@easy-cms/plugin-multi-tenant 0.47.3 → 0.48.0

package/dist/index.d.ts

@@ -42,6 +42,12 @@ interface MultiTenantOptions<S extends string = string, T extends string = strin
     readonly collections: readonly S[];
     /** Globals with a value per tenant, e.g. `['site-settings']`. Others are shared. */
     readonly globals?: readonly string[];
+    /**
+     * Shared collections and globals (not listed above) that the people of a tenant, its admins
+     * included, may change. A change applies to every tenant. Default: none; only users with
+     * access to all tenants change shared data.
+     */
+    readonly editShared?: readonly string[];
     /** Slug of the tenants collection. Default `tenants`. */
     readonly tenantsSlug?: T;
     /**

package/dist/index.js

@@ -61,7 +61,7 @@ import {
 // src/info.ts
 var INFO = {
   name: "@easy-cms/plugin-multi-tenant",
-  ...true ? { version: "0.47.3" } : {}
+  ...true ? { version: "0.48.0" } : {}
 };
 
 // src/members.ts
@@ -70,6 +70,24 @@ import {
   NotFoundError,
   ValidationError
 } from "@easy-cms/core";
+async function addedEmail(cms, tenantsSlug, tenant, to, origin) {
+  const found = await cms.findById(tenantsSlug, tenant, { depth: 0 });
+  const name = typeof found?.name === "string" ? found.name : String(tenant);
+  const admin = `${cms.config.serverURL ?? origin}${cms.config.admin.path}`;
+  return {
+    to,
+    subject: `You were added to ${name}`,
+    text: [
+      `An admin of ${name} added you to it. Sign in as before to work there:`,
+      admin,
+      "",
+      `\u0E1C\u0E39\u0E49\u0E14\u0E39\u0E41\u0E25\u0E02\u0E2D\u0E07 ${name} \u0E40\u0E1E\u0E34\u0E48\u0E21\u0E04\u0E38\u0E13\u0E40\u0E02\u0E49\u0E32\u0E44\u0E1B\u0E41\u0E25\u0E49\u0E27 \u0E40\u0E02\u0E49\u0E32\u0E2A\u0E39\u0E48\u0E23\u0E30\u0E1A\u0E1A\u0E14\u0E49\u0E27\u0E22\u0E1A\u0E31\u0E0D\u0E0A\u0E35\u0E40\u0E14\u0E34\u0E21\u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E17\u0E33\u0E07\u0E32\u0E19\u0E17\u0E35\u0E48\u0E19\u0E31\u0E48\u0E19:`,
+      admin,
+      "",
+      "If you don't know why, ask your admin. / \u0E2B\u0E32\u0E01\u0E44\u0E21\u0E48\u0E17\u0E23\u0E32\u0E1A\u0E17\u0E35\u0E48\u0E21\u0E32 \u0E42\u0E1B\u0E23\u0E14\u0E2A\u0E2D\u0E1A\u0E16\u0E32\u0E21\u0E1C\u0E39\u0E49\u0E14\u0E39\u0E41\u0E25"
+    ].join("\n")
+  };
+}
 function membersEndpoints(options) {
   const tenantFor = (user, context) => {
     const { tenant } = tenantOf(context);
@@ -139,6 +157,12 @@ function membersEndpoints(options) {
         });
         const existing = docs[0];
         if (existing) {
+          const account = { id: existing.id, email, role: existing.role };
+          const memberRoles = cms.config.auth.members?.roles ?? [];
+          if (memberRoles.includes(String(existing.role)) || options.isSuper(account))
+            throw new ValidationError("users", [
+              { field: "email", message: "can't be added to a tenant" }
+            ]);
           const list = rows(existing).filter((row) => !sameId(row.tenant, tenant));
           const doc2 = await cms.update(
             "users",
@@ -146,7 +170,17 @@ function membersEndpoints(options) {
             { [MEMBERSHIPS_FIELD]: [...list, { tenant, role }] },
             { depth: 0 }
           );
-          return { member: member(doc2, tenant), invited: false };
+          let invited2 = false;
+          if (cms.auth.canSendPasswordLinks(url.origin)) {
+            await cms.sendEmail(
+              await addedEmail(cms, options.tenantsSlug, tenant, email, url.origin)
+            );
+            invited2 = true;
+          }
+          return Response.json(
