@jwilleke/ngdpbase-types 5.42.0 → 5.44.0

package/lib/src/security/PolicyDecisionPoint.d.ts

@@ -28,8 +28,11 @@ import type { WikiEngine } from '../types/WikiEngine.js';
 import type { Decision, DecisionRequest, Policy } from '../types/Policy.js';
 import { type RoleGrant } from '../utils/roleGrants.js';
 import { type ActorContext } from '../context/ActorContext.js';
+import { type OwnedListAsk, type OwnedListDecision, type OwnedRecordAsk } from './ownedRecords.js';
 export declare const POLICIES_KEY = "ngdpbase.access.policies";
 export declare const POLICIES_ENABLED_KEY = "ngdpbase.access.policies.enabled";
+/** Whether an administrator may enter another person's unencrypted vault (#2255). */
+export declare const VAULTS_ADMIN_ACCESS_KEY = "ngdpbase.vaults.admin-access";
 /**
  * What `decide`, `permits` and `holds` take (#2022): the caller's own context
  * — a request's `PermissionSubject` or a job's `JobContext` — or a subject
@@ -48,7 +51,8 @@ export declare class PolicyDecisionPoint extends BaseManager {
     /** Warn, once per policy and name, that a policy names a retired permission and what it is read as (#2038). */
     private warnRetiredOnce;
     /**
-     * The policies in force right now, highest priority first.
+     * The policies in force right now, in configuration order. Order carries no
+     * meaning: the rule-combining algorithm is `deny-overrides` (#2330).
      *
      * - `ngdpbase.access.policies.enabled` false — its default when unset —
      *   means none;
@@ -71,8 +75,8 @@ export declare class PolicyDecisionPoint extends BaseManager {
      * What each role permits: role name → the actions its holders are granted.
      *
      * It mirrors the evaluator's ROLE matching — an allow policy naming a role
-     * grants its actions, a deny policy naming it takes them away, lower
-     * priority first so a higher-priority deny lands last and wins. It does not
+     * grants its actions, a deny policy naming it takes them away, whatever the
+     * order (deny-overrides, #2330). It does not
      * evaluate resource patterns or the ceilings, so it is a summary for a human
      * reading a table (the admin Security Policy Summary, a profile), never an
      * authorisation answer — that is {@link permits} with the caller's subject.
@@ -256,7 +260,20 @@ export declare class PolicyDecisionPoint extends BaseManager {
      * own sign-in, once policy has said yes.
      */
     private proxyCeiling;
-    /** Does the named actor HOLD `action` (policy alone, live)? Step-up is the proxy subject's question, not theirs. */
+    /**
+     * Does the named actor HOLD the action (policy alone, live)? Step-up is the
+     * proxy subject's question, not theirs. Asked about the same page when the
+     * request names one (#2255), so an actor who may edit only some categories
+     * is asked about this page's.
+     *
+     * Inside a vault or a shared folder the actor is asked the bare capability,
+     * as before #2255 (#2267): the `vault` and `shared-folder` matchers assume
+     * the container rule proved the subject may be there, and for the actor it
+     * did not — the person represented passed it. Asked with the container, a
+     * reader actor would hold everything `vault-owner` holds in someone else's
+     * vault. The door (`permitsInVault`), the page door and the list filter all
+     * come through here, so they agree.
+     */
     private actorHolds;
     /**
      * Decide. The order is load-bearing:
@@ -277,5 +294,91 @@ export declare class PolicyDecisionPoint extends BaseManager {
     decide(subject: DecisionInput, request: DecisionRequest): Promise<Decision>;
     /** `decide`, with the step-up rule applied or not — {@link holds} is the only caller that leaves it out. */
     private evaluate;
+    /**
+     * The first declared system category on which the policies permit a page
+     * write (#2255, decision 10), or null. Asked once per category, so a deny
+     * on one still wins there. Owner conditions are unknown here (no page), so
+     * a grant that needs the author does not count. Only enabled categories
+     * that are not bound to a location count (#2268): `shared` is a shared
+     * folder's, decided with the folder, and every account holds `vault-owner`,
+     * so counting it would give a reader every page write as a capability.
+     */
+    private onSomeCategory;
+    /**
+     * Every system category the catalogue declares, core and add-ons, enabled
+     * or not, lowercased; with `inUse`, only those enabled and not bound to a
+     * shared folder (`storageLocation.sharedfolder`).
