@easy-cms/core 0.60.0 → 0.62.0

package/dist/{chunk-S2AJVHR4.js → chunk-CX7R6QBJ.js}

@@ -32,8 +32,9 @@ import {
   storageKey,
   typeFromName,
   uniqueWithinOf,
+  warnDeprecated,
   withPrivacy
-} from "./chunk-CGVNZUW4.js";
+} from "./chunk-FPFWLQB5.js";
 
 // src/access.ts
 var isSystemAdmin = (user) => user?.role === "admin" && !user.apiKey && user.scoped !== true;
@@ -1722,7 +1723,14 @@ var Auth = class {
       ...args.name ? { name: args.name } : {}
     });
     const raw = await this.db.findById({ collection: USERS, id: user.id });
-    return this.startSession(raw);
+    const session = await this.startSession(raw);
+    await this.cms.audit.record({
+      action: "setup",
+      target: "auth",
+      user: session.user,
+      detail: { setupCode: !!code }
+    });
+    return session;
   }
   // --- Members signing up (`auth.members.signUp`) ---------------------------------------------
   /** What a sign-up form needs: a token proving when it was loaded, and Turnstile's site key. */
@@ -4611,6 +4619,7 @@ function validateConfig(config) {
     return issues;
   }
   validateSecret(config.secret, add);
+  validateCronSecret(config.cronSecret, (issue) => issues.push(issue));
   checkConfigKeys(config, (issue) => issues.push(issue));
   validateAdapterVersions(config, add);
   if (!config.db || typeof config.db.name !== "string" || typeof config.db.init !== "function") {
@@ -4686,6 +4695,27 @@ function validateSecret(secret, add) {
     add("secret", "looks like an example or a repeated pattern, not a random string", hint);
   }
 }
+function validateCronSecret(value, push) {
+  const hint = `use a random string of at least ${MIN_SECRET_LENGTH} characters, e.g. \`openssl rand -hex 32\``;
+  if (value !== void 0) {
+    if (typeof value !== "string") push({ path: "cronSecret", message: "must be a string" });
+    else if (value.length < MIN_SECRET_LENGTH)
+      push({
+        path: "cronSecret",
+        message: `must be at least ${MIN_SECRET_LENGTH} characters (got ${value.length})`,
+        hint
+      });
+    return;
+  }
+  const env = process.env.CRON_SECRET;
+  if (env && env.length < MIN_SECRET_LENGTH)
+    push({
+      path: "cronSecret",
+      message: `CRON_SECRET is ${env.length} characters; anyone who guesses it can run jobs`,
+      hint,
+      severity: "warning"
+    });
+}
 function guessable(secret) {
   return /change[-_ ]?me|example|placeholder|secret-?key/i.test(secret) || new Set(secret).size < 8;
 }
@@ -6020,6 +6050,221 @@ function resolveAudit(audit) {
 // src/local-api.ts
 import { createHmac as createHmac6, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual5 } from "crypto";
 
