@easy-cms/core 0.62.0 → 0.64.0

package/dist/{chunk-CX7R6QBJ.js → chunk-JZW6G6XI.js}

@@ -33,8 +33,9 @@ import {
   typeFromName,
   uniqueWithinOf,
   warnDeprecated,
+  withCharset,
   withPrivacy
-} from "./chunk-FPFWLQB5.js";
+} from "./chunk-RTKWMVAC.js";
 
 // src/access.ts
 var isSystemAdmin = (user) => user?.role === "admin" && !user.apiKey && user.scoped !== true;
@@ -1015,6 +1016,21 @@ async function verifyTurnstile(secretKey, response, ip, fetcher = fetch) {
 
 // src/auth/cookie.ts
 var SESSION_COOKIE = "ecms-session";
+var hostCookie = (name) => `__Host-${name}`;
+function cookieValue(header, name) {
+  if (!header) return void 0;
+  let plain;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq <= 0) continue;
+    const key = part.slice(0, eq).trim();
+    if (key !== name && key !== hostCookie(name)) continue;
+    const value = decodeURIComponent(part.slice(eq + 1).trim());
+    if (key !== name) return value;
+    plain ??= value;
+  }
+  return plain;
+}
 
 // src/auth/emails.ts
 var esc = (value) => value.replace(
@@ -1169,11 +1185,13 @@ function safeEqual(a, b) {
   const right = Buffer.from(b);
   return left.length === right.length && timingSafeEqual4(left, right);
 }
-function signPreviewToken(secret, target, expiresAt) {
+function signPreviewToken(secret, target, expiresAt, user) {
   const payload = Buffer.from(
-    JSON.stringify(
-      "global" in target ? { g: target.global, e: expiresAt } : { c: target.collection, i: target.id, e: expiresAt }
-    )
+    JSON.stringify({
+      ..."global" in target ? { g: target.global } : { c: target.collection, i: target.id },
+      e: expiresAt,
+      ...user !== void 0 ? { u: user } : {}
+    })
   ).toString("base64url");
   return `${payload}.${hmac(secret, `preview:${payload}`)}`;
 }
@@ -1185,9 +1203,10 @@ function verifyPreviewToken(secret, token, now = Date.now()) {
   try {
     const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
     if (typeof data.e !== "number" || data.e <= now) return null;
-    if (typeof data.g === "string") return { global: data.g, expiresAt: data.e };
+    const user = typeof data.u === "string" ? { user: data.u } : {};
+    if (typeof data.g === "string") return { global: data.g, expiresAt: data.e, ...user };
     if (typeof data.c === "string" && typeof data.i === "string")
-      return { collection: data.c, id: data.i, expiresAt: data.e };
+      return { collection: data.c, id: data.i, expiresAt: data.e, ...user };
     return null;
   } catch {
     return null;
@@ -1908,12 +1927,8 @@ var Auth = class {
   async userFromHeaders(headers) {
     const authorization = headers.get("authorization");
     if (authorization?.startsWith("Bearer ")) return this.verify(authorization.slice(7).trim());
-    for (const part of headers.get("cookie")?.split(";") ?? []) {
-      const eq = part.indexOf("=");
-      if (eq > 0 && part.slice(0, eq).trim() === SESSION_COOKIE)
-        return this.verify(decodeURIComponent(part.slice(eq + 1).trim()));
-    }
-    return null;
+    const cookie2 = cookieValue(headers.get("cookie"), SESSION_COOKIE);
+    return cookie2 ? this.verify(cookie2) : null;
   }
   /**
    * Returns the user for a signed session token, or for an API key (`ecms_…`, with `apiKey` set
@@ -1934,6 +1949,12 @@ var Auth = class {
     if (!user || user.active === false) return null;
     return this.toAuthUser(user);
   }
+  /** An active user by id, as requests see them; `null` when deleted or deactivated. @internal */
+  async activeUser(id) {
+    const user = await this.db.findById({ collection: USERS, id });
+    if (!user || user.active === false) return null;
+    return this.toAuthUser(user);
+  }
   /** The CSRF token clients must echo for a signed session token. @internal */
   csrfFor(signedToken) {
     const token = unsignToken(this.config.secret, signedToken);
@@ -6818,7 +6839,7 @@ var EasyCMS = class {
     const filename = withPrivacy(storageKey(file.name, mimeType, random2), isPrivate);
     const stored = [];
     try {
-      await storage.put(filename, file.data, { contentType: mimeType });
+      await storage.put(filename, file.data, { contentType: withCharset(mimeType) });
       stored.push(filename);
       const dimensions = imageDimensions(file.data, mimeType);
       const sizes = await this.resizeImage(
@@ -7119,18 +7140,23 @@ var EasyCMS = class {
   }
   /**
    * How many documents use any of these files in a top-level upload field (rich text and fields
-   * inside groups, arrays and blocks are not counted). Drafts count too.
+   * inside groups, arrays and blocks are not counted). Drafts count too. With
+   * `overrideAccess: false`, only documents the user may read.
    */
-  async mediaUsage(ids) {
+  async mediaUsage(ids, options = {}) {
     if (ids.length === 0) return 0;
     let count = 0;
     for (const config of this.config.collections) {
       if (INTERNAL_COLLECTIONS.has(config.slug)) continue;
       for (const field of config.fields) {
         if (field.type !== "upload") continue;
-        count += await this.db.count({
-          collection: config.slug,
-          where: { [field.name]: { in: [...ids] } }
