domma-cms 0.92.1 → 0.94.0

package/server/routes/api/collections.js

@@ -50,6 +50,7 @@ import {
     importEntries,
     listCollections,
     listEntries,
+    migrateStorage,
     updateCollection,
     updateEntry
 } from '../../services/collections.js';
@@ -538,55 +539,15 @@ export async function collectionsRoutes(fastify) {
     // Storage migration
     // -------------------------------------------------------------------------
 
+    // Entries keep their ids and meta dates; see migrateStorage() in services/collections.js.
     fastify.post('/collections/:slug/migrate-storage', canUpdate, async (request, reply) => {
-        const {slug} = request.params;
-        const {storage} = request.body || {};
-
-        if (!storage?.adapter) {
-            return reply.status(400).send({error: 'storage.adapter is required'});
-        }
-
-        const schema = await getCollection(slug);
-        if (!schema) return reply.status(404).send({error: 'Collection not found'});
-
-        const sourceAdapter = schema.storage?.adapter || 'file';
-        if (sourceAdapter === storage.adapter) {
-            return reply.status(400).send({error: 'Source and target adapters are the same'});
-        }
-
-        // Step 1: read all existing entries from current adapter BEFORE schema change
-        const {entries} = await listEntries(slug, {limit: 1000000, sort: 'createdAt', order: 'asc'});
-
-        // Step 2: update schema to new adapter (also invalidates the adapter cache)
-        await updateCollection(slug, {...schema, storage});
-
-        // Step 3: insert all entries into the new adapter
-        let migrated = 0;
-        for (const entry of entries) {
-            try {
-                await createEntry(slug, entry.data, {
-                    createdBy: entry.meta?.createdBy || null,
-                    source: 'migration'
-                });
-                migrated++;
-            } catch (err) {
-                fastify.log.warn(`[migrate-storage] Entry ${entry.id} skipped: ${err.message}`);
-            }
-        }
-
-        // Step 4: if migrating away from file storage, archive the old data.json
-        if (sourceAdapter === 'file') {
-            try {
-                const {rename} = await import('fs/promises');
-                const {join} = await import('path');
-                const dataPath = join(process.cwd(), 'content', 'collections', slug, 'data.json');
-                await rename(dataPath, dataPath + '.bak');
-            } catch {
-                // data.json may not exist or rename already done
-            }
+        try {
+            return await migrateStorage(request.params.slug, request.body?.storage);
+        } catch (err) {
+            const status = err.statusCode || 500;
+            if (status >= 500) fastify.log.error(`[migrate-storage] ${request.params.slug}: ${err.message}`);
+            return reply.status(status).send({error: err.message, ...(err.collisions && {collisions: err.collisions})});
         }
-
-        return {migrated, total: entries.length};
     });
 
     // -------------------------------------------------------------------------
@@ -704,7 +665,10 @@ export async function collectionsRoutes(fastify) {
      * Body: { attrs: <base64 JSON of the original shortcode attributes> }
      * Auth: JWT required - `createdBy = <user.id>` is injected server-side
      *       (the client cannot tamper with which user's data they see).
-     * Returns: { html: '<div class="dm-collection-…">…</div>' }
+     * Returns: { html: '<div class="dm-collection-…">…</div>' } - a
+     *          Collection Browser shell (`scope: 'mine'` in its config) when
+     *          the attrs are interactive, so `transitions` works; otherwise
+     *          the static fragment.
      *
      * Security: results are always scoped to `createdBy = <user.id>` -
      * a caller can only ever render their own entries, regardless of the
@@ -787,10 +751,10 @@ export async function collectionsRoutes(fastify) {
         const schema = await getCollection(attrs.slug);
         if (!schema) return reply.status(404).send({ error: 'Collection not found' });
 
