@kywi-software/core 0.13.0 → 0.15.0

package/dist/api/password-reset-routes.js

@@ -1,9 +1,8 @@
 import { z } from 'zod';
 import { jsonOk, jsonError, validationError } from './response.js';
-import { getUserByEmail, updateUser } from '../db/user-queries.js';
+import { getUserByEmail, changeUserPassword } from '../db/user-queries.js';
 import { createResetToken, findValidToken, markTokenUsed } from '../db/password-reset-queries.js';
 import { generateResetToken, hashResetToken, verifyResetToken, getTokenExpiryDate } from '../auth/password-reset.js';
-import { hashPassword } from '../auth/passwords.js';
 import { renderEmailTemplate, PASSWORD_RESET_TEMPLATE } from '../email/templates.js';
 // ── Rate limiter (in-memory, per email) ──────────────────────────────────────
 const RATE_LIMIT_MAX = 3;
@@ -77,7 +76,11 @@ export function registerPasswordResetRoutes(router, ctx) {
         });
         return jsonOk({ message: 'If that email exists, a reset link has been sent.' });
     });
-    // POST /auth/reset-password
+    // POST /auth/reset-password — redeem a token and set the new password.
+    // A full participant in the password lifecycle (kywi-cms#173): the write goes
+    // through `changeUserPassword`, so it stamps `password_changed_at` (ending the
+    // user's other sessions via the stateless check in POST /auth/refresh) and
+    // clears `password_reset_required`.
     router.post('/auth/reset-password', async (req) => {
         let body;
         try {
@@ -108,9 +111,13 @@ export function registerPasswordResetRoutes(router, ctx) {
         }
         // Mark token as used
         await markTokenUsed(db, matchedToken.id);
-        // Update password
-        const passwordHash = await hashPassword(newPassword);
-        await updateUser(db, user.id, { passwordHash });
+        // Set the password through the ONE lifecycle-aware writer (kywi-cms#173):
+        // it stamps `passwordChangedAt`, which is what makes the stateless refresh
+        // invalidation in POST /auth/refresh fire — and this is the one flow a
+        // compromised user can reach, so it is exactly where that has to work.
+        // `clearResetRequired: true` because proving control of your email and
+        // choosing a new password satisfies a forced reset.
+        await changeUserPassword(db, user.id, newPassword, { clearResetRequired: true });
         return jsonOk({ message: 'Password has been reset successfully.' });
     });
 }

package/dist/api/password-reset-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset-routes.js","sourceRoot":"","sources":["../../src/api/password-reset-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAKvB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAA;AACjG,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AACpH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AAQpF,gFAAgF;AAChF,MAAM,cAAc,GAAG,CAAC,CAAA;AACxB,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,SAAS;AAOrD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAA0B,CAAA;AAE/D,0CAA0C;AAC1C,MAAM,UAAU,iBAAiB;IAC/B,qBAAqB,CAAC,KAAK,EAAE,CAAA;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAC9C,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,GAAG,oBAAoB,EAAE,CAAC;QAC7D,qBAAqB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAA;QAChE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAA;IAChB,IAAI,KAAK,CAAC,KAAK,GAAG,cAAc,EAAE,CAAC;QACjC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAA;AAEF,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC;CACzE,CAAC,CAAA;AAEF,MAAM,UAAU,2BAA2B,CAAC,MAAc,EAAE,GAA8B;IACxF,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,GAAG,CAAA;IAEzC,6BAA6B;IAC7B,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjD,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;QAE7B,+CAA+C;QAC/C,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC,cAAc,EAAE,2DAA2D,EAAE,GAAG,CAAC,CAAA;QACpG,CAAC;QAED,qDAAqD;QACrD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAA;QACjF,CAAC;QAED,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAA;QACrC,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;QAC1C,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAA;QACtC,MAAM,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;QAEzD,kBAAkB;QAClB,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,WAAW,CAAA;QACzD,MAAM,QAAQ,GAAG,WAAW,UAAU,+BAA+B,QAAQ,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAA;QAClH,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,MAAM,CAAA;QAEhD,aAAa;QACb,MAAM,IAAI,GAAG,mBAAmB,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjF,MAAM,aAAa,CAAC,IAAI,CAAC;YACvB,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,oBAAoB,QAAQ,EAAE;YACvC,IAAI;SACL,CAAC,CAAA;QAEF,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,4BAA4B;IAC5B,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChD,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;QAEjD,eAAe;QACf,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC,aAAa,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAA;QACxE,CAAC;QAED,kCAAkC;QAClC,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QACrD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC,aAAa,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAA;QACxE,CAAC;QAED,2DAA2D;QAC3D,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;QAChF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC,aAAa,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAA;QACxE,CAAC;QAED,qBAAqB;QACrB,MAAM,aAAa,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,CAAA;QAExC,kBAAkB;QAClB,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;QACpD,MAAM,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;QAE/C,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"password-reset-routes.js","sourceRoot":"","sources":["../../src/api/password-reset-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAKvB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC1E,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAA;AACjG,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AACpH,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AAQpF,gFAAgF;AAChF,MAAM,cAAc,GAAG,CAAC,CAAA;AACxB,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,SAAS;AAOrD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAA0B,CAAA;AAE/D,0CAA0C;AAC1C,MAAM,UAAU,iBAAiB;IAC/B,qBAAqB,CAAC,KAAK,EAAE,CAAA;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAC9C,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,GAAG,oBAAoB,EAAE,CAAC;QAC7D,qBAAqB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAA;QAChE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAA;IAChB,IAAI,KAAK,CAAC,KAAK,GAAG,cAAc,EAAE,CAAC;QACjC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAA;AAEF,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC;CACzE,CAAC,CAAA;AAEF,MAAM,UAAU,2BAA2B,CAAC,MAAc,EAAE,GAA8B;IACxF,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,GAAG,CAAA;IAEzC,6BAA6B;IAC7B,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjD,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;QAE7B,+CAA+C;QAC/C,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC,cAAc,EAAE,2DAA2D,EAAE,GAAG,CAAC,CAAA;QACpG,CAAC;QAED,qDAAqD;QACrD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAA;QACjF,CAAC;QAED,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAA;QACrC,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;QAC1C,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAA;QACtC,MAAM,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;QAEzD,kBAAkB;QAClB,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,WAAW,CAAA;QACzD,MAAM,QAAQ,GAAG,WAAW,UAAU,+BAA+B,QAAQ,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAA;QAClH,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,MAAM,CAAA;QAEhD,aAAa;QACb,MAAM,IAAI,GAAG,mBAAmB,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjF,MAAM,aAAa,CAAC,IAAI,CAAC;YACvB,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,oBAAoB,QAAQ,EAAE;YACvC,IAAI;SACL,CAAC,CAAA;QAEF,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,uEAAuE;IACvE,8EAA8E;IAC9E,+EAA+E;IAC/E,2EAA2E;IAC3E,oCAAoC;IACpC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChD,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;QAEjD,eAAe;QACf,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC,aAAa,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAA;QACxE,CAAC;QAED,kCAAkC;QAClC,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QACrD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC,aAAa,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAA;QACxE,CAAC;QAED,2DAA2D;QAC3D,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;QAChF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC,aAAa,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAA;QACxE,CAAC;QAED,qBAAqB;QACrB,MAAM,aAAa,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,CAAA;QAExC,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,oDAAoD;QACpD,MAAM,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAA;QAEhF,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/search-routes.js

