create-mithaq 0.1.1 → 0.2.0

package/template/templates/{asas/src → mithaq/src/roles}/tenant-access.ts

@@ -1,7 +1,9 @@
-import { onPlatform, platformRoles, platformURL } from '@asas/auth'
-import { secret } from '@asas/auth/platform-roles'
+import { onBackoffice, backofficeApp, backofficeRoles, backofficeURL } from '../mithaq/auth/index.ts'
+import { secret } from '../mithaq/auth/backoffice-roles.ts'
 import { actorPermissions, actorRoles, authActor, userRefs, type Held, type RowTable, type Store } from 'mithaq'
-import { isOwner, OWNER_ROLE } from './roles/grants.ts'
+// add-on: roles
+import { isOwner, OWNER_ROLE } from './grants.ts'
+// end add-on: roles
 
 /**
  * What a row may name on the actor: `user.<key>` in any kayan's row is checked
@@ -24,28 +26,28 @@ export type OrganizationActor = {
 }
 
 /**
- * The platform administrator's slug. Platform roles live on Better Auth's
- * `user.role`, never in a tenant's `memberRoles`: `assignedRoles` drops any such
- * assignment, because the access target holds a slug's keys only where this
+ * The backoffice administrator's slug. Backoffice roles live on Better Auth's
+ * `user.role`, never in a tenant's assignment: `assignedRoles` drops any such
+ * slug there, because the access target holds a slug's keys only where this
  * reader answers it.
  */
-export const PLATFORM = 'super_admin'
+export const BACKOFFICE = 'super_admin'
 
 /**
- * The platform screen, the only place the platform roles answer. The app decides
+ * The backoffice screen, the only place the backoffice roles answer. The app decides
  * this, never the request.
  */
-export const PLATFORM_SCREEN = 'platform'
+export const BACKOFFICE_SCREEN = 'backoffice'
 
 /**
- * The kayan whose session carries the platform column, the one `auth.admin`
+ * The kayan whose session carries the backoffice column, the one `auth.admin`
  * names. A build may run several Better Auth instances, and only this one's
  * `user.role` is the layer above every tenant.
  */
-const PLATFORM_KAYAN = 'user'
+const BACKOFFICE_KAYAN = 'user'
 
 /**
- * Platform roles read every tenant's rows and write none; staff change a
+ * Backoffice roles read every tenant's rows and write none; staff change a
  * tenant's data only by impersonating a member, which is audited. Every write is
  * an explicit `false`, because a slug a table leaves out still takes the `'*'`
  * row, which opens every write. The row opens the door and the keys decide who
@@ -53,19 +55,19 @@ const PLATFORM_KAYAN = 'user'
  */
 const readOnly = { create: false, read: true, update: false, delete: false } as const
 
-/** The read-only row under every platform role, which every row table of this project spreads in. */
-export const platformReads = Object.fromEntries(Object.keys(platformRoles).map((slug) => [slug, readOnly])) as {
-  readonly [Slug in keyof typeof platformRoles]: typeof readOnly
+/** The read-only row under every backoffice role, which every row table of this project spreads in. */
+export const backofficeReads = Object.fromEntries(Object.keys(backofficeRoles).map((slug) => [slug, readOnly])) as {
+  readonly [Slug in keyof typeof backofficeRoles]: typeof readOnly
 }
 
 /**
- * Every operation refused under every platform role, spread in place of
- * `platformReads` by tables the platform does not read, such as the settings
+ * Every operation refused under every backoffice role, spread in place of
+ * `backofficeReads` by tables the backoffice does not read, such as the settings
  * global and the audit log.
  */
 const closed = { create: false, read: false, update: false, delete: false } as const
-export const platformClosed = Object.fromEntries(Object.keys(platformRoles).map((slug) => [slug, closed])) as {
-  readonly [Slug in keyof typeof platformRoles]: typeof closed
+export const backofficeClosed = Object.fromEntries(Object.keys(backofficeRoles).map((slug) => [slug, closed])) as {
+  readonly [Slug in keyof typeof backofficeRoles]: typeof closed
 }
 
 /**
@@ -89,13 +91,13 @@ export const currentOrganization = (user: unknown) => {
 }
 
