@tinacms/graphql 3.0.0 → 4.0.1

package/dist/index.js

@@ -3058,7 +3058,7 @@ var assertCheckboxGroupIsList = (field) => {
 var package_default = {
   name: "@tinacms/graphql",
   type: "module",
-  version: "3.0.0",
+  version: "4.0.1",
   main: "dist/index.js",
   module: "./dist/index.js",
   files: [
@@ -3101,7 +3101,7 @@ var package_default = {
     "gray-matter": "catalog:",
     "isomorphic-git": "catalog:",
     "js-sha1": "catalog:",
-    "js-yaml": "^3.15.1",
+    "js-yaml": "^3.15.2",
     "jsonpath-plus": "catalog:",
     "many-level": "catalog:",
     micromatch: "catalog:",
@@ -3348,13 +3348,136 @@ import {
 } from "graphql";
 
 // src/resolver/index.ts
-import path3 from "path";
+import path4 from "path";
 import { isValid } from "date-fns";
 import { JSONPath as JSONPath2 } from "jsonpath-plus";
 
 // src/mdx/index.ts
 import { parseMDX, serializeMDX } from "@tinacms/mdx";
 
+// src/references/visit.ts
+var MDX_SEGMENT = { mdx: true };
+var encodeLocator = (locator) => JSON.stringify(locator);
+var isRecord = (value) => typeof value === "object" && value !== null;
+var visitReferences = (data, collectable, tinaSchema, visit) => {
+  const visitCollectable = (collectableHere, value, locator) => {
+    if (!isRecord(value)) {
+      return false;
+    }
+    let fields;
+    try {
+      fields = tinaSchema.getTemplateForData({
+        data: value,
+        collection: collectableHere
+      })?.fields;
+    } catch {
+      return false;
+    }
+    let replaced = false;
+    for (const field of fields ?? []) {
+      replaced = visitField(field, value, locator) || replaced;
+    }
+    return replaced;
+  };
+  const visitField = (field, parent, locator) => {
+    const key = field.type === "rich-text" && field.isBody && "$_body" in parent ? "$_body" : field.name;
+    const value = parent[key];
+    if (value === void 0 || value === null) {
+      return false;
+    }
+    const at = [...locator, field.name];
+    let replaced = false;
+    if (field.type === "reference") {
+      if (field.list && Array.isArray(value)) {
+        for (const [index, item] of value.entries()) {
+          if (typeof item !== "string" || item.length === 0) {
+            continue;
+          }
+          visit({
+            value: item,
+            collections: field.collections ?? [],
+            locator: [...at, index],
+            replace: (next) => {
+              value[index] = next;
+              replaced = true;
+            }
+          });
+        }
+        return replaced;
+      } else if (typeof value !== "string" || value.length === 0) {
+        return false;
+      }
+      visit({
+        value,
+        collections: field.collections ?? [],
+        locator: at,
+        replace: (next) => {
+          parent[field.name] = next;
+          replaced = true;
+        }
+      });
+      return replaced;
+    } else if (field.type === "object") {
+      if (field.list && Array.isArray(value)) {
+        for (const [index, item] of value.entries()) {
+          replaced = visitCollectable(field, item, [...at, index]) || replaced;
+        }
+        return replaced;
+      }
+      return visitCollectable(field, value, at);
+    } else if (field.type === "rich-text") {
+      return visitRichText(field, parent, key, at);
+    }
+    return false;
+  };
+  const visitRichText = (field, parent, key, at) => {
+    const stored = parent[key];
+    const storedIsText = typeof stored === "string";
+    if (!storedIsText && !isRecord(stored)) {
+      return false;
+    }
+    let tree;
+    if (storedIsText) {
+      try {
+        tree = parseMDX(stored, field, (value) => value);
+      } catch {
+        return false;
+      }
+    } else {
+      tree = stored;
+    }
+    const replaced = visitNodes2(tree?.children, field, [...at, MDX_SEGMENT]);
+    if (replaced && storedIsText) {
+      parent[key] = serializeMDX(tree, field, (value) => value);
+    }
+    return replaced;
+  };
+  const visitNodes2 = (nodes, field, at) => {
+    if (!Array.isArray(nodes)) {
+      return false;
+    }
+    const templates = field.templates ?? [];
+    let replaced = false;
+    for (const [index, node] of nodes.entries()) {
+      if (!isRecord(node)) {
+        continue;
+      }
+      const here = [...at, index];
+      if (typeof node.name === "string" && (node.type === "mdxJsxFlowElement" || node.type === "mdxJsxTextElement") && isRecord(node.props)) {
+        const template = templates.find(
+          (candidate) => lastItem(candidate.namespace) === node.name
+        );
+        for (const templateField of template?.fields ?? []) {
+          replaced = visitField(templateField, node.props, [...here, "props"]) || replaced;
+        }
+      }
+      replaced = visitNodes2(node.children, field, [...here, "children"]) || replaced;
+    }
+    return replaced;
+  };
+  return visitCollectable(collectable, data, []);
+};
+
 // src/resolver/index.ts
 import {
   ERR_ALREADY_EXISTS,
@@ -4431,54 +4554,41 @@ var makeIndexOpsForDocument = (filepath, collection, indexDefinitions, data, opT
   }
   return result;
 };
-var makeRefOpsForDocument = (filepath, collection, references, data, opType, level) => {
+var makeRefOpsForDocument = (filepath, collectionName, tinaSchema, data, opType, level) => {
   const result = [];
-  if (collection) {
-    for (const [c, referencePaths] of Object.entries(references || {})) {
-      if (!referencePaths.length) {
-        continue;
-      }