-        const { renderCollectionFragment } = await import('../../services/markdown.js');
-        const html = await renderCollectionFragment(attrs, {
-            extraFilter: { createdBy: decoded.id }
-        });
+        // Interactive attrs come back as a Collection Browser shell scoped to
+        // this viewer (transitions included); the rest as a static fragment.
+        const { renderScopedCollection } = await import('../../services/markdown.js');
+        const html = await renderScopedCollection(attrs, decoded.id);
 
         return { html };
     });

package/server/routes/api/contacts.js

@@ -12,6 +12,11 @@
  * is a behaviour change, and this was a relocation. A test pins it so the next
  * reader finds it stated rather than inferred.
  *
+ * Because a group is shared, renaming or deleting one rewrites every user's
+ * contacts. So only the group's creator (`meta.createdBy`, recorded on new
+ * groups) or a holder of `contacts.manageGroups` may do either; a group from
+ * before creators were recorded belongs to the permission holders alone.
+ *
  * Hand-filtered, as the plugin did it, rather than via rowAccess.js - the right
  * end state, and again not something to smuggle into a move.
  *
@@ -27,6 +32,30 @@
 import {authenticate as defaultAuthenticate, requirePermission as defaultRequirePermission} from '../../middleware/auth.js';
 import {createEntry, deleteEntry, getEntry, listEntries, updateEntry} from '../../services/collections.js';
 import {hooks} from '../../services/hooks.js';
+import {getPermissionsFor} from '../../services/roles.js';
+import {getEffectiveRoles} from '../../services/userRoles.js';
+
+/**
+ * The permission that lets someone rename or delete a group they did not
+ * create. Groups are shared, so a rename or delete changes every user's
+ * contacts; without it only the group's creator may do either. Level 0 holds
+ * it like everything else; admin is granted it once at boot (server.js).
+ */
+export const MANAGE_GROUPS = 'manageGroups';
+
+/**
+ * Does the caller hold `contacts.manageGroups`? The same union-of-roles test
+ * requirePermission() makes, done in the handler because the answer only
+ * matters when the caller is not the group's creator.
+ *
+ * @param {object} request
+ * @returns {boolean}
+ */
+function defaultHoldsManageGroups(request) {
+    if (!request.user) return false;
+    const allowed = getPermissionsFor('contacts', MANAGE_GROUPS);
+    return getEffectiveRoles(request.user).some(r => allowed.includes(r));
+}
 
 const CONTACTS_SLUG = 'contacts-contacts';
 const GROUPS_SLUG = 'contacts-groups';
@@ -217,7 +246,7 @@ function toGroupName(entry) {
 export async function contactsRoutes(fastify, opts = {}) {
     const authenticate = opts.authenticate || defaultAuthenticate;
     const requirePermission = opts.requirePermission || defaultRequirePermission;
-
+    const holdsManageGroups = opts.holdsManageGroups || defaultHoldsManageGroups;
 
     function userId(request) {
         return request.user?.id ?? request.user?.sub ?? null;
@@ -232,9 +261,22 @@ export async function contactsRoutes(fastify, opts = {}) {
 
     async function loadGroups() {
         const {entries} = await listEntries(GROUPS_SLUG, {limit: 10000, sort: 'createdAt', order: 'asc'});
-        return entries.map(e => ({id: e.id, name: toGroupName(e)}));
+        return entries.map(e => ({id: e.id, name: toGroupName(e), createdBy: e.meta?.createdBy ?? null}));
+    }
+
+    /**
+     * May this caller rename or delete this group? Its creator may; so may
+     * anyone holding contacts.manageGroups. A group from before creators were
+     * recorded has none, so only permission holders can touch it.
+     */
+    function canManageGroup(request, group) {
+        const uid = userId(request);
+        if (uid && group.createdBy && group.createdBy === uid) return true;
+        return holdsManageGroups(request) === true;
     }
 
+    const NOT_YOURS = 'Only the person who created this group, or someone allowed to manage every group, can rename or delete it.';
+
     /**
      * Build the stored shape from whatever a caller sent.
      *
@@ -396,6 +438,24 @@ export async function contactsRoutes(fastify, opts = {}) {
         return reply.send(groups.map(g => g.name));
     });
 
