);
     const own = String(row.user) === String(actor.id);
-    if (!own && (actor.role !== "admin" || actor.apiKey)) throw new ForbiddenError();
+    if (!own && (!isSystemAdmin(actor) || actor.apiKey)) throw new ForbiddenError();
     const user = await this.cms.db.findById({ collection: USERS, id: row.user });
     const others = (await this.identities(row.user)).length - 1;
     const password = !!user?.passwordHash && this.passwordAllowed(user);
@@ -1834,6 +1845,10 @@ var SingleSignOn = class {
     this.cms.logger.info(`${email2} signed up with a provider`);
     return this.cms.db.findById({ collection: USERS, id: created.id });
   }
+  /** A site member (`auth.members`): matched by email, like any shop or site account. */
+  isMember(user) {
+    return (this.config.auth.members?.roles ?? []).includes(String(user.role));
+  }
   defaultRole() {
     const roles = this.config.auth.roles;
     return roles.includes("editor") ? "editor" : roles[roles.length - 1];
@@ -1872,6 +1887,7 @@ var Auth = class {
     const email2 = typeof args.email === "string" ? args.email.trim().toLowerCase() : "";
     const password = typeof args.password === "string" ? args.password : "";
     const key2 = `${email2}|${args.ip ?? ""}`;
+    if (args.ip === void 0) this.warnNoClientIp();
     try {
       await this.checkRateLimit(key2);
     } catch (error) {
@@ -1994,8 +2010,16 @@ var Auth = class {
       throw new QueryError("Signing up needs `email` in the config, and a site URL in production");
     const existing = email2 ? await this.findByEmail(email2) : void 0;
     if (existing && verify) {
-      if (existing.emailVerified === false && existing.active !== false)
-        await this.mailVerifyLink(existing, args);
+      if (existing.emailVerified === false && existing.active !== false) {
+        await this.cms.update(USERS, existing.id, { password: args.password }, {
+          context: args.context ?? {}
+        });
+        const pending = await this.db.findById({
+          collection: USERS,
+          id: existing.id
+        });
+        await this.mailVerifyLink(pending, args);
+      }
       return { verify: true };
     }
     const created = await this.cms.create(
@@ -2030,14 +2054,15 @@ var Auth = class {
     const claims = readPasswordToken(token);
     const id = claims && (/^\d+$/.test(claims.userId) ? Number(claims.userId) : claims.userId);
     const user = claims && claims.purpose === "verify" && claims.expiresAt > Date.now() && id !== null ? await this.db.findById({ collection: USERS, id }) : null;
-    if (!user || user.active === false || !passwordTokenMatches(this.config.secret, token, passwordFingerprint(user.passwordHash))) {
+    if (!user || user.active === false || // A link confirms once: it doesn't sign in again afterwards.
+    user.emailVerified !== false || !passwordTokenMatches(this.config.secret, token, passwordFingerprint(user.passwordHash))) {
       await this.recordFailure(key2);
       throw new ValidationError(USERS, [
         { field: "token", message: "This link has expired or is not valid" }
       ]);
     }
     await this.clearFailures(key2);
-    if (user.emailVerified === false) {
+    {
       const { id: _id, ...rest } = user;
       await this.db.update({
         collection: USERS,
@@ -2086,6 +2111,18 @@ var Auth = class {
   async hasUsers() {
     return await this.db.count({ collection: USERS }) > 0;
   }
+  warnedNoClientIp = false;
+  /**
+   * Without the client's address, failed logins count per email only, so anyone can lock an
+   * account for a while. Said once, in production.
+   */
+  warnNoClientIp() {
+    if (this.warnedNoClientIp || process.env.NODE_ENV !== "production") return;
+    this.warnedNoClientIp = true;
+    this.cms.logger.warn(
+      "Easy CMS doesn't know the client's IP address, so logins are rate limited per email only. Behind a proxy that sets X-Forwarded-For, set `trustProxy: true` in the adapter."
