@easy-cms/plugin-multi-tenant 0.0.0-stage → 0.43.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kanawoot K.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,32 @@
-# Temporary Holding Version
+# @easy-cms/plugin-multi-tenant
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Several sites or clients in one Easy CMS: each tenant has its own documents in the collections you name, its own value of the globals you name, and its own members with a role there. Admins switch tenants at the top of the menu; frontends name their tenant with a header or their domain. Part of [Easy CMS](https://github.com/maritonx/easy-cms), the embedded, code-first headless CMS for Nuxt and Next.js.
+
+## Install
+
+```bash
+npm install @easy-cms/plugin-multi-tenant
+```
+
+Or `pnpm add`, `yarn add` or `bun add`.
+
+## Usage
+
+```ts
+import { multiTenantPlugin } from '@easy-cms/plugin-multi-tenant'
+
+export default defineConfig({
+  // …
+  plugins: [multiTenantPlugin({ collections: ['posts', 'pages', 'media'], globals: ['site'] })],
+})
+```
+
+```bash
+curl -H 'x-easy-cms-tenant: brand-a' https://cms.example.com/api/cms/posts
+```
+
+## Links
+
+[Multi-tenant](https://maritonx.github.io/easy-cms/guide/multi-tenant) · [Documentation](https://maritonx.github.io/easy-cms/) ([ภาษาไทย](https://maritonx.github.io/easy-cms/th/)) · [GitHub](https://github.com/maritonx/easy-cms)
+
+MIT License

package/dist/admin.js

@@ -0,0 +1,42 @@
+var u={en:{lead:"People who work in this tenant, and their role here. An account can belong to several tenants.",email:"Email",name:"Name",role:"Role",actions:"Actions",remove:"Remove",removeConfirm:"Remove {email} from this tenant? Their account stays.",add:"Add member",adding:"Adding\u2026",added:"{email} was added.",invited:"{email} was added and emailed a link to set a password.",addedNoEmail:"{email} was added. Email is not set up, so send them a password link from Users.",none:"No members yet.",loading:"Loading\u2026",failed:"Couldn't load the members.",choose:"Choose a tenant at the top of the menu to see its members.",you:"you"},th:{lead:"\u0E04\u0E19\u0E17\u0E35\u0E48\u0E17\u0E33\u0E07\u0E32\u0E19\u0E43\u0E19 tenant \u0E19\u0E35\u0E49\u0E41\u0E25\u0E30\u0E1A\u0E17\u0E1A\u0E32\u0E17\u0E02\u0E2D\u0E07\u0E41\u0E15\u0E48\u0E25\u0E30\u0E04\u0E19 \u0E1A\u0E31\u0E0D\u0E0A\u0E35\u0E2B\u0E19\u0E36\u0E48\u0E07\u0E2D\u0E22\u0E39\u0E48\u0E44\u0E14\u0E49\u0E2B\u0E25\u0E32\u0E22 tenant",email:"\u0E2D\u0E35\u0E40\u0E21\u0E25",name:"\u0E0A\u0E37\u0E48\u0E2D",role:"\u0E1A\u0E17\u0E1A\u0E32\u0E17",actions:"\u0E01\u0E32\u0E23\u0E17\u0E33\u0E07\u0E32\u0E19",remove:"\u0E19\u0E33\u0E2D\u0E2D\u0E01",removeConfirm:"\u0E19\u0E33 {email} \u0E2D\u0E2D\u0E01\u0E08\u0E32\u0E01 tenant \u0E19\u0E35\u0E49\u0E44\u0E2B\u0E21 \u0E1A\u0E31\u0E0D\u0E0A\u0E35\u0E02\u0E2D\u0E07\u0E40\u0E02\u0E32\u0E22\u0E31\u0E07\u0E2D\u0E22\u0E39\u0E48",add:"\u0E40\u0E1E\u0E34\u0E48\u0E21\u0E2A\u0E21\u0E32\u0E0A\u0E34\u0E01",adding:"\u0E01\u0E33\u0E25\u0E31\u0E07\u0E40\u0E1E\u0E34\u0E48\u0E21\u2026",added:"\u0E40\u0E1E\u0E34\u0E48\u0E21 {email} \u0E41\u0E25\u0E49\u0E27",invited:"\u0E40\u0E1E\u0E34\u0E48\u0E21 {email} \u0E41\u0E25\u0E49\u0E27 \u0E41\u0E25\u0E30\u0E2A\u0E48\u0E07\u0E25\u0E34\u0E07\u0E01\u0E4C\u0E15\u0E31\u0E49\u0E07\u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E48\u0E32\u0E19\u0E17\u0E32\u0E07\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E41\u0E25\u0E49\u0E27",addedNoEmail:"\u0E40\u0E1E\u0E34\u0E48\u0E21 {email} \u0E41\u0E25\u0E49\u0E27 \u0E22\u0E31\u0E07\u0E44\u0E21\u0E48\u0E44\u0E14\u0E49\u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32\u0E2D\u0E35\u0E40\u0E21\u0E25 \u0E2A\u0E48\u0E07\u0E25\u0E34\u0E07\u0E01\u0E4C\u0E15\u0E31\u0E49\u0E07\u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E48\u0E32\u0E19\u0E08\u0E32\u0E01\u0E2B\u0E19\u0E49\u0E32\u0E1C\u0E39\u0E49\u0E43\u0E0A\u0E49\u0E41\u0E17\u0E19",none:"\u0E22\u0E31\u0E07\u0E44\u0E21\u0E48\u0E21\u0E35\u0E2A\u0E21\u0E32\u0E0A\u0E34\u0E01",loading:"\u0E01\u0E33\u0E25\u0E31\u0E07\u0E42\u0E2B\u0E25\u0E14\u2026",failed:"\u0E42\u0E2B\u0E25\u0E14\u0E23\u0E32\u0E22\u0E0A\u0E37\u0E48\u0E2D\u0E2A\u0E21\u0E32\u0E0A\u0E34\u0E01\u0E44\u0E21\u0E48\u0E2A\u0E33\u0E40\u0E23\u0E47\u0E08",choose:"\u0E40\u0E25\u0E37\u0E2D\u0E01 tenant \u0E17\u0E35\u0E48\u0E14\u0E49\u0E32\u0E19\u0E1A\u0E19\u0E02\u0E2D\u0E07\u0E40\u0E21\u0E19\u0E39\u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E14\u0E39\u0E2A\u0E21\u0E32\u0E0A\u0E34\u0E01",you:"\u0E04\u0E38\u0E13"}},e=l=>l.replace(/[&<>"']/g,a=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[a]),m=`
+  :host { display: block; font: inherit; color: var(--text); }
+  [hidden] { display: none !important; }
+  p { margin: 0 0 1rem; }
+  .muted { color: var(--text-muted); }
+  .card { border: 1px solid var(--border); border-radius: var(--radius, 12px); background: var(--surface); overflow-x: auto; }
+  table { width: 100%; border-collapse: collapse; font-size: 0.9rem; }
+  th { text-align: left; font-size: 0.75rem; font-weight: 600; color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.02em; }
+  th, td { padding: 0.6rem 0.75rem; border-bottom: 1px solid var(--border); vertical-align: middle; }
