@easy-cms/plugin-multi-tenant 0.47.4 → 0.49.0

package/dist/index.d.ts

@@ -34,7 +34,7 @@ interface Member {
     readonly role: string;
 }
 
-interface MultiTenantOptions<S extends string = string, T extends string = string> {
+interface MultiTenantPluginOptions<S extends string = string, T extends string = string> {
     /**
      * Collections whose documents belong to one tenant, by slug, e.g. `['posts', 'pages',
      * 'media']`. With `media` and `upload.folders`, the media folders too. Others are shared.
@@ -42,8 +42,16 @@ interface MultiTenantOptions<S extends string = string, T extends string = strin
     readonly collections: readonly S[];
     /** Globals with a value per tenant, e.g. `['site-settings']`. Others are shared. */
     readonly globals?: readonly string[];
+    /**
+     * Shared collections and globals (not listed above) that the people of a tenant, its admins
+     * included, may change. A change applies to every tenant. Default: none; only users with
+     * access to all tenants change shared data.
+     */
+    readonly editShared?: readonly string[];
     /** Slug of the tenants collection. Default `tenants`. */
-    readonly tenantsSlug?: T;
+    readonly slugs?: {
+        readonly tenants?: T;
+    };
     /**
      * Users who see and manage every tenant and the whole system. Default: users whose own role
      * is `admin`.
@@ -123,24 +131,25 @@ type MultiTenantPluginTypes<S extends string, T extends string = 'tenants'> = {
  * and globals with a value per tenant. Requests name their tenant with a header, `?tenant=`,
  * the admin's cookie or the domain.
  */
-declare function multiTenantPlugin<const S extends string, const T extends string = 'tenants'>(options: MultiTenantOptions<S, T>): TypedPlugin<MultiTenantPluginTypes<S, T>>;
+declare function multiTenantPlugin<const S extends string, const T extends string = 'tenants'>(options: MultiTenantPluginOptions<S, T>): TypedPlugin<MultiTenantPluginTypes<S, T>>;
 
+/** A tenant by its slug or one of its domains. */
+interface TenantLookup {
+    readonly slug?: string;
+    readonly host?: string;
+    /** Slug of the tenants collection, when the plugin's `slugs.tenants` changed it. */
+    readonly collection?: string;
+}
 /**
  * The tenant of a page of your site, by slug or by domain (`domains` of the tenant), e.g. from
  * the request's host. `null` when none matches.
  */
-declare function findTenantFor(cms: EasyCMS, by: {
-    readonly slug?: string;
-    readonly host?: string;
-}, tenantsSlug?: string): Promise<TenantRef | null>;
+declare function findTenantFor(cms: EasyCMS, by: TenantLookup): Promise<TenantRef | null>;
 /**
  * The `context` for Local API calls that read one tenant's content, e.g.
  * `cms.find('posts', { overrideAccess: false, user: null, context: await tenantContext(cms, { host }) })`.
  * A tenant that doesn't exist gives a context that finds nothing.
  */
-declare function tenantContext(cms: EasyCMS, by: {
-    readonly slug?: string;
-    readonly host?: string;
-}, tenantsSlug?: string): Promise<RequestContext>;
+declare function tenantContext(cms: EasyCMS, by: TenantLookup): Promise<RequestContext>;
 
-export { ALL, type Member, type Membership, type MultiTenantOptions, type MultiTenantPluginTypes, type TenantContext, type TenantRef, findTenantFor, multiTenantPlugin, tenantContext, tenantOf };
+export { ALL, type Member, type Membership, type MultiTenantPluginOptions, type MultiTenantPluginTypes, type TenantContext, type TenantLookup, type TenantRef, findTenantFor, multiTenantPlugin, tenantContext, tenantOf };

package/dist/index.js

@@ -52,16 +52,17 @@ var tenantOfHost = (list, host) => {
 // src/plugin.ts
 import {
   definePlugin,
-  isLoggedIn,
-  MEDIA,
-  MEDIA_FOLDERS,
+  isStaff,
   ValidationError as ValidationError2
 } from "@easy-cms/core";
+import { checkRenamedOptions, MEDIA, MEDIA_FOLDERS } from "@easy-cms/core/internal";
 
