domma-cms 0.91.1 → 0.92.1

package/plugins/free-tier.lock.json

@@ -1,6 +1,6 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@466a485",
+  "source": "dcms-marketplace@9434f03",
   "plugins": {
     "blog": {
       "version": "1.9.0",
@@ -71,6 +71,27 @@
         "tests/public.test.js": "a6fcdc4ede242aa050ffe5a52f970d6bec1f4a70ae78967eb8a7bdeec73df19d"
       }
     },
+    "feedback": {
+      "version": "1.0.0",
+      "files": {
+        "CLAUDE.md": "8cdfa2ccf028cb6b9e4a185dc81e5547927132bda9b6326725b99fc221bc6758",
+        "admin/css/index.css": "f2e934c8b94f883340148aba17945dfa725eeb2b0ddb6cabb8a8c17e2487c1de",
+        "admin/lib/kit.js": "3e153c8e1f14ab88c2ed847e65d3b3f597ef833603f2e4a50aa878f10f8c490e",
+        "admin/templates/feedback.html": "a366dce78f6c3e84a7cb0ac63eba53e1980a4eb44154496a0536f5214c5bb36f",
+        "admin/views/feedback.js": "11da66fd3aa18dabdc6a334ebd0eb55040ece95128a8f1cfbf08d89b1765cac1",
+        "admin/views/inbox.js": "649b86844230be73939d82aa7c97432252c0b119baa102ebf53808e1d5f23737",
+        "admin/views/send.js": "1a876a20cf34e1348a6ee7239432801dc9f26852a2e65d386c34b0f9674856b2",
+        "collections/feedback-reports.json": "a072291b52463f7785a77f5f77d36b8238ba8f89cfc2672c6642eccdb3144486",
+        "config.js": "29d9999d1028c2c11931f67fb9abdf35132430b7cf58c161681e734c0b45143a",
+        "lib/receiver.js": "39b2ebac0a705b4cf182913ec8d006dff4b522fb5aaf6023747b48137559ea6d",
+        "lib/sender.js": "efb00d06ec149843ffd746f68f3c1ba94333f2205942a786bb37fa91eb3e9806",
+        "lib/shape.js": "67acf62f812c2c9a01b52776641ed7ae1601c59ebab8ea278a07d1087a9f299b",
+        "plugin.js": "a2f4cccc7ec38cf3877db8390a880e45d1b0e46a61df8dc60ac1300285fe66ae",
+        "plugin.json": "4c92ad716deb845058db90cbc67c2e386e6d9f85d1c1d60481eb6b130dbc427e",
+        "tests/api.test.js": "6984a2a8c31b06b0ccb1092853567856fc79027345b26e8114dcce631a0949e9",
+        "tests/shape.test.js": "5133578142a79cc1a100b3215436372129f01fb0de8c757fd743ff99e1d7e37f"
+      }
+    },
     "mail-reader": {
       "version": "1.2.1",
       "files": {

package/server/routes/api/collections.js

@@ -232,7 +232,14 @@ export async function checkPublicAccess(schema, operation, request, reply) {
     }
 
     const user = request.user;
-    const requiredLevel = roleLevel(access.access);
+    // A role name that is not a role on this site (deleted, mistyped, or one of
+    // the subscriber/editor/manager names older collection editors offered)
+    // resolves to level Infinity, and `userLevel > Infinity` is never true - so
+    // it used to let ANY signed-in user through. Fail closed instead: only the
+    // level-0 role passes, the same rule checkVisibility() applies to a page
+    // whose visibility names an unknown role (middleware/auth.js).
+    const namedLevel    = roleLevel(access.access);
+    const requiredLevel = Number.isFinite(namedLevel) ? namedLevel : 0;
     // Effective level - multi-role users get the lowest (most privileged) level
     // across their primary + additional roles for this access decision.
     const userLevel     = getEffectiveLevel(user);