@@ -34,7 +34,7 @@ export function registerSearchRoutes(router, ctx) {
             const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
             if (!auth.user)
                 return unauthorized();
-            const siteDenied = assertSiteAccess(auth.user, siteId);
+            const siteDenied = assertSiteAccess(auth.user, siteId, ctx.config.auth);
             if (siteDenied)
                 return siteDenied;
             includeExcluded = true;
@@ -44,7 +44,7 @@ export function registerSearchRoutes(router, ctx) {
             const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
             if (!auth.user)
                 return unauthorized();
-            const siteDenied = assertSiteAccess(auth.user, siteId);
+            const siteDenied = assertSiteAccess(auth.user, siteId, ctx.config.auth);
             if (siteDenied)
                 return siteDenied;
             includeExcluded = true;

package/dist/api/search-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"search-routes.js","sourceRoot":"","sources":["../../src/api/search-routes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAQvD,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,GAAuB;IAC1E,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,GAAG,CAAA;IAE9B,wFAAwF;IACxF,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAEnC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,iCAAiC,EAAE,GAAG,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC,aAAa,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAA;QAC9E,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAA;QAC1D,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAA;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAA;QAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/F,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAEjG,wEAAwE;QACxE,6EAA6E;QAC7E,2EAA2E;QAC3E,wEAAwE;QACxE,EAAE;QACF,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,yBAAyB;QACzB,IAAI,eAAe,GAAG,KAAK,CAAA;QAC3B,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;YAChF,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,YAAY,EAAE,CAAA;YACrC,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YACtD,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAA;YACjC,eAAe,GAAG,IAAI,CAAA;QACxB,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,mEAAmE;YACnE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;YAChF,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,YAAY,EAAE,CAAA;YACrC,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YACtD,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAA;YACjC,eAAe,GAAG,IAAI,CAAA;QACxB,CAAC;QAED,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;QAChD,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAClD,MAAM,IAAI,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAEtF,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE;YACpD,MAAM;YACN,WAAW;YACX,MAAM;YACN,MAAM;YACN,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,eAAe;YACvB,eAAe;SAChB,CAAC,CAAA;QAEF,OAAO,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"search-routes.js","sourceRoot":"","sources":["../../src/api/search-routes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAQvD,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,GAAuB;IAC1E,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,GAAG,CAAA;IAE9B,wFAAwF;IACxF,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAEnC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,iCAAiC,EAAE,GAAG,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC,aAAa,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAA;QAC9E,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAA;QAC1D,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAA;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAA;QAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/F,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAEjG,wEAAwE;QACxE,6EAA6E;QAC7E,2EAA2E;QAC3E,wEAAwE;QACxE,EAAE;QACF,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,yBAAyB;QACzB,IAAI,eAAe,GAAG,KAAK,CAAA;QAC3B,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;YAChF,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,YAAY,EAAE,CAAA;YACrC,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACvE,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAA;YACjC,eAAe,GAAG,IAAI,CAAA;QACxB,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,mEAAmE;YACnE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;YAChF,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,YAAY,EAAE,CAAA;YACrC,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACvE,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAA;YACjC,eAAe,GAAG,IAAI,CAAA;QACxB,CAAC;QAED,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;QAChD,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAClD,MAAM,IAAI,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAEtF,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE;YACpD,MAAM;YACN,WAAW;YACX,MAAM;YACN,MAAM;YACN,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,eAAe;YACvB,eAAe;SAChB,CAAC,CAAA;QAEF,OAAO,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/section-template-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"section-template-routes.d.ts","sourceRoot":"","sources":["../../src/api/section-template-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAgBpD,UAAU,2BAA2B;IACnC,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;CACnB;AAoCD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,2BAA2B,GAAG,IAAI,CA0JpG"}
+{"version":3,"file":"section-template-routes.d.ts","sourceRoot":"","sources":["../../src/api/section-template-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAgBpD,UAAU,2BAA2B;IACnC,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;CACnB;AAkDD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,2BAA2B,GAAG,IAAI,CA6JpG"}

