@easy-cms/core 1.19.0 → 1.20.1

package/dist/{chunk-FZCQXH5M.js → chunk-R2YJ2K56.js}

@@ -972,7 +972,10 @@ var AuditLog = class {
     }
     await auditContext.run({ via: "scheduler", user: null }, () => this.verify());
   }
-  /** What the dashboard warns about: many failed logins, entries not written, a failed check. */
+  /**
+   * What the dashboard warns about: many failed logins, sign-ins of break-glass accounts in the
+   * last day, entries not written, a failed check.
+   */
   async attention(now = /* @__PURE__ */ new Date()) {
     if (!this.enabled) return [];
     const out = [];
@@ -984,6 +987,20 @@ var AuditLog = class {
       }
     });
     if (failed >= this.settings.failedLogins) out.push({ id: "failed-logins", count: failed });
+    const day = new Date(now.getTime() - 864e5).toISOString();
+    const breakGlass = await this.cms.db.find({
+      collection: AUDIT_LOGS,
+      where: { and: [{ action: { equals: "login.breakGlass" } }, { createdAt: { gte: day } }] },
+      sort: ["-id"],
+      limit: 0,
+      page: 1
+    });
+    if (breakGlass.docs.length > 0)
+      out.push({
+        id: "break-glass",
+        count: breakGlass.docs.length,
+        emails: [...new Set(breakGlass.docs.map((row) => String(row.actorEmail ?? "")))]
+      });
     if (this.failures > 0) out.push({ id: "audit-failures", count: this.failures });
     const last = await this.lastVerification();
     if (last && last.invalid > 0)
@@ -1394,6 +1411,9 @@ function unseal(secrets, value) {
     return null;
   }
 }
+function passwordFor(policy) {
+  return policy === true ? "everyone" : policy === false ? "admins" : "breakGlass";
+}
 var SingleSignOn = class {
   constructor(cms) {
     this.cms = cms;
@@ -1412,9 +1432,19 @@ var SingleSignOn = class {
       icon: p.icon ?? "key"
     }));
   }
-  /** Whether a user may sign in with a password (`auth.password: false` leaves only admins). */
+  /**
+   * Whether a user may sign in with a password: everyone, only admins (`auth.password: false`), or
+   * only break-glass accounts (`{ breakGlass }`).
+   */
   passwordAllowed(user) {
-    return this.config.auth.password || user.role === "admin";
+    const policy = this.config.auth.password;
+    if (policy === true) return true;
+    if (policy === false) return user.role === "admin";
+    return typeof user.email === "string" && policy.breakGlass.includes(user.email.toLowerCase());
+  }
+  /** Whether a user signs in with a password only as a break-glass account. */
+  isBreakGlass(user) {
+    return typeof this.config.auth.password === "object" && this.passwordAllowed(user);
   }
   /** `<serverURL><api>/auth/<id>/callback`, or `null` without `serverURL` in production. */
   callbackURL(provider, origin) {
@@ -1607,7 +1637,8 @@ var SingleSignOn = class {
         callbackURL: this.callbackURL(p.id, origin),
         details: { ...p.describe?.() ?? {} }
       })),
-      password: this.config.auth.password ? "everyone" : "admins",
+      password: passwordFor(this.config.auth.password),
+      ...typeof this.config.auth.password === "object" ? { breakGlass: [...this.config.auth.password.breakGlass] } : {},
       signUp: providerSignUp.domains.length > 0 ? {
         domains: [...providerSignUp.domains],
         role: providerSignUp.role ?? this.defaultRole()
@@ -1845,7 +1876,11 @@ var Auth = class {
     }
     await this.deleteExpiredSessions(user.id);
     const session = await this.startSession(user);
-    await this.cms.audit.record({ action: "login", target: "auth", user: session.user });
+    await this.cms.audit.record({
+      action: this.sso.isBreakGlass(user) ? "login.breakGlass" : "login",
+      target: "auth",
+      user: session.user
+    });
     return session;
   }
   /**
@@ -2019,6 +2054,58 @@ var Auth = class {
     const path = target ?? `${this.config.admin.path}/${page === "verifyEmail" ? "verify-email" : "reset-password"}`;
     return `${base}${path.startsWith("/") ? "" : "/"}${path}${path.includes("?") ? "&" : "?"}${query}`;
   }
+  /**
+   * At start: when `auth.password` differs from the last start, records the change and ends the
+   * sessions of accounts that may no longer use a password (single sign-on users sign in once
+   * more). With break-glass accounts, warns when none of them can sign in with a password.
+   * @internal
+   */
+  async applyPasswordPolicy() {
+    const policy = passwordPolicyName(this.config.auth.password);
+    const stored = await this.db.findGlobal({ slug: PASSWORD_POLICY });
+    const before = typeof stored?.policy === "string" ? stored.policy : "everyone";
+    if (before !== policy) {
+      let ended = 0;
+      if (policy !== "everyone") {
+        const users = /* @__PURE__ */ new Map();
+        const { docs } = await this.db.find({ collection: SESSIONS, sort: [], limit: 0, page: 1 });
+        for (const session of docs) {
+          const id = String(session.user);
+          if (!users.has(id))
+            users.set(id, await this.db.findById({ collection: USERS, id: session.user }));
+          const user = users.get(id);
+          if (user && this.sso.passwordAllowed(user)) continue;
+          await this.db.delete({ collection: SESSIONS, id: session.id });
+          ended++;
+        }
+      }
+      const at = (/* @__PURE__ */ new Date()).toISOString();
+      await this.db.updateGlobal({ slug: PASSWORD_POLICY, data: { policy, updatedAt: at } });
+      await this.cms.audit.record({
+        action: "auth.password.policy",
+        target: "auth",
+        user: null,
+        detail: { from: before, to: policy, sessionsEnded: ended }
+      });
+      this.cms.logger.info(
+        `Password sign-in: ${before} \u2192 ${policy}${ended ? `; ${ended} session(s) ended` : ""}.`
+      );
+    }
+    const password = this.config.auth.password;
+    if (typeof password === "object" && await this.hasUsers()) {
+      const { docs } = await this.db.find({
+        collection: USERS,
+        where: { email: { in: [...password.breakGlass] } },
+        sort: [],
+        limit: 0,
+        page: 1
+      });
+      if (!docs.some((user) => user.passwordHash && user.active !== false))
+        this.cms.logger.warn(
+          "auth.password.breakGlass: none of these accounts exists with a password, so nobody can sign in if the provider is down. Create one with `easy-cms admin:create`."
+        );
+    }
+  }
   async hasUsers() {
     return await this.db.count({ collection: USERS }) > 0;
   }
@@ -2388,6 +2475,12 @@ var Auth = class {
       await this.db.delete({ collection: LOGIN_ATTEMPTS, id: attempt.id });
   }
 };
+var PASSWORD_POLICY = "easy-cms:password-policy";
+function passwordPolicyName(policy) {
+  if (policy === true) return "everyone";
+  if (policy === false) return "admins";
+  return `breakGlass:${[...policy.breakGlass].sort().join(",")}`;
+}
 
