create-nevela 0.7.1 → 0.9.1

package/template/laravel/src/Support/PublicAccess.php

@@ -0,0 +1,208 @@
+<?php
+
+namespace Nevela\Laravel\Support;
+
+use InvalidArgumentException;
+
+/**
+ * What of a resource is open to anyone, signed in or not: the descriptor's "public" section.
+ *
+ *   "public": {
+ *     "read":   { "by": "slug", "fields": ["title", "slug", "body", "publishedAt"] },
+ *     "create": { "fields": ["name", "email", "message"], "throttle": "10,1" }
+ *   }
+ *
+ * Nothing is open without it, and nothing beyond what it names: a resource with "read"
+ * alone can't be written to, and a field that isn't listed is never sent or accepted.
+ * Which records can be read is the model's to say, in its publicQuery scope.
+ *
+ * A form anyone can send is sent by bots too, so a create can say what stands in their
+ * way, and whether the address it is given has to be proved:
+ *
+ *     "create": {
+ *       "fields": ["email"],
+ *       "protect": { "turnstile": true, "honeypot": true, "minSeconds": 3, "email": "email" },
+ *       "confirm": "email"
+ *     }
+ *
+ * See Forms\FormGuard for the checks, and Forms\Confirmation for the link.
+ */
+final class PublicAccess
+{
+    /** Requests a minute, when the section doesn't say: plenty for a page, few for a form. */
+    public const READ_THROTTLE = '60,1';
+
+    public const CREATE_THROTTLE = '10,1';
+
+    /** What "protect" can turn on. */
+    public const CHECKS = ['turnstile', 'honeypot', 'minSeconds', 'email'];
+
+    /** The longest a form can be made to wait before it is sent, in seconds. */
+    public const MAX_SECONDS = 3600;
+
+    /**
+     * @param  list<string>|null  $read  The fields anyone may read, or null when nothing may be
+     * @param  string|null  $by  The unique field one record is fetched by, in place of its id
+     * @param  list<string>|null  $create  The fields anyone may send to create a record, or null when nobody may
+     * @param  list<string>  $middleware  More middleware for these routes: the app's own spam checks
+     * @param  array{turnstile: bool, honeypot: bool, minSeconds: int, email: string|null}|null  $protect  The checks a create passes before it is looked at, or null for none
+     * @param  string|null  $confirm  The field holding an address its owner has to prove, by a link sent to it
+     */
+    public function __construct(
+        public readonly ?array $read = null,
+        public readonly ?string $by = null,
+        public readonly ?array $create = null,
+        public readonly string $readThrottle = self::READ_THROTTLE,
+        public readonly string $createThrottle = self::CREATE_THROTTLE,
+        public readonly array $middleware = [],
+        public readonly ?array $protect = null,
+        public readonly ?string $confirm = null,
+    ) {
+        foreach ([$readThrottle, $createThrottle] as $throttle) {
+            if (! preg_match('/^[1-9][0-9]*,[1-9][0-9]*$/', $throttle)) {
+                throw new InvalidArgumentException("\"{$throttle}\" is not a throttle. Write how many requests in how many minutes: \"10,1\".");
+            }
+        }
+        if ($read === null && $create === null) {
+            throw new InvalidArgumentException('A "public" section opens something: give it "read", "create" or both.');
+        }
+        foreach ($middleware as $name) {
+            if (! is_string($name) || ! preg_match('/^[A-Za-z0-9_.:,\\\\-]+$/', $name)) {
+                throw new InvalidArgumentException('Public middleware is named as in a route: "honeypot", or "throttle:5,1".');
+            }
+        }
+        if ($protect !== null && ! $protect['turnstile'] && ! $protect['honeypot'] && $protect['minSeconds'] === 0 && $protect['email'] === null) {
+            throw new InvalidArgumentException('"protect" turns nothing on. Give it "turnstile", "honeypot", "minSeconds" or "email", or leave it out.');
+        }
+        if ($protect !== null && ($protect['minSeconds'] < 0 || $protect['minSeconds'] > self::MAX_SECONDS)) {
+            throw new InvalidArgumentException('"minSeconds" is how long a person takes to fill the form in: between 0 and '.self::MAX_SECONDS.'.');
+        }
+    }
+
+    /** Whether a create has checks to pass. */
+    public function protected(): bool
+    {
+        return $this->protect !== null;
+    }
+
+    /**
+     * "protect" as it is written, made whole: every check said yes or no to.
+     *
+     * @return array{turnstile: bool, honeypot: bool, minSeconds: int, email: string|null}
+     */
+    private static function protection(mixed $given): array
+    {
+        if (! is_array($given)) {
+            throw new InvalidArgumentException('"protect" lists the checks to make: { "turnstile": true, "honeypot": true, "minSeconds": 3, "email": "email" }.');
+        }
+        if (($unknown = array_diff(array_keys($given), self::CHECKS)) !== []) {
+            throw new InvalidArgumentException('"protect" has no check called "'.reset($unknown).'". There are: '.implode(', ', self::CHECKS).'.');
+        }
+        $seconds = $given['minSeconds'] ?? 0;
+        if (! is_int($seconds)) {
+            throw new InvalidArgumentException('"minSeconds" is a whole number of seconds.');
+        }
+        $email = $given['email'] ?? null;
+        if ($email !== null && ! is_string($email)) {