+// src/auth/common-passwords.ts
+var LIST = `
+0.0.0.000 01234567 063dyjuy 085tzzqi 09876543 10101010 11001001 11111111 11112222 11223344
+11235813 12121212 12312312 123123123 12341234 12344321 12345678 123456789 1234567890 12345679
+1234abcd 1234qwer 12locked 12qwaszx 13131313 13576479 14141414 14725836 14789632 151nxjmt
+154ugeiu 17011701 17171717 18436572 19691969 19741974 19781978 19841984 1a2b3c4d 1letmein
+1michael 1million 1passwor 1q2w3e4r 1q2w3e4r5t 1qaz2wsx 1qazxsw2 1x2zkg8w 20002000 20012001
+201jedlz 20202020 20spanks 21122112 21212121 22222222 23232323 23skidoo 24242424 24682468
+25252525 25802580 31415926 33333333 368ejhih 380zliki 383pdjvl 44444444 474jdvff 50spanks
+51505150 551scasi 554uzpad 55555555 55bgates 5wr2i7h8 66666666 66668888 69696969 69camaro
+766rglqy 77777777 78945612 863abgsg 87654321 88888888 8j4ye3uz 911turbo 98765432 987654321
+99999999 a1234567 a1b2c3d4 aaaaaaa1 aaaaaaaa aardvark abc12345 abcd1234 abcdefg1 abcdefgh
+aberdeen abnormal absolute absolutely acapulco access14 access99 achilles acidburn adelaide
+adrienne aerosmit airborne aircraft airforce airplane albatros alejandr alessand alexalex
+alexande alexander alexandr alexandra alfarome alleycat alliance allison1 allnight allstate
+almighty alpha123 alphabet amateurs amatuers ambrosia america1 american amethyst amsterda
+amsterdam anaconda anastasi andersen anderson andromed andyandy andyod22 angelica angelika
+angelina animated annabell annmarie antelope anthony1 anthony7 anything aolsucks apollo13
+apple123 applepie aquarius archange architec argentin arizona1 arkansas armstron arsenal1
+asdf1234 asdfasdf asdfghjk asdfghjkl ashleigh assassin asshole1 assholes atlantic atlantis
+atreides attitude attorney auckland augustus austin31 australi australia avalanch aviation
+azertyui b929ezzh baberuth babybaby babyblue babycake babydoll babyface babygirl babylon5
+babylove backbone backdoor badabing balloons baltimor bangbang barbados barcelon barcelona
+barefeet barefoot baritone basebal1 baseball baseball1 basement basketba basketball bastards
+bbbbbbbb bcfields bearbear bearcats beatles1 beatrice beautifu beautiful beefcake beerbeer
+beethove bellagio bendover benjamin bergkamp berkeley bettyboo bigballs bigblack bigblock
+bigboobs bigbooty bigbucks bigdaddy bigdick1 bigdicks bigmoney bigpenis bigpoppa bigtruck
+billabon billbill billybob billyboy binladen birthday birthday1 birthday4 bitchass blackbir
+blackcat blackcoc blackdog blackhaw blackice blackjac blackjack blacklab blackman blackout
+blessing blink182 blizzard blowfish blue1234 blueball bluebell blueberr bluebird blueblue
+blueeyes bluefish bluejays bluemoon bluesman bobafett bobdylan bollocks bonehead bookworm
+borabora bordeaux borussia bradford brandon1 brewster brighton brigitte brisbane brittany
+brittney broadway broncos1 brooklyn brothers browning brucelee bubba123 bubbles1 buckaroo
+buckeyes buckshot budapest buddy123 buddyboy budlight budweise buffalo1 building bukowski
+bulldawg bulldog1 bulldogs bulletin bullfrog bullseye bullshit bullwink bunghole business
+businessbabe buttercu butterfl butterfly buttfuck butthead butthole cabernet cadillac caldwell
+calendar caliente californ california caligula calimero callaway callisto camaross cambridg
+cameltoe cameron1 campbell canadian candyass candyman cannabis capetown capitals capricor
+capslock captain1 cardinal cardinals care1839 carebear carlitos carnival carolina caroline
+carpedie carpente cartman1 cartoons casanova cashflow cashmone cassandr castillo catalina
+catfight catherin catherine catwoman cavalier cbr900rr cccccccc celebrity cerberus cezer121
+chadwick chainsaw challeng chambers champion chandler changeme chargers charisma charlene
+charles1 charlie1 charlie123 charlie2 charlott charlotte charlton checkers checkmat cheerleaers
+chelsea1 chemical cherokee cherries cheshire chester1 chestnut chevelle chevrole chevrolet
+chewbacc cheyenne chicago1 chicken1 chickens children chipmunk chiquita chocolat chocolate
+choochoo chris123 chrisbln christia christian christie christin christina christine christma
+christmas christop christopher chrysler chuckles churchil cinnamon citation civilwar clarence
+clarinet clarissa classics claudia1 claymore clemente cleopatr clevelan cleveland clifford
+climbing clippers clitoris close-up clueless cocacola cocksuck cocksucker cocktail coldbeer
+coldplay colombia colonial colorado coltrane columbia columbus comanche commande commando
+complete computer concorde concrete confused conquest constant consumer contains contortionist
+contract coolcool cooldude coolhand coolness copenhag corleone cornhole cornwall corvet07
+corvette costello cosworth courtney coventry cowboys1 crawford crazybab crazyman creampie
+creation creative creature creepers crescent cricket1 criminal cristian cristina cromwell
+crusader crystal1 csfbr5yy culinary customer cutiepie cybersex cyclones cygnusx1 dad2ownu
+daedalus daisydog danielle dannyboy dapzu455 daredevi darkange darklord darkness darkside
+darkstar darthvad daughter davecole davedave davidson daylight dddddddd deadhead deadpool
+deadspin death666 december deepthroat deerhunt deeznuts deeznutz defender deftones delaware
