Roles, single sign-on and an audit log
Easy CMS 0.33 to 0.36 make it ready for teams: roles you set up in the admin, sign-in with your company account, and a record of who changed what.
A CMS for one developer can trust everyone who logs in. A CMS for a team can't. Four releases, 0.33 to 0.36, add what a team needs, and each is off until you turn it on.
Roles from the admin
auth: { rbac: true },Admins get Settings → Roles: add a role and tick Read, Create, Update, Delete and Publish per collection and global, plus admin pages. Permissions are checked on the server on top of your access rules, so both must allow. When roles are first turned on, they keep everything they could do before; nothing changes until an admin unticks something.
0.34 adds the details teams ask for next:
**Own documents only:** writers read every post but change, publish and delete only theirs.
**Field permissions:** per role, each field can be editable, read only or hidden.
**Deleting a user** asks who gets the documents they owned.
Single sign-on
The new @easy-cms/auth-oauth package adds "Sign in with…" for Google, Microsoft (Entra ID), GitHub or any OpenID Connect provider.
import { google } from '@easy-cms/auth-oauth'
auth: { providers: [google()] }, // reads GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRETauth.allowSignUp gives people from your domains an account on their first sign-in, and auth.password: false keeps passwords for admins only.
An audit log
With audit: true, Easy CMS records changes to documents (each field's value before and after), sign-ins, failed logins, roles, backups and deliveries, with who, how and from where. Settings → Audit log has filters and CSV export. Entries can't be edited through Easy CMS, each is signed with the secret, and a daily check finds edited or missing ones.
Each of these adds a table: create a migration when you turn it on. The Roles, Single sign-on and Audit log guides have the details.