package/server/routes/api/search.js

@@ -1,12 +1,16 @@
 /**
  * Search API Routes
  *
- * GET  /api/search?q=…      - public: full-text search across published pages
+ * GET  /api/search?q=…      - public: full-text search across the published pages
+ *        the viewer may open (resolveViewer(): Bearer, else the dm_session cookie
+ *        the overlay's same-origin fetch carries) - noindex pages (frontmatter or
+ *        the SEO screen's per-URL override) and pages in a disabled project never
  * GET  /api/search/settings - public: the search UI's own configuration
  * PUT  /api/search/settings - admin-only: save it
  * GET  /api/search/preview?q=…&max=… - admin-only: the Search screen's "Try it" -
  *        the same search, run with the max-results being edited (not yet saved)
- *        and without the minimum length, so a setting can be tried before Save
+ *        and without the minimum length, so a setting can be tried before Save.
+ *        Runs as an anonymous visitor, so it shows what the public finds
  * GET  /api/search/_count   - admin-only: the sidebar badge (searchBadge)
  *
  * The public settings endpoint is kept for anything already calling it (and
@@ -17,17 +21,20 @@
 import {authenticate as defaultAuthenticate, requireAdmin as defaultRequireAdmin,
     requirePermission as defaultRequirePermission} from '../../middleware/auth.js';
 import {listPages} from '../../services/content.js';
-import {getSearchSettings, saveSearchSettings, searchBadge, searchCoverage, searchPages} from '../../services/search.js';
+import {getSearchSettings, saveSearchSettings, searchBadge, searchCoverage, searchExclusions, searchPages}
+    from '../../services/search.js';
+import {resolveViewer as defaultResolveViewer} from '../../services/viewerSession.js';
 
 /**
  * @param {import('fastify').FastifyInstance} fastify
- * @param {{authenticate?: Function, requireAdmin?: Function}} [opts] - DI for tests
+ * @param {{authenticate?: Function, requireAdmin?: Function, resolveViewer?: Function}} [opts] - DI for tests
  */
 export async function searchRoutes(fastify, opts = {}) {
     const authenticate = opts.authenticate || defaultAuthenticate;
     const requireAdmin = opts.requireAdmin || defaultRequireAdmin;
     const adminOnly = {preHandler: [authenticate, requireAdmin]};
     const requirePermission = opts.requirePermission || defaultRequirePermission;
+    const resolveViewer = opts.resolveViewer || defaultResolveViewer;
     // The badge follows the Search sidebar entry's own permission (settings), so whoever
     // sees the entry can read it - admin-only, it 403'd every minute for the rest. It
     // tells nothing a visitor's search does not: public pages only.
@@ -43,9 +50,18 @@ export async function searchRoutes(fastify, opts = {}) {
             });
         }
 
+        // A read with no side effects, like a page navigation - so the viewer is
+        // resolved the way the public renderer does it, and a result is only
+        // ever a page this viewer would be served. authenticate() stays out of
+        // it: an anonymous search is the common case, not a 401. Responses are
+        // no-store (the /api onSend hook) and never enter the response cache,
+        // so nothing gated can be replayed to another viewer.
+        const viewer = await resolveViewer(request);
         const pages = await listPages();
         const results = searchPages(pages, q, {
             maxResults: settings.maxResults,
+            viewer,
+            exclusions: await searchExclusions(pages),
             onError: (err, page) =>
                 request.log.warn({err, page: page.urlPath}, '[search] skipped an unreadable page')
         });
@@ -66,12 +82,17 @@ export async function searchRoutes(fastify, opts = {}) {
         const asked = parseInt(request.query.max, 10);
         const maxResults = Number.isFinite(asked) ? Math.min(50, Math.max(1, asked)) : settings.maxResults;
         const pages = await listPages();
+        const exclusions = await searchExclusions(pages);
         const results = searchPages(pages, q, {
             maxResults,
+            exclusions,
             onError: (err, page) => request.log.warn({err, page: page.urlPath}, '[search] skipped an unreadable page')
         });
-        return {q, maxResults, results, coverage: searchCoverage(pages)};
+        return {q, maxResults, results, coverage: searchCoverage(pages, exclusions)};
     });
 
