@easy-cms/core 1.18.0 → 1.20.0

package/dist/{chunk-NTAFZ4M6.js → chunk-QP6PENQI.js}

@@ -154,6 +154,7 @@ var ROLES = "user-roles";
 var USER_IDENTITIES = "user-identities";
 var AUDIT_LOGS = "audit-logs";
 var OUTBOX = "outbox";
+var RATE_LIMITS = "rate-limits";
 var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SESSIONS,
   LOGIN_ATTEMPTS,
@@ -166,7 +167,8 @@ var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   ROLES,
   USER_IDENTITIES,
   AUDIT_LOGS,
-  OUTBOX
+  OUTBOX,
+  RATE_LIMITS
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
 var CREATED_BY_FIELD = {
@@ -640,6 +642,17 @@ var outboxCollection = {
     { name: "error", type: "text" }
   ]
 };
+var rateLimitsCollection = {
+  slug: RATE_LIMITS,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    // `<anonymous|user|apiKey>:<id or HMAC of the IP>:<window number>`
+    { name: "key", type: "text", required: true, unique: true },
+    { name: "count", type: "number", required: true },
+    // When the window is over, for clearing old rows.
+    { name: "expiresAt", type: "text", required: true, index: true }
+  ]
+};
 var emailDeliveriesCollection = {
   slug: EMAIL_DELIVERIES,
   access: { read: nobody, create: nobody, update: nobody, delete: nobody },
@@ -959,7 +972,10 @@ var AuditLog = class {
     }
     await auditContext.run({ via: "scheduler", user: null }, () => this.verify());
   }
-  /** What the dashboard warns about: many failed logins, entries not written, a failed check. */
+  /**
+   * What the dashboard warns about: many failed logins, sign-ins of break-glass accounts in the
+   * last day, entries not written, a failed check.
+   */
   async attention(now = /* @__PURE__ */ new Date()) {
     if (!this.enabled) return [];
     const out = [];
@@ -971,6 +987,20 @@ var AuditLog = class {
       }
     });
     if (failed >= this.settings.failedLogins) out.push({ id: "failed-logins", count: failed });
+    const day = new Date(now.getTime() - 864e5).toISOString();
+    const breakGlass = await this.cms.db.find({
+      collection: AUDIT_LOGS,
+      where: { and: [{ action: { equals: "login.breakGlass" } }, { createdAt: { gte: day } }] },
+      sort: ["-id"],
+      limit: 0,
+      page: 1
+    });
+    if (breakGlass.docs.length > 0)
+      out.push({
+        id: "break-glass",
+        count: breakGlass.docs.length,
+        emails: [...new Set(breakGlass.docs.map((row) => String(row.actorEmail ?? "")))]
+      });
     if (this.failures > 0) out.push({ id: "audit-failures", count: this.failures });
     const last = await this.lastVerification();
     if (last && last.invalid > 0)
@@ -1381,6 +1411,9 @@ function unseal(secrets, value) {
     return null;
   }
 }
+function passwordFor(policy) {
+  return policy === true ? "everyone" : policy === false ? "admins" : "breakGlass";
+}
 var SingleSignOn = class {
   constructor(cms) {
     this.cms = cms;
@@ -1399,9 +1432,19 @@ var SingleSignOn = class {
       icon: p.icon ?? "key"
     }));
   }
-  /** Whether a user may sign in with a password (`auth.password: false` leaves only admins). */
+  /**
+   * Whether a user may sign in with a password: everyone, only admins (`auth.password: false`), or
+   * only break-glass accounts (`{ breakGlass }`).
+   */
   passwordAllowed(user) {
-    return this.config.auth.password || user.role === "admin";
+    const policy = this.config.auth.password;
+    if (policy === true) return true;
+    if (policy === false) return user.role === "admin";
+    return typeof user.email === "string" && policy.breakGlass.includes(user.email.toLowerCase());
+  }
+  /** Whether a user signs in with a password only as a break-glass account. */
+  isBreakGlass(user) {
+    return typeof this.config.auth.password === "object" && this.passwordAllowed(user);
   }
   /** `<serverURL><api>/auth/<id>/callback`, or `null` without `serverURL` in production. */
   callbackURL(provider, origin) {
@@ -1594,7 +1637,8 @@ var SingleSignOn = class {
         callbackURL: this.callbackURL(p.id, origin),
         details: { ...p.describe?.() ?? {} }
       })),
-      password: this.config.auth.password ? "everyone" : "admins",
+      password: passwordFor(this.config.auth.password),
+      ...typeof this.config.auth.password === "object" ? { breakGlass: [...this.config.auth.password.breakGlass] } : {},
       signUp: providerSignUp.domains.length > 0 ? {
         domains: [...providerSignUp.domains],
         role: providerSignUp.role ?? this.defaultRole()
@@ -1832,7 +1876,11 @@ var Auth = class {
     }
     await this.deleteExpiredSessions(user.id);
     const session = await this.startSession(user);
-    await this.cms.audit.record({ action: "login", target: "auth", user: session.user });
+    await this.cms.audit.record({
+      action: this.sso.isBreakGlass(user) ? "login.breakGlass" : "login",
+      target: "auth",
+      user: session.user
+    });
     return session;
   }
   /**
@@ -2006,6 +2054,58 @@ var Auth = class {
     const path = target ?? `${this.config.admin.path}/${page === "verifyEmail" ? "verify-email" : "reset-password"}`;
     return `${base}${path.startsWith("/") ? "" : "/"}${path}${path.includes("?") ? "&" : "?"}${query}`;
   }
+  /**
+   * At start: when `auth.password` differs from the last start, records the change and ends the
+   * sessions of accounts that may no longer use a password (single sign-on users sign in once
+   * more). With break-glass accounts, warns when none of them can sign in with a password.
+   * @internal
+   */
+  async applyPasswordPolicy() {
+    const policy = passwordPolicyName(this.config.auth.password);
+    const stored = await this.db.findGlobal({ slug: PASSWORD_POLICY });
+    const before = typeof stored?.policy === "string" ? stored.policy : "everyone";
+    if (before !== policy) {
+      let ended = 0;
+      if (policy !== "everyone") {
+        const users = /* @__PURE__ */ new Map();
+        const { docs } = await this.db.find({ collection: SESSIONS, sort: [], limit: 0, page: 1 });
+        for (const session of docs) {
+          const id = String(session.user);
+          if (!users.has(id))
+            users.set(id, await this.db.findById({ collection: USERS, id: session.user }));
+          const user = users.get(id);
+          if (user && this.sso.passwordAllowed(user)) continue;
+          await this.db.delete({ collection: SESSIONS, id: session.id });
+          ended++;
+        }
+      }
+      const at = (/* @__PURE__ */ new Date()).toISOString();
+      await this.db.updateGlobal({ slug: PASSWORD_POLICY, data: { policy, updatedAt: at } });
+      await this.cms.audit.record({
+        action: "auth.password.policy",
+        target: "auth",
+        user: null,
+        detail: { from: before, to: policy, sessionsEnded: ended }
+      });
+      this.cms.logger.info(
+        `Password sign-in: ${before} \u2192 ${policy}${ended ? `; ${ended} session(s) ended` : ""}.`
+      );
+    }
+    const password = this.config.auth.password;
+    if (typeof password === "object" && await this.hasUsers()) {
+      const { docs } = await this.db.find({
+        collection: USERS,
+        where: { email: { in: [...password.breakGlass] } },
+        sort: [],
+        limit: 0,
+        page: 1
+      });
+      if (!docs.some((user) => user.passwordHash && user.active !== false))
+        this.cms.logger.warn(
+          "auth.password.breakGlass: none of these accounts exists with a password, so nobody can sign in if the provider is down. Create one with `easy-cms admin:create`."
+        );
+    }
+  }
   async hasUsers() {
     return await this.db.count({ collection: USERS }) > 0;
   }
@@ -2375,6 +2475,12 @@ var Auth = class {
       await this.db.delete({ collection: LOGIN_ATTEMPTS, id: attempt.id });
   }
 };
+var PASSWORD_POLICY = "easy-cms:password-policy";
+function passwordPolicyName(policy) {
+  if (policy === true) return "everyone";
+  if (policy === false) return "admins";
+  return `breakGlass:${[...policy.breakGlass].sort().join(",")}`;
+}
 