+        count += await this.count(config.slug, {
+          ...options,
+          where: { [field.name]: { in: [...ids] } },
+          draft: true
+        }).catch((error) => {
+          if (error instanceof ForbiddenError || error instanceof UnauthorizedError) return 0;
+          throw error;
         });
       }
     }
@@ -7159,7 +7185,7 @@ var EasyCMS = class {
     const old = [String(doc.filename)];
     const copy = async (source, target) => {
       const file = await from.get(source);
-      if (file) await to.put(target, file.body, { contentType });
+      if (file) await to.put(target, file.body, { contentType: withCharset(contentType) });
     };
     await copy(String(doc.filename), filename);
     const sizes = {};
@@ -7381,12 +7407,15 @@ var EasyCMS = class {
   /**
    * A token that lets a page read one document's current draft for a while (default one hour),
    * without a login: `GET /api/cms/:collection/:id?preview=<token>`. The admin adds one to the
-   * preview URL as `easy-cms-preview`, for sites on another origin.
+   * preview URL as `easy-cms-preview`, for sites on another origin. With `user`, the page reads
+   * it with that user's access (fields they can't read are left out; a deactivated user's token
+   * stops working); without, with full access.
    */
   createPreviewToken(target, options = {}) {
     const seconds = options.expiresIn ?? 60 * 60;
     const normalized = "global" in target ? target : { collection: target.collection, id: String(target.id) };
-    return signPreviewToken(this.config.secret, normalized, Date.now() + seconds * 1e3);
+    const user = options.user ? String(options.user.id) : void 0;
+    return signPreviewToken(this.config.secret, normalized, Date.now() + seconds * 1e3, user);
   }
   /** What a preview token opens, or `null` when it is invalid or expired. */
   verifyPreviewToken(token) {
@@ -7846,7 +7875,8 @@ var EasyCMS = class {
     const check3 = (operation) => this.checkDocumentAccess(config, operation, guard, parsed, void 0).then(
       () => true,
       (error) => {
-        if (error instanceof ForbiddenError || error instanceof UnauthorizedError) return false;
+        if (error instanceof ForbiddenError || error instanceof UnauthorizedError || error instanceof NotFoundError)
+          return false;
         throw error;
       }
     );
@@ -8315,7 +8345,38 @@ var EasyCMS = class {
     await this.checkQueryFields(config, guard, where);
     return andWhere(andWhere(where, access), own);
   }
+  /**
+   * Throws unless the caller may update or delete this document. A user who may not even read
+   * it gets `NotFoundError`, as for an id that doesn't exist: a 403 would tell it does.
+   */
   async checkDocumentAccess(config, operation, guard, id, data) {
+    await this.hidingDenied(
+      config.slug,
+      guard,
+      id,
+      () => this.documentAccess(config, operation, guard, id, data)
+    );
+  }
+  /** Runs a check; a `ForbiddenError` for a document the user can't read becomes a 404. */
+  async hidingDenied(collection2, guard, id, check3) {
+    try {
+      await check3();
+    } catch (error) {
+      if (error instanceof ForbiddenError && !await this.mayRead(collection2, guard, id))
+        throw new NotFoundError(collection2, String(id));
+      throw error;
+    }
+  }
+  async mayRead(collection2, guard, id) {
+    const config = this.collection(collection2);
+    try {
+      const where = await this.readWhere(config, guard, { id: { equals: id } });
+      return await this.db.count({ collection: collection2, where }) > 0;
+    } catch {
+      return false;
+    }
+  }
+  async documentAccess(config, operation, guard, id, data) {
     if (!guard.enforce) return;
     const own = await this.checkGrant(guard, { collection: config.slug }, operation);
     const allowed2 = await evaluateAccess(config.access?.[operation], {
@@ -8382,13 +8443,15 @@ var EasyCMS = class {
   }
   /** `checkGrant` for one document: a role limited to its own documents must own it. */
   async checkDocumentGrant(guard, collection2, operation, id) {
-    const own = await this.checkGrant(guard, { collection: collection2 }, operation);
-    if (own === true) return;
-    const matches2 = await this.db.count({
-      collection: collection2,
-      where: andWhere(own, { id: { equals: id } })
+    await this.hidingDenied(collection2, guard, id, async () => {
+      const own = await this.checkGrant(guard, { collection: collection2 }, operation);
+      if (own === true) return;
+      const matches2 = await this.db.count({
+        collection: collection2,
+        where: andWhere(own, { id: { equals: id } })
+      });
+      if (matches2 === 0) throw deny(guard.user);
     });
-    if (matches2 === 0) throw deny(guard.user);
   }
   /** Runs afterRead hooks, populates relationships and removes what the caller may not see. */
   async output(config, docs, guard, options) {
@@ -9042,7 +9105,7 @@ async function readAdminModule(cms, index) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.62.0" : "0.0.0-dev";
+var VERSION = true ? "0.64.0" : "0.0.0-dev";
 