+  tr:last-child td { border-bottom: 0; }
+  form { display: flex; flex-wrap: wrap; gap: 0.5rem; align-items: flex-end; margin: 1.25rem 0 0.5rem; }
+  label { display: grid; gap: 0.25rem; font-size: 0.8rem; color: var(--text-muted); }
+  input, select {
+    min-height: 2.25rem; padding: 0 0.6rem; border: 1px solid var(--border-strong); border-radius: var(--radius-sm, 8px);
+    background: var(--surface); color: var(--text); font: inherit; font-size: 0.9rem;
+  }
+  input { min-width: 16rem; }
+  button {
+    min-height: 2.25rem; padding: 0 0.9rem; border: 1px solid var(--border-strong); border-radius: var(--radius-sm, 8px);
+    background: var(--surface); color: var(--text); font: inherit; font-size: 0.875rem; cursor: pointer;
+  }
+  button.primary { background: var(--accent); border-color: var(--accent); color: var(--accent-contrast, #fff); font-weight: 600; }
+  button:disabled { opacity: 0.6; cursor: default; }
+  button:focus-visible, input:focus-visible, select:focus-visible { outline: 2px solid var(--focus); outline-offset: 2px; }
+  .status { min-height: 1.25rem; font-size: 0.875rem; }
+  .error { color: var(--danger, #b42318); }
+`,d=class extends HTMLElement{api;uiLocale;user;data=null;state="loading";message="";error="";busy=!1;#e=!1;constructor(){super(),this.attachShadow({mode:"open"})}connectedCallback(){this.render(),this.#e||(this.#e=!0,this.load())}get uiLang(){return this.uiLocale==="th"?"th":"en"}get me(){return this.user?.id===void 0?void 0:String(this.user.id)}t(a,r={}){return u[this.uiLang][a].replace(/\{(\w+)\}/g,(t,s)=>r[s]??"")}async load(){if(this.api){try{this.data=await this.api("GET","/tenant-members"),this.state="ready"}catch(a){this.state=a.status===403?"choose":"failed"}this.render()}}async run(a){this.busy=!0,this.error="",this.message="",this.render();try{this.message=await a()??"",await this.load()}catch(r){this.error=r.message}finally{this.busy=!1,this.render()}}roleOptions(a){return(this.data?.roles??[]).map(r=>`<option value="${e(r.key)}"${r.key===a?" selected":""}>${e(r.name||r.key)}</option>`).join("")}render(){let a=this.shadowRoot;if(this.state!=="ready"||!this.data){let t=this.state==="loading"?this.t("loading"):this.state==="choose"?this.t("choose"):this.t("failed");a.innerHTML=`<style>${m}</style><p class="muted">${e(t)}</p>`;return}let r=this.data.members.map(t=>`<tr data-id="${e(String(t.id))}">
+          <td>${e(t.email)}${String(t.id)===this.me?` <span class="muted">(${e(this.t("you"))})</span>`:""}</td>
+          <td>${e(t.name??"")}</td>
+          <td><select data-role aria-label="${e(`${this.t("role")}: ${t.email}`)}"${this.busy?" disabled":""}>${this.roleOptions(t.role)}</select></td>
+          <td>${String(t.id)===this.me?"":`<button type="button" data-remove${this.busy?" disabled":""}>${e(this.t("remove"))}</button>`}</td>
+        </tr>`).join("");a.innerHTML=`<style>${m}</style>
+      <p class="muted">${e(this.t("lead"))}</p>
+      <div class="card">
+        ${r?`<table><thead><tr><th>${e(this.t("email"))}</th><th>${e(this.t("name"))}</th><th>${e(this.t("role"))}</th><th><span class="muted">${e(this.t("actions"))}</span></th></tr></thead><tbody>${r}</tbody></table>`:`<p class="muted" style="padding:1rem;margin:0">${e(this.t("none"))}</p>`}
+      </div>
+      <form>
+        <label>${e(this.t("email"))}<input type="email" name="email" required autocomplete="off"></label>
+        <label>${e(this.t("role"))}<select name="role">${this.roleOptions("editor")}</select></label>
+        <button type="submit" class="primary"${this.busy?" disabled":""}>${e(this.busy?this.t("adding"):this.t("add"))}</button>
+      </form>
+      <p class="status ${this.error?"error":""}" role="status">${e(this.error||this.message)}</p>`,a.querySelector("form")?.addEventListener("submit",t=>{t.preventDefault();let s=t.target,i=s.elements.namedItem("email").value.trim(),n=s.elements.namedItem("role").value;this.run(async()=>{let o=await this.api?.("POST","/tenant-members",{email:i,role:n});return this.t(o.invited?"invited":this.data?.invites===!1?"addedNoEmail":"added",{email:i})})});for(let t of a.querySelectorAll("tr[data-id]")){let s=t.dataset.id,i=t.querySelector("td")?.textContent?.trim()??"";t.querySelector("[data-role]")?.addEventListener("change",n=>{let o=n.target.value;this.run(async()=>{await this.api?.("PATCH",`/tenant-members/${encodeURIComponent(s)}`,{role:o})})}),t.querySelector("[data-remove]")?.addEventListener("click",()=>{window.confirm(this.t("removeConfirm",{email:i}))&&this.run(async()=>{await this.api?.("DELETE",`/tenant-members/${encodeURIComponent(s)}`)})})}}};customElements.get("ecms-tenant-members")||customElements.define("ecms-tenant-members",d);

package/dist/index.d.ts

@@ -0,0 +1,146 @@
+import { ID, RequestContext, AuthUser, TypedPlugin, EasyCMS } from '@easy-cms/core';
+
+/** "All tenants" in the switcher, the header or the cookie. */
+declare const ALL = "*";
+/**
+ * What a request knows about tenants, in its `context`:
+ * - `tenant`: the id of the tenant it works in, `null` for none (or all of them);
+ * - `allTenants`: it may see every tenant (users who have access to all of them, and
+ *   anonymous reads with `publicReads: 'all'`).
