cabloy 5.1.104 → 5.1.106

package/.cabloy-version

@@ -1 +1 @@
-5.1.104
+5.1.106

package/.claude/skills/cabloy-backend-scaffold/references/follow-up-checklist.md

@@ -24,7 +24,7 @@ After generating or extending a backend thread, check which follow-up layers app
 
 - migration/version changes
 - `meta.version`
-- field indexes
+- field indexes; in shared-database multitenancy, preserve ordinary lookup indexes and enforce business uniqueness in tenant-aware business logic rather than with `table.unique(...)`
 - relations
 - datasource choice
 - cache behavior

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 5.1.106
+
+### Improvements
+
+- Refresh the Zova lockfile and update the Vona Zova Core patch.
+
+## 5.1.105
+
+### Features
+
+- Filter SSR menus based on user roles.
+- Add SSR site access policies.
+- Add an event for retrieving action permissions.
+- Update `monkeySys.ts` functionality.
+
 ## 5.1.104
 
 ### Features

package/CLAUDE.md

@@ -67,6 +67,7 @@ Before inventing a custom implementation path:
 - `src/bean` defines the global shorthand surface; classes that should not appear in `IBeanRecordGlobal` should move to `src/lib` or `src/service` rather than being filtered by `@Virtual()`.
 - When backend code references `this.bean.xxx`, `ctx.bean.xxx`, or `app.bean.xxx`, use `IBeanRecordGlobal` and module `src/.metadata/index.ts` as the first static lookup surface; use `IBeanRecordGeneral` or `src/service` only when the target is not a global shorthand.
 - When adding a persisted field to an existing backend resource, ask the user whether `vonaModule.fileVersion` should be incremented before changing `meta.version.ts` or the module schema path. If yes, add a new migration version and bump `fileVersion`. If no, keep the current `fileVersion` and fold the schema change into the current version path. Do not assume the versioning strategy without confirmation.
+- In shared-database multitenancy, do not use `table.unique(...)` for business uniqueness. Keep ordinary indexes for lookup performance and enforce tenant-scoped uniqueness in the business layer.
 - For `@Api.field(...)` and related schemaLike composition, framework guards now preserve previously attached OpenAPI metadata across schema rebuilds, but structure-shaping schemaLike is still order-sensitive. Treat `v.object(...)`, `v.array(...)`, `v.optional()`, `v.nullable()`, `v.default(...)`, and preprocess/transform wrappers as structure-shaping; keep the final structure-defining schemaLike last and verify emitted schema/OpenAPI output after such edits.
 
 ## Verification expectations

package/cabloy-docs/backend/controller-aop-guide.md

@@ -93,8 +93,8 @@ Typical jobs include:
 ```typescript
 @Passport.public()
 @Passport.activated(false)
-@Passport.roleName({ name: 'admin' })
-@Passport.admin()
+@Passport.roleName({ name: 'systemAdmin' })
+@Passport.systemAdmin()
 ```
 
 These shorthands still map back to the generic aspect model.

package/cabloy-docs/backend/field-indexes.md

@@ -66,6 +66,14 @@ Field indexes can also be configured through app config.
 
 That means index behavior participates in the broader configuration system rather than being locked into one metadata file only.
 
+## Shared-database multitenancy and business uniqueness
+
+Ordinary indexes in `meta.index` improve lookup and query performance. They do not define a business uniqueness rule.
+
+In shared-database multitenancy, do not use `table.unique(...)` for tenant-scoped business uniqueness. A database-wide unique constraint can reject the same business value when it belongs to a different tenant.
+
+Keep the ordinary indexes needed by the access pattern, and enforce the tenant-scoped uniqueness rule in tenant-aware business logic.
+
 ## Implementation checks for persistence changes
 
 When changing persistence design, do not stop at entity fields and model methods.
@@ -74,7 +82,8 @@ Also ask:
 
 1. does this access pattern need an index?
 2. should the index belong in `meta.index`?
-3. is the typed style a better fit than raw string declarations?
+3. does a business key need tenant-scoped uniqueness, to be enforced in tenant-aware business logic rather than with `table.unique(...)`?
+4. is the typed style a better fit than raw string declarations?
 
 That leads to backend changes that are more production-aware and more aligned with Vona’s module metadata model.
 

package/cabloy-docs/backend/menu-guide.md

@@ -55,6 +55,36 @@ This makes menu retrieval part of the broader backend contract surface.
 
