domma-cms 1.6.35 → 1.6.37

package/server/routes/api/collections.js

@@ -64,9 +64,73 @@ import {hooks} from '../../services/hooks.js';
 import {authenticateApiToken, scopeAllows} from '../../services/apiTokens.js';
 import {isProjectEnabled, resolveArtefactProject} from '../../services/projects.js';
 import {maskConnections, restoreConnections} from '../../services/connectionSecrets.js';
+import {
+    callerId,
+    isRoot,
+    isUserDataPreset,
+    mayReadRow,
+    mayWriteRow,
+    ownRowsFilter,
+    pinOwner,
+    pluginDenial
+} from '../../services/collectionAccess.js';
 
 const ALL_PRESET_SLUGS = new Set(['roles', 'user-profiles', ...PRESET_COLLECTION_SLUGS]);
 
+/**
+ * The generic routes are open to anyone holding `collections`, which every
+ * level-1 admin does. Two kinds of collection need more than that (see
+ * services/collectionAccess.js): a plugin's collection needs that plugin's own
+ * permission, and the Tools' user-data presets (notes, tasks, contacts) are
+ * kept to the caller's own rows. Answers the schema, or sends 404/403 and
+ * answers null - the caller returns at once.
+ *
+ * @param {object} request
+ * @param {object} reply
+ * @returns {Promise<object|null>}
+ */
+async function admitted(request, reply) {
+    const schema = await getCollection(request.params.slug);
+    if (!schema) {
+        reply.status(404).send({ error: 'Collection not found' });
+        return null;
+    }
+    const denial = pluginDenial(schema, request.user);
+    if (denial) {
+        reply.status(403).send({ error: denial });
+        return null;
+    }
+    return schema;
+}
+
+/**
+ * One row of a user-data preset the caller may read (or, with `write`,
+ * change): the row, or null after a 404 (no such row) or 403 (not theirs).
+ * Any other collection's rows pass as they are.
+ *
+ * @param {object} request
+ * @param {object} reply
+ * @param {{write?: boolean}} [opts]
+ * @returns {Promise<object|null>}
+ */
+async function ownRow(request, reply, {write = false} = {}) {
+    const {slug, id} = request.params;
+    const entry = await getEntry(slug, id);
+    if (!entry) {
+        reply.status(404).send({ error: 'Entry not found' });
+        return null;
+    }
+    const allowed = write ? mayWriteRow(slug, entry, request.user) : mayReadRow(slug, entry, request.user);
+    if (!allowed) {
+        reply.status(403).send({ error: NOT_YOUR_ROW });
+        return null;
+    }
+    return entry;
+}
+
+const NOT_YOUR_ROW = 'This entry belongs to another user';
+const NOT_YOUR_ROWS = 'Only the site owner can do this to everyone\'s entries - the Tool works on your own';
+
 /**
  * The sidebar badge on Collections (GET /collections/_count): how many
  * collections this user sees and how many entries they hold, with where they
@@ -364,6 +428,9 @@ export async function collectionsRoutes(fastify) {
     });
 
     fastify.put('/collections/:slug', canUpdate, async (request, reply) => {
+        // A plugin's schema is the plugin's: without this, opening `api.read` to
+        // the public is one PUT away from every row the entry routes refuse.
+        if (!(await admitted(request, reply))) return;
         try {
             return await updateCollection(request.params.slug, request.body || {});
         } catch (err) {
@@ -375,6 +442,7 @@ export async function collectionsRoutes(fastify) {
         if (ALL_PRESET_SLUGS.has(request.params.slug)) {
             return reply.status(403).send({ error: 'Cannot delete a preset collection' });
         }
+        if (!(await admitted(request, reply))) return;
         try {
             await deleteCollection(request.params.slug);
             return { success: true };
@@ -404,10 +472,11 @@ export async function collectionsRoutes(fastify) {
      * adding the `qs` dependency for one route.
      */
     fastify.get('/collections/:slug/entries', canRead, async (request, reply) => {
-        const schema = await getCollection(request.params.slug);
-        if (!schema) return reply.status(404).send({ error: 'Collection not found' });
+        if (!(await admitted(request, reply))) return;
         const { page, limit, sort, order, search } = request.query;
-        const filter = extractBracketed(request.query, 'filter');
+        // The caller's own rows of a user-data preset - after their filter, so
+        // `filter[userId]=someone-else` cannot widen it.
+        const filter = {...extractBracketed(request.query, 'filter'), ...ownRowsFilter(request.params.slug, request.user)};
         const result = await listEntries(request.params.slug, {
             page:   parseInt(page, 10)  || 1,
             limit:  parseInt(limit, 10) || 50,
@@ -423,15 +492,18 @@ export async function collectionsRoutes(fastify) {
     });
 