+            { member: { ...member(doc2, tenant), name: null }, invited: invited2 },
+            { status: 201 }
+          );
         }
         const doc = await cms.create(
           "users",
@@ -240,6 +274,8 @@ function multiTenantPlugin(options) {
       );
     const superUser = (user, _context) => !!user && user.member !== true && user.scoped !== true && isSuper(user);
     const everywhere = (user, context) => tenantOf(context).allTenants || superUser(user, context);
+    const editShared = new Set(options.editShared ?? []);
+    const sharedWrite = (slug, original) => async (args) => args.user?.scoped === true && !editShared.has(slug) ? false : (original ?? isLoggedIn)(args);
     const tenantFilter = (args, op) => {
       const { tenant } = tenantOf(args.context);
       if (op === "create") return tenant !== null || superUser(args.user, args.context);
@@ -482,7 +518,17 @@ function multiTenantPlugin(options) {
           access: { ...c.access, ...usersAccess(c.access) }
         });
       } else if (scoped.has(c.slug)) collections.push(scopeCollection(c, BUILTIN_ACCESS[c.slug]));
-      else collections.push({ ...c, fields: withTenantFilters(c.fields) });
+      else
+        collections.push({
+          ...c,
+          fields: withTenantFilters(c.fields),
+          access: {
+            ...c.access,
+            create: sharedWrite(c.slug, c.access?.create),
+            update: sharedWrite(c.slug, c.access?.update),
+            delete: sharedWrite(c.slug, c.access?.delete)
+          }
+        });
     }
     if (!hasUsers) collections.push({ slug: "users", fields: [memberships], access: usersAccess() });
     for (const builtin of [MEDIA, MEDIA_FOLDERS]) {
@@ -500,7 +546,11 @@ function multiTenantPlugin(options) {
     }
     const globals = (config.globals ?? []).map((g) => {
       const filtered = { ...g, fields: withTenantFilters(g.fields) };
-      if (!perTenant.has(g.slug)) return filtered;
+      if (!perTenant.has(g.slug))
+        return {
+          ...filtered,
+          access: { ...g.access, update: sharedWrite(g.slug, g.access?.update) }
+        };
       return {
         ...filtered,
         // One value per tenant; none when the request has no tenant.
@@ -662,7 +712,7 @@ of its own. Run it once after adding the plugin to a site that has content.
         ...config.endpoints ?? [],
         optionsEndpoint,
         impactEndpoint,
-        ...membersEndpoints({ tenantsSlug, superUser })
+        ...membersEndpoints({ tenantsSlug, superUser, isSuper })
       ],
       commands: [...config.commands ?? [], assign],
       // Audit log entries belong to their tenant: its admins see them.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/plugin-multi-tenant",
-  "version": "0.47.3",
+  "version": "0.48.0",
   "description": "Multi-tenant Easy CMS: several sites or clients in one CMS, each with its own content, members and roles",
   "license": "MIT",
   "type": "module",
@@ -17,14 +17,14 @@
     "dist"
   ],
   "peerDependencies": {
-    "@easy-cms/core": "^0.47.3"
+    "@easy-cms/core": "^0.48.0"
   },
   "devDependencies": {
-    "@easy-cms/core": "^0.47.3",
-    "@easy-cms/db-sqlite": "^0.47.3",
-    "@easy-cms/plugin-form-builder": "^0.47.3",
-    "@easy-cms/plugin-nested-docs": "^0.47.3",
-    "@easy-cms/plugin-redirects": "^0.47.3"
+    "@easy-cms/core": "^0.48.0",
+    "@easy-cms/db-sqlite": "^0.48.0",
+    "@easy-cms/plugin-form-builder": "^0.48.0",
+    "@easy-cms/plugin-nested-docs": "^0.48.0",
+    "@easy-cms/plugin-redirects": "^0.48.0"
   },
   "engines": {
     "node": ">=22.12"