package/dist/api/section-template-routes.js

@@ -5,9 +5,9 @@ import { canAccessContent, hasMinRole } from '../auth/roles.js';
 import { jsonOk, jsonError, unauthorized, forbidden, notFound, validationError } from './response.js';
 import { validateLayoutDocument } from '../layout/types.js';
 import { newlyIntroducedAdminOnlyTypes } from '../layout/module-permissions.js';
-import { createSectionTemplate, updateSectionTemplate, deleteSectionTemplate, getSectionTemplateById, listSectionTemplates, } from '../db/component-queries.js';
+import { createSectionTemplate, setSectionTemplateDefinition, deleteSectionTemplate, getSectionTemplateById, listSectionTemplates, } from '../db/section-template-queries.js';
 /**
- * Standalone saved layouts ("section templates").
+ * Standalone saved layouts ("section templates", "blueprints").
  *
  * The `kywi_section_templates.definition` column is untyped jsonb. This surface
  * stores a full {@link LayoutDocument} there (regions → sections → columns →
@@ -15,16 +15,30 @@ import { createSectionTemplate, updateSectionTemplate, deleteSectionTemplate, ge
  * with no lossy transform. Validation reuses `validateLayoutDocument`, exactly
  * like the per-content `/content/:type/:id/layout` routes.
  *
- * Linked components (kywi-cms#147) and this surface deliberately do NOT meet:
- * a saved layout stored here can contain `componentId` links, but it is a
- * blueprint, not a placement — it renders on no page, and inserting it into one
- * clones it (`cloneSection` keeps the link), at which point `setContentLayout`
- * indexes the real placement. So section templates are not counted as instances
- * ("N instances across M pages" would then be naming something no visitor can
- * see), and `detach-all` does not rewrite them. The consequence is that a
- * template can outlive the component it links to; that is safe because a
- * connected node carries a resolved fallback copy and the renderer falls back
- * to it, which is exactly what an unresolvable link does today.
+ * LINKED COMPONENTS AND THIS SURFACE (kywi-cms#147, rewritten by #156). A saved
+ * layout can contain `componentId` links, and a blueprint is not a placement —
+ * it renders on no page, and inserting it into one clones it (`cloneSection`
+ * keeps the link), at which point `setContentLayout` indexes the real
+ * placement. #147 concluded from that they should not be indexed at all. That
+ * was wrong in a specific, load-bearing way: a link is a link, and leaving it
+ * out of the index did not make the blueprint independent of the component — it
+ * only made the dependency invisible. Deleting the component left the blueprint
+ * rendering the node's fallback copy forever with nothing said; the save fork
+ * on the blueprint canvas had to run inert because every number it would quote
+ * was a lie; and the canvas withheld every minting action for the same reason.
+ *
+ * A blueprint is now a HOLDER in `kywi_component_instances`, alongside a page
+ * (see `schema/components.ts`). Its placements are counted in their own
+ * partition — `blueprints`, never `pages`/`items`, because "used on 4 pages"
+ * must still name four pages a reader can open — they block the component's
+ * delete with `COMPONENT_IN_USE`, and `?detachAll=1` rewrites blueprints along
+ * with pages.
+ *
+ * BOTH WRITING ROUTES BELOW GO THROUGH `db/section-template-queries.ts`, which
+ * writes the definition and the index rows in one transaction. That is the
+ * load-bearing part: a route left on a plain UPDATE would silently drift the
+ * index, and the drift would only surface as a wrong number in a delete
+ * confirmation.
  */
 const createSchema = z.object({
     name: z.string().min(1),
@@ -51,7 +65,7 @@ export function registerSectionTemplateRoutes(router, ctx) {
             return forbidden();
         const url = new URL(req.url);
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
-        const siteDenied = assertSiteAccess(auth.user, siteId);
+        const siteDenied = assertSiteAccess(auth.user, siteId, config.auth);
         if (siteDenied)
             return siteDenied;
         const category = url.searchParams.get('category') ?? undefined;
@@ -67,7 +81,7 @@ export function registerSectionTemplateRoutes(router, ctx) {
             return forbidden();
         const url = new URL(req.url);
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
-        const siteDenied = assertSiteAccess(auth.user, siteId);
+        const siteDenied = assertSiteAccess(auth.user, siteId, config.auth);
         if (siteDenied)
             return siteDenied;
         const template = await getSectionTemplateById(db, params.id, siteId);
@@ -107,7 +121,7 @@ export function registerSectionTemplateRoutes(router, ctx) {
             }
         }
         const siteId = await toSiteUuid(db, parsed.data.siteId, config);
-        const siteDenied = assertSiteAccess(auth.user, siteId);
+        const siteDenied = assertSiteAccess(auth.user, siteId, config.auth);
         if (siteDenied)
             return siteDenied;
         const template = await createSectionTemplate(db, {
@@ -139,7 +153,7 @@ export function registerSectionTemplateRoutes(router, ctx) {
         }
         const url = new URL(req.url);
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
-        const siteDenied = assertSiteAccess(auth.user, siteId);
+        const siteDenied = assertSiteAccess(auth.user, siteId, config.auth);
         if (siteDenied)
             return siteDenied;
         const patch = {};
@@ -165,7 +179,10 @@ export function registerSectionTemplateRoutes(router, ctx) {
             }
             patch.definition = validation.data;
         }
-        const updated = await updateSectionTemplate(db, params.id, patch, siteId);
+        // One transactional write for name, category and definition together: the
+        // definition and its index rows must commit or roll back as one, and a
+        // separate metadata UPDATE would be a second door onto the same row.
+        const updated = await setSectionTemplateDefinition(db, params.id, patch, siteId);
         if (!updated)
             return notFound('Section template not found');
         return jsonOk(updated);
@@ -179,7 +196,7 @@ export function registerSectionTemplateRoutes(router, ctx) {
             return forbidden();
         const url = new URL(req.url);
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
-        const siteDenied = assertSiteAccess(auth.user, siteId);
+        const siteDenied = assertSiteAccess(auth.user, siteId, config.auth);
         if (siteDenied)
             return siteDenied;
         const deleted = await deleteSectionTemplate(db, params.id, siteId);

