domma-cms 0.85.0 → 0.86.0

package/plugins/blog/plugin.js

@@ -8,15 +8,25 @@ import {catalogue, seedBlocks} from './lib/render.js';
 import {liveBase, liveSettings, loadEntries as loadAll, renderPostPage} from './lib/page.js';
 import {addNavLink, moveNavLink, removeNavLink} from './lib/nav-link.js';
 import {SAMPLE_CATEGORIES, samplePosts} from './lib/samples.js';
+import {commentKey, commentNotice} from './lib/notices.js';
+import {authorPatch, permissionChecker} from './lib/access.js';
+import {getPermissionsFor, invalidate as invalidateRoles} from '../../server/services/roles.js';
 
 const POSTS_SLUG      = 'blog-posts';
 const CATEGORIES_SLUG = 'blog-categories';
 const COMMENTS_SLUG   = 'blog-comments';
 
-const PUBLISH_ROLES = ['blog-editor', 'admin', 'super-admin'];
+// Who may do what is a PERMISSION (lib/access.js), set when the plugin
+// registers - never a role name. An editor is whoever holds blog-posts.publish.
+let can = () => false;
+
+/** Point the checks at a permission lookup - the plugin does, on start; tests do, with their own. */
+export function usePermissionLookup(permissionsFor) {
+    can = permissionChecker(permissionsFor);
+}
 
 function canPublish(user) {
-    return PUBLISH_ROLES.includes(user?.role);
+    return can(user, 'blog-posts.publish');
 }
 
 function isEditorOrAdmin(user) {
@@ -242,8 +252,41 @@ function registerEmbedShortcodes(registerShortcode, baseOf) {
 
 export default async function blogPlugin(fastify, options) {
     const { authenticate, requireAdmin } = options.auth;
+
+    // Permissions (tests pass their own lookup). An editor held as an additional
+    // role counts, and a custom role given blog-posts.publish under Roles is one.
+    usePermissionLookup(options.getPermissionsFor || getPermissionsFor);
+    const need = (key) => async (request, reply) => {
+        if (!can(request.user, key)) return reply.code(403).send({ error: 'Forbidden' });
+    };
+    const uidOf = (user) => user?.id ?? user?.sub ?? null;
+    // A Blog Author made before this release holds a bare 'blog-posts', which a
+    // permission check reads as every action - publish and delete too. Once only.
+    try {
+        let patched = false;
+        for (const e of (await listEntries('roles', { limit: 500 })).entries || []) {
+            const patch = authorPatch(e.data);
+            if (!patch) continue;
+            await updateEntry('roles', e.id, { ...e.data, ...patch });
+            patched = true;
+        }
+        if (patched) { await invalidateRoles(); fastify.log.info('[blog] Blog Author: posts read/create/update and categories read (no publish or delete)'); }
+    } catch (err) {
+        fastify.log.warn(`[blog] could not update the Blog Author role: ${err.message}`);
+    }
     const settings = { ...defaultConfig, ...(options.settings || {}) };
 
+    // Notifications (core 0.80+; feature-detected): a comment held for approval
+    // tells the site's staff (the source's audience); it goes when moderated.
+    const notify = (p) => { try { options.hooks?.notify?.(p); } catch { /* a notice never breaks a request */ } };
+    const resolveNotice = (key) => { try { options.hooks?.resolveNotification?.(key, 'comments'); } catch { /* ditto */ } };
+    if (typeof options.hooks?.registerNotificationSource === 'function') {
+        try {
+            options.hooks.registerNotificationSource({id: 'comments', label: 'Comments awaiting moderation', severity: 'info',
+                description: 'A reader left a comment that is waiting for approval. It goes once the comment is approved, rejected or deleted.'});
+        } catch { /* older engine */ }
+    }
+
     if (options.hooks?.registerShortcode) {
         registerEmbedShortcodes(options.hooks.registerShortcode, () => liveBase(settings));
     }
@@ -262,7 +305,7 @@ export default async function blogPlugin(fastify, options) {
     // -------------------------------------------------------------------------
 