 // src/rest/admin-deliveries.ts
 var PER_PAGE = 50;
@@ -9978,7 +10041,8 @@ async function respond(cms, request, url, path, root, options, production) {
   const headers = new Headers({
     "content-type": "application/json; charset=utf-8",
     "cache-control": "no-store",
-    "x-content-type-options": "nosniff"
+    "x-content-type-options": "nosniff",
+    ...production ? { "strict-transport-security": "max-age=31536000" } : {}
   });
   try {
     if (path === null) throw new HttpError("Not found", 404);
@@ -9995,7 +10059,8 @@ async function respond(cms, request, url, path, root, options, production) {
       context,
       via: signedIn ? via : null,
       token,
-      headers
+      headers,
+      trustProxy: options.trustProxy === true
     };
     const method = request.method.toUpperCase();
     if (method !== "GET" && method !== "HEAD") checkCsrf(cms, ctx);
@@ -10171,6 +10236,7 @@ async function route(cms, ctx, method, path, options) {
       case "POST logout": {
         if (ctx.token) await cms.auth.logout(ctx.token);
         clearSessionCookies(ctx);
+        ctx.headers.set("clear-site-data", '"cache"');
         return { body: { message: "Logged out" } };
       }
       case "GET me": {
@@ -10406,7 +10472,12 @@ async function route(cms, ctx, method, path, options) {
     if (!ctx.user || ctx.user.apiKey) throw new UnauthorizedError();
     if (method !== "GET") throw methodNotAllowed(ctx, "GET");
     const ids = (ctx.url.searchParams.get("ids") ?? "").split(",").map((id2) => parseId(id2)).filter((id2) => id2 !== void 0);
-    return { body: { count: await cms.mediaUsage(ids) } };
+    const count = await cms.mediaUsage(ids, {
+      overrideAccess: false,
+      user: ctx.user,
+      context: ctx.context
+    });
+    return { body: { count } };
   }
   if (first === "admin" && second === "roles") {
     if (!ctx.user) throw new UnauthorizedError();
@@ -10551,9 +10622,10 @@ async function route(cms, ctx, method, path, options) {
     if (third !== void 0) return globalAction(cms, ctx, method, second, segments.slice(2));
     if (method === "GET") {
       if (ctx.url.searchParams.has("preview")) {
-        requirePreview(cms, ctx, { global: second });
+        const as = await requirePreview(cms, ctx, { global: second });
         return {
           body: await cms.findGlobal(second, {
+            ...as,
             ...parseDepth(ctx.url),
             ...parseLocale(ctx.url),
             draft: true
@@ -10662,8 +10734,9 @@ async function route(cms, ctx, method, path, options) {
   }
   const id = second;
   if (method === "GET" && ctx.url.searchParams.has("preview")) {
-    requirePreview(cms, ctx, { collection: collection2, id });
+    const as = await requirePreview(cms, ctx, { collection: collection2, id });
     const doc = await cms.findById(collection2, id, {
+      ...as,
       ...parseDepth(ctx.url),
       ...parseLocale(ctx.url),
       draft: true
@@ -10742,7 +10815,7 @@ async function documentAction(cms, ctx, method, collection2, id, path) {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
     const body = await readJson(ctx.request);
     const result = await cms.preview(collection2, id, body, { ...access, ...depth });
-    const token = cms.createPreviewToken({ collection: collection2, id });
+    const token = cms.createPreviewToken({ collection: collection2, id }, { user: ctx.user });
     return { body: { ...result, url: result.url && withPreviewToken(result.url, token) } };
   }
   if (path.length === 1 && (action === "unpublish" || action === "discard-draft")) {
@@ -10792,7 +10865,7 @@ async function globalAction(cms, ctx, method, slug2, path) {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
     const body = await readJson(ctx.request);
     const result = await cms.previewGlobal(slug2, body, { ...access, ...depth });
-    const token = cms.createPreviewToken({ global: slug2 });
+    const token = cms.createPreviewToken({ global: slug2 }, { user: ctx.user });
     return { body: { ...result, url: result.url && withPreviewToken(result.url, token) } };
   }
   if (path.length === 1 && (action === "unpublish" || action === "discard-draft")) {
@@ -10831,10 +10904,16 @@ function withPreviewToken(url, token) {
   const separator = base.includes("?") ? "&" : "?";
   return `${base}${separator}${PREVIEW_PARAM}=${encodeURIComponent(token)}${fragment}`;
 }
-function requirePreview(cms, ctx, target) {
+async function requirePreview(cms, ctx, target) {
   const opened = cms.verifyPreviewToken(ctx.url.searchParams.get("preview"));
   const matches2 = opened !== null && ("global" in target ? "global" in opened && opened.global === target.global : "collection" in opened && opened.collection === target.collection && opened.id === target.id);
   if (!matches2) throw new UnauthorizedError("Invalid or expired preview token");