+     */
+    private declaredCategories;
+    /**
+     * May an administrator enter `owner`'s vault (#2255,
+     * `ngdpbase.vaults.admin-access`)? Asked only after the container rule has
+     * refused someone who is not the owner. Yes when all hold:
+     *
+     * - the key is true, read now, on every request (shipped true);
+     * - the caller is a signed-in session or a job, not a share link, a proxy
+     *   or an agent token;
+     * - the caller holds `admin-system`;
+     * - the vault is not encrypted: an encrypted vault always needs its key,
+     *   whatever the key says, so it is not entered at all.
+     *
+     * `record` true (a door) writes `vault-admin-access` with the administrator
+     * as the actor and the owner, vault and page named; an affordance passes
+     * false and records nothing. Lists and search never ask this, so an
+     * administrator does not see other people's vault pages listed.
+     */
+    adminMayEnterVault(ctx: ActorContext | null | undefined, owner: string, vault: string, resource: string, record?: boolean): Promise<boolean>;
+    /**
+     * The declared system categories on which an allow policy grants `action`
+     * through the `system-category` resource type (#2255). The sitemap asks it
+     * with `pushed-pages-edit` to leave pushed pages out. A summary of the
+     * policies, never an answer to "may this subject".
+     */
+    /**
+     * May this subject act on one stored add-on record (#1823)?
+     *
+     * The manager passes attributes it read from the row. `owner` is the
+     * identity @id. A type that declares `owner` is allowed only when that @id
+     * is the subject's (the person a proxy grant represents, not the actor),
+     * and policy also allows the action. A role does not bypass the owner. A
+     * type with no `owner` is policy alone. A core type (`page`, `vault`, …)
+     * is not decided here. Missing data throws {@link OwnedRecordError}; the
+     * caller fails closed. This records nothing.
+     */
+    decideOwnedRecord(input: DecisionInput, request: OwnedRecordAsk): Promise<Decision>;
+    /**
+     * May this subject list a type, and which rows (#1823)?
+     *
+     * An allow for a type that declares `owner` carries one filter, `owner`
+     * equals the subject's identity @id. The manager binds that value; it is
+     * not SQL. An allow for a type with no owner carries an empty filter: policy
+     * alone, no row constraint. A refusal is `{ decision: 'deny' }`, never an
+     * empty filter and never an empty row set from this method. Missing data
+     * throws {@link OwnedRecordError}. This records nothing: the list is logged
+     * once by the manager that applies it.
+     */
+    decideOwnedList(input: DecisionInput, request: OwnedListAsk): Promise<OwnedListDecision>;
+    /**
+     * The ceilings, the declared type, and a reader for conditions. A ceiling
+     * denial is the whole answer. Anything that cannot be decided throws.
+     */
+    private prepareOwned;
+    private ownedTypeEntry;
+    private typeDeclaresOwner;
+    /** The owner the manager read. Missing on an owner-typed record cannot be decided. */
+    private storedOwner;
+    private ownerMismatch;
+    /** The subject's identity @id, or a denial when nobody is signed in. A signed-in subject with no identity cannot be decided. */
+    private subjectOwnerId;
+    private ownedUserContext;
+    /**
+     * Condition values (#1823). A `resource:` attribute is the value the manager
+     * read from the stored row, never a request field. Subject and environment
+     * attributes come from the PIP.
+     */
+    private ownedReader;
+    private ownedTypeResult;
+    private decisionFrom;
+    categoriesGranting(action: string): string[];
 }
 export default PolicyDecisionPoint;

package/lib/src/security/PolicyInformationPoint.d.ts

@@ -1,4 +1,5 @@
 import BaseManager from '../managers/BaseManager.js';
+import { type AalFacts } from '../utils/policyAttributes.js';
 import { type ActorContext } from '../context/ActorContext.js';
 import { WikiEngine } from '../types/WikiEngine.js';
 import type { AgentTokenGrant, ProxyClaim } from '../managers/UserManager.js';
@@ -52,6 +53,10 @@ interface UserContext {
  * form. They convert it themselves, through {@link asSubject}.