 // src/database.ts
 var ADAPTER_API_VERSION = 1;
@@ -5960,8 +6053,16 @@ function validateAuth(config, add) {
   if (auth === void 0) return;
   if (auth.rbac !== void 0 && typeof auth.rbac !== "boolean")
     add("auth.rbac", "must be true or false");
-  if (auth.password !== void 0 && typeof auth.password !== "boolean")
-    add("auth.password", "must be true or false");
+  if (typeof auth.password === "object" && auth.password !== null) {
+    const { breakGlass } = auth.password;
+    if (!Array.isArray(breakGlass) || breakGlass.length === 0 || breakGlass.some((email2) => typeof email2 !== "string" || !email2.includes("@")))
+      add(
+        "auth.password.breakGlass",
+        "must list the emails of the accounts that may still use a password",
+        "e.g. { breakGlass: ['emergency@example.com'] }"
+      );
+  } else if (auth.password !== void 0 && typeof auth.password !== "boolean")
+    add("auth.password", "must be true, false or { breakGlass: [emails] }");
   if (auth.setupCode !== void 0 && typeof auth.setupCode !== "string")
     add("auth.setupCode", "must be a string");
   const providers = auth.providers;
@@ -6012,8 +6113,12 @@ function validateAuth(config, add) {
     if (!Array.isArray(providers) || providers.length === 0)
       add("auth.providerSignUp", "needs auth.providers");
   }
-  if (auth.password === false && (!Array.isArray(providers) || providers.length === 0))
-    add("auth.password", "false needs auth.providers", "otherwise only admins could sign in");
+  if (auth.password !== void 0 && auth.password !== true && (!Array.isArray(providers) || providers.length === 0))
+    add(
+      "auth.password",
+      "turning passwords off needs auth.providers",
+      "otherwise nobody else could sign in"
+    );
   if (auth.roles !== void 0) {
     const roles = auth.roles;
     if (!Array.isArray(roles) || roles.some((r) => typeof r !== "string" || r === "")) {
@@ -7223,7 +7328,7 @@ async function resolveConfig(input) {
       rbac: config.auth?.rbac === true,
       providers: config.auth?.providers ?? [],
       providerSignUp: config.auth?.providerSignUp ?? { domains: [] },
-      password: config.auth?.password !== false,
+      password: typeof config.auth?.password === "object" ? { breakGlass: config.auth.password.breakGlass.map((email2) => email2.toLowerCase()) } : config.auth?.password !== false,
       setupCode: config.auth?.setupCode ?? process.env.EASY_CMS_SETUP_CODE ?? "",
       tokenExpiration: config.auth?.tokenExpiration ?? DEFAULT_TOKEN_EXPIRATION,
       maxLoginAttempts: config.auth?.maxLoginAttempts ?? 5,
@@ -7317,7 +7422,7 @@ function cacheableResponse(request, body, status, headers, times, tags) {
 }
 