 In the current repo implementation, the out-of-the-box menu controller is public and delegates directly to `this.scope.service.menu.retrieveMenus(publicPath)`.
 
+## Static menu visibility
+
+`@SsrMenu(...)` items can declare static role visibility without changing the public menu DTO:
+
+```typescript
+@SsrMenu({
+  item: {
+    title: $locale('Operations'),
+    link: 'presetResource',
+    roles: ['systemAdmin'],
+  },
+  site: 'basic-siteadmin:admin',
+})
+```
+
+- Omit `roles`, or use `roles: []`, to make an item visible to anonymous and authenticated callers.
+- A nonempty `roles` array is visible when the current Passport has at least one matching role name.
+- `roles` is server-only declaration metadata. It is filtered out before the API response and is not part of `IMenuItem`, OpenAPI, or generated frontend clients.
+- This controls navigation disclosure only. It never grants access to a page, controller action, API, or resource; those boundaries retain their own route and Passport/permission guards.
+
+SSR Site menu definitions are cached structurally by Site and locale. The framework keeps static role policy in that prepared cache, then creates a filtered response for each request without mutating the cached definition.
+
+### Frontend query lifecycle
+
+Passport filtering does not add user or role identity to the frontend menu query key. The menu resource remains keyed by stable inputs: Site/public path and locale.
+
+On login, `ModelPassport.afterLogin()` stores the Passport/JWT before returning to the destination layout. The layout's ordinary `$useStateData(...)` lifecycle refreshes stale menu data using the newly authenticated request context. On logout, the Passport model navigates to login and then clears query data.
+
+A dynamic role or menu-policy change while the user remains signed in is different: the mutation owner must explicitly refresh authoritative Passport state when needed and invalidate or refetch the affected menu query. This is UI freshness behavior only; route, controller, API, and resource authorization remain enforced independently by their existing guards.
+
 ## Relationship to frontend integration
 
 Menu retrieval is especially relevant in SSR-sensitive frontend flows.

package/cabloy-docs/frontend/model-state-guide.md

@@ -336,6 +336,8 @@ that logical key is prefixed internally with model identity, and with selector w
 
 That means model code can use short business-facing keys while still getting namespace isolation.
 
+Automatic model namespacing does not make every varying runtime value part of the logical key. Logical keys still describe stable resource inputs. Do not add a user or role fingerprint solely because a backend response is evaluated through the current Passport; use the normal authentication lifecycle for login/logout and explicitly invalidate or refetch affected stable keys for an in-session policy change. See [use-state-data-best-practices.md](./use-state-data-best-practices.md) for the full rule.
+
 ## Persistence and restore behavior
 
 Current source treats persistence as part of the model-state runtime.

package/cabloy-docs/frontend/use-state-data-best-practices.md

@@ -325,6 +325,29 @@ Readable keys improve:
 - tracing cache behavior
 - future refactors when similar query families grow
 
+## Practical rule 9: key stable resource inputs, not ambient caller identity
+
+A `$useStateData(...)` query key identifies the stable variant of a resource. Include inputs that change that variant, such as an operation or resource identifier, filters, pagination, Site/public path, or locale.
+
+Do not append the current username, authenticated flag, Passport role names or IDs, or another authorization fingerprint merely because the server evaluates the current Passport while producing the response. Those values are ambient request context, not automatically part of the frontend resource identity.
+
+Normal authentication transitions already provide lifecycle boundaries: login stores the new Passport before navigating into the destination model, and that model's ordinary query lifecycle refreshes stale data under the new request context. Logout clears query data after leaving protected UI.
+
+Use explicit invalidation or refetch when authorization policy changes during an otherwise continuing authenticated session, such as an administrator changing role membership, Site policy, or menu policy. Refresh authoritative Passport state when necessary, then synchronize the affected stable resource key; do not turn a policy fingerprint into the key by default.
+
+For example, the menu resource is keyed by its stable Site/public path and locale:
+
+```ts
+queryKey: ['retrieveMenus', publicPath, locale];
+```
+
+Do not key it by the current roles:
+
+```ts
+// Avoid: roles are ambient request policy, not menu resource identity.
+queryKey: ['retrieveMenus', publicPath, locale, roleNames];
+```
+
 ## Anti-pattern: command-first controller state
 