 /**
- * The platform rows of the tenant-owned kayan: `platformReads` minus the
+ * The backoffice rows of the tenant-owned kayan: `backofficeReads` minus the
  * columns `secret` names. A row's field list closes a column whatever keys the
  * actor holds, and a column an actor may not read is no filter either.
  */
 const readsNoSecret = { ...readOnly, fields: ['*', ...secret.map((key) => `!${key.slice(key.indexOf('.fields.') + '.fields.'.length)}`)] as readonly string[] }
-const secretClosed = Object.fromEntries(Object.keys(platformRoles).map((slug) => [slug, readsNoSecret])) as {
-  readonly [Slug in keyof typeof platformRoles]: typeof readsNoSecret
+const secretClosed = Object.fromEntries(Object.keys(backofficeRoles).map((slug) => [slug, readsNoSecret])) as {
+  readonly [Slug in keyof typeof backofficeRoles]: typeof readsNoSecret
 }
 
 /**
@@ -110,39 +112,46 @@ const secretClosed = Object.fromEntries(Object.keys(platformRoles).map((slug) =>
  */
 export const tenantAccess = {
   '*': { create: true, read: true, update: true, delete: true },
+  // add-on: courses
   /**
    * The one row keyed on a system slug, and it narrows: an instructor teaches and
    * never removes a row. Every operation is named in full, because a missing one
    * reads as `false` and a `false` in any applicable row wins.
    */
   instructor: { create: true, read: true, update: true, delete: false },
+  // end add-on: courses
   ...secretClosed,
 } as const satisfies RowTable
 
 /**
  * The roles a kayan's rows are read through; its parameter also types `user` for
- * every row this project writes. Slugs come from the `memberRoles` kayan for the
+ * every row this project writes. Slugs come from the access target for the
  * active organization, off the trusted snapshot, so an object naming its own
- * roles is no one. `member.role` grants one thing only: an owner always holds
- * `administrator` in its tenant, so the role that manages roles is never lost.
+ * roles is no one.
  */
 export const assignedRoles = (actor: OrganizationActor): readonly string[] => {
   if (!authActor(actor)) return []
-  // The platform app answers the platform roles alone and the tenant app the
+  // The backoffice app answers the backoffice roles alone and the tenant app the
   // membership's roles alone, never unioned, so neither adds keys on the other's
   // screens. Which app serves the request is the app's own fact, never the request's.
-  if (onPlatform()) return platformRolesOf(actor)
+  if (onBackoffice()) return backofficeRolesOf(actor)
   if (!currentOrganization(actor)) return []
-  const assigned = (actorRoles(actor) ?? []).filter((slug) => !Object.hasOwn(platformRoles, slug))
-  return isOwner(authActor(actor)?.memberRole) && !assigned.includes(OWNER_ROLE) ? [...assigned, OWNER_ROLE] : assigned
+  const assigned = (actorRoles(actor) ?? []).filter((slug) => !Object.hasOwn(backofficeRoles, slug))
+  // add-on: roles
+  // The slugs are the `memberRoles` kayan's, and `member.role` grants one thing
+  // only: an owner always holds `administrator` in its tenant, so the role that
+  // manages roles is never lost.
+  if (isOwner(authActor(actor)?.memberRole) && !assigned.includes(OWNER_ROLE)) return [...assigned, OWNER_ROLE]
+  // end add-on: roles
+  return assigned
 }
 
 /**
  * Whether `assignedRoles` answers this actor `super_admin`, which only the
- * platform app does. It is the administrator of `auth.admin`, the one answer
+ * backoffice app does. It is the administrator of `auth.admin`, the one answer
  * local auth's `_verified` writes ask, and the reader and writer of local accounts.
  */
-export const superAdmin = ({ user }: { user: unknown }) => assignedRoles(user as OrganizationActor).includes(PLATFORM)
+export const superAdmin = ({ user }: { user: unknown }) => assignedRoles(user as OrganizationActor).includes(BACKOFFICE)
 
 /**
  * Every operation refused to every actor, the administrator included, for the
@@ -153,69 +162,99 @@ export const superAdmin = ({ user }: { user: unknown }) => assignedRoles(user as
 export const providerOnly = { create: () => false, read: () => false, update: () => false, delete: () => false } as const
 