 // src/version.ts
-var VERSION = true ? "1.19.0" : "0.0.0-dev";
+var VERSION = true ? "1.20.1" : "0.0.0-dev";
 
 // src/telemetry.ts
 var DB_CALLS = /* @__PURE__ */ new Set([
@@ -7551,6 +7656,10 @@ async function createEasyCMS(config, options = {}) {
   if (options.scheduler !== false) cms.startSearch();
   const scheduling = [...resolved3.collections, ...resolved3.globals].some((c) => c.schedule) || (resolved3.webhooks?.length ?? 0) > 0 || resolved3.email !== void 0 || resolved3.jobs.length > 0 || resolved3.outbox === true;
   if (scheduling && options.scheduler !== false) cms.startScheduler();
+  if (options.schema !== "skip")
+    await cms.auth.applyPasswordPolicy().catch(
+      (error) => logger.error(`Password sign-in policy: ${error.message}`, { error })
+    );
   if (process.env.NODE_ENV === "production" && !resolved3.auth.setupCode && await cms.auth.hasUsers().catch(() => true) === false)
     logger.warn(
       "No admin exists yet and no setup code is set: whoever opens the admin first becomes the admin. Set EASY_CMS_SETUP_CODE, or create the admin with `easy-cms admin:create`."
@@ -8556,7 +8665,10 @@ var EasyCMS = class {
       return out2;
     }
     if (config.slug === USERS) await this.guardLastAdmin(parsed, existing, prepared);
-    if (password !== void 0) prepared.passwordHash = await hashPassword(password);
+    if (password !== void 0) {
+      await this.guardPassword({ ...existing, ...prepared });
+      prepared.passwordHash = await hashPassword(password);
+    }
     if (collection2 === MEDIA_FOLDERS) {
       await this.validateFolder(prepared, parsed);
       if (prepared.private !== existing.private || String(prepared.parent ?? null) !== String(existing.parent ?? null))
@@ -9895,7 +10007,10 @@ var EasyCMS = class {
       { ...base, operation: "create" },
       prepared
     );
-    if (password !== void 0) prepared.passwordHash = await hashPassword(password);
+    if (password !== void 0) {
+      await this.guardPassword(prepared);
+      prepared.passwordHash = await hashPassword(password);
+    }
     if (collection2 === MEDIA_FOLDERS) await this.validateFolder(prepared, void 0);
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const row = { ...prepared, createdAt: now, updatedAt: now };
@@ -10215,6 +10330,20 @@ var EasyCMS = class {
     return clean2;
   }
   /** Refuses changes that would leave no active admin (and lock everyone out). */
+  /**
+   * With break-glass accounts (`auth.password: { breakGlass }`), other accounts get no password:
+   * they couldn't use it. The first account, made before anyone can sign in with a provider, may.
+   */
+  async guardPassword(user) {
+    if (typeof this.config.auth.password !== "object" || this.auth.sso.passwordAllowed(user)) return;
+    if (!await this.auth.hasUsers()) return;
+    throw new ValidationError(USERS, [
+      {
+        field: "password",
+        message: "passwords are off: this account signs in with single sign-on"
+      }
+    ]);
+  }
   async guardLastAdmin(id, before, after) {
     const wasAdmin = before.role === "admin" && before.active !== false;
     const staysAdmin = after.role === "admin" && after.active !== false;
@@ -11777,6 +11906,8 @@ async function adminSchema(cms, user, origin, context = {}) {
     locale: cms.config.admin.locale,
     switcher: cms.config.admin.switcher || null,
     passwordLinks: cms.auth.canSendPasswordLinks(origin),
+    passwordFor: passwordFor(cms.config.auth.password),
+    ...typeof cms.config.auth.password === "object" && isSystemAdmin(user) ? { breakGlass: [...cms.config.auth.password.breakGlass] } : {},
     nav: buildNav(cms, adminCollections, adminGlobals, adminPages, views),
     commands: cms.config.admin.commands.map((c) => JSON.parse(JSON.stringify(c))),
     localization: localization ? { locales: [...localization.locales], defaultLocale: localization.defaultLocale } : null,
@@ -12593,7 +12724,14 @@ async function route(cms, ctx, method, path, options) {
         const csrfToken2 = ctx.via === "cookie" && ctx.token ? cms.auth.csrfFor(ctx.token) : void 0;
         if (csrfToken2)
           ctx.headers.append("set-cookie", cookie(ctx, CSRF_COOKIE, csrfToken2, { httpOnly: false }));
-        return { body: { user: ctx.user, ...csrfToken2 ? { csrfToken: csrfToken2 } : {} } };
+        return {
+          body: {
+            user: ctx.user,
+            // Whether this user may set and use a password (`auth.password`).
+            ...ctx.user ? { password: cms.auth.sso.passwordAllowed(ctx.user) } : {},
+            ...csrfToken2 ? { csrfToken: csrfToken2 } : {}
+          }
+        };
       }
       case "GET init":
         return {
@@ -12601,9 +12739,11 @@ async function route(cms, ctx, method, path, options) {
             hasUsers: await cms.auth.hasUsers(),
             // The login page offers "Forgot password?" only when the email can be sent.
             passwordReset: cms.auth.canSendPasswordLinks(ctx.url.origin),
-            // Buttons to sign in with outside accounts; `password: false`: only admins use one.
+            // Buttons to sign in with outside accounts; `password: false`: only some use one
+            // (`passwordFor`: admins, or break-glass accounts), behind a folded form.
             providers: cms.auth.sso.providers(),
-            password: cms.config.auth.password,
+            password: cms.config.auth.password === true,
+            passwordFor: passwordFor(cms.config.auth.password),
             // The first admin needs the setup code (`EASY_CMS_SETUP_CODE`).
             setupCode: cms.config.auth.setupCode !== ""
           }

