domma-cms 0.44.0 → 0.45.0

package/server/services/projects.js

@@ -4,13 +4,13 @@
  * Projects group related artefacts (Pages, Collections, Forms, Actions,
  * Menus, Blocks, Components, Views, Roles, Users, API endpoints) under a
  * named slug. Membership is
- * a metadata tag (`meta.project: '<slug>'`) on each artefact — no
+ * a metadata tag (`meta.project: '<slug>'`) on each artefact - no
  * filesystem isolation. Projects also act as a permission boundary:
  * users with `projects: []` set only see their projects' artefacts plus
  * the core project's artefacts.
  *
  * The built-in **core** project owns every artefact not claimed by another
- * project — by resolution fallback, not by tagging. It is seeded at boot
+ * project - by resolution fallback, not by tagging. It is seeded at boot
  * (`seedCoreProject()`), cannot be deleted, and is never an access
  * boundary: core-resolved artefacts are visible to all authenticated
  * users, regardless of their `projects: []` scope.
@@ -32,7 +32,7 @@ export const CORE_PROJECT_SLUG = 'core';
 const CORE_PROJECT_SEED = {
     slug:        CORE_PROJECT_SLUG,
     name:        'Core',
-    description: 'The core site — everything not assigned to another project.',
+    description: 'The core site - everything not assigned to another project.',
     icon:        'home',
     rootUrl:     '/',
     sortOrder:   -1,
@@ -47,7 +47,7 @@ export const DOCS_PROJECT_SLUG = 'domma-docs';
 const DOCS_PROJECT_SEED = {
     slug:        DOCS_PROJECT_SLUG,
     name:        'Domma Docs',
-    description: 'The Domma CMS handbook — guides, tutorials, component & API ' +
+    description: 'The Domma CMS handbook - guides, tutorials, component & API ' +
                  'reference. Switch on to publish it on your own site.',
     icon:        'document',
     rootUrl:     '/domma-docs',
@@ -132,7 +132,7 @@ export async function createProject(input) {
 }
 
 /**
- * Seed the built-in core project at boot. Create-if-absent by slug — NOT by
+ * Seed the built-in core project at boot. Create-if-absent by slug - NOT by
  * data.json existence: preset seeding already creates an empty data file, and
  * retrofitted sites have project entries that must be preserved. If a project
  * with the core slug already exists it is adopted: `protected: true` is set
@@ -145,7 +145,7 @@ export async function seedCoreProject() {
     const {entries} = await listEntries(PROJECTS_COLLECTION_SLUG, {limit: 0});
     const existing = entries.find(e => e.data?.slug === CORE_PROJECT_SLUG);
     if (existing) {
-        // Core is always protected and always enabled — adopt both invariants.
+        // Core is always protected and always enabled - adopt both invariants.
         if (existing.data.protected === true && existing.data.enabled !== false) return normalise(existing);
         const adopted = {...existing.data, protected: true, enabled: true, updatedAt: new Date().toISOString()};
         await updateEntry(PROJECTS_COLLECTION_SLUG, existing.id, adopted);
@@ -158,7 +158,7 @@ export async function seedCoreProject() {
 }
 
 /**
- * Seed the built-in Domma Docs project at boot. Create-if-absent by slug — an
+ * Seed the built-in Domma Docs project at boot. Create-if-absent by slug - an
  * existing record (including the admin's enabled/disabled choice and any edits)
  * is returned untouched. Disabled by default: a fresh site ships with the docs
  * off until an admin enables the project.
@@ -223,7 +223,7 @@ export async function updateProject(slug, input) {
 
 /**
  * Delete a project. Returns true if removed, false if not found.
- * Does NOT check for tagged artefacts — caller (API route) must do that.
+ * Does NOT check for tagged artefacts - caller (API route) must do that.
  * The core project can never be deleted.
  *
  * @param {string} slug
@@ -254,7 +254,7 @@ export function validateProject(project) {
     const errors = [];
     if (!project || typeof project !== 'object') return ['Project must be an object'];
     if (!validateSlug(project.slug)) {
-        errors.push(`Invalid slug "${project.slug}" — lowercase alphanumeric + hyphen only`);
+        errors.push(`Invalid slug "${project.slug}" - lowercase alphanumeric + hyphen only`);
     }
     if (!project.name || typeof project.name !== 'string') {
         errors.push('name is required');
@@ -281,7 +281,7 @@ function normalise(entry) {
 