+  if (opened.user === void 0) return {};
+  const id = parseId(opened.user);
+  const issuer = id === void 0 ? null : await cms.auth.activeUser(id);
+  if (!issuer) throw new UnauthorizedError("Invalid or expired preview token");
+  const { user, context } = await cms.applyOnRequest(ctx.request.headers, ctx.url, issuer);
+  return { overrideAccess: false, user, context };
 }
 function parsePage(url) {
   const { page, limit } = parseListQuery(url);
@@ -10852,23 +10931,17 @@ function readToken(request) {
   return { token, via: token ? "cookie" : null };
 }
 function readCookie(request, name) {
-  const header = request.headers.get("cookie");
-  if (!header) return void 0;
-  for (const part of header.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq > 0 && part.slice(0, eq).trim() === name)
-      return decodeURIComponent(part.slice(eq + 1).trim());
-  }
-  return void 0;
+  return cookieValue(request.headers.get("cookie"), name);
 }
-function sameHost(origin, request) {
+function sameHost(origin, request, trustProxy) {
   let host;
   try {
     host = new URL(origin).host;
   } catch {
     return false;
   }
-  const forwarded = request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+  const trusted = trustProxy || !!process.env.VERCEL || !!process.env.NETLIFY;
+  const forwarded = trusted ? request.headers.get("x-forwarded-host")?.split(",")[0]?.trim() : void 0;
   return host === (forwarded || request.headers.get("host"));
 }
 function checkCsrf(cms, ctx) {
@@ -10876,7 +10949,7 @@ function checkCsrf(cms, ctx) {
   const fetchSite = ctx.request.headers.get("sec-fetch-site");
   const cookie2 = ctx.via === "cookie" && ctx.token !== void 0;
   const { cors } = cms.config;
-  const trusted = origin !== null && (origin === ctx.url.origin || sameHost(origin, ctx.request) || cms.config.auth.trustedOrigins.includes(origin) || !cookie2 && (cors === "*" || cors.includes(origin)));
+  const trusted = origin !== null && (origin === ctx.url.origin || sameHost(origin, ctx.request, ctx.trustProxy) || cms.config.auth.trustedOrigins.includes(origin) || !cookie2 && (cors === "*" || cors.includes(origin)));
   if (origin !== null && !trusted) throw new ForbiddenError("CSRF check failed: untrusted origin");
   if (origin === null && fetchSite === "cross-site")
     throw new ForbiddenError("CSRF check failed: cross-site request");
@@ -10898,7 +10971,7 @@ async function serveFile(cms, key, head) {
   const file = await cms.storage.get(key);
   if (!file) throw new HttpError("Not found", 404);
   const extension = key.slice(key.lastIndexOf(".") + 1);
-  const type = TYPE_BY_EXTENSION[extension] ?? "application/octet-stream";
+  const type = withCharset(TYPE_BY_EXTENSION[extension] ?? "application/octet-stream");
   return new Response(
     head ? null : file.body,
     {
@@ -10941,7 +11014,9 @@ async function servePrivateFile(cms, ctx, key, head) {
   }
   const file = await cms.privateStorage.get(key);
   if (!file) throw new HttpError("Not found", 404);
-  const type = TYPE_BY_EXTENSION[key.slice(key.lastIndexOf(".") + 1)] ?? "application/octet-stream";
+  const type = withCharset(
+    TYPE_BY_EXTENSION[key.slice(key.lastIndexOf(".") + 1)] ?? "application/octet-stream"
+  );
   return new Response(
     head ? null : file.body,
     {
@@ -11052,9 +11127,14 @@ function isSecure(ctx) {
   return ctx.url.protocol === "https:" || process.env.NODE_ENV === "production";
 }
 function cookie(ctx, name, value, opts) {
-  const parts = [`${name}=${encodeURIComponent(value)}`, "Path=/", "SameSite=Lax"];
+  const secure = isSecure(ctx);
+  const parts = [
+    `${secure ? hostCookie(name) : name}=${encodeURIComponent(value)}`,
+    "Path=/",
+    "SameSite=Lax"
+  ];
   if (opts.httpOnly) parts.push("HttpOnly");
-  if (isSecure(ctx)) parts.push("Secure");
+  if (secure) parts.push("Secure");
   if (opts.maxAge !== void 0) parts.push(`Max-Age=${opts.maxAge}`);
   return parts.join("; ");
 }
@@ -11133,6 +11213,9 @@ function setSessionCookies(cms, ctx, session) {
 function clearSessionCookies(ctx) {
   ctx.headers.append("set-cookie", cookie(ctx, SESSION_COOKIE, "", { httpOnly: true, maxAge: 0 }));
   ctx.headers.append("set-cookie", cookie(ctx, CSRF_COOKIE, "", { httpOnly: false, maxAge: 0 }));
+  if (isSecure(ctx))
+    for (const name of [SESSION_COOKIE, CSRF_COOKIE])
+      ctx.headers.append("set-cookie", `${name}=; Path=/; Max-Age=0; Secure; SameSite=Lax`);
 }
 function errorResponse(cms, error, headers, production) {
   if (error instanceof EasyCMSError) {
@@ -11198,6 +11281,7 @@ function createApiHandler(config, options = {}) {
     if (!handler) {
       handler = createRestHandler(cms, {
         getClientIp,
+        trustProxy: options.trustProxy === true,
         ...options.basePath ? { basePath: options.basePath } : {}
       });
       handlers.set(cms, handler);