+delldell delpiero designer destiny1 detectiv devil666 devildog devilman diamond1 diamonds
+dickdick dickhead dietcoke digital1 dilbert1 dilligaf dingdong dinosaur dipstick director
+dirtbike dirtydog disaster discover division doberman dodgeram dodgers1 doghouse dogpound
+dolemite dolphin1 dolphins dominick dominion dominiqu dontknow doomsday doughboy doughnut
+downhill downtown dragon12 dragon69 dragonba dragonball dragonfl dragster dreamcas dreamer1
+dreaming dripping drowssap drpepper drummer1 dudedude dukeduke dutchess dynamite earnhard
+earthlin earthlink eastside eastwood eatmenow eatpussy eclipse1 edgewise edmonton eeeeeeee
+eggplant eighteen einstein ejaculation elcamino eldiablo eldorado electric electron elephant
+elisabet elizabet elizabeth embalmer emmanuel enforcer engineer england1 enternow enterpri
+enterprise entrance envelope erection ericsson escalade espresso estrella eternity evangeli
+everlast evolutio excalibu excalibur exchange experience experienced explorer express1 f00tball
+fairlane faithful fandango fantasia fantasies farscape fastball fatluvr69 favorite favorite2
+favorite6 fearless feathers february federico feelgood fellatio ferguson fernando ferrari1
+festival ffffffff ffvdj474 fidelity fighting films+pic+galeries fingerig fireball fireblad
+firefigh firefire firehawk firewall fishbone fishcake fisherma fishfish fishhead fishing1
+fishtank flamingo flanders flashman flathead fletcher flexible flipflop flipmode florence
+florida1 flounder flyers88 football football1 fordf150 foreplay foreskin forgetit formula1
+forsaken fortress fortune12 fountain foxylady francesc francine francois frankie1 franklin
+freckles frederic fredfred fredrick freedom1 freefall freefree freepass freeporn freeuser
+freewill frenchie friendly frogfrog front242 frontier fuck_inside fuckface fuckfuck fuckhead
+fuckinside fuckoff1 fuckthis fuckyou1 fuckyou2 fullback fullmoon funstuff funtimes fussball
+fuzzball gabriel1 gabriela gabriell galeries gallaries gamecock gamecube gameover gandalf1
+gangbang gangbanged gangster garfield gargoyle garrison gateway1 gateway2 gatorade general1
+generals genesis1 geneviev geoffrey gerhardt geronimo gertrude gesperrt getmoney getsdown
+gfxqx686 gggggggg gilligan ginscoot giovanna giovanni girfriend giuseppe giveitup gizmodo1
+gladiato gladiator glendale glennwei gnasher23 godfathe godfather godsmack godspeed godzilla
+gogators goldberg goldeney goldfing goldfish goldstar goldwing golfball golfgolf gonzales
+gonzalez goodfell goodgirl goodluck goodtime goodyear goofball gooseman gordon24 gorgeous
+gotohell gotyoass graduate graphics grateful graywolf greatest greatone green123 greenbay
+greenday greenman gregory1 gretchen greywolf griffith gsxr1000 guardian guinness gymnastic
+hahahaha hairball halflife hallowee hamilton handball handsome handyman hannibal happines
+happy123 happyday happydog happyman hardball hardcock hardcore harddick hardrock hardware
+hardwood harrison hartford hastings hattrick hawaii50 hawaiian hawkeyes hawkwind hawthorn
+hayabusa heather1 hedgehog heineken heinrich hellfire hello123 hellohel hellyeah hercules
+herewego heritage hetfield hhhhhhhh highbury highheel highland highlander highlife hihje863
+hillbill hillside holidays hollywoo hollywood holyshit homemade homepage homepage- honeybee
+honeydew hongkong honolulu hooligan hoosiers hooters1 hopeless hornyman horseman horsemen
+hotgirls hotmail0 hotmail1 hotpussy hotstuff hounddog housewife housewifes houston1 hugetits
+hugohugo humphrey hurrican hurricane huskers1 hyperion hzze929b ibilltes icecream icehouse
+idontkno idontknow ihateyou iiiiiiii illinois illmatic illusion ilovegod ilovesex iloveyou
+iloveyou! iloveyou1 iloveyou2 immortal imperial implants infantry infinite infiniti infinity
+innocent insanity insertion insertions insomnia inspiron instinct interacial intercourse
+interest internal internet intrepid intruder iqzzt580 irishman isabella isabelle isacs155
+islander istanbul istheman italiano iverson3 jackass1 jackjack jackson1 jackson5 jakejake
+james007 jamesbon jamesbond japanees japanese jasmine1 jayhawks jeanette jediknig jeepjeep
+jeepster jefferso jeffjeff jellybea jennifer jennings jeremiah jermaine jessica1 jiggaman
+jjjjjjjj jo9k2jw2 johannes johndeer johngalt johnjohn johnmish johnson1 johnston jojojojo
+jonathan jonathon jordan23 josephin joystick juliette junkmail jupiter1 jupiter2 jurassic
+just4fun justdoit juventus kamikaze kangaroo katarina katherin katherine kathleen kawasaki
+kayleigh kcchiefs kcj9wx5n kentucky kenworth keyboard keystone kikimora killbill killkill
+kimberly kingfish kingkong kingrich kingston kirkland kisskiss kittycat kittykat kkkkkkkk
+klondike knickerless knickers knockers knuckles kordell1 kristian kristin1 kristina kristine
+labrador lacrosse laetitia lakeside lakewood lalakers lalalala lancelot landmark laserjet
+lasvegas laughing laurence lavalamp lawrence lebowski leedsutd lemonade leonardo lesbians
+letmein1 letmein2 letmein22 letmeinn letmesee letsdoit lexingky lifehack lifetime lighthou
+lighting lightnin lightning limewire lincoln1 lionhear lionking lipstick lisalisa littlema
+liverpoo liverpool lkjhgfds llllllll lockdown lockerroom logitech lollipop lollypop lonesome
