@easy-cms/core 1.17.0 → 1.18.0

package/dist/{chunk-LPIABPBA.js → chunk-NTAFZ4M6.js}

@@ -45,6 +45,99 @@ var isStaff = ({ user }) => user !== null && user.member !== true;
 var isSignedIn = ({ user }) => user !== null;
 var isAdmin = ({ user }) => user?.role === "admin" && user.scoped !== true;
 
+// src/auth/tokens.ts
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
+function newToken() {
+  return randomBytes(32).toString("base64url");
+}
+function hashToken(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+function hmac(secret, value) {
+  return createHmac("sha256", secret).update(value).digest("base64url");
+}
+function secretsOf(config) {
+  return [config.secret, ...config.previousSecrets ?? []];
+}
+function signedWith(secrets, value, signature) {
+  return [secrets].flat().some((secret) => safeEqual(signature, hmac(secret, value)));
+}
+function signToken(secret, token) {
+  return `${token}.${hmac(secret, `session:${token}`)}`;
+}
+function unsignToken(secrets, value) {
+  const dot = value.lastIndexOf(".");
+  if (dot <= 0) return void 0;
+  const token = value.slice(0, dot);
+  return signedWith(secrets, `session:${token}`, value.slice(dot + 1)) ? token : void 0;
+}
+function csrfToken(secret, token) {
+  return hmac(secret, `csrf:${token}`);
+}
+function csrfMatches(secrets, token, given) {
+  return signedWith(secrets, `csrf:${token}`, given);
+}
+function safeEqual(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+function signPreviewToken(secret, target, expiresAt, user) {
+  const payload = Buffer.from(
+    JSON.stringify({
+      ..."global" in target ? { g: target.global } : { c: target.collection, i: target.id },
+      e: expiresAt,
+      ...user !== void 0 ? { u: user } : {}
+    })
+  ).toString("base64url");
+  return `${payload}.${hmac(secret, `preview:${payload}`)}`;
+}
+function verifyPreviewToken(secrets, token, now = Date.now()) {
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0) return null;
+  const payload = token.slice(0, dot);
+  if (!signedWith(secrets, `preview:${payload}`, token.slice(dot + 1))) return null;
+  try {
+    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (typeof data.e !== "number" || data.e <= now) return null;
+    const user = typeof data.u === "string" ? { user: data.u } : {};
+    if (typeof data.g === "string") return { global: data.g, expiresAt: data.e, ...user };
+    if (typeof data.c === "string" && typeof data.i === "string")
+      return { collection: data.c, id: data.i, expiresAt: data.e, ...user };
+    return null;
+  } catch {
+    return null;
+  }
+}
+function passwordFingerprint(passwordHash) {
+  return createHash("sha256").update(typeof passwordHash === "string" ? passwordHash : "no-password").digest("base64url").slice(0, 22);
+}
+function signPasswordToken(secret, args) {
+  const payload = Buffer.from(
+    JSON.stringify({ u: args.userId, p: args.purpose, e: args.expiresAt })
+  ).toString("base64url");
+  return `${payload}.${hmac(secret, `password:${payload}:${args.fingerprint}`)}`;
+}
+function readPasswordToken(token) {
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0) return null;
+  const payload = token.slice(0, dot);
+  try {
+    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (typeof data.u !== "string" || typeof data.e !== "number") return null;
+    if (data.p !== "reset" && data.p !== "invite" && data.p !== "verify") return null;
+    return { userId: data.u, purpose: data.p, expiresAt: data.e, payload };
+  } catch {
+    return null;
+  }
+}
+function passwordTokenMatches(secrets, token, fingerprint) {
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0) return false;
+  const payload = token.slice(0, dot);
+  return signedWith(secrets, `password:${payload}:${fingerprint}`, token.slice(dot + 1));
+}
+
 // src/builtins.ts
 var USERS = "users";
 var MEDIA = "media";
@@ -563,7 +656,7 @@ var emailDeliveriesCollection = {
 
 // src/audit.ts
 import { AsyncLocalStorage } from "async_hooks";
-import { createHmac } from "crypto";
+import { createHmac as createHmac2 } from "crypto";
 var DEFAULT_AUDIT_KEEP = 365;
 var DEFAULT_FAILED_LOGINS = 20;
 var MAX_VALUE = 500;
@@ -778,7 +871,7 @@ var AuditLog = class {
       });
       for (const row of result.docs) {
         checked++;
-        if (row.signature !== this.sign(row)) invalid.push(row.id);
+        if (!this.signer(row)) invalid.push(row.id);
         const id = Number(row.id);
         if (previous !== void 0 && Number.isInteger(id) && id > previous + 1)
           gaps += id - previous - 1;
@@ -797,6 +890,49 @@ var AuditLog = class {
     );
     return verification;
   }
+  /** The secret an entry was signed with: the current one, a previous one, or none (changed). */
+  signer(row) {
+    return secretsOf(this.cms.config).find((secret) => row.signature === this.sign(row, secret));
+  }
+  /**
+   * After `secret` changed: signs again, with the current secret, the entries signed with one of
+   * `previousSecrets`, so they still verify once it is removed. Entries no secret verifies were
+   * changed: they are left as they are, and reported. Records `audit.resign`.
+   */
+  async resign() {
+    const invalid = [];
+    let checked = 0;
+    let resigned = 0;
+    for (let page = 1; ; page++) {
+      const result = await this.cms.db.find({
+        collection: AUDIT_LOGS,
+        sort: ["id"],
+        limit: 500,
+        page
+      });
+      for (const row of result.docs) {
+        checked++;
+        const secret = this.signer(row);
+        if (secret === void 0) invalid.push(row.id);
+        else if (secret !== this.cms.config.secret) {
+          const { id, ...data } = row;
+          await this.cms.db.update({
+            collection: AUDIT_LOGS,
+            id,
+            data: { ...data, signature: this.sign(row) }
+          });
+          resigned++;
+        }
+      }
+      if (page >= result.totalPages) break;
+    }
+    await this.record({
+      action: "audit.resign",
+      target: "audit",
+      detail: { checked, resigned, invalid: invalid.length }
+    });
+    return { checked, resigned, invalid };
+  }
   /**
    * Daily upkeep from `runJobs`: deletes entries older than `keep` days, then verifies the log.
    * Runs when the last check is more than a day old.
@@ -847,11 +983,11 @@ var AuditLog = class {
     const scope = this.settings.scope;
     return (scope && context ? scope({ context, user }) : null) ?? null;
   }
-  sign(row) {
+  sign(row, secret = this.cms.config.secret) {
     const values = SIGNED.map((key) => row[key] ?? null);
     if (typeof row.scope === "string" && row.scope) values.push(row.scope);
     const payload = stable(values);
-    return createHmac("sha256", this.cms.config.secret).update(`audit:${payload}`).digest("base64url");
+    return createHmac2("sha256", secret).update(`audit:${payload}`).digest("base64url");
   }
   async lastVerification() {
     const { docs } = await this.cms.db.find({
@@ -903,7 +1039,7 @@ function toEntry(row) {
 }
 