 /**
  * Whether the given project is enabled (i.e. not switched off). A disabled
- * project is a hard kill-switch on its PUBLIC surfaces — public pages 404 and
+ * project is a hard kill-switch on its PUBLIC surfaces - public pages 404 and
  * its external API (collections + custom endpoints + tokens) is refused.
  *
  * The core project is always enabled. An unknown slug resolves to core by
@@ -300,7 +300,7 @@ export async function isProjectEnabled(slug) {
 /**
  * List projects the given user is allowed to see. Super-admin sees all;
  * users with empty `projects: []` see all; scoped users see their listed
- * projects plus the core project (whose artefacts they can see anyway —
+ * projects plus the core project (whose artefacts they can see anyway -
  * see canSeeArtefact).
  *
  * @param {object|null} user
@@ -321,7 +321,7 @@ export async function listProjectsForUser(user) {
  * Rules:
  *   - Super-admin (role level 0) bypasses everything.
  *   - Core artefacts (no `meta.project`, or tagged `core`) are visible to
- *     all — the core project is organisational, never an access boundary.
+ *     all - the core project is organisational, never an access boundary.
  *   - Users with no scope set (`projects: []` or missing) have no restriction.
  *   - Otherwise: artefact's project must be in user's scope.
  *
@@ -341,7 +341,7 @@ export function canSeeArtefact(user, artefact) {
 /**
  * Resolve the project a non-page artefact belongs to. Artefacts without a
  * `meta.project` tag belong to the core project by exclusion. (Pages resolve
- * via getProjectForPage instead — they carry a frontmatter `project` field
+ * via getProjectForPage instead - they carry a frontmatter `project` field
  * and inherit by rootUrl prefix.)
  *
  * @param {object} artefact - Anything with optional `meta.project`.
@@ -354,15 +354,22 @@ export function resolveArtefactProject(artefact) {
 /**
  * Resolve the project a page belongs to using the inheritance rules:
  *   1. Explicit `project: '<slug>'` → use it
- *   2. Explicit `project: null` → core (legacy opt-out, deprecated — core
+ *   2. Explicit `project: null` → core (legacy opt-out, deprecated - core
  *      owns the floor, so "untagged" no longer exists as a state)
  *   3. Missing field → longest matching `rootUrl` prefix wins
  *   4. No match → core
  *
- * The core project does not participate in prefix matching — it is the
+ * The core project does not participate in prefix matching - it is the
  * fallback when nothing else claims the page. If the core record has not
  * been seeded yet, falls back to null (pre-seed behaviour).
  *
+ * A trailing slash on `rootUrl` is ignored: '/shop/' claims '/shop/items'
+ * exactly as '/shop' does. (The naive prefix test built `rootUrl + '/'` =
+ * '/shop//', which nothing starts with, so one stray keystroke in the project
+ * editor silently switched inheritance off.) '/' itself is rejected at
+ * validation - it belongs to core - so a whole-site project inherits nothing
+ * by URL and its pages must carry an explicit `project:` tag.
+ *
  * @param {string} urlPath
  * @param {string|null|undefined} explicitProject
  * @returns {Promise<string|null>}
@@ -376,11 +383,13 @@ export async function getProjectForPage(urlPath, explicitProject) {
     let bestLen = -1;
     for (const p of projects) {
         if (!p.rootUrl || p.slug === CORE_PROJECT_SLUG) continue;
-        if (urlPath === p.rootUrl || urlPath.startsWith(p.rootUrl + '/')) {
-            if (p.rootUrl.length > bestLen) {
+        const root = p.rootUrl.replace(/\/+$/, '');
+        if (!root) continue;
+        if (urlPath === root || urlPath.startsWith(root + '/')) {
+            if (root.length > bestLen) {
                 best = p.slug;
-                bestLen = p.rootUrl.length;
-            } else if (p.rootUrl.length === bestLen && p.slug < best) {
+                bestLen = root.length;
+            } else if (root.length === bestLen && p.slug < best) {
                 best = p.slug;
             }
         }
@@ -390,7 +399,7 @@ export async function getProjectForPage(urlPath, explicitProject) {
 
