@tetherto/dev-websites-core 0.3.5 → 0.3.6

package/dist/cms/index.d.mts

@@ -1,3 +1,3 @@
-import { $ as createAccessHelpers, A as downloadCtaBlock, B as seoFields, C as codeBlockLanguages, D as sectionHeadingBlock, E as leafBlocks, F as richTextBlock, G as STOCK_COLLECTION_SLUGS, H as BuildCmsConfigOptions, I as coerceBlogPostCategoriesOnRead, J as GlobalOverride, K as StockCollectionSlug, L as coerceBlogPostCategoriesOnWrite, M as imageBlock, N as codeTabsBlock, O as accordionBlock, P as codeBlock, Q as AccessOptions, R as setPublishedAt, S as showcaseContentBlocks, T as languageOptions, U as buildCmsConfig, V as draftsWithAutosave, W as Overrides, X as applyGlobalOverride, Y as applyCollectionOverride, Z as AccessHelpers, _ as requireEnvAtRuntime, a as createChangelog, b as blogContentBlocks, c as createPages, d as createAuthors, f as createMedia, g as createS3MediaPlugin, h as CreateS3MediaPluginOptions, i as createEventTags, j as videoBlock, k as stepsBlock, l as createBlogPosts, m as createUsers, n as createSiteSettings, o as createChangelogTags, p as createApiTokens, q as CollectionOverride, r as createEvents, s as createLegalPages, t as createAnnouncementBanner, u as createCategories, v as getRichTextEditorConfig, w as defaultCodeLanguage, x as pageContentBlocks, y as richTextEditor, z as slugify } from "../index.mjs";
+import { $ as createAccessHelpers, A as downloadCtaBlock, B as seoFields, C as codeBlockLanguages, D as sectionHeadingBlock, E as leafBlocks, F as richTextBlock, G as STOCK_COLLECTION_SLUGS, H as BuildCmsConfigOptions, I as coerceBlogPostCategoriesOnRead, J as GlobalOverride, K as StockCollectionSlug, L as coerceBlogPostCategoriesOnWrite, M as imageBlock, N as codeTabsBlock, O as accordionBlock, P as codeBlock, Q as AccessOptions, R as setPublishedAt, S as showcaseContentBlocks, T as languageOptions, U as buildCmsConfig, V as draftsWithAutosave, W as Overrides, X as applyGlobalOverride, Y as applyCollectionOverride, Z as AccessHelpers, _ as requireEnvAtRuntime, _t as writeAccess, a as createChangelog, at as RoleRule, b as blogContentBlocks, c as createPages, ct as collectionRoleRule, d as createAuthors, dt as hiddenUnless, et as ADMIN_ROLE, f as createMedia, ft as isCmsAdmin, g as createS3MediaPlugin, gt as withRoles, h as CreateS3MediaPluginOptions, ht as userHasAnyRole, i as createEventTags, it as RoleOption, j as videoBlock, k as stepsBlock, l as createBlogPosts, lt as effectiveRoles, m as createUsers, mt as resolveRoleOptions, n as createSiteSettings, nt as DEFAULT_GLOBAL_ROLES, o as createChangelogTags, ot as RolesOptions, p as createApiTokens, pt as publishedOrRoleRead, q as CollectionOverride, r as createEvents, rt as DEFAULT_ROLES, s as createLegalPages, st as adminRoleAccess, t as createAnnouncementBanner, tt as DEFAULT_COLLECTION_ROLES, u as createCategories, ut as globalRoleRule, v as getRichTextEditorConfig, w as defaultCodeLanguage, x as pageContentBlocks, y as richTextEditor, z as slugify } from "../index.mjs";
 import { n as readPayloadMediaAsDataUrl, r as readPayloadMediaBuffer, t as PayloadMedia } from "../readMediaBuffer.mjs";