  */
 type PageQuestionCaller = ActorContext | UserContext | null | undefined;
+/** What a subject attribute is read from (#2261): who, and what bears on `subject:aal`. */
+export type SubjectFacts = AalFacts & {
+    username?: string;
+};
 /**
  * Access decision log entry
  */
@@ -61,8 +66,24 @@ interface AccessDecisionLog {
     action?: string;
     allowed?: boolean;
     reason?: string;
+    /** The policies that decided (#2255), recorded on a denial. */
+    policyIds?: string[];
+    /** Allows that matched but whose condition was not met (#2288), recorded on a denial. */
+    conditionNotMet?: string[];
     context?: Record<string, unknown>;
 }
+/**
+ * What the policies may read about a page (#2255), resolved by the PIP from
+ * the page itself. `attributes` holds what a resource type matches on
+ * (`system-category`), read eagerly; `read` answers a condition's
+ * `resource:<name>` for an attribute declared on the `page` resource type,
+ * lazily, so a lookup (the owner's account) is made only when a policy needs
+ * it. `undefined` is a missing attribute.
+ */
+export interface PageAttributes {
+    attributes: Record<string, unknown>;
+    read(name: string): unknown;
+}
 /**
  * PolicyInformationPoint — what a page decision needs to know about the page
  * (#1431; was ACLManager until step 8).
@@ -117,6 +138,7 @@ interface AccessDecisionLog {
  * if (await pip.checkPagePermissionWithContext(wikiContext, 'edit')) { ... }
  */
 declare class PolicyInformationPoint extends BaseManager {
+    private readonly clock;
     /** Read at the moment of use: this manager starts before PolicyEvaluator (#1431 step 13). */
     private get policyEvaluator();
     /**
@@ -124,8 +146,9 @@ declare class PolicyInformationPoint extends BaseManager {
      *
      * @constructor
      * @param {WikiEngine} engine - The wiki engine instance
+     * @param {() => Date} [clock] - The time `environment:` attributes are read at; injectable for tests
      */
-    constructor(engine: WikiEngine);
+    constructor(engine: WikiEngine, clock?: () => Date);
     /**
      * Initializes the PolicyInformationPoint by loading policies and configurations
      *
@@ -353,10 +376,12 @@ declare class PolicyInformationPoint extends BaseManager {
      *   Tier 1 is skipped for a vault page: `audience` grants nothing there.
      * - __Tier 0.5, author-lock__, `edit` only. It only denies: an author, or a
      *   subject holding `admin-system` (#1431 7b), falls through to Tier 1+.
-     * - __Tier 1, frontmatter__ `access[action]` / `audience`. Page-level, and
-     *   overrides global policy when it states a rule (#1054). An `audience`
-     *   covers every action, and a subject holding `admin-system` is its one
-     *   exception; `access` has none (#1964).
+     * - __Tier 1, frontmatter__ `audience`. Page-level, and decides a view
+     *   when it states a rule (#1054). An `audience` covers every action, and a
+     *   subject holding `admin-system` is its one exception (#1964). `access`
+     *   is no longer read (#2255).
+     * - A page in a shared folder is decided by the folder's permission, and a
+     *   change also by the `shared` category's policy and author-lock (#2255).
      * - __Tier 2.__ For a share visitor the share IS the policy (#1222); for
      *   anyone else, global policy.
      * - __Default deny.__ Nothing below Tier 2 grants — JSPWiki's page-body ACL
@@ -477,14 +502,82 @@ declare class PolicyInformationPoint extends BaseManager {
      */
     canUserAccessMediaItem(caller: PageQuestionCaller, item: MediaItem): Promise<boolean>;
     /**
-     * Check front matter audience / access fields (Tier 1).
+     * Check the front matter audience (Tier 1).
      * Returns a decision object; decided=false means no front matter restriction — fall through.
      *
      * An audience that leaves the subject out refuses every action, unless the
      * subject holds `admin-system` (#1964, operator 2026-10-23): asked only
-     * then. `access[action]` has no such exception.
+     * then. `access` is no longer read (#2255).
      */
     private checkFrontmatterAccess;
+    /**
+     * A page's attributes for the policies (#2255, XACML's PIP): the PDP asks
+     * this from the page id, so no route passes them. `knownMetadata` is the
+     * frontmatter when this PIP already holds it (the page door); otherwise the
+     * page is read with the caller's own context, so a sealed page stays closed
+     * to anyone without its key (#1422). A page that cannot be read has no
+     * attributes: no category policy matches it and every condition on it is
+     * unknown.
+     */
+    pageAttributes(caller: PageQuestionCaller, pageName: string, knownMetadata?: Record<string, unknown> | null): Promise<PageAttributes>;
+    /**
+     * {@link pageAttributes} from frontmatter already in hand (the list
+     * filter). Attributes are those declared on the `page` resource type in
+     * `ngdpbase.access.resource-types`, each read from its `from` source; the
+     * sources are code (`frontmatter:<field>` today).