 // src/info.ts
 var INFO = {
   name: "@easy-cms/plugin-multi-tenant",
-  ...true ? { version: "0.47.4" } : {}
+  // The plugin API it is written for (`PLUGIN_API_VERSION` of @easy-cms/core).
+  apiVersion: 1,
+  ...true ? { version: "0.49.0" } : {}
 };
 
 // src/members.ts
@@ -234,8 +235,8 @@ function membersEndpoints(options) {
 
 // src/plugin.ts
 var BUILTIN_ACCESS = {
-  [MEDIA]: { read: () => true, create: isLoggedIn, update: isLoggedIn, delete: isLoggedIn },
-  [MEDIA_FOLDERS]: { read: isLoggedIn, create: isLoggedIn, update: isLoggedIn, delete: isLoggedIn }
+  [MEDIA]: { read: () => true, create: isStaff, update: isStaff, delete: isStaff },
+  [MEDIA_FOLDERS]: { read: isStaff, create: isStaff, update: isStaff, delete: isStaff }
 };
 function readCookie(header, name) {
   for (const part of header?.split(";") ?? []) {
@@ -246,8 +247,9 @@ function readCookie(header, name) {
   return void 0;
 }
 function multiTenantPlugin(options) {
+  checkRenamedOptions("multiTenantPlugin", options, { tenantsSlug: "slugs.tenants" });
   return definePlugin((config) => {
-    const tenantsSlug = options.tenantsSlug ?? "tenants";
+    const tenantsSlug = options.slugs?.tenants ?? "tenants";
     const header = (options.header ?? "x-easy-cms-tenant").toLowerCase();
     const cookie = options.cookie ?? "ecms-tenant";
     const publicReads = options.publicReads ?? "none";
@@ -274,6 +276,8 @@ function multiTenantPlugin(options) {
       );
     const superUser = (user, _context) => !!user && user.member !== true && user.scoped !== true && isSuper(user);
     const everywhere = (user, context) => tenantOf(context).allTenants || superUser(user, context);
+    const editShared = new Set(options.editShared ?? []);
+    const sharedWrite = (slug, original) => async (args) => args.user?.scoped === true && !editShared.has(slug) ? false : (original ?? isStaff)(args);
     const tenantFilter = (args, op) => {
       const { tenant } = tenantOf(args.context);
       if (op === "create") return tenant !== null || superUser(args.user, args.context);
@@ -282,7 +286,7 @@ function multiTenantPlugin(options) {
       return superUser(args.user, args.context);
     };
     const narrow = (original, op) => async (args) => {
-      const base = await (original ?? isLoggedIn)(args);
+      const base = await (original ?? isStaff)(args);
       if (base === false) return false;
       const filter = tenantFilter(args, op);
       if (filter === false) return false;
@@ -317,13 +321,13 @@ function multiTenantPlugin(options) {
       type: "relationship",
       to: tenantsSlug,
       index: true,
-      position: "sidebar",
       label: { en: "Tenant", th: "Tenant" },
       // Set from the tenant the request works in; only users with access to all tenants choose.
       access: { update: ({ user, context }) => superUser(user, context) },
       admin: {
+        position: "sidebar",
         // New documents start in the chosen tenant.
-        defaultValue: ({ context }) => tenantOf(context).tenant ?? void 0,
+        initialValue: ({ context }) => tenantOf(context).tenant ?? void 0,
         // A column while every tenant is shown.
         column: ({ user, context }) => superUser(user, context) && tenantOf(context).tenant === null,
         allowCreate: false
@@ -346,7 +350,7 @@ function multiTenantPlugin(options) {
       }
       return data;
     };
-    const checkTenant = (slug) => ({ data, operation, originalDoc, context, user }) => {
+    const checkTenant = (slug) => ({ data, operation, previousDoc, context, user }) => {
       const value = data[TENANT_FIELD] ?? null;
       const { tenant } = tenantOf(context);
       if (!user && tenant === null) return data;
@@ -356,7 +360,7 @@ function multiTenantPlugin(options) {
       if (value === null) fail("is required: choose a tenant");
       if (superUser(user, context)) return data;
       if (!sameId(value, tenant)) fail("must be the tenant you work in");
-      const before = originalDoc?.[TENANT_FIELD] ?? null;
+      const before = previousDoc?.[TENANT_FIELD] ?? null;
       if (operation === "update" && before !== null && !sameId(before, value))
         fail("can't move to another tenant");
       return data;
@@ -449,9 +453,9 @@ function multiTenantPlugin(options) {
     const tenantsCollection = {
       slug: tenantsSlug,
       labels: { singular: { en: "Tenant", th: "Tenant" }, plural: { en: "Tenants", th: "Tenant" } },
-      icon: "building",
       useAsTitle: "name",
       admin: {
+        icon: "building",
         group: "settings.people",