-export { type AccessHelpers, type AccessOptions, type BuildCmsConfigOptions, type CollectionOverride, type CreateS3MediaPluginOptions, type GlobalOverride, type Overrides, type PayloadMedia, STOCK_COLLECTION_SLUGS, type StockCollectionSlug, accordionBlock, applyCollectionOverride, applyGlobalOverride, blogContentBlocks, buildCmsConfig, codeBlock, codeBlockLanguages, codeTabsBlock, coerceBlogPostCategoriesOnRead, coerceBlogPostCategoriesOnWrite, createAccessHelpers, createAnnouncementBanner, createApiTokens, createAuthors, createBlogPosts, createCategories, createChangelog, createChangelogTags, createEventTags, createEvents, createLegalPages, createMedia, createPages, createS3MediaPlugin, createSiteSettings, createUsers, defaultCodeLanguage, downloadCtaBlock, draftsWithAutosave, getRichTextEditorConfig, imageBlock, languageOptions, leafBlocks, pageContentBlocks, readPayloadMediaAsDataUrl, readPayloadMediaBuffer, requireEnvAtRuntime, richTextBlock, richTextEditor, sectionHeadingBlock, seoFields, setPublishedAt, showcaseContentBlocks, slugify, stepsBlock, videoBlock };
+export { ADMIN_ROLE, type AccessHelpers, type AccessOptions, type BuildCmsConfigOptions, type CollectionOverride, type CreateS3MediaPluginOptions, DEFAULT_COLLECTION_ROLES, DEFAULT_GLOBAL_ROLES, DEFAULT_ROLES, type GlobalOverride, type Overrides, type PayloadMedia, type RoleOption, type RoleRule, type RolesOptions, STOCK_COLLECTION_SLUGS, type StockCollectionSlug, accordionBlock, adminRoleAccess, applyCollectionOverride, applyGlobalOverride, blogContentBlocks, buildCmsConfig, codeBlock, codeBlockLanguages, codeTabsBlock, coerceBlogPostCategoriesOnRead, coerceBlogPostCategoriesOnWrite, collectionRoleRule, createAccessHelpers, createAnnouncementBanner, createApiTokens, createAuthors, createBlogPosts, createCategories, createChangelog, createChangelogTags, createEventTags, createEvents, createLegalPages, createMedia, createPages, createS3MediaPlugin, createSiteSettings, createUsers, defaultCodeLanguage, downloadCtaBlock, draftsWithAutosave, effectiveRoles, getRichTextEditorConfig, globalRoleRule, hiddenUnless, imageBlock, isCmsAdmin, languageOptions, leafBlocks, pageContentBlocks, publishedOrRoleRead, readPayloadMediaAsDataUrl, readPayloadMediaBuffer, requireEnvAtRuntime, resolveRoleOptions, richTextBlock, richTextEditor, sectionHeadingBlock, seoFields, setPublishedAt, showcaseContentBlocks, slugify, stepsBlock, userHasAnyRole, videoBlock, withRoles, writeAccess };

package/dist/cms/index.mjs

@@ -1,3 +1,3 @@
-import { A as richTextBlock, B as languageOptions, C as blogContentBlocks, D as accordionBlock, E as sectionHeadingBlock, F as downloadCtaBlock, G as createAccessHelpers, H as seoFields, I as codeTabsBlock, L as codeBlock, M as richTextEditor, N as videoBlock, O as leafBlocks, P as imageBlock, R as codeBlockLanguages, S as coerceBlogPostCategoriesOnWrite, T as showcaseContentBlocks, U as slugify, V as createAuthors, W as createApiTokens, _ as createCategories, a as STOCK_COLLECTION_SLUGS, b as setPublishedAt, c as createSiteSettings, d as createPages, f as createMedia, g as createChangelog, h as createChangelogTags, i as buildCmsConfig, j as getRichTextEditorConfig, k as stepsBlock, l as createUsers, m as createEventTags, n as createS3MediaPlugin, o as applyCollectionOverride, p as createEvents, r as requireEnvAtRuntime, s as applyGlobalOverride, t as createAnnouncementBanner, u as createLegalPages, v as createBlogPosts, w as pageContentBlocks, x as coerceBlogPostCategoriesOnRead, y as draftsWithAutosave, z as defaultCodeLanguage } from "../cms.mjs";