+     *
+     * - `system-category` is lowercased; a page with none is in the default
+     *   category (the entry with `default: true`); a page in a shared folder is
+     *   `shared`, whatever its frontmatter says (#2255).
+     * - An `identity` attribute (`owner`, from `author`) is compared by the
+     *   account it names: an @id or a username not yet converted both read as
+     *   that account's username, an orphan as missing (#2097).
+     */
+    pageAttributesFrom(pageName: string, metadata: PageFrontmatter | null | undefined): PageAttributes;
+    /**
+     * A subject attribute a condition reads (#2255, #2261): `subject:<name>`,
+     * declared in `ngdpbase.access.subject-attributes` (`id` always is) and read
+     * from its `from` source here, the only place a subject attribute is read. A
+     * request cannot send one. Missing when it is not declared, cannot be read, or
+     * the subject has none (`subject:aal` of a visitor who is not signed in, of a
+     * token made before it was stored); the evaluator then fails closed. Returns
+     * the value, or a Promise of it for a field read from the account (the
+     * evaluator awaits every read).
+     */
+    subjectAttribute(subject: SubjectFacts | null | undefined, name: string): unknown;
+    /**
+     * An environment attribute a condition reads (#2261): `environment:<name>`,
+     * declared in `ngdpbase.access.environment-attributes` and read from its
+     * `from` source here, the only place one is read. `schedule:<name>` is whether
+     * that schedule in `ngdpbase.schedules` is open at `now`; `config:<key>` is
+     * the boolean stored at that configuration key, any key, secrets included.
+     * Missing when it is not declared, the schedule is absent, the stored value is
+     * not a boolean, or the read fails; the evaluator then fails closed. The value
+     * is returned to the evaluator and goes nowhere else: it is never logged.
+     */
+    environmentAttribute(name: string, now?: Date): boolean | undefined;
+    /**
+     * A reader of environment attributes for one decision or one listing
+     * (#2261): the clock is read once, on the first attribute asked for, and
+     * each attribute once, so every policy and every page sees one instant.
+     */
+    environmentReader(): (name: string) => unknown;
+    /** One read of a declared subject attribute from its source. A value of the wrong type, or a source that throws, is missing. */
+    private readSubjectSource;
+    /** The page's category for the policies (#2255): lowercased; the default when it has none; `shared` in a shared folder. */
+    private pageCategory;
+    /** The attributes declared on the `page` resource type (#2255). */
+    private declaredPageAttributes;
+    /** An identity reference as the policies compare it: the username of the account it names, or missing (#2097). */
+    private identityValue;
+    /** Pages already warned about for an `access:` that is not the legacy stamp (#2255): once per page per process. */
+    private readonly warnedAccess;
+    /**
+     * `access:` frontmatter no longer has any effect (#2255). The stamp install
+     * wrote (`{ edit: [admin] }`) is left alone silently; any other value is
+     * someone's rule that is now ignored, so it is said once per page.
+     */
+    private warnLegacyAccess;
     /**
      * Does the page's `audience` admit this subject (#1964)? True when the page
      * names no audience, the subject matches it, or the subject holds
@@ -501,6 +594,19 @@ declare class PolicyInformationPoint extends BaseManager {
      * Accepts either a single object or positional args for backward compatibility.
      */
     logAccessDecision(userOrObj: UserContext | AccessDecisionLog, pageName?: string, action?: string, allowed?: boolean, reason?: string, _context?: Record<string, unknown>): void;
+    /**
+     * Record a page write a door refused on a capability alone (#2272): the
+     * route's `page-edit` / `page-create` check asks the PDP, which records
+     * nothing. Same record as every other page denial, `policyIds` included.
+     */
+    recordPageRefusal(subject: UserContext | null | undefined, pageName: string, action: string, reason: string, policyIds?: readonly string[], conditionNotMet?: readonly string[]): Promise<void>;
+    /**
+     * Record a write the signed-out write gate refused before any route ran
+     * (#2298). The resource is the route as asked (`POST /save/Home`): method
+     * and path, never the query or the body, which can carry a password or a
+     * token. Standard tier and best-effort, like every other denial.
+     */
+    recordRouteRefusal(subject: UserContext | null | undefined, route: string): Promise<void>;
     /** The name a decision is recorded under: the subject's, or `anonymous`. */
     private static recordedUser;
     /**

package/lib/src/security/ownedRecords.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Add-on record decisions (#1823).