+    /**
+     * GET /api/contacts/groups/access - who may do what with each group, for
+     * the screens. `/groups` stays a list of names: other Tools read it.
+     * `{manageAll, groups: [{name, mine, canManage}]}`
+     */
+    fastify.get('/groups/access', {preHandler: [authenticate, requirePermission('contacts', 'read')]}, async (request, reply) => {
+        const uid = userId(request);
+        const manageAll = holdsManageGroups(request) === true;
+        const groups = await loadGroups();
+        return reply.send({
+            manageAll,
+            groups: groups.map(g => {
+                const mine = Boolean(uid && g.createdBy && g.createdBy === uid);
+                return {name: g.name, mine, canManage: mine || manageAll};
+            })
+        });
+    });
+
     /** POST /api/contacts/groups */
     fastify.post('/groups', {preHandler: [authenticate, requirePermission('contacts', 'create')]}, async (request, reply) => {
         const { name } = request.body ?? {};
@@ -410,7 +470,8 @@ export async function contactsRoutes(fastify, opts = {}) {
             return reply.code(400).send({ error: 'Group already exists' });
         }
 
-        await createEntry(GROUPS_SLUG, {name: trimmed}, {source: 'admin'});
+        // The creator is recorded: it is who may rename or delete the group.
+        await createEntry(GROUPS_SLUG, {name: trimmed}, {createdBy: userId(request), source: 'admin'});
         return reply.code(201).send({ name: trimmed });
     });
 
@@ -426,6 +487,7 @@ export async function contactsRoutes(fastify, opts = {}) {
         const groups = await loadGroups();
         const grpEntry = groups.find(g => g.name === oldName);
         if (!grpEntry) return reply.code(404).send({error: 'Group not found'});
+        if (!canManageGroup(request, grpEntry)) return reply.code(403).send({error: NOT_YOURS});
 
         const trimmed = newName.trim();
         if (groups.some(g => g.name === trimmed)) {
@@ -457,6 +519,7 @@ export async function contactsRoutes(fastify, opts = {}) {
         const groups = await loadGroups();
         const grpEntry = groups.find(g => g.name === name);
         if (!grpEntry) return reply.code(404).send({error: 'Group not found'});
+        if (!canManageGroup(request, grpEntry)) return reply.code(403).send({error: NOT_YOURS});
 
         // Remove the group entry
         await deleteEntry(GROUPS_SLUG, grpEntry.id);

package/server/routes/api/documentation.js

@@ -0,0 +1,42 @@
+/**
+ * Documentation API - plugin guides for the admin's Documentation folder.
+ *
+ * GET /api/documentation/plugins              - the guides this user may read
+ * GET /api/documentation/plugins/:name        - one guide, its first page rendered
+ * GET /api/documentation/plugins/:name/:page  - one guide, the named page rendered
+ *
+ * Signed-in users only. A guide is readable by whoever can use the plugin
+ * (services/pluginGuides.js decides), so a role that cannot open Invoices is
+ * not shown the Invoices guide either.
+ */
+import {authenticate as defaultAuthenticate} from '../../middleware/auth.js';
+import {getPermissionsForRoles} from '../../services/roles.js';
+import {getEffectiveRegistry} from '../../services/permissionRegistry.js';
+import {getEffectiveRoles} from '../../services/userRoles.js';
+import {getGuide, listGuides} from '../../services/pluginGuides.js';
+
+/** The caller's permissions - the same union /api/auth/permissions answers. */
+function permissionsOf(user, resolve) {
+    if (resolve) return resolve(user);
+    const roles = getEffectiveRoles(user || {});
+    return getPermissionsForRoles(roles, getEffectiveRegistry().map(r => r.key));
+}
+
+export async function documentationRoutes(fastify, opts = {}) {
+    const authenticate = opts.authenticate || defaultAuthenticate;
+    const signedIn = {preHandler: [authenticate]};
+
+    fastify.get('/documentation/plugins', signedIn, async (request) => {
+        return {guides: listGuides(permissionsOf(request.user, opts.permissionsOf))};
+    });
+
+    const one = async (request, reply) => {
+        const {name, page} = request.params;
+        const out = await getGuide(name, page, permissionsOf(request.user, opts.permissionsOf));
+        if (out.status === 403) return reply.code(403).send({statusCode: 403, error: 'Forbidden', message: 'You cannot use this plugin.'});
+        if (out.status !== 200) return reply.code(404).send({statusCode: 404, error: 'Not Found', message: 'No such guide.'});
+        return out.guide;
+    };
+    fastify.get('/documentation/plugins/:name', signedIn, one);
+    fastify.get('/documentation/plugins/:name/:page', signedIn, one);
+}

package/server/routes/api/notifications.js

@@ -27,6 +27,7 @@ import { randomUUID } from 'crypto';
 import { getAdapter } from '../../services/adapterRegistry.js';
 import {AUDIENCES, isActiveFor, listNotificationSources, runSource, saveSourceSetting} from '../../services/notify.js';
 import {getEffectiveRoles} from '../../services/userRoles.js';
+import {fmtDate} from '../../services/dates.js';
 
 const SLUG = 'notifications';
 
