@tinacms/graphql 3.0.0 → 4.0.0

package/dist/database/index.d.ts

@@ -20,6 +20,16 @@ export interface DatabaseArgs {
     version?: boolean;
     namespace?: string;
     levelBatchSize?: number;
+    authCollection?: AuthCollectionOptions;
+}
+export interface AuthCollectionOptions {
+    /** Values of the uid field of users who can edit the auth collection. */
+    admins?: string[];
+    /**
+     * Allow writes to the auth collection from calls that pass no ctxUser.
+     * A null ctxUser means nobody is signed in, and is still refused.
+     */
+    allowUnauthenticatedWrites?: boolean;
 }
 export interface GitProvider {
     onPut: (key: string, value: string) => Promise<void>;
@@ -47,6 +57,10 @@ export type CreateLocalDatabaseArgs = Omit<DatabaseArgs, 'level'> & {
 };
 export declare const createLocalDatabase: (config?: CreateLocalDatabaseArgs) => Database;
 export declare const createDatabase: (config: CreateDatabase) => Database;
+/**
+ * Builds a database for CLI tooling and tests. It trusts requests without a
+ * user, so do not use it for a public endpoint. Use `createDatabase` instead.
+ */
 export declare const createDatabaseInternal: (config: DatabaseArgs) => Database;
 /** Options for {@link Database.query} **/
 export type QueryOptions = {
@@ -71,6 +85,10 @@ export declare class Database {
     private readonly onPut;
     private readonly onDelete;
     private readonly levelBatchSize;
+    readonly authCollection: Readonly<{
+        admins: readonly string[];
+        allowUnauthenticatedWrites: boolean;
+    }>;
     private tinaSchema;
     private contentNamespace;
     private collectionIndexDefinitions;

package/dist/index.js

@@ -3058,7 +3058,7 @@ var assertCheckboxGroupIsList = (field) => {
 var package_default = {
   name: "@tinacms/graphql",
   type: "module",
-  version: "3.0.0",
+  version: "4.0.0",
   main: "dist/index.js",
   module: "./dist/index.js",
   files: [
@@ -3348,7 +3348,7 @@ import {
 } from "graphql";
 
 // src/resolver/index.ts
-import path3 from "path";
+import path4 from "path";
 import { isValid } from "date-fns";
 import { JSONPath as JSONPath2 } from "jsonpath-plus";
 
@@ -4683,6 +4683,170 @@ var collectConditionsForField = (fieldName, field, filterNode, pathExpression, c
   }
 };
 