-    fastify.get('/search/_count', canReadBadge, async () => searchBadge(getSearchSettings(), await listPages()));
+    fastify.get('/search/_count', canReadBadge, async () => {
+        const pages = await listPages();
+        return searchBadge(getSearchSettings(), pages, await searchExclusions(pages));
+    });
 }

package/server/routes/api/views.js

@@ -12,13 +12,11 @@
  * POST   /views/_preview            - Run an UNSAVED config (the editor's Results): {source, connection, stages, limit}
  * GET    /views/collection/:slug    - List views targeting a collection
  *
- * Public endpoint (role-checked per view access config):
+ * Public endpoint (checked against the view's own access - canReadView):
  * GET    /views/:slug/public        - Execute view publicly
  */
-import {createView, deleteView, executeView, executeViewConfig, getView, listViews, updateView, viewsBadge} from '../../services/views.js';
+import {canReadView, createView, deleteView, executeView, executeViewConfig, getView, listViews, updateView, viewsBadge} from '../../services/views.js';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
-import {getRoleLevel} from '../../services/roles.js';
-import {getEffectiveLevel} from '../../services/userRoles.js';
 
 /**
  * Every collection a pipeline's $lookup stages read, as slugs (`cms_` stripped - Mongo-authored views
@@ -203,29 +201,30 @@ export async function viewsRoutes(fastify) {
 
         if (!view) return reply.status(404).send({ error: 'View not found' });
 
-        if (!view.access?.public) {
-            try {
-                await request.jwtVerify();
-            } catch {
-                return reply.status(401).send({ error: 'Unauthorised' });
-            }
-
-            const user          = request.user;
-            const allowedRoles  = view.access?.roles || ['admin', 'super-admin'];
-            const userLevel     = getEffectiveLevel(user);
-            const minAllowed    = Math.min(...allowedRoles.map(r => getRoleLevel(r)));
+        // Identify the caller even on a public view: row-level scoping needs
+        // them, and an anonymous run of a row-scoped view is empty.
+        let user = null;
+        try {
+            const decoded = await request.jwtVerify();
+            if (decoded?.type === 'access') user = request.user || null;
+        } catch {
+            user = null;
+        }
 
-            if (userLevel > minAllowed) {
-                return reply.status(403).send({ error: 'Insufficient permissions' });
-            }
+        // The same decision the [view] shortcode makes (canReadView), so the
+        // page and the endpoint it pages from never disagree.
+        if (!canReadView(user, view)) {
+            return user
+                ? reply.status(403).send({ error: 'Insufficient permissions' })
+                : reply.status(401).send({ error: 'Unauthorised' });
         }
 
         const { page, limit } = request.query;
         try {
-            return await executeView(view.slug, {
+            return await executeViewConfig(view, {
                 page:  parseInt(page,  10) || 1,
                 limit: parseInt(limit, 10) || 25,
-                user: request.user || null
+                user
             });
         } catch (err) {
             return reply.status(400).send({ error: err.message });

package/server/routes/public.js

@@ -273,6 +273,15 @@ export async function publicRoutes(fastify) {
             return reply.type('text/html').send(await render());
         }
 
+        // A row-scoped [view] shows each signed-in user their OWN rows, so the
+        // render differs per user, not per role set - two users sharing a role
+        // must not share an entry. Anonymous viewers of such a view get no rows
+        // at all (views.js), which is one output, so they still share the cache.
+        if (page.perViewer && userObj) {
+            hooks.emit('content:pageViewed', {urlPath, title: page.title || ''});
+            return sendHtml(request, reply, await render());
+        }
+
         // mtime in the key: any change to the backing file - editor save,
         // script, git pull - yields a fresh entry even if no invalidation
         // hook fired. Stale-mtime entries age out via TTL/LRU.