+            throw new InvalidArgumentException('"email" in "protect" names the field that holds the address.');
+        }
+
+        return ['turnstile' => ($given['turnstile'] ?? false) === true, 'honeypot' => ($given['honeypot'] ?? false) === true, 'minSeconds' => $seconds, 'email' => $email];
+    }
+
+    /** @param array<string, mixed> $data */
+    public static function fromArray(array $data): self
+    {
+        $read = isset($data['read']) ? (array) $data['read'] : null;
+        $create = isset($data['create']) ? (array) $data['create'] : null;
+
+        return new self(
+            $read === null ? null : array_values(array_map('strval', (array) ($read['fields'] ?? []))),
+            $read['by'] ?? null,
+            $create === null ? null : array_values(array_map('strval', (array) ($create['fields'] ?? []))),
+            (string) ($read['throttle'] ?? self::READ_THROTTLE),
+            (string) ($create['throttle'] ?? self::CREATE_THROTTLE),
+            array_values((array) ($data['middleware'] ?? [])),
+            isset($create['protect']) ? self::protection($create['protect']) : null,
+            isset($create['confirm']) ? (string) $create['confirm'] : null,
+        );
+    }
+
+    /** @return array<string, mixed> */
+    public function toArray(): array
+    {
+        return array_filter([
+            'read' => $this->read === null ? null : array_filter([
+                'by' => $this->by,
+                'fields' => $this->read,
+                'throttle' => $this->readThrottle === self::READ_THROTTLE ? null : $this->readThrottle,
+            ], fn ($v) => $v !== null),
+            'create' => $this->create === null ? null : array_filter([
+                'fields' => $this->create,
+                'throttle' => $this->createThrottle === self::CREATE_THROTTLE ? null : $this->createThrottle,
+                // Only what is on, so a descriptor reads as it was written.
+                'protect' => $this->protect === null ? null : array_filter($this->protect, fn ($v) => $v !== false && $v !== 0 && $v !== null),
+                'confirm' => $this->confirm,
+            ], fn ($v) => $v !== null),
+            'middleware' => $this->middleware ?: null,
+        ], fn ($v) => $v !== null);
+    }
+
+    /**
+     * Checked against the resource's fields, which the section on its own can't know.
+     *
+     * @param  array<string, Field>  $fields
+     *
+     * @throws InvalidArgumentException
+     */
+    public function check(string $resource, array $fields): void
+    {
+        foreach (['read' => $this->read, 'create' => $this->create] as $what => $listed) {
+            if ($listed === null) {
+                continue;
+            }
+            if ($listed === []) {
+                throw new InvalidArgumentException("{$resource}: public {$what} names no fields, so there would be nothing to {$what}.");
+            }
+            foreach ($listed as $field) {
+                if (! isset($fields[$field])) {
+                    throw new InvalidArgumentException("{$resource}: public {$what} lists \"{$field}\", which is not one of its fields.");
+                }
+            }
+        }
+        foreach ($this->read ?? [] as $field) {
+            if ($fields[$field]->private) {
+                throw new InvalidArgumentException("{$resource}: \"{$field}\" is a private file, so it can't be read by anyone who asks.");
+            }
+        }
+        if ($this->by !== null) {
+            if ($this->read === null) {
+                throw new InvalidArgumentException("{$resource}: \"by\" says how one record is read, and nothing is.");
+            }
+            if (! isset($fields[$this->by]) || ! $fields[$this->by]->unique) {
+                throw new InvalidArgumentException("{$resource}: a record is fetched by \"{$this->by}\", which has to be a unique field ({$this->by}:slug!).");
+            }
+        }
+        if ($this->create === null && ($this->protect !== null || $this->confirm !== null)) {
+            throw new InvalidArgumentException("{$resource}: \"protect\" and \"confirm\" are about a public create, and there isn't one.");
+        }
+        foreach (['protect.email' => $this->protect['email'] ?? null, 'confirm' => $this->confirm] as $what => $named) {
+            if ($named === null) {
+                continue;
+            }
+            // The address has to be something a visitor types into the form.
+            if (! in_array($named, $this->create ?? [], true) || $fields[$named]->kind !== 'string') {
+                throw new InvalidArgumentException("{$resource}: {$what} names \"{$named}\", which has to be a text field the public create lists.");
+            }
+        }
+        if ($this->create !== null) {
+            foreach ($fields as $field) {
+                // Left out of the form, a field needs something to be: nothing, or a default.
+                // (A yes/no column is no unless said otherwise.)
+                if ($field->required && $field->default === null && $field->kind !== 'boolean' && ! in_array($field->name, $this->create, true)) {
+                    throw new InvalidArgumentException("{$resource}: \"{$field->name}\" is required and a public create can't send it. List it under create, give it a default, or make it optional.");
+                }
+            }
+        }
+    }
+}