+import { $ as hiddenUnless, A as richTextBlock, B as languageOptions, C as blogContentBlocks, D as accordionBlock, E as sectionHeadingBlock, F as downloadCtaBlock, G as ADMIN_ROLE, H as seoFields, I as codeTabsBlock, J as DEFAULT_ROLES, K as DEFAULT_COLLECTION_ROLES, L as codeBlock, M as richTextEditor, N as videoBlock, O as leafBlocks, P as imageBlock, Q as globalRoleRule, R as codeBlockLanguages, S as coerceBlogPostCategoriesOnWrite, T as showcaseContentBlocks, U as slugify, V as createAuthors, W as createApiTokens, X as collectionRoleRule, Y as adminRoleAccess, Z as effectiveRoles, _ as createCategories, a as STOCK_COLLECTION_SLUGS, at as writeAccess, b as setPublishedAt, c as createSiteSettings, d as createPages, et as isCmsAdmin, f as createMedia, g as createChangelog, h as createChangelogTags, i as buildCmsConfig, it as withRoles, j as getRichTextEditorConfig, k as stepsBlock, l as createUsers, m as createEventTags, n as createS3MediaPlugin, nt as resolveRoleOptions, o as applyCollectionOverride, ot as createAccessHelpers, p as createEvents, q as DEFAULT_GLOBAL_ROLES, r as requireEnvAtRuntime, rt as userHasAnyRole, s as applyGlobalOverride, t as createAnnouncementBanner, tt as publishedOrRoleRead, u as createLegalPages, v as createBlogPosts, w as pageContentBlocks, x as coerceBlogPostCategoriesOnRead, y as draftsWithAutosave, z as defaultCodeLanguage } from "../cms.mjs";
 import { n as readPayloadMediaBuffer, t as readPayloadMediaAsDataUrl } from "../readMediaBuffer.mjs";
-export { STOCK_COLLECTION_SLUGS, accordionBlock, applyCollectionOverride, applyGlobalOverride, blogContentBlocks, buildCmsConfig, codeBlock, codeBlockLanguages, codeTabsBlock, coerceBlogPostCategoriesOnRead, coerceBlogPostCategoriesOnWrite, createAccessHelpers, createAnnouncementBanner, createApiTokens, createAuthors, createBlogPosts, createCategories, createChangelog, createChangelogTags, createEventTags, createEvents, createLegalPages, createMedia, createPages, createS3MediaPlugin, createSiteSettings, createUsers, defaultCodeLanguage, downloadCtaBlock, draftsWithAutosave, getRichTextEditorConfig, imageBlock, languageOptions, leafBlocks, pageContentBlocks, readPayloadMediaAsDataUrl, readPayloadMediaBuffer, requireEnvAtRuntime, richTextBlock, richTextEditor, sectionHeadingBlock, seoFields, setPublishedAt, showcaseContentBlocks, slugify, stepsBlock, videoBlock };
+export { ADMIN_ROLE, DEFAULT_COLLECTION_ROLES, DEFAULT_GLOBAL_ROLES, DEFAULT_ROLES, STOCK_COLLECTION_SLUGS, accordionBlock, adminRoleAccess, applyCollectionOverride, applyGlobalOverride, blogContentBlocks, buildCmsConfig, codeBlock, codeBlockLanguages, codeTabsBlock, coerceBlogPostCategoriesOnRead, coerceBlogPostCategoriesOnWrite, collectionRoleRule, createAccessHelpers, createAnnouncementBanner, createApiTokens, createAuthors, createBlogPosts, createCategories, createChangelog, createChangelogTags, createEventTags, createEvents, createLegalPages, createMedia, createPages, createS3MediaPlugin, createSiteSettings, createUsers, defaultCodeLanguage, downloadCtaBlock, draftsWithAutosave, effectiveRoles, getRichTextEditorConfig, globalRoleRule, hiddenUnless, imageBlock, isCmsAdmin, languageOptions, leafBlocks, pageContentBlocks, publishedOrRoleRead, readPayloadMediaAsDataUrl, readPayloadMediaBuffer, requireEnvAtRuntime, resolveRoleOptions, richTextBlock, richTextEditor, sectionHeadingBlock, seoFields, setPublishedAt, showcaseContentBlocks, slugify, stepsBlock, userHasAnyRole, videoBlock, withRoles, writeAccess };

package/dist/cms.mjs

@@ -30,6 +30,370 @@ function createAccessHelpers(options = {}) {
 	};
 }
 //#endregion
+//#region src/cms/shared/roles.ts
+const ADMIN_ROLE = "admin";
+const CMS_ROLES_SLUG = "cms-roles";
+const moderator = ["moderator"];
+const developer = ["developer"];
+const moderatorAndDeveloper = ["moderator", "developer"];
+const DEFAULT_ROLES = [
+	{
+		label: "Admin",
+		value: ADMIN_ROLE
+	},
+	{
+		label: "Moderator",
+		value: "moderator"
+	},
+	{
+		label: "Developer",
+		value: "developer"
+	}
+];
+const DEFAULT_COLLECTION_ROLES = {
+	"api-tokens": false,
+	"media": { roles: moderatorAndDeveloper },
+	"authors": { roles: moderator },