+// src/resolver/auth-fields.ts
+import { randomBytes } from "crypto";
+import path3 from "path";
+async function getUserDocumentContext(tinaSchema, resolver) {
+  const collection = tinaSchema.getCollections().find((c) => c.isAuthCollection);
+  if (!collection) {
+    throw new Error("Auth collection not found");
+  }
+  const userFields = mapUserFields(collection, ["_rawData"]);
+  if (!userFields.length) {
+    throw new Error(`No user field found in collection ${collection.name}`);
+  }
+  if (userFields.length > 1) {
+    throw new Error(
+      `Multiple user fields found in collection ${collection.name}`
+    );
+  }
+  const userField = userFields[0];
+  const relativePath = "index.json";
+  const realPath = path3.join(collection.path, relativePath);
+  const userDoc = await resolver.getDocument(realPath);
+  const users = get(userDoc, userField.path);
+  if (!users) {
+    throw new Error("No users found");
+  }
+  return { collection, userField, users, userDoc, relativePath };
+}
+function findUserInCollection(users, userField, userSub) {
+  const { idFieldName } = userField;
+  if (!idFieldName) {
+    throw new Error("No uid field found on user field");
+  }
+  return users.find((u) => u[idFieldName] === userSub) || null;
+}
+function withoutPasswordValue(user, userField) {
+  const { passwordFieldName } = userField;
+  if (!passwordFieldName) {
+    return user;
+  }
+  return {
+    ...user,
+    [passwordFieldName]: {
+      passwordChangeRequired: user[passwordFieldName]?.passwordChangeRequired ?? false
+    }
+  };
+}
+var dummyPasswordHash;
+var warnedUnflaggedAuthenticate = false;
+var getDummyPasswordHash = () => {
+  dummyPasswordHash ??= generatePasswordHash({
+    password: randomBytes(32).toString("hex")
+  });
+  return dummyPasswordHash;
+};
+function assertNewUsersHavePasswords(collection, newBody, existingData) {
+  const userFields = mapUserFields(collection);
+  if (userFields.length !== 1) {
+    return;
+  }
+  const [{ path: usersPath, idFieldName, passwordFieldName }] = userFields;
+  const users = get(newBody, usersPath);
+  if (!Array.isArray(users) || !idFieldName || !passwordFieldName) {
+    return;
+  }
+  const storedUsers = get(existingData, usersPath);
+  const storedIds = new Set(
+    (Array.isArray(storedUsers) ? storedUsers : []).map((u) => u?.[idFieldName])
+  );
+  const withoutPassword = users.filter(
+    (u) => !storedIds.has(u?.[idFieldName]) && !u?.[passwordFieldName]?.["value"]
+  ).map((u) => u?.[idFieldName]);
+  if (withoutPassword.length) {
+    throw new Error(`New users need a password: ${withoutPassword.join(", ")}`);
+  }
+}
+async function handleAuthenticate({
+  tinaSchema,
+  resolver,
+  sub,
+  password,
+  isSignIn
+}) {
+  if (!isSignIn) {
+    if (!warnedUnflaggedAuthenticate) {
+      warnedUnflaggedAuthenticate = true;
+      console.warn(
+        "TinaCMS: authenticate was called without isSignIn, so it returned null. If sign-in is failing, run `tinacms build` with a @tinacms/cli that matches @tinacms/datalayer to regenerate the database client."
+      );
+    }
+    return null;
+  }
+  const { userField, users } = await getUserDocumentContext(
+    tinaSchema,
+    resolver
+  );
+  const user = sub ? findUserInCollection(users, userField, sub) : null;
+  const { passwordFieldName } = userField;
+  const saltedHash = user ? get(user, [passwordFieldName || "", "value"]) : void 0;
+  if (!saltedHash) {
+    await checkPasswordHash({
+      saltedHash: await getDummyPasswordHash(),
+      password: password ?? ""
+    });
+    return null;
+  }
+  const matches = await checkPasswordHash({
+    saltedHash,
+    password
+  });
+  return matches ? withoutPasswordValue(user, userField) : null;
+}
+async function handleAuthorize({
+  tinaSchema,
+  resolver,
+  sub,
+  ctxUser
+}) {
+  const userSub = sub || ctxUser?.sub;
+  const { userField, users } = await getUserDocumentContext(
+    tinaSchema,
+    resolver
+  );
+  const user = findUserInCollection(users, userField, userSub);
+  return user ? withoutPasswordValue(user, userField) : null;
+}
+async function handleUpdatePassword({
+  tinaSchema,
+  resolver,
+  password,
+  ctxUser
+}) {
+  if (!ctxUser?.sub) {
+    throw new Error("Not authorized");
+  }
+  if (!password) {
+    throw new Error("No password provided");
+  }
+  const { userField, users } = await getUserDocumentContext(
+    tinaSchema,
+    resolver
+  );
+  const { idFieldName, passwordFieldName } = userField;
+  if (!passwordFieldName) {
+    throw new Error("No password field found on user field");
+  }
+  if (!users.find((u) => u[idFieldName] === ctxUser.sub)) {
+    throw new Error("Not authorized");
+  }
+  const passwordHash = await generatePasswordHash({ password });
+  await resolver.updateAuthDocumentInternal((rawData) => {
+    const storedUsers = get(rawData, userField.path.slice(1));
+    const user = Array.isArray(storedUsers) ? storedUsers.find((u) => u[idFieldName] === ctxUser.sub) : void 0;
+    if (!user) {
+      throw new Error("Not authorized");
+    }
+    user[passwordFieldName] = {
+      value: passwordHash,
+      passwordChangeRequired: false
+    };
+    return rawData;
+  });
+  return true;
+}
+
 // src/resolver/media-utils.ts
 var resolveMediaCloudToRelative = (value, config = { useRelativeMedia: true }, schema) => {
   if (config && value) {
@@ -4764,6 +4928,7 @@ var hasTinaMediaConfig = (schema) => {
 };
 