@@ -100,7 +101,7 @@ export function notificationsBadge(active = []) {
             ],
             items: unread.slice(0, 6).map(e => ({
                 text: String(e.data.title || '(no title)').slice(0, 80),
-                meta: [sev(e), String(e.data.createdAt || '').slice(0, 10)].filter(Boolean).join(' · '),
+                meta: [sev(e), fmtDate(e.data.createdAt)].filter(Boolean).join(' · '),
                 ...(sev(e) === 'critical' && {tone: 'danger'})
             })),
             empty: 'Nothing unread.'
@@ -121,7 +122,7 @@ export function notificationsBadge(active = []) {
  */
 export function sampleNotifications(now = new Date(), origin = '', forUser = null) {
     const expiresAt = new Date(now.getTime() + 7 * 86_400_000).toISOString();
-    const note = `\n\n(A sample - it goes by itself on ${expiresAt.slice(0, 10)}.)`;
+    const note = `\n\n(A sample - it goes by itself on ${fmtDate(expiresAt, {utc: true})}.)`;
     const samples = [
         {severity: 'critical', title: 'Plugin failed to load: Calendar',
             body: 'The Calendar plugin stopped with an error while the site started, so its screens and pages are missing. Check Plugins for the error, then restart the site.',

package/server/routes/api/users.js

@@ -1,11 +1,15 @@
 /**
  * Users API
- * GET    /api/users      - list all users (admin, manager)
+ * Access is by the `users` permission (read/create/update/delete - which roles
+ * hold it is role data), plus canManageUser(): you can only create, change or
+ * delete an account whose role is junior to yours.
+ *
+ * GET    /api/users      - list all users (users.read)
  * GET    /api/users/_count - the sidebar badge (ids are uuids - nothing can shadow it)
- * GET    /api/users/:id  - single user (admin, manager, or self)
- * POST   /api/users      - create user (admin, manager - manager cannot create admin)
- * PUT    /api/users/:id  - update user (admin, manager - manager cannot edit admin)
- * DELETE /api/users/:id  - delete user (admin, manager - manager cannot delete admin, no self-delete)
+ * GET    /api/users/:id  - single user (users.read, or self)
+ * POST   /api/users      - create user (users.create; only a role junior to yours)
+ * PUT    /api/users/:id  - update user (users.update; only a junior account)
+ * DELETE /api/users/:id  - delete user (users.delete; only a junior account, no self-delete)
  * POST   /api/users/:id/password-reset - {via: 'email'|'link'} - email them a reset link, or return one to copy
  * DELETE /api/users/:id/password-reset - withdraw an unused reset link
  *   Both: users.update and a more senior role than theirs (canManageUser); never your own account.
@@ -83,7 +87,7 @@ export async function usersRoutes(fastify) {
         return usersBadge((await listUsers()).filter(u => canSeeArtefact(request.user, u)));
     });
 
-    // Get single user (admin, manager, or the user themselves)
+    // Get single user (users.read, or the user themselves)
     fastify.get('/users/:id', { preHandler: [authenticate] }, async (request, reply) => {
         const { id } = request.params;
         const actor = request.user;

package/server/server.js

@@ -21,7 +21,7 @@ import {createRequire} from 'module';
 import {config, getConfig} from './config.js';
 import {getLoadedPlugins, getPluginSettings, recordPluginLoadFailure, registerPlugins} from './services/plugins.js';
 import {notifierFor} from './services/notify.js';
-import {load as loadRoles, seed as seedRoles} from './services/roles.js';
+import {grantPermissionOnce, load as loadRoles, seed as seedRoles} from './services/roles.js';
 import {ensureAllProfiles, seed as seedUserProfiles} from './services/userProfiles.js';
 import {seedAll as seedPresetCollections} from './services/presetCollections.js';
 import {seedCoreProject, seedDocsProject} from './services/projects.js';
@@ -231,6 +231,9 @@ try {
 