+ */
+interface TenantContext {
+    readonly tenant: ID | null;
+    readonly allTenants: boolean;
+}
+declare const tenantOf: (context: RequestContext | undefined) => TenantContext;
+/** One row of a user's `tenants`. */
+interface Membership {
+    readonly tenant: ID;
+    readonly role: string;
+}
+/** A tenant as `onRequest` and the helpers know it. */
+interface TenantRef {
+    readonly id: ID;
+    readonly name: string;
+    readonly slug: string;
+    readonly domains: readonly string[];
+}
+
+/** A member as the Members page shows them. */
+interface Member {
+    readonly id: ID;
+    readonly email: string;
+    readonly name: string | null;
+    readonly role: string;
+}
+
+interface MultiTenantOptions<S extends string = string, T extends string = string> {
+    /**
+     * Collections whose documents belong to one tenant, by slug, e.g. `['posts', 'pages',
+     * 'media']`. With `media` and `upload.folders`, the media folders too. Others are shared.
+     */
+    readonly collections: readonly S[];
+    /** Globals with a value per tenant, e.g. `['site-settings']`. Others are shared. */
+    readonly globals?: readonly string[];
+    /** Slug of the tenants collection. Default `tenants`. */
+    readonly tenantsSlug?: T;
+    /**
+     * Users who see and manage every tenant and the whole system. Default: users whose own role
+     * is `admin`.
+     */
+    readonly userHasAccessToAllTenants?: (user: AuthUser) => boolean;
+    /**
+     * Reads that name no tenant (no header, `?tenant=`, cookie or matching domain): `none`
+     * (default) finds nothing; `all` finds every tenant's published documents.
+     */
+    readonly publicReads?: 'none' | 'all';
+    /** Request header naming the tenant, by slug or id. Default `x-easy-cms-tenant`. */
+    readonly header?: string;
+    /** Cookie in which the admin keeps the chosen tenant. Default `ecms-tenant`. */
+    readonly cookie?: string;
+}
+type TenantFieldType<T extends string> = {
+    readonly name: 'tenant';
+    readonly type: 'relationship';
+    readonly to: T;
+};
+/** What `multiTenantPlugin(options)` adds, for the types the Local API infers from the config. */
+type MultiTenantPluginTypes<S extends string, T extends string = 'tenants'> = {
+    readonly fields: {
+        readonly [K in S]: readonly [TenantFieldType<T>];
+    } & {
+        readonly users: readonly [
+            {
+                readonly name: 'tenants';
+                readonly type: 'array';
+                readonly fields: readonly [
+                    {
+                        readonly name: 'tenant';
+                        readonly type: 'relationship';
+                        readonly to: T;
+                        readonly required: true;
+                    },
+                    {
+                        readonly name: 'role';
+                        readonly type: 'text';
+                        readonly required: true;
+                    }
+                ];
+            }
+        ];
+    };
+    readonly collections: readonly [
+        {
+            readonly slug: T;
+            readonly fields: readonly [
+                {
+                    readonly name: 'name';
+                    readonly type: 'text';
+                    readonly required: true;
+                },
+                {
+                    readonly name: 'slug';
+                    readonly type: 'slug';
+                },
+                {
+                    readonly name: 'domains';
+                    readonly type: 'array';
+                    readonly fields: readonly [
+                        {
+                            readonly name: 'domain';
+                            readonly type: 'text';
+                            readonly required: true;
+                        }
+                    ];
+                }
+            ];
+        }
+    ];
+};
+/**
+ * Several sites or clients in one CMS: a `tenants` collection, a `tenant` on the documents of
+ * the collections you name, members with a role in each tenant, a tenant switcher in the admin,
+ * and globals with a value per tenant. Requests name their tenant with a header, `?tenant=`,
+ * the admin's cookie or the domain.
+ */
+declare function multiTenantPlugin<const S extends string, const T extends string = 'tenants'>(options: MultiTenantOptions<S, T>): TypedPlugin<MultiTenantPluginTypes<S, T>>;
+
+/**
+ * The tenant of a page of your site, by slug or by domain (`domains` of the tenant), e.g. from
+ * the request's host. `null` when none matches.