 A common anti-pattern looks like this:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.104",
+  "version": "5.1.106",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [

package/vona/packages-vona/vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona",
-  "version": "5.1.73",
+  "version": "5.1.74",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "Vona is an intuitive, elegant and powerful Node.js framework for rapidly developing enterprise applications of any size",
   "keywords": [

package/vona/patches/{zova-core@5.1.77.patch → zova-core@5.1.78.patch}

@@ -32,10 +32,10 @@ index 838e299407218b7bfac469d42a12d6ab59820380..e8b61cc231e39ee3a270ee513ab43ff5
  //# sourceMappingURL=module.d.ts.map
 
 diff --git a/dist/types/utils/env.d.ts b/dist/types/utils/env.d.ts
-index 708c0a584dfec65b8c7ad2d049156f900de49928..a8caacb276794e3ac70591b974f14d6eee3ac302 100644
+index 7eb5fa0c4d5c23e046b1cebb64cf8ce85c0302fa..5f6aa470d4a88262e2108ff086923c673fdfbf67 100644
 --- a/dist/types/utils/env.d.ts
 +++ b/dist/types/utils/env.d.ts
-@@ -34,19 +34,4 @@ export interface ZovaConfigEnv {
+@@ -35,19 +35,4 @@ export interface ZovaConfigEnv {
      MOCK_BUILD: string | undefined;
      MOCK_BUILD_PORT: string | undefined;
  }

package/vona/pnpm-lock.yaml

@@ -16,7 +16,7 @@ overrides:
   zod: npm:@cabloy/zod@4.3.8
 
 patchedDependencies:
-  zova-core@5.1.77: 0f4164c4d2bbb16d671beb5c26759dff37769be0709df941bc7b90b94261ac54
+  zova-core@5.1.78: ff659aa5f659be32501f56841b72f148c24acf1546f79cce551586e27fcde2ce
 
 importers:
 
@@ -501,11 +501,11 @@ importers:
         specifier: npm:@cabloy/zod@4.3.8
         version: '@cabloy/zod@4.3.8'
       zova:
-        specifier: ^5.1.133
-        version: 5.1.133(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
+        specifier: ^5.1.135
+        version: 5.1.135(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
       zova-jsx:
-        specifier: ^1.1.77
-        version: 1.1.77(typescript@5.9.3)
+        specifier: ^1.1.78
+        version: 1.1.78(typescript@5.9.3)
       zova-module-a-api:
         specifier: ^5.1.21
         version: 5.1.21
@@ -528,17 +528,17 @@ importers:
         specifier: ^5.1.29
         version: 5.1.29
       zova-module-a-model:
-        specifier: ^5.1.32
-        version: 5.1.32(vue@3.5.39(typescript@5.9.3))
+        specifier: ^5.1.33
+        version: 5.1.33(vue@3.5.39(typescript@5.9.3))
       zova-module-a-openapi:
         specifier: ^5.1.43
         version: 5.1.43
       zova-module-a-router:
-        specifier: ^5.1.29
-        version: 5.1.29
+        specifier: ^5.1.30
+        version: 5.1.30
       zova-module-a-routertabs:
-        specifier: ^5.1.32
-        version: 5.1.32
+        specifier: ^5.1.33
+        version: 5.1.33
       zova-module-a-ssr:
         specifier: ^5.1.29
         version: 5.1.29
@@ -573,11 +573,11 @@ importers:
         specifier: npm:@cabloy/zod@4.3.8
         version: '@cabloy/zod@4.3.8'
       zova:
-        specifier: ^5.1.133
-        version: 5.1.133(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
+        specifier: ^5.1.135
+        version: 5.1.135(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
       zova-jsx:
-        specifier: ^1.1.77
-        version: 1.1.77(typescript@5.9.3)
+        specifier: ^1.1.78
+        version: 1.1.78(typescript@5.9.3)
       zova-module-a-api:
         specifier: ^5.1.21
         version: 5.1.21
@@ -600,17 +600,17 @@ importers:
         specifier: ^5.1.29
         version: 5.1.29
       zova-module-a-model:
-        specifier: ^5.1.32
-        version: 5.1.32(vue@3.5.39(typescript@5.9.3))
+        specifier: ^5.1.33
+        version: 5.1.33(vue@3.5.39(typescript@5.9.3))
       zova-module-a-openapi:
         specifier: ^5.1.43
         version: 5.1.43
       zova-module-a-router:
-        specifier: ^5.1.29
-        version: 5.1.29
+        specifier: ^5.1.30
+        version: 5.1.30
       zova-module-a-routertabs:
-        specifier: ^5.1.32
-        version: 5.1.32
+        specifier: ^5.1.33
+        version: 5.1.33
       zova-module-a-ssr:
         specifier: ^5.1.29
         version: 5.1.29
@@ -7948,11 +7948,11 @@ packages:
     peerDependencies:
       zod: ^3.25.28 || ^4
 