         // Deleting a tenant deletes its content: its name is typed, and what goes is shown.
         confirmDelete: { typeTitle: true, impact: "/tenant-impact" }
@@ -516,7 +520,17 @@ function multiTenantPlugin(options) {
           access: { ...c.access, ...usersAccess(c.access) }
         });
       } else if (scoped.has(c.slug)) collections.push(scopeCollection(c, BUILTIN_ACCESS[c.slug]));
-      else collections.push({ ...c, fields: withTenantFilters(c.fields) });
+      else
+        collections.push({
+          ...c,
+          fields: withTenantFilters(c.fields),
+          access: {
+            ...c.access,
+            create: sharedWrite(c.slug, c.access?.create),
+            update: sharedWrite(c.slug, c.access?.update),
+            delete: sharedWrite(c.slug, c.access?.delete)
+          }
+        });
     }
     if (!hasUsers) collections.push({ slug: "users", fields: [memberships], access: usersAccess() });
     for (const builtin of [MEDIA, MEDIA_FOLDERS]) {
@@ -534,7 +548,11 @@ function multiTenantPlugin(options) {
     }
     const globals = (config.globals ?? []).map((g) => {
       const filtered = { ...g, fields: withTenantFilters(g.fields) };
-      if (!perTenant.has(g.slug)) return filtered;
+      if (!perTenant.has(g.slug))
+        return {
+          ...filtered,
+          access: { ...g.access, update: sharedWrite(g.slug, g.access?.update) }
+        };
       return {
         ...filtered,
         // One value per tenant; none when the request has no tenant.
@@ -546,9 +564,7 @@ function multiTenantPlugin(options) {
     });
     const previous = config.onRequest;
     const onRequest = async (args) => {
-      const before = previous ? await previous(args) : void 0;
-      const user = before?.user !== void 0 ? before.user : args.user;
-      const context = { ...before?.context };
+      const user = args.user;
       const list = await tenantList(args.cms, tenantsSlug);
       const asked = args.headers.get(header) ?? args.url?.searchParams.get("tenant") ?? readCookie(args.headers.get("cookie"), cookie) ?? null;
       const byHost = tenantOfHost(
@@ -559,7 +575,7 @@ function multiTenantPlugin(options) {
       const boundTenant = bound ? tenantOf(bound) : void 0;
       if (user && user.member !== true && isSuper(user) && (!boundTenant || boundTenant.tenant === null)) {
         const chosen2 = asked === ALL ? void 0 : findTenant(list, asked);
-        return { user, context: { ...context, tenant: chosen2?.id ?? null, allTenants: true } };
+        return { user, context: { tenant: chosen2?.id ?? null, allTenants: true } };
       }
       if (user && user.member !== true) {
         const mine = membershipsOf(user);
@@ -567,14 +583,13 @@ function multiTenantPlugin(options) {
         const membership = boundTenant && boundTenant.tenant !== null ? mine.find((m) => sameId(m.tenant, boundTenant.tenant)) ?? (isSuper(user) ? { tenant: boundTenant.tenant, role: user.role } : void 0) : member(findTenant(list, asked)) ?? member(byHost) ?? mine.find((m) => list.some((t) => sameId(t.id, m.tenant)));
         return {
           user: { ...user, role: membership?.role ?? user.role, scoped: true },
-          context: { ...context, tenant: membership?.tenant ?? null, allTenants: false }
+          context: { tenant: membership?.tenant ?? null, allTenants: false }
         };
       }
       const chosen = asked && asked !== ALL ? findTenant(list, asked) : byHost;
       return {
         user,
         context: {
-          ...context,
           tenant: chosen?.id ?? null,
           allTenants: !chosen && publicReads === "all"
         }
@@ -691,19 +706,19 @@ of its own. Run it once after adding the plugin to a site that has content.
       ...config,
       collections,
       globals,
-      onRequest,
+      onRequest: [...typeof previous === "function" ? [previous] : previous ?? [], onRequest],
       endpoints: [
         ...config.endpoints ?? [],
         optionsEndpoint,
         impactEndpoint,
         ...membersEndpoints({ tenantsSlug, superUser, isSuper })
       ],
-      commands: [...config.commands ?? [], assign],
+      cliCommands: [...config.cliCommands ?? [], assign],
       // Audit log entries belong to their tenant: its admins see them.
       ...config.audit ? {
         audit: {
           ...config.audit === true ? {} : config.audit,
-          scope: (context) => {
+          scope: ({ context }) => {
             const { tenant } = tenantOf(context);
             return tenant === null ? null : String(tenant);
           }
@@ -762,12 +777,12 @@ async function removeTenant(cms, id, collections) {
 }
 