 /**
  * Enumerate every artefact belonging to the given project. Returns a flat
- * grouping by type — each value is an array of artefact summary objects.
+ * grouping by type - each value is an array of artefact summary objects.
  * Used by the project detail page (counts + per-type tabs).
  *
  * Membership is by resolution, not tag equality: artefacts without a
@@ -497,7 +506,7 @@ export async function getArtefactsForProject(projectSlug) {
 
     try {
         // Custom API endpoints store their project in data.project (required
-        // field — no untagged-→core fallback applies, so match directly).
+        // field - no untagged-→core fallback applies, so match directly).
         const {entries} = await listEntries('api-endpoints', {limit: 0});
         for (const e of entries) {
             if (e.data?.project === projectSlug) {
@@ -514,11 +523,11 @@ export async function getArtefactsForProject(projectSlug) {
  * Returns a count map of how many of each type were untagged. Used as the
  * "Untag all" escape hatch before delete.
  *
- * Per-service plumbing (Tasks 9–16) is required for non-menu artefacts to
+ * Per-service plumbing (Tasks 9-16) is required for non-menu artefacts to
  * carry meta.project through their update path; without that plumbing, this
  * function simply returns zero counts for those types.
  *
- * Refused for the core project — membership there is by resolution, so
+ * Refused for the core project - membership there is by resolution, so
  * untagging would be a no-op that resolution immediately reverses.
  *
  * @param {string} projectSlug
@@ -527,11 +536,11 @@ export async function getArtefactsForProject(projectSlug) {
  */
 export async function untagAllForProject(projectSlug) {
     if (projectSlug === CORE_PROJECT_SLUG) {
-        throw new Error('Cannot untag the core project — artefacts would immediately resolve back to it');
+        throw new Error('Cannot untag the core project - artefacts would immediately resolve back to it');
     }
     const proj = await getProject(projectSlug);
     if (proj?.protected === true) {
-        throw new Error(`Cannot untag the protected "${projectSlug}" project — its pages would resolve back to core`);
+        throw new Error(`Cannot untag the protected "${projectSlug}" project - its pages would resolve back to core`);
     }
     const counts = {
         pages: 0, collections: 0, forms: 0, actions: 0,
@@ -629,7 +638,7 @@ export async function untagAllForProject(projectSlug) {
     // tasks may revisit.
     //
     // API endpoints: intentionally skipped. An endpoint's project IS its URL
-    // namespace (/api/x/<project>/...) — silently untagging would move live
+    // namespace (/api/x/<project>/...) - silently untagging would move live
     // endpoints to /api/x/core/... and break external callers. Delete or
     // recreate them explicitly instead.
 

package/server/services/recipes/contact-list.json

@@ -1,7 +1,7 @@
 {
   "slug":         "contact-list",
   "name":         "Contact list (CRM-lite)",
-  "description":  "A simple address book — contacts collection with email/phone/company/tags, a quick-add form, and a single status transition for follow-ups.",
+  "description":  "A simple address book - contacts collection with email/phone/company/tags, a quick-add form, and a single status transition for follow-ups.",
   "icon":         "users",
   "options": [
     { "name": "collectionSlug", "label": "Collection slug", "default": "contacts",         "hint": "Where contact records are stored" },