+lonestar lonewolf longdong longhair longhorn longjohn longshot lorraine losangel lovelife
+lovelove loverboy loverman lowrider luckydog luckyone lunchbox luv2epus macaroni macdaddy
+macgyver macintos madeline madison1 magazine magellan magician magicman magnolia mainland
+majestic makaveli mallorca mallrats mamacita manchest manchester mandarin mandingo mandrake
+manhatta maradona marathon marauder marcello marcius2 margaret marianne marijuan mariners
+marines1 marino13 mariposa marjorie marlboro marriage marshall martinez maryjane maryland
+masamune maserati mash4077 master12 masterbaiting masterbate masterbating masturbation matchbox
+material matthew1 matthews matthias maverick maxwell1 mazda626 mazdarx7 mccarthy mcdonald
+mckenzie meatball meathead meatloaf mechanic medicine megadeth megapass megatron melanie1
+melissa1 meowmeow mephisto mercedes merchant mercury1 meredith meridian metallic metallica
+michael1 michael2 michaela michaels michelle michigan microsof microsoft midnight mikemike
+milamber military millions millwall minemine minimoni ministry minnesot mischief misfit99
+mississi missouri mistress mitchell mmmmmmmm mobydick modelsne mohammad mohammed mollydog
+monalisa money123 moneyman mongoose monkey12 monkeybo monopoly monster1 monsters montana1
+montecar monterey montreal montrose moonbeam moonligh moonlight moonshin morpheus morrison
+mortgage morticia mortimer motherfucker motocros motorola mounta1n mountain mudvayne muffdive
+mulligan munchkin mushroom musician musicman mustang1 mustang2 mustang5 mustang6 mustangs
+mwq6qlzo myspace1 myxworld nancy123 napoleon nascar24 natalie1 natasha1 natedogg nathalie
+nathanie national navyseal ncc1701a ncc1701d ncc1701e ncc74656 nebraska necklace negative
+nemrac58 netscape nevermin newcastl newcastle newpass6 newyork1 nicetits nicholas nightmar
+nightowl nightwin nineball nineinch nineteen nintendo nirvana1 nnnnnnnn nocturne nonenone
+normandy northern nostromo notebook notredam nounours november novifarm nwo4life nygiants
+nyyankee oblivion obsidian offshore oklahoma oooooooo opendoor operator optimist original
+outoutout outsider overkill overlord ozlq6qwm pa55w0rd pa55word packers1 paintbal paintball
+painting pakistan paladin1 pallmall palmtree panasoni panasonic pantera1 panther1 panthers
+papabear papillon paradigm paradise paramedi paranoid pasadena pass1234 passmast passpass
+passport passthie passw0rd passwor1 password password1 password2 password9 passwords passwort
+patches1 pathetic pathfind patience patricia patrick1 patriots paulpaul pavement pavilion
+peaches1 pearljam peekaboo penelope penetrating penetration penguin1 penguins pennywis pentagon
+penthous perfect1 personal pertinant pescator peterbil peternorth peterpan peterson phaedrus
+phantom1 pharmacy phialpha philippe phillies phillips phoenix1 pianoman pictuers piercing
+pimpdadd pimpdaddy pineappl pinetree pingpong pinkfloy pinkfloyd pinnacle pipeline pitchers
+pizzaman plastics platinum platypus playball playboy1 playboy2 playmate playoffs playstat
+playstation playtime pleasant pleasure plymouth polopolo poohbear pool6123 poontang poophead
+pooppoop porkchop porn4life pornking pornographic pornporn porsche1 porsche9 portland portugal
+poseidon positive postov1000 pounding pppppppp preacher precious predator pregnant prelude1
+presario presiden president pressure primetime21 princess princeto pringles printing private1
+producer progress property prophecy prospect ptfe3xxp pumpkin1 pumpkins punisher punkrock
+puppydog pussy123 pussy4me pussycat pussyeat pussyman pxx3eftp q1w2e3r4 qazwsxed qazwsxedc
+qcmfd454 qqqqqqqq quant4307s question qwer1234 qwerasdf qwerqwer qwert123 qwerty12 qwerty123
+qwertyui qwertyuiop qwertzui r2d2c3po rachelle radiohea ragnarok raiders1 railroad rainbow1
+rainbow6 rainbows rainyday raistlin randolph rangers1 rapunzel rasputin rasta220 rebecca1
+reckless recovery redalert redbaron reddevil reddwarf redheads redlight redshift redskins
+redstorm redwings reginald register reindeer remember remingto renegade republic research
+resident revoluti revolver reynolds rhiannon richard1 richards richmond riffraff rightnow
+riverrat riversid roadkill roadking roadrunn roadster robinson robotech robotics rochelle
+rockford rockhard rocknrol rockrock rockstar rockwell rolltide rootbeer rootedit rosemary
+rrrrrrrr rsalinas rt6ytere rush2112 rushmore russell1 rustydog sabrina1 sailboat salasana
+salesman salvador samadams samantha samsung1 sandberg sandiego sandrine sandwich sanity72
+santiago sapphire saratoga satan666 saturday sausages savannah save13tx saxophon scandinavian
+scarface scarlett scheisse scirocco scissors scoobydo scoobydoo scooter1 scorpio1 scorpion
+scotland scrabble scrapper screamer screwyou seahawks sealteam sebastia sebastian security
+seductive seinfeld seminole semperfi senators sentinel sentnece septembe september serenity
+sergeant services sexsexsex sexybabe sexygirl sexylady sexysexy shadow12 shamrock shanghai
+shannon1 sheepdog shepherd sheridan sherlock sherwood shitface shithead shitshit shopping
+showtime sickness sidekick sigmachi silverad simpsons sinclair singapor sinister sithlord
+sixtynin skeeter1 skinhead skipper1 skittles skydiver skywalke skywalker slamdunk slapnuts