+ *
+ * The add-on's manager is the enforcement point. It reads `owner` from the
+ * stored row and asks {@link PolicyDecisionPoint.decideOwnedRecord} or
+ * {@link PolicyDecisionPoint.decideOwnedList}. The answer is never null.
+ * A type that declares `owner` (an identity @id) is refused to anyone but
+ * that owner: under a proxy grant the subject is the person represented, so
+ * the delegate is allowed and a role is not. A type with no `owner` is
+ * decided by policy alone. A list that is refused is a denial, not an empty
+ * page of rows.
+ */
+/** The PDP cannot decide. The caller fails closed; this is not a deny. */
+export declare class OwnedRecordError extends Error {
+    constructor(message: string);
+}
+/** One record, with the attributes the manager read from its stored row. */
+export interface OwnedRecordAsk {
+    action: string;
+    resource: {
+        type: string;
+        id: string;
+        /** From the stored row. `owner`, when the type declares it, is the identity @id. */
+        attributes?: Record<string, unknown>;
+    };
+}
+/** A list of one type. There is no owner argument: the filter comes from the subject. */
+export interface OwnedListAsk {
+    action: string;
+    resource: {
+        type: string;
+    };
+}
+/**
+ * A constraint the manager turns into a bound parameter. Never SQL.
+ * `equals` means the column must equal the one value.
+ */
+export interface OwnedRecordFilter {
+    attribute: string;
+    operator: 'equals';
+    values: readonly string[];
+}
+/**
+ * The resource a refusal is audited against (#1823). `owner` is the identity
+ * @id from the stored row, `ownerUser` that person's username. Both come from
+ * storage, never from the request body.
+ */
+export interface OwnedAuditResource {
+    type: string;
+    id?: string;
+    owner?: string;
+    ownerUser?: string;
+}
+/** An explicit list answer (#1823). `filter` is empty only when the type has no owner. */
+export type OwnedListDecision = {
+    decision: 'allow';
+    filter: readonly OwnedRecordFilter[];
+} | {
+    decision: 'deny';
+    reason: string;
+    policyIds: readonly string[];
+};
+/**
+ * What is wrong with a resource type's `owner` declaration, or null (#1823).
+ * `owner`, when present at all, must be exactly `{ "type": "identity" }`.
+ * Anything else, `null` included, would quietly make an owner type
+ * policy-alone, so the decision throws and start-up refuses the config.
+ */
+export declare function ownerDeclarationProblem(type: string, entry: unknown): string | null;

package/lib/src/security/permissions.generated.d.ts

@@ -30,6 +30,8 @@ export type CorePermission =
  | 'identity-read'
 /** Browse and view the media library (not delegated to anonymous visitors) */
  | 'media-read'
+/** Set or change a page's system-category (#2255). A page created in a shared folder gets the shared category without it */
+ | 'page-categorize'
 /** Create new pages */
  | 'page-create'
 /** Delete pages */
@@ -50,6 +52,12 @@ export type CorePermission =
  | 'profile-manage'
 /** Let another person act for you, within permissions you hold, and revoke it (#1762). Every signed-in role except demo-admin; an administrator making or revoking a grant for someone else also needs user-edit, and that grant never carries a copy of the person's vault key. A grant that includes proxy-grant lets the proxy give others access too. Asks for a fresh sign-in */
  | 'proxy-grant'
+/** Delete pushed pages (#2255) */
+ | 'pushed-pages-delete'
+/** Edit pushed pages: pages shipped by the system or an add-on (the categories a policy grants it on; system, documentation and addon as shipped) (#2255) */
+ | 'pushed-pages-edit'
+/** Rename pushed pages (#2255) */
+ | 'pushed-pages-rename'
 /** Search pages */
  | 'search-page'
 /** Search users */

package/lib/src/security/signedOutWrites.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The signed-out write list (#2298): the one place that names which routes may
+ * be written to by someone who is not signed in.
+ *
+ * Every request from a caller who is not signed in, other than GET, HEAD and
+ * OPTIONS, is refused by `signedOutWriteGate` (src/middleware/signedOutWriteGate.ts),
+ * before any route runs, unless the route is on this list. A new write route
+ * is therefore closed to signed-out callers until someone adds it here with a
+ * reason, which is the point (#2294 came from routes that were open until
+ * their author remembered to close them).