package/server/services/recipes/onboarding.json

@@ -19,7 +19,7 @@
       "name": "namespace",
       "label": "Namespace",
       "default": "onboarding",
-      "hint": "Single name that cascades into every slug below. Change this once and the collection, form, and actions all rename in lockstep — or override the individual slugs below to break the chain."
+      "hint": "Single name that cascades into every slug below. Change this once and the collection, form, and actions all rename in lockstep - or override the individual slugs below to break the chain."
     },
     {
       "name": "collectionSlug",
@@ -129,7 +129,7 @@
         "label": "Reference contacts",
         "type": "textarea",
         "required": false,
-        "placeholder": "Name, email, relationship \u2014 one per line"
+        "placeholder": "Name, email, relationship - one per line"
       },
       {
         "name": "notes",
@@ -194,7 +194,7 @@
   },
   "form": {
     "title": "Employee Onboarding",
-    "description": "Welcome aboard \u2014 let's get you set up.",
+    "description": "Welcome aboard - let's get you set up.",
     "fields": [
       {
         "name": "fullName",
@@ -267,19 +267,19 @@
           "accept": "application/pdf,image/jpeg,image/png",
           "maxSize": 5242880
         },
-        "helper": "PDF, JPEG or PNG \u2014 up to 5 MB"
+        "helper": "PDF, JPEG or PNG - up to 5 MB"
       },
       {
         "name": "references",
         "label": "Reference contacts",
         "type": "textarea",
         "required": false,
-        "placeholder": "Name, email, relationship \u2014 one per line"
+        "placeholder": "Name, email, relationship - one per line"
       }
     ],
     "settings": {
       "submitText": "Send to HR",
-      "successMessage": "Thanks \u2014 HR will review your details shortly.",
+      "successMessage": "Thanks - HR will review your details shortly.",
       "honeypot": true,
       "rateLimitPerMinute": 3,
       "actionSlug": ""
@@ -378,8 +378,8 @@
           "type": "email",
           "config": {
             "to": "{{entry.data.email}}",
-            "subject": "Welcome \u2014 you're cleared to start",
-            "template": "Hi {{entry.data.fullName}},\n\nGreat news \u2014 your onboarding paperwork has been approved. Your first day is {{entry.data.startDate}}.\n\nIf you have any questions before then, just reply to this email.\n\nThe HR team"
+            "subject": "Welcome - you're cleared to start",
+            "template": "Hi {{entry.data.fullName}},\n\nGreat news - your onboarding paperwork has been approved. Your first day is {{entry.data.startDate}}.\n\nIf you have any questions before then, just reply to this email.\n\nThe HR team"
           }
         }
       ]

package/server/services/references.js

@@ -1,5 +1,5 @@
 /**
- * Reference resolver — turn raw foreign-key ids stored on entries into
+ * Reference resolver - turn raw foreign-key ids stored on entries into
  * displayable values from the target collections.
  *
  * Reference field schema shape:
@@ -11,7 +11,7 @@
  *       collection:    "jobs",        // target collection slug (required)
  *       displayField:  "title",       // field on the target to show     (default: "title")
  *       searchField:   "title",       // field to search on in picker UI (default: displayField)
- *       linkTemplate:  "/jobs/{{id}}" // optional link template — `{{id}}` substituted
+ *       linkTemplate:  "/jobs/{{id}}" // optional link template - `{{id}}` substituted
  *     }
  *   }
  *
@@ -22,7 +22,7 @@
  *
  * Batching: when resolving N entries that each have a `jobId`, we collect
  * all distinct ids once, fetch the target collection in a single pass, then
- * decorate every entry from the lookup map — one adapter call per *target
+ * decorate every entry from the lookup map - one adapter call per *target
  * collection* per resolve, not per entry.
  *
  * Missing-target handling: if a referenced id no longer exists (the target
@@ -59,7 +59,7 @@ export function referenceFields(schema) {
  * @param {object}      schema   - Source collection schema
  * @param {object[]}    entries  - Source entries; each may be mutated
  * @param {object}      [opts]
- * @param {Function}    [opts.adapterResolver] - Optional async (slug) → adapter — for tests
+ * @param {Function}    [opts.adapterResolver] - Optional async (slug) → adapter - for tests
  * @returns {Promise<object[]>}
  */
 export async function resolveReferences(schema, entries, opts = {}) {
@@ -95,17 +95,17 @@ export async function resolveReferences(schema, entries, opts = {}) {
             const adapter = await resolver(collectionSlug);
             // FileAdapter: cheap to read all then filter; MongoAdapter: $in is the
             // right call but we don't have a list-by-ids API yet. For now, get()
-            // each id in parallel — N requests but small N (distinct refs only).
+            // each id in parallel - N requests but small N (distinct refs only).
             const map = new Map();
             await Promise.all([...idSet].map(async id => {
                 try {
                     const target = await adapter.get(collectionSlug, id);
                     if (target) map.set(id, target);
-                } catch { /* missing target — left out of the map */ }
+                } catch { /* missing target - left out of the map */ }
             }));
             lookups.set(collectionSlug, map);
         } catch {
-            lookups.set(collectionSlug, new Map());     // collection gone — all refs render as missing
+            lookups.set(collectionSlug, new Map());     // collection gone - all refs render as missing
         }
     }
 
@@ -151,7 +151,7 @@ function buildRef(field, id, lookupMap) {
 }
 
 /**
- * Convenience helper for renderers — get the display label for a reference
+ * Convenience helper for renderers - get the display label for a reference
  * field on a single entry, falling back to the raw value when no resolution
  * was performed (e.g. a caller skipped `resolveRefs: true`).
  *

package/server/services/renderer.js

@@ -36,7 +36,7 @@ let _templateCache = null;
 