 // src/resolver/index.ts
+var authCollectionWrites = /* @__PURE__ */ new WeakMap();
 var createResolver = (args) => {
   return new Resolver(args);
 };
@@ -4903,7 +5068,7 @@ var transformDocumentIntoPayload = async (fullPath, rawData, tinaSchema, config,
       base: basename,
       ext: extension,
       name: filename
-    } = path3.parse(normalizedPath);
+    } = path4.parse(normalizedPath);
     const relativePath = normalizedPath.replace(collection.path, "").replace(/^\/|\/$/g, "");
     const breadcrumbs = relativePath.replace(extension, "").split("/");
     const data = {
@@ -5000,12 +5165,14 @@ var Resolver = class _Resolver {
     this.database = init.database;
     this.tinaSchema = init.tinaSchema;
     this.isAudit = init.isAudit;
+    this.ctxUser = init.ctxUser;
   }
   init;
   config;
   database;
   tinaSchema;
   isAudit;
+  ctxUser;
   resolveCollection = async (_args, collectionName, hasDocuments) => {
     const collection = this.tinaSchema.getCollection(collectionName);
     const extraFields = {};
@@ -5182,6 +5349,11 @@ var Resolver = class _Resolver {
       collectionName,
       relativePath
     );
+    await this.assertAuthCollectionWrite({
+      collection,
+      realPath,
+      op: "addPending"
+    });
     const alreadyExists = await this.database.documentExists(realPath);
     if (alreadyExists) {
       throw new Error(
@@ -5297,19 +5469,19 @@ var Resolver = class _Resolver {
     if (fullPath.includes("\0")) {
       throw new Error("Invalid path: null bytes are not allowed");
     }
-    const normalizedPath = path3.normalize(fullPath.replace(/\\/g, "/"));
-    const normalizedCollectionPath = path3.normalize(collection.path);
-    const relative = path3.relative(normalizedCollectionPath, normalizedPath);
+    const normalizedPath = path4.normalize(fullPath.replace(/\\/g, "/"));
+    const normalizedCollectionPath = path4.normalize(collection.path);
+    const relative = path4.relative(normalizedCollectionPath, normalizedPath);
     if (relative.startsWith("..")) {
       throw new Error(`Invalid path: path escapes the collection directory`);
     }
-    if (path3.isAbsolute(relative)) {
+    if (path4.isAbsolute(relative)) {
       throw new Error(`Invalid path: absolute paths are not allowed`);
     }
     if (relativePath) {
       _Resolver.validateRelativePath(relativePath);
       const collectionFormat = collection.format || "md";
-      const fileExtension = path3.extname(relativePath).toLowerCase().slice(1);
+      const fileExtension = path4.extname(relativePath).toLowerCase().slice(1);
       if (fileExtension !== collectionFormat) {
         throw new Error(
           `Invalid file extension: expected '.${collectionFormat}' but got '.${fileExtension}'`
@@ -5317,6 +5489,81 @@ var Resolver = class _Resolver {
       }
     }
   };
+  assertAuthCollectionWrite = async ({
+    collection,
+    realPath,
+    op
+  }) => {
+    const authCollection = this.tinaSchema.getCollections().find((c) => c.isAuthCollection);
+    if (!authCollection) {
+      return;
+    }
+    const normalizedPath = normalizePath2(realPath);
+    if (collection.name !== authCollection.name && !this.isStoredInCollection(normalizedPath, authCollection)) {
+      return;
+    }
+    const { admins, allowUnauthenticatedWrites } = this.database.authCollection ?? { admins: [], allowUnauthenticatedWrites: true };
+    if (this.ctxUser === void 0 && allowUnauthenticatedWrites) {
+      return;
+    }
+    const sub = this.ctxUser?.sub;
+    const userStorePath = normalizePath2(
+      path4.join(authCollection.path, "index.json")
+    );
+    if (op === "update" && normalizedPath === userStorePath && typeof sub === "string" && sub !== "" && admins.includes(sub) && await this.isStoredUser(sub)) {
+      return;
+    }
+    throw new Error("Not authorized");
+  };
+  assertReferenceUpdates = async (realPath, collection) => {
+    if (!this.tinaSchema.getCollections().some((c) => c.isAuthCollection)) {
+      return;
+    }
+    const collRefs = await this.findReferences(realPath, collection);
+    for (const docsWithRefs of Object.values(collRefs)) {
+      for (const pathToDocWithRef of Object.keys(docsWithRefs)) {
+        await this.assertAuthCollectionWrite({
+          collection: this.tinaSchema.getCollectionByFullPath(pathToDocWithRef),
+          realPath: pathToDocWithRef,
+          op: "update"
+        });
+      }
+    }
+  };
+  isAuthCollectionPath = (realPath) => {
+    const authCollection = this.tinaSchema.getCollections().find((c) => c.isAuthCollection);
+    return !!authCollection && this.isStoredInCollection(normalizePath2(realPath), authCollection);
+  };
+  withAuthCollectionLock = (realPath, write) => {
+    if (!this.isAuthCollectionPath(realPath)) {
+      return write();
+    }
+    const previous = authCollectionWrites.get(this.database);
+    const current = previous ? previous.then(write, write) : write();
+    authCollectionWrites.set(
+      this.database,
+      current.catch(() => void 0)
+    );
+    return current;
+  };
+  isStoredInCollection = (realPath, collection) => {
+    try {
+      return this.tinaSchema.getCollectionByFullPath(realPath)?.name === collection.name;
+    } catch {
+      return false;
+    }
+  };
+  isStoredUser = async (sub) => {
+    try {
+      const { userField, users } = await getUserDocumentContext(