     /** GET /api/plugins/blog/layouts - every post layout and listing display on offer */
-    fastify.get('/layouts', { preHandler: [authenticate] }, async () => {
+    fastify.get('/layouts', { preHandler: [authenticate, need('blog-posts.read')] }, async () => {
         const s = liveSettings(settings);
         return { ...(await catalogue()), postLayout: s.postLayout, listDisplay: s.listDisplay };
     });
@@ -272,7 +315,7 @@ export default async function blogPlugin(fastify, options) {
      * the editor's UNSAVED fields and in any layout, for the preview panel.
      * The whole page, chrome and all, so what the author sees is what readers get.
      */
-    fastify.post('/preview', { preHandler: [authenticate] }, async (request, reply) => {
+    fastify.post('/preview', { preHandler: [authenticate, need('blog-posts.read')] }, async (request, reply) => {
         const body = request.body ?? {};
         const user = request.user;
         let stored = null;
@@ -368,13 +411,16 @@ export default async function blogPlugin(fastify, options) {
     // -------------------------------------------------------------------------
 
     /** GET /api/plugins/blog/posts */
-    fastify.get('/posts', { preHandler: [authenticate] }, async (request, reply) => {
+    fastify.get('/posts', { preHandler: [authenticate, need('blog-posts.read')] }, async (request, reply) => {
         const user = request.user;
         const { entries } = await listEntries(POSTS_SLUG, { limit: 100000, sort: 'createdAt', order: 'desc' });
         let posts = entries.map(toPost);
 
-        if (!isEditorOrAdmin(user) && user?.role === 'blog-author') {
-            const uid = user?.id ?? user?.sub ?? null;
+        // A writer who is not an editor sees their own posts only - drafts are
+        // nobody else's business. (Until 1.8 only the role named blog-author
+        // was filtered: every other signed-in account saw every draft.)
+        if (!isEditorOrAdmin(user)) {
+            const uid = uidOf(user);
             posts = posts.filter(p => p.authorId === uid);
         }
 
@@ -382,7 +428,7 @@ export default async function blogPlugin(fastify, options) {
     });
 
     /** POST /api/plugins/blog/posts */
-    fastify.post('/posts', { preHandler: [authenticate] }, async (request, reply) => {
+    fastify.post('/posts', { preHandler: [authenticate, need('blog-posts.create')] }, async (request, reply) => {
         const user = request.user;
         const uid  = user?.id ?? user?.sub ?? null;
         const body = request.body ?? {};
@@ -419,14 +465,16 @@ export default async function blogPlugin(fastify, options) {
     });
 
     /** GET /api/plugins/blog/posts/:id */
-    fastify.get('/posts/:id', { preHandler: [authenticate] }, async (request, reply) => {
+    fastify.get('/posts/:id', { preHandler: [authenticate, need('blog-posts.read')] }, async (request, reply) => {
         const entry = await getEntry(POSTS_SLUG, request.params.id);
-        if (!entry) return reply.code(404).send({ error: 'Post not found' });
+        if (!entry || (!isEditorOrAdmin(request.user) && entry.data.authorId !== uidOf(request.user))) {
+            return reply.code(404).send({ error: 'Post not found' });
+        }
         return reply.send(toPost(entry));
     });
 
     /** PUT /api/plugins/blog/posts/:id */
-    fastify.put('/posts/:id', { preHandler: [authenticate] }, async (request, reply) => {
+    fastify.put('/posts/:id', { preHandler: [authenticate, need('blog-posts.update')] }, async (request, reply) => {
         const user = request.user;
         const uid  = user?.id ?? user?.sub ?? null;
         const { id } = request.params;
@@ -445,7 +493,7 @@ export default async function blogPlugin(fastify, options) {
     });
 
     /** DELETE /api/plugins/blog/posts/:id */
-    fastify.delete('/posts/:id', { preHandler: [authenticate] }, async (request, reply) => {
+    fastify.delete('/posts/:id', { preHandler: [authenticate, need('blog-posts.delete')] }, async (request, reply) => {
         const user = request.user;
         if (!isEditorOrAdmin(user)) {
             return reply.code(403).send({ error: 'Forbidden' });
@@ -459,7 +507,7 @@ export default async function blogPlugin(fastify, options) {
     });
 
     /** POST /api/plugins/blog/posts/:id/publish */
-    fastify.post('/posts/:id/publish', { preHandler: [authenticate] }, async (request, reply) => {
+    fastify.post('/posts/:id/publish', { preHandler: [authenticate, need('blog-posts.publish')] }, async (request, reply) => {
         const user = request.user;
         if (!canPublish(user)) {
             return reply.code(403).send({ error: 'Forbidden' });
@@ -478,7 +526,7 @@ export default async function blogPlugin(fastify, options) {
     });
 