     fastify.get('/collections/:slug/entries/:id', canRead, async (request, reply) => {
-        const entry = await getEntry(request.params.slug, request.params.id);
-        if (!entry) return reply.status(404).send({ error: 'Entry not found' });
+        if (!(await admitted(request, reply))) return;
+        const entry = await ownRow(request, reply);
+        if (!entry) return;
         return request.params.slug === 'api-tokens' ? redactTokenHash(entry) : entry;
     });
 
     fastify.post('/collections/:slug/entries', canCreate, async (request, reply) => {
+        if (!(await admitted(request, reply))) return;
         const user = request.user;
         try {
-            let data = request.body?.data || {};
+            // A note, task or contact made here is the caller's, whatever userId was sent.
+            let data = pinOwner(request.params.slug, request.body?.data || {}, user);
             // A role created in the admin belongs to no plugin; see keepRoleSystemFields.
             if (request.params.slug === 'roles') {
                 data = {...data};
@@ -468,9 +540,10 @@ export async function collectionsRoutes(fastify) {
             ? request.body.field.trim()
             : 'spam';
         const value = request.body?.spam === false ? false : true;
+        if (!(await admitted(request, reply))) return;
         try {
-            const existing = await getEntry(slug, id);
-            if (!existing) return reply.code(404).send({error: 'Entry not found'});
+            const existing = await ownRow(request, reply, {write: true});
+            if (!existing) return;
 
             const entry = await updateEntry(slug, id, {...(existing.data || {}), [field]: value});
             hooks.emit('collection:entryUpdated', {
@@ -484,8 +557,15 @@ export async function collectionsRoutes(fastify) {
     });
 
     fastify.put('/collections/:slug/entries/:id', canUpdate, async (request, reply) => {
+        if (!(await admitted(request, reply))) return;
+        let existing = null;
+        if (isUserDataPreset(request.params.slug)) {
+            existing = await ownRow(request, reply, {write: true});
+            if (!existing) return;
+        }
         try {
-            let data = request.body?.data || {};
+            // A row of a user-data preset keeps its owner - a save cannot hand it to someone else.
+            let data = pinOwner(request.params.slug, request.body?.data || {}, request.user, existing);
             if (request.params.slug === 'roles') data = await keepRoleSystemFields(request.params.id, data);
             const entry = await updateEntry(request.params.slug, request.params.id, data);
             if (request.params.slug === 'roles') await invalidateRoles();
@@ -498,6 +578,8 @@ export async function collectionsRoutes(fastify) {
     });
 
     fastify.delete('/collections/:slug/entries/:id', canDelete, async (request, reply) => {
+        if (!(await admitted(request, reply))) return;
+        if (isUserDataPreset(request.params.slug) && !(await ownRow(request, reply, {write: true}))) return;
         if (request.params.slug === 'roles') {
             const entry = await getEntry('roles', request.params.id);
             if (entry?.data?.level === 0) {
@@ -525,6 +607,11 @@ export async function collectionsRoutes(fastify) {
         if (request.params.slug === 'roles') {
             return reply.status(403).send({ error: 'Roles cannot be cleared - delete them one at a time' });
         }
+        if (!(await admitted(request, reply))) return;
+        // Clearing wipes everyone's rows, so for a user-data preset only root may.
+        if (isUserDataPreset(request.params.slug) && !isRoot(request.user)) {
+            return reply.status(403).send({ error: NOT_YOUR_ROWS });
+        }
         try {
             await clearEntries(request.params.slug);
             return { success: true };
@@ -539,6 +626,7 @@ export async function collectionsRoutes(fastify) {
 