package/dist/{chunk-FPFWLQB5.js → chunk-RTKWMVAC.js}

@@ -271,6 +271,12 @@ function sizeKey(filename, size) {
   return filename.replace(/\.([^.]+)$/, `-${size}.$1`);
 }
 var PRIVATE_KEY = /^[\p{L}\p{M}\p{N}-]+\.private(-[\p{L}\p{N}_-]+)?\.[a-z0-9]+$/u;
+function withCharset(type) {
+  if (/;\s*charset=/i.test(type)) return type;
+  const base = type.split(";")[0]?.trim().toLowerCase() ?? "";
+  const text = base.startsWith("text/") || /^application\/(json|xml|javascript|ecmascript)$/.test(base) || /\+(json|xml)$/.test(base);
+  return text ? `${type}; charset=utf-8` : type;
+}
 
 // src/fields.ts
 var uniqueWithinOf = (field) => field.uniqueWithin === void 0 ? [] : [field.uniqueWithin].flat();
@@ -534,6 +540,7 @@ export {
   withPrivacy,
   sizeKey,
   PRIVATE_KEY,
+  withCharset,
   uniqueWithinOf,
   isHasMany,
   mimeAllowedBy,

package/dist/{config-jzFGsNL6.d.ts → config-Dgs6FE0S.d.ts}

@@ -1746,9 +1746,10 @@ declare class EasyCMS<C extends Config = Config> {
     private mediaSignature;
     /**
      * How many documents use any of these files in a top-level upload field (rich text and fields
-     * inside groups, arrays and blocks are not counted). Drafts count too.
+     * inside groups, arrays and blocks are not counted). Drafts count too. With
+     * `overrideAccess: false`, only documents the user may read.
      */
-    mediaUsage(ids: readonly ID[]): Promise<number>;
+    mediaUsage(ids: readonly ID[], options?: AccessOptions): Promise<number>;
     /** The storage for public files, or for private ones. */
     storageFor(isPrivate: boolean): StorageAdapter;
     /**
@@ -1811,7 +1812,9 @@ declare class EasyCMS<C extends Config = Config> {
     /**
      * A token that lets a page read one document's current draft for a while (default one hour),
      * without a login: `GET /api/cms/:collection/:id?preview=<token>`. The admin adds one to the
-     * preview URL as `easy-cms-preview`, for sites on another origin.
+     * preview URL as `easy-cms-preview`, for sites on another origin. With `user`, the page reads
+     * it with that user's access (fields they can't read are left out; a deactivated user's token
+     * stops working); without, with full access.
      */
     createPreviewToken(target: {
         collection: string;
@@ -1820,10 +1823,12 @@ declare class EasyCMS<C extends Config = Config> {
         global: string;
     }, options?: {
         expiresIn?: number;
+        user?: AuthUser | null;
     }): string;
     /** What a preview token opens, or `null` when it is invalid or expired. */
     verifyPreviewToken(token: string | null | undefined): (PreviewTarget & {
         expiresAt: number;
+        user?: string;
     }) | null;
     /** Live preview of a global. See `preview`. */
     previewGlobal<S extends GSlug<C>>(slug: S, data: Record<string, unknown>, options?: DepthOptions): Promise<LivePreview<GDoc<C, S>>>;
@@ -1992,7 +1997,15 @@ declare class EasyCMS<C extends Config = Config> {
     private checkGrant;
     /** The query constraint read access adds, or `undefined` when there is none. Throws when denied. */
     private readWhere;
+    /**
+     * Throws unless the caller may update or delete this document. A user who may not even read
+     * it gets `NotFoundError`, as for an id that doesn't exist: a 403 would tell it does.
+     */
     private checkDocumentAccess;
+    /** Runs a check; a `ForbiddenError` for a document the user can't read becomes a 404. */
+    private hidingDenied;
+    private mayRead;
+    private documentAccess;
     private checkGlobalAccess;
     private fieldChecker;
     /**

package/dist/{handler-CMA1LIq7.d.ts → handler-CcmsrLs8.d.ts}

@@ -1,4 +1,4 @@
-import { I as ID, ab as Config, au as EasyCMS, bd as LocalizationConfig, aD as Field, aH as FieldError, aS as FilterOptions, af as CreateEasyCMSOptions, bI as ResolvedConfig } from './config-jzFGsNL6.js';
+import { I as ID, ab as Config, au as EasyCMS, bd as LocalizationConfig, aD as Field, aH as FieldError, aS as FilterOptions, af as CreateEasyCMSOptions, bI as ResolvedConfig } from './config-Dgs6FE0S.js';
 
 type BackupState = 'pending' | 'running' | 'done' | 'failed';
 /** One backup as the admin shows it (`GET <api>/admin/backups`). */
@@ -172,6 +172,11 @@ interface RestHandlerOptions {
     readonly basePath?: string;
     /** Client IP, used with the email to rate-limit logins. Adapters provide it. */
     readonly getClientIp?: (request: Request) => string | undefined;
+    /**
+     * Behind a reverse proxy you control: its `X-Forwarded-Host` names the public host (for the
+     * CSRF check of a request's Origin). Vercel and Netlify are recognized without it.
+     */
+    readonly trustProxy?: boolean;
 }
 type RestHandler = (request: Request) => Promise<Response>;
 /** Creates the REST API as a Web-standard `(Request) => Response` handler. */
@@ -183,6 +188,7 @@ declare function createRestHandler<C extends Config>(instance: EasyCMS<C>, optio
  * use it; the standalone server does.
  */
 declare function createRootEndpointHandler<C extends Config>(instance: EasyCMS<C>, options?: Pick<RestHandlerOptions, 'getClientIp'>): (request: Request) => Promise<Response | undefined>;
+/** A cookie of the request; the `__Host-` one (set over HTTPS) first. */
 declare function readCookie(request: Request, name: string): string | undefined;
 