 // src/api-keys.ts
-import { createHash, randomBytes, timingSafeEqual } from "crypto";
+import { createHash as createHash2, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var API_KEYS = "api-keys";
 var API_KEY_OPERATIONS = ["read", "create", "update", "delete", "publish"];
 var API_KEY_GLOBAL_OPERATIONS = ["read", "update", "publish"];
@@ -913,12 +1049,12 @@ function isApiKey(token) {
   return token.startsWith("ecms_");
 }
 function newApiKey() {
-  const prefix = randomBytes(4).toString("hex");
-  const secret = randomBytes(32).toString("base64url");
+  const prefix = randomBytes2(4).toString("hex");
+  const secret = randomBytes2(32).toString("base64url");
   return { key: `ecms_${prefix}_${secret}`, prefix, hash: hashSecret(secret) };
 }
 function hashSecret(secret) {
-  return createHash("sha256").update(secret).digest("hex");
+  return createHash2("sha256").update(secret).digest("hex");
 }
 function parseApiKey(token) {
   const match = KEY_PATTERN.exec(token);
@@ -928,7 +1064,7 @@ function secretMatches(secret, hash) {
   if (typeof hash !== "string") return false;
   const a = Buffer.from(hashSecret(secret), "hex");
   const b = Buffer.from(hash, "hex");
-  return a.length === b.length && timingSafeEqual(a, b);
+  return a.length === b.length && timingSafeEqual2(a, b);
 }
 function keyAllows(user, target, operation) {
   const key = user?.apiKey;
@@ -1035,20 +1171,23 @@ function cleanPermissions(value, known) {
 }
 
 // src/spam.ts
-import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual3 } from "crypto";
 var MAX_AGE = 24 * 36e5;
-var sign = (secret, value) => createHmac2("sha256", secret).update(value).digest("base64url");
+var sign = (secret, value) => createHmac3("sha256", secret).update(value).digest("base64url");
 function formToken(secret, purpose, now = Date.now()) {
   return `${now}.${sign(secret, `${purpose}:${now}`)}`;
 }
-function checkFormToken(secret, purpose, token, minTime, now = Date.now()) {
+function checkFormToken(secrets, purpose, token, minTime, now = Date.now()) {
   if (typeof token !== "string") return "invalid";
   const [time, signature] = token.split(".");
   const issued = Number(time);
   if (!Number.isFinite(issued) || !signature) return "invalid";
-  const expected = Buffer.from(sign(secret, `${purpose}:${issued}`));
   const given = Buffer.from(signature);
-  if (expected.length !== given.length || !timingSafeEqual2(expected, given)) return "invalid";
+  const genuine = [secrets].flat().some((secret) => {
+    const expected = Buffer.from(sign(secret, `${purpose}:${issued}`));
+    return expected.length === given.length && timingSafeEqual3(expected, given);
+  });
+  if (!genuine) return "invalid";
   if (now - issued < minTime) return "too-fast";
   if (now - issued > MAX_AGE) return "expired";
   return "ok";
@@ -1172,7 +1311,7 @@ var DEFAULT_PASSWORD_EMAILS = {
 };
 
 // src/auth/password.ts
-import { randomBytes as randomBytes2, scrypt, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { randomBytes as randomBytes3, scrypt, timingSafeEqual as timingSafeEqual4 } from "crypto";
 var MIN_PASSWORD_LENGTH = 8;
 var N = 2 ** 17;
 var R = 8;
@@ -1191,7 +1330,7 @@ function derive(password, salt, n, r, p, length) {
   });
 }
 async function hashPassword(password) {
-  const salt = randomBytes2(16);
+  const salt = randomBytes3(16);
   const key = await derive(password, salt, N, R, P, KEY_LENGTH);
   return ["scrypt", N, R, P, salt.toString("base64url"), key.toString("base64url")].join("$");
 }
@@ -1207,7 +1346,7 @@ async function verifyPassword(password, stored) {
     Number(p),
     expected.length
   );
-  return key.length === expected.length && timingSafeEqual3(key, expected);
+  return key.length === expected.length && timingSafeEqual4(key, expected);
 }
 var dummyHash;
 async function fakeVerify(password) {
@@ -1218,92 +1357,6 @@ async function fakeVerify(password) {
 