+    );
+  }
   /** Ends the session for a signed token. Unknown tokens are ignored. */
   async logout(signedToken) {
     const token = unsignToken(this.config.secret, signedToken);
@@ -3988,12 +4025,41 @@ for (const [net, prefix] of [
   ["ff00::", 8]
 ])
   PRIVATE.addSubnet(net, prefix, "ipv6");
+var EMBEDS_IPV4 = new BlockList();
+EMBEDS_IPV4.addSubnet("64:ff9b::", 96, "ipv6");
+EMBEDS_IPV4.addSubnet("::", 96, "ipv6");
+function embeddedIPv4(address) {
+  if (address === "::" || address === "::1" || !EMBEDS_IPV4.check(address, "ipv6")) return void 0;
+  const bytes = ipv6Bytes(address);
+  return bytes ? bytes.slice(12).join(".") : void 0;
+}
+function ipv6Bytes(address) {
+  let text2 = address;
+  const tail = /(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(text2);
+  if (tail) {
+    const [a, b, c, d] = tail.slice(1).map(Number);
+    text2 = `${text2.slice(0, tail.index)}${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
+  }
+  const [head = "", rest] = text2.split("::");
+  const left = head ? head.split(":") : [];
+  const right = rest === void 0 ? [] : rest ? rest.split(":") : [];
+  const groups = rest === void 0 ? left : [...left, ...Array(8 - left.length - right.length).fill("0"), ...right];
+  if (groups.length !== 8) return void 0;
+  return groups.flatMap((g) => {
+    const n = Number.parseInt(g, 16);
+    return [n >> 8, n & 255];
+  });
+}
 function isPrivateAddress(address) {
   const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(address);
   if (mapped?.[1]) return PRIVATE.check(mapped[1], "ipv4");
   const family = isIP(address);
   if (family === 4) return PRIVATE.check(address, "ipv4");
-  if (family === 6) return PRIVATE.check(address, "ipv6");
+  if (family === 6) {
+    const embedded = embeddedIPv4(address);
+    if (embedded) return PRIVATE.check(embedded, "ipv4");
+    return PRIVATE.check(address, "ipv6");
+  }
   return true;
 }
 function hostAllowed(host, allowedHosts) {
@@ -4363,6 +4429,7 @@ var Roles = class {
   async canView(user, id) {
     if (isSystemAdmin(user)) return true;
     if (user.apiKey) return false;
+    if (id === "deliveries" && user.scoped === true) return false;
     if (id === "audit" && user.role === "admin" && user.scoped === true && this.config.audit !== false && typeof this.config.audit.scope === "function")
       return true;
     if (!this.enabled) return id.startsWith("page:") || id.startsWith("widget:");
@@ -5202,8 +5269,13 @@ function validateSecret(secret, add) {
     );
   } else if (secret.length < MIN_SECRET_LENGTH) {
     add("secret", `must be at least ${MIN_SECRET_LENGTH} characters (got ${secret.length})`, hint);
+  } else if (process.env.NODE_ENV === "production" && guessable(secret)) {
+    add("secret", "looks like an example or a repeated pattern, not a random string", hint);
   }
 }
+function guessable(secret) {
+  return /change[-_ ]?me|example|placeholder|secret-?key/i.test(secret) || new Set(secret).size < 8;
+}
 function validateAdmin(config, add) {
   const admin = config.admin;
   if (admin === void 0) return;
@@ -6584,9 +6656,10 @@ var EasyCMS = class {
     if (!Number.isInteger(limit) || limit < 0)
       throw new QueryError("limit must be a non-negative integer");
     if (!Number.isInteger(page) || page < 1) throw new QueryError("page must be a positive integer");
+    const draft = readsDrafts(guard, options.draft);
     const where = this.whereFor(
       config,
-      draftWhere(config, options.draft, await this.readWhere(config, guard, options.where)),
+      draftWhere(config, draft, await this.readWhere(config, guard, options.where)),
       options
     );
     const requested = options.sort === void 0 ? ["-createdAt"] : [options.sort].flat();