-      const collectionSublevel = level.sublevel(c, SUBLEVEL_OPTIONS);
-      const refSublevel = collectionSublevel.sublevel(
-        REFS_COLLECTIONS_SORT_KEY,
-        SUBLEVEL_OPTIONS
-      );
-      const references2 = {};
-      for (const path9 of referencePaths) {
-        const ref = JSONPath({ path: path9, json: data });
-        if (!ref) {
-          continue;
-        }
-        if (Array.isArray(ref)) {
-          for (const r of ref) {
-            if (!r) {
-              continue;
-            }
-            if (references2[r]) {
-              references2[r].push(path9);
-            } else {
-              references2[r] = [path9];
-            }
-          }
-        } else {
-          if (references2[ref]) {
-            references2[ref].push(path9);
-          } else {
-            references2[ref] = [path9];
-          }
-        }
-      }
-      for (const ref of Object.keys(references2)) {
-        for (const path9 of references2[ref]) {
-          result.push({
-            type: opType,
-            key: `${ref}${INDEX_KEY_FIELD_SEPARATOR}${path9}${INDEX_KEY_FIELD_SEPARATOR}${filepath}`,
-            sublevel: refSublevel,
-            value: opType === "put" ? {} : void 0
-          });
-        }
+  if (!collectionName || !tinaSchema) {
+    return result;
+  }
+  let collection;
+  try {
+    collection = tinaSchema.getCollection(collectionName);
+  } catch {
+    return result;
+  }
+  const byCollection = /* @__PURE__ */ new Map();
+  visitReferences(
+    data,
+    collection,
+    tinaSchema,
+    ({ value, collections, locator }) => {
+      const encoded = encodeLocator(locator);
+      for (const target of collections) {
+        const entries = byCollection.get(target) ?? [];
+        entries.push({ ref: value, locator: encoded });
+        byCollection.set(target, entries);
       }
     }
+  );
+  for (const [target, entries] of byCollection) {
+    const refSublevel = level.sublevel(target, SUBLEVEL_OPTIONS).sublevel(REFS_COLLECTIONS_SORT_KEY, SUBLEVEL_OPTIONS);
+    for (const { ref, locator } of entries) {
+      result.push({
+        type: opType,
+        key: `${ref}${INDEX_KEY_FIELD_SEPARATOR}${locator}${INDEX_KEY_FIELD_SEPARATOR}${filepath}`,
+        sublevel: refSublevel,
+        value: opType === "put" ? {} : void 0
+      });
+    }
   }
   return result;
 };
@@ -4683,6 +4793,170 @@ var collectConditionsForField = (fieldName, field, filterNode, pathExpression, c
   }
 };
 
+// src/resolver/auth-fields.ts
+import { randomBytes } from "crypto";
+import path3 from "path";
+async function getUserDocumentContext(tinaSchema, resolver) {
+  const collection = tinaSchema.getCollections().find((c) => c.isAuthCollection);
+  if (!collection) {
+    throw new Error("Auth collection not found");
+  }
+  const userFields = mapUserFields(collection, ["_rawData"]);
+  if (!userFields.length) {
+    throw new Error(`No user field found in collection ${collection.name}`);
+  }
+  if (userFields.length > 1) {
+    throw new Error(
+      `Multiple user fields found in collection ${collection.name}`
+    );
+  }
+  const userField = userFields[0];
+  const relativePath = "index.json";
+  const realPath = path3.join(collection.path, relativePath);
+  const userDoc = await resolver.getDocument(realPath);
+  const users = get(userDoc, userField.path);
+  if (!users) {
+    throw new Error("No users found");
+  }
+  return { collection, userField, users, userDoc, relativePath };
+}
+function findUserInCollection(users, userField, userSub) {
+  const { idFieldName } = userField;
+  if (!idFieldName) {
+    throw new Error("No uid field found on user field");
+  }
+  return users.find((u) => u[idFieldName] === userSub) || null;
+}
+function withoutPasswordValue(user, userField) {
+  const { passwordFieldName } = userField;
+  if (!passwordFieldName) {
+    return user;
+  }
+  return {
+    ...user,
+    [passwordFieldName]: {
+      passwordChangeRequired: user[passwordFieldName]?.passwordChangeRequired ?? false
+    }
+  };
+}
+var dummyPasswordHash;
+var warnedUnflaggedAuthenticate = false;
+var getDummyPasswordHash = () => {
+  dummyPasswordHash ??= generatePasswordHash({
+    password: randomBytes(32).toString("hex")
+  });
+  return dummyPasswordHash;
+};
+function assertNewUsersHavePasswords(collection, newBody, existingData) {
+  const userFields = mapUserFields(collection);
+  if (userFields.length !== 1) {
+    return;
+  }
+  const [{ path: usersPath, idFieldName, passwordFieldName }] = userFields;
+  const users = get(newBody, usersPath);
+  if (!Array.isArray(users) || !idFieldName || !passwordFieldName) {
+    return;
+  }
+  const storedUsers = get(existingData, usersPath);
+  const storedIds = new Set(
+    (Array.isArray(storedUsers) ? storedUsers : []).map((u) => u?.[idFieldName])
+  );
+  const withoutPassword = users.filter(
+    (u) => !storedIds.has(u?.[idFieldName]) && !u?.[passwordFieldName]?.["value"]
+  ).map((u) => u?.[idFieldName]);
+  if (withoutPassword.length) {
+    throw new Error(`New users need a password: ${withoutPassword.join(", ")}`);
+  }
+}
+async function handleAuthenticate({
+  tinaSchema,
+  resolver,
+  sub,
+  password,
+  isSignIn
+}) {
+  if (!isSignIn) {
+    if (!warnedUnflaggedAuthenticate) {
+      warnedUnflaggedAuthenticate = true;
+      console.warn(
+        "TinaCMS: authenticate was called without isSignIn, so it returned null. If sign-in is failing, run `tinacms build` with a @tinacms/cli that matches @tinacms/datalayer to regenerate the database client."