     // Entries keep their ids and meta dates; see migrateStorage() in services/collections.js.
     fastify.post('/collections/:slug/migrate-storage', canUpdate, async (request, reply) => {
+        if (!(await admitted(request, reply))) return;
         try {
             return await migrateStorage(request.params.slug, request.body?.storage);
         } catch (err) {
@@ -553,9 +641,11 @@ export async function collectionsRoutes(fastify) {
     // -------------------------------------------------------------------------
 
     fastify.get('/collections/:slug/export', canRead, async (request, reply) => {
+        if (!(await admitted(request, reply))) return;
         const format = request.query.format === 'csv' ? 'csv' : 'json';
         try {
-            const output = await exportEntries(request.params.slug, format);
+            // A user-data preset exports the caller's own rows, as the Tool would.
+            const output = await exportEntries(request.params.slug, format, {filter: ownRowsFilter(request.params.slug, request.user)});
             if (format === 'csv') {
                 reply.header('Content-Type', 'text/csv');
                 reply.header('Content-Disposition', `attachment; filename="${request.params.slug}-entries.csv"`);
@@ -573,8 +663,13 @@ export async function collectionsRoutes(fastify) {
         const user    = request.user;
         const entries = request.body?.entries;
         if (!Array.isArray(entries)) return reply.status(400).send({ error: 'entries must be an array' });
+        if (!(await admitted(request, reply))) return;
         try {
-            const result = await importEntries(request.params.slug, entries, { createdBy: user?.id || null });
+            // Imported notes, tasks or contacts are the caller's own, whatever userId the file carries.
+            const own = isUserDataPreset(request.params.slug)
+                ? entries.map(item => ({data: pinOwner(request.params.slug, (item?.data && typeof item.data === 'object') ? item.data : (item || {}), user)}))
+                : entries;
+            const result = await importEntries(request.params.slug, own, { createdBy: user?.id || null });
             return reply.status(201).send(result);
         } catch (err) {
             return reply.status(400).send({ error: err.message });
@@ -624,6 +719,7 @@ export async function collectionsRoutes(fastify) {
             const denied = await checkPublicAccess(schema, 'read', request, reply);
             if (denied !== undefined) return;
         }
+        if (nobodysRows(request, reply, filter)) return;
 
         const result = await listEntries(request.params.slug, {
             page:   parseInt(page, 10)  || 1,
@@ -637,15 +733,38 @@ export async function collectionsRoutes(fastify) {
         return applyReadFieldAllowlist(schema, result);
     }
 
+    /**
+     * The public surface of a user-data preset (its `api` block says admins may
+     * read) still shows people only their own rows: the filter joins the
+     * caller's, and a caller with no identity - a visitor, or a project token -
+     * has no rows here. Sends 403 and answers true when that is the case.
+     *
+     * @param {object} request
+     * @param {object} reply
+     * @param {object} [filter] - the list filter to narrow, in place
+     * @returns {boolean}
+     */
+    function nobodysRows(request, reply, filter) {
+        const slug = request.params.slug;
+        if (!isUserDataPreset(slug) || isRoot(request.user)) return false;
+        if (!callerId(request.user)) {
+            reply.status(403).send({ error: NOT_YOUR_ROW });
+            return true;
+        }
+        if (filter) Object.assign(filter, ownRowsFilter(slug, request.user));
+        return false;
+    }
+
     async function publicGetEntry(request, reply) {
         const schema = await getCollection(request.params.slug);
         if (!schema) return reply.status(404).send({ error: 'Collection not found' });
 
         const denied = await checkPublicAccess(schema, 'read', request, reply);
         if (denied !== undefined) return;
+        if (nobodysRows(request, reply)) return;
 