-  zova-core@5.1.77:
-    resolution: {integrity: sha512-PfB5yaHVZ8U8Fjeyju3m9OGe1PjXH26HTjkA9jvl+KK9l3t/lzdEVP4s03/4zEggvPz7pkwek1heLuMaQRmX/Q==}
+  zova-core@5.1.78:
+    resolution: {integrity: sha512-PWvgOujRI1k7TpsJy1G8/Wf7W+/Rm6QbGHPNwcRjgDz4PhTg9z8UN1hfIO1Gg37IAI2hIrK8kqHhFRayROQHgQ==}
 
-  zova-jsx@1.1.77:
-    resolution: {integrity: sha512-TnjesMVt7wSvwjP4XDOg9m2MacbL5xgMrdLtU9XhhPHm3gYuNV/hzr2vQ788k/z+WWQdHsqRvTy6Ngr/GDr6zg==}
+  zova-jsx@1.1.78:
+    resolution: {integrity: sha512-KToLi7h2uElT4ULd5QSXfLNqSA3PaeRKJ4IHNMEJU1xiH02j2u0KCd7iVYK54mQC1QYphan3Z/YXFuW0odPx8w==}
 
   zova-module-a-api@5.1.21:
     resolution: {integrity: sha512-qjm/hfjC4/+7Ap/uzJfBzV0PwRlp2idEmEKwCZYxquaXq6QtJBbTWTznw1iukT4lkJZip2KFkjOvXTzdvZA2UA==}
@@ -7993,20 +7993,20 @@ packages:
   zova-module-a-meta@5.1.21:
     resolution: {integrity: sha512-7vsLOMw1UQEZ+8qbBaiz9t4n3N7AU1jxpaiSIIky7hBvKO9nuHq+e7FONpj9poa8WeHkYoflBg/8imKBy/IlNw==}
 
-  zova-module-a-model@5.1.32:
-    resolution: {integrity: sha512-uzOXp2JlIOaBFy4pe5HyM846A2IK3zA2J8y8Je0i4EvioM36eiBhE61F8q0K59ojh3QZuinrxH6m9DIVL2EvVw==}
+  zova-module-a-model@5.1.33:
+    resolution: {integrity: sha512-NwxCguvESPLUSA2zo5vVH3Qx29o5znmUL2qU9khwjXUmDPbOTeYTkgPCI33fTsy8VnkguoWBLMgUdOsaJF+7OA==}
 
   zova-module-a-openapi@5.1.43:
     resolution: {integrity: sha512-xJKvSPl1AZnH7EpgEd9a3u3IEpJfnou19DKre/7TL1KdiTdfNThLrmmkdP1UNYlUHUgCczcGUwZDdMiE9gdxwA==}
 
-  zova-module-a-router@5.1.29:
-    resolution: {integrity: sha512-7vIXOf0aPUXvZAFC9hM1JQyNwmQAG+EtSbQ1et8+iP6roff8yUhhq50Dw8PFU5eb7hjk1TTxpUFhCTvev5JZqQ==}
+  zova-module-a-router@5.1.30:
+    resolution: {integrity: sha512-pfKeZdZUMTfkjEVZfLHj21UKjKBhTd79rfF4Mr+OLwV4avK8sDPAudseaAInVvh+T/0Ayq5w9fLhzFYeU1If8A==}
 
   zova-module-a-routerstack@5.1.26:
     resolution: {integrity: sha512-uu4tFw2DUruanPR7cojM5p6rvyCIh+tnwPmq7s0jZdg+5XBr+YMy1RGjnE8vPFSLHW8C71hlNbps6VpKvKMiiQ==}
 