+ *
+ * What belongs here: a route a person reaches BEFORE they are signed in (the
+ * steps of signing in, registering, recovering a password, accepting an
+ * invitation), a link followed from an email in any browser, and a public form.
+ * What does not: anything that asks for a permission a signed-out caller
+ * never holds. A route that answers its own token (a Bearer token, which the
+ * gate counts as signed in) needs no entry.
+ *
+ * Core's routes are listed below. An add-on lists its own through the add-on
+ * host, `host.allowSignedOutWrite(...)`, which accepts only a route under the
+ * add-on's own `/api/<slug>/` or `/addons/<slug>/`, and refuses a slug that
+ * names one of core's own `/api/` or `/addons/` prefixes. Those are the only
+ * ways onto the list, and it is sealed once the add-ons have loaded; outside
+ * tests (`NODE_ENV=test`) the seal cannot be undone.
+ *
+ * Permission to write is still asked by each route, as always: an entry only
+ * lets the request reach the route, it grants nothing.
+ */
+export type WriteMethod = 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+export interface SignedOutWriteRoute {
+    method: WriteMethod;
+    /** An Express path: literal segments and `:name` parameters only. */
+    path: string;
+    /** Why a caller who is not signed in must reach it. Required. */
+    reason: string;
+}
+/** Whether the method may change things, and so is held by the gate: anything but GET, HEAD and OPTIONS. */
+export declare function isWriteMethod(method: string): boolean;
+/**
+ * Slugs an add-on may not use to list a route, because core already answers
+ * under `/api/<slug>/` or `/addons/<slug>/`: an add-on in a directory named
+ * `admin` must not open `/api/admin/...`. Kept in step with core's route
+ * files; `signedOutWriteGate.test.ts` checks it against the route inventory.
+ */
+export declare const RESERVED_ADDON_SLUGS: ReadonlySet<string>;
+/**
+ * Core's list. Each reason says why the route cannot wait for a sign-in.
+ * Routes that need a signed-in session by their nature (consent, the
+ * account-setup password, the second-factor enrolment, reauthentication) are
+ * not here: their callers are signed in when they reach them.
+ */
+export declare const CORE_SIGNED_OUT_WRITES: readonly SignedOutWriteRoute[];
+/**
+ * An add-on's declaration of a route a signed-out caller may write to.
+ * Called through `AddonHost.allowSignedOutWrite`, bound to the add-on's slug.
+ * Throws on anything outside the add-on's own paths, so one add-on can never
+ * open another's, or core's.
+ */
+export declare function declareAddonSignedOutWrite(slug: string, route: SignedOutWriteRoute): void;
+/** Close the list to add-ons. Called once, after they have loaded. */
+export declare function sealSignedOutWrites(): void;
+/** Test support: forget add-on declarations and reopen the list. Refuses outside `NODE_ENV=test`, so a sealed list stays sealed. */
+export declare function resetSignedOutWrites(): void;
+/** Every route on the list, core's then the add-ons'. */
+export declare function signedOutWriteRoutes(): Array<SignedOutWriteRoute & {
+    owner: string;
+}>;
+/** The reason the route is on the list, or null when a signed-out caller may not write to it. */
+export declare function signedOutWriteReason(method: string, path: string): string | null;

package/lib/src/security/signedOutWrites.js

@@ -0,0 +1,146 @@
+/**
+ * The signed-out write list (#2298): the one place that names which routes may
+ * be written to by someone who is not signed in.
+ *
+ * Every request from a caller who is not signed in, other than GET, HEAD and
+ * OPTIONS, is refused by `signedOutWriteGate` (src/middleware/signedOutWriteGate.ts),
+ * before any route runs, unless the route is on this list. A new write route
+ * is therefore closed to signed-out callers until someone adds it here with a
+ * reason, which is the point (#2294 came from routes that were open until
+ * their author remembered to close them).
+ *
+ * What belongs here: a route a person reaches BEFORE they are signed in (the
+ * steps of signing in, registering, recovering a password, accepting an
+ * invitation), a link followed from an email in any browser, and a public form.
+ * What does not: anything that asks for a permission a signed-out caller
+ * never holds. A route that answers its own token (a Bearer token, which the
+ * gate counts as signed in) needs no entry.
+ *
+ * Core's routes are listed below. An add-on lists its own through the add-on
+ * host, `host.allowSignedOutWrite(...)`, which accepts only a route under the
+ * add-on's own `/api/<slug>/` or `/addons/<slug>/`, and refuses a slug that
+ * names one of core's own `/api/` or `/addons/` prefixes. Those are the only
+ * ways onto the list, and it is sealed once the add-ons have loaded; outside
+ * tests (`NODE_ENV=test`) the seal cannot be undone.