package/template/laravel/src/Support/Slug.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace Nevela\Laravel\Support;
+
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+
+/**
+ * A slug nobody typed: made from another field, and made different from every one
+ * already in the table.
+ *
+ * "Opening day" is `opening-day`; the next post of that name is `opening-day-2`. Records
+ * in the trash are counted, because they still hold their value and can come back with it.
+ */
+final class Slug
+{
+    /** Room left at the end of the column's 255 for the "-12" that makes one different. */
+    private const LONGEST = 240;
+
+    /**
+     * @param  array<string, true>  $taken  Values spoken for that the table doesn't hold yet: earlier rows of the same batch. The one returned is added.
+     */
+    public static function free(string $table, string $column, string $from, array &$taken = []): string
+    {
+        $base = Str::limit(Str::slug($from), self::LONGEST, '');
+        // A title with nothing a slug can keep (all symbols, say) still needs an address.
+        $base = trim($base, '-') !== '' ? trim($base, '-') : 'untitled';
+
+        $held = $taken;
+        // Straight from the table, past the model's scopes: a record in the trash holds its slug too.
+        foreach (DB::table($table)->where($column, $base)->orWhere($column, 'like', $base.'-%')->pluck($column) as $existing) {
+            $held[(string) $existing] = true;
+        }
+
+        $slug = $base;
+        for ($n = 2; isset($held[$slug]); $n++) {
+            $slug = "{$base}-{$n}";
+        }
+        $taken[$slug] = true;
+
+        return $slug;
+    }
+}