 /**
  * Strip hidden items from the navigation config before public injection.
- * Returns a shallow clone — never mutates the cached config object.
+ * Returns a shallow clone - never mutates the cached config object.
  *
  * @param {object} nav - Raw navigation config from getConfig('navigation')
  * @returns {object} Filtered navigation object safe for public injection
@@ -59,7 +59,7 @@ function filterHiddenNavItems(nav) {
  * whose binding matches, each drawn by the same builder the `[menu]` shortcode
  * uses so an overlay and a shortcode of the same menu look identical.
  *
- * Emitted as bare <nav> elements with no wrapper — a wrapping element would
+ * Emitted as bare <nav> elements with no wrapper - a wrapping element would
  * risk becoming a containing block for their position:fixed pinning.
  *
  * @param {{urlPath?: string, project?: string|null}} menuCtx
@@ -88,7 +88,7 @@ async function buildOverlayMenus(menuCtx, user) {
  * @returns {Promise<string>}
  */
 export async function renderPage(page, opts = {}) {
-    // Page context for menu bindings — a menu bound to this URL or this page's
+    // Page context for menu bindings - a menu bound to this URL or this page's
     // project takes its slot over. `resolvedProject` is stamped by the content
     // service; fall back to resolving it here for callers that skip that path.
     const menuCtx = {
@@ -144,7 +144,7 @@ export async function renderPage(page, opts = {}) {
     const pageWidth = VALID_LAYOUT_WIDTHS.has(page.width) ? page.width : null;
     const layoutWidth = pageWidth || (VALID_LAYOUT_WIDTHS.has(preset.width) ? preset.width : 'normal');
     // A vertical navbar docks as a side rail, so the body needs its gutter from
-    // the first paint — stamping the class client-side would shift the layout.
+    // the first paint - stamping the class client-side would shift the layout.
     const verticalNavClass = navigation.orientation === 'vertical'
         ? `dm-vnav dm-vnav-${navigation.side === 'right' ? 'right' : 'left'}`
         : '';
@@ -242,7 +242,7 @@ export async function renderPage(page, opts = {}) {
         headInject: [injection.head, navbarFontLink].filter(Boolean).join('\n'),
         headInjectLate: [injection.headLate, customCssTag, navbarStyleTag].filter(Boolean).join('\n'),
         bodyEndInject: [
-            // Overlay menus — bound to the `overlay` slot and pinned by their own
+            // Overlay menus - bound to the `overlay` slot and pinned by their own
             // float config, so they belong at the end of the body, clear of the
             // content flow.
             overlayMenus,
@@ -385,7 +385,7 @@ function buildSeoTags({page, site, baseUrl, seoTitle, seoDescription, ogImage})
     if (ogImage) tags.push(`<meta name="twitter:image" content="${ogImage}">`);
     if (twitterHandle) tags.push(`<meta name="twitter:site" content="${twitterHandle}">`);
 
-    // JSON-LD WebPage schema — gives search engines a structured summary.
+    // JSON-LD WebPage schema - gives search engines a structured summary.
     // Omit `url` when no baseUrl, since a relative URL in JSON-LD is invalid.
     const jsonLd = {
         '@context': 'https://schema.org',
@@ -400,7 +400,7 @@ function buildSeoTags({page, site, baseUrl, seoTitle, seoDescription, ogImage})
     const jsonLdString = JSON.stringify(jsonLd).replace(/<\/script>/gi, '<\\/script>');
     tags.push(`<script type="application/ld+json">${jsonLdString}</script>`);
 