 /**
- * The platform roles this actor holds on Better Auth's `user.role`, whichever app
- * asks. Several are comma-separated, and only a platform role's name counts.
+ * The backoffice roles this actor holds on Better Auth's `user.role`, whichever app
+ * asks. Several are comma-separated, and only a backoffice role's name counts.
  *
  * The column is read off the trusted snapshot, and only from the admin kayan's
  * session on a Better Auth strategy: a build may run several instances that all
  * write `user.role`, and local auth spreads its kayan's row onto the actor, so a
- * `role` column there would otherwise hand someone a platform role.
+ * `role` column there would otherwise hand someone a backoffice role.
  */
-export const platformRolesOf = (actor: unknown): string[] => {
+export const backofficeRolesOf = (actor: unknown): string[] => {
   const trusted = authActor(actor)
-  if (!trusted || trusted.strategy !== 'better-auth' || trusted.collection !== PLATFORM_KAYAN || typeof trusted.role !== 'string') return []
-  return [...new Set(trusted.role.split(',').map((slug) => slug.trim()).filter((slug) => Object.hasOwn(platformRoles, slug)))]
+  if (!trusted || trusted.strategy !== 'better-auth' || trusted.collection !== BACKOFFICE_KAYAN || typeof trusted.role !== 'string') return []
+  return [...new Set(trusted.role.split(',').map((slug) => slug.trim()).filter((slug) => Object.hasOwn(backofficeRoles, slug)))]
 }
 
 /**
- * Where the tenant app's header links the platform app, for an actor whose
- * platform roles hold `screen.platform`; nothing otherwise. It is a link and
- * grants nothing: the platform app's own server decides entry.
+ * Where the tenant app's header links the backoffice app, for an actor whose
+ * backoffice roles hold `screen.backoffice`; nothing otherwise. It is a link and
+ * grants nothing: the backoffice app's own server decides entry. A project that
+ * serves no backoffice app links nowhere.
  */
-export const platformEntry = (actor: unknown): string | undefined => {
-  if (onPlatform()) return undefined
-  const enters = platformRolesOf(actor).some((slug) => {
-    const held = platformRoles[slug as keyof typeof platformRoles].permissions
-    return held === '*' || (held as readonly string[]).includes(`screen.${PLATFORM_SCREEN}`)
+export const backofficeEntry = (actor: unknown): string | undefined => {
+  if (onBackoffice() || !backofficeApp) return undefined
+  const enters = backofficeRolesOf(actor).some((slug) => {
+    const held = backofficeRoles[slug as keyof typeof backofficeRoles].permissions
+    return held === '*' || (held as readonly string[]).includes(`screen.${BACKOFFICE_SCREEN}`)
   })
-  return enters ? new URL(`/${PLATFORM_SCREEN}`, platformURL).href : undefined
+  return enters ? new URL(`/${BACKOFFICE_SCREEN}`, backofficeURL).href : undefined
 }
 
 /**
  * The keys a provider kayan's columns are graded by, which `rows()` takes as its
  * `holds`: in the tenant app the id and the name alone, and only where the actor
- * holds their keys; in the platform app the actor's own keys. An actor holding no
+ * holds their keys; in the backoffice app the actor's own keys. An actor holding no
  * key reads no column, since an empty set grades every column closed where
  * `undefined` would grade none.
  */
 export const namesInTenant = (kayan: string) => (actor: unknown): Held => {
   const held = actorPermissions(actor)
-  if (onPlatform()) return held
+  if (onBackoffice()) return held
   return new Set(['id', 'name'].map((field) => `${kayan}.fields.${field}`).filter((key) => held === true || held?.has(key) === true))
 }
 