+slapshot sleeping slimed123 slimshad slipknot slippery slowhand smackdow smartass smashing
+smeghead smirnoff smithers smoothie snapshot sneakers snickers sniffing snoopdog snowball
+snowbird snowboar snowboard snowflak snuggles soccer10 soccer11 soccer12 socrates softball
+softtail software solitude solution somerset somethin something sometime sonyfuck sonysony
+sooners1 sopranos soulmate southern southpar southpark southpaw spaceman spanking sparhawk
+sparkles spartan1 spartans speakers special1 specialk spectrum speedway spencer1 spiderma
+spiderman spitfire splinter spongebo sporting springer sprinter sprocket squerting squirrel
+srinivas ssptx452 ssssssss stafford stallion standard stanford stanley1 starbuck starcraf
+starcraft stardust starfire starfish stargate starligh starlite starship starstar startrek
+starwars steelers stefanie stephane stephani stephanie stephen1 stephens sterling stewart1
+stickman stiletto stingray stirling stocking stockton stonecol stonecold stonewal stoppedby
+straight stranger strawber streaming strength stripper suburban success1 suckcock suckdick
+sullivan summer69 summer99 sundance sundevil sunflowe sunlight sunnyday sunshine superfly
+superior superman supernov supersta superstar surprise surveyor survival survivor svetlana
+sweetnes sweetness sweetpea swimming swingers swinging swordfis swordfish sylveste syracuse
+tacobell tailgate takehana talisman tampabay tangerin tarheels tazmania technics techniques
+teddybea telephon temppass temptress tennesse terminal terminat terrapin test1234 testerer
+testibil testing1 testpass testtest thailand thanatos thankyou thedoors theforce thegreat
+thematri theodore therock1 thething thetruth thinking thirteen thisisit thompson thrasher
+threesom thriller thuglife thumbnils thumper1 thunder1 thunderb thursday tiberius tickling
+ticklish tiffany1 tiger123 tigercat tinkerbe titanium titleist tmjxn151 together tomahawk
+tommyboy tomorrow toonarmy toriamos tottenha tottenham touching trailers training transexual
+transfer traveler treasure treefrog triangle trinidad trinitro trinity1 trombone trooper1
+tropical trouble1 troubles trousers trucking trueblue truelove trumpet1 trustno1 tttttttt
+tunafish turkey50 twilight ultimate umbrella unbelievable uncencored underdog undertak
+undertaker undertow underwear universa universe university ursitesux username usmarine uuuuuuuu
+vacation vagabond valdepen valencia valentin valhalla valkyrie valleywa vampire1 vampires
+vancouve vanessa1 vanguard vanhalen vauxhall velocity verbatim veronica veronika verygood
+victoria viewsoni vikings1 vincent1 violator vipergts virginia virginie vivitron vladimir
+volkswag volleyba voyager1 vvvvvvvv wanderer wapapapa warcraft wareagle warhamme warrior1
+warriors washburn washingt washington watching waterboy waterfal waterloo waterman waterski
+webmaste webmaster wednesda wednesday welcome1 wellingt werewolf westside westwood wetpussy
+wg8e3wjf whatever whatwhat whiplash whiskers whistler whiteboy whiteout whitesox whocares
+wildbill wildcard wildcats wildfire wildstar wildwood william1 williams windmill windows1
+windsurf winfield wingchun winston1 winter99 wireless wishbone wolfgang wolfpack wolverin
+wolverine wonderboy wonderfu woodland woodstoc woodwork woofwoof wordpass wp2003wp wrangler
+wrestler wrestlin wrestling wrinkle1 wrinkle5 wwwwwwww xxxxxxx1 xxxxxxxx yamahar1 yankees1
+yankees2 yeahbaby yeahyeah year2005 yesterda yogibear yosemite yqlgr667 yvtte545 yy5rbfsc
+yyyyyyyy zachary1 zanzibar zaq12wsx zaq1xsw2 zeppelin zerocool zildjian zoomzoom zxcvbnm1
+zzzzzzzz
+`;
+var COMMON_PASSWORDS = new Set(LIST.split(/\s+/).filter(Boolean));
+
 // src/localization.ts
 var ALL_LOCALES = "all";
 var isPlainObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -6373,6 +6618,10 @@ async function createEasyCMS(config, options = {}) {
   const cms = new EasyCMS(resolved3, db, logger, storage, cwd);
   const scheduling = [...resolved3.collections, ...resolved3.globals].some((c) => c.schedule) || (resolved3.webhooks?.length ?? 0) > 0 || resolved3.email !== void 0 || resolved3.jobs.length > 0;
   if (scheduling && options.scheduler !== false) cms.startScheduler();
+  if (process.env.NODE_ENV === "production" && !resolved3.auth.setupCode && await cms.auth.hasUsers().catch(() => true) === false)
+    logger.warn(
+      "No admin exists yet and no setup code is set: whoever opens the admin first becomes the admin. Set EASY_CMS_SETUP_CODE, or create the admin with `easy-cms admin:create`."
+    );
   return cms;
 }
 var toJob = (row) => ({
@@ -8712,6 +8961,11 @@ function splitPassword(config, raw) {
       { field: "password", message: `must be at least ${MIN_PASSWORD_LENGTH} characters` }
     ]);
   }
+  if (COMMON_PASSWORDS.has(password.normalize("NFKC").toLowerCase())) {
+    throw new ValidationError(USERS, [
+      { field: "password", message: "is one of the most common passwords; choose another" }
+    ]);
+  }
   return { input, password };
 }
 function asObject(data, name) {
@@ -8788,7 +9042,7 @@ async function readAdminModule(cms, index) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.60.0" : "0.0.0-dev";
+var VERSION = true ? "0.62.0" : "0.0.0-dev";
 