 export { type AdminBackup as A, type BackupState as B, CONFIG_FILE_NAMES as C, DEFAULT_ADMIN_PATH as D, validateFields as E, writeBackupFile as F, type LoadConfigOptions as L, type RestHandler as R, type AdminBackups as a, type ApiHandlerOptions as b, type RestHandlerOptions as c, createApiHandler as d, createRestHandler as e, slugify as f, CSRF_COOKIE as g, CSRF_HEADER as h, DEFAULT_API_PATH as i, DEFAULT_MAX_FILE_SIZE as j, DEFAULT_TOKEN_EXPIRATION as k, loadConfig as l, applyDefaults as m, applyPlugins as n, createRootEndpointHandler as o, fillMissing as p, findConfigFile as q, resolveConfig as r, sharedEasyCMS as s, forwardedClientIp as t, generateSlugs as u, importConfig as v, mergeForUpdate as w, parseId as x, platformClientIp as y, readCookie as z };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { P as PaginatedDocs, I as ID, E as EmailSetting } from './config-jzFGsNL6.js';
-export { A as ADAPTER_API_VERSION, a as ADMIN_ICONS, b as Access, c as AccessArgs, d as AccessOptions, e as AdminBrand, f as AdminCommand, g as AdminComponent, h as AdminConfig, i as AdminFieldArgs, j as AdminIcon, k as AdminLocale, l as AdminPage, m as AdminRole, n as AdminRoleChange, o as AdminRoleField, p as AdminRoleTarget, q as AdminRoleView, r as AdminRoles, s as AdminSso, t as AdminSwitcher, u as AdminViewAccess, v as AfterChangeHook, w as AfterDeleteHook, x as AfterReadHook, y as ApiKeyContext, z as ApiKeyGlobalOperation, B as ApiKeyOperation, C as ApiKeyPermissions, D as ArrayField, F as AuditChange, G as AuditConfig, H as AuditEntry, J as AuditLog, K as AuditPage, L as AuditVerification, M as Auth, N as AuthConfig, O as AuthProvider, Q as AuthProviderProfile, R as AuthProviderRequest, S as AuthUser, T as BackupsConfig, U as BeforeChangeHook, V as BeforeDeleteHook, W as BeforeValidateHook, X as Block, Y as BlocksField, Z as BooleanField, _ as BuiltinApiKeysCollection, $ as BuiltinMediaCollection, a0 as BuiltinMediaFoldersCollection, a1 as BuiltinUsersCollection, a2 as BundleHints, a3 as CliCommand, a4 as CollectionAccess, a5 as CollectionAdmin, a6 as CollectionConfig, a7 as CollectionDocument, a8 as CollectionHooks, a9 as CollectionListAdmin, aa as CollectionSlug, ab as Config, ac as ConfigError, ad as ConfigIssue, ae as ContainerAdmin, af as CreateEasyCMSOptions, ag as CreateInput, ah as CreateMigrationResult, ai as CustomField, aj as CustomFieldTypes, ak as DashboardWidget, al as Database, am as DatabaseAdapter, an as DatabaseInitArgs, ao as DatabaseTransfer, ap as DateField, aq as DepthOptions, ar as DirectUpload, as as DiskStorageOptions, at as DocumentOf, au as EasyCMS, av as EasyCMSError, aw as EmailAdapter, ax as EmailField, ay as EmailMessage, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aC as FIELD_TYPES, aD as Field, aE as FieldAccess, aF as FieldAccessFn, aG as FieldAdmin, aH as FieldError, aI as FieldRule, aJ as FieldType, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aN as FieldValidate, aO as FieldValidateContext, aP as FieldValue, aQ as FieldsInput, aR as FieldsValue, aS as FilterOptions, aT as FilterOptionsArgs, aU as FindArgs, aV as FindOptions, aW as FolderLevel, aX as FolderPermissions, aY as ForbiddenError, aZ as GlobalAccess, a_ as GlobalConfig, a$ as GlobalDocument, b0 as GlobalHooks, b1 as GlobalInput, b2 as GlobalSlug, b3 as GroupField, b4 as ImageSize, b5 as IncrementOptions, b6 as InferCollection, b7 as InferGlobal, b8 as JobConfig, b9 as JsonField, ba as Label, bb as LayoutNode, bc as LivePreview, bd as LocalizationConfig, be as Logger, bf as LoginArgs, bg as MediaDocument, bh as MediaSize, bi as MembersConfig, bj as MembersSignup, bk as MigrationInfo, bl as NavGroup, bm as NotFoundError, bn as NumberField, bo as OnRequest, bp as OnRequestArgs, bq as Operation, br as PLUGIN_API_VERSION, bs as PasswordEmail, bt as PasswordEmailArgs, bu as PasswordEmailFn, bv as PasswordLinkOptions, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bA as PreviewTarget, bB as PreviewURL, bC as QueryError, bD as ROLE_OPERATIONS, bE as RawDocument, bF as ReadOptions, bG as RelationshipField, bH as RequestContext, bI as ResolvedConfig, bJ as RichTextDocument, bK as RichTextField, bL as Role, bM as RoleOperation, bN as RolePermissions, bO as Roles, bP as RoutesConfig, bQ as ScheduledPublish, bR as SchemaError, bS as SchemaMode, bT as SelectField, bU as SelectOption, bV as Session, bW as SidebarPanel, bX as SignupArgs, bY as SignupResult, bZ as SingleSignOn, b_ as SlugField, b$ as SlugOf, c0 as SsoOutcome, c1 as SsoProviderRef, c2 as StorageAdapter, c3 as StoredFile, c4 as TextField, c5 as TextareaField, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, c9 as UpdateInput, ca as UpdateOptions, cb as UploadConfig, cc as UploadField, cd as UploadFromURLConfig, ce as UserIdentity, cf as ValidationError, cg as Version, ch as VersionSummary, ci as VersionsConfig, cj as WEBHOOK_EVENTS, ck as WebhookConfig, cl as WebhookEvent, cm as WebhookPayload, cn as Where, co as WhereOperators, cp as anyone, cq as consoleEmail, cr as consoleLogger, cs as createEasyCMS, ct as defineConfig, cu as defineFieldType, cv as definePlugin, cw as diskStorage, cx as hasRows, cy as isAdmin, cz as isHasMany, cA as isSignedIn, cB as isStaff, cC as isSystemAdmin, cD as mimeAllowedBy, cE as rowFields, cF as silentLogger, cG as uniqueWithinOf } from './config-jzFGsNL6.js';