-        const entry = await getEntry(request.params.slug, request.params.id);
-        if (!entry) return reply.status(404).send({ error: 'Entry not found' });
+        const entry = await ownRow(request, reply);
+        if (!entry) return;
         return applyReadFieldAllowlist(schema, entry);
     }
 
@@ -714,6 +833,10 @@ export async function collectionsRoutes(fastify) {
 
         const denied = await checkPublicAccess(schema, 'read', request, reply);
         if (denied !== undefined) return;
+        // A fragment renders every row it is given; a user-data preset has no "everyone's rows" for anyone but root.
+        if (isUserDataPreset(attrs.slug) && !isRoot(request.user)) {
+            return reply.status(403).send({ error: NOT_YOUR_ROWS });
+        }
 
         const { renderCollectionFragment } = await import('../../services/markdown.js');
         const html = await renderCollectionFragment(attrs);
@@ -763,9 +886,10 @@ export async function collectionsRoutes(fastify) {
 
         const denied = await checkPublicAccess(schema, 'create', request, reply);
         if (denied !== undefined) return;
+        if (nobodysRows(request, reply)) return;
 
         try {
-            let data = request.body?.data || {};
+            let data = pinOwner(request.params.slug, request.body?.data || {}, request.user);
             // A role created in the admin belongs to no plugin; see keepRoleSystemFields.
             if (request.params.slug === 'roles') {
                 data = {...data};
@@ -787,9 +911,16 @@ export async function collectionsRoutes(fastify) {
 
         const denied = await checkPublicAccess(schema, 'update', request, reply);
         if (denied !== undefined) return;
+        if (nobodysRows(request, reply)) return;
+        let existing = null;
+        if (isUserDataPreset(request.params.slug)) {
+            existing = await ownRow(request, reply, {write: true});
+            if (!existing) return;
+        }
 
         try {
-            return await updateEntry(request.params.slug, request.params.id, request.body?.data || {});
+            const data = pinOwner(request.params.slug, request.body?.data || {}, request.user, existing);
+            return await updateEntry(request.params.slug, request.params.id, data);
         } catch (err) {
             const status = err.message === 'Entry not found' ? 404 : 400;
             return reply.status(status).send({ error: err.message });
@@ -802,6 +933,8 @@ export async function collectionsRoutes(fastify) {
 
         const denied = await checkPublicAccess(schema, 'delete', request, reply);
         if (denied !== undefined) return;
+        if (nobodysRows(request, reply)) return;
+        if (isUserDataPreset(request.params.slug) && !(await ownRow(request, reply, {write: true}))) return;
 
         try {
             await deleteEntry(request.params.slug, request.params.id);

package/server/routes/outreach-public.js

@@ -1,13 +1,22 @@
 /**
- * The one-click unsubscribe page every outreach email links to:
+ * The unsubscribe page every outreach email links to:
  *
- *   GET /campaign-unsubscribe?e=<base64url address>&k=<HMAC>
+ *   GET  /campaign-unsubscribe?e=<base64url address>&k=<HMAC>   a confirm page
+ *   POST /campaign-unsubscribe  (e, k as form fields or query)   the opt-out
  *
  * Core's, not the sending Tool's, so the link in an email already sent keeps
  * working when that Tool lapses or is removed (PECR). The address goes on the
  * shared suppression list (`outreach-unsubscribes`), which every outreach
  * Tool checks before it sends.
  *
+ * Only the POST changes anything. Mail security scanners (Safe Links,
+ * Mimecast, Proofpoint) and mailbox previews GET every link in a message, so a
+ * GET that opted out unsubscribed people who never clicked - and silenced
+ * Surveys and Onboard for them too, the list being shared. The GET shows one
+ * button; the POST is also what a mail client's own Unsubscribe button sends
+ * (RFC 8058 one-click: the List-Unsubscribe URL with the body
+ * `List-Unsubscribe=One-Click`), so both land on the same handler.
+ *
  * A Campaigns Pro older than this engine registers the same path itself, and
  * plugins register before core: then core stands aside rather than collide.
  *
@@ -19,6 +28,7 @@ import {UNSUBSCRIBE_PATH, verifyUnsubscribe} from '../../plugins/_lib/outreach/u
 import {getUnsubscribeSecret} from '../services/outreachUnsubscribe.js';
 