+      );
+    }
+    return null;
+  }
+  const { userField, users } = await getUserDocumentContext(
+    tinaSchema,
+    resolver
+  );
+  const user = sub ? findUserInCollection(users, userField, sub) : null;
+  const { passwordFieldName } = userField;
+  const saltedHash = user ? get(user, [passwordFieldName || "", "value"]) : void 0;
+  if (!saltedHash) {
+    await checkPasswordHash({
+      saltedHash: await getDummyPasswordHash(),
+      password: password ?? ""
+    });
+    return null;
+  }
+  const matches = await checkPasswordHash({
+    saltedHash,
+    password
+  });
+  return matches ? withoutPasswordValue(user, userField) : null;
+}
+async function handleAuthorize({
+  tinaSchema,
+  resolver,
+  sub,
+  ctxUser
+}) {
+  const userSub = sub || ctxUser?.sub;
+  const { userField, users } = await getUserDocumentContext(
+    tinaSchema,
+    resolver
+  );
+  const user = findUserInCollection(users, userField, userSub);
+  return user ? withoutPasswordValue(user, userField) : null;
+}
+async function handleUpdatePassword({
+  tinaSchema,
+  resolver,
+  password,
+  ctxUser
+}) {
+  if (!ctxUser?.sub) {
+    throw new Error("Not authorized");
+  }
+  if (!password) {
+    throw new Error("No password provided");
+  }
+  const { userField, users } = await getUserDocumentContext(
+    tinaSchema,
+    resolver
+  );
+  const { idFieldName, passwordFieldName } = userField;
+  if (!passwordFieldName) {
+    throw new Error("No password field found on user field");
+  }
+  if (!users.find((u) => u[idFieldName] === ctxUser.sub)) {
+    throw new Error("Not authorized");
+  }
+  const passwordHash = await generatePasswordHash({ password });
+  await resolver.updateAuthDocumentInternal((rawData) => {
+    const storedUsers = get(rawData, userField.path.slice(1));
+    const user = Array.isArray(storedUsers) ? storedUsers.find((u) => u[idFieldName] === ctxUser.sub) : void 0;
+    if (!user) {
+      throw new Error("Not authorized");
+    }
+    user[passwordFieldName] = {
+      value: passwordHash,
+      passwordChangeRequired: false
+    };
+    return rawData;
+  });
+  return true;
+}
+
 // src/resolver/media-utils.ts
 var resolveMediaCloudToRelative = (value, config = { useRelativeMedia: true }, schema) => {
   if (config && value) {
@@ -4764,6 +5038,7 @@ var hasTinaMediaConfig = (schema) => {
 };
 
 // src/resolver/index.ts
+var authCollectionWrites = /* @__PURE__ */ new WeakMap();
 var createResolver = (args) => {
   return new Resolver(args);
 };
@@ -4903,7 +5178,7 @@ var transformDocumentIntoPayload = async (fullPath, rawData, tinaSchema, config,
       base: basename,
       ext: extension,
       name: filename
-    } = path3.parse(normalizedPath);
+    } = path4.parse(normalizedPath);
     const relativePath = normalizedPath.replace(collection.path, "").replace(/^\/|\/$/g, "");
     const breadcrumbs = relativePath.replace(extension, "").split("/");
     const data = {
@@ -4965,34 +5240,6 @@ var transformDocumentIntoPayload = async (fullPath, rawData, tinaSchema, config,
     throw e;
   }
 };
-var updateObjectWithJsonPath = (obj, path9, oldValue, newValue) => {
-  let updated = false;
-  if (!path9.includes(".") && !path9.includes("[")) {
-    if (path9 in obj && obj[path9] === oldValue) {
-      obj[path9] = newValue;
-      updated = true;
-    }
-    return { object: obj, updated };
-  }
-  const parentPath = path9.replace(/\.[^.\[\]]+$/, "");
-  const keyToUpdate = path9.match(/[^.\[\]]+$/)[0];
-  const parents = JSONPath2({
-    path: parentPath,
-    json: obj,
-    resultType: "value"
-  });
-  if (parents.length > 0) {
-    parents.forEach((parent) => {
-      if (parent && typeof parent === "object" && keyToUpdate in parent) {
-        if (parent[keyToUpdate] === oldValue) {
-          parent[keyToUpdate] = newValue;
-          updated = true;
-        }
-      }
-    });
-  }
-  return { object: obj, updated };
-};
 var Resolver = class _Resolver {
   constructor(init) {
     this.init = init;
@@ -5000,12 +5247,14 @@ var Resolver = class _Resolver {
     this.database = init.database;
     this.tinaSchema = init.tinaSchema;
     this.isAudit = init.isAudit;
+    this.ctxUser = init.ctxUser;
   }
   init;
   config;
   database;
   tinaSchema;
   isAudit;
+  ctxUser;
   resolveCollection = async (_args, collectionName, hasDocuments) => {
     const collection = this.tinaSchema.getCollection(collectionName);
     const extraFields = {};
@@ -5182,6 +5431,11 @@ var Resolver = class _Resolver {
       collectionName,
       relativePath
     );
+    await this.assertAuthCollectionWrite({
+      collection,
+      realPath,
+      op: "addPending"
+    });
     const alreadyExists = await this.database.documentExists(realPath);
     if (alreadyExists) {
       throw new Error(
@@ -5297,19 +5551,19 @@ var Resolver = class _Resolver {
     if (fullPath.includes("\0")) {
       throw new Error("Invalid path: null bytes are not allowed");
     }
-    const normalizedPath = path3.normalize(fullPath.replace(/\\/g, "/"));
-    const normalizedCollectionPath = path3.normalize(collection.path);
-    const relative = path3.relative(normalizedCollectionPath, normalizedPath);
+    const normalizedPath = path4.normalize(fullPath.replace(/\\/g, "/"));
+    const normalizedCollectionPath = path4.normalize(collection.path);
+    const relative = path4.relative(normalizedCollectionPath, normalizedPath);
     if (relative.startsWith("..")) {
       throw new Error(`Invalid path: path escapes the collection directory`);
     }
-    if (path3.isAbsolute(relative)) {
+    if (path4.isAbsolute(relative)) {
       throw new Error(`Invalid path: absolute paths are not allowed`);
     }
     if (relativePath) {
       _Resolver.validateRelativePath(relativePath);
       const collectionFormat = collection.format || "md";
-      const fileExtension = path3.extname(relativePath).toLowerCase().slice(1);