+/**
+ * Whom a role reads among its organization's people when it holds no
+ * `member.find`: the members assigned one of the roles named here, beside
+ * itself. A role left out, a custom role included, reads itself alone, so a
+ * key to read people never by itself opens the staff to a portal role.
+ */
+export const peopleAudience: Readonly<Record<string, readonly string[]>> = {
+  // add-on: courses
+  // The students it enrols, never the staff.
+  instructor: ['student'],
+  // end add-on: courses
+}
+
 /**
  * The read the person's own rows are ANDed with, so it narrows and never widens:
  * the members of the organization the actor's session has active, read off the
- * store. The organization is the trusted snapshot's, so a claim is no one's.
+ * store, all of them to a holder of `member.find`, who lists them through the
+ * provider anyway, and otherwise the actor and its roles' `peopleAudience`. The
+ * organization is the trusted snapshot's, so a claim is no one's.
  */
 export const membersOf = (store: Pick<Store, 'find'>) => async ({ user: actor }: { user: unknown }) => {
-  // A platform role reads every person in the platform app; the rows answer who holds one.
-  if (onPlatform()) return true
+  // A backoffice role reads every person in the backoffice app; the rows answer who holds one.
+  if (onBackoffice()) return true
   const active = currentOrganization(actor)
   if (!active) return false
-  const members = await store.find({ kayan: 'member', args: { limit: 0, page: 1, sort: { field: 'id', direction: 'asc' }, where: { organizationId: { equals: active } } } })
+  const all = { limit: 0, page: 1, sort: { field: 'id', direction: 'asc' } } as const
+  const members = await store.find({ kayan: 'member', args: { ...all, where: { organizationId: { equals: active } } } })
   const ids = members.docs.map((row) => row.userId).filter((id): id is string => typeof id === 'string')
-  return ids.length ? { id: { in: ids } } : false
+  const held = actorPermissions(actor)
+  if (held === true || held?.has('member.find')) return ids.length ? { id: { in: ids } } : false
+  const seen = new Set([authActor(actor)?.id])
+  // add-on: roles
+  // A custom role's name is a tenant's to write, so one named `constructor` reads no inherited key.
+  const audience =[...new Set(assignedRoles(actor as OrganizationActor).flatMap((slug) => (Object.hasOwn(peopleAudience, slug) ? peopleAudience[slug]! : [])))]
+  if (audience.length) {
+    const assigned = await store.find({ kayan: 'memberRoles', args: { ...all, where: { organization: { equals: active }, role: { in: audience } } } })
+    for (const row of assigned.docs) seen.add(row.user)
+  }
+  // end add-on: roles
+  // An assignment can outlive its membership, so only a current member is seen.
+  const reached = ids.filter((id) => seen.has(id))
+  return reached.length ? { id: { in: reached } } : false
 }
 
 /**
  * Whether an actor reads past what a kayan's own read narrows for roles not
- * holding `key`: in the platform app, whose staff read every tenant's rows whole,
- * or in a tenant, holding that key. Archived courses, sessions of unreadable
- * courses, covers of unreadable courses and other people's seats narrow this way.
+ * holding `key`: in the backoffice app, whose staff read every tenant's rows whole,
+ * or in a tenant, holding that key. The courses add-on narrows archived courses,
+ * sessions and covers of unreadable courses and other people's seats this way.
  */
 export const readsPast = (actor: unknown, key: string) => {
   const held = actorPermissions(actor)
-  return onPlatform() || held === true || held?.has(key) === true
+  return onBackoffice() || held === true || held?.has(key) === true
 }

package/template/templates/{asas/src → mithaq/src/roles}/tenant-roles.ts

@@ -1,5 +1,9 @@
 import type { SystemRoles } from 'mithaq'
+// without add-on: roles
+// import { defaultMemberRoles } from './default-member-roles.ts'
+// end without add-on: roles
 
+// add-on: courses
 /** A session's columns but its `enrollments`, which the registrar and the instructor read alike. */
 const sessionColumns = [
   'sessions.fields.id',
@@ -12,9 +16,29 @@ const sessionColumns = [
   'sessions.fields.venue',
   'sessions.fields.format',
   'sessions.fields.archived',
+  'sessions.fields.archiveReason',
   'sessions.fields.details',
 ] as const
 