-  zova-module-a-routertabs@5.1.32:
-    resolution: {integrity: sha512-HZziZYnXUAZZ3YhQl2Qc+/KhCS7/GlKs9Ob4eIZok+YdDPF3iaVJsW+y+5l3rbtxIFsZtRsUZtoys2+p5wEvSQ==}
+  zova-module-a-routertabs@5.1.33:
+    resolution: {integrity: sha512-u5YIFc7OfUsxruIG8QP4sH1+TCps2vAYUpAMNfT1XPkJLHdFGkjEc6++KMCpv4jGpNDoQ42/LefEQGg7vqnQuw==}
 
   zova-module-a-ssr@5.1.29:
     resolution: {integrity: sha512-wlxLSy+Wjh/UFEVqsKQ105bvXceXPdIDmJQPKF0hSwiNY1R8HUottADfXPwYOatzZAayZ4AU4vQIpG92F2GJiA==}
@@ -8026,17 +8026,17 @@ packages:
   zova-module-a-zod@5.1.36:
     resolution: {integrity: sha512-4gEjxJBelVOA84aP2XWSNSmzQr+AYh14Ha5QCj9yZIpSnEajSgYLoyLw4dwiVcscuEw7xAAOOnWbZS9uXSpJzg==}
 
-  zova-module-a-zova@5.1.92:
-    resolution: {integrity: sha512-RxHSKnBDMuBKwx0cJoPOIvq/DV6Xhji2yZ/lBgJTMrWOYVsHux/PbDc+vlAU+Aie2K0RiZ2ytR3mPBpMxpmexg==}
+  zova-module-a-zova@5.1.93:
+    resolution: {integrity: sha512-pZ7JGNvDoSLdgbQZLj/LtppDWinpd6W+u0WYQvXLuJH3Hnf0Satcpz5fQS+zseJLxm5jhXjmG3ngoYoOfv72RQ==}
 
   zova-module-rest-resource@5.1.41:
     resolution: {integrity: sha512-7Y8rLmHdw0pynlWqsyHPWuCWFLwr/0HsNvfef64cPw91LRujf/7OlulVWqH8ZoFNioZZUpfumB+t/+mICoYfFg==}
 
-  zova-suite-a-zova@5.1.132:
-    resolution: {integrity: sha512-bHyim0stshLyjEvehW8cUL0Bf/pR/sU43Dpada2g2ieGH1p34EzyLeaWimhId++sO9H3xErVX6aQXe0Xf6pELA==}
+  zova-suite-a-zova@5.1.134:
+    resolution: {integrity: sha512-XwmEGAM6po9GjzGLryGVCKhkVjtI3MXNY85AhQVxxMUOU6S+3dBtF399LzzDdhlKYXbvfwuHB/yDQiS1PbfS5w==}
 
-  zova@5.1.133:
-    resolution: {integrity: sha512-1tM0u0EU69/RvXmlxhVIrEY4ADVhQsEIr8UAcQ1U+Mjm3QwLJ7y7fDAQWsW7ChjEXHGrCU62fdc0tPvJ5CGntg==}
+  zova@5.1.135:
+    resolution: {integrity: sha512-Avk0YcjocSYpdRUO4A58/yQmeGUoo+bgzbtKZNLCNDit7PSEGMBJZi9p47ct7SNc6LDybhBm7xPf/xioL0Ozdg==}
 
   zwitch@1.0.5:
     resolution: {integrity: sha512-V50KMwwzqJV0NpZIZFwfOD5/lyny3WlSzRiXgA0G7VUnRlqttta1L6UQIHzd6EuBY/cHGfwTIck7w1yH6Q5zUw==}
@@ -13855,7 +13855,7 @@ snapshots:
     dependencies:
       zod: '@cabloy/zod@4.3.8'
 
-  zova-core@5.1.77(patch_hash=0f4164c4d2bbb16d671beb5c26759dff37769be0709df941bc7b90b94261ac54)(typescript@5.9.3):
+  zova-core@5.1.78(patch_hash=ff659aa5f659be32501f56841b72f148c24acf1546f79cce551586e27fcde2ce)(typescript@5.9.3):
     dependencies:
       '@cabloy/compose': link:packages-utils/compose
       '@cabloy/extend': link:packages-utils/extend
@@ -13884,14 +13884,14 @@ snapshots:
     transitivePeerDependencies:
       - typescript
 