+	"categories": { roles: moderator },
+	"blog-posts": {
+		roles: moderator,
+		drafts: true
+	},
+	"pages": {
+		roles: moderator,
+		drafts: true
+	},
+	"legal-pages": {
+		roles: moderator,
+		drafts: true
+	},
+	"changelog-tags": { roles: developer },
+	"changelog": {
+		roles: developer,
+		drafts: true
+	},
+	"event-tags": { roles: moderator },
+	"events": {
+		roles: moderator,
+		drafts: true
+	}
+};
+const DEFAULT_GLOBAL_ROLES = {
+	"site-settings": false,
+	"announcement-banner": { roles: moderator }
+};
+let roleCache = null;
+function asCmsUser(user) {
+	if (!user || typeof user !== "object") return null;
+	const record = user;
+	if (record.collection !== "users") return null;
+	return record;
+}
+function roleRefs(roles) {
+	if (!Array.isArray(roles)) return {
+		ids: [],
+		slugs: []
+	};
+	const ids = [];
+	const slugs = [];
+	roles.forEach((role) => {
+		if (typeof role === "string" || typeof role === "number") {
+			const value = String(role);
+			if (/^[a-f0-9]{24}$/i.test(value)) ids.push(value);
+			else if (value) slugs.push(value);
+			return;
+		}
+		if (role && typeof role === "object" && "id" in role && role.id != null) ids.push(String(role.id));
+	});
+	return {
+		ids,
+		slugs
+	};
+}
+function readPermissions(value) {
+	if (!Array.isArray(value)) return [];
+	return value.flatMap((entry) => {
+		if (!entry || typeof entry !== "object" || !("target" in entry)) return [];
+		const row = entry;
+		if (!row.target) return [];
+		return [{
+			target: row.target,
+			create: Boolean(row.create),
+			update: Boolean(row.update),
+			delete: Boolean(row.delete),
+			drafts: Boolean(row.drafts)
+		}];
+	});
+}
+async function refreshRoleCache(payload) {
+	const found = await payload.find({
+		collection: CMS_ROLES_SLUG,
+		depth: 0,
+		limit: 500,
+		pagination: false,
+		overrideAccess: true
+	});
+	const byId = /* @__PURE__ */ new Map();
+	const bySlug = /* @__PURE__ */ new Map();
+	found.docs.forEach((doc) => {
+		const record = doc;
+		if (!record.slug) return;
+		const role = {
+			id: String(record.id),
+			name: record.name ?? record.slug,
+			slug: record.slug,
+			fullAccess: Boolean(record.fullAccess) || record.slug === "admin",
+			permissions: readPermissions(record.permissions)
+		};
+		byId.set(role.id, role);
+		bySlug.set(role.slug, role);
+	});
+	roleCache = {
+		byId,
+		bySlug
+	};
+}
+async function ensureRoleCache(payload) {
+	if (!roleCache) await refreshRoleCache(payload);
+	return roleCache ?? {
+		byId: /* @__PURE__ */ new Map(),
+		bySlug: /* @__PURE__ */ new Map()
+	};
+}
+function lookupRoles(refs, cache) {
+	return [...refs.ids.map((id) => cache.byId.get(id)), ...refs.slugs.map((slug) => cache.bySlug.get(slug))].filter((role) => Boolean(role));
+}
+function syncAssignment(user) {
+	const record = asCmsUser(user);
+	if (!record) return "guest";
+	const refs = roleRefs(record.roles);
+	if (refs.ids.length === 0 && refs.slugs.length === 0) return "admin";
+	if (!roleCache) return "unknown";
+	return lookupRoles(refs, roleCache);
+}
+async function loadAssignment(req) {
+	const record = asCmsUser(req.user);
+	if (!record) return "guest";
+	const refs = roleRefs(record.roles);
+	if (refs.ids.length === 0 && refs.slugs.length === 0) return "admin";
+	return lookupRoles(refs, await ensureRoleCache(req.payload));
+}
+function hasPermission(roles, target, action) {
+	if (roles.some((role) => role.fullAccess)) return true;
+	return roles.some((role) => role.permissions.some((permission) => permission.target === target && permission[action]));
+}
+/**
+* `null` means this user has no roles yet and is treated as admin.