 // src/auth/sso.ts
 import { createHmac as createHmac4, randomBytes as randomBytes4 } from "crypto";
-
-// src/auth/tokens.ts
-import { createHash as createHash2, createHmac as createHmac3, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual4 } from "crypto";
-function newToken() {
-  return randomBytes3(32).toString("base64url");
-}
-function hashToken(token) {
-  return createHash2("sha256").update(token).digest("hex");
-}
-function hmac(secret, value) {
-  return createHmac3("sha256", secret).update(value).digest("base64url");
-}
-function signToken(secret, token) {
-  return `${token}.${hmac(secret, `session:${token}`)}`;
-}
-function unsignToken(secret, value) {
-  const dot = value.lastIndexOf(".");
-  if (dot <= 0) return void 0;
-  const token = value.slice(0, dot);
-  return safeEqual(value.slice(dot + 1), hmac(secret, `session:${token}`)) ? token : void 0;
-}
-function csrfToken(secret, token) {
-  return hmac(secret, `csrf:${token}`);
-}
-function safeEqual(a, b) {
-  const left = Buffer.from(a);
-  const right = Buffer.from(b);
-  return left.length === right.length && timingSafeEqual4(left, right);
-}
-function signPreviewToken(secret, target, expiresAt, user) {
-  const payload = Buffer.from(
-    JSON.stringify({
-      ..."global" in target ? { g: target.global } : { c: target.collection, i: target.id },
-      e: expiresAt,
-      ...user !== void 0 ? { u: user } : {}
-    })
-  ).toString("base64url");
-  return `${payload}.${hmac(secret, `preview:${payload}`)}`;
-}
-function verifyPreviewToken(secret, token, now = Date.now()) {
-  const dot = token.lastIndexOf(".");
-  if (dot <= 0) return null;
-  const payload = token.slice(0, dot);
-  if (!safeEqual(token.slice(dot + 1), hmac(secret, `preview:${payload}`))) return null;
-  try {
-    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (typeof data.e !== "number" || data.e <= now) return null;
-    const user = typeof data.u === "string" ? { user: data.u } : {};
-    if (typeof data.g === "string") return { global: data.g, expiresAt: data.e, ...user };
-    if (typeof data.c === "string" && typeof data.i === "string")
-      return { collection: data.c, id: data.i, expiresAt: data.e, ...user };
-    return null;
-  } catch {
-    return null;
-  }
-}
-function passwordFingerprint(passwordHash) {
-  return createHash2("sha256").update(typeof passwordHash === "string" ? passwordHash : "no-password").digest("base64url").slice(0, 22);
-}
-function signPasswordToken(secret, args) {
-  const payload = Buffer.from(
-    JSON.stringify({ u: args.userId, p: args.purpose, e: args.expiresAt })
-  ).toString("base64url");
-  return `${payload}.${hmac(secret, `password:${payload}:${args.fingerprint}`)}`;
-}
-function readPasswordToken(token) {
-  const dot = token.lastIndexOf(".");
-  if (dot <= 0) return null;
-  const payload = token.slice(0, dot);
-  try {
-    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (typeof data.u !== "string" || typeof data.e !== "number") return null;
-    if (data.p !== "reset" && data.p !== "invite" && data.p !== "verify") return null;
-    return { userId: data.u, purpose: data.p, expiresAt: data.e, payload };
-  } catch {
-    return null;
-  }
-}
-function passwordTokenMatches(secret, token, fingerprint) {
-  const dot = token.lastIndexOf(".");
-  if (dot <= 0) return false;
-  const payload = token.slice(0, dot);
-  return safeEqual(token.slice(dot + 1), hmac(secret, `password:${payload}:${fingerprint}`));
-}
-
-// src/auth/sso.ts
 var SSO_COOKIE = "ecms-sso";
 var PENDING_TTL = 10 * 6e4;
 var random = () => randomBytes4(32).toString("base64url");
@@ -1314,12 +1367,13 @@ function seal(secret, pending) {
   const payload = Buffer.from(JSON.stringify(pending)).toString("base64url");
   return `${payload}.${sign2(secret, payload)}`;
 }
-function unseal(secret, value) {
+function unseal(secrets, value) {
   if (!value) return null;
   const dot = value.lastIndexOf(".");
   if (dot <= 0) return null;
   const payload = value.slice(0, dot);
-  if (!safeEqual(value.slice(dot + 1), sign2(secret, payload))) return null;
+  const signature = value.slice(dot + 1);
+  if (![secrets].flat().some((secret) => safeEqual(signature, sign2(secret, payload)))) return null;
   try {
     const pending = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
     return typeof pending.e === "number" && pending.e > Date.now() ? pending : null;
@@ -1387,7 +1441,7 @@ var SingleSignOn = class {
    */
   async finish(providerId, options) {
     const admin = this.config.admin.path.replace(/\/+$/, "");
-    const pending = unseal(this.config.secret, options.cookie);
+    const pending = unseal(secretsOf(this.config), options.cookie);
     let email2 = null;
     const back = async (page2, outcome) => {
       await this.cms.audit.record({
@@ -1839,7 +1893,7 @@ var Auth = class {
       await this.recordFailure(key);
       throw refuse("form", "could not be sent");
     }
-    const checked = checkFormToken(this.config.secret, SIGNUP_FORM, args.token, SIGNUP_MIN_TIME);
+    const checked = checkFormToken(this.secrets, SIGNUP_FORM, args.token, SIGNUP_MIN_TIME);
     if (checked !== "ok")
       throw refuse(
         "form",
@@ -1899,7 +1953,7 @@ var Auth = class {
     const id = claims && (/^\d+$/.test(claims.userId) ? Number(claims.userId) : claims.userId);
     const user = claims && claims.purpose === "verify" && claims.expiresAt > Date.now() && id !== null ? await this.db.findById({ collection: USERS, id }) : null;
     if (!user || user.active === false || // A link confirms once: it doesn't sign in again afterwards.
-    user.emailVerified !== false || !passwordTokenMatches(this.config.secret, token, passwordFingerprint(user.passwordHash))) {
+    user.emailVerified !== false || !passwordTokenMatches(this.secrets, token, passwordFingerprint(user.passwordHash))) {
       await this.recordFailure(key);
       throw new ValidationError(USERS, [
         { field: "token", message: "This link has expired or is not valid" }
@@ -1969,7 +2023,7 @@ var Auth = class {
   }
   /** Ends the session for a signed token. Unknown tokens are ignored. */
   async logout(signedToken) {
-    const token = unsignToken(this.config.secret, signedToken);
+    const token = unsignToken(this.secrets, signedToken);
     if (!token) return;
     const session = await this.findSession(token);
     if (!session) return;
@@ -1999,7 +2053,7 @@ var Auth = class {
   async verify(signedToken) {
     if (!signedToken) return null;
     if (isApiKey(signedToken)) return this.verifyApiKey(signedToken);
-    const token = unsignToken(this.config.secret, signedToken);
+    const token = unsignToken(this.secrets, signedToken);
     if (!token) return null;
     const session = await this.findSession(token);
     if (!session) return null;
@@ -2019,9 +2073,21 @@ var Auth = class {
   }
   /** The CSRF token clients must echo for a signed session token. @internal */
   csrfFor(signedToken) {
-    const token = unsignToken(this.config.secret, signedToken);
+    const token = unsignToken(this.secrets, signedToken);
     return token ? csrfToken(this.config.secret, token) : void 0;
   }
+  /**
+   * Whether `given` is the session's CSRF token, made with the current secret or a previous one
+   * (a client that fetched it before the secret changed). @internal
+   */
+  csrfMatches(signedToken, given) {
+    const token = unsignToken(this.secrets, signedToken);
+    return token !== void 0 && csrfMatches(this.secrets, token, given);
+  }
+  /** The current secret and `previousSecrets`, which still verify. */
+  get secrets() {
+    return secretsOf(this.config);
+  }
   /** Starts a new session for a user, e.g. after they changed their own password. */
   async createSession(userId) {
     const user = await this.db.findById({ collection: USERS, id: userId });
@@ -2144,7 +2210,7 @@ var Auth = class {
     const user = await this.db.findById({ collection: USERS, id });
     if (!user || user.active === false || !this.sso.passwordAllowed(user)) return null;
     const fingerprint = passwordFingerprint(user.passwordHash);
-    if (!passwordTokenMatches(this.config.secret, token, fingerprint)) return null;
+    if (!passwordTokenMatches(this.secrets, token, fingerprint)) return null;
     return { user, purpose: claims.purpose };
   }
   async mailPasswordLink(user, purpose, options) {
@@ -3911,7 +3977,7 @@ var VersionStore = class {
 };
 
 // src/local-api.ts
-import { createHash as createHash5, createHmac as createHmac7, randomBytes as randomBytes6, randomUUID as randomUUID3, timingSafeEqual as timingSafeEqual6 } from "crypto";
+import { createHash as createHash5, createHmac as createHmac7, randomBytes as randomBytes6, randomUUID as randomUUID3 } from "crypto";
 
 // src/auth/common-passwords.ts
 var LIST = `
@@ -4647,7 +4713,7 @@ function read(response, maxBytes, deadline) {
 
 // src/config-keys.ts
 var keys = (list) => new Set(list.split(/\s+/).filter(Boolean));
-var CONFIG = keys(`secret db serverURL cors cronSecret timeZone webhooks events jobs localization routes admin
+var CONFIG = keys(`secret previousSecrets db serverURL cors cronSecret timeZone webhooks events jobs localization routes admin
   upload auth collections globals endpoints cliCommands onRequest fieldTypes apiKeys email backups
   audit logs countCacheSeconds maxPage httpCache outbox search telemetry plugins`);
 var ADMIN = keys("path locale brand siteURL nav commands modules pages dashboard switcher");
@@ -5417,6 +5483,7 @@ function validateConfig(config) {
     return issues;
   }
   validateSecret(config.secret, add);
+  validatePreviousSecrets(config.previousSecrets, config.secret, add);
   validateCronSecret(config.cronSecret, (issue) => issues.push(issue));
   checkConfigKeys(config, (issue) => issues.push(issue));
   validateAdapterVersions(config, add);
@@ -5502,6 +5569,22 @@ function validateSecret(secret, add) {
     add("secret", "looks like an example or a repeated pattern, not a random string", hint);
   }
 }
+function validatePreviousSecrets(value, secret, add) {
+  if (value === void 0) return;
+  if (!Array.isArray(value)) {
+    add("previousSecrets", "must be an array of strings", "e.g. previousSecrets: [oldSecret]");
+    return;
+  }
+  for (const [i, previous] of value.entries()) {
+    if (typeof previous !== "string" || previous.length < MIN_SECRET_LENGTH)
+      add(
+        `previousSecrets[${i}]`,
+        `must be a string of at least ${MIN_SECRET_LENGTH} characters, like secret`
+      );
+    else if (previous === secret)
+      add(`previousSecrets[${i}]`, "is the same as secret", "list only secrets used before it");
+  }
+}
 function validateCronSecret(value, push) {
   const hint = `use a random string of at least ${MIN_SECRET_LENGTH} characters, e.g. \`openssl rand -hex 32\``;
   if (value !== void 0) {
@@ -7083,7 +7166,7 @@ function cacheableResponse(request, body, status, headers, times, tags) {
 }
 
 // src/version.ts
-var VERSION = true ? "1.17.0" : "0.0.0-dev";
+var VERSION = true ? "1.18.0" : "0.0.0-dev";
 