package/template/laravel/src/Trash/Trash.php

@@ -102,7 +102,9 @@ final class Trash
     public static function purge(Model $record): bool
     {
         try {
-            $record->forceDelete();
+            // In a transaction of its own. Called inside another, that makes it a savepoint:
+            // on Postgres a refused delete would otherwise abort everything around it.
+            $record->getConnection()->transaction(fn () => $record->forceDelete());
 
             return true;
         } catch (QueryException $e) {

package/template/web/.env.example

@@ -1,2 +1,6 @@
 # Where Nevela's routes live in the Laravel app (apps/api), including the prefix.
 NEVELA_API_URL=http://127.0.0.1:8000/api
+
+# Cloudflare Turnstile's site key, for a public form whose descriptor asks for the robot
+# check. Its secret key goes in apps/api/.env as TURNSTILE_SECRET_KEY.
+# NEXT_PUBLIC_TURNSTILE_SITE_KEY=

package/template/web/app/api/[...path]/route.ts

@@ -1,11 +1,13 @@
 import type { NextRequest } from "next/server";
-import { API_URL, sessionToken } from "@/lib/laravel";
+import { API_URL, callerHeaders, sessionToken } from "@/lib/laravel";
 
 /**
  * The browser's way to the Laravel API, for the few things a server action can't do:
  *
  * - reading, for the relation picker's search (`/api/categories?q=…`),
- * - showing stored files (`/api/_nevela/files/<key>`), and
+ * - showing stored files (`/api/_nevela/files/<key>`),
+ * - downloading a private one (`/api/_nevela/private/<slug>/<id>/<field>`), which Laravel
+ *   hands only to someone who may view that record, and
  * - uploading one (`PUT /api/_nevela/uploads/<Resource>/<field>`), which needs the
  *   browser's upload progress and is larger than a server action accepts.
  *
@@ -13,6 +15,11 @@ import { API_URL, sessionToken } from "@/lib/laravel";
  * as a Bearer token. Laravel still decides what the person may see or store. Everything
  * else that changes data goes through the server actions, so nothing but an upload is
  * let through here as a write.
+ *
+ * And for a site's visitors, who have no session: what a resource's "public" section
+ * opens (`/api/public/…`). Reading it, a form's create (`POST /api/public/<slug>`) and a
+ * file for that form (`PUT /api/public/_nevela/uploads/<Resource>/<field>`) go through
+ * with no token. Laravel has those routes only for resources whose descriptor opens them.
  */
 export const dynamic = "force-dynamic";
 
@@ -23,7 +30,7 @@ const MAX_UPLOAD_BYTES = 64 * 1024 * 1024;
  * What is passed back from Laravel's answer. Not its length or encoding: fetch() hands
  * over the body already decompressed, so the length Laravel gave may no longer be true.
  */
-const RESPONSE_HEADERS = ["content-type", "cache-control", "etag", "last-modified", "location", "x-content-type-options"];
+const RESPONSE_HEADERS = ["content-type", "content-disposition", "cache-control", "etag", "last-modified", "location", "x-content-type-options"];
 
 type Context = { params: Promise<{ path: string[] }> };
 
@@ -32,11 +39,16 @@ function target(path: string[], search: string): string | null {
   return `${API_URL}/${path.map(encodeURIComponent).join("/")}${search}`;
 }
 
-async function forward(url: string, init: RequestInit, withToken: boolean): Promise<Response> {
+/** Whether an address is under what a resource's "public" section opens. */
+const isPublic = (path: string[]) => path[0] === "public" && path.length > 1;
+
+async function forward(url: string, init: RequestInit, withToken: boolean, forVisitor = false): Promise<Response> {
   const headers = new Headers(init.headers);
   headers.set("Accept", headers.get("Accept") ?? "application/json");
   const token = withToken ? await sessionToken() : undefined;
   if (token) headers.set("Authorization", `Bearer ${token}`);
+  // Whose request this is, so Laravel's throttle counts the visitor and not this server.
+  if (forVisitor) for (const [name, value] of Object.entries(await callerHeaders())) headers.set(name, value);
 