 // src/rest/admin-deliveries.ts
 var PER_PAGE = 50;
@@ -9895,6 +10149,11 @@ async function route(cms, ctx, method, path, options) {
   if (first === "admin" && ctx.user?.member === true) throw new ForbiddenError();
   const authAction = third === void 0 && second !== void 0 ? first === "auth" && AUTH_ACTIONS.has(second) || first === USERS && !/^\d+$/.test(second) : false;
   if (first === "auth" && !authAction) return ssoRoute(cms, ctx, method, segments);
+  if (authAction && first === USERS && second !== void 0 && AUTH_ACTIONS.has(second))
+    warnDeprecated(
+      "EASY_CMS_DEP001",
+      `${method} <api>/users/${second} is now <api>/auth/${second}; the old path works through 1.x.`
+    );
   if (authAction && second !== void 0) {
     switch (`${method} ${second}`) {
       case "POST login": {
@@ -10027,6 +10286,7 @@ async function route(cms, ctx, method, path, options) {
     if (!byCron && !isSystemAdmin(ctx.user)) {
       throw ctx.user ? new HttpError("Forbidden", 403) : new UnauthorizedError();
     }
+    if (!byCron && ctx.via === "cookie" && method !== "POST") throw methodNotAllowed(ctx, "POST");
     return { body: await cms.runJobs() };
   }
   if (first === "admin" && second === "backups") {
@@ -10303,6 +10563,8 @@ async function route(cms, ctx, method, path, options) {
       return { body: await cms.findGlobal(second, { ...access, ...parseDepth(ctx.url), draft }) };
     }
     if (method === "PATCH" || method === "POST") {
+      if (method === "POST")
+        warnDeprecated("EASY_CMS_DEP002", "Globals are updated with PATCH; POST works through 1.x.");
       const body = await readJson(ctx.request);
       return { body: await cms.updateGlobal(second, body, { ...access, ...parseDepth(ctx.url) }) };
     }
@@ -10550,7 +10812,13 @@ function scheduleJob(body) {
 }
 function parseLocale(url) {
   const locale = url.searchParams.get("locale");
-  const fallback = url.searchParams.get("fallbackLocale") ?? url.searchParams.get("fallback-locale");
+  const old = url.searchParams.get("fallback-locale");
+  if (old !== null)
+    warnDeprecated(
+      "EASY_CMS_DEP003",
+      "?fallback-locale= is now ?fallbackLocale=; the old name works through 1.x."
+    );
+  const fallback = url.searchParams.get("fallbackLocale") ?? old;
   return {
     ...locale ? { locale } : {},
     ...fallback === "false" || fallback === "true" ? { fallbackLocale: fallback === "true" } : {}

