Audit fixes: VIP self-grant, draft leak, onboarding flag, hero personalization, gated downloads

web/src/collections/Comments.ts

@@ -0,0 +1,44 @@
+import type { CollectionConfig } from 'payload'
+
+/* Moderated member comments (QA-D04). Lifecycle: pending → approved | rejected.
+   Author is forced server-side (hook + custom route) so REST cannot spoof identity. */
+const Comments: CollectionConfig = {
+  slug: 'comments',
+  admin: { defaultColumns: ['post', 'authorName', 'status', 'createdAt'] },
+  access: {
+    read: ({ req }) =>
+      (req.user as { role?: string } | undefined)?.role === 'admin'
+        ? true
+        : { status: { equals: 'approved' } },
+    create: ({ req }) => !!req.user,
+    update: ({ req }) => (req.user as { role?: string } | undefined)?.role === 'admin',
+    delete: ({ req }) => (req.user as { role?: string } | undefined)?.role === 'admin',
+  },
+  hooks: {
+    beforeChange: [
+      ({ data, req, operation }) => {
+        if (operation === 'create' && req.user) data.author = req.user.id
+        return data
+      },
+    ],
+  },
+  fields: [
+    { name: 'post', type: 'relationship', relationTo: 'posts', required: true },
+    { name: 'author', type: 'relationship', relationTo: 'users', required: true, admin: { hidden: true } },
+    { name: 'authorName', type: 'text', label: 'Author name' },
+    { name: 'body', type: 'textarea', required: true, minLength: 8, maxLength: 2000 },
+    {
+      name: 'status',
+      type: 'select',
+      required: true,
+      defaultValue: 'pending',
+      options: [
+        { label: 'Pending', value: 'pending' },
+        { label: 'Approved', value: 'approved' },
+        { label: 'Rejected', value: 'rejected' },
+      ],
+    },
+  ],
+}
+
+export default Comments

web/src/collections/Files.ts

@@ -0,0 +1,55 @@
+import path from 'path'
+import { fileURLToPath } from 'url'
+import type { AccessArgs, CollectionConfig } from 'payload'
+
+const filename = fileURLToPath(import.meta.url)
+const dirname = path.dirname(filename)
+
+const isAdmin = (args: AccessArgs) =>
+  (args.req.user as { role?: string } | null | undefined)?.role === 'admin'
+
+/** Where the actual bytes live; the download route reads from here. */
+export const FILES_DIR = path.resolve(dirname, '../../files-private')
+
+const isVip = (args: AccessArgs) => {
+  const role = (args.req.user as { role?: string } | null | undefined)?.role
+  return role === 'vip' || role === 'admin'
+}
+
+/* Per-post work files (templates, checklists). Metadata (labels, filenames)
+   is harmless — the enforcement point is GET /api/files/[id], which gates the
+   bytes per file via `access`. This read rule is defense in depth. */
+const Files: CollectionConfig = {
+  slug: 'files',
+  upload: {
+    staticDir: FILES_DIR,
+    mimeTypes: ['application/pdf', 'application/zip', 'text/markdown', 'text/csv', 'text/plain', 'application/json'],
+  },
+  admin: {
+    useAsTitle: 'label',
+    hidden: ({ user }) => user?.role !== 'admin',
+  },
+  access: {
+    admin: isAdmin,
+    read: isVip,
+    create: isAdmin,
+    update: isAdmin,
+    delete: isAdmin,
+  },
+  fields: [
+    { name: 'label', type: 'text', label: 'Label' },
+    {
+      name: 'access',
+      type: 'select',
+      required: true,
+      defaultValue: 'vip',
+      label: 'Access',
+      options: [
+        { label: 'مجاني', value: 'free' },
+        { label: 'VIP', value: 'vip' },
+      ],
+    },
+  ],
+}
+
+export default Files