+      const fileExtension = path4.extname(relativePath).toLowerCase().slice(1);
       if (fileExtension !== collectionFormat) {
         throw new Error(
           `Invalid file extension: expected '.${collectionFormat}' but got '.${fileExtension}'`
@@ -5317,6 +5571,81 @@ var Resolver = class _Resolver {
       }
     }
   };
+  assertAuthCollectionWrite = async ({
+    collection,
+    realPath,
+    op
+  }) => {
+    const authCollection = this.tinaSchema.getCollections().find((c) => c.isAuthCollection);
+    if (!authCollection) {
+      return;
+    }
+    const normalizedPath = normalizePath2(realPath);
+    if (collection.name !== authCollection.name && !this.isStoredInCollection(normalizedPath, authCollection)) {
+      return;
+    }
+    const { admins, allowUnauthenticatedWrites } = this.database.authCollection ?? { admins: [], allowUnauthenticatedWrites: true };
+    if (this.ctxUser === void 0 && allowUnauthenticatedWrites) {
+      return;
+    }
+    const sub = this.ctxUser?.sub;
+    const userStorePath = normalizePath2(
+      path4.join(authCollection.path, "index.json")
+    );
+    if (op === "update" && normalizedPath === userStorePath && typeof sub === "string" && sub !== "" && admins.includes(sub) && await this.isStoredUser(sub)) {
+      return;
+    }
+    throw new Error("Not authorized");
+  };
+  assertReferenceUpdates = async (realPath, collection) => {
+    if (!this.tinaSchema.getCollections().some((c) => c.isAuthCollection)) {
+      return;
+    }
+    const collRefs = await this.findReferences(realPath, collection);
+    for (const docsWithRefs of Object.values(collRefs)) {
+      for (const pathToDocWithRef of Object.keys(docsWithRefs)) {
+        await this.assertAuthCollectionWrite({
+          collection: this.tinaSchema.getCollectionByFullPath(pathToDocWithRef),
+          realPath: pathToDocWithRef,
+          op: "update"
+        });
+      }
+    }
+  };
+  isAuthCollectionPath = (realPath) => {
+    const authCollection = this.tinaSchema.getCollections().find((c) => c.isAuthCollection);
+    return !!authCollection && this.isStoredInCollection(normalizePath2(realPath), authCollection);
+  };
+  withAuthCollectionLock = (realPath, write) => {
+    if (!this.isAuthCollectionPath(realPath)) {
+      return write();
+    }
+    const previous = authCollectionWrites.get(this.database);
+    const current = previous ? previous.then(write, write) : write();
+    authCollectionWrites.set(
+      this.database,
+      current.catch(() => void 0)
+    );
+    return current;
+  };
+  isStoredInCollection = (realPath, collection) => {
+    try {
+      return this.tinaSchema.getCollectionByFullPath(realPath)?.name === collection.name;
+    } catch {
+      return false;
+    }
+  };
+  isStoredUser = async (sub) => {
+    try {
+      const { userField, users } = await getUserDocumentContext(
+        this.tinaSchema,
+        this
+      );
+      return Array.isArray(users) && !!findUserInCollection(users, userField, sub);
+    } catch {
+      return false;
+    }
+  };
   /**
    * Helper method to get collection and construct validated path.
    * This encapsulates the common pattern of getting a collection, joining paths,
@@ -5337,7 +5666,7 @@ var Resolver = class _Resolver {
     if (options?.extraSegments) {
       pathSegments.push(...options.extraSegments.map(_Resolver.sanitizePath));
     }
-    const realPath = normalizePath2(path3.join(...pathSegments));
+    const realPath = normalizePath2(path4.join(...pathSegments));
     const shouldValidateExtension = options?.validateExtension !== false;
     this.validatePath(
       realPath,
@@ -5371,12 +5700,17 @@ var Resolver = class _Resolver {
   }) => {
     const collection = this.getCollectionWithName(collectionName);
     _Resolver.validateRelativePath(relativePath);
-    const realPath = path3.join(
+    const realPath = path4.join(
       collection.path,
       relativePath,
       `.gitkeep.${collection.format || "md"}`
     );
     this.validatePath(realPath, collection);
+    await this.assertAuthCollectionWrite({
+      collection,
+      realPath,
+      op: "createFolder"
+    });
     const alreadyExists = await this.database.documentExists(realPath);
     if (alreadyExists) {
       throw new Error(
@@ -5399,6 +5733,11 @@ var Resolver = class _Resolver {
       collectionName,
       relativePath
     );
+    await this.assertAuthCollectionWrite({
+      collection,
+      realPath,
+      op: "create"
+    });
     const alreadyExists = await this.database.documentExists(realPath);
     if (alreadyExists) {
       throw new Error(
@@ -5409,7 +5748,17 @@ var Resolver = class _Resolver {
     await this.database.put(realPath, params, collection.name);
     return this.getDocument(realPath);
   };
-  resolveUpdateDocument = async ({
+  resolveUpdateDocument = async (args) => {
+    const { realPath } = this.getValidatedPath(
+      args.collectionName,
+      args.relativePath
+    );
+    return this.withAuthCollectionLock(
+      realPath,
+      () => this.updateDocument(args)
+    );
+  };
+  updateDocument = async ({
     collectionName,
     relativePath,
     newRelativePath,
@@ -5419,6 +5768,13 @@ var Resolver = class _Resolver {
       collectionName,
       relativePath
     );
+    if (!newRelativePath) {
+      await this.assertAuthCollectionWrite({
+        collection,
+        realPath,
+        op: "update"
+      });
+    }
     const alreadyExists = await this.database.documentExists(realPath);
     if (!alreadyExists) {
       throw new Error(`Unable to update document, ${realPath} does not exist`);
@@ -5438,45 +5794,33 @@ var Resolver = class _Resolver {
           `Unable to rename document, ${newRealPath} ${ERR_ALREADY_EXISTS}`
         );
       }
+      await this.assertAuthCollectionWrite({
+        collection,
+        realPath,
+        op: "rename"