package/dist/{config-U1mRwD4t.d.ts → config-BuKlngv6.d.ts}

@@ -432,8 +432,10 @@ interface AdminSso {
         callbackURL: string | null;
         details: Record<string, string>;
     })[];
-    /** Who may sign in with a password: everyone, or only admins. */
-    password: 'everyone' | 'admins';
+    /** Who may sign in with a password: everyone, only admins, or only break-glass accounts. */
+    password: 'everyone' | 'admins' | 'breakGlass';
+    /** The accounts that may still use a password (`auth.password: { breakGlass }`). */
+    breakGlass?: string[];
     /** Email domains whose people get an account when they first sign in. */
     signUp: {
         domains: string[];
@@ -461,10 +463,17 @@ declare class SingleSignOn {
     private get config();
     get enabled(): boolean;
     providers(): SsoProviderRef[];
-    /** Whether a user may sign in with a password (`auth.password: false` leaves only admins). */
+    /**
+     * Whether a user may sign in with a password: everyone, only admins (`auth.password: false`), or
+     * only break-glass accounts (`{ breakGlass }`).
+     */
     passwordAllowed(user: {
         readonly [key: string]: unknown;
     }): boolean;
+    /** Whether a user signs in with a password only as a break-glass account. */
+    isBreakGlass(user: {
+        readonly [key: string]: unknown;
+    }): boolean;
     /** `<serverURL><api>/auth/<id>/callback`, or `null` without `serverURL` in production. */
     callbackURL(provider: string, origin?: string): string | null;
     /**
@@ -2331,6 +2340,11 @@ declare class EasyCMS<C extends Config = Config> {
     /** Validates, checks uniqueness and references. Returns clean data or throws `ValidationError`. */
     private prepare;
     /** Refuses changes that would leave no active admin (and lock everyone out). */
+    /**
+     * With break-glass accounts (`auth.password: { breakGlass }`), other accounts get no password:
+     * they couldn't use it. The first account, made before anyone can sign in with a provider, may.
+     */
+    private guardPassword;
     private guardLastAdmin;
     private makeSlugsUnique;
     private checkUnique;
@@ -2484,10 +2498,17 @@ declare class AuditLog {
         resigned: number;
         invalid: ID[];
     }>;
-    /** What the dashboard warns about: many failed logins, entries not written, a failed check. */
+    /**
+     * What the dashboard warns about: many failed logins, sign-ins of break-glass accounts in the
+     * last day, entries not written, a failed check.
+     */
     attention(now?: Date): Promise<({
         id: 'failed-logins';
         count: number;
+    } | {
+        id: 'break-glass';
+        count: number;
+        emails: string[];
     } | {
         id: 'audit-failures';
         count: number;
@@ -3344,10 +3365,13 @@ interface AuthConfig {
         readonly role?: string;
     };
     /**
-     * `false`: only admins may sign in with a password (a way in when the provider is down);
-     * everyone else signs in with `providers`. Default `true`.
+     * Who may sign in with a password; everyone else signs in with `providers`. Default `true`:
+     * everyone. `false`: only admins (a way in when the provider is down). `{ breakGlass: [emails] }`:
+     * only those accounts, for organisations that require single sign-on (and its MFA) for every
+     * other account, admins included. A change ends the sessions of accounts that may no longer use a
+     * password, and is recorded in the audit log, as is each sign-in of a break-glass account.
      */
-    readonly password?: boolean;
+    readonly password?: boolean | PasswordPolicy;
     /**
      * A code the first admin must enter to create their account, so nobody else can claim a
      * freshly deployed site. Default: the `EASY_CMS_SETUP_CODE` environment variable; without it,
@@ -3366,6 +3390,11 @@ interface AuthConfig {
         readonly passwordChanged?: PasswordEmailFn;
     };
 }
+/** `auth.password` with break-glass accounts: the only ones that sign in with a password. */
+interface PasswordPolicy {
+    /** Emails of the accounts that may still use a password, e.g. one kept for when the provider is down. */
+    readonly breakGlass: readonly string[];
+}
 interface RateLimitConfig {
     /** Seconds each count lasts. Default 60. */
     readonly window?: number;