-  zova-jsx@1.1.77(typescript@5.9.3):
+  zova-jsx@1.1.78(typescript@5.9.3):
     dependencies:
       '@cabloy/compose': link:packages-utils/compose
       '@cabloy/utils': link:packages-utils/utils
       '@cabloy/word-utils': 2.1.14
       typestyle: 2.4.0
       vue: 3.5.39(typescript@5.9.3)
-      zova-core: 5.1.77(patch_hash=0f4164c4d2bbb16d671beb5c26759dff37769be0709df941bc7b90b94261ac54)(typescript@5.9.3)
+      zova-core: 5.1.78(patch_hash=ff659aa5f659be32501f56841b72f148c24acf1546f79cce551586e27fcde2ce)(typescript@5.9.3)
     transitivePeerDependencies:
       - typescript
 
@@ -13935,7 +13935,7 @@ snapshots:
 
   zova-module-a-meta@5.1.21: {}
 
-  zova-module-a-model@5.1.32(vue@3.5.39(typescript@5.9.3)):
+  zova-module-a-model@5.1.33(vue@3.5.39(typescript@5.9.3)):
     dependencies:
       '@tanstack/query-core': 5.101.2
       '@tanstack/query-persist-client-core': 5.101.2
@@ -13953,11 +13953,11 @@ snapshots:
       openapi3-ts: 4.6.0
       typestyle: 2.4.0
 
-  zova-module-a-router@5.1.29: {}
+  zova-module-a-router@5.1.30: {}
 
   zova-module-a-routerstack@5.1.26: {}
 
-  zova-module-a-routertabs@5.1.32: {}
+  zova-module-a-routertabs@5.1.33: {}
 
   zova-module-a-ssr@5.1.29:
     dependencies:
@@ -13992,7 +13992,7 @@ snapshots:
       '@cabloy/zod-query': link:packages-utils/zod-query
       zod: '@cabloy/zod@4.3.8'
 
-  zova-module-a-zova@5.1.92(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
+  zova-module-a-zova@5.1.93(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
     dependencies:
       '@cabloy/compose': link:packages-utils/compose
       '@cabloy/deps': link:packages-utils/deps
@@ -14003,14 +14003,14 @@ snapshots:
       '@cabloy/word-utils': 2.1.14
       defu: 6.1.7
       luxon: 3.7.2
-      zova-jsx: 1.1.77(typescript@5.9.3)
+      zova-jsx: 1.1.78(typescript@5.9.3)
     transitivePeerDependencies:
       - typescript
       - vue
 
   zova-module-rest-resource@5.1.41: {}
 
-  zova-suite-a-zova@5.1.132(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
+  zova-suite-a-zova@5.1.134(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
     dependencies:
       zova-module-a-api: 5.1.21
       zova-module-a-app: 5.1.24
@@ -14025,18 +14025,18 @@ snapshots:
       zova-module-a-interceptor: 5.1.29
       zova-module-a-logger: 5.1.26
       zova-module-a-meta: 5.1.21
-      zova-module-a-model: 5.1.32(vue@3.5.39(typescript@5.9.3))
+      zova-module-a-model: 5.1.33(vue@3.5.39(typescript@5.9.3))
       zova-module-a-openapi: 5.1.43
-      zova-module-a-router: 5.1.29
+      zova-module-a-router: 5.1.30
       zova-module-a-routerstack: 5.1.26
-      zova-module-a-routertabs: 5.1.32
+      zova-module-a-routertabs: 5.1.33
       zova-module-a-ssr: 5.1.29
       zova-module-a-ssrhmr: 5.1.22
       zova-module-a-ssrserver: 5.1.22
       zova-module-a-style: 5.1.32
       zova-module-a-table: 5.1.37(vue@3.5.39(typescript@5.9.3))
       zova-module-a-zod: 5.1.36
-      zova-module-a-zova: 5.1.92(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
+      zova-module-a-zova: 5.1.93(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
     transitivePeerDependencies:
       - '@vue/composition-api'
       - debug
@@ -14044,10 +14044,10 @@ snapshots:
       - typescript
       - vue
 