web/src/collections/Media.ts

@@ -0,0 +1,31 @@
+import path from 'path'
+import { fileURLToPath } from 'url'
+import type { AccessArgs, CollectionConfig } from 'payload'
+
+const filename = fileURLToPath(import.meta.url)
+const dirname = path.dirname(filename)
+
+const isAdmin = (args: AccessArgs) =>
+  (args.req.user as { role?: string } | null | undefined)?.role === 'admin'
+
+const Media: CollectionConfig = {
+  slug: 'media',
+  upload: {
+    staticDir: path.resolve(dirname, '../../media'),
+    mimeTypes: ['image/jpg', 'image/jpeg', 'image/png', 'image/webp'],
+    imageSizes: [],
+  },
+  admin: {
+    hidden: ({ user }) => user?.role !== 'admin',
+  },
+  access: {
+    admin: isAdmin,
+    read: () => true, // covers must render publicly
+    create: isAdmin,
+    update: isAdmin,
+    delete: isAdmin,
+  },
+  fields: [],
+}
+
+export default Media

web/src/collections/PostLikes.ts

@@ -0,0 +1,46 @@
+import type { CollectionConfig } from 'payload'
+
+/* One like per user per post. `likes`/`views` counters live on the post doc;
+   this collection records who liked what so the toggle is idempotent. */
+const PostLikes: CollectionConfig = {
+  slug: 'post-likes',
+  admin: {
+    useAsTitle: 'id',
+    defaultColumns: ['user', 'post', 'createdAt'],
+  },
+  access: {
+    read: () => true,
+    create: ({ req }) => !!req.user,
+    delete: ({ req }) => {
+      // Admins and the like owner can unlike
+      const user = req.user as { id?: number | string; role?: string } | undefined
+      if (user?.role === 'admin') return true
+      return { user: { equals: user?.id } }
+    },
+  },
+  fields: [
+    { name: 'user', type: 'relationship', relationTo: 'users', required: true, index: true },
+    { name: 'post', type: 'relationship', relationTo: 'posts', required: true, index: true },
+  ],
+  hooks: {
+    beforeValidate: [
+      async ({ data, req, operation }) => {
+        if (operation !== 'create' || !data || !req.payload) return data
+        const existing = await req.payload.find({
+          collection: 'post-likes',
+          where: {
+            and: [
+              { user: { equals: data.user } },
+              { post: { equals: data.post } },
+            ],
+          },
+          limit: 1,
+        })
+        if (existing.docs.length > 0) throw new Error('already-liked')
+        return data
+      },
+    ],
+  },
+}
+
+export default PostLikes