+* `true` / `false` is the cached decision. A cold cache returns `null` so the
+* nav stays visible until startup finishes loading roles.
+*/
+function cachedPermission(user, target, action) {
+	const assigned = syncAssignment(user);
+	if (assigned === "guest") return false;
+	if (assigned === "admin") return true;
+	if (assigned === "unknown") return null;
+	return hasPermission(assigned, target, action);
+}
+async function userIsFullAdmin(req) {
+	const assigned = await loadAssignment(req);
+	if (assigned === "guest") return false;
+	if (assigned === "admin") return true;
+	return assigned.some((role) => role.fullAccess);
+}
+async function userCan(req, target, action) {
+	const assigned = await loadAssignment(req);
+	if (assigned === "guest") return false;
+	if (assigned === "admin") return true;
+	return hasPermission(assigned, target, action);
+}
+/**
+* Users created before the roles field existed have none stored.
+* Treat that as admin so turning roles on does not lock the panel.
+*/
+function effectiveRoles(user) {
+	const assigned = syncAssignment(user);
+	if (assigned === "admin") return [ADMIN_ROLE];
+	if (assigned === "guest" || assigned === "unknown") return [];
+	return assigned.map((role) => role.slug);
+}
+function userHasAnyRole(user, roles) {
+	const assigned = effectiveRoles(user);
+	if (assigned.includes("admin")) return true;
+	return roles.some((role) => assigned.includes(role));
+}
+function isCmsAdmin(user) {
+	const assigned = syncAssignment(user);
+	if (assigned === "admin") return true;
+	if (assigned === "guest" || assigned === "unknown") return false;
+	return assigned.some((role) => role.fullAccess);
+}
+const adminRoleAccess = ({ req }) => userIsFullAdmin(req);
+function hiddenUnless(roles) {
+	return ({ user }) => !userHasAnyRole(user, roles);
+}
+function writeAccess(roles) {
+	return ({ req }) => userHasAnyRole(req.user, roles);
+}
+function publishedOrRoleRead(roles) {
+	return ({ req }) => {
+		if (userHasAnyRole(req.user, roles)) return true;
+		return { _status: { equals: "published" } };
+	};
+}
+const selfOrAdminAccess = async ({ req }) => {
+	if (await userIsFullAdmin(req)) return true;
+	const record = asCmsUser(req.user);
+	if (record?.id == null) return false;
+	return { id: { equals: record.id } };
+};
+const manageRolesAccess = ({ req }) => userIsFullAdmin(req);
+function hiddenFor(target) {
+	return ({ user }) => {
+		const create = cachedPermission(user, target, "create");
+		const update = cachedPermission(user, target, "update");
+		const drafts = cachedPermission(user, target, "drafts");
+		if (create == null || update == null || drafts == null) return false;
+		return !(create || update || drafts);
+	};
+}
+function hiddenUnlessFullAdmin() {
+	return ({ user }) => {
+		const assigned = syncAssignment(user);
+		if (assigned === "unknown" || assigned === "admin") return false;
+		if (assigned === "guest") return true;
+		return !assigned.some((role) => role.fullAccess);
+	};
+}
+function resolveRoleOptions(options = {}) {
+	const custom = options.roles?.filter((role) => role.value !== "admin") ?? DEFAULT_ROLES.filter((role) => role.value !== "admin");
+	const merged = /* @__PURE__ */ new Map([[ADMIN_ROLE, {
+		label: "Admin",
+		value: ADMIN_ROLE
+	}]]);
+	[...custom, ...options.extraRoles ?? []].forEach((role) => {
+		if (!role.value || role.value === "admin") return;
+		merged.set(role.value, {
+			label: role.label,
+			value: role.value
+		});
+	});
+	return [...merged.values()];
+}
+function collectionRoleRule(options, slug, fallback) {
+	return roleRule(options, "collections", slug, fallback);
+}
+function globalRoleRule(options, slug, fallback) {
+	return roleRule(options, "globals", slug, fallback);
+}
+function roleRule(options, kind, slug, fallback) {
+	const overrides = (options === true || options == null ? {} : options)[kind];
+	if (overrides && Object.prototype.hasOwnProperty.call(overrides, slug)) return overrides[slug];
+	const defaults = kind === "collections" ? DEFAULT_COLLECTION_ROLES : DEFAULT_GLOBAL_ROLES;
+	if (Object.prototype.hasOwnProperty.call(defaults, slug)) return defaults[slug];
+	return fallback;
+}
+function rolesField() {
+	return {
+		name: "roles",
+		type: "relationship",
+		relationTo: CMS_ROLES_SLUG,
+		hasMany: true,
+		saveToJWT: true,
+		access: {
+			create: manageRolesAccess,
+			update: manageRolesAccess
+		},
+		admin: {
+			position: "sidebar",
+			description: "Only an admin can change roles. Several roles can be combined. Empty means Admin until a role is saved. The user must sign in again before a change applies."