-export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-C19Bt8ux.js';
-export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-CMA1LIq7.js';
+import { P as PaginatedDocs, I as ID, E as EmailSetting } from './config-Dgs6FE0S.js';
+export { A as ADAPTER_API_VERSION, a as ADMIN_ICONS, b as Access, c as AccessArgs, d as AccessOptions, e as AdminBrand, f as AdminCommand, g as AdminComponent, h as AdminConfig, i as AdminFieldArgs, j as AdminIcon, k as AdminLocale, l as AdminPage, m as AdminRole, n as AdminRoleChange, o as AdminRoleField, p as AdminRoleTarget, q as AdminRoleView, r as AdminRoles, s as AdminSso, t as AdminSwitcher, u as AdminViewAccess, v as AfterChangeHook, w as AfterDeleteHook, x as AfterReadHook, y as ApiKeyContext, z as ApiKeyGlobalOperation, B as ApiKeyOperation, C as ApiKeyPermissions, D as ArrayField, F as AuditChange, G as AuditConfig, H as AuditEntry, J as AuditLog, K as AuditPage, L as AuditVerification, M as Auth, N as AuthConfig, O as AuthProvider, Q as AuthProviderProfile, R as AuthProviderRequest, S as AuthUser, T as BackupsConfig, U as BeforeChangeHook, V as BeforeDeleteHook, W as BeforeValidateHook, X as Block, Y as BlocksField, Z as BooleanField, _ as BuiltinApiKeysCollection, $ as BuiltinMediaCollection, a0 as BuiltinMediaFoldersCollection, a1 as BuiltinUsersCollection, a2 as BundleHints, a3 as CliCommand, a4 as CollectionAccess, a5 as CollectionAdmin, a6 as CollectionConfig, a7 as CollectionDocument, a8 as CollectionHooks, a9 as CollectionListAdmin, aa as CollectionSlug, ab as Config, ac as ConfigError, ad as ConfigIssue, ae as ContainerAdmin, af as CreateEasyCMSOptions, ag as CreateInput, ah as CreateMigrationResult, ai as CustomField, aj as CustomFieldTypes, ak as DashboardWidget, al as Database, am as DatabaseAdapter, an as DatabaseInitArgs, ao as DatabaseTransfer, ap as DateField, aq as DepthOptions, ar as DirectUpload, as as DiskStorageOptions, at as DocumentOf, au as EasyCMS, av as EasyCMSError, aw as EmailAdapter, ax as EmailField, ay as EmailMessage, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aC as FIELD_TYPES, aD as Field, aE as FieldAccess, aF as FieldAccessFn, aG as FieldAdmin, aH as FieldError, aI as FieldRule, aJ as FieldType, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aN as FieldValidate, aO as FieldValidateContext, aP as FieldValue, aQ as FieldsInput, aR as FieldsValue, aS as FilterOptions, aT as FilterOptionsArgs, aU as FindArgs, aV as FindOptions, aW as FolderLevel, aX as FolderPermissions, aY as ForbiddenError, aZ as GlobalAccess, a_ as GlobalConfig, a$ as GlobalDocument, b0 as GlobalHooks, b1 as GlobalInput, b2 as GlobalSlug, b3 as GroupField, b4 as ImageSize, b5 as IncrementOptions, b6 as InferCollection, b7 as InferGlobal, b8 as JobConfig, b9 as JsonField, ba as Label, bb as LayoutNode, bc as LivePreview, bd as LocalizationConfig, be as Logger, bf as LoginArgs, bg as MediaDocument, bh as MediaSize, bi as MembersConfig, bj as MembersSignup, bk as MigrationInfo, bl as NavGroup, bm as NotFoundError, bn as NumberField, bo as OnRequest, bp as OnRequestArgs, bq as Operation, br as PLUGIN_API_VERSION, bs as PasswordEmail, bt as PasswordEmailArgs, bu as PasswordEmailFn, bv as PasswordLinkOptions, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bA as PreviewTarget, bB as PreviewURL, bC as QueryError, bD as ROLE_OPERATIONS, bE as RawDocument, bF as ReadOptions, bG as RelationshipField, bH as RequestContext, bI as ResolvedConfig, bJ as RichTextDocument, bK as RichTextField, bL as Role, bM as RoleOperation, bN as RolePermissions, bO as Roles, bP as RoutesConfig, bQ as ScheduledPublish, bR as SchemaError, bS as SchemaMode, bT as SelectField, bU as SelectOption, bV as Session, bW as SidebarPanel, bX as SignupArgs, bY as SignupResult, bZ as SingleSignOn, b_ as SlugField, b$ as SlugOf, c0 as SsoOutcome, c1 as SsoProviderRef, c2 as StorageAdapter, c3 as StoredFile, c4 as TextField, c5 as TextareaField, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, c9 as UpdateInput, ca as UpdateOptions, cb as UploadConfig, cc as UploadField, cd as UploadFromURLConfig, ce as UserIdentity, cf as ValidationError, cg as Version, ch as VersionSummary, ci as VersionsConfig, cj as WEBHOOK_EVENTS, ck as WebhookConfig, cl as WebhookEvent, cm as WebhookPayload, cn as Where, co as WhereOperators, cp as anyone, cq as consoleEmail, cr as consoleLogger, cs as createEasyCMS, ct as defineConfig, cu as defineFieldType, cv as definePlugin, cw as diskStorage, cx as hasRows, cy as isAdmin, cz as isHasMany, cA as isSignedIn, cB as isStaff, cC as isSystemAdmin, cD as mimeAllowedBy, cE as rowFields, cF as silentLogger, cG as uniqueWithinOf } from './config-Dgs6FE0S.js';
+export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-8hrkYMuR.js';
+export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-CcmsrLs8.js';
 export { FieldCondition, matchesCondition } from './conditions.js';
 