   let upstream: Response;
   try {
@@ -68,17 +80,38 @@ export async function GET(request: NextRequest, context: Context) {
   // a request with no session is told 401; asked as a page, Laravel would try to send it
   // to a sign-in route this app doesn't have. A file is asked for as the browser wants it.
   const accept = isFile ? (request.headers.get("accept") ?? "*/*") : "application/json";
-  return forward(url, { method: "GET", headers: { Accept: accept, ...conditional } }, !isFile);
+  // What is public is the same for everyone, so it is asked for as nobody.
+  return forward(url, { method: "GET", headers: { Accept: accept, ...conditional } }, !isFile && !isPublic(path), isPublic(path));
+}
+
+/**
+ * A visitor's form: a public create. Nothing else is posted this way. A signed-in
+ * person's saves go through the dashboard's server actions.
+ */
+export async function POST(request: NextRequest, context: Context) {
+  const { path } = await context.params;
+  const url = target(path, request.nextUrl.search);
+  if (!url || path.length !== 2 || path[0] !== "public" || path[1].startsWith("_")) {
+    return Response.json({ error: "Only a public form is sent this way. Records are saved through the dashboard." }, { status: 405 });
+  }
+  const length = Number(request.headers.get("content-length") ?? 0);
+  if (length > 1024 * 1024) return Response.json({ error: "That is too much to send." }, { status: 413 });
+  const body = await request.text();
+  if (body.length > 1024 * 1024) return Response.json({ error: "That is too much to send." }, { status: 413 });
+  return forward(url, { method: "POST", body, headers: { "Content-Type": "application/json" } }, false, true);
 }
 
 export async function PUT(request: NextRequest, context: Context) {
   const { path } = await context.params;
   const url = target(path, request.nextUrl.search);
-  if (!url || path[0] !== "_nevela" || path[1] !== "uploads") {
+  // A visitor's file for a public form: /api/public/_nevela/uploads/<Resource>/<field>.
+  const forVisitor = path.length === 5 && path[0] === "public" && path[1] === "_nevela" && path[2] === "uploads";
+  if (!url || !(forVisitor || (path[0] === "_nevela" && path[1] === "uploads"))) {
     return Response.json({ error: "Only uploads are sent this way. Records are saved through the dashboard." }, { status: 405 });
   }
-  // Nothing is read until it is known who is sending it and how much there is.
-  if (!(await sessionToken())) return Response.json({ error: "Sign in first." }, { status: 401 });
+  // Nothing is read until it is known who is sending it and how much there is. (A visitor
+  // is nobody, by design: Laravel takes their file only for a field a public form lists.)
+  if (!forVisitor && !(await sessionToken())) return Response.json({ error: "Sign in first." }, { status: 401 });
   const length = Number(request.headers.get("content-length"));
   if (!Number.isFinite(length) || length <= 0) return Response.json({ error: "The upload didn't say how large it is." }, { status: 411 });
   if (length > MAX_UPLOAD_BYTES) {
@@ -91,5 +124,5 @@ export async function PUT(request: NextRequest, context: Context) {
   if (body.byteLength > MAX_UPLOAD_BYTES) {
     return Response.json({ error: "That file is too large to upload." }, { status: 413 });
   }
-  return forward(url, { method: "PUT", body, headers: { "Content-Type": request.headers.get("content-type") ?? "application/octet-stream" } }, true);
+  return forward(url, { method: "PUT", body, headers: { "Content-Type": request.headers.get("content-type") ?? "application/octet-stream" } }, !forVisitor, forVisitor);
 }