+        this.tinaSchema,
+        this
+      );
+      return Array.isArray(users) && !!findUserInCollection(users, userField, sub);
+    } catch {
+      return false;
+    }
+  };
   /**
    * Helper method to get collection and construct validated path.
    * This encapsulates the common pattern of getting a collection, joining paths,
@@ -5337,7 +5584,7 @@ var Resolver = class _Resolver {
     if (options?.extraSegments) {
       pathSegments.push(...options.extraSegments.map(_Resolver.sanitizePath));
     }
-    const realPath = normalizePath2(path3.join(...pathSegments));
+    const realPath = normalizePath2(path4.join(...pathSegments));
     const shouldValidateExtension = options?.validateExtension !== false;
     this.validatePath(
       realPath,
@@ -5371,12 +5618,17 @@ var Resolver = class _Resolver {
   }) => {
     const collection = this.getCollectionWithName(collectionName);
     _Resolver.validateRelativePath(relativePath);
-    const realPath = path3.join(
+    const realPath = path4.join(
       collection.path,
       relativePath,
       `.gitkeep.${collection.format || "md"}`
     );
     this.validatePath(realPath, collection);
+    await this.assertAuthCollectionWrite({
+      collection,
+      realPath,
+      op: "createFolder"
+    });
     const alreadyExists = await this.database.documentExists(realPath);
     if (alreadyExists) {
       throw new Error(
@@ -5399,6 +5651,11 @@ var Resolver = class _Resolver {
       collectionName,
       relativePath
     );
+    await this.assertAuthCollectionWrite({
+      collection,
+      realPath,
+      op: "create"
+    });
     const alreadyExists = await this.database.documentExists(realPath);
     if (alreadyExists) {
       throw new Error(
@@ -5409,7 +5666,17 @@ var Resolver = class _Resolver {
     await this.database.put(realPath, params, collection.name);
     return this.getDocument(realPath);
   };
-  resolveUpdateDocument = async ({
+  resolveUpdateDocument = async (args) => {
+    const { realPath } = this.getValidatedPath(
+      args.collectionName,
+      args.relativePath
+    );
+    return this.withAuthCollectionLock(
+      realPath,
+      () => this.updateDocument(args)
+    );
+  };
+  updateDocument = async ({
     collectionName,
     relativePath,
     newRelativePath,
@@ -5419,6 +5686,13 @@ var Resolver = class _Resolver {
       collectionName,
       relativePath
     );
+    if (!newRelativePath) {
+      await this.assertAuthCollectionWrite({
+        collection,
+        realPath,
+        op: "update"
+      });
+    }
     const alreadyExists = await this.database.documentExists(realPath);
     if (!alreadyExists) {
       throw new Error(`Unable to update document, ${realPath} does not exist`);
@@ -5438,38 +5712,53 @@ var Resolver = class _Resolver {
           `Unable to rename document, ${newRealPath} ${ERR_ALREADY_EXISTS}`
         );
       }
+      await this.assertAuthCollectionWrite({
+        collection,
+        realPath,
+        op: "rename"
+      });
+      await this.assertAuthCollectionWrite({
+        collection,
+        realPath: newRealPath,
+        op: "rename"
+      });
+      await this.assertReferenceUpdates(realPath, collection);
       await this.database.put(newRealPath, doc._rawData, collection.name);
       await this.deleteDocument(realPath);
       const collRefs = await this.findReferences(realPath, collection);
+      const holdsLock = this.isAuthCollectionPath(realPath);
       for (const [_collection, docsWithRefs] of Object.entries(collRefs)) {
         for (const [pathToDocWithRef, referencePaths] of Object.entries(
           docsWithRefs
         )) {
-          let docWithRef = await this.getRaw(pathToDocWithRef);
-          let hasUpdate = false;
-          for (const path9 of referencePaths) {
-            const { object: object2, updated } = updateObjectWithJsonPath(
-              docWithRef,
-              path9,
-              realPath,
-              newRealPath
-            );
-            docWithRef = object2;
-            hasUpdate = updated || hasUpdate;
-          }
-          if (hasUpdate) {
-            const collectionWithRef = this.tinaSchema.getCollectionByFullPath(pathToDocWithRef);
-            if (!collectionWithRef) {
-              throw new Error(
-                `Unable to find collection for ${pathToDocWithRef}`
+          const rewriteReferences = async () => {
+            let docWithRef = await this.getRaw(pathToDocWithRef);
+            let hasUpdate = false;
+            for (const path9 of referencePaths) {
+              const { object: object2, updated } = updateObjectWithJsonPath(
+                docWithRef,
+                path9,
+                realPath,
+                newRealPath
               );
+              docWithRef = object2;
+              hasUpdate = updated || hasUpdate;
             }
-            await this.database.put(
-              pathToDocWithRef,
-              docWithRef,
-              collectionWithRef.name
-            );
-          }
+            if (hasUpdate) {
+              const collectionWithRef = this.tinaSchema.getCollectionByFullPath(pathToDocWithRef);
+              if (!collectionWithRef) {
+                throw new Error(
+                  `Unable to find collection for ${pathToDocWithRef}`
+                );
+              }
+              await this.database.put(