     /** POST /api/plugins/blog/posts/:id/schedule */
-    fastify.post('/posts/:id/schedule', { preHandler: [authenticate] }, async (request, reply) => {
+    fastify.post('/posts/:id/schedule', { preHandler: [authenticate, need('blog-posts.publish')] }, async (request, reply) => {
         const user = request.user;
         if (!canPublish(user)) {
             return reply.code(403).send({ error: 'Forbidden' });
@@ -506,13 +554,13 @@ export default async function blogPlugin(fastify, options) {
     // -------------------------------------------------------------------------
 
     /** GET /api/plugins/blog/categories */
-    fastify.get('/categories', { preHandler: [authenticate] }, async (request, reply) => {
+    fastify.get('/categories', { preHandler: [authenticate, need('blog-categories.read')] }, async (request, reply) => {
         const { entries } = await listEntries(CATEGORIES_SLUG, { limit: 10000, sort: 'createdAt', order: 'asc' });
         return reply.send(entries.map(toCategory));
     });
 
     /** POST /api/plugins/blog/categories */
-    fastify.post('/categories', { preHandler: [authenticate] }, async (request, reply) => {
+    fastify.post('/categories', { preHandler: [authenticate, need('blog-categories.create')] }, async (request, reply) => {
         if (!isEditorOrAdmin(request.user)) {
             return reply.code(403).send({ error: 'Forbidden' });
         }
@@ -534,7 +582,7 @@ export default async function blogPlugin(fastify, options) {
     });
 
     /** PUT /api/plugins/blog/categories/:id */
-    fastify.put('/categories/:id', { preHandler: [authenticate] }, async (request, reply) => {
+    fastify.put('/categories/:id', { preHandler: [authenticate, need('blog-categories.update')] }, async (request, reply) => {
         if (!isEditorOrAdmin(request.user)) {
             return reply.code(403).send({ error: 'Forbidden' });
         }
@@ -542,15 +590,19 @@ export default async function blogPlugin(fastify, options) {
         const entry = await getEntry(CATEGORIES_SLUG, request.params.id);
         if (!entry) return reply.code(404).send({ error: 'Category not found' });
 
-        const updates = request.body ?? {};
-        const merged  = { ...entry.data, ...updates };
+        // Its own fields only - the body used to be merged in whole.
+        const b = request.body ?? {};
+        const merged = { ...entry.data };
+        if (typeof b.name === 'string' && b.name.trim()) merged.name = b.name.trim();
+        if (typeof b.slug === 'string' && b.slug.trim()) merged.slug = slugify(b.slug);
+        if (typeof b.description === 'string') merged.description = b.description.trim();
 
         const updated = await updateEntry(CATEGORIES_SLUG, request.params.id, merged);
         return reply.send(toCategory(updated));
     });
 
     /** DELETE /api/plugins/blog/categories/:id */
-    fastify.delete('/categories/:id', { preHandler: [authenticate] }, async (request, reply) => {
+    fastify.delete('/categories/:id', { preHandler: [authenticate, need('blog-categories.delete')] }, async (request, reply) => {
         if (!isEditorOrAdmin(request.user)) {
             return reply.code(403).send({ error: 'Forbidden' });
         }
@@ -567,7 +619,7 @@ export default async function blogPlugin(fastify, options) {
     // -------------------------------------------------------------------------
 
     /** GET /api/plugins/blog/comments */
-    fastify.get('/comments', { preHandler: [authenticate] }, async (request, reply) => {
+    fastify.get('/comments', { preHandler: [authenticate, need('blog-comments.read')] }, async (request, reply) => {
         const { status: statusFilter, postId } = request.query;
         const { entries } = await listEntries(COMMENTS_SLUG, { limit: 100000, sort: 'createdAt', order: 'desc' });
         let comments = entries.map(toComment);
@@ -583,7 +635,7 @@ export default async function blogPlugin(fastify, options) {
     });
 
     /** GET /api/plugins/blog/comments/pending-count - the sidebar badge on Blog: comments waiting for approval */
-    fastify.get('/comments/pending-count', { preHandler: [authenticate] }, async () => {
+    fastify.get('/comments/pending-count', { preHandler: [authenticate, need('blog-comments.read')] }, async () => {
         const [comments, posts] = await Promise.all([loadAll(COMMENTS_SLUG), loadAll(POSTS_SLUG)]);
         const pending = comments.filter(c => c.status === 'pending')
             .sort((a, b) => String(b.createdAt ?? '').localeCompare(String(a.createdAt ?? '')));
@@ -649,11 +701,15 @@ export default async function blogPlugin(fastify, options) {
             createdAt:   new Date().toISOString()
         }, { source: 'public' });
 