 // src/index.ts
-async function findTenantFor(cms, by, tenantsSlug = "tenants") {
-  const list = await tenantList(cms, tenantsSlug);
+async function findTenantFor(cms, by) {
+  const list = await tenantList(cms, by.collection ?? "tenants");
   return (by.slug ? findTenant(list, by.slug) : void 0) ?? tenantOfHost(list, by.host) ?? null;
 }
-async function tenantContext(cms, by, tenantsSlug = "tenants") {
-  const tenant = await findTenantFor(cms, by, tenantsSlug);
+async function tenantContext(cms, by) {
+  const tenant = await findTenantFor(cms, by);
   return { tenant: tenant?.id ?? null, allTenants: false };
 }
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/plugin-multi-tenant",
-  "version": "0.47.4",
+  "version": "0.49.0",
   "description": "Multi-tenant Easy CMS: several sites or clients in one CMS, each with its own content, members and roles",
   "license": "MIT",
   "type": "module",
@@ -17,14 +17,14 @@
     "dist"
   ],
   "peerDependencies": {
-    "@easy-cms/core": "^0.47.4"
+    "@easy-cms/core": "^0.49.0"
   },
   "devDependencies": {
-    "@easy-cms/core": "^0.47.4",
-    "@easy-cms/db-sqlite": "^0.47.4",
-    "@easy-cms/plugin-form-builder": "^0.47.4",
-    "@easy-cms/plugin-nested-docs": "^0.47.4",
-    "@easy-cms/plugin-redirects": "^0.47.4"
+    "@easy-cms/core": "^0.49.0",
+    "@easy-cms/db-sqlite": "^0.49.0",
+    "@easy-cms/plugin-form-builder": "^0.49.0",
+    "@easy-cms/plugin-nested-docs": "^0.49.0",
+    "@easy-cms/plugin-redirects": "^0.49.0"
   },
   "engines": {
     "node": ">=22.12"