+                pathToDocWithRef,
+                docWithRef,
+                collectionWithRef.name
+              );
+            }
+          };
+          await (holdsLock ? rewriteReferences() : this.withAuthCollectionLock(pathToDocWithRef, rewriteReferences));
         }
       }
       return this.getDocument(newRealPath);
@@ -5477,6 +5766,9 @@ var Resolver = class _Resolver {
     if (!newBody) {
       throw new Error("Body not provided for updated document.");
     }
+    if (collection.isAuthCollection) {
+      assertNewUsersHavePasswords(collection, newBody, doc?._rawData);
+    }
     const params = await this.buildObjectMutations(
       newBody,
       collection,
@@ -5493,6 +5785,21 @@ var Resolver = class _Resolver {
     );
     return this.getDocument(realPath);
   };
+  /**
+   * Rewrites the auth collection's user store without the admin check, so the
+   * caller must check the request user.
+   */
+  updateAuthDocumentInternal = async (update) => {
+    const collection = this.tinaSchema.getCollections().find((c) => c.isAuthCollection);
+    if (!collection) {
+      throw new Error("Auth collection not found");
+    }
+    const { realPath } = this.getValidatedPath(collection.name, "index.json");
+    await this.withAuthCollectionLock(realPath, async () => {
+      const rawData = await this.getRaw(realPath);
+      await this.database.put(realPath, update(rawData), collection.name);
+    });
+  };
   resolveDeleteDocument = async ({
     collectionName,
     relativePath
@@ -5505,39 +5812,50 @@ var Resolver = class _Resolver {
     if (!alreadyExists) {
       throw new Error(`Unable to delete document, ${realPath} does not exist`);
     }
+    await this.assertAuthCollectionWrite({
+      collection,
+      realPath,
+      op: "delete"
+    });
+    const hasReferences = await this.hasReferences(realPath, collection);
+    if (hasReferences) {
+      await this.assertReferenceUpdates(realPath, collection);
+    }
     const doc = await this.getDocument(realPath);
     await this.deleteDocument(realPath);
-    if (await this.hasReferences(realPath, collection)) {
+    if (hasReferences) {
       const collRefs = await this.findReferences(realPath, collection);
       for (const [_collection, docsWithRefs] of Object.entries(collRefs)) {
         for (const [pathToDocWithRef, referencePaths] of Object.entries(
           docsWithRefs
         )) {
-          let refDoc = await this.getRaw(pathToDocWithRef);
-          let hasUpdate = false;
-          for (const path9 of referencePaths) {
-            const { object: object2, updated } = updateObjectWithJsonPath(
-              refDoc,
-              path9,
-              realPath,
-              null
-            );
-            refDoc = object2;
-            hasUpdate = updated || hasUpdate;
-          }
-          if (hasUpdate) {
-            const collectionWithRef = this.tinaSchema.getCollectionByFullPath(pathToDocWithRef);
-            if (!collectionWithRef) {
-              throw new Error(
-                `Unable to find collection for ${pathToDocWithRef}`
+          await this.withAuthCollectionLock(pathToDocWithRef, async () => {
+            let refDoc = await this.getRaw(pathToDocWithRef);
+            let hasUpdate = false;
+            for (const path9 of referencePaths) {
+              const { object: object2, updated } = updateObjectWithJsonPath(
+                refDoc,
+                path9,
+                realPath,
+                null
               );
+              refDoc = object2;
+              hasUpdate = updated || hasUpdate;
             }
-            await this.database.put(
-              pathToDocWithRef,
-              refDoc,
-              collectionWithRef.name
-            );
-          }
+            if (hasUpdate) {
+              const collectionWithRef = this.tinaSchema.getCollectionByFullPath(pathToDocWithRef);
+              if (!collectionWithRef) {
+                throw new Error(
+                  `Unable to find collection for ${pathToDocWithRef}`
+                );
+              }
+              await this.database.put(
+                pathToDocWithRef,
+                refDoc,
+                collectionWithRef.name
+              );
+            }
+          });
         }
       }
     }
@@ -5573,10 +5891,15 @@ var Resolver = class _Resolver {
     if (isAddPendingDocument === true) {
       return this.resolveAddPendingDocument({
         collectionName: collection.name,
-        relativePath: path3.relative(collection.path, realPath),
+        relativePath: path4.relative(collection.path, realPath),
         templateName: args.template
       });
     }
+    await this.assertAuthCollectionWrite({
+      collection,
+      realPath,
+      op: "create"
+    });
     const params = await this.buildObjectMutations(
       // @ts-ignore
       args.params[collection.name],
@@ -5595,6 +5918,11 @@ var Resolver = class _Resolver {
     isAddPendingDocument,
     isCollectionSpecific
   }) => {
+    await this.assertAuthCollectionWrite({
+      collection,
+      realPath,
+      op: "update"
+    });
     const doc = await this.getDocument(realPath);
     const oldDoc = this.resolveLegacyValues(doc?._rawData || {}, collection);
     if (isAddPendingDocument === true) {
@@ -6101,130 +6429,6 @@ var resolveDateInput = (value) => {
   return date;
 };
 