+ *
+ * Permission to write is still asked by each route, as always: an entry only
+ * lets the request reach the route, it grants nothing.
+ */
+/** The methods that only read. Every other method is held by the gate, so a new one (PROPFIND, MERGE, SEARCH…) fails closed. */
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+/** The methods an add-on may list. */
+const LISTABLE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+/** Whether the method may change things, and so is held by the gate: anything but GET, HEAD and OPTIONS. */
+export function isWriteMethod(method) {
+    return !SAFE_METHODS.has(method.toUpperCase());
+}
+/**
+ * Slugs an add-on may not use to list a route, because core already answers
+ * under `/api/<slug>/` or `/addons/<slug>/`: an add-on in a directory named
+ * `admin` must not open `/api/admin/...`. Kept in step with core's route
+ * files; `signedOutWriteGate.test.ts` checks it against the route inventory.
+ */
+export const RESERVED_ADDON_SLUGS = new Set([
+    'addons', 'admin', 'agent', 'agents', 'assets', 'attachments', 'audit', 'auth', 'backup', 'catalog', 'check-updates',
+    'comments', 'config', 'consent', 'core', 'export', 'footnotes', 'import', 'install', 'keywords', 'login', 'logout',
+    'media', 'notifications', 'oidc', 'page', 'page-metadata', 'page-source', 'page-suggestions', 'pages', 'policies',
+    'policy', 'preview', 'profile', 'register', 'search', 'session', 'session-count', 'session-users', 'sessions', 'share',
+    'system', 'test', 'tokens', 'user', 'user-keywords', 'users', 'vault', 'wiki'
+]);
+/**
+ * Core's list. Each reason says why the route cannot wait for a sign-in.
+ * Routes that need a signed-in session by their nature (consent, the
+ * account-setup password, the second-factor enrolment, reauthentication) are
+ * not here: their callers are signed in when they reach them.
+ */
+export const CORE_SIGNED_OUT_WRITES = Object.freeze([
+    // Signing in. The caller has no session yet.
+    { method: 'POST', path: '/login', reason: 'password step of signing in' },
+    { method: 'POST', path: '/auth/magic-link', reason: 'asks for a sign-in link by email' },
+    { method: 'POST', path: '/auth/magic-link/verify', reason: 'completes a sign-in from the emailed link' },
+    { method: 'POST', path: '/auth/passkey/authenticate/verify', reason: 'signs in with a passkey' },
+    { method: 'POST', path: '/auth/oauth/:name', reason: 'starts a sign-in with an outside provider' },
+    { method: 'POST', path: '/auth/choose-account', reason: 'finishes an outside sign-in whose email is shared by several accounts' },
+    { method: 'POST', path: '/login/connect/cancel', reason: 'drops an outside identity waiting to be connected, from the login page' },
+    // The second factor. It needs the pending sign-in handle from the password step, not a session.
+    { method: 'POST', path: '/login/second-factor/email', reason: 'second factor: sends the approval email for the waiting sign-in' },
+    { method: 'POST', path: '/login/second-factor/complete', reason: 'second factor: completes the waiting sign-in' },
+    { method: 'POST', path: '/login/second-factor/cancel', reason: 'second factor: abandons the waiting sign-in' },
+    { method: 'POST', path: '/login/second-factor/totp', reason: 'second factor: authenticator-app code for the waiting sign-in' },
+    { method: 'POST', path: '/login/second-factor/device', reason: 'second factor: proof from a remembered browser for the waiting sign-in' },
+    { method: 'POST', path: '/login/approve', reason: 'approves or refuses a waiting sign-in from the emailed link, opened in any browser' },
+    // Signing out. A session that expired still has to be able to end.
+    { method: 'POST', path: '/logout', reason: 'ends the session; a signed-out caller is sent on to sign in' },
+    // Becoming a user, and getting back in.
+    { method: 'POST', path: '/register', reason: 'registration (the handler answers 404 when it is off)' },
+    { method: 'POST', path: '/recover-password', reason: 'password reset with the recovery words' },
+    { method: 'POST', path: '/invitation', reason: 'accepts an invitation by its token, which signs the person in' },
+    { method: 'POST', path: '/account/email/confirm', reason: 'confirms a changed email address from the emailed link, opened in any browser' },
+    // Public forms.