+		}
+	};
+}
+function permissionFor(target, rule, role, collection) {
+	if (rule == null || rule === false || !rule.roles.includes(role)) return null;
+	return {
+		target,
+		create: collection,
+		update: true,
+		delete: false,
+		drafts: collection && rule.drafts === true
+	};
+}
+/** Targets shown in the Roles editor: stock defaults plus anything the app configures. */
+function roleTargetSlugs(options = {}) {
+	const targets = /* @__PURE__ */ new Set([
+		...Object.keys(DEFAULT_COLLECTION_ROLES),
+		...Object.keys(DEFAULT_GLOBAL_ROLES),
+		...Object.keys(options.collections ?? {}),
+		...Object.keys(options.globals ?? {})
+	]);
+	targets.delete("users");
+	targets.delete(CMS_ROLES_SLUG);
+	return [...targets].sort();
+}
+/**
+* Default role documents. Existing documents with the same slug are left alone,
+* so edits made in the admin survive a restart.
+*/
+function buildRoleSeeds(options = {}) {
+	const roles = resolveRoleOptions(options);
+	const targets = roleTargetSlugs(options);
+	return roles.map((role) => {
+		if (role.value === "admin") return {
+			name: role.label,
+			slug: role.value,
+			fullAccess: true,
+			permissions: []
+		};
+		const permissions = targets.flatMap((target) => {
+			const collection = collectionRoleRule(options, target);
+			const global = globalRoleRule(options, target);
+			const row = permissionFor(target, collection !== void 0 ? collection : global, role.value, collection !== void 0);
+			return row ? [row] : [];
+		});
+		return {
+			name: role.label,
+			slug: role.value,
+			fullAccess: false,
+			permissions
+		};
+	});
+}
+function isCollectionConfig(config) {
+	if ("auth" in config || "upload" in config || "labels" in config || "defaultSort" in config) return true;
+	return Boolean(config.access && ("create" in config.access || "delete" in config.access));
+}
+/** Limits create, update, and delete from the Roles collection. Admin is always allowed. */
+function withRoles(config) {
+	const collection = isCollectionConfig(config);
+	const users = collection && Boolean(config.auth);
+	const slug = config.slug;
+	const versioned = "versions" in config && Boolean(config.versions);
+	return {
+		...config,
+		admin: {
+			...config.admin,
+			...users ? { hidden: hiddenUnlessFullAdmin() } : { hidden: hiddenFor(slug) }
+		},
+		access: {
+			...config.access,
+			...collection ? {
+				create: users ? adminRoleAccess : ({ req }) => userCan(req, slug, "create"),
+				delete: users ? adminRoleAccess : ({ req }) => userCan(req, slug, "delete")
+			} : {},
+			...users ? {
+				read: selfOrAdminAccess,
+				update: selfOrAdminAccess
+			} : { update: ({ req }) => userCan(req, slug, "update") },
+			...versioned && !users ? { read: async ({ req }) => {
+				if (await userCan(req, slug, "update") || await userCan(req, slug, "drafts")) return true;
+				return { _status: { equals: "published" } };
+			} } : {}
+		},
+		...users && !(config.fields ?? []).some((field) => "name" in field && field.name === "roles") ? { fields: [...config.fields ?? [], rolesField()] } : {}
+	};
+}
+//#endregion
 //#region src/cms/collections/createApiTokens.ts
 const adminOrSelf = ({ req }) => {
 	if (req.user?.collection === "users") return true;
@@ -96,6 +460,133 @@ function createApiTokens(access) {
 //#region src/cms/hooks/slugify.ts
 const slugify = ({ value }) => typeof value === "string" ? value.toLowerCase().replace(/\s+/g, "-").replace(/[^a-z0-9-]/g, "") : value;
 //#endregion
+//#region src/cms/collections/createCmsRoles.ts
+const refresh = ({ req }) => refreshRoleCache(req.payload);
+const refreshAfterDelete = ({ req }) => refreshRoleCache(req.payload);
+const keepAdminRole = ({ data, originalDoc }) => {
+	if (originalDoc?.slug === "admin" || data?.slug === "admin") return {
+		...data,
+		slug: ADMIN_ROLE,
+		fullAccess: true
+	};
+	return data;
+};
+const blockAdminDelete = async ({ id, req }) => {
+	if ((await req.payload.findByID({
+		collection: "cms-roles",
+		id,
+		depth: 0,
+		overrideAccess: true
+	})).slug === "admin") throw new Error("The Admin role cannot be deleted.");
+};
+const fullAdmin = ({ req }) => userIsFullAdmin(req);
+function createCmsRoles(targets) {
+	return {
+		slug: CMS_ROLES_SLUG,
+		labels: {
+			singular: "Role",
+			plural: "Roles"
+		},
+		admin: {
+			useAsTitle: "name",
+			hidden: hiddenUnlessFullAdmin(),
+			description: "Who can edit each collection and global. Only an admin can change this."