-    // BreadcrumbList JSON-LD — emit whenever the page has a non-trivial path
+    // BreadcrumbList JSON-LD - emit whenever the page has a non-trivial path
     // and an origin is known (Schema.org requires absolute URLs in `item`).
     // Independent of the visual breadcrumb setting so SERPs can show the trail
     // even when the on-page nav hides it.
@@ -523,7 +523,7 @@ function buildFontVars(fontFamily, fontSize) {
  */
 export async function renderBlogPage(templatePath, data = {}, seoMeta = {}) {
     const user = seoMeta.user || null;
-    // Plugin fragments know their own URL via seoMeta.urlPath — enough for a
+    // Plugin fragments know their own URL via seoMeta.urlPath - enough for a
     // menu bound to that page or to the project the URL falls under.
     const menuCtx = seoMeta.urlPath
         ? {urlPath: seoMeta.urlPath, project: await getProjectForPage(seoMeta.urlPath)}
@@ -673,7 +673,7 @@ async function readLegacyNavBackup() {
         const here = fileURLToPath(import.meta.url);
         const bak  = path.resolve(path.dirname(here), '..', '..', 'config', 'navigation.json.bak');
         const raw  = await fs.readFile(bak, 'utf8');
-        console.warn('[menus] navbar location unmapped — falling back to navigation.json.bak (deprecated)');
+        console.warn('[menus] navbar location unmapped - falling back to navigation.json.bak (deprecated)');
         return JSON.parse(raw);
     } catch {
         return null;

package/server/services/roles.js

@@ -1,6 +1,6 @@
 /**
  * Roles Service
- * Preset Collection — seeds roles on first startup, caches them in memory.
+ * Preset Collection - seeds roles on first startup, caches them in memory.
  * Auth middleware calls getRoleMap() / getPermissionsFor() at request time.
  *
  * Base roles: super-admin (0), admin (1), user (2).
@@ -18,13 +18,13 @@ const DIR = path.join(COLLECTIONS_DIR, SLUG);
 const SCHEMA_PATH = path.join(DIR, 'schema.json');
 const DATA_PATH = path.join(DIR, 'data.json');
 
-/** Users dir — derived from collections dir parent (content/users/) */
+/** Users dir - derived from collections dir parent (content/users/) */
 const USERS_DIR = path.resolve(path.dirname(COLLECTIONS_DIR), 'users');
 
 /** Base role slugs that should always exist */
 const BASE_ROLE_NAMES = ['super-admin', 'admin', 'user'];
 
-/** Role slugs that were seeded by the old 4-role system — used to detect legacy data */
+/** Role slugs that were seeded by the old 4-role system - used to detect legacy data */
 const DEFUNCT_ROLE_NAMES = ['manager', 'editor', 'subscriber'];
 
 export {RESOURCES, ACTIONS};
@@ -32,7 +32,7 @@ export {RESOURCES, ACTIONS};
 const PRESET_SCHEMA = {
     slug: SLUG,
     title: 'Roles',
-    description: 'CMS role definitions — managed by the system.',
+    description: 'CMS role definitions - managed by the system.',
     preset: true,
     fields: [
         {name: 'name', label: 'Name (slug)', type: 'text', required: true},
@@ -194,7 +194,7 @@ export async function seed() {
             await writeData(entries);
         }
     } catch {
-        // data.json doesn't exist — fresh install
+        // data.json doesn't exist - fresh install
         entries = SEED_ENTRIES.map(data => makeEntry(data));
         await writeData(entries);
     }
@@ -203,7 +203,7 @@ export async function seed() {
     // definitions in an update. Role permissions are a persisted snapshot
     // taken at seed time, so a new family (e.g. api-endpoints) would
     // otherwise be invisible on existing installs until granted by hand.
-    // Append-only — permissions an admin ADDED are preserved; note that a
+    // Append-only - permissions an admin ADDED are preserved; note that a
     // seeded permission deliberately removed from a base role is re-added on
     // boot (use a custom role to run with less than the base set). The root
     // role's seed list is the full registry, so it always carries every
@@ -241,7 +241,7 @@ async function migrateUserRoles(roleEntries) {
     try {
         files = await fs.readdir(USERS_DIR);
     } catch {
-        return; // users dir doesn't exist yet — nothing to migrate
+        return; // users dir doesn't exist yet - nothing to migrate
     }
 
     for (const file of files) {
@@ -277,7 +277,7 @@ export async function load() {
 }
 
 /**
- * Reload from disk — call after any CRUD on the roles collection.
+ * Reload from disk - call after any CRUD on the roles collection.
  *
  * @returns {Promise<void>}
  */
@@ -287,7 +287,7 @@ export async function invalidate() {
 