-  zova@5.1.133(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
+  zova@5.1.135(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
     dependencies:
-      zova-core: 5.1.77(patch_hash=0f4164c4d2bbb16d671beb5c26759dff37769be0709df941bc7b90b94261ac54)(typescript@5.9.3)
-      zova-suite-a-zova: 5.1.132(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
+      zova-core: 5.1.78(patch_hash=ff659aa5f659be32501f56841b72f148c24acf1546f79cce551586e27fcde2ce)(typescript@5.9.3)
+      zova-suite-a-zova: 5.1.134(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
     transitivePeerDependencies:
       - '@vue/composition-api'
       - debug

package/vona/pnpm-workspace.yaml

@@ -53,4 +53,4 @@ allowBuilds:
   vue-demi: true
 
 patchedDependencies:
-  zova-core@5.1.77: patches/zova-core@5.1.77.patch
+  zova-core@5.1.78: patches/zova-core@5.1.78.patch

package/vona/src/suite/a-home/modules/home-user/src/bean/eventListener.activate.ts

@@ -17,10 +17,11 @@ export class EventListenerActivate
     next: NextEvent<TypeEventData, TypeEventResult>,
   ): Promise<TypeEventResult> {
     const user = data as IUser;
-    if (user.name === 'admin' && !this.scope.config.disableRoleAdmin) {
-      // role: admin
-      const roleAdmin = await this.scope.model.role.get({ name: 'admin' });
-      await this.bean.role.addUserId(roleAdmin!.id, user.id);
+    const roleRegisteredUser = await this.scope.model.role.get({ name: 'registeredUser' });
+    await this.bean.role.addUserId(roleRegisteredUser!.id, user.id);
+    if (user.name === 'admin' && !this.scope.config.disableBootstrapSystemAdmin) {
+      const roleSystemAdmin = await this.scope.model.role.get({ name: 'systemAdmin' });
+      await this.bean.role.addUserId(roleSystemAdmin!.id, user.id);
     }
     // next
     return next();

package/vona/src/suite/a-home/modules/home-user/src/bean/meta.version.ts

@@ -18,6 +18,7 @@ export class MetaVersion extends BeanBase implements IMetaVersionUpdate, IMetaVe
         table.comment(entityRole.$comment.$table);
         table.basicFields();
         table.string(entityRole.name, 255).comment(entityRole.$comment.name);
+        table.json(entityRole.siteIds).comment(entityRole.$comment.siteIds);
       });
       // homeUser
       const entityUser = this.scope.entity.user;
@@ -47,12 +48,15 @@ export class MetaVersion extends BeanBase implements IMetaVersionUpdate, IMetaVe
 
   async init(options: IMetaVersionInitOptions) {
     if (options.version === 1) {
-      // role: admin
-      if (!this.scope.config.disableRoleAdmin) {
-        await this.scope.model.role.insert({
-          name: 'admin',
-        });
-      }
+      // roles
+      await this.scope.model.role.insert({
+        name: 'registeredUser',
+        siteIds: ['web'],
+      });
+      await this.scope.model.role.insert({
+        name: 'systemAdmin',
+        siteIds: ['web', 'admin'],
+      });
       // user: admin
       if (!this.scope.config.disableUserAdmin) {
         await this.bean.auth.authenticate('auth-simple:simple', {

package/vona/src/suite/a-home/modules/home-user/src/config/config.ts

@@ -5,7 +5,7 @@ export function config(_app: VonaApplication) {
     passwordDefault: {
       admin: '123456',
     },
-    disableRoleAdmin: false,
+    disableBootstrapSystemAdmin: false,
     disableUserAdmin: false,
   };
 }

package/vona/src/suite/a-home/modules/home-user/src/entity/role.ts

@@ -3,6 +3,7 @@ import type { IRole } from 'vona-module-a-user';
 
 import { Api, v } from 'vona-module-a-openapiutils';
 import { Entity, EntityBase } from 'vona-module-a-orm';
+import z from 'zod';
 
 import { $locale } from '../.metadata/locales.ts';
 
@@ -12,4 +13,7 @@ export interface IEntityOptionsRole extends IDecoratorEntityOptions {}
 export class EntityRole extends EntityBase implements IRole {
   @Api.field(v.title($locale('RoleName')))
   name: string;
+
+  @Api.field(v.array(z.string()))
+  siteIds: string[];
 }

package/vona/src/suite/a-home/modules/home-user/src/service/passportAdapter.ts

@@ -7,9 +7,9 @@ import type { IPayloadDataOfPassport } from '../types/jwt.ts';
 