 // src/database.ts
 var ADAPTER_API_VERSION = 1;
@@ -3977,7 +4083,7 @@ var VersionStore = class {
 };
 
 // src/local-api.ts
-import { createHash as createHash5, createHmac as createHmac7, randomBytes as randomBytes6, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash5, createHmac as createHmac8, randomBytes as randomBytes6, randomUUID as randomUUID3 } from "crypto";
 
 // src/auth/common-passwords.ts
 var LIST = `
@@ -4473,6 +4579,141 @@ function entryOf(row) {
   };
 }
 
+// src/rate-limit.ts
+import { createHmac as createHmac5 } from "crypto";
+var SYNC_MS = 5e3;
+var DEFAULTS = { window: 60, anonymous: 300, users: 1200, apiKeys: 1200 };
+var RateLimiter = class {
+  constructor(db, secret, logger, settings) {
+    this.db = db;
+    this.secret = secret;
+    this.logger = logger;
+    this.settings = { ...DEFAULTS, ...settings };
+  }
+  db;
+  secret;
+  logger;
+  counts = /* @__PURE__ */ new Map();
+  settings;
+  lastSync = Date.now();
+  syncing;
+  warnedNoIp = false;
+  /**
+   * Counts a request, or returns the seconds until the client may send another when it is over
+   * its limit. Health checks and the cron's `jobs/run` aren't counted (the caller skips them).
+   */
+  hit(user, ip, now = Date.now()) {
+    const client = this.client(user, ip);
+    if (!client) return void 0;
+    const [kind, id, limit] = client;
+    const windowMs = this.settings.window * 1e3;
+    const bucket = Math.floor(now / windowMs);
+    const key = `${kind}:${id}:${bucket}`;
+    let count = this.counts.get(key);
+    if (!count) {
+      count = { total: 0, pending: 0, ends: (bucket + 1) * windowMs };
+      this.counts.set(key, count);
+    }
+    if (now - this.lastSync >= SYNC_MS && !this.syncing) void this.sync(now);
+    if (count.total + count.pending >= limit)
+      return Math.max(1, Math.ceil((count.ends - now) / 1e3));
+    count.pending++;
+    return void 0;
+  }
+  /** Who is counted, and their limit; `undefined` when nothing limits them. */
+  client(user, ip) {
+    const { anonymous, users, apiKeys } = this.settings;
+    const key = user?.apiKey;
+    if (key) return apiKeys === false ? void 0 : ["apiKey", String(key.id), apiKeys];
+    if (user) return users === false ? void 0 : ["user", String(user.id), users];
+    if (anonymous === false) return void 0;
+    if (!ip) {
+      if (!this.warnedNoIp) {
+        this.warnedNoIp = true;
+        this.logger.warn(
+          "rateLimit: the client IP is unknown, so visitors who are not signed in are not limited. Behind a proxy, set trustProxy on the adapter."
+        );
+      }
+      return void 0;
+    }
+    const hashed = createHmac5("sha256", this.secret).update(`rate:${ip}`).digest("base64url");
+    return ["anonymous", hashed.slice(0, 22), anonymous];
+  }
+  /**
+   * Adds what this instance counted to the database and reads the totals back; forgets windows
+   * that are over. Runs in the background every few seconds; `await` it in tests.
+   */
+  sync(now = Date.now()) {
+    this.lastSync = now;
+    this.syncing ??= this.write(now).catch((error) => this.logger.warn(`rateLimit: counts not saved: ${String(error)}`)).finally(() => {
+      this.syncing = void 0;
+    });
+    return this.syncing;
+  }
+  async write(now) {
+    for (const [key, count] of this.counts) {
+      if (count.ends <= now) {
+        this.counts.delete(key);
+        continue;
+      }
+      const added = count.pending;
+      count.pending = 0;
+      count.total = await this.add(key, count, added) ?? count.total + added;
+    }
+  }
+  /** Adds `by` to the key's row (made if missing) and returns the new total. */
+  async add(key, count, by) {
+    count.id ??= await this.rowId(key);
+    if (count.id === void 0) {
+      const stamp = (/* @__PURE__ */ new Date()).toISOString();
+      try {
+        const created = await this.db.create({
+          collection: RATE_LIMITS,
+          data: {
+            key,
+            count: by,
+            expiresAt: new Date(count.ends).toISOString(),
+            createdAt: stamp,
+            updatedAt: stamp
+          }
+        });
+        count.id = created.id;
+        return by;
+      } catch (error) {
+        count.id = await this.rowId(key);
+        if (count.id === void 0) throw error;
+      }
+    }
+    return this.db.increment({ collection: RATE_LIMITS, id: count.id, field: "count", by });
+  }
+  async rowId(key) {
+    const { docs } = await this.db.find({
+      collection: RATE_LIMITS,
+      where: { key: { equals: key } },
+      sort: [],
+      limit: 1,
+      page: 1
+    });
+    return docs[0]?.id;
+  }
+  /** Deletes the rows of windows that are over. From `runJobs`. */
+  async clear(now = /* @__PURE__ */ new Date()) {
+    let deleted = 0;
+    for (; ; ) {
+      const { docs } = await this.db.find({
+        collection: RATE_LIMITS,
+        where: { expiresAt: { lt: now.toISOString() } },
+        sort: ["id"],
+        limit: 500,
+        page: 1
+      });
+      for (const row of docs) await this.db.delete({ collection: RATE_LIMITS, id: row.id });
+      deleted += docs.length;
+      if (docs.length < 500) return deleted;
+    }
+  }
+};
+
 // src/remote-file.ts
 import { lookup as dnsLookup } from "dns";
 import { request as httpRequest } from "http";
@@ -4715,7 +4956,7 @@ function read(response, maxBytes, deadline) {
 var keys = (list) => new Set(list.split(/\s+/).filter(Boolean));
 var CONFIG = keys(`secret previousSecrets db serverURL cors cronSecret timeZone webhooks events jobs localization routes admin
   upload auth collections globals endpoints cliCommands onRequest fieldTypes apiKeys email backups
-  audit logs countCacheSeconds maxPage httpCache outbox search telemetry plugins`);
+  audit logs countCacheSeconds maxPage httpCache outbox rateLimit search telemetry plugins`);
 var ADMIN = keys("path locale brand siteURL nav commands modules pages dashboard switcher");
 var AUTH = keys(`roles rbac tokenExpiration maxLoginAttempts lockWindow trustedOrigins
   resetPasswordExpiration inviteExpiration providers providerSignUp password setupCode members emails`);
@@ -4723,6 +4964,7 @@ var MEMBERS = keys("roles signUp pages emails");
 var UPLOAD = keys("dir maxFileSize mimeTypes storage imageSizes fromURL folders privateStorage");
 var BACKUPS = keys("frequency at keep dir storage sqlite encryptionKey");
 var AUDIT = keys("keepDays values failedLogins scope");
+var RATE_LIMIT = keys("window anonymous users apiKeys");
 var LOGS = keys("format requests");
 var COLLECTION = keys(`slug labels fields useAsTitle drafts versions schedule preview access hooks
   admin httpCache search`);
@@ -4848,6 +5090,7 @@ function checkConfigKeys(config, add) {
   check2(c.upload, "upload", "upload", UPLOAD, add);
   check2(c.backups, "backups", "backups", BACKUPS, add);
   if (isObject(c.audit)) check2(c.audit, "audit", "audit", AUDIT, add);
+  if (isObject(c.rateLimit)) check2(c.rateLimit, "rateLimit", "rateLimit", RATE_LIMIT, add);
   check2(c.logs, "logs", "logs", LOGS, add);
   for (const [kind, list] of [
     ["collections", c.collections],
@@ -5204,13 +5447,13 @@ var SearchIndex = class {
 };
 