-// src/resolver/auth-fields.ts
-import path4 from "path";
-import { set } from "es-toolkit/compat";
-async function getUserDocumentContext(tinaSchema, resolver) {
-  const collection = tinaSchema.getCollections().find((c) => c.isAuthCollection);
-  if (!collection) {
-    throw new Error("Auth collection not found");
-  }
-  const userFields = mapUserFields(collection, ["_rawData"]);
-  if (!userFields.length) {
-    throw new Error(`No user field found in collection ${collection.name}`);
-  }
-  if (userFields.length > 1) {
-    throw new Error(
-      `Multiple user fields found in collection ${collection.name}`
-    );
-  }
-  const userField = userFields[0];
-  const relativePath = "index.json";
-  const realPath = path4.join(collection.path, relativePath);
-  const userDoc = await resolver.getDocument(realPath);
-  const users = get(userDoc, userField.path);
-  if (!users) {
-    throw new Error("No users found");
-  }
-  return { collection, userField, users, userDoc, relativePath };
-}
-function findUserInCollection(users, userField, userSub) {
-  const { idFieldName } = userField;
-  if (!idFieldName) {
-    throw new Error("No uid field found on user field");
-  }
-  return users.find((u) => u[idFieldName] === userSub) || null;
-}
-async function handleAuthenticate({
-  tinaSchema,
-  resolver,
-  sub,
-  password,
-  ctxUser
-}) {
-  const userSub = sub || ctxUser?.sub;
-  const { userField, users } = await getUserDocumentContext(
-    tinaSchema,
-    resolver
-  );
-  const user = findUserInCollection(users, userField, userSub);
-  if (!user) {
-    return null;
-  }
-  const { passwordFieldName } = userField;
-  const saltedHash = get(user, [passwordFieldName || "", "value"]);
-  if (!saltedHash) {
-    throw new Error("No password field found on user field");
-  }
-  const matches = await checkPasswordHash({
-    saltedHash,
-    password
-  });
-  return matches ? user : null;
-}
-async function handleAuthorize({
-  tinaSchema,
-  resolver,
-  sub,
-  ctxUser
-}) {
-  const userSub = sub || ctxUser?.sub;
-  const { userField, users } = await getUserDocumentContext(
-    tinaSchema,
-    resolver
-  );
-  const user = findUserInCollection(users, userField, userSub);
-  return user ? user : null;
-}
-async function handleUpdatePassword({
-  tinaSchema,
-  resolver,
-  password,
-  ctxUser
-}) {
-  if (!ctxUser?.sub) {
-    throw new Error("Not authorized");
-  }
-  if (!password) {
-    throw new Error("No password provided");
-  }
-  const { collection, userField, users, relativePath } = await getUserDocumentContext(tinaSchema, resolver);
-  const { idFieldName, passwordFieldName } = userField;
-  const user = users.find((u) => u[idFieldName] === ctxUser.sub);
-  if (!user) {
-    throw new Error("Not authorized");
-  }
-  user[passwordFieldName] = {
-    value: password,
-    passwordChangeRequired: false
-  };
-  const newBody = {};
-  set(
-    newBody,
-    userField.path.slice(1),
-    // remove _rawData from users path
-    users.map((u) => {
-      if (user[idFieldName] === u[idFieldName]) {
-        return user;
-      }
-      return {
-        // don't overwrite other users' passwords
-        ...u,
-        [passwordFieldName]: {
-          ...u[passwordFieldName],
-          value: ""
-        }
-      };
-    })
-  );
-  await resolver.resolveUpdateDocument({
-    collectionName: collection.name,
-    relativePath,
-    newBody
-  });
-  return true;
-}
-
 // src/error.ts
 import { GraphQLError as GraphQLError3 } from "graphql";
 var NotFoundError = class extends GraphQLError3 {
@@ -6243,7 +6447,8 @@ var resolve = async ({
   silenceErrors,
   verbose,
   isAudit,
-  ctxUser
+  ctxUser,
+  isSignIn
 }) => {
   try {
     const verboseValue = verbose ?? true;
@@ -6262,7 +6467,8 @@ var resolve = async ({
       config,
       database,
       tinaSchema,
-      isAudit: isAudit || false
+      isAudit: isAudit || false,
+      ctxUser
     });
     const resolverPromises = [];
     const res = await graphql({
@@ -6306,7 +6512,7 @@ var resolve = async ({
                 sub: authArgs.sub,
                 password: authArgs.password,
                 info,
-                ctxUser
+                isSignIn
               });
             }
             if (info.fieldName === "authorize") {
@@ -6672,7 +6878,11 @@ import path5 from "node:path";
 import { GraphQLError as GraphQLError5 } from "graphql";
 import micromatch2 from "micromatch";
 import sha2 from "js-sha1";
-import { set as set2 } from "es-toolkit/compat";
+import { set } from "es-toolkit/compat";
+var withUnauthenticatedWrites = (options) => ({
+  ...options,
+  allowUnauthenticatedWrites: options?.allowUnauthenticatedWrites ?? true
+});
 var createLocalDatabase = (config) => {
   const level = new TinaLevelClient(config?.port);
   level.openConnection();
@@ -6680,7 +6890,8 @@ var createLocalDatabase = (config) => {
   return new Database({
     bridge: fsBridge,
     ...config || {},
-    level
+    level,
+    authCollection: withUnauthenticatedWrites(config?.authCollection)
   });
 };
 var createDatabase = (config) => {
@@ -6721,7 +6932,8 @@ var createDatabaseInternal = (config) => {
   return new Database({
     ...config,
     bridge: config.bridge,
-    level: config.level
+    level: config.level,
+    authCollection: withUnauthenticatedWrites(config.authCollection)
   });
 };
 var SYSTEM_FILES = ["_schema", "_graphql", "_lookup"];
@@ -6740,6 +6952,10 @@ var Database = class {
     this.onDelete = config.onDelete || defaultOnDelete;
     this.levelBatchSize = config.levelBatchSize ?? DEFAULT_LEVEL_BATCH_SIZE;
     this.contentNamespace = config.namespace;
+    this.authCollection = Object.freeze({
+      admins: Object.freeze([...config.authCollection?.admins ?? []]),
+      allowUnauthenticatedWrites: config.authCollection?.allowUnauthenticatedWrites === true
+    });
   }
   config;
   bridge;
@@ -6751,6 +6967,7 @@ var Database = class {
   onPut;
   onDelete;
   levelBatchSize;
+  authCollection;
   tinaSchema;
   contentNamespace;
   collectionIndexDefinitions;
@@ -7347,7 +7564,7 @@ var Database = class {
             }
             if (fields) {
               for (const field of fields) {
-                if (field.indexed !== void 0 && field.indexed === false || field.type === "object") {
+                if (field.indexed !== void 0 && field.indexed === false || field.type === "password" || field.type === "object") {
                   continue;
                 }
                 indexDefinitions[field.name] = {
@@ -7812,7 +8029,7 @@ var hashPasswordVisitor = async (node, path9) => {
   const passwordValuePath = [...path9, "value"];
   const plaintextPassword = get(node, passwordValuePath);
   if (plaintextPassword) {
-    set2(
+    set(
       node,
       passwordValuePath,
       await generatePasswordHash({ password: plaintextPassword })