@@ -6599,8 +6672,8 @@ var EasyCMS = class {
       this.config.localization?.locales ?? []
     );
     const result = await this.db.find({ collection: collection2, where, sort, limit, page });
-    const found = options.draft ? await this.withDrafts(config, result.docs) : result.docs;
-    const docs = await this.output(config, found, guard, options);
+    const found = draft ? await this.withDrafts(config, result.docs) : result.docs;
+    const docs = await this.output(config, found, guard, { ...options, draft });
     return { ...result, docs };
   }
   async findById(collection2, id, options = {}) {
@@ -6608,9 +6681,10 @@ var EasyCMS = class {
     const guard = guardOf(options);
     const parsed = parseId(id);
     if (parsed === void 0) return null;
+    const draft = readsDrafts(guard, options.draft);
     const where = this.whereFor(
       config,
-      draftWhere(config, options.draft, await this.readWhere(config, guard, void 0)),
+      draftWhere(config, draft, await this.readWhere(config, guard, void 0)),
       options
     );
     const doc = where ? (await this.db.find({
@@ -6621,8 +6695,8 @@ var EasyCMS = class {
       page: 1
     })).docs[0] : await this.db.findById({ collection: collection2, id: parsed });
     if (!doc) return null;
-    const [current] = options.draft ? await this.withDrafts(config, [doc]) : [doc];
-    const [out] = await this.output(config, [current], guard, options);
+    const [current] = draft ? await this.withDrafts(config, [doc]) : [doc];
+    const [out] = await this.output(config, [current], guard, { ...options, draft });
     return out ?? null;
   }
   async count(collection2, options = {}) {
@@ -6631,7 +6705,7 @@ var EasyCMS = class {
       config,
       draftWhere(
         config,
-        options.draft,
+        readsDrafts(guardOf(options), options.draft),
         await this.readWhere(config, guardOf(options), options.where)
       ),
       options
@@ -6782,6 +6856,8 @@ var EasyCMS = class {
     const mimeType = sniffMimeType(start.body.subarray(0, SNIFF_BYTES), t.name);
     if (mimeType !== t.type)
       await refuse(`contains ${mimeType ?? "an unknown type"}, not ${t.type}`);
+    const served = start.contentType?.split(";")[0]?.trim().toLowerCase();
+    if (served && served !== t.type) await refuse(`is stored as ${served}, not ${t.type}`);
     const stored = [];
     try {
       let dimensions;
@@ -7333,6 +7409,7 @@ var EasyCMS = class {
       raw = rest;
     }
     const { input, password } = splitPassword(config, raw);
+    if (config.slug === USERS) await this.checkOwnCredentials(guard, existing, raw, password);
     const filtered = await filterInput(
       config.fields,
       input,
@@ -7492,7 +7569,7 @@ var EasyCMS = class {
   /** A global as stored under `key` (see `globalKey`); empty when there is no key. */
   async readGlobal(config, key2, guard, options) {
     const saved = key2 ? await this.db.findGlobal({ slug: key2 }) : null;
-    const stored = saved && options.draft ? await this.globalDraft(config, saved, key2) : saved;
+    const stored = saved && readsDrafts(guard, options.draft) ? await this.globalDraft(config, saved, key2) : saved;
     const data = fillMissing(
       config.fields,
       applyDefaults(config.fields, stored ?? {}, this.config.localization)
@@ -7652,6 +7729,33 @@ var EasyCMS = class {
     await this.audited(config, "update", doc, current, guard, mode);
     return this.readGlobal(config, key2, guard, { ...options, draft: true });
   }
+  /**
+   * Users changing their own password or email say their current password first, so a session
+   * someone else got hold of can't lock them out. Admins changing other users don't.