package/dist/{chunk-CGVNZUW4.js → chunk-FPFWLQB5.js}

@@ -369,6 +369,23 @@ function defineConfig(config) {
   return config;
 }
 
+// src/deprecation.ts
+var KEY = /* @__PURE__ */ Symbol.for("easy-cms.deprecations");
+function warned() {
+  const store = globalThis;
+  store[KEY] ??= /* @__PURE__ */ new Set();
+  return store[KEY];
+}
+function warnDeprecated(code, message) {
+  const seen = warned();
+  if (seen.has(code)) return;
+  seen.add(code);
+  const node = globalThis.process;
+  if (typeof node?.emitWarning === "function")
+    node.emitWarning(message, { type: "DeprecationWarning", code });
+  else console.warn(`[${code}] DeprecationWarning: ${message}`);
+}
+
 // src/field-types.ts
 var FIELD_TYPE_BASES = [
   "text",
@@ -527,6 +544,7 @@ export {
   PLUGIN_API_VERSION,
   definePlugin,
   defineConfig,
+  warnDeprecated,
   FIELD_TYPE_BASES,
   defineFieldType,
   fieldTypeModules,

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { P as PaginatedDocs, I as ID, E as EmailSetting } from './config-jzFGsNL6.js';
 export { A as ADAPTER_API_VERSION, a as ADMIN_ICONS, b as Access, c as AccessArgs, d as AccessOptions, e as AdminBrand, f as AdminCommand, g as AdminComponent, h as AdminConfig, i as AdminFieldArgs, j as AdminIcon, k as AdminLocale, l as AdminPage, m as AdminRole, n as AdminRoleChange, o as AdminRoleField, p as AdminRoleTarget, q as AdminRoleView, r as AdminRoles, s as AdminSso, t as AdminSwitcher, u as AdminViewAccess, v as AfterChangeHook, w as AfterDeleteHook, x as AfterReadHook, y as ApiKeyContext, z as ApiKeyGlobalOperation, B as ApiKeyOperation, C as ApiKeyPermissions, D as ArrayField, F as AuditChange, G as AuditConfig, H as AuditEntry, J as AuditLog, K as AuditPage, L as AuditVerification, M as Auth, N as AuthConfig, O as AuthProvider, Q as AuthProviderProfile, R as AuthProviderRequest, S as AuthUser, T as BackupsConfig, U as BeforeChangeHook, V as BeforeDeleteHook, W as BeforeValidateHook, X as Block, Y as BlocksField, Z as BooleanField, _ as BuiltinApiKeysCollection, $ as BuiltinMediaCollection, a0 as BuiltinMediaFoldersCollection, a1 as BuiltinUsersCollection, a2 as BundleHints, a3 as CliCommand, a4 as CollectionAccess, a5 as CollectionAdmin, a6 as CollectionConfig, a7 as CollectionDocument, a8 as CollectionHooks, a9 as CollectionListAdmin, aa as CollectionSlug, ab as Config, ac as ConfigError, ad as ConfigIssue, ae as ContainerAdmin, af as CreateEasyCMSOptions, ag as CreateInput, ah as CreateMigrationResult, ai as CustomField, aj as CustomFieldTypes, ak as DashboardWidget, al as Database, am as DatabaseAdapter, an as DatabaseInitArgs, ao as DatabaseTransfer, ap as DateField, aq as DepthOptions, ar as DirectUpload, as as DiskStorageOptions, at as DocumentOf, au as EasyCMS, av as EasyCMSError, aw as EmailAdapter, ax as EmailField, ay as EmailMessage, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aC as FIELD_TYPES, aD as Field, aE as FieldAccess, aF as FieldAccessFn, aG as FieldAdmin, aH as FieldError, aI as FieldRule, aJ as FieldType, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aN as FieldValidate, aO as FieldValidateContext, aP as FieldValue, aQ as FieldsInput, aR as FieldsValue, aS as FilterOptions, aT as FilterOptionsArgs, aU as FindArgs, aV as FindOptions, aW as FolderLevel, aX as FolderPermissions, aY as ForbiddenError, aZ as GlobalAccess, a_ as GlobalConfig, a$ as GlobalDocument, b0 as GlobalHooks, b1 as GlobalInput, b2 as GlobalSlug, b3 as GroupField, b4 as ImageSize, b5 as IncrementOptions, b6 as InferCollection, b7 as InferGlobal, b8 as JobConfig, b9 as JsonField, ba as Label, bb as LayoutNode, bc as LivePreview, bd as LocalizationConfig, be as Logger, bf as LoginArgs, bg as MediaDocument, bh as MediaSize, bi as MembersConfig, bj as MembersSignup, bk as MigrationInfo, bl as NavGroup, bm as NotFoundError, bn as NumberField, bo as OnRequest, bp as OnRequestArgs, bq as Operation, br as PLUGIN_API_VERSION, bs as PasswordEmail, bt as PasswordEmailArgs, bu as PasswordEmailFn, bv as PasswordLinkOptions, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bA as PreviewTarget, bB as PreviewURL, bC as QueryError, bD as ROLE_OPERATIONS, bE as RawDocument, bF as ReadOptions, bG as RelationshipField, bH as RequestContext, bI as ResolvedConfig, bJ as RichTextDocument, bK as RichTextField, bL as Role, bM as RoleOperation, bN as RolePermissions, bO as Roles, bP as RoutesConfig, bQ as ScheduledPublish, bR as SchemaError, bS as SchemaMode, bT as SelectField, bU as SelectOption, bV as Session, bW as SidebarPanel, bX as SignupArgs, bY as SignupResult, bZ as SingleSignOn, b_ as SlugField, b$ as SlugOf, c0 as SsoOutcome, c1 as SsoProviderRef, c2 as StorageAdapter, c3 as StoredFile, c4 as TextField, c5 as TextareaField, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, c9 as UpdateInput, ca as UpdateOptions, cb as UploadConfig, cc as UploadField, cd as UploadFromURLConfig, ce as UserIdentity, cf as ValidationError, cg as Version, ch as VersionSummary, ci as VersionsConfig, cj as WEBHOOK_EVENTS, ck as WebhookConfig, cl as WebhookEvent, cm as WebhookPayload, cn as Where, co as WhereOperators, cp as anyone, cq as consoleEmail, cr as consoleLogger, cs as createEasyCMS, ct as defineConfig, cu as defineFieldType, cv as definePlugin, cw as diskStorage, cx as hasRows, cy as isAdmin, cz as isHasMany, cA as isSignedIn, cB as isStaff, cC as isSystemAdmin, cD as mimeAllowedBy, cE as rowFields, cF as silentLogger, cG as uniqueWithinOf } from './config-jzFGsNL6.js';
-export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail } from './plugin-EX9OHwR3.js';
+export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-C19Bt8ux.js';
 export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-CMA1LIq7.js';
 export { FieldCondition, matchesCondition } from './conditions.js';
 