package/dist/resolve.d.ts

@@ -1,6 +1,7 @@
 import type { GraphQLConfig } from './types';
 import type { Database } from './database';
-export declare const resolve: ({ config, query, variables, database, silenceErrors, verbose, isAudit, ctxUser, }: {
+import { type CtxUser } from './resolver';
+export declare const resolve: ({ config, query, variables, database, silenceErrors, verbose, isAudit, ctxUser, isSignIn, }: {
     config?: GraphQLConfig;
     query: string;
     variables: object;
@@ -8,9 +9,9 @@ export declare const resolve: ({ config, query, variables, database, silenceErro
     silenceErrors?: boolean;
     verbose?: boolean;
     isAudit?: boolean;
-    ctxUser?: {
-        sub: string;
-    };
+    ctxUser?: CtxUser;
+    /** Set only by the generated database client's `authenticate()`. */
+    isSignIn?: boolean;
 }) => Promise<import("graphql").ExecutionResult<{
     [key: string]: any;
 }, {

package/dist/resolver/auth-fields.d.ts

@@ -1,15 +1,56 @@
-import type { TinaSchema } from '@tinacms/schema-tools';
+import type { Collection, TinaSchema } from '@tinacms/schema-tools';
 import type { GraphQLResolveInfo } from 'graphql';
 import type { Resolver } from './index';
-export declare function handleAuthenticate({ tinaSchema, resolver, sub, password, ctxUser, }: {
+export declare function getUserDocumentContext(tinaSchema: TinaSchema, resolver: Resolver): Promise<{
+    collection: Collection<true>;
+    userField: {
+        path: string[];
+        collectable: import("@tinacms/schema-tools").Collectable;
+        idFieldName?: string;
+        passwordFieldName?: string;
+    };
+    users: any;
+    userDoc: {
+        _sys: {
+            title: any;
+            basename: string;
+            filename: string;
+            extension: string;
+            hasReferences: boolean;
+            path: string;
+            relativePath: string;
+            breadcrumbs: string[];
+            collection: Collection<true>;
+            template: string | number;
+        };
+        _values: {
+            _collection: any;
+            _template: any;
+        };
+        _rawData: {
+            _collection: any;
+            _template: any;
+        };
+        _collection: any;
+        _template: any;
+        __typename: string;
+        id: string;
+    };
+    relativePath: string;
+}>;
+export declare function findUserInCollection(users: any[], userField: any, userSub: string): any;
+/**
+ * A stored hash only carries over to a user with the same uid, so a new or
+ * renamed user saved without a password could never sign in.
+ */
+export declare function assertNewUsersHavePasswords(collection: Collection<true>, newBody: Record<string, unknown>, existingData?: Record<string, unknown>): void;
+export declare function handleAuthenticate({ tinaSchema, resolver, sub, password, isSignIn, }: {
     tinaSchema: TinaSchema;
     resolver: Resolver;
     sub?: string;
     password: string;
     info: GraphQLResolveInfo;
-    ctxUser?: {
-        sub?: string;
-    };
+    isSignIn?: boolean;
 }): Promise<any>;
 export declare function handleAuthorize({ tinaSchema, resolver, sub, ctxUser, }: {
     tinaSchema: TinaSchema;
@@ -18,7 +59,7 @@ export declare function handleAuthorize({ tinaSchema, resolver, sub, ctxUser, }:
     info: GraphQLResolveInfo;
     ctxUser?: {
         sub?: string;
-    };
+    } | null;
 }): Promise<any>;
 export declare function handleUpdatePassword({ tinaSchema, resolver, password, ctxUser, }: {
     tinaSchema: TinaSchema;
@@ -27,5 +68,5 @@ export declare function handleUpdatePassword({ tinaSchema, resolver, password, c
     info: GraphQLResolveInfo;
     ctxUser?: {
         sub?: string;
-    };
+    } | null;
 }): Promise<boolean>;