package/dist/{handler-D2y4WSSM.d.ts → handler-DuOjJu_X.d.ts}

@@ -1,4 +1,4 @@
-import { I as ID, C as Config, E as EasyCMS, L as LocalizationConfig, F as Field, a as FieldError, b as FilterOptions, c as CreateEasyCMSOptions, R as ResolvedConfig } from './config-U1mRwD4t.js';
+import { I as ID, C as Config, E as EasyCMS, L as LocalizationConfig, F as Field, a as FieldError, b as FilterOptions, c as CreateEasyCMSOptions, R as ResolvedConfig } from './config-BuKlngv6.js';
 
 /** Decrypts a file from `encryptBackup`; throws for another key or a changed file. */
 declare function decryptBackup(data: Uint8Array, encryptionKey: string): Uint8Array;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { P as PaginatedDocs, I as ID, d as EmailSetting, W as WebhookPayload } from './config-U1mRwD4t.js';
-export { A as ADAPTER_API_VERSION, e as ADMIN_ICONS, f as Access, g as AccessArgs, h as AccessOptions, i as AdminBrand, j as AdminCommand, k as AdminComponent, l as AdminConfig, m as AdminFieldArgs, n as AdminIcon, o as AdminLocale, p as AdminPage, q as AdminRole, r as AdminRoleChange, s as AdminRoleField, t as AdminRoleTarget, u as AdminRoleView, v as AdminRoles, w as AdminSso, x as AdminSwitcher, y as AdminViewAccess, z as AfterChangeHook, B as AfterDeleteHook, D as AfterReadHook, G as ApiKeyContext, H as ApiKeyGlobalOperation, J as ApiKeyOperation, K as ApiKeyPermissions, M as ArrayField, N as AuditChange, O as AuditConfig, Q as AuditEntry, S as AuditLog, T as AuditPage, U as AuditVerification, V as Auth, X as AuthConfig, Y as AuthProvider, Z as AuthProviderProfile, _ as AuthProviderRequest, $ as AuthUser, a0 as BackupsConfig, a1 as BeforeChangeHook, a2 as BeforeDeleteHook, a3 as BeforeValidateHook, a4 as Block, a5 as BlocksField, a6 as BooleanField, a7 as BuiltinApiKeysCollection, a8 as BuiltinMediaCollection, a9 as BuiltinMediaFoldersCollection, aa as BuiltinUsersCollection, ab as BundleHints, ac as CliCommand, ad as CollectionAccess, ae as CollectionAdmin, af as CollectionConfig, ag as CollectionDocument, ah as CollectionHooks, ai as CollectionListAdmin, aj as CollectionSearch, ak as CollectionSlug, C as Config, al as ConfigError, am as ConfigIssue, an as ContainerAdmin, c as CreateEasyCMSOptions, ao as CreateInput, ap as CreateMigrationResult, aq as CursorDocs, ar as CustomField, as as CustomFieldTypes, at as DashboardWidget, au as Database, av as DatabaseAdapter, aw as DatabaseInitArgs, ax as DatabaseTransfer, ay as DateField, az as DepthOptions, aA as DirectUpload, aB as DiskStorageOptions, aC as DocumentOf, E as EasyCMS, aD as EasyCMSError, aE as EmailAdapter, aF as EmailField, aG as EmailMessage, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, aK as FIELD_TYPES, F as Field, aL as FieldAccess, aM as FieldAccessFn, aN as FieldAdmin, a as FieldError, aO as FieldRule, aP as FieldType, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, aT as FieldValidate, aU as FieldValidateContext, aV as FieldValue, aW as FieldsInput, aX as FieldsValue, b as FilterOptions, aY as FilterOptionsArgs, aZ as FindAfterArgs, a_ as FindArgs, a$ as FindOptions, b0 as FolderLevel, b1 as FolderPermissions, b2 as ForbiddenError, b3 as GlobalAccess, b4 as GlobalConfig, b5 as GlobalDocument, b6 as GlobalHooks, b7 as GlobalInput, b8 as GlobalSlug, b9 as GroupField, ba as ImageSize, bb as IncrementOptions, bc as InferCollection, bd as InferGlobal, be as JobConfig, bf as JsonField, bg as KeysetPage, bh as Label, bi as LayoutNode, bj as LivePreview, bk as LocaleOf, L as LocalizationConfig, bl as LogDetails, bm as Logger, bn as LoginArgs, bo as LogsConfig, bp as MediaDocument, bq as MediaSize, br as MembersConfig, bs