+ */
+declare function findTenantFor(cms: EasyCMS, by: {
+    readonly slug?: string;
+    readonly host?: string;
+}, tenantsSlug?: string): Promise<TenantRef | null>;
+/**
+ * The `context` for Local API calls that read one tenant's content, e.g.
+ * `cms.find('posts', { overrideAccess: false, user: null, context: await tenantContext(cms, { host }) })`.
+ * A tenant that doesn't exist gives a context that finds nothing.
+ */
+declare function tenantContext(cms: EasyCMS, by: {
+    readonly slug?: string;
+    readonly host?: string;
+}, tenantsSlug?: string): Promise<RequestContext>;
+
+export { ALL, type Member, type Membership, type MultiTenantOptions, type MultiTenantPluginTypes, type TenantContext, type TenantRef, findTenantFor, multiTenantPlugin, tenantContext, tenantOf };

package/dist/index.js

@@ -0,0 +1,648 @@
+// src/shared.ts
+var TENANT_FIELD = "tenant";
+var MEMBERSHIPS_FIELD = "tenants";
+var ALL = "*";
+var tenantOf = (context) => ({
+  tenant: context?.tenant ?? null,
+  allTenants: context?.allTenants === true
+});
+function membershipsOf(user) {
+  const rows = user?.[MEMBERSHIPS_FIELD];
+  if (!Array.isArray(rows)) return [];
+  return rows.flatMap((row) => {
+    const r = row;
+    const tenant = r.tenant && typeof r.tenant === "object" ? r.tenant.id : r.tenant;
+    return tenant === null || tenant === void 0 ? [] : [{ tenant, role: typeof r.role === "string" ? r.role : "editor" }];
+  });
+}
+var NOTHING = {
+  and: [{ [TENANT_FIELD]: { exists: true } }, { [TENANT_FIELD]: { exists: false } }]
+};
+var sameId = (a, b) => a !== null && a !== void 0 && b !== null && b !== void 0 && String(a) === String(b);
+var CACHE = /* @__PURE__ */ Symbol.for("easy-cms.multi-tenant.tenants");
+var TTL = 1e4;
+async function tenantList(cms, slug) {
+  const holder = cms;
+  const cached = holder[CACHE];
+  if (cached && Date.now() - cached.at < TTL) return cached.list;
+  const list = cms.find(slug, { limit: 0, depth: 0, sort: "name" }).then(
+    ({ docs }) => docs.map((doc) => ({
+      id: doc.id,
+      name: String(doc.name ?? doc.slug ?? doc.id),
+      slug: String(doc.slug ?? ""),
+      domains: Array.isArray(doc.domains) ? doc.domains.map((d) => String(d.domain ?? "").toLowerCase()).filter(Boolean) : []
+    }))
+  );
+  holder[CACHE] = { at: Date.now(), list };
+  list.catch(() => {
+    if (holder[CACHE]?.list === list) delete holder[CACHE];
+  });
+  return list;
+}
+function forgetTenants(cms) {
+  delete cms[CACHE];
+}
+var hostName = (host) => (host ?? "").trim().toLowerCase().replace(/:\d+$/, "");
+var findTenant = (list, value) => value ? list.find((t) => String(t.id) === value || t.slug === value) : void 0;
+var tenantOfHost = (list, host) => {
+  const name = hostName(host);
+  return name ? list.find((t) => t.domains.includes(name)) : void 0;
+};
+
+// src/plugin.ts
+import {
+  definePlugin,
+  isLoggedIn,
+  MEDIA,
+  MEDIA_FOLDERS,
+  ValidationError as ValidationError2
+} from "@easy-cms/core";
+
+// src/info.ts
+var INFO = {
+  name: "@easy-cms/plugin-multi-tenant",
+  ...true ? { version: "0.43.0" } : {}
+};
+
+// src/members.ts
+import {
+  ForbiddenError,
+  NotFoundError,
+  ValidationError
+} from "@easy-cms/core";
+function membersEndpoints(options) {
+  const tenantFor = (user, context) => {
+    const { tenant } = tenantOf(context);
+    if (!user) throw new ForbiddenError("Log in first");
+    if (tenant === null) throw new ForbiddenError("Choose a tenant first");
+    if (user.role !== "admin" && !options.superUser(user, context))
+      throw new ForbiddenError("Only admins of this tenant manage its members");
+    return tenant;
+  };
+  const roleOf = async (cms, value) => {
+    const roles = await cms.roles.options();
+    const role = typeof value === "string" ? value : "";
+    if (!roles.some((r) => r.key === role))
+      throw new ValidationError("users", [{ field: "role", message: `there is no role "${role}"` }]);
+    return role;
+  };
+  const member = (doc, tenant) => ({
+    id: doc.id,
+    email: String(doc.email ?? ""),
+    name: typeof doc.name === "string" ? doc.name : null,
+    role: membershipsOf(doc).find((m) => sameId(m.tenant, tenant))?.role ?? ""
+  });
+  const rows = (doc) => (doc[MEMBERSHIPS_FIELD] ?? []).map((row) => ({ ...row }));
+  const findMember = async (cms, id, tenant) => {
+    const doc = await cms.findById("users", /^\d+$/.test(id) ? Number(id) : id, {
+      depth: 0
+    });
+    if (!doc || !membershipsOf(doc).some((m) => sameId(m.tenant, tenant)))
+      throw new NotFoundError("members", id);
+    return doc;
+  };
+  return [
+    {
+      path: "/tenant-members",
+      method: "get",
+      handler: async ({ user, context, cms }) => {
+        const tenant = tenantFor(user, context);
+        const { docs } = await cms.find("users", {
+          where: { [`${MEMBERSHIPS_FIELD}.tenant`]: { equals: tenant } },
+          sort: "email",
+          limit: 0,
+          depth: 0
+        });
+        return {
+          members: docs.map((doc) => member(doc, tenant)),
+          roles: await cms.roles.options(),
+          invites: cms.auth.canSendPasswordLinks()
+        };
+      }
+    },
+    {
+      path: "/tenant-members",
+      method: "post",
+      handler: async ({ user, context, cms, json, url }) => {
+        const tenant = tenantFor(user, context);
+        const body = await json();
+        const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
+        if (!/^[^\s@]+@[^\s@]+$/.test(email))
+          throw new ValidationError("users", [
+            { field: "email", message: "is not an email address" }
+          ]);
+        const role = await roleOf(cms, body.role);
+        const { docs } = await cms.find("users", {
+          where: { email: { equals: email } },
+          limit: 1,
+          depth: 0
+        });
+        const existing = docs[0];
+        if (existing) {
+          const list = rows(existing).filter((row) => !sameId(row.tenant, tenant));
+          const doc2 = await cms.update(
+            "users",
+            existing.id,