 await seedRoles();
 await loadRoles();
+// Renaming or deleting a shared contact group is for its creator or a holder of
+// contacts.manageGroups; admins get it once - removed by hand, it stays removed.
+await grantPermissionOnce('admin', 'contacts.manageGroups', 'core').catch(() => {});
 await seedUserProfiles();
 await ensureAllProfiles();
 await seedPresetCollections();
@@ -484,6 +487,7 @@ const {apiTokensRoutes}     = await import('./routes/api/api-tokens.js');
 const {apiEndpointsRoutes}  = await import('./routes/api/api-endpoints.js');
 const {endpointsPublicRoutes} = await import('./routes/api/endpoints-public.js');
 const {sidebarRoutes}       = await import('./routes/api/sidebar.js');
+const {documentationRoutes} = await import('./routes/api/documentation.js');
 const { mediaRoutes }      = await import('./routes/api/media.js');
 const { usersRoutes }      = await import('./routes/api/users.js');
 const { pluginsRoutes }            = await import('./routes/api/plugins.js');
@@ -522,6 +526,7 @@ await app.register(apiTokensRoutes,     {prefix: '/api'});
 await app.register(apiEndpointsRoutes,  {prefix: '/api'});
 await app.register(endpointsPublicRoutes, {prefix: '/api'});
 await app.register(sidebarRoutes,       {prefix: '/api'});
+await app.register(documentationRoutes, {prefix: '/api'});
 await app.register(mediaRoutes,       { prefix: '/api' });
 await app.register(usersRoutes,       { prefix: '/api' });
 await app.register(pluginsRoutes,            { prefix: '/api' });
@@ -630,6 +635,16 @@ registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Layouts
 registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Plugins', url: '#/plugins', icon: 'package', permission: 'plugins', countUrl: '/api/plugins/_count', inventory: true}});
 registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'API Tokens', url: '#/api-tokens', icon: 'key', permission: 'api-tokens', countUrl: '/api/api-tokens/_count'}});
 registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Search', url: '#/search', icon: 'search', permission: 'settings', countUrl: '/api/search/_count', inventory: true}});
+// Documentation pages added after the sidebar menu was seeded (0.93.1). The menu is
+// seeded once, so new pages reach existing sites only by registering here. The two
+// sub-folders have no key in older menus; findFolder() falls back to their name.
+registerSidebarItem({folder: 'Usage', item: {source: 'Built in', text: 'Collections & Forms', url: '#/docs/usage/collections', icon: 'database'}});
+registerSidebarItem({folder: 'Usage', item: {source: 'Built in', text: 'Built-in Tools', url: '#/docs/usage/tools', icon: 'tool'}});
+registerSidebarItem({folder: 'Usage', item: {source: 'Built in', text: 'Editions & Licences', url: '#/docs/usage/editions', icon: 'key'}});
+registerSidebarItem({folder: 'API Reference', item: {source: 'Built in', text: 'Forms', url: '#/docs/api/forms', icon: 'layout'}});
+registerSidebarItem({folder: 'API Reference', item: {source: 'Built in', text: 'Scaffold', url: '#/docs/api/scaffold', icon: 'package'}});
+registerSidebarItem({folder: 'API Reference', item: {source: 'Built in', text: 'External API & Tokens', url: '#/docs/api/external', icon: 'key'}});
+registerSidebarItem({folder: 'API Reference', item: {source: 'Built in', text: 'API Builder', url: '#/docs/api/builder', icon: 'code'}});
 
 // Core's notification sources, before plugins add theirs (0.80).
 const {registerCoreSources} = await import('./services/notification-sources.js');

package/server/services/actions.js

@@ -29,10 +29,27 @@
 import {v4 as uuidv4} from 'uuid';
 import {createEntry, deleteEntry, getEntry, updateEntry} from './collections.js';
 import {checkEntryAccess} from './rowAccess.js';
+import {canReadView} from './views.js';
+import {getEffectiveLevel} from './userRoles.js';
 
 /** MongoDB collection where action configs are stored. */
 const ACTIONS_COLLECTION = 'cms__actions';
 