package/server/services/content.js

@@ -98,9 +98,9 @@ export async function getPage(urlPath, opts = {}) {
  */
 export async function buildPreviewPage(urlPath, frontmatter, body, opts = {}) {
     const raw = serialiseMarkdown({...(frontmatter || {})}, body || '');
-    const {data, content, html, usedComponents, tags} =
+    const {data, content, html, usedComponents, tags, perViewer} =
         await parseMarkdown(raw, {user: opts.user || null, urlPath});
-    return {...data, urlPath, content, html, usedComponents, cacheTags: tags};
+    return {...data, urlPath, content, html, usedComponents, cacheTags: tags, perViewer};
 }
 
 /**
@@ -411,14 +411,16 @@ async function readPageFile(filePath, opts = {}) {
     const urlPath = filePathToUrlPath(filePath);
     // urlPath is passed through so `[menu location="…"]` in the body resolves
     // against menus bound to this page or its project, exactly as the navbar does.
-    const { data, content, html, usedComponents, tags } =
+    const { data, content, html, usedComponents, tags, perViewer } =
         await parseMarkdown(raw, {user: opts.user || null, urlPath});
     // parseMarkdown's `tags` are CACHE tags (`block:x`, `collection:y`), not
     // the page's editorial tags. Spreading them last used to shadow the
     // frontmatter's `tags`, so the editor loaded `block:feedback-card` into
     // the tag pillbox and wrote it back on save, and the pages list showed
     // cache internals in its Tags column. Keep them apart.
-    return { ...data, urlPath, content, html, usedComponents, cacheTags: tags };
+    // perViewer: a row-scoped [view] renders per user - the public route keeps
+    // such a page out of the role-keyed response cache for signed-in viewers.
+    return { ...data, urlPath, content, html, usedComponents, cacheTags: tags, perViewer };
 }
 
 /**

package/server/services/markdown.js

@@ -14,7 +14,7 @@ import {getCollection, listEntries} from './collections.js';
 import {getMenu, resolveLocation, resolveMenuDecorations} from './menus.js';
 import {buildMenuNav} from './menuRender.js';
 import {checkVisibility} from '../middleware/auth.js';
-import {getRoleHierarchy} from './roles.js';
+import {getRoleHierarchy, getRoleLevel} from './roles.js';
 import {buildTextStyle} from '../../public/js/text-style.mjs';
 
 const __dirname_md = path.dirname(fileURLToPath(import.meta.url));
@@ -243,15 +243,20 @@ export function resolveExportConfig(schemaExport, attrs, defaultRole) {
  * test on the client.
  *
  * @param {string} access - 'public', or a role name
- * @returns {string[]} empty for 'public' (no check needed) or an unknown role
+ * @returns {string[]} empty for 'public' (no check needed); the level-0
+ *   role(s) only for a role name that is not a role on this site
  */
 function rolesAtOrAbove(access) {
     if (access === 'public') return [];
     const hierarchy = getRoleHierarchy();          // most → least privileged
     const idx = hierarchy.indexOf(access);
-    // Unknown role name: fail closed with an empty list rather than granting
-    // everyone, so a typo in schema.json cannot open export up.
-    return idx === -1 ? [] : hierarchy.slice(0, idx + 1);
+    // Unknown role name (deleted, mistyped, an old editor's preset name):
+    // fail closed - only the level-0 role passes, the same rule
+    // checkPublicAccess() (routes/api/collections.js) and page visibility
+    // (checkSingleVisibility in middleware/auth.js) apply. An empty list here
+    // would hide export from everybody, super-admin included.
+    if (idx === -1) return hierarchy.filter(r => getRoleLevel(r) === 0);
+    return hierarchy.slice(0, idx + 1);
 }
 