+      });
+      await this.assertAuthCollectionWrite({
+        collection,
+        realPath: newRealPath,
+        op: "rename"
+      });
+      await this.assertReferenceUpdates(realPath, collection);
       await this.database.put(newRealPath, doc._rawData, collection.name);
       await this.deleteDocument(realPath);
-      const collRefs = await this.findReferences(realPath, collection);
-      for (const [_collection, docsWithRefs] of Object.entries(collRefs)) {
-        for (const [pathToDocWithRef, referencePaths] of Object.entries(
-          docsWithRefs
-        )) {
-          let docWithRef = await this.getRaw(pathToDocWithRef);
-          let hasUpdate = false;
-          for (const path9 of referencePaths) {
-            const { object: object2, updated } = updateObjectWithJsonPath(
-              docWithRef,
-              path9,
-              realPath,
-              newRealPath
-            );
-            docWithRef = object2;
-            hasUpdate = updated || hasUpdate;
-          }
-          if (hasUpdate) {
-            const collectionWithRef = this.tinaSchema.getCollectionByFullPath(pathToDocWithRef);
-            if (!collectionWithRef) {
-              throw new Error(
-                `Unable to find collection for ${pathToDocWithRef}`
-              );
-            }
-            await this.database.put(
-              pathToDocWithRef,
-              docWithRef,
-              collectionWithRef.name
-            );
-          }
-        }
-      }
+      await this.rewriteReferences(
+        realPath,
+        newRealPath,
+        collection,
+        this.isAuthCollectionPath(realPath)
+      );
       return this.getDocument(newRealPath);
     }
     if (!newBody) {
       throw new Error("Body not provided for updated document.");
     }
+    if (collection.isAuthCollection) {
+      assertNewUsersHavePasswords(collection, newBody, doc?._rawData);
+    }
     const params = await this.buildObjectMutations(
       newBody,
       collection,
@@ -5493,6 +5837,21 @@ var Resolver = class _Resolver {
     );
     return this.getDocument(realPath);
   };
+  /**
+   * Rewrites the auth collection's user store without the admin check, so the
+   * caller must check the request user.
+   */
+  updateAuthDocumentInternal = async (update) => {
+    const collection = this.tinaSchema.getCollections().find((c) => c.isAuthCollection);
+    if (!collection) {
+      throw new Error("Auth collection not found");
+    }
+    const { realPath } = this.getValidatedPath(collection.name, "index.json");
+    await this.withAuthCollectionLock(realPath, async () => {
+      const rawData = await this.getRaw(realPath);
+      await this.database.put(realPath, update(rawData), collection.name);
+    });
+  };
   resolveDeleteDocument = async ({
     collectionName,
     relativePath
@@ -5505,41 +5864,19 @@ var Resolver = class _Resolver {
     if (!alreadyExists) {
       throw new Error(`Unable to delete document, ${realPath} does not exist`);
     }
+    await this.assertAuthCollectionWrite({
+      collection,
+      realPath,
+      op: "delete"
+    });
+    const hasReferences = await this.hasReferences(realPath, collection);
+    if (hasReferences) {
+      await this.assertReferenceUpdates(realPath, collection);
+    }
     const doc = await this.getDocument(realPath);
     await this.deleteDocument(realPath);
-    if (await this.hasReferences(realPath, collection)) {
-      const collRefs = await this.findReferences(realPath, collection);
-      for (const [_collection, docsWithRefs] of Object.entries(collRefs)) {
-        for (const [pathToDocWithRef, referencePaths] of Object.entries(
-          docsWithRefs
-        )) {
-          let refDoc = await this.getRaw(pathToDocWithRef);
-          let hasUpdate = false;
-          for (const path9 of referencePaths) {
-            const { object: object2, updated } = updateObjectWithJsonPath(
-              refDoc,
-              path9,
-              realPath,
-              null
-            );
-            refDoc = object2;
-            hasUpdate = updated || hasUpdate;
-          }
-          if (hasUpdate) {
-            const collectionWithRef = this.tinaSchema.getCollectionByFullPath(pathToDocWithRef);
-            if (!collectionWithRef) {
-              throw new Error(
-                `Unable to find collection for ${pathToDocWithRef}`
-              );
-            }
-            await this.database.put(
-              pathToDocWithRef,
-              refDoc,
-              collectionWithRef.name
-            );
-          }
-        }
-      }
+    if (hasReferences) {
+      await this.rewriteReferences(realPath, null, collection, false);
     }
     return doc;
   };
@@ -5573,10 +5910,15 @@ var Resolver = class _Resolver {
     if (isAddPendingDocument === true) {
       return this.resolveAddPendingDocument({
         collectionName: collection.name,
-        relativePath: path3.relative(collection.path, realPath),
+        relativePath: path4.relative(collection.path, realPath),
         templateName: args.template
       });
     }
+    await this.assertAuthCollectionWrite({
+      collection,
+      realPath,
+      op: "create"
+    });
     const params = await this.buildObjectMutations(
       // @ts-ignore
       args.params[collection.name],
@@ -5595,6 +5937,11 @@ var Resolver = class _Resolver {
     isAddPendingDocument,
     isCollectionSpecific
   }) => {
+    await this.assertAuthCollectionWrite({
+      collection,
+      realPath,
+      op: "update"
+    });
     const doc = await this.getDocument(realPath);
     const oldDoc = this.resolveLegacyValues(doc?._rawData || {}, collection);
     if (isAddPendingDocument === true) {
@@ -5887,6 +6234,47 @@ var Resolver = class _Resolver {
       }
     };
   };
+  /**
+   * Repoints every reference to `from` at `to`, or clears it when `to` is null.