 const SLUG = 'outreach-unsubscribes';
+const FORM_TYPE = 'application/x-www-form-urlencoded';
 
 const esc = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 
@@ -26,6 +36,15 @@ function page(title, bodyHtml) {
     return `<!DOCTYPE html><html lang="en-GB"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta name="robots" content="noindex"><title>${esc(title)}</title><link rel="stylesheet" href="/dist/domma/domma.css"><style>main{max-width:36rem;margin:4rem auto;padding:0 1.25rem;line-height:1.6}</style></head><body><main>${bodyHtml}</main></body></html>`;
 }
 
+const badLink = () => page('Unsubscribe', '<h1>That link is not right.</h1><p>Use the unsubscribe link from one of our emails.</p>');
+
+/** The confirm page: the same e and k, posted back by one button. */
+function confirmPage(email, e, k) {
+    return page('Unsubscribe', `<h1>Unsubscribe?</h1><p>${esc(email)} will get no more campaign or survey emails from this site.</p>`
+        + `<form method="post" action="${UNSUBSCRIBE_PATH}"><input type="hidden" name="e" value="${esc(e)}"><input type="hidden" name="k" value="${esc(k)}">`
+        + `<button type="submit" class="btn btn-primary">Unsubscribe</button></form>`);
+}
+
 /** The suppression list's collection - made if no outreach Tool ever made it. */
 async function ensureList() {
     try {
@@ -43,6 +62,14 @@ async function ensureList() {
     }
 }
 
+/** The e and k of a request: the posted form first, else the URL (a one-click POST keeps them there). */
+export function linkParams(req) {
+    const body = req.body && typeof req.body === 'object' ? req.body : {};
+    const query = req.query || {};
+    const pick = (v) => (typeof v === 'string' ? v : '');
+    return {e: pick(body.e) || pick(query.e), k: pick(body.k) || pick(query.k)};
+}
+
 /**
  * @param {import('fastify').FastifyInstance} fastify
  * @param {{col?: object, secret?: string}} [opts] - tests inject a collections service and a secret
@@ -52,17 +79,34 @@ export async function outreachPublicRoutes(fastify, opts = {}) {
     const col = opts.col || {createEntry, deleteEntry, listEntries};
     const suppression = createSuppression(col);
 