 /**
@@ -869,10 +874,21 @@ function renderCollectionListgroup(entries, opts, ctxOpts = {}) {
  * Executes the View's aggregation pipeline and renders results using the
  * same render functions as [collection].
  *
+ * The view's own `access` decides what the viewer gets, exactly as it does on
+ * `GET /api/views/:slug/public` (`canReadView`): a viewer it refuses gets the
+ * empty state - no rows, no field names - and the pipeline never runs. A
+ * viewer it admits runs the pipeline AS themselves, so row-level scoping
+ * applies. A page holding a row-scoped view renders per user, not per role
+ * set, and `flags.perViewer` tells the public route to keep it out of the
+ * shared response cache.
+ *
  * @param {string} markdown
+ * @param {Set<string>} [tagSet]
+ * @param {object|null} [user]  - Resolved viewer, null for anonymous
+ * @param {{perViewer?: boolean}} [flags] - Set when output differs per user
  * @returns {Promise<string>}
  */
-async function processViewBlocks(markdown, tagSet) {
+async function processViewBlocks(markdown, tagSet, user = null, flags = {}) {
     const {scrubbed, restore} = scrubCodeRegions(markdown);
     const pattern = /\[view([^\]]*?)\/\]/gi;
     const matches = [...scrubbed.matchAll(pattern)];
@@ -890,13 +906,18 @@ async function processViewBlocks(markdown, tagSet) {
         }
         tagSet?.add(`view:${slug}`);
 
+        const {canReadView, getView} = await import('./views.js');
+        const viewConfig = await getView(slug).catch(() => null);
+        if (viewConfig?.access?.rowLevel) flags.perViewer = true;
+        const allowed = canReadView(user, viewConfig);
+
         // Interactive `[view]` - when searchable / sortable / paginate is set,
         // emit a Collection Browser shell against the view's executed dataset.
         // No filter rail (views own their own filter logic) but search, sort,
         // and pagination work as on `[collection]`. This is how cross-collection
         // browsing happens without the shortcode itself having to learn joins.
         if (isInteractiveCollection(attrs)) {
-            const shell = await renderViewBrowserShell(attrs);
+            const shell = await renderViewBrowserShell(attrs, {viewConfig, allowed, user});
             result = result.replace(fullMatch, shell);
             continue;
         }
@@ -918,12 +939,16 @@ async function processViewBlocks(markdown, tagSet) {
 
         let replacement = `<div class="dm-collection-display dm-collection-empty"><p>${escapeHtmlText(emptyMsg)}</p></div>`;
 
+        // Missing view or a viewer its access refuses: the empty state, and
+        // the pipeline is never run.
+        if (!viewConfig || !allowed) {
+            result = result.replace(fullMatch, replacement);
+            continue;
+        }
+
         try {
-            const {executeView, getView} = await import('./views.js');
-            const [{results}, viewConfig] = await Promise.all([
-                executeView(slug, {page: 1, limit: limitAttr}),
-                getView(slug).catch(() => null)
-            ]);
+            const {executeViewConfig} = await import('./views.js');
+            const {results} = await executeViewConfig(viewConfig, {page: 1, limit: limitAttr, user});
 