+   *
+   * Each referring document is re-walked rather than addressed by the locators the index stored,
+   * since a stored path cannot address a reference inside rich text. Only a document the walk
+   * changed is written back.
+   */
+  rewriteReferences = async (from, to, collection, holdsLock) => {
+    const collRefs = await this.findReferences(from, collection);
+    for (const docsWithRefs of Object.values(collRefs)) {
+      for (const pathToDocWithRef of Object.keys(docsWithRefs)) {
+        const rewrite = async () => {
+          const collectionWithRef = this.tinaSchema.getCollectionByFullPath(pathToDocWithRef);
+          if (!collectionWithRef) {
+            throw new Error(
+              `Unable to find collection for ${pathToDocWithRef}`
+            );
+          }
+          const docWithRef = await this.getRaw(pathToDocWithRef);
+          const changed = visitReferences(
+            docWithRef,
+            collectionWithRef,
+            this.tinaSchema,
+            (reference) => {
+              if (reference.value === from) {
+                reference.replace(to);
+              }
+            }
+          );
+          if (changed) {
+            await this.database.put(
+              pathToDocWithRef,
+              docWithRef,
+              collectionWithRef.name
+            );
+          }
+        };
+        await (holdsLock ? rewrite() : this.withAuthCollectionLock(pathToDocWithRef, rewrite));
+      }
+    }
+  };
   /**
    * Checks if a document has references to it
    * @param id  The id of the document to check for references
@@ -5897,6 +6285,8 @@ var Resolver = class _Resolver {
     let count = 0;
     await this.database.query(
       {
+        // One key answers a boolean; the default page is 50.
+        first: 1,
         collection: c.name,
         filterChain: makeFilterChain({
           conditions: [
@@ -5932,6 +6322,9 @@ var Resolver = class _Resolver {
     const references = {};
     await this.database.query(
       {
+        // Every reference, not the default page of 50, which otherwise caps how many a rename or
+        // delete updates.
+        first: -1,
         collection: c.name,
         filterChain: makeFilterChain({
           conditions: [
@@ -6101,130 +6494,6 @@ var resolveDateInput = (value) => {
   return date;
 };
 
-// src/resolver/auth-fields.ts
-import path4 from "path";
-import { set } from "es-toolkit/compat";
-async function getUserDocumentContext(tinaSchema, resolver) {
-  const collection = tinaSchema.getCollections().find((c) => c.isAuthCollection);
-  if (!collection) {
-    throw new Error("Auth collection not found");
-  }
-  const userFields = mapUserFields(collection, ["_rawData"]);
-  if (!userFields.length) {
-    throw new Error(`No user field found in collection ${collection.name}`);
-  }
-  if (userFields.length > 1) {
-    throw new Error(
-      `Multiple user fields found in collection ${collection.name}`
-    );
-  }
-  const userField = userFields[0];
-  const relativePath = "index.json";
-  const realPath = path4.join(collection.path, relativePath);
-  const userDoc = await resolver.getDocument(realPath);
-  const users = get(userDoc, userField.path);
-  if (!users) {
-    throw new Error("No users found");
-  }
-  return { collection, userField, users, userDoc, relativePath };
-}
-function findUserInCollection(users, userField, userSub) {
-  const { idFieldName } = userField;
-  if (!idFieldName) {
-    throw new Error("No uid field found on user field");
-  }
-  return users.find((u) => u[idFieldName] === userSub) || null;
-}
-async function handleAuthenticate({
-  tinaSchema,
-  resolver,
-  sub,
-  password,
-  ctxUser
-}) {
-  const userSub = sub || ctxUser?.sub;
-  const { userField, users } = await getUserDocumentContext(
-    tinaSchema,
-    resolver
-  );
-  const user = findUserInCollection(users, userField, userSub);
-  if (!user) {
-    return null;
-  }
-  const { passwordFieldName } = userField;
-  const saltedHash = get(user, [passwordFieldName || "", "value"]);
-  if (!saltedHash) {
-    throw new Error("No password field found on user field");
-  }
-  const matches = await checkPasswordHash({
-    saltedHash,
-    password
-  });
-  return matches ? user : null;
-}
-async function handleAuthorize({
-  tinaSchema,
-  resolver,
-  sub,
-  ctxUser
-}) {
-  const userSub = sub || ctxUser?.sub;
-  const { userField, users } = await getUserDocumentContext(
-    tinaSchema,
-    resolver
-  );
-  const user = findUserInCollection(users, userField, userSub);
-  return user ? user : null;
-}
-async function handleUpdatePassword({
-  tinaSchema,
-  resolver,
-  password,
-  ctxUser
-}) {
-  if (!ctxUser?.sub) {
-    throw new Error("Not authorized");
-  }
-  if (!password) {
-    throw new Error("No password provided");
-  }
-  const { collection, userField, users, relativePath } = await getUserDocumentContext(tinaSchema, resolver);
-  const { idFieldName, passwordFieldName } = userField;
-  const user = users.find((u) => u[idFieldName] === ctxUser.sub);
-  if (!user) {
-    throw new Error("Not authorized");
-  }
-  user[passwordFieldName] = {
-    value: password,
-    passwordChangeRequired: false
-  };
-  const newBody = {};
-  set(
-    newBody,
-    userField.path.slice(1),
-    // remove _rawData from users path
-    users.map((u) => {
-      if (user[idFieldName] === u[idFieldName]) {
-        return user;
-      }
-      return {
-        // don't overwrite other users' passwords
-        ...u,
-        [passwordFieldName]: {
-          ...u[passwordFieldName],
-          value: ""
-        }
-      };
-    })
-  );
-  await resolver.resolveUpdateDocument({
-    collectionName: collection.name,