package/dist/api/section-template-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"section-template-routes.js","sourceRoot":"","sources":["../../src/api/section-template-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACrG,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAE3D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,4BAA4B,CAAA;AAQnC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAA;AAEF,MAAM,UAAU,6BAA6B,CAAC,MAAc,EAAE,GAAgC;IAC5F,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;IAEtC,KAAK,UAAU,YAAY,CAAC,GAAY;QACtC,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;IACtE,CAAC;IAED,yDAAyD;IACzD,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAA;QAE9D,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAClE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,yDAAyD;IACzD,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QACrE,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAA;QAC5D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,kDAAkD;IAClD,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACjE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC,kBAAkB,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAC7D,CAAC;QAED,2EAA2E;QAC3E,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;YAC7C,MAAM,SAAS,GAAG,6BAA6B,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACtE,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAC,kBAAkB,EAAE,6CAA6C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;YAChH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/D,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,EAAE,EAAE;YAC/C,MAAM;YACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,UAAU,EAAE,UAAU,CAAC,IAA0C;YACjE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;SACxB,CAAC,CAAA;QAEF,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,qDAAqD;IACrD,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,KAAK,GAAgD,EAAE,CAAA;QAC7D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAA;QACjE,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAA;QAC7E,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACjE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,SAAS,CAAC,kBAAkB,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC7D,CAAC;YACD,0EAA0E;YAC1E,4EAA4E;YAC5E,2EAA2E;YAC3E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC7C,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;gBACnE,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,UAAU,IAAI,IAAI,CAA0B,CAAA;gBACvE,MAAM,SAAS,GAAG,6BAA6B,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;gBAC3E,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,SAAS,CAAC,kBAAkB,EAAE,6CAA6C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;gBAChH,CAAC;YACH,CAAC;YACD,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC,IAA0C,CAAA;QAC1E,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QAC1E,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAA;QAC3D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,wDAAwD;IACxD,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QACnE,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAA;QAC3D,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"section-template-routes.js","sourceRoot":"","sources":["../../src/api/section-template-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACrG,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAE3D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mCAAmC,CAAA;AAQ1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAA;AAEF,MAAM,UAAU,6BAA6B,CAAC,MAAc,EAAE,GAAgC;IAC5F,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;IAEtC,KAAK,UAAU,YAAY,CAAC,GAAY;QACtC,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;IACtE,CAAC;IAED,yDAAyD;IACzD,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACnE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAA;QAE9D,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAClE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,yDAAyD;IACzD,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACnE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QACrE,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAA;QAC5D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,kDAAkD;IAClD,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACjE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC,kBAAkB,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAC7D,CAAC;QAED,2EAA2E;QAC3E,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;YAC7C,MAAM,SAAS,GAAG,6BAA6B,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACtE,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAC,kBAAkB,EAAE,6CAA6C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;YAChH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/D,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACnE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,EAAE,EAAE;YAC/C,MAAM;YACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,UAAU,EAAE,UAAU,CAAC,IAA0C;YACjE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;SACxB,CAAC,CAAA;QAEF,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,qDAAqD;IACrD,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACnE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,KAAK,GAAuD,EAAE,CAAA;QACpE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAA;QACjE,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAA;QAC7E,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACjE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,SAAS,CAAC,kBAAkB,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC7D,CAAC;YACD,0EAA0E;YAC1E,4EAA4E;YAC5E,2EAA2E;YAC3E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC7C,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;gBACnE,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,UAAU,IAAI,IAAI,CAA0B,CAAA;gBACvE,MAAM,SAAS,GAAG,6BAA6B,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;gBAC3E,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,SAAS,CAAC,kBAAkB,EAAE,6CAA6C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;gBAChH,CAAC;YACH,CAAC;YACD,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC,IAA0C,CAAA;QAC1E,CAAC;QAED,0EAA0E;QAC1E,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACjF,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAA;QAC3D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,wDAAwD;IACxD,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACnE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QACnE,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAA;QAC3D,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/site-admin-routes.d.ts

@@ -1,5 +1,14 @@
 import type { Router } from './router.js';
 import type { KywiDb } from '../db/client.js';
 import type { HookRegistry } from '../hooks/registry.js';
-export declare function registerSiteAdminRoutes(router: Router, db: KywiDb, authSecret: string, hookRegistry?: HookRegistry): void;
+import type { SiteAccessPolicy } from './site-context.js';
+/**
+ * Site CRUD (superAdmin) plus the per-site settings surface (siteAdmin+).
+ *
+ * `siteAuth` sits BEFORE the optional `hookRegistry` so it can be required:
+ * the settings routes address a site by path segment, which makes them exactly
+ * the shape of hole per-site authorization exists to close, and an optional
+ * policy would let a future caller reopen it by omission.
+ */
+export declare function registerSiteAdminRoutes(router: Router, db: KywiDb, authSecret: string, siteAuth: SiteAccessPolicy | undefined, hookRegistry?: HookRegistry): void;
 //# sourceMappingURL=site-admin-routes.d.ts.map