package/dist/resolver/index.d.ts

@@ -4,11 +4,26 @@
 import { Database } from '../database';
 import type { Collectable, Collection, Template, TinaField, TinaSchema } from '@tinacms/schema-tools';
 import type { GraphQLConfig } from '../types';
+export type AuthCollectionWriteOp = 'create' | 'update' | 'rename' | 'delete' | 'addPending' | 'createFolder';
+/**
+ * The signed-in user behind a request. Leave it undefined only when the caller
+ * vouches for the call itself, and pass null when nobody is signed in.
+ */
+export type CtxUser = {
+    sub?: string;
+} | null | undefined;
+type UpdateDocumentArgs = {
+    collectionName: string;
+    relativePath: string;
+    newRelativePath?: string;
+    newBody?: Record<string, unknown>;
+};
 interface ResolverConfig {
     config?: GraphQLConfig;
     database: Database;
     tinaSchema: TinaSchema;
     isAudit: boolean;
+    ctxUser?: CtxUser;
 }
 export declare const createResolver: (args: ResolverConfig) => Resolver;
 export declare const resolveFieldData: ({ namespace, ...field }: TinaField<true>, rawData: unknown, accumulator: {
@@ -66,6 +81,7 @@ export declare class Resolver {
     database: Database;
     tinaSchema: TinaSchema;
     isAudit: boolean;
+    ctxUser: CtxUser;
     constructor(init: ResolverConfig);
     resolveCollection: (_args: any, collectionName: string, hasDocuments?: boolean) => Promise<{
         fields: TinaField<true>[];
@@ -248,6 +264,12 @@ export declare class Resolver {
      */
     private static validateRelativePath;
     private validatePath;
+    private assertAuthCollectionWrite;
+    private assertReferenceUpdates;
+    private isAuthCollectionPath;
+    private withAuthCollectionLock;
+    private isStoredInCollection;
+    private isStoredUser;
     /**
      * Helper method to get collection and construct validated path.
      * This encapsulates the common pattern of getting a collection, joining paths,
@@ -349,12 +371,7 @@ export declare class Resolver {
         __typename: string;
         id: string;
     }>;
-    resolveUpdateDocument: ({ collectionName, relativePath, newRelativePath, newBody, }: {
-        collectionName: string;
-        relativePath: string;
-        newRelativePath?: string;
-        newBody?: Record<string, unknown>;
-    }) => Promise<{
+    resolveUpdateDocument: (args: UpdateDocumentArgs) => Promise<{
         _sys: {
             title: any;
             basename: string;
@@ -380,6 +397,12 @@ export declare class Resolver {
         __typename: string;
         id: string;
     }>;
+    private updateDocument;
+    /**
+     * Rewrites the auth collection's user store without the admin check, so the
+     * caller must check the request user.
+     */
+    updateAuthDocumentInternal: (update: (rawData: Record<string, any>) => Record<string, any>) => Promise<void>;
     resolveDeleteDocument: ({ collectionName, relativePath, }: {
         collectionName: string;
         relativePath: string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tinacms/graphql",
   "type": "module",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "main": "dist/index.js",
   "module": "./dist/index.js",
   "files": [
@@ -43,8 +43,8 @@
     "normalize-path": "^3.0.0",
     "readable-stream": "^4.7.0",
     "yup": "^1.6.1",
-    "@tinacms/mdx": "^2.2.3",
-    "@tinacms/schema-tools": "^2.10.0"
+    "@tinacms/schema-tools": "^2.10.1",
+    "@tinacms/mdx": "^2.3.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org"
@@ -72,7 +72,7 @@
     "vite": "^4.5.9",
     "vitest": "^0.32.4",
     "zod": "^3.24.2",
-    "@tinacms/schema-tools": "2.10.0",
+    "@tinacms/schema-tools": "2.10.1",
     "@tinacms/scripts": "1.6.4"
   },
   "scripts": {