+		},
+		access: {
+			read: fullAdmin,
+			create: fullAdmin,
+			update: fullAdmin,
+			delete: fullAdmin
+		},
+		hooks: {
+			beforeChange: [keepAdminRole],
+			beforeDelete: [blockAdminDelete],
+			afterChange: [refresh],
+			afterDelete: [refreshAfterDelete]
+		},
+		fields: [
+			{
+				name: "name",
+				type: "text",
+				required: true
+			},
+			{
+				name: "slug",
+				type: "text",
+				required: true,
+				unique: true,
+				index: true,
+				hooks: { beforeValidate: [slugify] },
+				admin: { description: "Stable id. Do not change it after users are assigned this role." }
+			},
+			{
+				name: "fullAccess",
+				type: "checkbox",
+				defaultValue: false,
+				admin: { description: "Can edit every collection, including Roles and Users." }
+			},
+			{
+				name: "permissions",
+				type: "array",
+				admin: {
+					condition: (data) => !data?.fullAccess,
+					description: "One row per collection or global. No row means no access."
+				},
+				fields: [
+					{
+						name: "target",
+						type: "select",
+						required: true,
+						options: targets.map((slug) => ({
+							label: slug,
+							value: slug
+						}))
+					},
+					{
+						name: "create",
+						type: "checkbox",
+						defaultValue: false
+					},
+					{
+						name: "update",
+						type: "checkbox",
+						defaultValue: false
+					},
+					{
+						name: "delete",
+						type: "checkbox",
+						defaultValue: false
+					},
+					{
+						name: "drafts",
+						type: "checkbox",
+						defaultValue: false,
+						admin: { description: "Can open unpublished documents. Update also allows this." }
+					}
+				]
+			}
+		]
+	};
+}
+/** Creates each default role once. Documents that already exist are left as edited. */
+async function seedDefaultCmsRoles(payload, options = {}) {
+	const seeds = buildRoleSeeds(options);
+	await Promise.all(seeds.map(async (role) => {
+		if ((await payload.find({
+			collection: "cms-roles",
+			where: { slug: { equals: role.slug } },
+			limit: 1,
+			depth: 0,
+			overrideAccess: true
+		})).docs.length > 0) return;
+		await payload.create({
+			collection: CMS_ROLES_SLUG,
+			data: role,
+			overrideAccess: true
+		});
+	}));
+}
+//#endregion
 //#region src/cms/shared/seo-fields.ts
 const MAX_META_TITLE = 60;
 const MAX_META_DESCRIPTION = 160;
@@ -1693,12 +2184,31 @@ function buildCmsConfig(options) {
 		"event-tags": createEventTags(access),
 		"events": createEvents(access)
 	};
-	const collections = [...STOCK_COLLECTION_SLUGS.map((slug) => applyCollectionOverride(stock[slug], overrides[slug])).filter((c) => c !== null), ...options.extraCollections ?? []];
-	const siteSettings = applyGlobalOverride(createSiteSettings(access), overrides["site-settings"]);
+	const rolesSetting = options.access?.roles;
+	const rolesEnabled = rolesSetting != null;
+	const rolesConfig = rolesSetting === true || rolesSetting == null ? {} : rolesSetting;
+	if (rolesEnabled) Object.keys(stock).forEach((slug) => {
+		stock[slug] = withRoles(stock[slug]);
+	});
+	const collections = [
+		...rolesEnabled ? [createCmsRoles(roleTargetSlugs(rolesConfig))] : [],
+		...STOCK_COLLECTION_SLUGS.map((slug) => applyCollectionOverride(stock[slug], overrides[slug])).filter((c) => c !== null),
+		...options.extraCollections ?? []
+	];
+	const siteSettingsBase = createSiteSettings(access);