+            { [MEMBERSHIPS_FIELD]: [...list, { tenant, role }] },
+            { depth: 0 }
+          );
+          return { member: member(doc2, tenant), invited: false };
+        }
+        const doc = await cms.create(
+          "users",
+          { email, [MEMBERSHIPS_FIELD]: [{ tenant, role }] },
+          { depth: 0 }
+        );
+        let invited = false;
+        if (cms.auth.canSendPasswordLinks(url.origin)) {
+          await cms.auth.sendPasswordLink(doc.id, { origin: url.origin });
+          invited = true;
+        }
+        return Response.json({ member: member(doc, tenant), invited }, { status: 201 });
+      }
+    },
+    {
+      path: "/tenant-members/:id",
+      method: "patch",
+      handler: async ({ user, context, cms, json, params }) => {
+        const tenant = tenantFor(user, context);
+        const doc = await findMember(cms, params.id, tenant);
+        const role = await roleOf(cms, (await json()).role);
+        const list = rows(doc).map((row) => sameId(row.tenant, tenant) ? { ...row, role } : row);
+        const updated = await cms.update(
+          "users",
+          doc.id,
+          { [MEMBERSHIPS_FIELD]: list },
+          { depth: 0 }
+        );
+        return { member: member(updated, tenant) };
+      }
+    },
+    {
+      path: "/tenant-members/:id",
+      method: "delete",
+      handler: async ({ user, context, cms, params }) => {
+        const tenant = tenantFor(user, context);
+        const doc = await findMember(cms, params.id, tenant);
+        if (sameId(doc.id, user?.id))
+          throw new ValidationError("users", [
+            { field: "id", message: "you can't remove yourself from a tenant" }
+          ]);
+        const list = rows(doc).filter((row) => !sameId(row.tenant, tenant));
+        await cms.update("users", doc.id, { [MEMBERSHIPS_FIELD]: list }, {
+          depth: 0
+        });
+        return { removed: true };
+      }
+    }
+  ];
+}
+
+// src/plugin.ts
+var BUILTIN_ACCESS = {
+  [MEDIA]: { read: () => true, create: isLoggedIn, update: isLoggedIn, delete: isLoggedIn },
+  [MEDIA_FOLDERS]: { read: isLoggedIn, create: isLoggedIn, update: isLoggedIn, delete: isLoggedIn }
+};
+function readCookie(header, name) {
+  for (const part of header?.split(";") ?? []) {
+    const eq = part.indexOf("=");
+    if (eq > 0 && part.slice(0, eq).trim() === name)
+      return decodeURIComponent(part.slice(eq + 1).trim());
+  }
+  return void 0;
+}
+function multiTenantPlugin(options) {
+  return definePlugin((config) => {
+    const tenantsSlug = options.tenantsSlug ?? "tenants";
+    const header = (options.header ?? "x-easy-cms-tenant").toLowerCase();
+    const cookie = options.cookie ?? "ecms-tenant";
+    const publicReads = options.publicReads ?? "none";
+    const isSuper = options.userHasAccessToAllTenants ?? ((user) => user.role === "admin");
+    const scoped = new Set(options.collections);
+    if (scoped.has(MEDIA) && config.upload?.folders === true) scoped.add(MEDIA_FOLDERS);
+    const declared = new Set((config.collections ?? []).map((c) => c.slug));
+    const missing = [...scoped].filter(
+      (s) => !declared.has(s) && s !== MEDIA && s !== MEDIA_FOLDERS
+    );
+    if (missing.length)
+      throw new Error(
+        `multiTenantPlugin: no collection ${missing.map((s) => `"${s}"`).join(", ")} in the config (add plugins that make collections before this one)`
+      );
+    if (scoped.has(tenantsSlug) || scoped.has("users"))
+      throw new Error(`multiTenantPlugin: "${tenantsSlug}" and "users" can't belong to a tenant`);
+    const perTenant = new Set(options.globals ?? []);
+    const unknownGlobals = [...perTenant].filter(
+      (g) => !(config.globals ?? []).some((global) => global.slug === g)
+    );
+    if (unknownGlobals.length)
+      throw new Error(
+        `multiTenantPlugin: no global ${unknownGlobals.map((g) => `"${g}"`).join(", ")} in the config`
+      );
+    const everywhere = (user, context) => tenantOf(context).allTenants || !!user && user.scoped !== true && isSuper(user);
+    const superUser = (user, context) => !!user && everywhere(user, context);
+    const tenantFilter = (args, op) => {
+      const { tenant } = tenantOf(args.context);
+      if (op === "create") return tenant !== null || everywhere(args.user, args.context);
+      if (tenant !== null) return { [TENANT_FIELD]: { equals: tenant } };
+      if (everywhere(args.user, args.context)) return true;
+      return op === "read" ? NOTHING : false;
+    };
+    const narrow = (original, op) => async (args) => {
+      const base = await (original ?? isLoggedIn)(args);
+      if (base === false) return false;
+      const filter = tenantFilter(args, op);
+      if (filter === false) return false;
+      if (filter === true) return base;
+      return base === true ? filter : { and: [base, filter] };
+    };
+    const withTenantFilters = (fields) => fields.map((field) => {
+      if (field.type === "group" || field.type === "array")
+        return { ...field, fields: withTenantFilters(field.fields) };
+      if (field.type === "blocks")
+        return {
+          ...field,
+          blocks: field.blocks.map((b) => ({ ...b, fields: withTenantFilters(b.fields) }))
+        };
+      if (field.type !== "relationship" || !scoped.has(field.to)) return field;
+      const own = field.filterOptions;
+      return {
+        ...field,
+        filterOptions: async (args) => {
+          const base = own ? await own(args) : true;
+          const { tenant } = tenantOf(args.context);
+          if (tenant === null) return base;
+          const mine = { [TENANT_FIELD]: { equals: tenant } };
+          return base === true ? mine : { and: [base, mine] };
+        }
+      };
+    });
+    const tenantField = {
+      name: TENANT_FIELD,
+      type: "relationship",
+      to: tenantsSlug,
+      index: true,
+      position: "sidebar",
+      label: { en: "Tenant", th: "Tenant" },
+      // Set from the tenant the request works in; only users with access to all tenants choose.