 // src/telemetry.ts
 var DB_CALLS = /* @__PURE__ */ new Set([
@@ -7754,11 +7837,7 @@ var EasyCMS = class {
   verify(purpose, token) {
     const [payload, signature] = String(token).split(".");
     if (!payload || !signature) return void 0;
-    const expected = Buffer.from(
-      createHmac7("sha256", this.config.secret).update(`${purpose}:${payload}`).digest("base64url")
-    );
-    const given = Buffer.from(signature);
-    if (expected.length !== given.length || !timingSafeEqual6(expected, given)) return void 0;
+    if (!signedWith(secretsOf(this.config), `${purpose}:${payload}`, signature)) return void 0;
     try {
       return JSON.parse(Buffer.from(payload, "base64url").toString());
     } catch {
@@ -7875,9 +7954,7 @@ var EasyCMS = class {
   verifyMediaSignature(key, expires, signature) {
     const at = Number(expires);
     if (!signature || !Number.isInteger(at) || at < Date.now() / 1e3) return false;
-    const expected = Buffer.from(this.mediaSignature(key, at));
-    const given = Buffer.from(signature);
-    return expected.length === given.length && timingSafeEqual6(expected, given);
+    return signedWith(secretsOf(this.config), `media:${key}:${at}`, signature);
   }
   mediaSignature(key, expires) {
     return createHmac7("sha256", this.config.secret).update(`media:${key}:${expires}`).digest("base64url");
@@ -8170,7 +8247,7 @@ var EasyCMS = class {
   }
   /** What a preview token opens, or `null` when it is invalid or expired. */
   verifyPreviewToken(token) {
-    return token ? verifyPreviewToken(this.config.secret, token) : null;
+    return token ? verifyPreviewToken(secretsOf(this.config), token) : null;
   }
   /** Live preview of a global. See `preview`. */
   async previewGlobal(slug2, data, options = {}) {
@@ -13136,9 +13213,8 @@ function checkCsrf(cms, ctx) {
   if (origin === null && fetchSite === "cross-site")
     throw new ForbiddenError("CSRF check failed: cross-site request");
   if (ctx.via === "cookie" && ctx.token) {
-    const expected = cms.auth.csrfFor(ctx.token);
     const given = ctx.request.headers.get(CSRF_HEADER);
-    if (!expected || !given || !safeEqual(given, expected)) {
+    if (!given || !cms.auth.csrfMatches(ctx.token, given)) {
       throw new ForbiddenError(
         `CSRF check failed: send the ${CSRF_HEADER} header from GET /auth/me`
       );
@@ -13538,6 +13614,7 @@ export {
   isStaff,
   isSignedIn,
   isAdmin,
+  secretsOf,
   MEDIA,
   MEDIA_FOLDERS,
   INTERNAL_COLLECTIONS,

package/dist/{config-CWTw3zFm.d.ts → config-CpeC7EvC.d.ts}

@@ -356,6 +356,16 @@ interface BundleHints {
     readonly traceInclude: readonly string[];
 }
 
+/**
+ * Secrets that verify: the current one first, then `previousSecrets` while one is replaced. New
+ * values are always signed with the current one.
+ */
+type Secrets = string | readonly string[];
+/** The secrets of a config, the current one first. */
+declare function secretsOf(config: {
+    readonly secret: string;
+    readonly previousSecrets?: readonly string[] | undefined;
+}): readonly string[];
 /** What a preview token opens: one document of a collection, or one global. */
 type PreviewTarget = {
     readonly collection: string;
@@ -613,6 +623,8 @@ declare class Auth {
      * on the user), or `null` if it is invalid or expired.
      */
     verify(signedToken: string | undefined | null): Promise<AuthUser | null>;
+    /** The current secret and `previousSecrets`, which still verify. */
+    private get secrets();
     /** Starts a new session for a user, e.g. after they changed their own password. */
     createSession(userId: ID): Promise<Session>;
     /** Signs a user out everywhere. */
@@ -2460,6 +2472,18 @@ declare class AuditLog {
     csv(filter: AuditFilter): Promise<string>;
     /** Checks every entry's signature, and that no ids are missing. */
     verify(): Promise<AuditVerification>;
+    /** The secret an entry was signed with: the current one, a previous one, or none (changed). */
+    private signer;
+    /**
+     * After `secret` changed: signs again, with the current secret, the entries signed with one of
+     * `previousSecrets`, so they still verify once it is removed. Entries no secret verifies were
+     * changed: they are left as they are, and reported. Records `audit.resign`.
+     */
+    resign(): Promise<{
+        checked: number;
+        resigned: number;
+        invalid: ID[];
+    }>;
     /** What the dashboard warns about: many failed logins, entries not written, a failed check. */
     attention(now?: Date): Promise<({
         id: 'failed-logins';
@@ -3531,6 +3555,13 @@ interface BackupsConfig {
 interface Config {
     /** Signs sessions. At least 32 characters; read it from `process.env.EASY_CMS_SECRET`. */
     readonly secret: string;
+    /**
+     * Secrets used before `secret`, while it is replaced: what they signed (sessions, links,
+     * tokens, the audit log) still verifies; new values are signed with `secret` only. Keep one
+     * until sessions and links made with it have expired (7 days by default), and run
+     * `easy-cms audit:resign` before removing it. At least 32 characters each, like `secret`.
+     */
+    readonly previousSecrets?: readonly string[];
     readonly db: DatabaseAdapter;
     /**
      * Public origin of the app, e.g. `https://example.com`. When set, media URLs are absolute
@@ -3687,5 +3718,5 @@ interface ResolvedConfig extends Omit<Config, 'cors' | 'localization' | 'routes'
  */
 declare function defineConfig<const TConfig extends Config>(config: TConfig): TConfig;
 