+/**
+ * What the portal's catalogue and course page read beside a course's own columns, for its roles alike: the
+ * sessions with the seats each has left, and the names of the tags it carries.
+ */
+const catalogueReads = [
+  'courses.findWithSessions',
+  'courses.fields.tags',
+  'courses.fields.selfEnroll',
+  'tags.find',
+  'tags.findByID',
+  'tags.fields.id',
+  'tags.fields.name',
+] as const
+
+// add-on: settings
+/** Whether the portal is closed for maintenance, and where to write, which the portal's foot reads for its roles alike. */
+const portalSettings = ['settings.findOne', 'settings.fields.maintenance', 'settings.fields.contactEmail'] as const
+// end add-on: settings
+
 /** A course's cover, read and never changed, which the portal's roles read alike. */
 const coverReads = [
   'media.find',
@@ -32,41 +56,43 @@ const coverReads = [
   'media.fields.updatedAt',
   'media.fields.width',
 ] as const
+// end add-on: courses
 
 /**
  * The roles this project ships to every tenant, written in code and never a
- * row: the access target takes them whole and reads what each holds from here,
- * and the `roles` kayan holds a tenant's own roles alone. A page lists them from
- * here too, which is why this file imports nothing.
+ * row: the access target takes them whole and reads what each holds from here.
+ * A page lists them from here too, which is why this file imports no server
+ * code.
  *
  * A slug here is the whole vocabulary of role names: a row table may be keyed on
  * one of them or on `'*'` and on nothing else, and `buildAsas` refuses a key
  * that is not in this project's catalog exactly as it does for a row's own.
  *
- * **These are business roles and never governance.** Better Auth's own
- * `member.role`, which holds `owner`, `admin` or `member`, stays what the
- * provider uses for settings, members and invitations, and nothing here reads
- * it. Sharing one comma-joined column would inherit the provider's own open
- * comma-in-a-role-name bug.
- *
- * A new organization's creator is assigned `administrator` while the
- * organization is being created, by the hook the template wires into the
- * provider, so a fresh tenant has a root granter from its first moment. That
- * row is written straight through the store, because a managed create is graded
- * against the actor making it and the creator is in no organization until that
- * route puts it in one.
- *
- * The platform roles, `super_admin` among them, are not here: they are staff
+ * The backoffice roles, `super_admin` among them, are not here: they are staff
  * above every tenant, held on Better Auth's `user.role`, and the access target
- * holds their keys in the platform app alone. Inside a tenant every actor, a
+ * holds their keys in the backoffice app alone. Inside a tenant every actor, a
  * `super_admin` included, holds what its membership's roles hold and nothing
- * more. These are the roles an assignment may name.
+ * more.
  */
 export const tenantRoles = {
+  // add-on: roles
+  // These are business roles and never governance, and the `roles` kayan holds
+  // a tenant's own roles beside them; an assignment names one of either. Better
+  // Auth's own `member.role`, which holds `owner`, `admin` or `member`, stays
+  // what the provider uses for settings, members and invitations, and nothing
+  // here reads it. Sharing one comma-joined column would inherit the provider's
+  // own open comma-in-a-role-name bug.
+  //
+  // A new organization's creator is assigned `administrator` while the
+  // organization is being created, by the hook the template wires into the
+  // provider, so a fresh tenant has a root granter from its first moment. That
+  // row is written straight through the store, because a managed create is
+  // graded against the actor making it and the creator is in no organization
+  // until that route puts it in one.
   /**
    * The tenant's root granter: every key of the project, which is what lets it
    * author a custom role at all. `'*'` holds every screen's key too, so it
-   * enters the dashboard and the portal alike. It never reaches the platform
+   * enters the dashboard and the portal alike. It never reaches the backoffice
    * app, where the reader answers no membership role at all.
    * `grantedPermissions` returns early on a granter holding everything, so this
    * role and no other may hand out a key it will never use itself.
@@ -80,11 +106,15 @@ export const tenantRoles = {
     label: { ar: 'مسجل', en: 'Registrar' },
     permissions: [
       'screen.dashboard',
+      // add-on: courses
       'courses.create',
       'courses.find',
       'courses.count',
       'courses.findByID',
       'courses.update',
+      // A course leaves the catalogue and comes back through its own operations, each with its reason.
+      'courses.archive',
+      'courses.unarchive',
       'courses.fields.archived',
       'courses.fields.archiveReason',