+      access: { update: ({ user, context }) => superUser(user, context) }
+    };
+    const fillTenant = ({ data, operation, context }) => {
+      if (operation !== "create" || (data[TENANT_FIELD] ?? null) !== null) return data;
+      const { tenant } = tenantOf(context);
+      return tenant === null ? data : { ...data, [TENANT_FIELD]: tenant };
+    };
+    const checkTenant = (slug) => ({ data, operation, originalDoc, context, user }) => {
+      const value = data[TENANT_FIELD] ?? null;
+      const { tenant } = tenantOf(context);
+      if (!user && tenant === null) return data;
+      const fail = (message) => {
+        throw new ValidationError2(slug, [{ field: TENANT_FIELD, message }]);
+      };
+      if (value === null) fail("is required: choose a tenant");
+      if (everywhere(user, context)) return data;
+      if (!sameId(value, tenant)) fail("must be the tenant you work in");
+      const before = originalDoc?.[TENANT_FIELD] ?? null;
+      if (operation === "update" && before !== null && !sameId(before, value))
+        fail("can't move to another tenant");
+      return data;
+    };
+    const scopeCollection = (c, builtin) => {
+      const fields = withTenantFilters(
+        c.fields.map(
+          (f) => (f.unique || f.type === "slug") && f.uniqueWithin === void 0 ? { ...f, uniqueWithin: TENANT_FIELD } : f
+        )
+      );
+      const access = { ...builtin, ...c.access };
+      return {
+        ...c,
+        fields: fields.some((f) => f.name === TENANT_FIELD) ? fields : [...fields, tenantField],
+        access: {
+          read: narrow(access.read, "read"),
+          create: narrow(access.create, "create"),
+          update: narrow(access.update, "update"),
+          delete: narrow(access.delete, "delete")
+        },
+        hooks: {
+          ...c.hooks,
+          beforeValidate: [fillTenant, ...c.hooks?.beforeValidate ?? []],
+          beforeChange: [...c.hooks?.beforeChange ?? [], checkTenant(c.slug)]
+        }
+      };
+    };
+    const memberships = {
+      name: MEMBERSHIPS_FIELD,
+      type: "array",
+      label: { en: "Tenants", th: "Tenant" },
+      access: { update: ({ user, context }) => superUser(user, context) },
+      fields: [
+        { name: "tenant", type: "relationship", to: tenantsSlug, required: true },
+        {
+          name: "role",
+          type: "text",
+          required: true,
+          defaultValue: "editor",
+          label: { en: "Role", th: "\u0E1A\u0E17\u0E1A\u0E32\u0E17" }
+        }
+      ]
+    };
+    const usersAccess = (custom) => {
+      const and = (own, mine) => own ? async (args) => {
+        const a = await own(args);
+        if (a === false) return false;
+        const b = await mine(args);
+        if (b === false) return false;
+        if (a === true) return b;
+        return b === true ? a : { and: [a, b] };
+      } : mine;
+      const self = (user) => ({ id: { equals: user.id } });
+      return {
+        read: and(custom?.read, ({ user, context }) => {
+          if (!user) return false;
+          if (superUser(user, context)) return true;
+          const { tenant } = tenantOf(context);
+          return tenant === null ? self(user) : { or: [self(user), { [`${MEMBERSHIPS_FIELD}.tenant`]: { equals: tenant } }] };
+        }),
+        // Members are added through Members (`/tenant-members`), not by creating users.