+   */
+  async checkOwnCredentials(guard, existing, raw, password) {
+    const user = guard.user;
+    if (!guard.enforce || !user || user.apiKey || String(user.id) !== String(existing.id)) return;
+    const email2 = typeof raw.email === "string" ? raw.email.trim().toLowerCase() : void 0;
+    const emailChanges = email2 !== void 0 && email2 !== String(existing.email ?? "").toLowerCase();
+    if (password === void 0 && !emailChanges) return;
+    const hash = typeof existing.passwordHash === "string" ? existing.passwordHash : void 0;
+    if (!hash) {
+      if (emailChanges)
+        throw new ValidationError(USERS, [
+          { field: "email", message: "can't be changed on an account without a password" }
+        ]);
+      return;
+    }
+    const current = typeof raw.currentPassword === "string" ? raw.currentPassword : "";
+    if (!current || !await verifyPassword(current, hash))
+      throw new ValidationError(USERS, [
+        {
+          field: "currentPassword",
+          message: current ? "is not right" : "is required to change your password or email"
+        }
+      ]);
+  }
   /**
    * What `user` may do with one document. Resolves `where`-style access
    * against the document, so the admin UI can hide actions precisely.
@@ -8220,6 +8324,7 @@ var EasyCMS = class {
       );
       return await stripFields(target.fields, hooked, read2);
     };
+    const drafts = readsDrafts(guard, options.draft);
     const load = async (target, ids) => {
       const where = await this.readWhere(target, guard, { id: { in: [...ids] } }).catch((error) => {
         if (error instanceof ForbiddenError || error instanceof UnauthorizedError) return null;
@@ -8228,12 +8333,12 @@ var EasyCMS = class {
       if (where === null) return [];
       const found = await this.db.find({
         collection: target.slug,
-        where: this.whereFor(target, draftWhere(target, options.draft, where), options),
+        where: this.whereFor(target, draftWhere(target, drafts, where), options),
         sort: [],
         limit: 0,
         page: 1
       });
-      const docs2 = options.draft ? await this.withDrafts(target, found.docs) : found.docs;
+      const docs2 = drafts ? await this.withDrafts(target, found.docs) : found.docs;
       return Promise.all(
         docs2.map((d) => finish(target, this.pick(target, d, options)))
       );
@@ -8761,12 +8866,17 @@ function guardOf(options) {
     context: options.context ?? NO_CONTEXT
   };
 }
+function readsDrafts(guard, draft) {
+  return draft === true && (!guard.enforce || guard.user !== null && guard.user.member !== true);
+}
 function deny(user) {
   return user ? new ForbiddenError() : new UnauthorizedError();
 }
 function splitPassword(config, raw) {
-  if (config.slug !== USERS || !Object.hasOwn(raw, "password")) return { input: raw };
-  const { password, ...input } = raw;
+  if (config.slug !== USERS) return { input: raw };
+  const { currentPassword: _current, ...rest } = raw;
+  if (!Object.hasOwn(rest, "password")) return { input: rest };
+  const { password, ...input } = rest;
   if (password === void 0 || password === null || password === "") return { input };
   if (typeof password !== "string" || password.length < MIN_PASSWORD_LENGTH) {
     throw new ValidationError(USERS, [
@@ -9517,7 +9627,7 @@ async function adminSearch(cms, who, q, perCollection = 5) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.47.3" : "0.0.0-dev";
+var VERSION = true ? "0.48.0" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
 var DAY2 = 864e5;
@@ -9860,7 +9970,8 @@ async function customEndpoint(cms, ctx, method, segments, root, options) {
       context: ctx.context,
       ip: options.getClientIp?.(ctx.request),
       cms,
-      json: () => readJson(ctx.request)
+      json: () => readJson(ctx.request),