package/dist/api/site-admin-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"site-admin-routes.d.ts","sourceRoot":"","sources":["../../src/api/site-admin-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAsBxD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAyFzH"}
+{"version":3,"file":"site-admin-routes.d.ts","sourceRoot":"","sources":["../../src/api/site-admin-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAKxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAmBzD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,gBAAgB,GAAG,SAAS,EACtC,YAAY,CAAC,EAAE,YAAY,GAC1B,IAAI,CAkGN"}

package/dist/api/site-admin-routes.js

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import { createSiteHookDispatcher } from '../hooks/dispatch.js';
 import { jsonOk, jsonError, notFound, unauthorized, forbidden, validationError } from './response.js';
 import { resolveAuth } from './auth.js';
+import { assertSiteAccess } from './site-context.js';
 import { hasMinRole } from '../auth/roles.js';
 import { createSite, updateSite, deleteSite } from '../db/site-admin-queries.js';
 import { getAllSiteSettings, bulkSetSiteSettings } from '../db/site-settings-queries.js';
@@ -17,7 +18,15 @@ const updateSiteSchema = z.object({
     defaultLocale: z.string().optional(),
     theme: z.string().optional(),
 }).strict();
-export function registerSiteAdminRoutes(router, db, authSecret, hookRegistry) {
+/**
+ * Site CRUD (superAdmin) plus the per-site settings surface (siteAdmin+).
+ *
+ * `siteAuth` sits BEFORE the optional `hookRegistry` so it can be required:
+ * the settings routes address a site by path segment, which makes them exactly
+ * the shape of hole per-site authorization exists to close, and an optional
+ * policy would let a future caller reopen it by omission.
+ */
+export function registerSiteAdminRoutes(router, db, authSecret, siteAuth, hookRegistry) {
     const siteHooks = hookRegistry ? createSiteHookDispatcher(hookRegistry) : null;
     // POST /sites — Create site (superAdmin only)
     router.post('/sites', async (req) => {
@@ -101,6 +110,12 @@ export function registerSiteAdminRoutes(router, db, authSecret, hookRegistry) {
             return unauthorized();
         if (!hasMinRole(auth.user.role, 'siteAdmin'))
             return forbidden();
+        // Roles are global, so the role check above says only "is a siteAdmin
+        // somewhere". Without this, a siteAdmin of site B could read site A's
+        // settings by naming it in the path (kywi-cms#74).
+        const siteDenied = assertSiteAccess(auth.user, params.siteId, siteAuth);
+        if (siteDenied)
+            return siteDenied;
         const settings = await getAllSiteSettings(db, params.siteId);
         return jsonOk(settings);
     });
@@ -111,6 +126,11 @@ export function registerSiteAdminRoutes(router, db, authSecret, hookRegistry) {
             return unauthorized();
         if (!hasMinRole(auth.user.role, 'siteAdmin'))
             return forbidden();
+        // Same gate as the GET, and the one that matters more: this route
+        // OVERWRITES the addressed site's settings (kywi-cms#74).
+        const siteDenied = assertSiteAccess(auth.user, params.siteId, siteAuth);
+        if (siteDenied)
+            return siteDenied;
         let body;
         try {
             body = await req.json();

package/dist/api/site-admin-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"site-admin-routes.js","sourceRoot":"","sources":["../../src/api/site-admin-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACrG,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AAChF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AAExF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC,MAAM,EAAE,CAAA;AAEX,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC,MAAM,EAAE,CAAA;AAEX,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAE,EAAU,EAAE,UAAkB,EAAE,YAA2B;IACjH,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAE9E,8CAA8C;IAC9C,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEjE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAE9F,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;QAE3H,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;QAC1D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE;YAChC,IAAI;YACJ,MAAM;YACN,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC,CAAA;QACF,IAAI,SAAS;YAAE,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QAChD,OAAO,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,qDAAqD;IACrD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEjE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAE9F,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;QAE3H,MAAM,UAAU,GAAoF,EAAE,CAAA;QACtG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAA;QACtE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAA;QAC5E,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;YAAE,UAAU,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAA;QACjG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,UAAU,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAA;QAEzE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,EAAE,UAAU,CAAC,CAAA;QAC7D,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAC5C,IAAI,SAAS;YAAE,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QAChD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,wDAAwD;IACxD,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEjE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,CAAC,CAAA;QACpD,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAC/C,IAAI,SAAS;YAAE,MAAM,SAAS,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,MAAO,EAAE,CAAC,CAAA;QAClE,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,8EAA8E;IAC9E,MAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,CAAC,CAAA;QAC7D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,MAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAE9F,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,SAAS,CAAC,aAAa,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,mBAAmB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,EAAE,IAA+B,CAAC,CAAA;QAC9E,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,CAAC,CAAA;QAC5D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"site-admin-routes.js","sourceRoot":"","sources":["../../src/api/site-admin-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACrG,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AAChF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AAExF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC,MAAM,EAAE,CAAA;AAEX,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC,MAAM,EAAE,CAAA;AAEX;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,EAAU,EACV,UAAkB,EAClB,QAAsC,EACtC,YAA2B;IAE3B,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAE9E,8CAA8C;IAC9C,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEjE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAE9F,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;QAE3H,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;QAC1D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE;YAChC,IAAI;YACJ,MAAM;YACN,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC,CAAA;QACF,IAAI,SAAS;YAAE,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QAChD,OAAO,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,qDAAqD;IACrD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEjE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAE9F,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;QAE3H,MAAM,UAAU,GAAoF,EAAE,CAAA;QACtG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAA;QACtE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAA;QAC5E,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;YAAE,UAAU,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAA;QACjG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,UAAU,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAA;QAEzE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,EAAE,UAAU,CAAC,CAAA;QAC7D,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAC5C,IAAI,SAAS;YAAE,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QAChD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,wDAAwD;IACxD,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEjE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,CAAC,CAAA;QACpD,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAC/C,IAAI,SAAS;YAAE,MAAM,SAAS,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,MAAO,EAAE,CAAC,CAAA;QAClE,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,8EAA8E;IAC9E,MAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAChE,sEAAsE;QACtE,sEAAsE;QACtE,mDAAmD;QACnD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAO,EAAE,QAAQ,CAAC,CAAA;QACxE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,CAAC,CAAA;QAC7D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,MAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAChE,kEAAkE;QAClE,0DAA0D;QAC1D,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAO,EAAE,QAAQ,CAAC,CAAA;QACxE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAE9F,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,SAAS,CAAC,aAAa,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,mBAAmB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,EAAE,IAA+B,CAAC,CAAA;QAC9E,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,CAAC,CAAA;QAC5D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/site-context.d.ts