-    relativePath,
-    newBody
-  });
-  return true;
-}
-
 // src/error.ts
 import { GraphQLError as GraphQLError3 } from "graphql";
 var NotFoundError = class extends GraphQLError3 {
@@ -6243,7 +6512,8 @@ var resolve = async ({
   silenceErrors,
   verbose,
   isAudit,
-  ctxUser
+  ctxUser,
+  isSignIn
 }) => {
   try {
     const verboseValue = verbose ?? true;
@@ -6262,7 +6532,8 @@ var resolve = async ({
       config,
       database,
       tinaSchema,
-      isAudit: isAudit || false
+      isAudit: isAudit || false,
+      ctxUser
     });
     const resolverPromises = [];
     const res = await graphql({
@@ -6306,7 +6577,7 @@ var resolve = async ({
                 sub: authArgs.sub,
                 password: authArgs.password,
                 info,
-                ctxUser
+                isSignIn
               });
             }
             if (info.fieldName === "authorize") {
@@ -6650,6 +6921,8 @@ var handleCollectionField = (info, args, resolver) => {
 import { ManyLevelGuest } from "many-level";
 import { pipeline } from "readable-stream";
 import { connect } from "net";
+var CONNECT_RETRIES = 50;
+var CONNECT_RETRY_DELAY_MS = 100;
 var TinaLevelClient = class extends ManyLevelGuest {
   port;
   _connected = false;
@@ -6659,10 +6932,30 @@ var TinaLevelClient = class extends ManyLevelGuest {
   }
   openConnection() {
     if (this._connected) return;
-    const socket = connect(this.port);
-    pipeline(socket, this.createRpcStream(), socket, () => {
-      this._connected = false;
-    });
+    const rpcStream = this.createRpcStream();
+    const tryConnect = (attempt) => {
+      const socket = connect(this.port);
+      const onConnectError = (err) => {
+        socket.destroy();
+        if (attempt < CONNECT_RETRIES) {
+          setTimeout(() => tryConnect(attempt + 1), CONNECT_RETRY_DELAY_MS);
+        } else {
+          console.error(
+            `TinaLevelClient: could not connect to the datalayer server on port ${this.port} after ${attempt + 1} attempts (${err.message}).`
+          );
+          rpcStream.destroy(err);
+          this._connected = false;
+        }
+      };
+      socket.once("error", onConnectError);
+      socket.once("connect", () => {
+        socket.removeListener("error", onConnectError);
+        pipeline(socket, rpcStream, socket, () => {
+          this._connected = false;
+        });
+      });
+    };
+    tryConnect(0);
     this._connected = true;
   }
 };
@@ -6672,7 +6965,11 @@ import path5 from "node:path";
 import { GraphQLError as GraphQLError5 } from "graphql";
 import micromatch2 from "micromatch";
 import sha2 from "js-sha1";
-import { set as set2 } from "es-toolkit/compat";
+import { set } from "es-toolkit/compat";
+var withUnauthenticatedWrites = (options) => ({
+  ...options,
+  allowUnauthenticatedWrites: options?.allowUnauthenticatedWrites ?? true
+});
 var createLocalDatabase = (config) => {
   const level = new TinaLevelClient(config?.port);
   level.openConnection();
@@ -6680,7 +6977,8 @@ var createLocalDatabase = (config) => {
   return new Database({
     bridge: fsBridge,
     ...config || {},
-    level
+    level,
+    authCollection: withUnauthenticatedWrites(config?.authCollection)
   });
 };
 var createDatabase = (config) => {
@@ -6721,7 +7019,8 @@ var createDatabaseInternal = (config) => {
   return new Database({
     ...config,
     bridge: config.bridge,
-    level: config.level
+    level: config.level,
+    authCollection: withUnauthenticatedWrites(config.authCollection)
   });
 };
 var SYSTEM_FILES = ["_schema", "_graphql", "_lookup"];
@@ -6740,6 +7039,10 @@ var Database = class {
     this.onDelete = config.onDelete || defaultOnDelete;
     this.levelBatchSize = config.levelBatchSize ?? DEFAULT_LEVEL_BATCH_SIZE;
     this.contentNamespace = config.namespace;
+    this.authCollection = Object.freeze({
+      admins: Object.freeze([...config.authCollection?.admins ?? []]),
+      allowUnauthenticatedWrites: config.authCollection?.allowUnauthenticatedWrites === true
+    });
   }
   config;
   bridge;
@@ -6751,6 +7054,7 @@ var Database = class {
   onPut;
   onDelete;
   levelBatchSize;
+  authCollection;
   tinaSchema;
   contentNamespace;
   collectionIndexDefinitions;
@@ -6871,7 +7175,7 @@ var Database = class {
     );
     const indexDefinitions = await this.getIndexDefinitions(this.contentLevel);
     const collectionIndexDefinitions = indexDefinitions?.[collection.name];
-    const collectionReferences = (await this.getCollectionReferences())?.[collection.name];
+    const referenceSchema = await this.getSchema();
     const normalizedPath = normalizePath(filepath);
     if (!collection?.isDetached) {
       if (this.bridge) {
@@ -6903,7 +7207,7 @@ var Database = class {
         ...makeRefOpsForDocument(
           normalizedPath,
           collection?.name,
-          collectionReferences,
+          referenceSchema,
           dataFields,
           "put",
           level
@@ -6934,7 +7238,7 @@ var Database = class {
         ...makeRefOpsForDocument(
           normalizedPath,
           collection?.name,
-          collectionReferences,
+          referenceSchema,
           existingItem,
           "del",
           level
@@ -6986,7 +7290,7 @@ var Database = class {
           );
           collectionIndexDefinitions = indexDefinitions?.[collectionName];
         }
-        const collectionReferences = (await this.getCollectionReferences())?.[collectionName];
+        const referenceSchema = await this.getSchema();
         const normalizedPath = normalizePath(filepath);
         const dataFields = await this.formatBodyOnPayload(filepath, data);
         const collection = await this.collectionForPath(filepath);