+        create: and(custom?.create, ({ user, context }) => superUser(user, context)),
+        update: and(
+          custom?.update,
+          ({ user, context }) => !user ? false : superUser(user, context) ? true : self(user)
+        ),
+        delete: and(custom?.delete, ({ user, context }) => superUser(user, context))
+      };
+    };
+    const tenantsAccess = {
+      read: ({ user, context }) => {
+        if (!user) return false;
+        if (superUser(user, context)) return true;
+        const ids = membershipsOf(user).map((m) => m.tenant);
+        return ids.length ? { id: { in: ids } } : false;
+      },
+      create: ({ user, context }) => superUser(user, context),
+      update: ({ user, context }) => superUser(user, context),
+      delete: ({ user, context }) => superUser(user, context)
+    };
+    const tenantsCollection = {
+      slug: tenantsSlug,
+      labels: { singular: { en: "Tenant", th: "Tenant" }, plural: { en: "Tenants", th: "Tenant" } },
+      icon: "building",
+      useAsTitle: "name",
+      admin: { group: "settings" },
+      access: tenantsAccess,
+      hooks: {
+        afterChange: [({ cms }) => forgetTenants(cms)],
+        afterDelete: [
+          async ({ cms, id }) => {
+            forgetTenants(cms);
+            await removeTenant(cms, id, [...scoped]);
+          }
+        ]
+      },
+      fields: [
+        { name: "name", type: "text", required: true, label: { en: "Name", th: "\u0E0A\u0E37\u0E48\u0E2D" } },
+        { name: "slug", type: "slug", from: "name", label: { en: "Slug", th: "Slug" } },
+        {
+          name: "domains",
+          type: "array",
+          label: { en: "Domains", th: "\u0E42\u0E14\u0E40\u0E21\u0E19" },
+          fields: [
+            {
+              name: "domain",
+              type: "text",
+              required: true,
+              label: { en: "Domain, e.g. example.com", th: "\u0E42\u0E14\u0E40\u0E21\u0E19 \u0E40\u0E0A\u0E48\u0E19 example.com" }
+            }
+          ]
+        }
+      ]
+    };
+    const collections = [];
+    const ownTenants = (config.collections ?? []).find((c) => c.slug === tenantsSlug);
+    collections.push(
+      ownTenants ? {
+        ...tenantsCollection,
+        ...ownTenants,
+        fields: [...tenantsCollection.fields, ...ownTenants.fields],
+        access: tenantsAccess,
+        hooks: {
+          ...ownTenants.hooks,
+          afterChange: [
+            ...tenantsCollection.hooks?.afterChange ?? [],
+            ...ownTenants.hooks?.afterChange ?? []
+          ],
+          afterDelete: [
+            ...tenantsCollection.hooks?.afterDelete ?? [],
+            ...ownTenants.hooks?.afterDelete ?? []
+          ]
+        }
+      } : tenantsCollection
+    );
+    let hasUsers = false;
+    for (const c of config.collections ?? []) {
+      if (c.slug === tenantsSlug) continue;
+      if (c.slug === "users") {
+        hasUsers = true;
+        collections.push({
+          ...c,
+          fields: [...withTenantFilters(c.fields), memberships],
+          access: { ...c.access, ...usersAccess(c.access) }
+        });
+      } else if (scoped.has(c.slug)) collections.push(scopeCollection(c, BUILTIN_ACCESS[c.slug]));
+      else collections.push({ ...c, fields: withTenantFilters(c.fields) });
+    }
+    if (!hasUsers) collections.push({ slug: "users", fields: [memberships], access: usersAccess() });
+    for (const builtin of [MEDIA, MEDIA_FOLDERS]) {
+      if (scoped.has(builtin) && !declared.has(builtin))
+        collections.push(scopeCollection({ slug: builtin, fields: [] }, BUILTIN_ACCESS[builtin]));
+    }
+    const globals = (config.globals ?? []).map((g) => {
+      const filtered = { ...g, fields: withTenantFilters(g.fields) };
+      if (!perTenant.has(g.slug)) return filtered;
+      return {
+        ...filtered,
+        // One value per tenant; none when the request has no tenant.
+        scope: ({ context }) => {
+          const { tenant } = tenantOf(context);
+          return tenant === null ? null : String(tenant);
+        }
+      };
+    });
+    const previous = config.onRequest;
+    const onRequest = async (args) => {
+      const before = previous ? await previous(args) : void 0;
+      const user = before?.user !== void 0 ? before.user : args.user;
+      const context = { ...before?.context };
+      const list = await tenantList(args.cms, tenantsSlug);
+      const asked = args.headers.get(header) ?? args.url?.searchParams.get("tenant") ?? readCookie(args.headers.get("cookie"), cookie) ?? null;
+      const byHost = tenantOfHost(
+        list,
+        args.headers.get("x-forwarded-host") ?? args.headers.get("host") ?? args.url?.host
+      );
+      const bound = user?.apiKey?.permissions?.context;
+      const boundTenant = bound ? tenantOf(bound) : void 0;
+      if (user && isSuper(user) && (!boundTenant || boundTenant.tenant === null)) {
+        const chosen2 = asked === ALL ? void 0 : findTenant(list, asked);
+        return { user, context: { ...context, tenant: chosen2?.id ?? null, allTenants: true } };
+      }
+      if (user) {
+        const mine = membershipsOf(user);
+        const member = (t) => t ? mine.find((m) => sameId(m.tenant, t.id)) : void 0;
+        const membership = boundTenant && boundTenant.tenant !== null ? mine.find((m) => sameId(m.tenant, boundTenant.tenant)) ?? (isSuper(user) ? { tenant: boundTenant.tenant, role: user.role } : void 0) : member(findTenant(list, asked)) ?? member(byHost) ?? mine.find((m) => list.some((t) => sameId(t.id, m.tenant)));
+        return {
+          user: { ...user, role: membership?.role ?? user.role, scoped: true },
+          context: { ...context, tenant: membership?.tenant ?? null, allTenants: false }
+        };
+      }
+      const chosen = asked && asked !== ALL ? findTenant(list, asked) : byHost;
+      return {
+        user,
+        context: {
+          ...context,
+          tenant: chosen?.id ?? null,
+          allTenants: !chosen && publicReads === "all"
+        }
+      };
+    };
+    const optionsEndpoint = {
+      path: "/tenant-options",
+      method: "get",
+      handler: async ({ user, context, cms }) => {
+        if (!user) return Response.json({ errors: [{ message: "Log in first" }] }, { status: 401 });
+        const list = await tenantList(cms, tenantsSlug);
+        const all = superUser(user, context);
+        const mine = membershipsOf(user);
+        return {
+          options: list.filter((t) => all || mine.some((m) => sameId(m.tenant, t.id))).map((t) => ({ value: t.slug || String(t.id), label: t.name })),
+          ...all ? { all: { en: "All tenants", th: "\u0E17\u0E38\u0E01 tenant" } } : {}
+        };
+      }
+    };
+    const assign = {
+      name: "tenants:assign",
+      description: "Give documents without a tenant to one (after adding the plugin to a site)",
+      help: `Usage: easy-cms tenants:assign <tenant> [options]
+
+Sets the tenant (by slug or id) of every document that has none, in the collections of
+multiTenantPlugin, and copies the shared value of each per-tenant global to it when it has none
+of its own. Run it once after adding the plugin to a site that has content.