 // src/webhooks.ts
-import { createHmac as createHmac6, randomUUID as randomUUID2 } from "crypto";
+import { createHmac as createHmac7, randomUUID as randomUUID2 } from "crypto";
 
 // src/webhook-signature.ts
-import { createHmac as createHmac5, timingSafeEqual as timingSafeEqual5 } from "crypto";
+import { createHmac as createHmac6, timingSafeEqual as timingSafeEqual5 } from "crypto";
 var TOLERANCE_SECONDS = 5 * 60;
 function signWebhook(secret, delivery, timestamp, body) {
-  return `v1=${createHmac5("sha256", secret).update(`${delivery}.${timestamp}.${body}`).digest("hex")}`;
+  return `v1=${createHmac6("sha256", secret).update(`${delivery}.${timestamp}.${body}`).digest("hex")}`;
 }
 function header(headers, name) {
   if (headers instanceof Headers) return headers.get(name) ?? void 0;
@@ -5411,7 +5654,7 @@ var Webhooks = class {
       const timestamp = Math.floor(Date.now() / 1e3);
       headers["x-easy-cms-timestamp"] = String(timestamp);
       headers["x-easy-cms-signature-v2"] = signWebhook(hook.secret, delivery, timestamp, body);
-      headers["x-easy-cms-signature"] = `sha256=${createHmac6("sha256", hook.secret).update(body).digest("hex")}`;
+      headers["x-easy-cms-signature"] = `sha256=${createHmac7("sha256", hook.secret).update(body).digest("hex")}`;
     }
     try {
       const response = await this.fetcher(hook.url, {
@@ -5810,8 +6053,16 @@ function validateAuth(config, add) {
   if (auth === void 0) return;
   if (auth.rbac !== void 0 && typeof auth.rbac !== "boolean")
     add("auth.rbac", "must be true or false");
-  if (auth.password !== void 0 && typeof auth.password !== "boolean")
-    add("auth.password", "must be true or false");
+  if (typeof auth.password === "object" && auth.password !== null) {
+    const { breakGlass } = auth.password;
+    if (!Array.isArray(breakGlass) || breakGlass.length === 0 || breakGlass.some((email2) => typeof email2 !== "string" || !email2.includes("@")))
+      add(
+        "auth.password.breakGlass",
+        "must list the emails of the accounts that may still use a password",
+        "e.g. { breakGlass: ['emergency@example.com'] }"
+      );
+  } else if (auth.password !== void 0 && typeof auth.password !== "boolean")
+    add("auth.password", "must be true, false or { breakGlass: [emails] }");
   if (auth.setupCode !== void 0 && typeof auth.setupCode !== "string")
     add("auth.setupCode", "must be a string");
   const providers = auth.providers;
@@ -5862,8 +6113,12 @@ function validateAuth(config, add) {
     if (!Array.isArray(providers) || providers.length === 0)
       add("auth.providerSignUp", "needs auth.providers");
   }
-  if (auth.password === false && (!Array.isArray(providers) || providers.length === 0))
-    add("auth.password", "false needs auth.providers", "otherwise only admins could sign in");
+  if (auth.password !== void 0 && auth.password !== true && (!Array.isArray(providers) || providers.length === 0))
+    add(
+      "auth.password",
+      "turning passwords off needs auth.providers",
+      "otherwise nobody else could sign in"
+    );
   if (auth.roles !== void 0) {
     const roles = auth.roles;
     if (!Array.isArray(roles) || roles.some((r) => typeof r !== "string" || r === "")) {
@@ -7073,7 +7328,7 @@ async function resolveConfig(input) {
       rbac: config.auth?.rbac === true,
       providers: config.auth?.providers ?? [],
       providerSignUp: config.auth?.providerSignUp ?? { domains: [] },
-      password: config.auth?.password !== false,
+      password: typeof config.auth?.password === "object" ? { breakGlass: config.auth.password.breakGlass.map((email2) => email2.toLowerCase()) } : config.auth?.password !== false,
       setupCode: config.auth?.setupCode ?? process.env.EASY_CMS_SETUP_CODE ?? "",
       tokenExpiration: config.auth?.tokenExpiration ?? DEFAULT_TOKEN_EXPIRATION,
       maxLoginAttempts: config.auth?.maxLoginAttempts ?? 5,
@@ -7096,6 +7351,7 @@ async function resolveConfig(input) {
       ...config.email ? [emailDeliveriesCollection] : [],
       ...(config.jobs?.length ?? 0) > 0 ? [jobRunsCollection] : [],
       ...config.outbox ? [outboxCollection] : [],
+      ...config.rateLimit ? [rateLimitsCollection] : [],
       databaseBackupsCollection,
       ...config.auth?.rbac ? [rolesCollection] : [],
       ...(config.auth?.providers?.length ?? 0) > 0 ? [userIdentitiesCollection] : [],
@@ -7166,7 +7422,7 @@ function cacheableResponse(request, body, status, headers, times, tags) {
 }
 