+      text: async () => new TextDecoder().decode(await readBody(ctx.request, MAX_BODY_BYTES))
     });
     return { body: body === void 0 ? null : body };
   }
@@ -10703,12 +10814,16 @@ async function readUpload(request, maxFileSize) {
       415
     );
   }
-  const declared = Number(request.headers.get("content-length") ?? 0);
-  if (declared > maxFileSize + 64 * 1024)
-    throw new PayloadTooLargeError(`File is larger than ${maxFileSize} bytes`);
+  const bytes = await readBody(request, maxFileSize + 64 * 1024).catch((error) => {
+    throw error instanceof HttpError && error.status === 413 ? new PayloadTooLargeError(`File is larger than ${maxFileSize} bytes`) : error;
+  });
   let form;
   try {
-    form = await request.formData();
+    form = await new Request(request.url, {
+      method: "POST",
+      headers: { "content-type": request.headers.get("content-type") ?? "" },
+      body: bytes
+    }).formData();
   } catch {
     throw new HttpError("Malformed multipart body", 400);
   }
@@ -10724,15 +10839,37 @@ async function readUpload(request, maxFileSize) {
     data
   };
 }
+async function readBody(request, max) {
+  const tooLarge = () => new HttpError("Request body too large", 413);
+  if (Number(request.headers.get("content-length") ?? 0) > max) throw tooLarge();
+  if (!request.body) return new Uint8Array();
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > max) {
+      reader.releaseLock();
+      throw tooLarge();
+    }
+    chunks.push(value);
+  }
+  const body = new Uint8Array(size);
+  let at = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, at);
+    at += chunk.byteLength;
+  }
+  return body;
+}
 async function readJson(request) {
   const type = request.headers.get("content-type") ?? "";
   if (!type.toLowerCase().startsWith("application/json")) {
     throw new HttpError("Content-Type must be application/json", 415);
   }
-  const declared = Number(request.headers.get("content-length") ?? 0);
-  if (declared > MAX_BODY_BYTES) throw new HttpError("Request body too large", 413);
-  const text2 = await request.text();
-  if (Buffer.byteLength(text2) > MAX_BODY_BYTES) throw new HttpError("Request body too large", 413);
+  const text2 = new TextDecoder().decode(await readBody(request, MAX_BODY_BYTES));
   let body;
   try {
     body = JSON.parse(text2);
@@ -10860,9 +10997,19 @@ function sharedEasyCMS(config, options) {
   });
   return promise;
 }
+function forwardedClientIp(value) {
+  const last = value?.split(",").map((part) => part.trim()).filter(Boolean).at(-1);
+  return last || void 0;
+}
+function platformClientIp(headers) {
+  if (process.env.VERCEL)
+    return headers.get("x-real-ip") ?? forwardedClientIp(headers.get("x-forwarded-for"));
+  if (process.env.NETLIFY) return headers.get("x-nf-client-connection-ip") ?? void 0;
+  return void 0;
+}
 function createApiHandler(config, options = {}) {
   const handlers = /* @__PURE__ */ new WeakMap();
-  const getClientIp = options.getClientIp ?? (options.trustProxy ? (r) => r.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || void 0 : () => void 0);
+  const getClientIp = options.getClientIp ?? (options.trustProxy ? (r) => forwardedClientIp(r.headers.get("x-forwarded-for")) : (r) => platformClientIp(r.headers));
   return async (request) => {
     const cms = await sharedEasyCMS(config);
     let handler = handlers.get(cms);
@@ -11158,6 +11305,7 @@ export {
   fillMissing,
   findConfigFile,
   formToken,
+  forwardedClientIp,
   generateSlugs,
   generateTypes,
   hasRows,
@@ -11178,6 +11326,7 @@ export {
   mimeAllowed,
   mimeAllowedBy,
   parseId,
+  platformClientIp,
   populate,
   rateKeys,
   readCookie,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.47.3",
+  "version": "0.48.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",