package/template/web/app/confirm/page.tsx

@@ -0,0 +1,51 @@
+import Link from "next/link";
+import { AuthShell } from "@/components/auth/auth-shell";
+import { laravel } from "@/lib/laravel";
+
+export const metadata = { title: "Confirm your address", robots: { index: false } };
+
+/**
+ * Where the link in a confirmation email leads: a list someone joined through a public
+ * form whose descriptor has "confirm". Opening it proves the address is theirs.
+ *
+ * Laravel made the link and Laravel checks it. This page passes on what the link
+ * carries and says how it went. To send people somewhere of your own, change what is
+ * shown here, or point nevela.public.confirm.path at another page that does the same.
+ */
+export default async function ConfirmPage({ searchParams }: { searchParams: Promise<{ list?: string; id?: string; key?: string }> }) {
+  const { list = "", id = "", key = "" } = await searchParams;
+  // Only what a link of ours looks like is passed on.
+  const wellFormed = /^[a-z0-9][a-z0-9-]{0,80}$/.test(list) && /^[A-Za-z0-9-]{1,40}$/.test(id) && /^[a-f0-9]{64}$/.test(key);
+
+  let confirmed = false;
+  let unreachable = false;
+  if (wellFormed) {
+    try {
+      const response = await laravel(`public/_nevela/confirm/${list}/${id}/${key}`, { method: "POST", token: null });
+      confirmed = response.ok;
+      unreachable = response.status >= 500 || response.status === 429;
+    } catch {
+      unreachable = true;
+    }
+  }
+
+  const [title, subtitle] = confirmed
+    ? ["You're confirmed", "Thank you. Your address is on the list."]
+    : unreachable
+      ? ["We couldn't check that just now", "Nothing is wrong with your link. Open it again in a moment."]
+      : ["This link is no longer good", "It may have been used too late. Sign up again and we'll send a new one."];
+
+  return (
+    <AuthShell
+      title={title}
+      subtitle={subtitle}
+      footer={
+        <Link href="/" className="font-medium text-link hover:underline">
+          Back to the site
+        </Link>
+      }
+    >
+      {null}
+    </AuthShell>
+  );
+}

package/template/web/app/dashboard/actions.ts

@@ -8,6 +8,7 @@ import { revalidateResource } from "@/lib/cache";
 import { fileUrl } from "@/lib/files";
 import { laravel } from "@/lib/laravel";
 import { allResources, resourcePath, dashboardSession, dashboardStore, mayDo } from "@/lib/dashboard";
+import { actionsOf, formOf, publishFieldOf } from "@/lib/extras";
 
 export type ActionResult<T = unknown> =
   | { ok: true; data: T }
@@ -36,6 +37,39 @@ export async function deleteRecordAction(resourceName: string, id: string): Prom
   return result;
 }
 
+/**
+ * Run one of a resource's own actions (the descriptor's "actions"): on one record, on
+ * the rows selected, or on the list as a whole.
+ *
+ * Laravel does it, in the class the app wrote for it, and decides everything: who may,
+ * whether it applies, whether what was filled in is valid. Its answer comes back as it
+ * is, so a problem with a field can be shown on that field.
+ */
+export async function runResourceAction(
+  resourceName: string,
+  key: string,
+  target: { id?: string; ids?: string[] },
+  input: Record<string, unknown> = {},
+): Promise<ActionResult<{ message: string; done?: number; skipped?: number }>> {
+  const { allowed: inAdmin, may } = await dashboardSession();
+  const resource = allResources().find((item) => item.name === resourceName);
+  const action = actionsOf(resourceName).find((item) => item.key === key);
+  if (!inAdmin || !resource || !action || !may(action.permission)) return forbidden();
+  if (target.ids && target.ids.length > 500) return { ok: false, status: 400, error: "That's more than 500 records. Do them in smaller batches." };
+
+  const path = target.id ? `${resource.slug}/${encodeURIComponent(target.id)}/_actions/${key}` : `${resource.slug}/_actions/${key}`;
+  const response = await laravel(path, { method: "POST", body: { input, ...(target.ids ? { ids: target.ids } : {}) } });
+  const body = (response.body ?? {}) as { message?: string; done?: number; skipped?: number; error?: string; detail?: string; issues?: FieldIssue[] };
+  if (!response.ok) {
+    // `detail` is only sent while the Laravel app is in debug mode: the reason, for whoever is building it.
+    return { ok: false, status: response.status, error: body.detail ? `${body.error ?? "It didn't work."} ${body.detail}` : (body.error ?? "It didn't work."), issues: body.issues };
+  }
+  // What it changed could be anything of this resource's, so everything of it is read again.
+  revalidateResource({ resource: resourceName, action: "update", id: target.id ?? "" });
+  revalidatePath(resourcePath(resource));
+  return { ok: true, data: { message: body.message ?? `${action.label}: done.`, done: body.done, skipped: body.skipped } };
+}
+
 /** How many rows one export may fetch: enough for a spreadsheet. */
 const EXPORT_LIMIT = 50_000;
 /** Laravel's `nevela.max_per_page`. */
@@ -77,8 +111,11 @@ export async function exportRecordsAction(resourceName: string, query: string):
 