as MembersSignup, bt as MigrationInfo, bu as NavGroup, bv as NotFoundError, bw as NumberField, bx as OnRequest, by as OnRequestArgs, bz as Operation, bA as OutboxRow, bB as PLUGIN_API_VERSION, bC as PasswordEmail, bD as PasswordEmailArgs, bE as PasswordEmailFn, bF as PasswordLinkOptions, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bK as PreviewTarget, bL as PreviewURL, bM as QueryError, bN as ROLE_OPERATIONS, bO as RawDocument, bP as ReadOptions, bQ as RelationshipField, bR as RequestContext, R as ResolvedConfig, bS as RichTextDocument, bT as RichTextField, bU as Role, bV as RoleOperation, bW as RolePermissions, bX as Roles, bY as RoutesConfig, bZ as ScheduledPublish, b_ as SchemaError, b$ as SchemaMode, c0 as SearchAdapter, c1 as SearchEntry, c2 as SearchHits, c3 as SearchOptions, c4 as SearchQuery, c5 as SearchResults, c6 as SearchSetting, c7 as SelectField, c8 as SelectOption, c9 as Session, ca as SidebarPanel, cb as SignupArgs, cc as SignupResult, cd as SingleSignOn, ce as SlugField, cf as SlugOf, cg as SsoOutcome, ch as SsoProviderRef, ci as StorageAdapter, cj as StoredFile, ck as TRIGRAM_LIKE_MIN, cl as TelemetryConfig, cm as TextField, cn as TextareaField, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cr as UncountedDocs, cs as UpdateInput, ct as UpdateOptions, cu as UploadConfig, cv as UploadField, cw as UploadFromURLConfig, cx as UserIdentity, cy as ValidationError, cz as Version, cA as VersionSummary, cB as VersionsConfig, cC as WEBHOOK_EVENTS, cD as WebhookConfig, cE as WebhookEvent, cF as Where, cG as WhereOperators, cH as anyone, cI as consoleEmail, cJ as consoleLogger, cK as createEasyCMS, cL as defineConfig, cM as defineFieldType, cN as definePlugin, cO as diskStorage, cP as hasRows, cQ as isAdmin, cR as isHasMany, cS as isSignedIn, cT as isStaff, cU as isSystemAdmin, cV as jsonLogger, cW as memorySearch, cX as mimeAllowedBy, cY as rowFields, cZ as silentLogger, c_ as uniqueWithinOf } from './config-U1mRwD4t.js';
-export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-DRV5HA4a.js';
-export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-D2y4WSSM.js';
+import { P as PaginatedDocs, I as ID, d as EmailSetting, W as WebhookPayload } from './config-BuKlngv6.js';
+export { A as ADAPTER_API_VERSION, e as ADMIN_ICONS, f as Access, g as AccessArgs, h as AccessOptions, i as AdminBrand, j as AdminCommand, k as AdminComponent, l as AdminConfig, m as AdminFieldArgs, n as AdminIcon, o as AdminLocale, p as AdminPage, q as AdminRole, r as AdminRoleChange, s as AdminRoleField, t as AdminRoleTarget, u as AdminRoleView, v as AdminRoles, w as AdminSso, x as AdminSwitcher, y as AdminViewAccess, z as AfterChangeHook, B as AfterDeleteHook, D as AfterReadHook, G as ApiKeyContext, H as ApiKeyGlobalOperation, J as ApiKeyOperation, K as ApiKeyPermissions, M as ArrayField, N as AuditChange, O as AuditConfig, Q as AuditEntry, S as AuditLog, T as AuditPage, U as AuditVerification, V as Auth, X as AuthConfig, Y as AuthProvider, Z as AuthProviderProfile, _ as AuthProviderRequest, $ as AuthUser, a0 as BackupsConfig, a1 as BeforeChangeHook, a2 as BeforeDeleteHook, a3 as BeforeValidateHook, a4 as Block, a5 as BlocksField, a6 as BooleanField, a7 as BuiltinApiKeysCollection, a8 as BuiltinMediaCollection, a9 as BuiltinMediaFoldersCollection, aa as BuiltinUsersCollection, ab as BundleHints, ac as CliCommand, ad as CollectionAccess, ae as CollectionAdmin, af as CollectionConfig, ag as CollectionDocument, ah as CollectionHooks, ai as CollectionListAdmin, aj as CollectionSearch, ak as CollectionSlug, C as Config, al as ConfigError, am as ConfigIssue, an as ContainerAdmin, c