+    { method: 'POST', path: '/contact', reason: 'the public contact form (the handler answers 404 when it is off)' },
+    // First run: no account exists to sign in with. The handlers refuse once the site is installed.
+    { method: 'POST', path: '/install', reason: 'first-run installation, before any account exists' },
+    { method: 'POST', path: '/install/reset', reason: 'first-run installation, before any account exists' }
+]);
+/** What a route path means to Express: `:name` is one segment; the match ignores case and a trailing slash. */
+function matcherFor(path) {
+    const body = path
+        .split('/')
+        .map((segment) => (segment.startsWith(':') ? '[^/]+' : segment.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')))
+        .join('/');
+    return new RegExp(`^${body}/?$`, 'i');
+}
+const entryOf = (route, owner) => ({ ...route, owner, matches: matcherFor(route.path) });
+const SEGMENT = /^(?:[A-Za-z0-9_~-][A-Za-z0-9._~-]*|:[A-Za-z][A-Za-z0-9_]*)$/;
+let addonEntries = [];
+let sealed = false;
+const coreEntries = CORE_SIGNED_OUT_WRITES.map((r) => entryOf(r, 'core'));
+/**
+ * An add-on's declaration of a route a signed-out caller may write to.
+ * Called through `AddonHost.allowSignedOutWrite`, bound to the add-on's slug.
+ * Throws on anything outside the add-on's own paths, so one add-on can never
+ * open another's, or core's.
+ */
+export function declareAddonSignedOutWrite(slug, route) {
+    const refuse = (why) => {
+        throw new Error(`Add-on '${slug}' cannot allow a signed-out ${String(route?.method)} ${String(route?.path)}: ${why}`);
+    };
+    if (sealed)
+        refuse('the list is sealed once add-ons have loaded; declare it in register()');
+    if (RESERVED_ADDON_SLUGS.has(slug.toLowerCase()))
+        refuse(`'${slug}' is one of core's own route prefixes`);
+    if (!route || typeof route.method !== 'string' || !LISTABLE_METHODS.has(route.method.toUpperCase()))
+        refuse('the method must be POST, PUT, PATCH or DELETE');
+    if (typeof route.reason !== 'string' || route.reason.trim() === '')
+        refuse('say why in `reason`');
+    if (typeof route.path !== 'string')
+        return refuse('the path must be a string');
+    const own = [`/api/${slug}/`, `/addons/${slug}/`];
+    if (!own.some((prefix) => route.path.startsWith(prefix)))
+        refuse(`the path must be under ${own.join(' or ')}`);
+    const segments = route.path.split('/').slice(1);
+    if (segments.some((s) => !SEGMENT.test(s)))
+        refuse('the path may hold only literal segments and :name parameters');
+    addonEntries.push(entryOf({ ...route, method: route.method.toUpperCase() }, slug));
+}
+/** Close the list to add-ons. Called once, after they have loaded. */
+export function sealSignedOutWrites() {
+    sealed = true;
+}
+/** Test support: forget add-on declarations and reopen the list. Refuses outside `NODE_ENV=test`, so a sealed list stays sealed. */
+export function resetSignedOutWrites() {
+    if (process.env.NODE_ENV !== 'test' && !process.env.VITEST)
+        throw new Error('resetSignedOutWrites is for tests only (NODE_ENV=test)');
+    addonEntries = [];
+    sealed = false;
+}
+/** Every route on the list, core's then the add-ons'. */
+export function signedOutWriteRoutes() {
+    return [...coreEntries, ...addonEntries].map(({ method, path, reason, owner }) => ({ method, path, reason, owner }));
+}
+/** The reason the route is on the list, or null when a signed-out caller may not write to it. */
+export function signedOutWriteReason(method, path) {
+    const m = method.toUpperCase();
+    const hit = [...coreEntries, ...addonEntries].find((e) => e.method === m && e.matches.test(path));
+    return hit ? hit.reason : null;
+}

package/lib/src/types/Page.d.ts

@@ -95,13 +95,6 @@ export interface PageFrontmatter {
      * in Slice E (v3.7.0). All datasets migrated; this field is the only source of truth.
      */
     private?: boolean;
-    /** Per-action principal lists — overrides audience for the named action */
-    access?: {
-        view?: string[];
-        edit?: string[];
-        delete?: string[];
-        [key: string]: string[] | undefined;
-    };
     /** Additional custom metadata */
     [key: string]: unknown;
 }