mirror of
https://github.com/hanzo-apps/cms.git
synced 2026-10-30 14:47:33 +00:00
zeekayandHanzo Dev
9571fe65c9
Pages.access.read now returns {_status: published} for anonymous requests
and true for authenticated callers. The multi-tenant plugin composes this
(withTenantAccess): a logged-in caller stays org-scoped; an anonymous caller
has no user, so no tenant constraint is added and published docs of ANY tenant
are world-readable — correct for a headless CMS serving many brands' storefronts
(karma.style/journal fetches with no token). Drafts and every write stay gated
exactly as 3.86.1.
proof.ts step 4b: anon read sees published, hides drafts (+ by-id negative
control). Verified on fresh SQLite: publicRead=true.
Co-authored-by: Hanzo Dev <[email protected]>