-export { ADAPTER_API_VERSION as A, EasyCMS as E, AuditLog as S, Auth as V, EasyCMSError as aD, FIELD_TYPES as aK, ConfigError as al, ForbiddenError as b2, PLUGIN_API_VERSION as bB, PayloadTooLargeError as bG, QueryError as bM, ROLE_OPERATIONS as bN, Roles as bX, SchemaError as b_, NotFoundError as bv, API_KEYS as c$, WEBHOOK_EVENTS as cC, anyone as cH, consoleEmail as cI, consoleLogger as cJ, createEasyCMS as cK, defineConfig as cL, defineFieldType as cM, definePlugin as cN, diskStorage as cO, hasRows as cP, isAdmin as cQ, isHasMany as cR, isSignedIn as cS, isStaff as cT, isSystemAdmin as cU, jsonLogger as cV, memorySearch as cW, mimeAllowedBy as cX, rowFields as cY, silentLogger as cZ, uniqueWithinOf as c_, SingleSignOn as cd, TRIGRAM_LIKE_MIN as ck, TooManyRequestsError as co, UnauthorizedError as cq, ValidationError as cy, API_KEY_GLOBAL_OPERATIONS as d0, API_KEY_OPERATIONS as d1, DEFAULT_MAX_VERSIONS as d2, DEFAULT_PASSWORD_EMAILS as d3, FIELD_TYPE_BASES as d4, FOLDER_LEVELS as d5, MediaFolders as d6, SSO_COOKIE as d7, codeOfStatus as d8, isJsonLogger as d9, keyAllows as da, logFormat as db, ADMIN_ICONS as e };
-export type { AuthUser as $, AfterDeleteHook as B, Config as C, AfterReadHook as D, Field as F, ApiKeyContext as G, ApiKeyGlobalOperation as H, ID as I, ApiKeyOperation as J, ApiKeyPermissions as K, LocalizationConfig as L, ArrayField as M, AuditChange as N, AuditConfig as O, PaginatedDocs as P, AuditEntry as Q, ResolvedConfig as R, AuditPage as T, AuditVerification as U, WebhookPayload as W, AuthConfig as X, AuthProvider as Y, AuthProviderProfile as Z, AuthProviderRequest as _, FieldError as a, FindOptions as a$, BackupsConfig as a0, BeforeChangeHook as a1, BeforeDeleteHook as a2, BeforeValidateHook as a3, Block as a4, BlocksField as a5, BooleanField as a6, BuiltinApiKeysCollection as a7, BuiltinMediaCollection as a8, BuiltinMediaFoldersCollection as a9, DirectUpload as aA, DiskStorageOptions as aB, DocumentOf as aC, EmailAdapter as aE, EmailField as aF, EmailMessage as aG, Endpoint as aH, EndpointRequest as aI, ErrorCode as aJ, FieldAccess as aL, FieldAccessFn as aM, FieldAdmin as aN, FieldRule as aO, FieldType as aP, FieldTypeBase as aQ, FieldTypeDefinition as aR, FieldTypeValidateContext as aS, FieldValidate as aT, FieldValidateContext as aU, FieldValue as aV, FieldsInput as aW, FieldsValue as aX, FilterOptionsArgs as aY, FindAfterArgs as aZ, FindArgs as a_, BuiltinUsersCollection as aa, BundleHints as ab, CliCommand as ac, CollectionAccess as ad, CollectionAdmin as ae, CollectionConfig as af, CollectionDocument as ag, CollectionHooks as ah, CollectionListAdmin as ai, CollectionSearch as aj, CollectionSlug as ak, ConfigIssue as am, ContainerAdmin as an, CreateInput as ao, CreateMigrationResult as ap, CursorDocs as aq, CustomField as ar, CustomFieldTypes as as, DashboardWidget as at, Database as au, DatabaseAdapter as av, DatabaseInitArgs as aw, DatabaseTransfer as ax, DateField as ay, DepthOptions as az, FilterOptions as b, SchemaMode as b$, FolderLevel as b0, FolderPermissions as b1, GlobalAccess as b3, GlobalConfig as b4, GlobalDocument as b5, GlobalHooks as b6, GlobalInput as b7, GlobalSlug as b8, GroupField as b9, OutboxRow as bA, PasswordEmail as bC, PasswordEmailArgs as bD, PasswordEmailFn as bE, PasswordLinkOptions as bF, Plugin as bH, PluginInfo as bI, PluginTypes as bJ, PreviewTarget as bK, PreviewURL as bL, RawDocument as bO, ReadOptions as bP, RelationshipField as bQ, RequestContext as bR, RichTextDocument as bS, RichTextField as bT, Role as bU, RoleOperation as bV, RolePermissions as bW, RoutesConfig as bY, ScheduledPublish as bZ, ImageSize as ba, IncrementOptions as bb, InferCollection as bc, InferGlobal as bd, JobConfig as be, JsonField as bf, KeysetPage as bg, Label as bh, LayoutNode as bi, LivePreview as bj, LocaleOf as bk, LogDetails as bl, Logger as bm, LoginArgs as bn, LogsConfig as bo, MediaDocument as bp, MediaSize as bq, MembersConfig as br, MembersSignup as bs, MigrationInfo as bt, NavGroup as bu, NumberField as bw, OnRequest as bx, OnRequestArgs as by, Operation as bz, CreateEasyCMSOptions as c, SearchAdapter as c0, SearchEntry as c1, SearchHits as c2, SearchOptions as c3, SearchQuery as c4, SearchResults as c5, SearchSetting as c6, SelectField as c7, SelectOption as c8, Session as c9, VersionSummary as cA, VersionsConfig as cB, WebhookConfig as cD, WebhookEvent as cE, Where as cF, WhereOperators as cG, SidebarPanel as ca, SignupArgs as cb, SignupResult as cc, SlugField as ce, SlugOf as cf, SsoOutcome as cg, SsoProviderRef as ch, StorageAdapter as ci, StoredFile as cj, TelemetryConfig as cl, TextField as cm, TextareaField as cn, TypedPlugin as cp, UncountedDocs as cr, UpdateInput as cs, UpdateOptions as ct, UploadConfig as cu, UploadField as cv, UploadFromURLConfig as cw, UserIdentity as cx, Version as cz, EmailSetting as d, Access as f, AccessArgs as g, AccessOptions as h, AdminBrand as i, AdminCommand as j, AdminComponent as k, AdminConfig as l, AdminFieldArgs as m, AdminIcon as n, AdminLocale as o, AdminPage as p, AdminRole as q, AdminRoleChange as r, AdminRoleField as s, AdminRoleTarget as t, AdminRoleView as u, AdminRoles as v, AdminSso as w, AdminSwitcher as x, AdminViewAccess as y, AfterChangeHook as z };