   const rows: Record<string, unknown>[] = [];
   let truncated = false;
+  // Someone who joined a list and hasn't proved their address isn't on it yet.
+  const confirmedOnly = formOf(resourceName)?.confirm !== undefined && !new URLSearchParams(query).has("filter[confirmed]");
   for (let page = 1; rows.length < EXPORT_LIMIT; page++) {
     const params = new URLSearchParams(query);
+    if (confirmedOnly) params.set("filter[confirmed]", "true");
     params.set("page", String(page));
     params.set("perPage", String(EXPORT_PAGE));
     const result = await store.list(params);
@@ -192,6 +229,17 @@ export async function updateRecordAction(resourceName: string, id: string, input
   return result;
 }
 
+/**
+ * Publish a record now, or take it back to a draft: its publish date is set to this
+ * moment, or cleared. An edit like any other, so it takes the permission to edit, and
+ * Laravel's policy has the last word.
+ */
+export async function publishRecordAction(resourceName: string, id: string, publish: boolean): Promise<ActionResult<Record<string, unknown>>> {
+  const field = publishFieldOf(resourceName);
+  if (!field) return { ok: false, status: 404, error: "This isn't something that is published." };
+  return updateRecordAction(resourceName, id, { [field]: publish ? new Date().toISOString() : null });
+}
+
 /**
  * Where the browser sends a file for a file or image field.
  *

package/template/web/app/globals.css

@@ -253,3 +253,49 @@
     letter-spacing: var(--heading-tracking);
   }
 }
+
+/*
+ * Rich text: what a rich text field's editor holds and what a record's page shows of it.
+ * Tailwind's reset takes the looks off headings, lists and quotes; this gives them back.
+ */
+.rich-text {
+  line-height: 1.6;
+  overflow-wrap: anywhere;
+}
+.rich-text > * + * {
+  margin-top: 0.75em;
+}
+.rich-text h2 {
+  font-size: 1.25em;
+  line-height: 1.3;
+}
+.rich-text h3 {
+  font-size: 1.1em;
+  line-height: 1.35;
+}
+.rich-text ul,
+.rich-text ol {
+  padding-left: 1.5em;
+}
+.rich-text ul {
+  list-style: disc;
+}
+.rich-text ol {
+  list-style: decimal;
+}
+.rich-text li + li {
+  margin-top: 0.25em;
+}
+.rich-text blockquote {
+  border-left: 3px solid var(--border);
+  padding-left: 1em;
+  color: var(--muted-foreground);
+}
+.rich-text a {
+  color: var(--primary);
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+.rich-text s {
+  text-decoration: line-through;
+}

package/template/web/components/access/role-form.tsx

@@ -2,7 +2,7 @@
 
 import Link from "next/link";
 import { useRouter } from "next/navigation";
-import { useMemo, useState, useTransition } from "react";
+import { Fragment, useMemo, useState, useTransition } from "react";
 import { toast } from "sonner";
 import { createRoleAction, deleteRoleAction, updateRoleAction } from "@/app/dashboard/access/actions";
 import {
@@ -27,6 +27,12 @@ import type { ManagedRole, PermissionCatalog, PermissionFeature } from "@/lib/ac
 const LIST = "/dashboard/access/roles";
 const ACTIONS = ["create", "view", "edit", "delete"] as const;
 const ACTION_LABELS: Record<string, string> = { create: "Create", view: "View", edit: "Edit", delete: "Delete" };
+/**
+ * Whether a permission is one of a resource's own actions ("applications.accept") and not
+ * one of the four. Those are given by name only: a whole section, or a pattern, doesn't
+ * carry them, which is how Laravel reads a grant too.
+ */
+const isOwn = (key: string) => !(ACTIONS as readonly string[]).includes(key.split(".")[1] ?? "");
 