+	const siteSettingsWithRoles = rolesEnabled ? withRoles(siteSettingsBase) : siteSettingsBase;
+	const siteSettings = applyGlobalOverride(siteSettingsWithRoles, overrides["site-settings"]);
 	const globals = [...siteSettings ? [siteSettings] : [], ...options.extraGlobals ?? []];
-	const { jobs: jobsOverride, ...payloadRest } = options.payload ?? {};
+	const { jobs: jobsOverride, onInit: callerOnInit, ...payloadRest } = options.payload ?? {};
 	return buildConfig({
 		...payloadRest,
+		onInit: async (payload) => {
+			if (rolesEnabled) {
+				await seedDefaultCmsRoles(payload, rolesConfig);
+				await refreshRoleCache(payload);
+			}
+			if (callerOnInit) await callerOnInit(payload);
+		},
 		jobs: {
 			autoRun: [{ cron: "* * * * *" }],
 			...jobsOverride
@@ -1843,6 +2353,6 @@ function createAnnouncementBanner(access) {
 	};
 }
 //#endregion
-export { richTextBlock as A, languageOptions as B, blogContentBlocks as C, accordionBlock as D, sectionHeadingBlock as E, downloadCtaBlock as F, createAccessHelpers as G, seoFields as H, codeTabsBlock as I, codeBlock as L, richTextEditor as M, videoBlock as N, leafBlocks as O, imageBlock as P, codeBlockLanguages as R, coerceBlogPostCategoriesOnWrite as S, showcaseContentBlocks as T, slugify as U, createAuthors as V, createApiTokens as W, createCategories as _, STOCK_COLLECTION_SLUGS as a, setPublishedAt as b, createSiteSettings as c, createPages as d, createMedia as f, createChangelog as g, createChangelogTags as h, buildCmsConfig as i, getRichTextEditorConfig as j, stepsBlock as k, createUsers as l, createEventTags as m, createS3MediaPlugin as n, applyCollectionOverride as o, createEvents as p, requireEnvAtRuntime as r, applyGlobalOverride as s, createAnnouncementBanner as t, createLegalPages as u, createBlogPosts as v, pageContentBlocks as w, coerceBlogPostCategoriesOnRead as x, draftsWithAutosave as y, defaultCodeLanguage as z };
+export { hiddenUnless as $, richTextBlock as A, languageOptions as B, blogContentBlocks as C, accordionBlock as D, sectionHeadingBlock as E, downloadCtaBlock as F, ADMIN_ROLE as G, seoFields as H, codeTabsBlock as I, DEFAULT_ROLES as J, DEFAULT_COLLECTION_ROLES as K, codeBlock as L, richTextEditor as M, videoBlock as N, leafBlocks as O, imageBlock as P, globalRoleRule as Q, codeBlockLanguages as R, coerceBlogPostCategoriesOnWrite as S, showcaseContentBlocks as T, slugify as U, createAuthors as V, createApiTokens as W, collectionRoleRule as X, adminRoleAccess as Y, effectiveRoles as Z, createCategories as _, STOCK_COLLECTION_SLUGS as a, writeAccess as at, setPublishedAt as b, createSiteSettings as c, createPages as d, isCmsAdmin as et, createMedia as f, createChangelog as g, createChangelogTags as h, buildCmsConfig as i, withRoles as it, getRichTextEditorConfig as j, stepsBlock as k, createUsers as l, createEventTags as m, createS3MediaPlugin as n, resolveRoleOptions as nt, applyCollectionOverride as o, createAccessHelpers as ot, createEvents as p, DEFAULT_GLOBAL_ROLES as q, requireEnvAtRuntime as r, userHasAnyRole as rt, applyGlobalOverride as s, createAnnouncementBanner as t, publishedOrRoleRead as tt, createLegalPages as u, createBlogPosts as v, pageContentBlocks as w, coerceBlogPostCategoriesOnRead as x, draftsWithAutosave as y, defaultCodeLanguage as z };
 
 //# sourceMappingURL=cms.mjs.map