+export { ADAPTER_API_VERSION as A, EasyCMS as E, AuditLog as S, Auth as V, EasyCMSError as aD, FIELD_TYPES as aK, ConfigError as al, ForbiddenError as b2, PLUGIN_API_VERSION as bB, PayloadTooLargeError as bG, QueryError as bM, ROLE_OPERATIONS as bN, Roles as bX, SchemaError as b_, NotFoundError as bv, API_KEYS as c$, WEBHOOK_EVENTS as cC, anyone as cH, consoleEmail as cI, consoleLogger as cJ, createEasyCMS as cK, defineConfig as cL, defineFieldType as cM, definePlugin as cN, diskStorage as cO, hasRows as cP, isAdmin as cQ, isHasMany as cR, isSignedIn as cS, isStaff as cT, isSystemAdmin as cU, jsonLogger as cV, memorySearch as cW, mimeAllowedBy as cX, rowFields as cY, silentLogger as cZ, uniqueWithinOf as c_, SingleSignOn as cd, TRIGRAM_LIKE_MIN as ck, TooManyRequestsError as co, UnauthorizedError as cq, ValidationError as cy, API_KEY_GLOBAL_OPERATIONS as d0, API_KEY_OPERATIONS as d1, DEFAULT_MAX_VERSIONS as d2, DEFAULT_PASSWORD_EMAILS as d3, FIELD_TYPE_BASES as d4, FOLDER_LEVELS as d5, MediaFolders as d6, SSO_COOKIE as d7, codeOfStatus as d9, isJsonLogger as da, keyAllows as db, logFormat as dc, secretsOf as dd, ADMIN_ICONS as e };
+export type { AuthUser as $, AfterDeleteHook as B, Config as C, AfterReadHook as D, Field as F, ApiKeyContext as G, ApiKeyGlobalOperation as H, ID as I, ApiKeyOperation as J, ApiKeyPermissions as K, LocalizationConfig as L, ArrayField as M, AuditChange as N, AuditConfig as O, PaginatedDocs as P, AuditEntry as Q, ResolvedConfig as R, AuditPage as T, AuditVerification as U, WebhookPayload as W, AuthConfig as X, AuthProvider as Y, AuthProviderProfile as Z, AuthProviderRequest as _, FieldError as a, FindOptions as a$, BackupsConfig as a0, BeforeChangeHook as a1, BeforeDeleteHook as a2, BeforeValidateHook as a3, Block as a4, BlocksField as a5, BooleanField as a6, BuiltinApiKeysCollection as a7, BuiltinMediaCollection as a8, BuiltinMediaFoldersCollection as a9, DirectUpload as aA, DiskStorageOptions as aB, DocumentOf as aC, EmailAdapter as aE, EmailField as aF, EmailMessage as aG, Endpoint as aH, EndpointRequest as aI, ErrorCode as aJ, FieldAccess as aL, FieldAccessFn as aM, FieldAdmin as aN, FieldRule as aO, FieldType as aP, FieldTypeBase as aQ, FieldTypeDefinition as aR, FieldTypeValidateContext as aS, FieldValidate as aT, FieldValidateContext as aU, FieldValue as aV, FieldsInput as aW, FieldsValue as aX, FilterOptionsArgs as aY, FindAfterArgs as aZ, FindArgs as a_, BuiltinUsersCollection as aa, BundleHints as ab, CliCommand as ac, CollectionAccess as ad, CollectionAdmin as ae, CollectionConfig as af, CollectionDocument as ag, CollectionHooks as ah, CollectionListAdmin as ai, CollectionSearch as aj, CollectionSlug as ak, ConfigIssue as am, ContainerAdmin as an, CreateInput as ao, CreateMigrationResult as ap, CursorDocs as aq, CustomField as ar, CustomFieldTypes as as, DashboardWidget as at, Database as au, DatabaseAdapter as av, DatabaseInitArgs as aw, DatabaseTransfer as ax, DateField as ay, DepthOptions as az, FilterOptions as b, SchemaMode as b$, FolderLevel as b0, FolderPermissions as b1, GlobalAccess as b3, GlobalConfig as b4, GlobalDocument as b5, GlobalHooks as b6, GlobalInput as b7, GlobalSlug as b8, GroupField as b9, OutboxRow as bA, PasswordEmail as bC, PasswordEmailArgs as bD, PasswordEmailFn as bE, PasswordLinkOptions as bF, Plugin as bH, PluginInfo as bI, PluginTypes as bJ, PreviewTarget as bK, PreviewURL as bL, RawDocument as bO, ReadOptions as bP, RelationshipField as bQ, RequestContext as bR, RichTextDocument as bS, RichTextField as bT, Role as bU, RoleOperation as bV, RolePermissions as bW, RoutesConfig as bY, ScheduledPublish as bZ, ImageSize as ba, IncrementOptions as bb, InferCollection as bc, InferGlobal as bd, JobConfig as be, JsonField as bf, KeysetPage as bg, Label as bh, LayoutNode as bi, LivePreview as bj, LocaleOf as bk, LogDetails as bl, Logger as bm, LoginArgs as bn, LogsConfig as bo, MediaDocument as bp, MediaSize as bq, MembersConfig as br, MembersSignup as bs, MigrationInfo as bt, NavGroup as bu, NumberField as bw, OnRequest as bx, OnRequestArgs as by, Operation as bz, CreateEasyCMSOptions as c, SearchAdapter as c0, SearchEntry as c1, SearchHits as c2, SearchOptions as c3, SearchQuery as c4, SearchResults as c5, SearchSetting as c6, SelectField as c7, SelectOption as c8, Session as c9, VersionSummary as cA, VersionsConfig as cB, WebhookConfig as cD, WebhookEvent as cE, Where as cF, WhereOperators as cG, SidebarPanel as ca, SignupArgs as cb, SignupResult as cc, SlugField as ce, SlugOf as cf, SsoOutcome as cg, SsoProviderRef as ch, StorageAdapter as ci, StoredFile as cj, TelemetryConfig as cl, TextField as cm, TextareaField as cn, TypedPlugin as cp, UncountedDocs as cr, UpdateInput as cs, UpdateOptions as ct, UploadConfig as cu, UploadField as cv, UploadFromURLConfig as cw, UserIdentity as cx, Version as cz, EmailSetting as d, Secrets as d8, Access as f, AccessArgs as g, AccessOptions as h, AdminBrand as i, AdminCommand as j, AdminComponent as k, AdminConfig as l, AdminFieldArgs as m, AdminIcon as n, AdminLocale as o, AdminPage as p, AdminRole as q, AdminRoleChange as r, AdminRoleField as s, AdminRoleTarget as t, AdminRoleView as u, AdminRoles as v, AdminSso as w, AdminSwitcher as x, AdminViewAccess as y, AfterChangeHook as z };