       'courses.fields.createdAt',
@@ -97,6 +127,7 @@ export const tenantRoles = {
       'courses.fields.organization',
       'courses.fields.title',
       'courses.fields.updatedAt',
+      'courses.fields.selfEnroll',
       // Whether a course is a draft, its versions and the restore of one: the
       // registrar edits the catalogue, so it reads a course's history and puts
       // an older copy back.
@@ -113,6 +144,7 @@ export const tenantRoles = {
       // read of it is refused for its fields and its pages draw nothing. Not a
       // session's `enrollments`, which reads a kayan this role does not.
       ...sessionColumns,
+      // end add-on: courses
       'tags.find',
       'tags.count',
       'tags.findByID',
@@ -121,6 +153,7 @@ export const tenantRoles = {
       'tags.fields.updatedAt',
       'tags.fields.organization',
       'tags.fields.name',
+      // add-on: media
       // The images a course's cover is picked from, which it uploads,
       // re-describes and deletes once no course points at one.
       'media.create',
@@ -141,6 +174,8 @@ export const tenantRoles = {
       'media.fields.organization',
       'media.fields.updatedAt',
       'media.fields.width',
+      // end add-on: media
+      // add-on: audit-log
       // The activity panel on each edit page it opens: the entries of the
       // kayan it lists, each change graded by the column's own key above.
       'auditLog.find',
@@ -152,8 +187,10 @@ export const tenantRoles = {
       'auditLog.fields.actor',
       'auditLog.fields.impersonatedBy',
       'auditLog.fields.changes',
+      // end add-on: audit-log
     ],
   },
+  // add-on: courses
   /**
    * Teaches: reads the catalogue and enrols. It holds no `courses.archive`. It
    * works in the portal, which draws the courses and the enrolments, and never
@@ -171,10 +208,14 @@ export const tenantRoles = {
       'courses.fields.cover',
       'courses.fields.details',
       'courses.fields.id',
-      'courses.fields.tags',
       'courses.fields.organization',
       'courses.fields.title',
       'courses.fields.updatedAt',
+      // What the portal's catalogue draws on a course's card and its page.
+      'courses.fields.summary',
+      'courses.fields.fee',
+      'courses.fields.currency',
+      'courses.fields.delivery',
       // It reads published courses alone, and whether one is published with them.
       'courses.fields._status',
       'enrollments.create',
@@ -195,15 +236,19 @@ export const tenantRoles = {
       'sessions.count',
       'sessions.findByID',
       ...sessionColumns,
-      // The people of its organization by their id and name alone, which the
+      // The students of its organization by their id and name alone, which the
       // enrollment drawer's student picker lists and an enrollment's student is
-      // titled by.
+      // titled by: `peopleAudience` in `tenant-access.ts` names whom it reads.
       'user.find',
       'user.count',
       'user.findByID',
       'user.fields.id',
       'user.fields.name',
       ...coverReads,
+      ...catalogueReads,
+      // add-on: settings
+      ...portalSettings,
+      // end add-on: settings
     ],
   },
   /**
@@ -216,8 +261,9 @@ export const tenantRoles = {
    * alone would hand a student every other student's seat. The enrollments'
    * own access narrows them to the student's own seats, since it holds no
    * `enrollments.others`, and the sessions' to those of the courses it reads.
-   * It reads no seat's `student`, which is itself on every row it reads, and
-   * writes no enrollment.
+   * It takes a seat for itself alone, in a course that lets its students enroll
+   * themselves and before the session starts, and gives one back before then:
+   * the enrollments' own steps hold it to that. It changes no seat.
    */
   student: {
     label: { ar: 'طالب', en: 'Student' },
@@ -245,11 +291,15 @@ export const tenantRoles = {
       'enrollments.find',
       'enrollments.count',
       'enrollments.findByID',
+      'enrollments.create',
+      'enrollments.delete',
       'enrollments.fields.id',
       'enrollments.fields.createdAt',
       'enrollments.fields.updatedAt',
       'enrollments.fields.organization',
       'enrollments.fields.session',
+      // Itself, which its own create fills and every seat it reads names.
+      'enrollments.fields.student',
       // The sessions its seats name, which the enrollment's session cell draws
       // by course and start.
       'sessions.find',
@@ -257,6 +307,15 @@ export const tenantRoles = {
       'sessions.findByID',
       ...sessionColumns,
       ...coverReads,
+      ...catalogueReads,
+      // add-on: settings
+      ...portalSettings,
+      // end add-on: settings
     ],
   },
+  // end add-on: courses
+  // end add-on: roles
+  // without add-on: roles
+  // ...defaultMemberRoles,
+  // end without add-on: roles
 } as const satisfies SystemRoles