@@ -25,6 +25,24 @@ export declare function resolveSiteId(req: Request, config: KywiConfig, siteIdMa
  * A UUID is returned untouched (no DB round-trip); only slugs are looked up.
  */
 export declare function toSiteUuid(db: KywiDb, idOrSlug: string | null | undefined, fallbackOrConfig: string | KywiConfig): Promise<string>;
+/**
+ * Per-site authorization policy, sourced from `config.auth` (kywi-cms#74).
+ *
+ * `AuthConfig` satisfies this shape structurally, so route handlers pass
+ * `config.auth` directly rather than constructing anything. Routes whose
+ * context carries no `KywiConfig` take it as an explicit `siteAuth` field.
+ *
+ * The parameter is REQUIRED (though it accepts `undefined`) on both helpers
+ * below so that a new site-scoped route cannot silently inherit the lenient
+ * default: omitting it is a compile error, not an unnoticed hole.
+ */
+export interface SiteAccessPolicy {
+    /**
+     * Deny-by-default for users with no membership rows (kywi-cms#74).
+     * Defaults to `false` — see {@link hasSiteAccess} for exactly what flips.
+     */
+    strictSiteMembership?: boolean;
+}
 /**
  * Per-site API authorization (#73).
  *
@@ -33,25 +51,37 @@ export declare function toSiteUuid(db: KywiDb, idOrSlug: string | null | undefin
  * addressing it (`?siteId=…`). This gates an already-authenticated,
  * site-scoped operation to the sites the user actually belongs to.
  *
- * Back-compat is deliberate (see {@link UserContext.siteMemberships}):
- *   - `superAdmin` always passes.
+ * `superAdmin` always passes, under either policy.
+ *
+ * DEFAULT (`strictSiteMembership` unset/false) — back-compat is deliberate
+ * (see {@link UserContext.siteMemberships}):
  *   - `undefined` memberships (old token, or an unresolved path) → pass. Old
  *     tokens must never be denied; they get a DB fallback in `resolveAuth`.
  *   - `[]` (zero membership rows) → pass. Existing single-site installs never
  *     seeded memberships, so a zero-row user is unrestricted.
  *   - a non-empty list → the user is confined to exactly those site UUIDs.
  *
+ * STRICT (`strictSiteMembership: true`, kywi-cms#74) — fail closed. Only an
+ * explicit membership grants access: `undefined` and `[]` are both denied, so
+ * a post-migration install where every user has real rows no longer treats
+ * "no rows" as "all sites". This also closes the edge the issue names —
+ * removing a user's LAST membership narrows their access to nothing instead of
+ * widening it back to unrestricted.
+ *
+ * Turning it on before every human user has memberships locks those users out
+ * of every site, which is why it is opt-in rather than the default.
+ *
  * `siteId` MUST be a resolved DB UUID (post `toSiteUuid`/`resolveSiteId`), since
  * that is the form stored in `kywi_site_memberships` and embedded in the claim.
  */
-export declare function hasSiteAccess(user: UserContext, siteId: string): boolean;
+export declare function hasSiteAccess(user: UserContext, siteId: string, policy: SiteAccessPolicy | undefined): boolean;
 /**
  * Guard form of {@link hasSiteAccess} for route handlers: returns a ready-to-
  * return 403 `Response` when the user may not act on `siteId`, or `null` when
  * access is allowed. Route usage:
  *
- *   const denied = assertSiteAccess(auth.user, siteId)
+ *   const denied = assertSiteAccess(auth.user, siteId, config.auth)
  *   if (denied) return denied
  */
-export declare function assertSiteAccess(user: UserContext, siteId: string): Response | null;
+export declare function assertSiteAccess(user: UserContext, siteId: string, policy: SiteAccessPolicy | undefined): Response | null;
 //# sourceMappingURL=site-context.d.ts.map

package/dist/api/site-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"site-context.d.ts","sourceRoot":"","sources":["../../src/api/site-context.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CA0B1G;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,UAAU,CAC9B,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,gBAAgB,EAAE,MAAM,GAAG,UAAU,GACpC,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAInF"}
+{"version":3,"file":"site-context.d.ts","sourceRoot":"","sources":["../../src/api/site-context.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CA0B1G;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,UAAU,CAC9B,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,gBAAgB,EAAE,MAAM,GAAG,UAAU,GACpC,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,gBAAgB,GAAG,SAAS,GACnC,OAAO,CAQT;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,gBAAgB,GAAG,SAAS,GACnC,QAAQ,GAAG,IAAI,CAIjB"}