package/dist/{handler-DzAqr9gY.d.ts → handler-BpKo6gh0.d.ts}

@@ -1,4 +1,4 @@
-import { I as ID, C as Config, E as EasyCMS, L as LocalizationConfig, F as Field, a as FieldError, b as FilterOptions, c as CreateEasyCMSOptions, R as ResolvedConfig } from './config-CWTw3zFm.js';
+import { I as ID, C as Config, E as EasyCMS, L as LocalizationConfig, F as Field, a as FieldError, b as FilterOptions, c as CreateEasyCMSOptions, R as ResolvedConfig } from './config-CpeC7EvC.js';
 
 /** Decrypts a file from `encryptBackup`; throws for another key or a changed file. */
 declare function decryptBackup(data: Uint8Array, encryptionKey: string): Uint8Array;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { P as PaginatedDocs, I as ID, d as EmailSetting, W as WebhookPayload } from './config-CWTw3zFm.js';
-export { A as ADAPTER_API_VERSION, e as ADMIN_ICONS, f as Access, g as AccessArgs, h as AccessOptions, i as AdminBrand, j as AdminCommand, k as AdminComponent, l as AdminConfig, m as AdminFieldArgs, n as AdminIcon, o as AdminLocale, p as AdminPage, q as AdminRole, r as AdminRoleChange, s as AdminRoleField, t as AdminRoleTarget, u as AdminRoleView, v as AdminRoles, w as AdminSso, x as AdminSwitcher, y as AdminViewAccess, z as AfterChangeHook, B as AfterDeleteHook, D as AfterReadHook, G as ApiKeyContext, H as ApiKeyGlobalOperation, J as ApiKeyOperation, K as ApiKeyPermissions, M as ArrayField, N as AuditChange, O as AuditConfig, Q as AuditEntry, S as AuditLog, T as AuditPage, U as AuditVerification, V as Auth, X as AuthConfig, Y as AuthProvider, Z as AuthProviderProfile, _ as AuthProviderRequest, $ as AuthUser, a0 as BackupsConfig, a1 as BeforeChangeHook, a2 as BeforeDeleteHook, a3 as BeforeValidateHook, a4 as Block, a5 as BlocksField, a6 as BooleanField, a7 as BuiltinApiKeysCollection, a8 as BuiltinMediaCollection, a9 as BuiltinMediaFoldersCollection, aa as BuiltinUsersCollection, ab as BundleHints, ac as CliCommand, ad as CollectionAccess, ae as CollectionAdmin, af as CollectionConfig, ag as CollectionDocument, ah as CollectionHooks, ai as CollectionListAdmin, aj as CollectionSearch, ak as CollectionSlug, C as Config, al as ConfigError, am as ConfigIssue, an as ContainerAdmin, c as CreateEasyCMSOptions, ao as CreateInput, ap as CreateMigrationResult, aq as CursorDocs, ar as CustomField, as as CustomFieldTypes, at as DashboardWidget, au as Database, av as DatabaseAdapter, aw as DatabaseInitArgs, ax as DatabaseTransfer, ay as DateField, az as DepthOptions, aA as DirectUpload, aB as DiskStorageOptions, aC as DocumentOf, E as EasyCMS, aD as EasyCMSError, aE as EmailAdapter, aF as EmailField, aG as EmailMessage, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, aK as FIELD_TYPES, F as Field, aL as FieldAccess, aM as FieldAccessFn, aN as FieldAdmin, a as FieldError, aO as FieldRule, aP as FieldType, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, aT as FieldValidate, aU as FieldValidateContext, aV as FieldValue, aW as FieldsInput, aX as FieldsValue, b as FilterOptions, aY as FilterOptionsArgs, aZ as FindAfterArgs, a_ as FindArgs, a$ as FindOptions, b0 as FolderLevel, b1 as FolderPermissions, b2 as ForbiddenError, b3 as GlobalAccess, b4 as GlobalConfig, b5 as GlobalDocument, b6 as GlobalHooks, b7 as GlobalInput, b8 as GlobalSlug, b9 as GroupField, ba as ImageSize, bb as IncrementOptions, bc as InferCollection, bd as InferGlobal, be as JobConfig, bf as JsonField, bg as KeysetPage, bh as Label, bi as LayoutNode, bj as LivePreview, bk as LocaleOf, L as LocalizationConfig, bl as LogDetails, bm as Logger, bn as LoginArgs, bo as LogsConfig, bp as MediaDocument, bq as MediaSize, br as MembersConfig, bs as MembersSignup, bt as MigrationInfo, bu as NavGroup, bv as NotFoundError, bw as NumberField, bx as OnRequest, by as OnRequestArgs, bz as Operation, bA as OutboxRow, bB as PLUGIN_API_VERSION, bC as PasswordEmail, bD as PasswordEmailArgs, bE as PasswordEmailFn, bF as PasswordLinkOptions, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bK as PreviewTarget, bL as PreviewURL, bM as QueryError, bN as ROLE_OPERATIONS, bO as RawDocument, bP as ReadOptions, bQ as RelationshipField, bR as RequestContext, R as ResolvedConfig, bS as RichTextDocument, bT as RichTextField, bU as Role, bV as RoleOperation, bW as RolePermissions, bX as Roles, bY as RoutesConfig, bZ as ScheduledPublish, b_ as SchemaError, b$ as SchemaMode, c0 as SearchAdapter, c1 as SearchEntry, c2 as SearchHits, c3 as SearchOptions, c4 as SearchQuery, c5 as SearchResults, c6 as SearchSetting, c7 as SelectField, c8 as SelectOption, c9 as Session, ca as SidebarPanel, cb as SignupArgs, cc as SignupResult, cd as SingleSignOn, ce as SlugField, cf as SlugOf, cg as SsoOutcome, ch as SsoProviderRef, ci as StorageAdapter, cj as StoredFile, ck as TRIGRAM_LIKE_MIN, cl as TelemetryConfig, cm as TextField, cn as TextareaField, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cr as UncountedDocs, cs as UpdateInput, ct as UpdateOptions, cu as UploadConfig, cv as UploadField, cw as UploadFromURLConfig, cx as UserIdentity, cy as ValidationError, cz as Version, cA as VersionSummary, cB as VersionsConfig, cC as WEBHOOK_EVENTS, cD as WebhookConfig, cE as WebhookEvent, cF as Where, cG as WhereOperators, cH as anyone, cI as consoleEmail, cJ as consoleLogger, cK as createEasyCMS, cL as defineConfig, cM as defineFieldType, cN as definePlugin, cO as diskStorage, cP as hasRows, cQ as isAdmin, cR as isHasMany, cS as isSignedIn, cT as isStaff, cU as isSystemAdmin, cV as jsonLogger, cW as memorySearch, cX as mimeAllowedBy, cY as rowFields, cZ as silentLogger, c_ as uniqueWithinOf } from './config-CWTw3zFm.js';
-export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-BYaJUVpz.js';
-export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-DzAqr9gY.js';
+import { P as PaginatedDocs, I as ID, d as EmailSetting, W as WebhookPayload } from './config-CpeC7EvC.js';
+export { A as ADAPTER_API_VERSION, e as ADMIN_ICONS, f as Access, g as AccessArgs, h as AccessOptions, i as AdminBrand, j as AdminCommand, k as AdminComponent, l as AdminConfig, m as AdminFieldArgs, n as AdminIcon, o as AdminLocale, p as AdminPage, q as AdminRole, r as AdminRoleChange, s as AdminRoleField, t as AdminRoleTarget, u as AdminRoleView, v as AdminRoles, w as AdminSso, x as AdminSwitcher, y as AdminViewAccess, z as AfterChangeHook, B as AfterDeleteHook, D as AfterReadHook, G as ApiKeyContext, H as ApiKeyGlobalOperation, J as ApiKeyOperation, K as ApiKeyPermissions, M as ArrayField, N as AuditChange, O as AuditConfig, Q as AuditEntry, S as AuditLog, T as AuditPage, U as AuditVerification, V as Auth, X as AuthConfig, Y as AuthProvider, Z as AuthProviderProfile, _ as AuthProviderRequest, $ as AuthUser, a0 as BackupsConfig, a1 as BeforeChangeHook, a2 as BeforeDeleteHook, a3 as BeforeValidateHook, a4 as Block, a5 as BlocksField, a6 as BooleanField, a7 as BuiltinApiKeysCollection, a8 as BuiltinMediaCollection, a9 as BuiltinMediaFoldersCollection, aa as BuiltinUsersCollection, ab as BundleHints, ac as CliCommand, ad as CollectionAccess, ae as CollectionAdmin, af as CollectionConfig, ag as CollectionDocument, ah as CollectionHooks, ai as CollectionListAdmin, aj as CollectionSearch, ak as CollectionSlug, C as Config, al as ConfigError, am as ConfigIssue, an as ContainerAdmin, c as CreateEasyCMSOptions, ao as CreateInput, ap as CreateMigrationResult, aq as CursorDocs, ar as CustomField, as as CustomFieldTypes, at as DashboardWidget, au as Database, av as DatabaseAdapter, aw as DatabaseInitArgs, ax as DatabaseTransfer, ay as DateField, az as DepthOptions, aA as DirectUpload, aB as DiskStorageOptions, aC as DocumentOf, E as EasyCMS, aD as EasyCMSError, aE as EmailAdapter, aF as EmailField, aG as EmailMessage, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, aK as FIELD_TYPES, F as Field, aL as FieldAccess, aM as FieldAccessFn, aN as FieldAdmin, a as FieldError, aO as FieldRule, aP as FieldType, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, aT as FieldValidate, aU as FieldValidateContext, aV as FieldValue, aW as FieldsInput, aX as FieldsValue, b as FilterOptions, aY as FilterOptionsArgs, aZ as FindAfterArgs, a_ as FindArgs, a$ as FindOptions, b0 as FolderLevel, b1 as FolderPermissions, b2 as ForbiddenError, b3 as GlobalAccess, b4 as GlobalConfig, b5 as GlobalDocument, b6 as GlobalHooks, b7 as GlobalInput, b8 as GlobalSlug, b9 as GroupField, ba as ImageSize, bb as IncrementOptions, bc as InferCollection, bd as InferGlobal, be as JobConfig, bf as JsonField, bg as KeysetPage, bh as Label, bi as LayoutNode, bj as LivePreview, bk as LocaleOf, L as LocalizationConfig, bl as LogDetails, bm as Logger, bn as LoginArgs, bo as LogsConfig, bp as MediaDocument, bq as MediaSize, br as MembersConfig, bs as MembersSignup, bt as MigrationInfo, bu as NavGroup, bv as NotFoundError, bw as NumberField, bx as OnRequest, by as OnRequestArgs, bz as Operation, bA as OutboxRow, bB as PLUGIN_API_VERSION, bC as PasswordEmail, bD as PasswordEmailArgs, bE as PasswordEmailFn, bF as PasswordLinkOptions, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bK as PreviewTarget, bL as PreviewURL, bM as QueryError, bN as ROLE_OPERATIONS, bO as RawDocument, bP as ReadOptions, bQ as RelationshipField, bR as RequestContext, R as ResolvedConfig, bS as RichTextDocument, bT as RichTextField, bU as Role, bV as RoleOperation, bW as RolePermissions, bX as Roles, bY as RoutesConfig, bZ as ScheduledPublish, b_ as SchemaError, b$ as SchemaMode, c0 as SearchAdapter, c1 as SearchEntry, c2 as SearchHits, c3 as SearchOptions, c4 as SearchQuery, c5 as SearchResults, c6 as SearchSetting, c7 as SelectField, c8 as SelectOption, c9 as Session, ca as SidebarPanel, cb as SignupArgs, cc as SignupResult, cd as SingleSignOn, ce as SlugField, cf as SlugOf, cg as SsoOutcome, ch as SsoProviderRef, ci as StorageAdapter, cj as StoredFile, ck as TRIGRAM_LIKE_MIN, cl as TelemetryConfig, cm as TextField, cn as TextareaField, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cr as UncountedDocs, cs as UpdateInput, ct as UpdateOptions, cu as UploadConfig, cv as UploadField, cw as UploadFromURLConfig, cx as UserIdentity, cy as ValidationError, cz as Version, cA as VersionSummary, cB as VersionsConfig, cC as WEBHOOK_EVENTS, cD as WebhookConfig, cE as WebhookEvent, cF as Where, cG as WhereOperators, cH as anyone, cI as consoleEmail, cJ as consoleLogger, cK as createEasyCMS, cL as defineConfig, cM as defineFieldType, cN as definePlugin, cO as diskStorage, cP as hasRows, cQ as isAdmin, cR as isHasMany, cS as isSignedIn, cT as isStaff, cU as isSystemAdmin, cV as jsonLogger, cW as memorySearch, cX as mimeAllowedBy, cY as rowFields, cZ as silentLogger, c_ as uniqueWithinOf } from './config-CpeC7EvC.js';
+export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-_XG-lqA5.js';
+export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-BpKo6gh0.js';
 export { FieldCondition, matchesCondition } from './conditions.js';
 