-    fastify.get(UNSUBSCRIBE_PATH, async (req, reply) => {
-        reply.header('Cache-Control', 'no-store').header('Referrer-Policy', 'no-referrer');
+    // The engine parses JSON only; the confirm form and one-click POSTs are
+    // form-encoded. Scoped to these routes, and tiny: two short fields.
+    if (!fastify.hasContentTypeParser(FORM_TYPE)) {
+        fastify.addContentTypeParser(FORM_TYPE, {parseAs: 'string', bodyLimit: 4096}, (req, body, done) => {
+            try { done(null, Object.fromEntries(new URLSearchParams(body))); } catch (err) { done(err); }
+        });
+    }
+
+    const verified = (req) => {
+        const {e, k} = linkParams(req);
         let email = null;
-        try { email = verifyUnsubscribe(opts.secret || getUnsubscribeSecret(), req.query?.e, req.query?.k); } catch { email = null; }
-        if (!email) {
-            return reply.code(400).type('text/html; charset=utf-8')
-                .send(page('Unsubscribe', '<h1>That link is not right.</h1><p>Use the unsubscribe link from one of our emails.</p>'));
-        }
+        try { email = verifyUnsubscribe(opts.secret || getUnsubscribeSecret(), e, k); } catch { email = null; }
+        return {email, e, k};
+    };
+    const html = (reply) => reply.header('Cache-Control', 'no-store').header('Referrer-Policy', 'no-referrer').type('text/html; charset=utf-8');
+
+    fastify.get(UNSUBSCRIBE_PATH, async (req, reply) => {
+        const {email, e, k} = verified(req);
+        if (!email) return html(reply).code(400).send(badLink());
+        return html(reply).send(confirmPage(email, e, k));
+    });
+
+    fastify.post(UNSUBSCRIBE_PATH, async (req, reply) => {
+        const {email} = verified(req);
+        if (!email) return html(reply).code(400).send(badLink());
         if (!opts.col) await ensureList();
         await suppression.add(email, 'unsubscribe-link');
-        return reply.type('text/html; charset=utf-8').send(page('Unsubscribed',
+        return html(reply).send(page('Unsubscribed',
             `<h1>You are unsubscribed.</h1><p>${esc(email)} will get no more campaign or survey emails from this site.</p>`));
     });
 }

package/server/server.js

@@ -30,6 +30,7 @@ import {seedDefaultComponents} from './services/components.js';
 import {refreshComponentTagAllowlist} from './services/markdown.js';
 import * as cache from './services/cache/index.js';
 import {parseTrustProxy} from './services/network.js';
+import {requestSerializer} from './services/request-log.js';
 import {rateLimitOptions} from './services/rate-limit.js';
 import {frameSources} from './services/embedCsp.js';
 
@@ -85,7 +86,10 @@ function resolveLogLevel() {
 }
 
 const app = Fastify({
-    logger: {level: resolveLogLevel()},
+    // The request serializer redacts query-string credentials (?token=, ?key=,
+    // *secret*, *password*) - see services/request-log.js; everything else is
+    // logged as Fastify would.
+    logger: {level: resolveLogLevel(), serializers: {req: requestSerializer}},
     // Behind a reverse proxy (Apache, domma-cms-manager), trust the proxy so
     // request.ip is the visitor, not the proxy's loopback. TRUST_PROXY=loopback
     // is the right value (right-most X-Forwarded-For entry a local proxy did not

package/server/services/authChecks.js

@@ -77,6 +77,14 @@ export async function runLoginChecks(phase, ctx, {start = 0, log = console} = {}
         try {
             out = await c.check(ctx);
         } catch (err) {
+            // A 'before' check that breaks (a breached-password lookup timing out) must not lock
+            // every account out, so it is skipped. An 'after' check is a second factor or a step-up:
+            // skipping one is a bypass (Security Pro's cookie parser threw on one bad cookie and a
+            // password alone signed in), so a throw there refuses the sign-in.
+            if (phase === 'after') {
+                log.error?.(`[auth] login check ${c.id} failed, sign-in refused: ${errOf(err)}`);
+                return {deny: true, message: 'Sign-in could not be completed. Try again.', status: 503, by: c.id};
+            }
             log.warn?.(`[auth] login check ${c.id} failed, skipped: ${errOf(err)}`);
             continue;
         }