-        return reply.code(201).send(toComment(entry));
+        const made = toComment(entry);
+        const post = await getEntry(POSTS_SLUG, String(postId)).catch(() => null);
+        const notice = commentNotice(made, post?.data?.title, '#/plugins/blog/comments');
+        if (notice) notify(notice);
+        return reply.code(201).send(made);
     });
 
     /** PUT /api/plugins/blog/comments/:id */
-    fastify.put('/comments/:id', { preHandler: [authenticate] }, async (request, reply) => {
+    fastify.put('/comments/:id', { preHandler: [authenticate, need('blog-comments.update')] }, async (request, reply) => {
         const entry = await getEntry(COMMENTS_SLUG, request.params.id);
         if (!entry) return reply.code(404).send({ error: 'Comment not found' });
 
@@ -669,15 +725,17 @@ export default async function blogPlugin(fastify, options) {
         }
 
         const updated = await updateEntry(COMMENTS_SLUG, request.params.id, merged);
+        if (merged.status !== 'pending') resolveNotice(commentKey(request.params.id));
         return reply.send(toComment(updated));
     });
 
     /** DELETE /api/plugins/blog/comments/:id */
-    fastify.delete('/comments/:id', { preHandler: [authenticate] }, async (request, reply) => {
+    fastify.delete('/comments/:id', { preHandler: [authenticate, need('blog-comments.delete')] }, async (request, reply) => {
         const entry = await getEntry(COMMENTS_SLUG, request.params.id);
         if (!entry) return reply.code(404).send({ error: 'Comment not found' });
 
         await deleteEntry(COMMENTS_SLUG, request.params.id);
+        resolveNotice(commentKey(request.params.id));
         return reply.send({ ok: true });
     });
 
@@ -693,7 +751,7 @@ export default async function blogPlugin(fastify, options) {
     // whole config object as the name.
 
     /** GET /api/plugins/blog/settings */
-    fastify.get('/settings', { preHandler: [authenticate] }, async (request, reply) => {
+    fastify.get('/settings', { preHandler: [authenticate, need('blog-posts.read')] }, async (request, reply) => {
         const stored = getPluginStates()?.blog?.settings ?? {};
         return reply.send({ ...defaultConfig, ...DISPLAY_DEFAULTS, ...stored });
     });