 // src/version.ts
-var VERSION = true ? "1.18.0" : "0.0.0-dev";
+var VERSION = true ? "1.20.0" : "0.0.0-dev";
 
 // src/telemetry.ts
 var DB_CALLS = /* @__PURE__ */ new Set([
@@ -7400,6 +7656,10 @@ async function createEasyCMS(config, options = {}) {
   if (options.scheduler !== false) cms.startSearch();
   const scheduling = [...resolved3.collections, ...resolved3.globals].some((c) => c.schedule) || (resolved3.webhooks?.length ?? 0) > 0 || resolved3.email !== void 0 || resolved3.jobs.length > 0 || resolved3.outbox === true;
   if (scheduling && options.scheduler !== false) cms.startScheduler();
+  if (options.schema !== "skip")
+    await cms.auth.applyPasswordPolicy().catch(
+      (error) => logger.error(`Password sign-in policy: ${error.message}`, { error })
+    );
   if (process.env.NODE_ENV === "production" && !resolved3.auth.setupCode && await cms.auth.hasUsers().catch(() => true) === false)
     logger.warn(
       "No admin exists yet and no setup code is set: whoever opens the admin first becomes the admin. Set EASY_CMS_SETUP_CODE, or create the admin with `easy-cms admin:create`."
@@ -7444,6 +7704,8 @@ var EasyCMS = class {
   mailer;
   /** With `outbox: true`: runs after hooks and events from rows saves write. */
   outbox;
+  /** @internal Requests per client (`rateLimit`), for the REST API. */
+  rateLimiter;
   /** With `search`: keeps the index in step with published documents. */
   searchIndex;
   /** @internal With `telemetry`: OpenTelemetry spans and metrics (set by `createEasyCMS`). */
@@ -7484,6 +7746,7 @@ var EasyCMS = class {
         () => this.runOutbox(entry, done, mark)
       ) : this.runOutbox(entry, done, mark)
     ) : void 0;
+    this.rateLimiter = config.rateLimit ? new RateLimiter(db, config.secret, logger, config.rateLimit) : void 0;
     this.searchIndex = config.search ? new SearchIndex(
       config.search,
       config.collections,
@@ -7830,7 +8093,7 @@ var EasyCMS = class {
   /** A value with its HMAC (`secret`), for `purpose` only: `<base64url JSON>.<signature>`. */
   sign(purpose, value) {
     const payload = Buffer.from(JSON.stringify(value)).toString("base64url");
-    const mac = createHmac7("sha256", this.config.secret).update(`${purpose}:${payload}`);
+    const mac = createHmac8("sha256", this.config.secret).update(`${purpose}:${payload}`);
     return `${payload}.${mac.digest("base64url")}`;
   }
   /** The value of a token made by `sign`, or `undefined` when it isn't genuine. */
@@ -7957,7 +8220,7 @@ var EasyCMS = class {
     return signedWith(secretsOf(this.config), `media:${key}:${at}`, signature);
   }
   mediaSignature(key, expires) {
-    return createHmac7("sha256", this.config.secret).update(`media:${key}:${expires}`).digest("base64url");
+    return createHmac8("sha256", this.config.secret).update(`media:${key}:${expires}`).digest("base64url");
   }
   /**
    * How many documents use any of these files in a top-level upload field (rich text and fields
@@ -8402,7 +8665,10 @@ var EasyCMS = class {
       return out2;
     }
     if (config.slug === USERS) await this.guardLastAdmin(parsed, existing, prepared);
-    if (password !== void 0) prepared.passwordHash = await hashPassword(password);
+    if (password !== void 0) {
+      await this.guardPassword({ ...existing, ...prepared });
+      prepared.passwordHash = await hashPassword(password);
+    }
     if (collection2 === MEDIA_FOLDERS) {
       await this.validateFolder(prepared, parsed);
       if (prepared.private !== existing.private || String(prepared.parent ?? null) !== String(existing.parent ?? null))
@@ -8974,6 +9240,7 @@ var EasyCMS = class {
         (error) => this.logger.error(`Backups: ${error.message}`, { error })
       );
       await this.audit.upkeep(now).catch((error) => this.logger.error(`Audit log: ${error.message}`, { error }));
+      await this.rateLimiter?.clear(now).catch((error) => this.logger.error(`Rate limits: ${error.message}`, { error }));
       const result = {
         scheduled,
         webhooks: await this.retryWebhooks(now),
@@ -9740,7 +10007,10 @@ var EasyCMS = class {
       { ...base, operation: "create" },
       prepared
     );
-    if (password !== void 0) prepared.passwordHash = await hashPassword(password);
+    if (password !== void 0) {
+      await this.guardPassword(prepared);
+      prepared.passwordHash = await hashPassword(password);
+    }
     if (collection2 === MEDIA_FOLDERS) await this.validateFolder(prepared, void 0);
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const row = { ...prepared, createdAt: now, updatedAt: now };
@@ -10060,6 +10330,20 @@ var EasyCMS = class {
     return clean2;
   }
   /** Refuses changes that would leave no active admin (and lock everyone out). */
+  /**
+   * With break-glass accounts (`auth.password: { breakGlass }`), other accounts get no password:
+   * they couldn't use it. The first account, made before anyone can sign in with a provider, may.
+   */
+  async guardPassword(user) {
+    if (typeof this.config.auth.password !== "object" || this.auth.sso.passwordAllowed(user)) return;
+    if (!await this.auth.hasUsers()) return;
+    throw new ValidationError(USERS, [
+      {
+        field: "password",
+        message: "passwords are off: this account signs in with single sign-on"
+      }
+    ]);
+  }
   async guardLastAdmin(id, before, after) {
     const wasAdmin = before.role === "admin" && before.active !== false;
     const staysAdmin = after.role === "admin" && after.active !== false;
@@ -11622,6 +11906,8 @@ async function adminSchema(cms, user, origin, context = {}) {
     locale: cms.config.admin.locale,
     switcher: cms.config.admin.switcher || null,
     passwordLinks: cms.auth.canSendPasswordLinks(origin),
+    passwordFor: passwordFor(cms.config.auth.password),
+    ...typeof cms.config.auth.password === "object" && isSystemAdmin(user) ? { breakGlass: [...cms.config.auth.password.breakGlass] } : {},
     nav: buildNav(cms, adminCollections, adminGlobals, adminPages, views),
     commands: cms.config.admin.commands.map((c) => JSON.parse(JSON.stringify(c))),
     localization: localization ? { locales: [...localization.locales], defaultLocale: localization.defaultLocale } : null,
@@ -12242,6 +12528,10 @@ async function respondNow(cms, request, url, path, root, options, production, re
       trustProxy: options.trustProxy === true
     };
     const method = request.method.toUpperCase();
+    const isJobsRun = !root && segments[0] === "jobs" && segments[1] === "run";
+    const wait = isJobsRun ? void 0 : cms.rateLimiter?.hit(user, options.getClientIp?.(request));
+    if (wait !== void 0)
+      throw new TooManyRequestsError("Too many requests: try again later", wait);
     if (method !== "GET" && method !== "HEAD") checkCsrf(cms, ctx);
     const audit = {
       user,
@@ -12434,7 +12724,14 @@ async function route(cms, ctx, method, path, options) {
         const csrfToken2 = ctx.via === "cookie" && ctx.token ? cms.auth.csrfFor(ctx.token) : void 0;
         if (csrfToken2)
           ctx.headers.append("set-cookie", cookie(ctx, CSRF_COOKIE, csrfToken2, { httpOnly: false }));
-        return { body: { user: ctx.user, ...csrfToken2 ? { csrfToken: csrfToken2 } : {} } };
+        return {
+          body: {
+            user: ctx.user,
+            // Whether this user may set and use a password (`auth.password`).
+            ...ctx.user ? { password: cms.auth.sso.passwordAllowed(ctx.user) } : {},
+            ...csrfToken2 ? { csrfToken: csrfToken2 } : {}
+          }
+        };
       }
       case "GET init":
         return {
@@ -12442,9 +12739,11 @@ async function route(cms, ctx, method, path, options) {
             hasUsers: await cms.auth.hasUsers(),
             // The login page offers "Forgot password?" only when the email can be sent.
             passwordReset: cms.auth.canSendPasswordLinks(ctx.url.origin),
-            // Buttons to sign in with outside accounts; `password: false`: only admins use one.
+            // Buttons to sign in with outside accounts; `password: false`: only some use one
+            // (`passwordFor`: admins, or break-glass accounts), behind a folded form.
             providers: cms.auth.sso.providers(),
-            password: cms.config.auth.password,
+            password: cms.config.auth.password === true,
+            passwordFor: passwordFor(cms.config.auth.password),
             // The first admin needs the setup code (`EASY_CMS_SETUP_CODE`).
             setupCode: cms.config.auth.setupCode !== ""
           }