             // Map MongoDB docs to { id, data } shape. MongoAdapter docs have a top-level id field.
             const entries = results.map(doc => ({id: doc.id || '', data: doc.data || doc}));
@@ -932,7 +957,7 @@ async function processViewBlocks(markdown, tagSet) {
             // permission. Views don't own a schema themselves - [dis]allowing
             // export must fall back CLOSED if the source collection can't be
             // resolved, since an open fallback would be a permission bypass.
-            const sourceSlug = viewConfig?.pipeline?.source || '';
+            const sourceSlug = viewConfig.pipeline?.source || '';
             const sourceSchema = sourceSlug ? await getCollection(sourceSlug) : null;
             const ctxOpts = sourceSchema
                 ? {
@@ -1279,34 +1304,37 @@ async function renderCollectionBrowserShell(attrs) {
  * filters by setting `filterable="…"`, but the field names must exist on the
  * view's projected document shape.
  *
+ * The embedded first page of data (`data-cb-data`) obeys the view's access
+ * the same way the static render does: a refused viewer gets an empty shell,
+ * and server-mode paging hits `/api/views/:slug/public`, which asks the same
+ * `canReadView`.
+ *
  * @param {Record<string, string>} attrs
+ * @param {object}      ctx
+ * @param {object|null} ctx.viewConfig - The saved view, null when missing
+ * @param {boolean}     ctx.allowed    - canReadView() for this viewer
+ * @param {object|null} ctx.user       - Viewer, for row-level scoping
  * @returns {Promise<string>}
  */
-async function renderViewBrowserShell(attrs) {
+async function renderViewBrowserShell(attrs, {viewConfig = null, allowed = false, user = null} = {}) {
     const slug      = attrs.slug;
     const pageSize  = parseInt(attrs['page-size'], 10) || parseInt(attrs.limit, 10) || 12;
     const declaredMode = attrs.mode === 'server' ? 'server' : 'client';
 
     let entries = [];
     let total   = 0;
-    let viewConfig = null;
 
-    try {
-        const {executeView, getView} = await import('./views.js');
-        viewConfig = await getView(slug).catch(() => null);
-
-        if (declaredMode === 'client') {
-            // For views we cap aggressively - views can be expensive aggregations.
-            const r = await executeView(slug, {page: 1, limit: 500});
-            entries = (r.results || []).map(doc => ({id: doc.id || '', data: doc.data || doc}));
-            total   = r.total ?? entries.length;
-        } else {
-            const r = await executeView(slug, {page: 1, limit: pageSize});
+    if (viewConfig && allowed) {
+        try {
+            const {executeViewConfig} = await import('./views.js');
+            // For views we cap aggressively in client mode - views can be expensive aggregations.
+            const limit = declaredMode === 'client' ? 500 : pageSize;
+            const r = await executeViewConfig(viewConfig, {page: 1, limit, user});
             entries = (r.results || []).map(doc => ({id: doc.id || '', data: doc.data || doc}));
             total   = r.total ?? entries.length;
+        } catch {
+            // Pipeline error - emit empty shell.
         }
-    } catch {
-        // executeView errored (view missing or pipeline error) - emit empty shell.
     }
 
     // Derive a schema-like fields list from the first row so the browser can
@@ -1315,7 +1343,7 @@ async function renderViewBrowserShell(attrs) {
         ? Object.keys(entries[0].data || {})
               .filter(k => !['_id', 'id', 'meta'].includes(k))
               .map(k => ({name: k, label: k, type: 'text'}))
-        : (viewConfig?.fields || []);
+        : (allowed ? (viewConfig?.fields || []) : []);
 