package/plugins/blog/plugin.json

@@ -1,14 +1,16 @@
 {
   "name": "blog",
   "displayName": "Blog",
-  "version": "1.6.3",
+  "version": "1.8.0",
   "tier": "free",
   "description": "Public-facing blog with posts, categories and comments - layouts and listings built from editable blocks.",
   "author": "Domma CMS",
-  "date": "2026-09-23",
+  "date": "2026-09-26",
   "icon": "file-text",
   "admin": {
-    "css": ["admin/css/index.css"],
+    "css": [
+      "admin/css/index.css"
+    ],
     "sidebar": [
       {
         "id": "blog",
@@ -18,27 +20,178 @@
         "section": "#/plugins/blog",
         "countUrl": "/api/plugins/blog/comments/pending-count",
         "children": [
-          { "id": "blog-posts",      "text": "Posts",      "url": "#/plugins/blog/posts" },
-          { "id": "blog-categories", "text": "Categories", "url": "#/plugins/blog/categories" },
-          { "id": "blog-comments",   "text": "Comments",   "url": "#/plugins/blog/comments" }
-        ]
+          {
+            "id": "blog-posts",
+            "text": "Posts",
+            "url": "#/plugins/blog/posts"
+          },
+          {
+            "id": "blog-categories",
+            "text": "Categories",
+            "url": "#/plugins/blog/categories"
+          },
+          {
+            "id": "blog-comments",
+            "text": "Comments",
+            "url": "#/plugins/blog/comments"
+          }
+        ],
+        "permission": "blog-posts"
       }
     ],
     "routes": [
-      { "path": "/plugins/blog",            "view": "plugin-blog-posts",       "title": "Blog - Domma CMS" },
-      { "path": "/plugins/blog/posts",      "view": "plugin-blog-posts",       "title": "Blog Posts - Domma CMS" },
-      { "path": "/plugins/blog/posts/new",  "view": "plugin-blog-post-editor", "title": "New Post - Domma CMS" },
-      { "path": "/plugins/blog/posts/:id",  "view": "plugin-blog-post-editor", "title": "Edit Post - Domma CMS" },
-      { "path": "/plugins/blog/categories", "view": "plugin-blog-categories",  "title": "Blog Categories - Domma CMS" },
-      { "path": "/plugins/blog/comments",   "view": "plugin-blog-comments",    "title": "Blog Comments - Domma CMS" },
-      { "path": "/plugins/blog/settings",   "view": "plugin-blog-settings",    "title": "Blog Settings - Domma CMS" }
+      {
+        "path": "/plugins/blog",
+        "view": "plugin-blog-posts",
+        "title": "Blog - Domma CMS"
+      },
+      {
+        "path": "/plugins/blog/posts",
+        "view": "plugin-blog-posts",
+        "title": "Blog Posts - Domma CMS"
+      },
+      {
+        "path": "/plugins/blog/posts/new",
+        "view": "plugin-blog-post-editor",
+        "title": "New Post - Domma CMS"
+      },
+      {
+        "path": "/plugins/blog/posts/:id",
+        "view": "plugin-blog-post-editor",
+        "title": "Edit Post - Domma CMS"
+      },
+      {
+        "path": "/plugins/blog/categories",
+        "view": "plugin-blog-categories",
+        "title": "Blog Categories - Domma CMS"
+      },
+      {
+        "path": "/plugins/blog/comments",
+        "view": "plugin-blog-comments",
+        "title": "Blog Comments - Domma CMS"
+      },
+      {
+        "path": "/plugins/blog/settings",
+        "view": "plugin-blog-settings",
+        "title": "Blog Settings - Domma CMS"
+      }
     ],
     "views": {
-      "plugin-blog-posts":       { "entry": "blog/admin/views/blog.js?v=9",        "exportName": "blogView" },
-      "plugin-blog-post-editor": { "entry": "blog/admin/views/post-editor.js?v=9", "exportName": "postEditorView" },
-      "plugin-blog-categories":  { "entry": "blog/admin/views/categories.js?v=9",  "exportName": "categoriesView" },
-      "plugin-blog-comments":    { "entry": "blog/admin/views/comments.js?v=9",    "exportName": "commentsView" },
-      "plugin-blog-settings":    { "entry": "blog/admin/views/settings.js?v=9",    "exportName": "settingsView" }
+      "plugin-blog-posts": {
+        "entry": "blog/admin/views/blog.js?v=9",
+        "exportName": "blogView"
+      },
+      "plugin-blog-post-editor": {
+        "entry": "blog/admin/views/post-editor.js?v=9",
+        "exportName": "postEditorView"
+      },
+      "plugin-blog-categories": {
+        "entry": "blog/admin/views/categories.js?v=9",
+        "exportName": "categoriesView"
+      },
+      "plugin-blog-comments": {
+        "entry": "blog/admin/views/comments.js?v=9",
+        "exportName": "commentsView"
+      },
+      "plugin-blog-settings": {
+        "entry": "blog/admin/views/settings.js?v=9",
+        "exportName": "settingsView"
+      }
+    }
+  },
+  "permissions": [
+    {
+      "key": "blog-posts",
+      "label": "Blog posts",
+      "group": "Blog",
+      "description": "Write, edit and publish blog posts.",
+      "actions": [
+        {
+          "key": "read",
+          "label": "View",
+          "description": "See the posts screens (a writer sees their own posts)"
+        },
+        {
+          "key": "create",
+          "label": "Write",
+          "description": "Write new posts"
+        },
+        {
+          "key": "update",
+          "label": "Edit",
+          "description": "Edit posts (a writer: their own)"
+        },
+        {
+          "key": "delete",
+          "label": "Delete",
+          "description": "Delete any post"
+        },
+        {
+          "key": "publish",
+          "label": "Publish",
+          "description": "Publish and schedule; see and edit everyone's posts"
+        }
+      ],
+      "grant": [
+        "admin"
+      ]
+    },
+    {
+      "key": "blog-categories",
+      "label": "Blog categories",
+      "group": "Blog",
+      "description": "The blog's categories.",
+      "actions": [
+        {
+          "key": "read",
+          "label": "View",
+          "description": "See and pick categories"
+        },
+        {
+          "key": "create",
+          "label": "Create",
+          "description": "Add categories"
+        },
+        {
+          "key": "update",
+          "label": "Edit",
+          "description": "Rename categories"
+        },
+        {
+          "key": "delete",
+          "label": "Delete",
+          "description": "Remove categories"
+        }
+      ],
+      "grant": [
+        "admin"
+      ]
+    },
+    {
+      "key": "blog-comments",
+      "label": "Blog comments",
+      "group": "Blog",
+      "description": "Readers' comments and moderation.",
+      "actions": [
+        {
+          "key": "read",
+          "label": "View",
+          "description": "See comments, with the commenter's email"
+        },
+        {
+          "key": "update",
+          "label": "Moderate",
+          "description": "Approve, reject, mark as spam"
+        },
+        {
+          "key": "delete",
+          "label": "Delete",
+          "description": "Delete comments"
+        }
+      ],
+      "grant": [
+        "admin"
+      ]
     }
-  }
+  ]
 }