package/template/templates/{asas → mithaq}/src/steps/expected-updated-at.ts

@@ -10,7 +10,7 @@
 // Listing the step without widening the input protects nothing, since the strict update
 // shape refuses the key by name.
 //
-// The compare is against `ctx.dataBefore`, loaded with `lock: 'update'` inside the update's
+// The compare is against `ctx.dataBefore`, loaded under the update's own row lock inside its
 // transaction, so on a store that honours the lock a second writer waits and no write lands
 // between the compare and the store step. A store that ignores the lock lets both through.
 //
@@ -38,4 +38,4 @@ export const expectedUpdatedAt = (ctx: Ctx<{ expectedUpdatedAt?: Date | string }
   }
   return ctx
 }
-// mithaq-admin b06d8d335d306c07556f8f2b81fba20ba7ded198 dad3f2c08ca33c2d63db0e3e11df5a2ba9d8acbba71ba77599ab76d625f2189f
+// mithaq-admin 0.0.0 10cc4a57db299d48c4fd53314ed42e02fc04b0464a7fa8a0c512cefc7ccb2b82

package/template/templates/{asas → mithaq}/src/storage/index.ts

@@ -8,7 +8,7 @@
 // `mithaq-storage` registry item and owned by the project: `mithaq upgrade
 // --check` reports one that was edited, and an edit is merged by hand.
 import { randomBytes } from 'node:crypto'
-import { defaultFileSize, type StorageConfig } from 'mithaq'
+import { defaultFileSize, defaultMaxBodyBytes, type StorageConfig } from 'mithaq'
 import {
   defaultDisposition,
   defaultKey,
@@ -81,6 +81,8 @@ export const storageConfig: StorageConfig = {
   adapter,
   // The largest file a kayan holds when its targets.storage names no fileSize.
   fileSize: defaultFileSize,
+  // The largest instructions request read; files themselves never come this way.
+  maxBodyBytes: defaultMaxBodyBytes,
   key: defaultKey,
   verify: defaultVerify,
   disposition: defaultDisposition,

package/template/templates/mithaq/src/ui/activity-page.tsx

@@ -0,0 +1,33 @@
+// The dashboard's Activity page: every change in the organization, read as the
+// viewer from the log's `find`, which answers this tenant's entries alone, of
+// the kayan the viewer lists. A file of its own beside `activity.tsx`, since the
+// shell it draws in holds the app's own pieces.
+import { useEffect, useState } from 'react'
+import { useAccess, useLocale } from 'mithaq/admin/react'
+import { ActivityLog, filtersOf, type ActivityQuery } from './activity.tsx'
+import { AppShell } from './app-shell.tsx'
+
+/**
+ * The page, filtered at first by what its link names, such as one record's
+ * entries from that record's panel. The link is read once the page is in the
+ * browser, since the server renders no location.
+ */
+export function ActivityPage() {
+  const { t } = useLocale()
+  const people = useAccess().collections?.user?.read === true
+  const [query, setQuery] = useState<ActivityQuery>()
+  useEffect(() => setQuery(filtersOf({ search: window.location.search, people })), [])
+  return (
+    <AppShell
+      regions={{
+        header: <h1>{t('auditLog.activity', 'Activity')}</h1>,
+        main: (
+          <section data-dashboard="activity" className="grid gap-4">
+            <p className="text-muted-foreground">{t('auditLog.about', 'Every change in this organization, newest first.')}</p>
+            {query ? <ActivityLog query={query} onQuery={setQuery} /> : <p className="text-muted-foreground text-sm">{t('auditLog.loading', 'Loading activity…')}</p>}
+          </section>
+        ),
+      }}
+    />
+  )
+}