     const filterable = (attrs.filterable && typeof attrs.filterable === 'string')
         ? attrs.filterable.split(',').map(s => s.trim()).filter(Boolean) : [];
@@ -4178,12 +4206,16 @@ function processCtaBlocks(markdown) {
  * @param {object} [opts]
  * @param {object|null} [opts.user] - Authenticated user (`{role, additionalRoles}`)
  *   or null for anonymous. Used to filter menu items gated by `visibility` in
- *   the `[menu]` shortcode. Backwards compatible - defaults to anonymous.
+ *   the `[menu]` shortcode, and as the viewer a `[view]`'s own access and
+ *   row-level scoping are checked against. Backwards compatible - defaults to
+ *   anonymous.
  * @param {string} [opts.urlPath] - URL of the page being parsed. Lets
  *   `[menu location="…"]` honour menus bound to this page or its project.
  * @param {string|null} [opts.project] - Project the page belongs to; resolved
  *   from `urlPath` when omitted.
- * @returns {{ data: object, content: string, html: string }}
+ * @returns {{ data: object, content: string, html: string, tags: string[], perViewer: boolean }}
+ *   `perViewer` - the output differs per signed-in USER, not just per role set
+ *   (a row-scoped `[view]`), so it must not share a role-keyed cache entry.
  */
 export async function parseMarkdown(raw, opts = {}) {
   const {data, content} = matter(raw);
@@ -4196,8 +4228,9 @@ export async function parseMarkdown(raw, opts = {}) {
   const preprocessed = applyTransforms('markdown:beforeParse', content);
   const {output: withComponents, used: usedComponents} = collectAndRewriteComponents(preprocessed);
   const tagSet = new Set();
+  const flags = {perViewer: false};
   const withCollection = await processCollectionBlocks(withComponents, tagSet);
-  const withView = await processViewBlocks(withCollection, tagSet);
+  const withView = await processViewBlocks(withCollection, tagSet, opts.user || null, flags);
   const withStaticBlock = await processStaticBlocks(withView, tagSet);
   const menuCtx = opts.urlPath
       ? {urlPath: opts.urlPath, project: opts.project ?? await resolveProjectForUrl(opts.urlPath)}
@@ -4308,7 +4341,7 @@ export async function parseMarkdown(raw, opts = {}) {
   const allowed = new Set(_dmTagAllowlist.map(t => t.replace(/^dm-/, '')));
   const filteredUsed = [...usedComponents].filter(name => allowed.has(name));
 
-  return {data, content, html, usedComponents: filteredUsed, tags: [...tagSet]};
+  return {data, content, html, usedComponents: filteredUsed, tags: [...tagSet], perViewer: flags.perViewer};
 }
 
 /**

package/server/services/rowAccess.js

@@ -175,3 +175,52 @@ export function buildRowLevelMatch(user, rowLevel) {
     // per-entry instead. Return null so the upstream code knows to do that.
     return null;
 }
+
+/**
+ * Whether `rowLevel` has to be enforced entry by entry for this user - a rule
+ * is set, the user is not level 0, and buildRowLevelMatch() cannot express it
+ * as a flat match (`mode: 'reference'`, or a misconfigured/unknown rule, which
+ * checkEntryAccess() then fails closed).
+ *
+ * @param {object|null} user
+ * @param {object|null} rowLevel
+ * @returns {boolean}
+ */
+export function needsEntryCheck(user, rowLevel) {
+    if (!rowLevel || isAdmin(user)) return false;
+    return buildRowLevelMatch(user, rowLevel) === null;
+}
+
+/**
+ * Keep only the entries `user` may access under `rowLevel` - checkEntryAccess()
+ * per entry, the same decision Actions make for a single entry. Target reads
+ * are memoised for the call, so many entries pointing at one parent cost one
+ * read of it, not one each.
+ *
+ * @param {object[]}    entries
+ * @param {object|null} user
+ * @param {object|null} rowLevel
+ * @param {object}      [opts]
+ * @param {Function}    [opts.adapterResolver] - Optional async (slug) → adapter - for tests
+ * @returns {Promise<object[]>}
+ */
+export async function filterEntriesByAccess(entries, user, rowLevel, opts = {}) {
+    if (!rowLevel || isAdmin(user)) return entries;
+    const resolver = opts.adapterResolver || getAdapter;
+    const adapters = new Map();
+    const targets  = new Map();
+    const memoResolver = (slug) => {
+        if (!adapters.has(slug)) {
+            adapters.set(slug, Promise.resolve().then(() => resolver(slug)).then(adapter => ({
+                get(collection, id) {
+                    const key = `${collection}\u0000${id}`;
+                    if (!targets.has(key)) targets.set(key, Promise.resolve().then(() => adapter.get(collection, id)));
+                    return targets.get(key);
+                }
+            })));
+        }
+        return adapters.get(slug);
+    };
+    const keep = await Promise.all(entries.map(e => checkEntryAccess(e, user, rowLevel, {adapterResolver: memoResolver})));
+    return entries.filter((_, i) => keep[i]);
+}