as CreateEasyCMSOptions, ao as CreateInput, ap as CreateMigrationResult, aq as CursorDocs, ar as CustomField, as as CustomFieldTypes, at as DashboardWidget, au as Database, av as DatabaseAdapter, aw as DatabaseInitArgs, ax as DatabaseTransfer, ay as DateField, az as DepthOptions, aA as DirectUpload, aB as DiskStorageOptions, aC as DocumentOf, E as EasyCMS, aD as EasyCMSError, aE as EmailAdapter, aF as EmailField, aG as EmailMessage, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, aK as FIELD_TYPES, F as Field, aL as FieldAccess, aM as FieldAccessFn, aN as FieldAdmin, a as FieldError, aO as FieldRule, aP as FieldType, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, aT as FieldValidate, aU as FieldValidateContext, aV as FieldValue, aW as FieldsInput, aX as FieldsValue, b as FilterOptions, aY as FilterOptionsArgs, aZ as FindAfterArgs, a_ as FindArgs, a$ as FindOptions, b0 as FolderLevel, b1 as FolderPermissions, b2 as ForbiddenError, b3 as GlobalAccess, b4 as GlobalConfig, b5 as GlobalDocument, b6 as GlobalHooks, b7 as GlobalInput, b8 as GlobalSlug, b9 as GroupField, ba as ImageSize, bb as IncrementOptions, bc as InferCollection, bd as InferGlobal, be as JobConfig, bf as JsonField, bg as KeysetPage, bh as Label, bi as LayoutNode, bj as LivePreview, bk as LocaleOf, L as LocalizationConfig, bl as LogDetails, bm as Logger, bn as LoginArgs, bo as LogsConfig, bp as MediaDocument, bq as MediaSize, br as MembersConfig, bs as MembersSignup, bt as MigrationInfo, bu as NavGroup, bv as NotFoundError, bw as NumberField, bx as OnRequest, by as OnRequestArgs, bz as Operation, bA as OutboxRow, bB as PLUGIN_API_VERSION, bC as PasswordEmail, bD as PasswordEmailArgs, bE as PasswordEmailFn, bF as PasswordLinkOptions, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bK as PreviewTarget, bL as PreviewURL, bM as QueryError, bN as ROLE_OPERATIONS, bO as RawDocument, bP as ReadOptions, bQ as RelationshipField, bR as RequestContext, R as ResolvedConfig, bS as RichTextDocument, bT as RichTextField, bU as Role, bV as RoleOperation, bW as RolePermissions, bX as Roles, bY as RoutesConfig, bZ as ScheduledPublish, b_ as SchemaError, b$ as SchemaMode, c0 as SearchAdapter, c1 as SearchEntry, c2 as SearchHits, c3 as SearchOptions, c4 as SearchQuery, c5 as SearchResults, c6 as SearchSetting, c7 as SelectField, c8 as SelectOption, c9 as Session, ca as SidebarPanel, cb as SignupArgs, cc as SignupResult, cd as SingleSignOn, ce as SlugField, cf as SlugOf, cg as SsoOutcome, ch as SsoProviderRef, ci as StorageAdapter, cj as StoredFile, ck as TRIGRAM_LIKE_MIN, cl as TelemetryConfig, cm as TextField, cn as TextareaField, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cr as UncountedDocs, cs as UpdateInput, ct as UpdateOptions, cu as UploadConfig, cv as UploadField, cw as UploadFromURLConfig, cx as UserIdentity, cy as ValidationError, cz as Version, cA as VersionSummary, cB as VersionsConfig, cC as WEBHOOK_EVENTS, cD as WebhookConfig, cE as WebhookEvent, cF as Where, cG as WhereOperators, cH as anyone, cI as consoleEmail, cJ as consoleLogger, cK as createEasyCMS, cL as defineConfig, cM as defineFieldType, cN as definePlugin, cO as diskStorage, cP as hasRows, cQ as isAdmin, cR as isHasMany, cS as isSignedIn, cT as isStaff, cU as isSystemAdmin, cV as jsonLogger, cW as memorySearch, cX as mimeAllowedBy, cY as rowFields, cZ as silentLogger, c_ as uniqueWithinOf } from './config-BuKlngv6.js';
+export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-zOdLJ1oh.js';
+export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-DuOjJu_X.js';
 export { FieldCondition, matchesCondition } from './conditions.js';
 