package/plugins/blog/roles/blog-author.json

@@ -2,9 +2,22 @@
   "name": "blog-author",
   "label": "Blog Author",
   "level": 2,
-  "permissions": ["blog-posts"],
+  "permissions": [
+    "blog-posts.read",
+    "blog-posts.create",
+    "blog-posts.update",
+    "blog-categories.read"
+  ],
   "badgeClass": "badge-info",
   "resources": [
-    { "key": "blog-posts", "label": "Blog Posts", "actions": ["read", "create", "update"] }
+    {
+      "key": "blog-posts",
+      "label": "Blog Posts",
+      "actions": [
+        "read",
+        "create",
+        "update"
+      ]
+    }
   ]
 }

package/plugins/blog/tests/access.test.js

@@ -0,0 +1,32 @@
+/** Blog access by permission (lib/access.js). */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {AUTHOR_MARKER, AUTHOR_PERMISSIONS, authorPatch, permissionChecker, rolesOf} from '../lib/access.js';
+
+const HOLDERS = {
+    'blog-posts.read': ['super-admin', 'admin', 'blog-editor', 'blog-author'],
+    'blog-posts.create': ['super-admin', 'admin', 'blog-editor', 'blog-author'],
+    'blog-posts.publish': ['super-admin', 'admin', 'blog-editor'],
+    'blog-comments.read': ['super-admin', 'admin', 'blog-editor']
+};
+const can = permissionChecker((k) => HOLDERS[k] || []);
+
+test('by permission, counting additional roles - never by role name alone', () => {
+    assert.equal(can({role: 'user', additionalRoles: ['blog-editor']}, 'blog-posts.publish'), true, 'an editor held as an additional role');
+    assert.equal(can({role: 'blog-author'}, 'blog-posts.publish'), false);
+    assert.equal(can({role: 'blog-author'}, 'blog-posts.create'), true);
+    assert.equal(can({role: 'user'}, 'blog-posts.read'), false, 'a plain account reads no drafts');
+    assert.equal(can({role: 'user'}, 'blog-comments.read'), false, 'nor commenters');
+    assert.equal(can(null, 'blog-posts.read'), false);
+    assert.deepEqual(rolesOf({role: 'a', additionalRoles: ['b', 'a']}), ['a', 'b']);
+});
+
+test('authorPatch makes a bare blog-posts explicit, once, and leaves edited roles alone', () => {
+    const shipped = {name: 'blog-author', plugin: 'blog', permissions: ['blog-posts']};
+    assert.deepEqual(authorPatch(shipped), {grantedBy: [AUTHOR_MARKER], permissions: [...AUTHOR_PERMISSIONS]});
+    assert.equal(authorPatch({...shipped, grantedBy: [AUTHOR_MARKER]}), null, 'once');
+    assert.deepEqual(authorPatch({...shipped, permissions: ['blog-posts.read']}), {grantedBy: [AUTHOR_MARKER]}, 'an admin\'s own list is kept');
+    assert.equal(authorPatch({...shipped, plugin: 'other'}), null);
+    assert.equal(authorPatch({name: 'blog-editor', plugin: 'blog', permissions: ['blog-posts']}), null);
+    assert.ok(!AUTHOR_PERMISSIONS.some(p => /publish|delete/.test(p)));
+});