+`,
+      run: async ({ cms, args, log }) => {
+        const list = await tenantList(cms, tenantsSlug);
+        const tenant = findTenant(list, args[0]);
+        if (!tenant) {
+          log(args[0] ? `No tenant "${args[0]}"` : "Name a tenant: easy-cms tenants:assign <slug>");
+          return 1;
+        }
+        for (const slug of scoped) {
+          if (!cms.config.collections.some((c) => c.slug === slug)) continue;
+          let updated = 0;
+          for (; ; ) {
+            const { docs } = await cms.find(slug, {
+              where: { [TENANT_FIELD]: { exists: false } },
+              limit: 100,
+              depth: 0,
+              draft: true
+            });
+            if (docs.length === 0) break;
+            for (const doc of docs) {
+              await cms.update(slug, doc.id, { [TENANT_FIELD]: tenant.id }, {
+                depth: 0,
+                live: true
+              });
+              updated++;
+            }
+          }
+          log(`${slug}: ${updated} given to ${tenant.name}`);
+        }
+        const context = { tenant: tenant.id, allTenants: false };
+        for (const slug of perTenant) {
+          const own = await cms.findGlobal(slug, { context, depth: 0 });
+          if (own.updatedAt) continue;
+          const shared = await cms.db.findGlobal({ slug });
+          if (!shared) continue;
+          const { updatedAt: _u, ...data } = shared;
+          await cms.updateGlobal(slug, data, { context, depth: 0 });
+          log(`${slug}: copied to ${tenant.name}`);
+        }
+        return 0;
+      }
+    };
+    return {
+      ...config,
+      collections,
+      globals,
+      onRequest,
+      endpoints: [
+        ...config.endpoints ?? [],
+        optionsEndpoint,
+        ...membersEndpoints({ tenantsSlug, superUser })
+      ],
+      commands: [...config.commands ?? [], assign],
+      admin: {
+        ...config.admin,
+        modules: [
+          .../* @__PURE__ */ new Set([...config.admin?.modules ?? [], "@easy-cms/plugin-multi-tenant/admin"])
+        ],
+        switcher: { cookie, label: { en: "Tenant", th: "Tenant" }, options: "/tenant-options" },
+        pages: [
+          ...config.admin?.pages ?? [],
+          {
+            path: "tenant-members",
+            label: { en: "Members", th: "\u0E2A\u0E21\u0E32\u0E0A\u0E34\u0E01" },
+            icon: "users",
+            group: "settings",
+            // Admins of a tenant (and users with access to all, once they choose one).
+            access: ({ user }) => user.role === "admin",
+            component: { tag: "ecms-tenant-members" }
+          }
+        ]
+      }
+    };
+  }, INFO);
+}
+async function removeTenant(cms, id, collections) {
+  const order = [...collections].sort(
+    (a, b) => a === MEDIA_FOLDERS ? 1 : b === MEDIA_FOLDERS ? -1 : 0
+  );
+  for (const slug of order) {
+    if (!cms.config.collections.some((c) => c.slug === slug)) continue;
+    for (; ; ) {
+      const { docs } = await cms.find(slug, {
+        where: { [TENANT_FIELD]: { equals: id } },
+        limit: 100,
+        depth: 0,
+        draft: true
+      });
+      if (docs.length === 0) break;
+      for (const doc of docs) await cms.delete(slug, doc.id).catch(() => void 0);
+    }
+  }
+  const { docs: members } = await cms.find("users", {
+    where: { [`${MEMBERSHIPS_FIELD}.tenant`]: { equals: id } },
+    limit: 0,
+    depth: 0
+  });
+  for (const member of members) {
+    const rows = member[MEMBERSHIPS_FIELD].filter(
+      (row) => !sameId(row.tenant, id)
+    );
+    await cms.update("users", member.id, { [MEMBERSHIPS_FIELD]: rows }, { depth: 0 });
+  }
+}
+
+// src/index.ts
+async function findTenantFor(cms, by, tenantsSlug = "tenants") {
+  const list = await tenantList(cms, tenantsSlug);
+  return (by.slug ? findTenant(list, by.slug) : void 0) ?? tenantOfHost(list, by.host) ?? null;
+}
+async function tenantContext(cms, by, tenantsSlug = "tenants") {
+  const tenant = await findTenantFor(cms, by, tenantsSlug);
+  return { tenant: tenant?.id ?? null, allTenants: false };
+}
+export {
+  ALL,
+  findTenantFor,
+  multiTenantPlugin,
+  tenantContext,
+  tenantOf
+};

package/package.json

@@ -1,6 +1,49 @@
 {
   "name": "@easy-cms/plugin-multi-tenant",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.43.0",
+  "description": "Multi-tenant Easy CMS: several sites or clients in one CMS, each with its own content, members and roles",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./admin": "./dist/admin.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "peerDependencies": {
+    "@easy-cms/core": "^0.43.0"
+  },
+  "devDependencies": {
+    "@easy-cms/core": "^0.43.0",
+    "@easy-cms/db-sqlite": "^0.43.0"
+  },
+  "engines": {
+    "node": ">=22.12"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/maritonx/easy-cms.git",
+    "directory": "packages/plugin-multi-tenant"
+  },
+  "keywords": [
+    "easy-cms",
+    "easy-cms-plugin",
+    "multi-tenant",
+    "multi-site",
+    "tenants"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
 }