 type DeliveryKind = 'webhook' | 'email';
@@ -196,6 +196,12 @@ type AdminAttention =
     id: 'failed-logins';
     count: number;
 }
+/** Break-glass accounts signed in with a password in the last day (`auth.password`). */
+ | {
+    id: 'break-glass';
+    count: number;
+    emails: string[];
+}
 /** Audit log entries that could not be written since the server started. */
  | {
     id: 'audit-failures';

package/dist/index.js

@@ -28,7 +28,7 @@ import {
   silentLogger,
   slugify,
   verifyWebhook
-} from "./chunk-FZCQXH5M.js";
+} from "./chunk-R2YJ2K56.js";
 import {
   matchesCondition
 } from "./chunk-U266LV4M.js";

package/dist/internal.d.ts

@@ -1,6 +1,6 @@
 import { Config, Database, EasyCMS, NavGroup, CollectionConfig, ID, RawDocument, Field, ResolvedConfig, ConfigIssue } from './index.js';
-export { c$ as API_KEYS, d0 as API_KEY_GLOBAL_OPERATIONS, d1 as API_KEY_OPERATIONS, d2 as DEFAULT_MAX_VERSIONS, d3 as DEFAULT_PASSWORD_EMAILS, d4 as FIELD_TYPE_BASES, d5 as FOLDER_LEVELS, d6 as MediaFolders, d7 as SSO_COOKIE, d8 as Secrets, ck as TRIGRAM_LIKE_MIN, d9 as codeOfStatus, cP as hasRows, cR as isHasMany, da as isJsonLogger, db as keyAllows, dc as logFormat, cX as mimeAllowedBy, cY as rowFields, dd as secretsOf, c_ as uniqueWithinOf } from './config-U1mRwD4t.js';
-export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as isEmail, y as mergeForUpdate, z as parseId, E as platformClientIp, F as readCookie, G as validateFields, H as writeBackupFile } from './handler-D2y4WSSM.js';
+export { c$ as API_KEYS, d0 as API_KEY_GLOBAL_OPERATIONS, d1 as API_KEY_OPERATIONS, d2 as DEFAULT_MAX_VERSIONS, d3 as DEFAULT_PASSWORD_EMAILS, d4 as FIELD_TYPE_BASES, d5 as FOLDER_LEVELS, d6 as MediaFolders, d7 as SSO_COOKIE, d8 as Secrets, ck as TRIGRAM_LIKE_MIN, d9 as codeOfStatus, cP as hasRows, cR as isHasMany, da as isJsonLogger, db as keyAllows, dc as logFormat, cX as mimeAllowedBy, cY as rowFields, dd as secretsOf, c_ as uniqueWithinOf } from './config-BuKlngv6.js';
+export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as isEmail, y as mergeForUpdate, z as parseId, E as platformClientIp, F as readCookie, G as validateFields, H as writeBackupFile } from './handler-DuOjJu_X.js';
 export { conditionIssues } from './conditions.js';
 
 /** The session cookie the REST API sets at login. */

package/dist/internal.js

@@ -58,7 +58,7 @@ import {
   verifyPassword,
   verifyTurnstile,
   writeBackupFile
-} from "./chunk-FZCQXH5M.js";
+} from "./chunk-R2YJ2K56.js";
 import {
   conditionIssues
 } from "./chunk-U266LV4M.js";

package/dist/{plugin-DRV5HA4a.d.ts → plugin-zOdLJ1oh.d.ts}

@@ -1,4 +1,4 @@
-import { bh as Label, F as Field, I as ID, o as AdminLocale, x as AdminSwitcher, ch as SsoProviderRef } from './config-U1mRwD4t.js';
+import { bh as Label, F as Field, I as ID, o as AdminLocale, x as AdminSwitcher, ch as SsoProviderRef } from './config-BuKlngv6.js';
 import { FieldCondition } from './conditions.js';
 
 /** A Web Component from an admin module, with its `props` (plain JSON). */
@@ -211,6 +211,12 @@ interface AdminSchema {
     switcher: AdminSwitcher | null;
     /** Admins can email users links to set their password (needs `email` and `serverURL`). */
     passwordLinks: boolean;
+    /**
+     * Who may have a password (`auth.password`); with `breakGlass`, the accounts, for admins of the
+     * whole system: others get no password field.
+     */
+    passwordFor: 'everyone' | 'admins' | 'breakGlass';
+    breakGlass?: string[];
     /** The menu: groups and what this user may open in them, in order. */
     nav: AdminNavNode[];
     /** More entries of the command palette (`admin.commands`). */

package/dist/plugin.d.ts

@@ -1,3 +1,3 @@
-export { e as ADMIN_ICONS, k as AdminComponent, n as AdminIcon, $ as AuthUser, ac as CliCommand, ad as CollectionAccess, af as CollectionConfig, C as Config, al as ConfigError, at as DashboardWidget, aD as EasyCMSError, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, F as Field, aL as FieldAccess, a as FieldError, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, b2 as ForbiddenError, b4 as GlobalConfig, I as ID, be as JobConfig, bh as Label, bu as NavGroup, bv as NotFoundError, bx as OnRequest, by as OnRequestArgs, bB as PLUGIN_API_VERSION, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bM as QueryError, bR as RequestContext, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cy as ValidationError, cF as Where, cM as defineFieldType, cN as definePlugin } from './config-U1mRwD4t.js';
-export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-DRV5HA4a.js';
+export { e as ADMIN_ICONS, k as AdminComponent, n as AdminIcon, $ as AuthUser, ac as CliCommand, ad as CollectionAccess, af as CollectionConfig, C as Config, al as ConfigError, at as DashboardWidget, aD as EasyCMSError, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, F as Field, aL as FieldAccess, a as FieldError, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, b2 as ForbiddenError, b4 as GlobalConfig, I as ID, be as JobConfig, bh as Label, bu as NavGroup, bv as NotFoundError, bx as OnRequest, by as OnRequestArgs, bB as PLUGIN_API_VERSION, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bM as QueryError, bR as RequestContext, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cy as ValidationError, cF as Where, cM as defineFieldType, cN as definePlugin } from './config-BuKlngv6.js';
+export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-zOdLJ1oh.js';
 import './conditions.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "1.19.0",
+  "version": "1.20.1",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",