package/dist/{config-CpeC7EvC.d.ts → config-BuKlngv6.d.ts}

@@ -432,8 +432,10 @@ interface AdminSso {
         callbackURL: string | null;
         details: Record<string, string>;
     })[];
-    /** Who may sign in with a password: everyone, or only admins. */
-    password: 'everyone' | 'admins';
+    /** Who may sign in with a password: everyone, only admins, or only break-glass accounts. */
+    password: 'everyone' | 'admins' | 'breakGlass';
+    /** The accounts that may still use a password (`auth.password: { breakGlass }`). */
+    breakGlass?: string[];
     /** Email domains whose people get an account when they first sign in. */
     signUp: {
         domains: string[];
@@ -461,10 +463,17 @@ declare class SingleSignOn {
     private get config();
     get enabled(): boolean;
     providers(): SsoProviderRef[];
-    /** Whether a user may sign in with a password (`auth.password: false` leaves only admins). */
+    /**
+     * Whether a user may sign in with a password: everyone, only admins (`auth.password: false`), or
+     * only break-glass accounts (`{ breakGlass }`).
+     */
     passwordAllowed(user: {
         readonly [key: string]: unknown;
     }): boolean;
+    /** Whether a user signs in with a password only as a break-glass account. */
+    isBreakGlass(user: {
+        readonly [key: string]: unknown;
+    }): boolean;
     /** `<serverURL><api>/auth/<id>/callback`, or `null` without `serverURL` in production. */
     callbackURL(provider: string, origin?: string): string | null;
     /**
@@ -2331,6 +2340,11 @@ declare class EasyCMS<C extends Config = Config> {
     /** Validates, checks uniqueness and references. Returns clean data or throws `ValidationError`. */
     private prepare;
     /** Refuses changes that would leave no active admin (and lock everyone out). */
+    /**
+     * With break-glass accounts (`auth.password: { breakGlass }`), other accounts get no password:
+     * they couldn't use it. The first account, made before anyone can sign in with a provider, may.
+     */
+    private guardPassword;
     private guardLastAdmin;
     private makeSlugsUnique;
     private checkUnique;
@@ -2484,10 +2498,17 @@ declare class AuditLog {
         resigned: number;
         invalid: ID[];
     }>;
-    /** What the dashboard warns about: many failed logins, entries not written, a failed check. */
+    /**
+     * What the dashboard warns about: many failed logins, sign-ins of break-glass accounts in the
+     * last day, entries not written, a failed check.
+     */
     attention(now?: Date): Promise<({
         id: 'failed-logins';
         count: number;
+    } | {
+        id: 'break-glass';
+        count: number;
+        emails: string[];
     } | {
         id: 'audit-failures';
         count: number;
@@ -3344,10 +3365,13 @@ interface AuthConfig {
         readonly role?: string;
     };
     /**
-     * `false`: only admins may sign in with a password (a way in when the provider is down);
-     * everyone else signs in with `providers`. Default `true`.
+     * Who may sign in with a password; everyone else signs in with `providers`. Default `true`:
+     * everyone. `false`: only admins (a way in when the provider is down). `{ breakGlass: [emails] }`:
+     * only those accounts, for organisations that require single sign-on (and its MFA) for every
+     * other account, admins included. A change ends the sessions of accounts that may no longer use a
+     * password, and is recorded in the audit log, as is each sign-in of a break-glass account.
      */
-    readonly password?: boolean;
+    readonly password?: boolean | PasswordPolicy;
     /**
      * A code the first admin must enter to create their account, so nobody else can claim a
      * freshly deployed site. Default: the `EASY_CMS_SETUP_CODE` environment variable; without it,
@@ -3366,6 +3390,25 @@ interface AuthConfig {
         readonly passwordChanged?: PasswordEmailFn;
     };
 }
+/** `auth.password` with break-glass accounts: the only ones that sign in with a password. */
+interface PasswordPolicy {
+    /** Emails of the accounts that may still use a password, e.g. one kept for when the provider is down. */
+    readonly breakGlass: readonly string[];
+}
+interface RateLimitConfig {
+    /** Seconds each count lasts. Default 60. */
+    readonly window?: number;
+    /**
+     * Requests per window from one IP without signing in. Default 300; `false`: no limit. Needs the
+     * client's IP: behind a proxy, set `trustProxy` on the adapter (without it, visitors aren't
+     * limited, and the log says so once).
+     */
+    readonly anonymous?: number | false;
+    /** Requests per window from one signed-in user (the admin included). Default 1200; `false`: no limit. */
+    readonly users?: number | false;
+    /** Requests per window with one API key. Default 1200; `false`: no limit. */
+    readonly apiKeys?: number | false;
+}
 /** What `onRequest` receives. */
 interface OnRequestArgs {
     readonly headers: Headers;
@@ -3673,6 +3716,13 @@ interface Config {
      * Default `false`: hooks run in the request, after the save.
      */
     readonly outbox?: boolean;
+    /**
+     * Limits requests to the API per client and minute, counted across instances: each visitor's
+     * IP, each signed-in user and each API key. Over the limit, the API answers `429` with
+     * `Retry-After`. `{}` uses the defaults. Needs a migration for the `rate-limits` table. Default
+     * off.
+     */
+    readonly rateLimit?: RateLimitConfig;
     /**
      * Relevance-ranked search of the collections that have `search`, e.g. `memorySearch()` for
      * development and small sites, or an adapter for a search engine. Published documents are