package/server/services/collectionAccess.js

@@ -0,0 +1,191 @@
+/**
+ * Collection access through the generic Collections API (/api/collections/:slug/...).
+ *
+ * The generic routes are guarded by the `collections` permission, which every
+ * level-1 admin holds. Two kinds of collection need more than that:
+ *
+ *   - The user-data presets (Notes, Todo, Contacts) hold people's private rows.
+ *     Their own Tool routes scope every read and write to the caller
+ *     (`data.userId` for notes, tasks and contacts; `meta.createdBy` for the
+ *     shared contact groups, which anyone may read but only their creator or a
+ *     `contacts.manageGroups` holder may change). The generic API applies the
+ *     same rule, so an admin sees and edits their own rows and nobody else's.
+ *
+ *   - A collection a plugin created (`schema.plugin`) belongs to that plugin.
+ *     When the plugin registers permission resources (plugin.json
+ *     `permissions`, or `resources` in its role files) the caller must hold one
+ *     of them; a plugin that registers none falls back to `collections` alone.
+ *
+ * A level-0 user keeps everything - the same bypass rowAccess.js gives them.
+ */
+import {USER_DATA_PRESET_SLUGS} from './presetCollections.js';
+import {getPermissionsFor} from './roles.js';
+import {getEffectiveLevel, getEffectiveRoles} from './userRoles.js';
+import {getEffectiveRegistry} from './permissionRegistry.js';
+
+/** Where each user-data preset keeps its owner - the field its Tool routes filter on. */
+const OWNER_FIELD = Object.freeze({
+    'notes-notes':       {in: 'data', field: 'userId'},
+    'todo-items':        {in: 'data', field: 'userId'},
+    'contacts-contacts': {in: 'data', field: 'userId'},
+    'contacts-groups':   {in: 'meta', field: 'createdBy'}
+});
+
+/** A row anyone with the Tool may read, whoever made it (ownership gates writes only). */
+const SHARED_READ = new Set(['contacts-groups']);
+
+/**
+ * Whether the slug is one of the Tools' user-data presets.
+ *
+ * @param {string} slug
+ * @returns {boolean}
+ */
+export function isUserDataPreset(slug) {
+    return USER_DATA_PRESET_SLUGS.includes(slug);
+}
+
+/**
+ * The caller's id as the Tools record it (`id`, or `sub` on older tokens).
+ *
+ * @param {object|null} user
+ * @returns {string|null}
+ */
+export function callerId(user) {
+    return user?.id ?? user?.sub ?? null;
+}
+
+/**
+ * Whether the user holds the root (level 0) role, directly or through an
+ * additional role - the one level the scoping never applies to.
+ *
+ * @param {object|null} user
+ * @returns {boolean}
+ */
+export function isRoot(user) {
+    return Boolean(user) && getEffectiveLevel(user) === 0;
+}
+
+/**
+ * Whether any of the user's roles holds the resource (any action) or, with
+ * `action`, that specific action. Plugins name their own actions (`manage`,
+ * `send`, `kitchen`), so the bare resource is what the plugin check asks for.
+ *
+ * @param {object|null} user
+ * @param {string} resource
+ * @param {string} [action]
+ * @returns {boolean}
+ */
+export function holds(user, resource, action) {
+    if (!user) return false;
+    const allowed = getPermissionsFor(resource, action);
+    return getEffectiveRoles(user).some(r => allowed.includes(r));
+}
+
+/**
+ * The permission resources a plugin registered at boot (plugin.json
+ * `permissions` plus `resources` in its role files).
+ *
+ * @param {string} plugin
+ * @param {Array<{key: string, plugin?: string}>} [registry] - injectable for tests
+ * @returns {string[]}
+ */
+export function pluginResources(plugin, registry = getEffectiveRegistry()) {
+    return registry.filter(r => r.plugin === plugin).map(r => r.key);
+}
+
+/**
+ * Why `user` may not touch a plugin's collection through the generic API, or
+ * null when they may: the collection is nobody's, the plugin registered no
+ * permission, the user holds one of them, or the user is root.
+ *
+ * @param {object} schema
+ * @param {object|null} user
+ * @param {Array<{key: string, plugin?: string}>} [registry] - injectable for tests
+ * @returns {string|null}
+ */