 /**
  * A role's name and what it allows.
@@ -84,8 +90,9 @@ export function RoleForm({
   }, [kept.length]);
 
   const holds = (key: string) => mine === null || mine.includes(key);
-  const on = (key: string) => everything || whole.has(moduleOf.get(key.split(".")[0]!) ?? "") || byPattern.has(key) || picked.has(key);
-  const fixed = (key: string) => locked || whole.has(moduleOf.get(key.split(".")[0]!) ?? "") || byPattern.has(key) || (!picked.has(key) && !holds(key));
+  const inWhole = (key: string) => !isOwn(key) && whole.has(moduleOf.get(key.split(".")[0]!) ?? "");
+  const on = (key: string) => everything || inWhole(key) || byPattern.has(key) || picked.has(key);
+  const fixed = (key: string) => locked || inWhole(key) || byPattern.has(key) || (!picked.has(key) && !holds(key));
 
   const total = catalog.total;
   const count = useMemo(() => {
@@ -116,7 +123,7 @@ export function RoleForm({
     // A permission already covered by a whole section doesn't need saying twice.
     const grants = everything
       ? ["*"]
-      : [...[...whole].map((section) => `@${section}.*`), ...kept, ...[...picked].filter((key) => !whole.has(moduleOf.get(key.split(".")[0]!) ?? ""))];
+      : [...[...whole].map((section) => `@${section}.*`), ...kept, ...[...picked].filter((key) => !inWhole(key))];
     const input = { name: name.trim(), description: description.trim() || null, grants };
 
     startTransition(async () => {
@@ -349,8 +356,11 @@ function FeatureRows({
         const keys = feature.actions.map((action) => `${feature.key}.${action}`);
         const every = keys.every(on);
         const some = keys.some(on);
+        // The resource's own actions: accept, send an announcement. They have no column, so they get a line.
+        const own = feature.actions.filter((action) => !(ACTIONS as readonly string[]).includes(action));
         return (
-          <tr key={feature.key} className="border-b last:border-b-0">
+          <Fragment key={feature.key}>
+          <tr className={own.length > 0 ? undefined : "border-b last:border-b-0"}>
             <th scope="row" className="px-3 py-2 text-left font-normal">
               {feature.name}
             </th>
@@ -382,6 +392,31 @@ function FeatureRows({
               />
             </td>
           </tr>
+          {own.length > 0 && (
+            <tr className="border-b last:border-b-0">
+              <td colSpan={ACTIONS.length + 2} className="px-3 pt-0 pb-2">
+                <span className="flex flex-wrap items-center gap-x-4 gap-y-1 text-sm text-muted-foreground">
+                  <span className="text-xs">Also</span>
+                  {own.map((action) => {
+                    const key = `${feature.key}.${action}`;
+                    return (
+                      <label key={action} className="flex items-center gap-2">
+                        {/* Named with its resource, as the four are: two resources can both have an "Archive". */}
+                        <Checkbox
+                          aria-label={`${feature.labels?.[action] ?? action} ${feature.name.toLowerCase()}`}
+                          checked={on(key)}
+                          disabled={fixed(key)}
+                          onCheckedChange={(value) => set([key], value === true)}
+                        />
+                        {feature.labels?.[action] ?? action}
+                      </label>
+                    );
+                  })}
+                </span>
+              </td>
+            </tr>
+          )}
+          </Fragment>
         );
       })}
     </>