package/dist/api/site-context.js

@@ -66,21 +66,36 @@ export async function toSiteUuid(db, idOrSlug, fallbackOrConfig) {
  * addressing it (`?siteId=…`). This gates an already-authenticated,
  * site-scoped operation to the sites the user actually belongs to.
  *
- * Back-compat is deliberate (see {@link UserContext.siteMemberships}):
- *   - `superAdmin` always passes.
+ * `superAdmin` always passes, under either policy.
+ *
+ * DEFAULT (`strictSiteMembership` unset/false) — back-compat is deliberate
+ * (see {@link UserContext.siteMemberships}):
  *   - `undefined` memberships (old token, or an unresolved path) → pass. Old
  *     tokens must never be denied; they get a DB fallback in `resolveAuth`.
  *   - `[]` (zero membership rows) → pass. Existing single-site installs never
  *     seeded memberships, so a zero-row user is unrestricted.
  *   - a non-empty list → the user is confined to exactly those site UUIDs.
  *
+ * STRICT (`strictSiteMembership: true`, kywi-cms#74) — fail closed. Only an
+ * explicit membership grants access: `undefined` and `[]` are both denied, so
+ * a post-migration install where every user has real rows no longer treats
+ * "no rows" as "all sites". This also closes the edge the issue names —
+ * removing a user's LAST membership narrows their access to nothing instead of
+ * widening it back to unrestricted.
+ *
+ * Turning it on before every human user has memberships locks those users out
+ * of every site, which is why it is opt-in rather than the default.
+ *
  * `siteId` MUST be a resolved DB UUID (post `toSiteUuid`/`resolveSiteId`), since
  * that is the form stored in `kywi_site_memberships` and embedded in the claim.
  */
-export function hasSiteAccess(user, siteId) {
+export function hasSiteAccess(user, siteId, policy) {
     if (user.role === 'superAdmin')
         return true;
     const memberships = user.siteMemberships;
+    if (policy?.strictSiteMembership === true) {
+        return memberships !== undefined && memberships.includes(siteId);
+    }
     if (memberships === undefined || memberships.length === 0)
         return true;
     return memberships.includes(siteId);
@@ -90,11 +105,11 @@ export function hasSiteAccess(user, siteId) {
  * return 403 `Response` when the user may not act on `siteId`, or `null` when
  * access is allowed. Route usage:
  *
- *   const denied = assertSiteAccess(auth.user, siteId)
+ *   const denied = assertSiteAccess(auth.user, siteId, config.auth)
  *   if (denied) return denied
  */
-export function assertSiteAccess(user, siteId) {
-    return hasSiteAccess(user, siteId)
+export function assertSiteAccess(user, siteId, policy) {
+    return hasSiteAccess(user, siteId, policy)
         ? null
         : forbidden('You do not have access to this site');
 }

package/dist/api/site-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"site-context.js","sourceRoot":"","sources":["../../src/api/site-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAAE,aAAa,IAAI,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAIzC;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY,EAAE,MAAkB,EAAE,SAAkC;IAChG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAA;IAEtE,0EAA0E;IAC1E,+EAA+E;IAC/E,+EAA+E;IAC/E,yEAAyE;IACzE,wEAAwE;IACxE,qCAAqC;IACrC,MAAM,cAAc,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACrD,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,cAAc,CAAC,CAAA;QAC/B,CAAC;QACD,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACnE,OAAO,cAAc,CAAA;QACvB,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC1D,IAAI,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAExC,oCAAoC;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,QAAmC,EACnC,gBAAqC;IAErC,MAAM,QAAQ,GACZ,OAAO,gBAAgB,KAAK,QAAQ;QAClC,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAA;IACzC,MAAM,GAAG,GAAG,QAAQ,IAAI,QAAQ,CAAA;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAA;IACpB,OAAO,CAAC,MAAM,mBAAmB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,CAAA;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa,CAAC,IAAiB,EAAE,MAAc;IAC7D,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAA;IACxC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtE,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAiB,EAAE,MAAc;IAChE,OAAO,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC;QAChC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAA;AACtD,CAAC"}
+{"version":3,"file":"site-context.js","sourceRoot":"","sources":["../../src/api/site-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAAE,aAAa,IAAI,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAIzC;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY,EAAE,MAAkB,EAAE,SAAkC;IAChG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAA;IAEtE,0EAA0E;IAC1E,+EAA+E;IAC/E,+EAA+E;IAC/E,yEAAyE;IACzE,wEAAwE;IACxE,qCAAqC;IACrC,MAAM,cAAc,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACrD,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,cAAc,CAAC,CAAA;QAC/B,CAAC;QACD,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACnE,OAAO,cAAc,CAAA;QACvB,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC1D,IAAI,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAExC,oCAAoC;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,QAAmC,EACnC,gBAAqC;IAErC,MAAM,QAAQ,GACZ,OAAO,gBAAgB,KAAK,QAAQ;QAClC,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAA;IACzC,MAAM,GAAG,GAAG,QAAQ,IAAI,QAAQ,CAAA;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAA;IACpB,OAAO,CAAC,MAAM,mBAAmB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,CAAA;AACpD,CAAC;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAiB,EACjB,MAAc,EACd,MAAoC;IAEpC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAA;IACxC,IAAI,MAAM,EAAE,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtE,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAiB,EACjB,MAAc,EACd,MAAoC;IAEpC,OAAO,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;QACxC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAA;AACtD,CAAC"}