package/dist/index.js

@@ -23,7 +23,7 @@ import {
   sharedEasyCMS,
   silentLogger,
   slugify
-} from "./chunk-S2AJVHR4.js";
+} from "./chunk-CX7R6QBJ.js";
 import {
   matchesCondition
 } from "./chunk-U266LV4M.js";
@@ -46,8 +46,9 @@ import {
   ValidationError,
   defineConfig,
   defineFieldType,
-  definePlugin
-} from "./chunk-CGVNZUW4.js";
+  definePlugin,
+  warnDeprecated
+} from "./chunk-FPFWLQB5.js";
 export {
   ADAPTER_API_VERSION,
   ADMIN_API_VERSION,
@@ -90,5 +91,6 @@ export {
   resolveConfig,
   sharedEasyCMS,
   silentLogger,
-  slugify
+  slugify,
+  warnDeprecated
 };

package/dist/internal.js

@@ -52,7 +52,7 @@ import {
   verifyPassword,
   verifyTurnstile,
   writeBackupFile
-} from "./chunk-S2AJVHR4.js";
+} from "./chunk-CX7R6QBJ.js";
 import {
   conditionIssues
 } from "./chunk-U266LV4M.js";
@@ -70,7 +70,7 @@ import {
   rowFields,
   sniffMimeType,
   uniqueWithinOf
-} from "./chunk-CGVNZUW4.js";
+} from "./chunk-FPFWLQB5.js";
 
 // src/typegen.ts
 var pascal = (name) => name.split(/[^A-Za-z0-9]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");

package/dist/{plugin-EX9OHwR3.d.ts → plugin-C19Bt8ux.d.ts}

@@ -323,4 +323,18 @@ interface SetFieldDetail {
     readonly value: unknown;
 }
 
-export { ADMIN_API_VERSION as A, type SetFieldDetail as S, type AdminCollection as a, type AdminComponentRef as b, type AdminElementProps as c, type AdminField as d, type AdminGlobal as e, type AdminLayoutNode as f, type AdminNavGroup as g, type AdminNavItem as h, type AdminNavNode as i, type AdminPageRef as j, type AdminPageRoute as k, type AdminSchema as l, type AdminWidgetRef as m };
+/**
+ * Logs that something deprecated was used, once per `code` and process. On Node.js it is a
+ * `DeprecationWarning` (`process.emitWarning`), so `--no-deprecation` hides it,
+ * `--throw-deprecation` turns it into an error and `--trace-deprecation` shows where it came
+ * from; elsewhere `console.warn`.
+ *
+ * Plugins use codes of their own, e.g. `ACME_SEO_DEP001`.
+ *
+ * ```ts
+ * warnDeprecated('ACME_DEP001', '`acmePlugin({ key })` is now `apiKey`; `key` goes in 2.0.')
+ * ```
+ */
+declare function warnDeprecated(code: string, message: string): void;
+
+export { ADMIN_API_VERSION as A, type SetFieldDetail as S, type AdminCollection as a, type AdminComponentRef as b, type AdminElementProps as c, type AdminField as d, type AdminGlobal as e, type AdminLayoutNode as f, type AdminNavGroup as g, type AdminNavItem as h, type AdminNavNode as i, type AdminPageRef as j, type AdminPageRoute as k, type AdminSchema as l, type AdminWidgetRef as m, warnDeprecated as w };

package/dist/plugin.d.ts

@@ -1,3 +1,3 @@
 export { a as ADMIN_ICONS, g as AdminComponent, j as AdminIcon, S as AuthUser, a3 as CliCommand, a4 as CollectionAccess, a6 as CollectionConfig, ab as Config, ac as ConfigError, ak as DashboardWidget, av as EasyCMSError, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aD as Field, aE as FieldAccess, aH as FieldError, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aY as ForbiddenError, a_ as GlobalConfig, I as ID, b8 as JobConfig, ba as Label, bl as NavGroup, bm as NotFoundError, bo as OnRequest, bp as OnRequestArgs, br as PLUGIN_API_VERSION, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bC as QueryError, bH as RequestContext, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, cf as ValidationError, cn as Where, cu as defineFieldType, cv as definePlugin } from './config-jzFGsNL6.js';
-export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail } from './plugin-EX9OHwR3.js';
+export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-C19Bt8ux.js';
 import './conditions.js';

package/dist/plugin.js

@@ -14,8 +14,9 @@ import {
   UnauthorizedError,
   ValidationError,
   defineFieldType,
-  definePlugin
-} from "./chunk-CGVNZUW4.js";
+  definePlugin,
+  warnDeprecated
+} from "./chunk-FPFWLQB5.js";
 export {
   ADMIN_API_VERSION,
   ADMIN_ICONS,
@@ -30,5 +31,6 @@ export {
   UnauthorizedError,
   ValidationError,
   defineFieldType,
-  definePlugin
+  definePlugin,
+  warnDeprecated
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.60.0",
+  "version": "0.62.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",