package/dist/{handler-BpKo6gh0.d.ts → handler-DuOjJu_X.d.ts}

@@ -1,4 +1,4 @@
-import { I as ID, C as Config, E as EasyCMS, L as LocalizationConfig, F as Field, a as FieldError, b as FilterOptions, c as CreateEasyCMSOptions, R as ResolvedConfig } from './config-CpeC7EvC.js';
+import { I as ID, C as Config, E as EasyCMS, L as LocalizationConfig, F as Field, a as FieldError, b as FilterOptions, c as CreateEasyCMSOptions, R as ResolvedConfig } from './config-BuKlngv6.js';
 
 /** Decrypts a file from `encryptBackup`; throws for another key or a changed file. */
 declare function decryptBackup(data: Uint8Array, encryptionKey: string): Uint8Array;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { P as PaginatedDocs, I as ID, d as EmailSetting, W as WebhookPayload } from './config-CpeC7EvC.js';
-export { A as ADAPTER_API_VERSION, e as ADMIN_ICONS, f as Access, g as AccessArgs, h as AccessOptions, i as AdminBrand, j as AdminCommand, k as AdminComponent, l as AdminConfig, m as AdminFieldArgs, n as AdminIcon, o as AdminLocale, p as AdminPage, q as AdminRole, r as AdminRoleChange, s as AdminRoleField, t as AdminRoleTarget, u as AdminRoleView, v as AdminRoles, w as AdminSso, x as AdminSwitcher, y as AdminViewAccess, z as AfterChangeHook, B as AfterDeleteHook, D as AfterReadHook, G as ApiKeyContext, H as ApiKeyGlobalOperation, J as ApiKeyOperation, K as ApiKeyPermissions, M as ArrayField, N as AuditChange, O as AuditConfig, Q as AuditEntry, S as AuditLog, T as AuditPage, U as AuditVerification, V as Auth, X as AuthConfig, Y as AuthProvider, Z as AuthProviderProfile, _ as AuthProviderRequest, $ as AuthUser, a0 as BackupsConfig, a1 as BeforeChangeHook, a2 as BeforeDeleteHook, a3 as BeforeValidateHook, a4 as Block, a5 as BlocksField, a6 as BooleanField, a7 as BuiltinApiKeysCollection, a8 as BuiltinMediaCollection, a9 as BuiltinMediaFoldersCollection, aa as BuiltinUsersCollection, ab as BundleHints, ac as CliCommand, ad as CollectionAccess, ae as CollectionAdmin, af as CollectionConfig, ag as CollectionDocument, ah as CollectionHooks, ai as CollectionListAdmin, aj as CollectionSearch, ak as CollectionSlug, C as Config, al as ConfigError, am as ConfigIssue, an as ContainerAdmin, c as CreateEasyCMSOptions, ao as CreateInput, ap as CreateMigrationResult, aq as CursorDocs, ar as CustomField, as as CustomFieldTypes, at as DashboardWidget, au as Database, av as DatabaseAdapter, aw as DatabaseInitArgs, ax as DatabaseTransfer, ay as DateField, az as DepthOptions, aA as DirectUpload, aB as DiskStorageOptions, aC as DocumentOf, E as EasyCMS, aD as EasyCMSError, aE as EmailAdapter, aF as EmailField, aG as EmailMessage, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, aK as FIELD_TYPES, F as Field, aL as FieldAccess, aM as FieldAccessFn, aN as FieldAdmin, a as FieldError, aO as FieldRule, aP as FieldType, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, aT as FieldValidate, aU as FieldValidateContext, aV as FieldValue, aW as FieldsInput, aX as FieldsValue, b as FilterOptions, aY as FilterOptionsArgs, aZ as FindAfterArgs, a_ as FindArgs, a$ as FindOptions, b0 as FolderLevel, b1 as FolderPermissions, b2 as ForbiddenError, b3 as GlobalAccess, b4 as GlobalConfig, b5 as GlobalDocument, b6 as GlobalHooks, b7 as GlobalInput, b8 as GlobalSlug, b9 as GroupField, ba as ImageSize, bb as IncrementOptions, bc as InferCollection, bd as InferGlobal, be as JobConfig, bf as JsonField, bg as KeysetPage, bh as Label, bi as LayoutNode, bj as LivePreview, bk as LocaleOf, L as LocalizationConfig, bl as LogDetails, bm as Logger, bn as LoginArgs, bo as LogsConfig, bp as MediaDocument, bq as MediaSize, br as MembersConfig, bs as MembersSignup, bt as MigrationInfo, bu as NavGroup, bv as NotFoundError, bw as NumberField, bx as OnRequest, by as OnRequestArgs, bz as Operation, bA as OutboxRow, bB as PLUGIN_API_VERSION, bC as PasswordEmail, bD as PasswordEmailArgs, bE as PasswordEmailFn, bF as PasswordLinkOptions, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bK as PreviewTarget, bL as PreviewURL, bM as QueryError, bN as ROLE_OPERATIONS, bO as RawDocument, bP as ReadOptions, bQ as RelationshipField, bR as RequestContext, R as ResolvedConfig, bS as RichTextDocument, bT as RichTextField, bU as Role, bV as RoleOperation, bW as RolePermissions, bX as Roles, bY as RoutesConfig, bZ as ScheduledPublish, b_ as SchemaError, b$ as SchemaMode, c0 as SearchAdapter, c1 as SearchEntry, c2 as SearchHits, c3 as SearchOptions, c4 as SearchQuery, c5 as SearchResults, c6 as SearchSetting, c7 as SelectField, c8 as SelectOption, c9 as Session, ca as SidebarPanel, cb as SignupArgs, cc as SignupResult, cd as SingleSignOn, ce as SlugField, cf as SlugOf, cg as SsoOutcome, ch as SsoProviderRef, ci as StorageAdapter, cj as StoredFile, ck as TRIGRAM_LIKE_MIN, cl as TelemetryConfig, cm as TextField, cn as TextareaField, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cr as UncountedDocs, cs as UpdateInput, ct as UpdateOptions, cu as UploadConfig, cv as UploadField, cw as UploadFromURLConfig, cx as UserIdentity, cy as ValidationError, cz as Version, cA as VersionSummary, cB as VersionsConfig, cC as WEBHOOK_EVENTS, cD as WebhookConfig, cE as WebhookEvent, cF as Where, cG as WhereOperators, cH as anyone, cI as consoleEmail, cJ as consoleLogger, cK as createEasyCMS, cL as defineConfig, cM as defineFieldType, cN as definePlugin, cO as diskStorage, cP as hasRows, cQ as isAdmin, cR as isHasMany, cS as isSignedIn, cT as isStaff, cU as isSystemAdmin, cV as jsonLogger, cW as memorySearch, cX as mimeAllowedBy, cY as rowFields, cZ as silentLogger, c_ as uniqueWithinOf } from './config-CpeC7EvC.js';