package/dist/api/tag-routes.js

@@ -61,7 +61,7 @@ export function registerTagRoutes(router, ctx) {
         const siteId = await toSiteUuid(db, parsed.data.siteId, config);
         if (!siteId)
             return jsonError('BAD_REQUEST', 'No site ID available', 400);
-        const siteDenied = assertSiteAccess(auth.user, siteId);
+        const siteDenied = assertSiteAccess(auth.user, siteId, config.auth);
         if (siteDenied)
             return siteDenied;
         const createData = {
@@ -96,7 +96,7 @@ export function registerTagRoutes(router, ctx) {
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
         if (!siteId)
             return jsonError('BAD_REQUEST', 'No site ID available', 400);
-        const siteDenied = assertSiteAccess(auth.user, siteId);
+        const siteDenied = assertSiteAccess(auth.user, siteId, config.auth);
         if (siteDenied)
             return siteDenied;
         const updateData = {};
@@ -122,7 +122,7 @@ export function registerTagRoutes(router, ctx) {
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
         if (!siteId)
             return jsonError('BAD_REQUEST', 'No site ID available', 400);
-        const siteDenied = assertSiteAccess(auth.user, siteId);
+        const siteDenied = assertSiteAccess(auth.user, siteId, config.auth);
         if (siteDenied)
             return siteDenied;
         const deleted = await deleteTag(db, params.id, siteId);

package/dist/api/tag-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"tag-routes.js","sourceRoot":"","sources":["../../src/api/tag-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EACL,QAAQ,EACR,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,GACV,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,MAAM,EACN,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,eAAe,GAChB,MAAM,eAAe,CAAA;AAQtB,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,GAAoB;IACpE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;IAEtC,iCAAiC;IACjC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QAEzE,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAA;QAChE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAChD,MAAM,KAAK,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAExE,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,EAAE,EACF,MAAM,EACN,SAAS,EACT,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CACzD,CAAA;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,sDAAsD;IACtD,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC7C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QACpD,IAAI,CAAC,GAAG;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC1C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,yCAAyC;IACzC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QACzE,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,UAAU,GAKZ;YACF,MAAM;YACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;SACzB,CAAA;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,UAAU,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAA;QAErF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;QAC3C,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,4CAA4C;IAC5C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QACzE,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,UAAU,GAAuE,EAAE,CAAA;QACzF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAA;QACtE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,UAAU,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAA;QACzE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,UAAU,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAA;QAErF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;QACnE,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAE9C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,mDAAmD;IACnD,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QACzE,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAE9C,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"tag-routes.js","sourceRoot":"","sources":["../../src/api/tag-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EACL,QAAQ,EACR,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,GACV,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,MAAM,EACN,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,eAAe,GAChB,MAAM,eAAe,CAAA;AAQtB,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,GAAoB;IACpE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;IAEtC,iCAAiC;IACjC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QAEzE,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAA;QAChE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAChD,MAAM,KAAK,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAExE,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,EAAE,EACF,MAAM,EACN,SAAS,EACT,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CACzD,CAAA;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,sDAAsD;IACtD,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC7C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QACpD,IAAI,CAAC,GAAG;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC1C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,yCAAyC;IACzC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QACzE,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACnE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,UAAU,GAKZ;YACF,MAAM;YACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;SACzB,CAAA;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,UAAU,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAA;QAErF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;QAC3C,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,4CAA4C;IAC5C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QACzE,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACnE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,UAAU,GAAuE,EAAE,CAAA;QACzF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAA;QACtE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,UAAU,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAA;QACzE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,UAAU,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAA;QAErF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;QACnE,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAE9C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,mDAAmD;IACnD,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QACzE,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACnE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAE9C,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/translation-routes.js

@@ -37,7 +37,7 @@ export function registerTranslationRoutes(router, ctx) {
         if (!user)
             return unauthorized();
         const { site, siteUuid } = resolveSite(req);
-        const siteDenied = assertSiteAccess(user, siteUuid);
+        const siteDenied = assertSiteAccess(user, siteUuid, config.auth);
         if (siteDenied)
             return siteDenied;
         return jsonOk({
@@ -53,7 +53,7 @@ export function registerTranslationRoutes(router, ctx) {
         if (!user)
             return unauthorized();
         const { site, siteUuid } = resolveSite(req);
-        const siteDenied = assertSiteAccess(user, siteUuid);
+        const siteDenied = assertSiteAccess(user, siteUuid, config.auth);
         if (siteDenied)
             return siteDenied;
         const locales = configuredLocales(site);
@@ -66,7 +66,7 @@ export function registerTranslationRoutes(router, ctx) {
         if (!user)
             return unauthorized();
         const { site, siteUuid } = resolveSite(req);
-        const siteDenied = assertSiteAccess(user, siteUuid);
+        const siteDenied = assertSiteAccess(user, siteUuid, config.auth);
         if (siteDenied)
             return siteDenied;
         const bundles = {};
@@ -91,7 +91,7 @@ export function registerTranslationRoutes(router, ctx) {
         if (!user)
             return unauthorized();
         const { site, siteUuid } = resolveSite(req);
-        const siteDenied = assertSiteAccess(user, siteUuid);
+        const siteDenied = assertSiteAccess(user, siteUuid, config.auth);
         if (siteDenied)
             return siteDenied;
         const variants = await getLocaleVariants(db, params.id);
@@ -117,7 +117,7 @@ export function registerTranslationRoutes(router, ctx) {
         }
         const { sourceId, locale } = parsed.data;
         const { site, siteUuid } = resolveSite(req);
-        const siteDenied = assertSiteAccess(user, siteUuid);
+        const siteDenied = assertSiteAccess(user, siteUuid, config.auth);
         if (siteDenied)
             return siteDenied;
         if (!configuredLocales(site).includes(locale)) {