@@ -7040,7 +7344,7 @@ var Database = class {
             ...makeRefOpsForDocument(
               normalizedPath,
               collectionName,
-              collectionReferences,
+              referenceSchema,
               dataFields,
               "put",
               level
@@ -7071,7 +7375,7 @@ var Database = class {
             ...makeRefOpsForDocument(
               normalizedPath,
               collectionName,
-              collectionReferences,
+              referenceSchema,
               existingItem,
               "del",
               level
@@ -7347,7 +7651,7 @@ var Database = class {
             }
             if (fields) {
               for (const field of fields) {
-                if (field.indexed !== void 0 && field.indexed === false || field.type === "object") {
+                if (field.indexed !== void 0 && field.indexed === false || field.type === "password" || field.type === "object") {
                   continue;
                 }
                 indexDefinitions[field.name] = {
@@ -7497,32 +7801,41 @@ var Database = class {
       endKey = key || "";
       edges = [...edges, { cursor: key, path: filepath, value: itemRecord }];
     }
-    return {
-      edges: await sequential(
-        edges,
-        async ({
-          cursor,
-          path: path9,
-          value
-        }) => {
-          try {
-            const node = await hydrator(path9, value);
-            return {
-              node,
-              cursor: btoa(cursor)
-            };
-          } catch (error) {
-            console.log(error);
-            if (error instanceof Error && (!path9.includes(".tina/__generated__/_graphql.json") || !path9.includes("tina/__generated__/_graphql.json"))) {
-              throw new TinaQueryError({
-                originalError: error,
-                file: path9,
-                collection: collection.name
-              });
-            }
-            throw error;
+    const hydratedEdges = await sequential(
+      edges,
+      async ({
+        cursor,
+        path: path9,
+        value
+      }) => {
+        try {
+          const node = await hydrator(path9, value);
+          return {
+            node,
+            cursor: btoa(cursor)
+          };
+        } catch (error) {
+          if (error instanceof NotFoundError) {
+            console.warn(
+              `Skipping ${path9} in collection ${collection.name}: its index entry has no record. Reindex to remove it.`
+            );
+            return null;
+          }
+          console.log(error);
+          if (error instanceof Error && (!path9.includes(".tina/__generated__/_graphql.json") || !path9.includes("tina/__generated__/_graphql.json"))) {
+            throw new TinaQueryError({
+              originalError: error,
+              file: path9,
+              collection: collection.name
+            });
           }
+          throw error;
         }
+      }
+    );
+    return {
+      edges: hydratedEdges.filter(
+        (edge) => edge !== null
       ),
       pageInfo: {
         hasPreviousPage,
@@ -7688,7 +8001,7 @@ var Database = class {
       throw new Error(`No collection found for path: ${filepath}`);
     }
     const indexDefinitions = await this.getIndexDefinitions(this.contentLevel);
-    const collectionReferences = (await this.getCollectionReferences())?.[collection.name];
+    const referenceSchema = await this.getSchema();
     const collectionIndexDefinitions = indexDefinitions?.[collection.name];
     let level = this.contentLevel;
     if (collection?.isDetached) {
@@ -7710,7 +8023,7 @@ var Database = class {
         ...makeRefOpsForDocument(
           normalizedPath,
           collection.name,
-          collectionReferences,
+          referenceSchema,
           item,
           "del",
           level
@@ -7812,7 +8125,7 @@ var hashPasswordVisitor = async (node, path9) => {
   const passwordValuePath = [...path9, "value"];
   const plaintextPassword = get(node, passwordValuePath);
   if (plaintextPassword) {
-    set2(
+    set(
       node,
       passwordValuePath,
       await generatePasswordHash({ password: plaintextPassword })
@@ -7857,7 +8170,6 @@ var _indexContent = async ({
     }
     collectionPath = collection.path;
   }
-  const collectionReferences = (await database.getCollectionReferences())?.[collection?.name];
   const tinaSchema = await database.getSchema();
   let templateInfo = null;
   if (collection) {
@@ -7894,7 +8206,7 @@ var _indexContent = async ({
             ...makeRefOpsForDocument(
               normalizedPath,
               collection?.name,
-              collectionReferences,
+              tinaSchema,
               item,
               "del",
               level
@@ -7930,7 +8242,7 @@ var _indexContent = async ({
           ...makeRefOpsForDocument(
             normalizedPath,
             collection?.name,
-            collectionReferences,
+            tinaSchema,
             aliasedData,
             "put",
             level
@@ -8000,7 +8312,6 @@ var _deleteIndexContent = async (database, documentPaths, enqueueOps, collection
       throw new Error(`No indexDefinitions for collection ${collection.name}`);
     }
   }
-  const collectionReferences = (await database.getCollectionReferences())?.[collection?.name];
   const tinaSchema = await database.getSchema();
   let templateInfo = null;
   if (collection) {
@@ -8027,7 +8338,7 @@ var _deleteIndexContent = async (database, documentPaths, enqueueOps, collection
         ...makeRefOpsForDocument(
           itemKey,
           collection?.name,
-          collectionReferences,
+          tinaSchema,
           aliasedData,
           "del",
           database.contentLevel