-export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-_XG-lqA5.js';
-export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-BpKo6gh0.js';
+import { P as PaginatedDocs, I as ID, d as EmailSetting, W as WebhookPayload } from './config-BuKlngv6.js';
+export { A as ADAPTER_API_VERSION, e as ADMIN_ICONS, f as Access, g as AccessArgs, h as AccessOptions, i as AdminBrand, j as AdminCommand, k as AdminComponent, l as AdminConfig, m as AdminFieldArgs, n as AdminIcon, o as AdminLocale, p as AdminPage, q as AdminRole, r as AdminRoleChange, s as AdminRoleField, t as AdminRoleTarget, u as AdminRoleView, v as AdminRoles, w as AdminSso, x as AdminSwitcher, y as AdminViewAccess, z as AfterChangeHook, B as AfterDeleteHook, D as AfterReadHook, G as ApiKeyContext, H as ApiKeyGlobalOperation, J as ApiKeyOperation, K as ApiKeyPermissions, M as ArrayField, N as AuditChange, O as AuditConfig, Q as AuditEntry, S as AuditLog, T as AuditPage, U as AuditVerification, V as Auth, X as AuthConfig, Y as AuthProvider, Z as AuthProviderProfile, _ as AuthProviderRequest, $ as AuthUser, a0 as BackupsConfig, a1 as BeforeChangeHook, a2 as BeforeDeleteHook, a3 as BeforeValidateHook, a4 as Block, a5 as BlocksField, a6 as BooleanField, a7 as BuiltinApiKeysCollection, a8 as BuiltinMediaCollection, a9 as BuiltinMediaFoldersCollection, aa as BuiltinUsersCollection, ab as BundleHints, ac as CliCommand, ad as CollectionAccess, ae as CollectionAdmin, af as CollectionConfig, ag as CollectionDocument, ah as CollectionHooks, ai as CollectionListAdmin, aj as CollectionSearch, ak as CollectionSlug, C as Config, al as ConfigError, am as ConfigIssue, an as ContainerAdmin, c as CreateEasyCMSOptions, ao as CreateInput, ap as CreateMigrationResult, aq as CursorDocs, ar as CustomField, as as CustomFieldTypes, at as DashboardWidget, au as Database, av as DatabaseAdapter, aw as DatabaseInitArgs, ax as DatabaseTransfer, ay as DateField, az as DepthOptions, aA as DirectUpload, aB as DiskStorageOptions, aC as DocumentOf, E as EasyCMS, aD as EasyCMSError, aE as EmailAdapter, aF as EmailField, aG as EmailMessage, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, aK as FIELD_TYPES, F as Field, aL as FieldAccess, aM as FieldAccessFn, aN as FieldAdmin, a as FieldError, aO as FieldRule, aP as FieldType, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, aT as FieldValidate, aU as FieldValidateContext, aV as FieldValue, aW as FieldsInput, aX as FieldsValue, b as FilterOptions, aY as FilterOptionsArgs, aZ as FindAfterArgs, a_ as FindArgs, a$ as FindOptions, b0 as FolderLevel, b1 as FolderPermissions, b2 as ForbiddenError, b3 as GlobalAccess, b4 as GlobalConfig, b5 as GlobalDocument, b6 as GlobalHooks, b7 as GlobalInput, b8 as GlobalSlug, b9 as GroupField, ba as ImageSize, bb as IncrementOptions, bc as InferCollection, bd as InferGlobal, be as JobConfig, bf as JsonField, bg as KeysetPage, bh as Label, bi as LayoutNode, bj as LivePreview, bk as LocaleOf, L as LocalizationConfig, bl as LogDetails, bm as Logger, bn as LoginArgs, bo as LogsConfig, bp as MediaDocument, bq as MediaSize, br as MembersConfig, bs as MembersSignup, bt as MigrationInfo, bu as NavGroup, bv as NotFoundError, bw as NumberField, bx as OnRequest, by as OnRequestArgs, bz as Operation, bA as OutboxRow, bB as PLUGIN_API_VERSION, bC as PasswordEmail, bD as PasswordEmailArgs, bE as PasswordEmailFn, bF as PasswordLinkOptions, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bK as PreviewTarget, bL as PreviewURL, bM as QueryError, bN as ROLE_OPERATIONS, bO as RawDocument, bP as ReadOptions, bQ as RelationshipField, bR as RequestContext, R as ResolvedConfig, bS as RichTextDocument, bT as RichTextField, bU as Role, bV as RoleOperation, bW as RolePermissions, bX as Roles, bY as RoutesConfig, bZ as ScheduledPublish, b_ as SchemaError, b$ as SchemaMode, c0 as SearchAdapter, c1 as SearchEntry, c2 as SearchHits, c3 as SearchOptions, c4 as SearchQuery, c5 as SearchResults, c6 as SearchSetting, c7 as SelectField, c8 as SelectOption, c9 as Session, ca as SidebarPanel, cb as SignupArgs, cc as SignupResult, cd as SingleSignOn, ce as SlugField, cf as SlugOf, cg as SsoOutcome, ch as SsoProviderRef, ci as StorageAdapter, cj as StoredFile, ck as TRIGRAM_LIKE_MIN, cl as TelemetryConfig, cm as TextField, cn as TextareaField, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cr as UncountedDocs, cs as UpdateInput, ct as UpdateOptions, cu as UploadConfig, cv as UploadField, cw as UploadFromURLConfig, cx as UserIdentity, cy as ValidationError, cz as Version, cA as VersionSummary, cB as VersionsConfig, cC as WEBHOOK_EVENTS, cD as WebhookConfig, cE as WebhookEvent, cF as Where, cG as WhereOperators, cH as anyone, cI as consoleEmail, cJ as consoleLogger, cK as createEasyCMS, cL as defineConfig, cM as defineFieldType, cN as definePlugin, cO as diskStorage, cP as hasRows, cQ as isAdmin, cR as isHasMany, cS as isSignedIn, cT as isStaff, cU as isSystemAdmin, cV as jsonLogger, cW as memorySearch, cX as mimeAllowedBy, cY as rowFields, cZ as silentLogger, c_ as uniqueWithinOf } from './config-BuKlngv6.js';
+export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-zOdLJ1oh.js';
+export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-DuOjJu_X.js';
 export { FieldCondition, matchesCondition } from './conditions.js';
 