 @Service()
 export class ServicePassportAdapter extends BeanBase implements IPassportAdapter {
-  async isAdmin(passport: IPassport | undefined): Promise<boolean> {
+  async isSystemAdmin(passport: IPassport | undefined): Promise<boolean> {
     if (!passport) return false;
-    if (passport.roles?.some(role => role.name === 'admin')) return true;
+    if (passport.roles?.some(role => role.name === 'systemAdmin')) return true;
     return false;
   }
 

package/vona/src/suite/a-home/modules/home-user/src/service/roleAdapter.ts

@@ -20,10 +20,10 @@ export class ServiceRoleAdapter extends BeanBase implements IRoleAdapter {
   }
 
   async addUserId(id: TableIdentity, userId: TableIdentity): Promise<TableIdentity> {
-    const res = await this.scope.model.roleUser.insert({
-      userId,
-      roleId: id,
-    });
-    return res.id;
+    let roleUser = await this.scope.model.roleUser.get({ userId, roleId: id });
+    if (!roleUser) {
+      roleUser = await this.scope.model.roleUser.insert({ userId, roleId: id });
+    }
+    return roleUser.id;
   }
 }

package/vona/src/suite/a-training/modules/training-record/src/bean/ssrMenu.record.ts

@@ -22,6 +22,7 @@ export interface ISsrMenuOptionsRecord extends IDecoratorSsrMenuOptions<ISsrSite
         },
       },
       group: 'basic-siteadmin:management',
+      roles: ['systemAdmin'],
     },
   },
   site: ['basic-siteadmin:admin'],

package/vona/src/suite/a-training/modules/training-student/src/bean/ssrMenu.student.ts

@@ -22,6 +22,7 @@ export interface ISsrMenuOptionsStudent extends IDecoratorSsrMenuOptions<ISsrSit
         },
       },
       group: 'basic-siteadmin:management',
+      roles: ['systemAdmin'],
     },
   },
   site: ['basic-siteadmin:admin'],

package/vona/src/suite/cabloy-basic/modules/basic-siteadmin/src/bean/ssrMenu.home.ts

@@ -16,6 +16,7 @@ export interface ISsrMenuOptionsHome extends IDecoratorSsrMenuOptions<ISsrSiteOp
     order: $order(1, 'core'),
     icon: '::home',
     link: '/',
+    roles: ['systemAdmin'],
   },
   site: ['basic-siteadmin:admin'],
 })

package/vona/src/suite/cabloy-basic/modules/basic-siteadmin/src/bean/ssrSite.admin.ts

@@ -4,6 +4,10 @@ import type { IIconRecord, IPagePathRecord } from 'zova-rest-cabloy-basic-admin'
 import { BeanSsrSiteBase, SsrSite } from 'vona-module-a-ssr';
 
 declare module 'vona-module-a-ssr' {
+  export interface ISsrSiteIdRecord {
+    admin: never;
+  }
+
   export interface ISsrSitePublicPathRecord {
     admin: never;
   }
@@ -20,10 +24,10 @@ export interface ISsrSiteOptionsAdmin extends IDecoratorSsrSiteOptions<
 > {}
 
 @SsrSite<ISsrSiteOptionsAdmin>({
+  siteId: 'admin',
   publicPath: 'admin',
   bundlePath: 'ssr-cabloyBasicAdmin-5.0.0',
   diagnostics: {
-    siteName: 'admin',
     buildCommand: 'npm run build:zova:admin',
   },
 })

package/vona/src/suite/cabloy-basic/modules/basic-siteweb/src/bean/ssrSite.web.ts

@@ -4,6 +4,10 @@ import type { IIconRecord, IPagePathRecord } from 'zova-rest-cabloy-basic-web';
 import { BeanSsrSiteBase, SsrSite } from 'vona-module-a-ssr';
 
 declare module 'vona-module-a-ssr' {
+  export interface ISsrSiteIdRecord {
+    web: never;
+  }
+
   export interface ISsrSitePublicPathRecord {
     '': never;
   }
@@ -20,10 +24,10 @@ export interface ISsrSiteOptionsWeb extends IDecoratorSsrSiteOptions<
 > {}
 
 @SsrSite<ISsrSiteOptionsWeb>({
+  siteId: 'web',
   publicPath: '',
   bundlePath: 'ssr-cabloyBasicWeb-5.0.0',
   diagnostics: {
-    siteName: 'web',
     buildCommand: 'npm run build:zova:web',
   },
 })