+/** A Db handed in by tests (useActionsDb); null means the 'default' connection. */
+let testDb = null;
+
+/**
+ * Tests only: store action configs in `db` (anything with Mongo's
+ * collection().find/findOne/insertOne/replaceOne/deleteOne) instead of the
+ * 'default' connection, so the routes can be driven without MongoDB. Pass
+ * null to go back.
+ *
+ * @param {object|null} db
+ */
+export function useActionsDb(db) {
+    testDb = db || null;
+}
+
 // ---------------------------------------------------------------------------
 // Internal helpers
 // ---------------------------------------------------------------------------
@@ -44,6 +61,7 @@ const ACTIONS_COLLECTION = 'cms__actions';
  * @throws {Error} If MongoDB is not configured
  */
 async function getMetaDb() {
+    if (testDb) return testDb;
     try {
         const { getDb } = await import('./connectionManager.js');
         return getDb('default');
@@ -415,57 +433,110 @@ export async function listActionsForCollection(collectionSlug) {
         .toArray();
 }
 
+/**
+ * May this user run the action (public execute) or be offered it as a
+ * transition? Any role in `access.roles` is enough, each on its usual ladder
+ * (the role and every more senior one; `=role` exact), across every role the
+ * user holds - the rule views use, so this IS canReadView(), not a third
+ * implementation.
+ *
+ * - A role name this site does not have admits nobody but the level-0 role
+ *   (checkVisibility's rule for an unknown name), so a deleted or mistyped
+ *   role never opens the action to everyone. `public` is not a role here:
+ *   running an action always needs a signed-in user, so it counts as unknown.
+ * - No roles named (missing or empty list) is the admin tier, levels 0 and 1 -
+ *   what the old `['admin', 'super-admin']` default names, and what the
+ *   Actions list shows ("admins").
+ *
+ * @param {object|null} user   - {role, additionalRoles}
+ * @param {object|null} action - action config
+ * @returns {boolean}
+ */
+export function canRunAction(user, action) {
+    if (!user?.role) return false;
+    const roles = Array.isArray(action?.access?.roles)
+        ? action.access.roles.filter(r => typeof r === 'string' && r)
+        : [];
+    if (!roles.length) return canReadView(user, {access: {roles: []}});
+    const named = roles.filter(r => r !== 'public');
+    if (!named.length) return getEffectiveLevel(user) === 0;
+    return canReadView(user, {access: {roles: named}});
+}
+
 /**
  * List the actions that represent valid next-state transitions for a given
  * entry as seen by a given user. Used by the per-row transitions UI in the
- * Collection Browser and the `[transitions]` shortcode.
+ * Collection Browser (an interactive `[collection … transitions]` on a page).
  *
  * Criteria for inclusion:
  *   1. action.collection matches the entry's collection
  *   2. action.transition is set and action.transition.from includes the
  *      entry's current value of action.transition.field
- *   3. action.access.roles allows the user (compared by role level so
- *      higher-privileged roles inherit access automatically)
+ *   3. canRunAction(): any of action.access.roles admits the user, on its
+ *      ladder (more senior roles inherit it)
  *
  * Returns a stripped projection - slug, title, trigger config, transition -
  * so the client can render buttons without leaking step internals.
  *
  * @param {string} collectionSlug
  * @param {object} entry          - The entry being inspected (needed for field-value match)
- * @param {object} [user]         - { role } - anonymous if missing
+ * @param {object} [user]         - { id, role, additionalRoles } - anonymous if missing
+ * @param {object} [opts]
+ * @param {string} [opts.scope]   - 'mine': the row is offered nothing unless it is
+ *                                  in the viewer's scope (entryInScope)
  * @returns {Promise<object[]>}
  */
-export async function listTransitionsForEntry(collectionSlug, entry, user = null) {
+export async function listTransitionsForEntry(collectionSlug, entry, user = null, {scope} = {}) {
+    if (!entryInScope(entry, user, scope)) return [];
     const all = await listActionsForCollection(collectionSlug);
     if (!Array.isArray(all) || !all.length) return [];
 