+export function pluginDenial(schema, user, registry) {
+    const plugin = schema?.plugin;
+    if (!plugin || isRoot(user)) return null;
+    const resources = pluginResources(plugin, registry);
+    if (!resources.length) return null;
+    if (resources.some(resource => holds(user, resource))) return null;
+    return `This collection belongs to the ${plugin} plugin - its permission is required`;
+}
+
+/**
+ * The owner recorded on a row of a user-data preset.
+ *
+ * @param {string} slug
+ * @param {object} entry
+ * @returns {string|null}
+ */
+export function ownerOf(slug, entry) {
+    const where = OWNER_FIELD[slug];
+    if (!where) return null;
+    return entry?.[where.in]?.[where.field] ?? null;
+}
+
+/**
+ * The list filter that keeps a user-data preset to the caller's own rows, or
+ * null when no filter applies (not a user-data preset, root, or a preset whose
+ * rows everyone may read). `createdBy` is the filter engine's pseudo-field for
+ * `meta.createdBy`; anything else is a `data` field.
+ *
+ * @param {string} slug
+ * @param {object|null} user
+ * @returns {object|null}
+ */
+export function ownRowsFilter(slug, user) {
+    const where = OWNER_FIELD[slug];
+    if (!where || SHARED_READ.has(slug) || isRoot(user)) return null;
+    return {[where.field]: callerId(user)};
+}
+
+/**
+ * Whether `user` may read one row of a user-data preset.
+ *
+ * @param {string} slug
+ * @param {object} entry
+ * @param {object|null} user
+ * @returns {boolean}
+ */
+export function mayReadRow(slug, entry, user) {
+    if (!OWNER_FIELD[slug] || SHARED_READ.has(slug) || isRoot(user)) return true;
+    const uid = callerId(user);
+    return Boolean(uid) && ownerOf(slug, entry) === uid;
+}
+
+/**
+ * Whether `user` may change or remove one row of a user-data preset: its
+ * owner, root, or - for contact groups - a `contacts.manageGroups` holder, as
+ * the Contacts Tool allows.
+ *
+ * @param {string} slug
+ * @param {object} entry
+ * @param {object|null} user
+ * @returns {boolean}
+ */
+export function mayWriteRow(slug, entry, user) {
+    if (!OWNER_FIELD[slug] || isRoot(user)) return true;
+    const uid = callerId(user);
+    if (uid && ownerOf(slug, entry) === uid) return true;
+    return slug === 'contacts-groups' && holds(user, 'contacts', 'manageGroups');
+}
+
+/**
+ * The data to store for a user-data preset row written by `user`: a new row
+ * is theirs, an existing row keeps its owner. Root writes what it sent.
+ * Groups record their owner in meta, so their data passes through.
+ *
+ * @param {string} slug
+ * @param {object} data
+ * @param {object|null} user
+ * @param {object|null} [existing] - the row being replaced, for updates
+ * @returns {object}
+ */
+export function pinOwner(slug, data, user, existing = null) {
+    const where = OWNER_FIELD[slug];
+    if (!where || where.in !== 'data' || isRoot(user)) return data;
+    const owner = existing ? ownerOf(slug, existing) : callerId(user);
+    return {...data, [where.field]: owner ?? null};
+}

package/server/services/collections.js

@@ -594,14 +594,20 @@ export async function migrateStorage(slug, storage) {
  *
  * @param {string} slug
  * @param {'json'|'csv'} [format='json']
+ * @param {object} [opts]
+ * @param {Record<string, unknown>|null} [opts.filter] - only the matching rows (filterEngine.js syntax)
  * @returns {Promise<string>}
  */
-export async function exportEntries(slug, format = 'json') {
+export async function exportEntries(slug, format = 'json', {filter = null} = {}) {
     const schema = await getCollection(slug);
     if (!schema) throw new Error(`Collection "${slug}" not found`);
 
     const adapter = await getAdapter(slug);
-    const entries = await adapter.all(slug);
+    // With a filter (the generic API exporting one person's rows of a user-data
+    // preset) only the matching rows go out; otherwise everything, trash included.
+    const entries = filter
+        ? (await adapter.list(slug, {limit: 0, sort: 'createdAt', order: 'asc', filter})).entries
+        : await adapter.all(slug);
 
     if (format === 'csv') {
         const columns = [