 type DeliveryKind = 'webhook' | 'email';

package/dist/index.js

@@ -28,7 +28,7 @@ import {
   silentLogger,
   slugify,
   verifyWebhook
-} from "./chunk-LPIABPBA.js";
+} from "./chunk-NTAFZ4M6.js";
 import {
   matchesCondition
 } from "./chunk-U266LV4M.js";

package/dist/internal.d.ts

@@ -1,6 +1,6 @@
 import { Config, Database, EasyCMS, NavGroup, CollectionConfig, ID, RawDocument, Field, ResolvedConfig, ConfigIssue } from './index.js';
-export { c$ as API_KEYS, d0 as API_KEY_GLOBAL_OPERATIONS, d1 as API_KEY_OPERATIONS, d2 as DEFAULT_MAX_VERSIONS, d3 as DEFAULT_PASSWORD_EMAILS, d4 as FIELD_TYPE_BASES, d5 as FOLDER_LEVELS, d6 as MediaFolders, d7 as SSO_COOKIE, ck as TRIGRAM_LIKE_MIN, d8 as codeOfStatus, cP as hasRows, cR as isHasMany, d9 as isJsonLogger, da as keyAllows, db as logFormat, cX as mimeAllowedBy, cY as rowFields, c_ as uniqueWithinOf } from './config-CWTw3zFm.js';
-export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as isEmail, y as mergeForUpdate, z as parseId, E as platformClientIp, F as readCookie, G as validateFields, H as writeBackupFile } from './handler-DzAqr9gY.js';
+export { c$ as API_KEYS, d0 as API_KEY_GLOBAL_OPERATIONS, d1 as API_KEY_OPERATIONS, d2 as DEFAULT_MAX_VERSIONS, d3 as DEFAULT_PASSWORD_EMAILS, d4 as FIELD_TYPE_BASES, d5 as FOLDER_LEVELS, d6 as MediaFolders, d7 as SSO_COOKIE, d8 as Secrets, ck as TRIGRAM_LIKE_MIN, d9 as codeOfStatus, cP as hasRows, cR as isHasMany, da as isJsonLogger, db as keyAllows, dc as logFormat, cX as mimeAllowedBy, cY as rowFields, dd as secretsOf, c_ as uniqueWithinOf } from './config-CpeC7EvC.js';
+export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as isEmail, y as mergeForUpdate, z as parseId, E as platformClientIp, F as readCookie, G as validateFields, H as writeBackupFile } from './handler-BpKo6gh0.js';
 export { conditionIssues } from './conditions.js';
 
 /** The session cookie the REST API sets at login. */
@@ -112,7 +112,7 @@ declare function formToken(secret: string, purpose: string, now?: number): strin
  * Checks a token: `ok` when the form was loaded at least `minTime` ms ago (people take a few
  * seconds; bots don't) and less than a day ago.
  */
-declare function checkFormToken(secret: string, purpose: string, token: unknown, minTime: number, now?: number): 'ok' | 'invalid' | 'too-fast' | 'expired';
+declare function checkFormToken(secrets: string | readonly string[], purpose: string, token: unknown, minTime: number, now?: number): 'ok' | 'invalid' | 'too-fast' | 'expired';
 /**
  * Rate-limit keys for `subject` (e.g. an IP and a form) in the current and previous window of
  * `window` seconds. A hash with the window in it: no IP is kept, and keys from different

package/dist/internal.js

@@ -52,12 +52,13 @@ import {
   rateKeys,
   readCookie,
   resolveAdminModule,
+  secretsOf,
   validateConfig,
   validateFields,
   verifyPassword,
   verifyTurnstile,
   writeBackupFile
-} from "./chunk-LPIABPBA.js";
+} from "./chunk-NTAFZ4M6.js";
 import {
   conditionIssues
 } from "./chunk-U266LV4M.js";
@@ -311,6 +312,7 @@ export {
   readCookie,
   resolveAdminModule,
   rowFields,
+  secretsOf,
   singularize,
   sniffMimeType,
   uniqueWithinOf,

package/dist/{plugin-BYaJUVpz.d.ts → plugin-_XG-lqA5.d.ts}

@@ -1,4 +1,4 @@
-import { bh as Label, F as Field, I as ID, o as AdminLocale, x as AdminSwitcher, ch as SsoProviderRef } from './config-CWTw3zFm.js';
+import { bh as Label, F as Field, I as ID, o as AdminLocale, x as AdminSwitcher, ch as SsoProviderRef } from './config-CpeC7EvC.js';
 import { FieldCondition } from './conditions.js';
 
 /** A Web Component from an admin module, with its `props` (plain JSON). */

package/dist/plugin.d.ts

@@ -1,3 +1,3 @@
-export { e as ADMIN_ICONS, k as AdminComponent, n as AdminIcon, $ as AuthUser, ac as CliCommand, ad as CollectionAccess, af as CollectionConfig, C as Config, al as ConfigError, at as DashboardWidget, aD as EasyCMSError, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, F as Field, aL as FieldAccess, a as FieldError, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, b2 as ForbiddenError, b4 as GlobalConfig, I as ID, be as JobConfig, bh as Label, bu as NavGroup, bv as NotFoundError, bx as OnRequest, by as OnRequestArgs, bB as PLUGIN_API_VERSION, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bM as QueryError, bR as RequestContext, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cy as ValidationError, cF as Where, cM as defineFieldType, cN as definePlugin } from './config-CWTw3zFm.js';
-export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-BYaJUVpz.js';
+export { e as ADMIN_ICONS, k as AdminComponent, n as AdminIcon, $ as AuthUser, ac as CliCommand, ad as CollectionAccess, af as CollectionConfig, C as Config, al as ConfigError, at as DashboardWidget, aD as EasyCMSError, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, F as Field, aL as FieldAccess, a as FieldError, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, b2 as ForbiddenError, b4 as GlobalConfig, I as ID, be as JobConfig, bh as Label, bu as NavGroup, bv as NotFoundError, bx as OnRequest, by as OnRequestArgs, bB as PLUGIN_API_VERSION, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bM as QueryError, bR as RequestContext, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cy as ValidationError, cF as Where, cM as defineFieldType, cN as definePlugin } from './config-CpeC7EvC.js';
+export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-_XG-lqA5.js';
 import './conditions.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "1.17.0",
+  "version": "1.18.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",