-    const { getRoleLevel } = await import('./roles.js');
-    const { getEffectiveLevel } = await import('./userRoles.js');
-    // Use effective level so multi-role users see transitions any of their
-    // roles permit - e.g. a user who's primarily a candidate but also an
-    // admin sees BOTH the candidate-only "withdraw" AND the admin-only
-    // "approve" transitions on the same entry.
-    const userLevel = getEffectiveLevel(user);
-
-    return all
-        .filter(a => {
-            if (!a.transition) return false;
-            const allowedFrom = Array.isArray(a.transition.from) ? a.transition.from : [a.transition.from].filter(Boolean);
-            if (allowedFrom.length) {
-                const current = entry.data?.[a.transition.field];
-                if (!allowedFrom.includes(current)) return false;
-            }
-            const roles    = a.access?.roles || ['admin', 'super-admin'];
-            const minLevel = Math.min(...roles.map(r => getRoleLevel(r)));
-            if (!(userLevel <= minLevel)) return false;
-            return true;
-        })
-        .map(a => ({
-            slug:       a.slug,
-            title:      a.title,
-            trigger:    a.trigger,
-            transition: a.transition
-        }));
+    // canRunAction walks every role the user holds, so a user who is primarily
+    // a candidate but also an admin sees BOTH the candidate-only "withdraw" AND
+    // the admin-only "approve" transitions on the same entry.
+    const offered = all.filter(a => {
+        if (!a.transition) return false;
+        const allowedFrom = Array.isArray(a.transition.from) ? a.transition.from : [a.transition.from].filter(Boolean);
+        if (allowedFrom.length) {
+            const current = entry.data?.[a.transition.field];
+            if (!allowedFrom.includes(current)) return false;
+        }
+        return canRunAction(user, a);
+    });
+
+    // Row-level rules too, so a button is only offered when executeAction()
+    // would let it through (a withdraw limited to the owner is not shown on
+    // someone else's row).
+    const kept = [];
+    for (const a of offered) {
+        if (await checkEntryAccess(entry, user, a.access?.rowLevel)) kept.push(a);
+    }
+    return kept.map(a => ({
+        slug:       a.slug,
+        title:      a.title,
+        trigger:    a.trigger,
+        transition: a.transition
+    }));
+}
+
+/**
+ * Is this entry inside the display scope the request came from? The only scope
+ * is `mine` (`[collection scope="mine"]`): the entry's `meta.createdBy` must be
+ * the user's id - the filter render-scope and `GET /:slug/public?scope=mine`
+ * list with, so a viewer acts only on the rows that display showed them. No
+ * level bypass: scope="mine" shows an admin their own rows too. No scope leaves
+ * the decision to the action's own access; a scope this code does not know
+ * fails closed.
+ *
+ * @param {object|null} entry
+ * @param {object|null} user
+ * @param {string} [scope]
+ * @returns {boolean}
+ */
+export function entryInScope(entry, user, scope) {
+    if (!scope) return true;
+    if (scope !== 'mine') return false;
+    return !!user?.id && entry?.meta?.createdBy === user.id;
 }
 
 // ---------------------------------------------------------------------------
@@ -481,17 +552,22 @@ export async function listTransitionsForEntry(collectionSlug, entry, user = null
  * @param {string} entryId          - ID of the target entry
  * @param {object} [opts]
  * @param {object}   [opts.user]    - Executing user object (for template context)
+ * @param {string}   [opts.scope]   - 'mine' when run from a scope="mine" display:
+ *                                    a row outside it is refused (403, entryInScope)
  * @returns {Promise<{ success: boolean, stepsCompleted: number, results: object[] }>}
  * @throws {Error} If action or entry not found
  */
-export async function executeAction(slug, entryId, { user = null } = {}) {
+export async function executeAction(slug, entryId, { user = null, scope } = {}) {
     const action = await getAction(slug);
     if (!action) throw new Error(`Action "${slug}" not found`);
 
     const entry = await getEntry(action.collection, entryId);
     if (!entry) throw new Error(`Entry "${entryId}" not found in collection "${action.collection}"`);
 
-    if (!(await checkEntryAccess(entry, user, action.access?.rowLevel))) {
+    // Out of the requesting display's scope (scope="mine": not the viewer's
+    // row) is refused exactly like a row-level denial, and before the state
+    // check, so an outside row never learns its state through a 409.
+    if (!entryInScope(entry, user, scope) || !(await checkEntryAccess(entry, user, action.access?.rowLevel))) {
         const err = new Error('Row-level access denied');
         err.statusCode = 403;
         throw err;