 type DeliveryKind = 'webhook' | 'email';

package/dist/index.js

@@ -23,7 +23,7 @@ import {
   sharedEasyCMS,
   silentLogger,
   slugify
-} from "./chunk-CX7R6QBJ.js";
+} from "./chunk-JZW6G6XI.js";
 import {
   matchesCondition
 } from "./chunk-U266LV4M.js";
@@ -48,7 +48,7 @@ import {
   defineFieldType,
   definePlugin,
   warnDeprecated
-} from "./chunk-FPFWLQB5.js";
+} from "./chunk-RTKWMVAC.js";
 export {
   ADAPTER_API_VERSION,
   ADMIN_API_VERSION,

package/dist/internal.d.ts

@@ -1,6 +1,6 @@
-import { ab as Config, al as Database, bl as NavGroup, a6 as CollectionConfig, I as ID, bE as RawDocument, aD as Field, bI as ResolvedConfig, ad as ConfigIssue } from './config-jzFGsNL6.js';
-export { cH as API_KEYS, cI as API_KEY_GLOBAL_OPERATIONS, cJ as API_KEY_OPERATIONS, cK as DEFAULT_MAX_VERSIONS, cL as DEFAULT_PASSWORD_EMAILS, cM as FIELD_TYPE_BASES, cN as FOLDER_LEVELS, cO as MediaFolders, cP as SSO_COOKIE, cQ as codeOfStatus, cx as hasRows, cz as isHasMany, cR as keyAllows, cD as mimeAllowedBy, cE as rowFields, cG as uniqueWithinOf } from './config-jzFGsNL6.js';
-export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as fillMissing, q as findConfigFile, t as forwardedClientIp, u as generateSlugs, v as importConfig, w as mergeForUpdate, x as parseId, y as platformClientIp, z as readCookie, E as validateFields, F as writeBackupFile } from './handler-CMA1LIq7.js';
+import { ab as Config, al as Database, bl as NavGroup, a6 as CollectionConfig, I as ID, bE as RawDocument, aD as Field, bI as ResolvedConfig, ad as ConfigIssue } from './config-Dgs6FE0S.js';
+export { cH as API_KEYS, cI as API_KEY_GLOBAL_OPERATIONS, cJ as API_KEY_OPERATIONS, cK as DEFAULT_MAX_VERSIONS, cL as DEFAULT_PASSWORD_EMAILS, cM as FIELD_TYPE_BASES, cN as FOLDER_LEVELS, cO as MediaFolders, cP as SSO_COOKIE, cQ as codeOfStatus, cx as hasRows, cz as isHasMany, cR as keyAllows, cD as mimeAllowedBy, cE as rowFields, cG as uniqueWithinOf } from './config-Dgs6FE0S.js';
+export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as fillMissing, q as findConfigFile, t as forwardedClientIp, u as generateSlugs, v as importConfig, w as mergeForUpdate, x as parseId, y as platformClientIp, z as readCookie, E as validateFields, F as writeBackupFile } from './handler-CcmsrLs8.js';
 export { conditionIssues } from './conditions.js';
 
 /** The session cookie the REST API sets at login. */

package/dist/internal.js

@@ -52,7 +52,7 @@ import {
   verifyPassword,
   verifyTurnstile,
   writeBackupFile
-} from "./chunk-CX7R6QBJ.js";
+} from "./chunk-JZW6G6XI.js";
 import {
   conditionIssues
 } from "./chunk-U266LV4M.js";
@@ -70,7 +70,7 @@ import {
   rowFields,
   sniffMimeType,
   uniqueWithinOf
-} from "./chunk-FPFWLQB5.js";
+} from "./chunk-RTKWMVAC.js";
 
 // src/typegen.ts
 var pascal = (name) => name.split(/[^A-Za-z0-9]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");

package/dist/{plugin-C19Bt8ux.d.ts → plugin-8hrkYMuR.d.ts}

@@ -1,4 +1,4 @@
-import { ba as Label, aD as Field, I as ID, k as AdminLocale, t as AdminSwitcher, c1 as SsoProviderRef } from './config-jzFGsNL6.js';
+import { ba as Label, aD as Field, I as ID, k as AdminLocale, t as AdminSwitcher, c1 as SsoProviderRef } from './config-Dgs6FE0S.js';
 import { FieldCondition } from './conditions.js';
 
 /** A Web Component from an admin module, with its `props` (plain JSON). */

package/dist/plugin.d.ts

@@ -1,3 +1,3 @@
-export { a as ADMIN_ICONS, g as AdminComponent, j as AdminIcon, S as AuthUser, a3 as CliCommand, a4 as CollectionAccess, a6 as CollectionConfig, ab as Config, ac as ConfigError, ak as DashboardWidget, av as EasyCMSError, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aD as Field, aE as FieldAccess, aH as FieldError, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aY as ForbiddenError, a_ as GlobalConfig, I as ID, b8 as JobConfig, ba as Label, bl as NavGroup, bm as NotFoundError, bo as OnRequest, bp as OnRequestArgs, br as PLUGIN_API_VERSION, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bC as QueryError, bH as RequestContext, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, cf as ValidationError, cn as Where, cu as defineFieldType, cv as definePlugin } from './config-jzFGsNL6.js';
-export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-C19Bt8ux.js';
+export { a as ADMIN_ICONS, g as AdminComponent, j as AdminIcon, S as AuthUser, a3 as CliCommand, a4 as CollectionAccess, a6 as CollectionConfig, ab as Config, ac as ConfigError, ak as DashboardWidget, av as EasyCMSError, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aD as Field, aE as FieldAccess, aH as FieldError, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aY as ForbiddenError, a_ as GlobalConfig, I as ID, b8 as JobConfig, ba as Label, bl as NavGroup, bm as NotFoundError, bo as OnRequest, bp as OnRequestArgs, br as PLUGIN_API_VERSION, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bC as QueryError, bH as RequestContext, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, cf as ValidationError, cn as Where, cu as defineFieldType, cv as definePlugin } from './config-Dgs6FE0S.js';
+export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-8hrkYMuR.js';
 import './conditions.js';

package/dist/plugin.js

@@ -16,7 +16,7 @@ import {
   defineFieldType,
   definePlugin,
   warnDeprecated
-} from "./chunk-FPFWLQB5.js";
+} from "./chunk-RTKWMVAC.js";
 export {
   ADMIN_API_VERSION,
   ADMIN_ICONS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.62.0",
+  "version": "0.64.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",