 /**
  * Persist a new role entry and rebuild the cache.
- * Idempotent — if a role with the same name exists, it is updated in place.
+ * Idempotent - if a role with the same name exists, it is updated in place.
  *
  * @param {{name:string,label:string,level:number,permissions:string[],badgeClass?:string,plugin?:string}} data
  * @returns {Promise<void>}

package/server/services/rowAccess.js

@@ -18,7 +18,7 @@
  *     Resolve `data.<field>` against `targetCollection` and check that target
  *     entry's `meta.createdBy` (or `data.<targetField>` if `targetField` is a
  *     data field name) equals `user[userKey]`. This is "user can access THIS
- *     entry because they own the entry it points at" — the recruiter/employer
+ *     entry because they own the entry it points at" - the recruiter/employer
  *     pattern: applications scoped to the jobs the user posted.
  *
  *     `targetField` accepts:
@@ -76,13 +76,13 @@ function isAdmin(user) {
  * satisfies an `owner`/`field` rule, OR the entry's referenced target
  * satisfies the `reference` rule. Returns `false` only when a rule is set
  * AND the entry fails it. Misconfigured rules (missing fields, unknown
- * targets) fail closed — return `false` to avoid leaking data through typos.
+ * targets) fail closed - return `false` to avoid leaking data through typos.
  *
  * @param {object}      entry    - Full entry object ({ id, data, meta })
  * @param {object|null} user     - Authenticated user object
  * @param {object|null} rowLevel - rowLevel config from action/view access
  * @param {object}      [opts]
- * @param {Function}    [opts.adapterResolver] - Optional async (slug) → adapter — for tests
+ * @param {Function}    [opts.adapterResolver] - Optional async (slug) → adapter - for tests
  * @returns {Promise<boolean>}
  */
 export async function checkEntryAccess(entry, user, rowLevel, opts = {}) {
@@ -98,7 +98,7 @@ export async function checkEntryAccess(entry, user, rowLevel, opts = {}) {
 
     if (rowLevel.mode === 'field') {
         const field = rowLevel.field;
-        if (!field) return false;     // misconfigured — fail closed
+        if (!field) return false;     // misconfigured - fail closed
         return entry?.data?.[field] === userVal;
     }
 
@@ -106,10 +106,10 @@ export async function checkEntryAccess(entry, user, rowLevel, opts = {}) {
         const field            = rowLevel.field;
         const targetCollection = rowLevel.targetCollection;
         const targetField      = rowLevel.targetField || 'createdBy';
-        if (!field || !targetCollection) return false;       // misconfigured — fail closed
+        if (!field || !targetCollection) return false;       // misconfigured - fail closed
 
         // The referenced id lives at data.<field>. Arrays of ids are supported
-        // — access is granted when ANY of the targets is owned by the user
+        // - access is granted when ANY of the targets is owned by the user
         // (e.g. "I can see this entry because I own at least one of its parents").
         const raw = entry?.data?.[field];
         if (raw == null || raw === '') return false;
@@ -126,7 +126,7 @@ export async function checkEntryAccess(entry, user, rowLevel, opts = {}) {
         for (const id of ids) {
             try {
                 const target = await adapter.get(targetCollection, id);
-                if (!target) continue;                       // dangling reference — skip
+                if (!target) continue;                       // dangling reference - skip
                 const value = targetField === 'createdBy'
                     ? target.meta?.createdBy
                     : target.data?.[targetField];
@@ -138,7 +138,7 @@ export async function checkEntryAccess(entry, user, rowLevel, opts = {}) {
         return false;
     }
 
-    return false;     // unknown mode — fail closed
+    return false;     // unknown mode - fail closed
 }
 
 /**
@@ -148,7 +148,7 @@ export async function checkEntryAccess(entry, user, rowLevel, opts = {}) {
  * The returned object is ready to use as `{ $match: buildRowLevelMatch(...) }`.
  *
  * Note: `mode: 'reference'` can't be expressed as a flat $match without a
- * `$lookup` — for that mode this function returns `null` and callers must
+ * `$lookup` - for that mode this function returns `null` and callers must
  * fall back to per-entry `checkEntryAccess()` filtering (slower but correct).
  *
  * @param {object|null} user
@@ -171,7 +171,7 @@ export function buildRowLevelMatch(user, rowLevel) {
         return {[`data.${field}`]: userVal};
     }
 
-    // 'reference' mode needs a join — caller should use checkEntryAccess()
+    // 'reference' mode needs a join - caller should use checkEntryAccess()
     // per-entry instead. Return null so the upstream code knows to do that.
     return null;
 }