 type DeliveryKind = 'webhook' | 'email';
@@ -196,6 +196,12 @@ type AdminAttention =
     id: 'failed-logins';
     count: number;
 }
+/** Break-glass accounts signed in with a password in the last day (`auth.password`). */
+ | {
+    id: 'break-glass';
+    count: number;
+    emails: string[];
+}
 /** Audit log entries that could not be written since the server started. */
  | {
     id: 'audit-failures';

package/dist/index.js

@@ -28,7 +28,7 @@ import {
   silentLogger,
   slugify,
   verifyWebhook
-} from "./chunk-NTAFZ4M6.js";
+} from "./chunk-QP6PENQI.js";
 import {
   matchesCondition
 } from "./chunk-U266LV4M.js";

package/dist/internal.d.ts

@@ -1,6 +1,6 @@
 import { Config, Database, EasyCMS, NavGroup, CollectionConfig, ID, RawDocument, Field, ResolvedConfig, ConfigIssue } from './index.js';
-export { c$ as API_KEYS, d0 as API_KEY_GLOBAL_OPERATIONS, d1 as API_KEY_OPERATIONS, d2 as DEFAULT_MAX_VERSIONS, d3 as DEFAULT_PASSWORD_EMAILS, d4 as FIELD_TYPE_BASES, d5 as FOLDER_LEVELS, d6 as MediaFolders, d7 as SSO_COOKIE, d8 as Secrets, ck as TRIGRAM_LIKE_MIN, d9 as codeOfStatus, cP as hasRows, cR as isHasMany, da as isJsonLogger, db as keyAllows, dc as logFormat, cX as mimeAllowedBy, cY as rowFields, dd as secretsOf, c_ as uniqueWithinOf } from './config-CpeC7EvC.js';
-export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as isEmail, y as mergeForUpdate, z as parseId, E as platformClientIp, F as readCookie, G as validateFields, H as writeBackupFile } from './handler-BpKo6gh0.js';
+export { c$ as API_KEYS, d0 as API_KEY_GLOBAL_OPERATIONS, d1 as API_KEY_OPERATIONS, d2 as DEFAULT_MAX_VERSIONS, d3 as DEFAULT_PASSWORD_EMAILS, d4 as FIELD_TYPE_BASES, d5 as FOLDER_LEVELS, d6 as MediaFolders, d7 as SSO_COOKIE, d8 as Secrets, ck as TRIGRAM_LIKE_MIN, d9 as codeOfStatus, cP as hasRows, cR as isHasMany, da as isJsonLogger, db as keyAllows, dc as logFormat, cX as mimeAllowedBy, cY as rowFields, dd as secretsOf, c_ as uniqueWithinOf } from './config-BuKlngv6.js';
+export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as isEmail, y as mergeForUpdate, z as parseId, E as platformClientIp, F as readCookie, G as validateFields, H as writeBackupFile } from './handler-DuOjJu_X.js';
 export { conditionIssues } from './conditions.js';
 
 /** The session cookie the REST API sets at login. */

package/dist/internal.js

@@ -58,7 +58,7 @@ import {
   verifyPassword,
   verifyTurnstile,
   writeBackupFile
-} from "./chunk-NTAFZ4M6.js";
+} from "./chunk-QP6PENQI.js";
 import {
   conditionIssues
 } from "./chunk-U266LV4M.js";

package/dist/{plugin-_XG-lqA5.d.ts → plugin-zOdLJ1oh.d.ts}

@@ -1,4 +1,4 @@
-import { bh as Label, F as Field, I as ID, o as AdminLocale, x as AdminSwitcher, ch as SsoProviderRef } from './config-CpeC7EvC.js';
+import { bh as Label, F as Field, I as ID, o as AdminLocale, x as AdminSwitcher, ch as SsoProviderRef } from './config-BuKlngv6.js';
 import { FieldCondition } from './conditions.js';
 
 /** A Web Component from an admin module, with its `props` (plain JSON). */
@@ -211,6 +211,12 @@ interface AdminSchema {
     switcher: AdminSwitcher | null;
     /** Admins can email users links to set their password (needs `email` and `serverURL`). */
     passwordLinks: boolean;
+    /**
+     * Who may have a password (`auth.password`); with `breakGlass`, the accounts, for admins of the
+     * whole system: others get no password field.
+     */
+    passwordFor: 'everyone' | 'admins' | 'breakGlass';
+    breakGlass?: string[];
     /** The menu: groups and what this user may open in them, in order. */
     nav: AdminNavNode[];
     /** More entries of the command palette (`admin.commands`). */

package/dist/plugin.d.ts

@@ -1,3 +1,3 @@
-export { e as ADMIN_ICONS, k as AdminComponent, n as AdminIcon, $ as AuthUser, ac as CliCommand, ad as CollectionAccess, af as CollectionConfig, C as Config, al as ConfigError, at as DashboardWidget, aD as EasyCMSError, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, F as Field, aL as FieldAccess, a as FieldError, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, b2 as ForbiddenError, b4 as GlobalConfig, I as ID, be as JobConfig, bh as Label, bu as NavGroup, bv as NotFoundError, bx as OnRequest, by as OnRequestArgs, bB as PLUGIN_API_VERSION, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bM as QueryError, bR as RequestContext, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cy as ValidationError, cF as Where, cM as defineFieldType, cN as definePlugin } from './config-CpeC7EvC.js';
-export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-_XG-lqA5.js';
+export { e as ADMIN_ICONS, k as AdminComponent, n as AdminIcon, $ as AuthUser, ac as CliCommand, ad as CollectionAccess, af as CollectionConfig, C as Config, al as ConfigError, at as DashboardWidget, aD as EasyCMSError, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, F as Field, aL as FieldAccess, a as FieldError, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, b2 as ForbiddenError, b4 as GlobalConfig, I as ID, be as JobConfig, bh as Label, bu as NavGroup, bv as NotFoundError, bx as OnRequest, by as OnRequestArgs, bB as PLUGIN_API_VERSION, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bM as QueryError, bR as RequestContext, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cy as ValidationError, cF as Where, cM as defineFieldType, cN as definePlugin } from './config-BuKlngv6.js';
+export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-zOdLJ1oh.js';
 import './conditions.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "1.18.0",
+  "version": "1.20.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",