web/src/collections/Posts.ts

@@ -0,0 +1,116 @@
+import type { AccessArgs, CollectionConfig } from 'payload'
+
+const isAdmin = (args: AccessArgs) =>
+  (args.req.user as { role?: string } | null | undefined)?.role === 'admin'
+
+export const CATEGORIES = ['وكلاء', 'نماذج', 'استرجاع', 'سلامة', 'أدوات', 'أعمال'] as const
+
+const Posts: CollectionConfig = {
+  slug: 'posts',
+  admin: {
+    useAsTitle: 'title',
+    defaultColumns: ['title', 'slug', 'category', 'access', 'status', 'publishedAt'],
+  },
+  access: {
+    admin: isAdmin,
+    read: ({ req }) => {
+      if (req.user?.role === 'admin') return true
+      // Public: only published posts (per-doc filtering happens in the hook below)
+      return { status: { equals: 'published' } }
+    },
+    create: isAdmin,
+    update: isAdmin,
+    delete: isAdmin,
+  },
+  fields: [
+    { name: 'title', type: 'text', required: true },
+    {
+      name: 'slug',
+      type: 'text',
+      required: true,
+      unique: true,
+      index: true,
+      admin: { description: 'Latin slug, used in /posts/[slug]' },
+    },
+    { name: 'dek', type: 'textarea', required: true, label: 'Standfirst' },
+    {
+      name: 'access',
+      type: 'select',
+      required: true,
+      defaultValue: 'free',
+      options: [
+        { label: 'مجاني', value: 'free' },
+        { label: 'VIP', value: 'vip' },
+      ],
+    },
+    {
+      name: 'teaser',
+      type: 'textarea',
+      label: 'Teaser (free preview for VIP posts)',
+      admin: { condition: (_data, siblingData: { access?: string } | undefined) => siblingData?.access === 'vip' },
+      validate: (value: unknown, { siblingData }: { siblingData?: { access?: string } }) => {
+        if (siblingData?.access === 'vip' && (!value || String(value).trim() === ''))
+          return 'Teaser is required for VIP posts'
+        return true
+      },
+    },
+    {
+      name: 'content',
+      type: 'richText',
+      required: true,
+      access: {
+        // Never serve VIP body to non-VIP clients — defense in depth
+        // (the paywall page also never queries it for them).
+        read: ((args: { doc?: { access?: string }; req: { user?: { role?: string } | null } }) => {
+          if (!args.doc) return true
+          if (args.doc.access !== 'vip') return true
+          return args.req.user?.role === 'vip' || args.req.user?.role === 'admin'
+        }) as never, // field-permission signature is structurally compatible; TS can't infer it here
+      },
+    },
+    {
+      // Per-post work files. Deliberately not field-gated: ids/filenames are
+      // harmless metadata — the bytes are gated by GET /api/files/[id] +
+      // each file's own `access` (see collections/Files.ts).
+      name: 'attachments',
+      type: 'upload',
+      relationTo: 'files',
+      hasMany: true,
+      label: 'ملفات العمل (VIP)',
+    },
+    {
+      name: 'category',
+      type: 'select',
+      required: true,
+      options: CATEGORIES.map((c) => ({ label: c, value: c })),
+    },
+    {
+      name: 'level',
+      type: 'select',
+      required: true,
+      defaultValue: 'مبتدئ',
+      options: [
+        { label: 'مبتدئ', value: 'مبتدئ' },
+        { label: 'متوسط', value: 'متوسط' },
+        { label: 'متقدم', value: 'متقدم' },
+      ],
+    },
+    { name: 'views', type: 'number', defaultValue: 0, admin: { readOnly: true, position: 'sidebar' } },
+    { name: 'likes', type: 'number', defaultValue: 0, admin: { readOnly: true, position: 'sidebar' } },
+    { name: 'cover', type: 'upload', relationTo: 'media', required: true },
+    { name: 'readingMinutes', type: 'number', required: true, defaultValue: 5 },
+    { name: 'publishedAt', type: 'date', admin: { position: 'sidebar' } },
+    {
+      name: 'status',
+      type: 'select',
+      required: true,
+      defaultValue: 'draft',
+      options: [
+        { label: 'Draft', value: 'draft' },
+        { label: 'Published', value: 'published' },
+      ],
+    },
+  ],
+}
+
+export default Posts

web/src/collections/Users.ts

@@ -0,0 +1,154 @@
+import type { AccessArgs, CollectionConfig } from 'payload'
+
+const isAdmin = (args: AccessArgs) =>
+  (args.req.user as { role?: string } | null | undefined)?.role === 'admin'
+
+export const ROLES = ['free', 'vip', 'admin'] as const
+
+const Users: CollectionConfig = {
+  slug: 'users',
+  auth: { maxLoginAttempts: 5, lockTime: 15 * 60 * 1000 },
+  admin: {
+    useAsTitle: 'email',
+    defaultColumns: ['email', 'role', 'createdAt'],
+  },
+  access: {
+    admin: isAdmin,
+    // Only self and admins can read full user docs
+    read: ({ req, id }) =>
+      req.user?.role === 'admin' || (id != null && req.user?.id === id),
+    // Public open for self-signup; beforeChange forces role 'free' for non-admins
+    create: () => true,
+    update: ({ req, id }) =>
+      req.user?.role === 'admin' || req.user?.id === id,
+    delete: isAdmin,
+  },
+  hooks: {
+    // Admin accounts never lock out (owner decision 2026-10-09): clear any lock
+    // before the login flow reads it. db.updateOne bypasses hooks on purpose —
+    // incrementLoginAttempts writes the same way, so this cannot be intercepted
+    // in beforeChange.
+    beforeOperation: [
+      async ({ args, operation, req }) => {
+        if (operation !== 'login') return
+        const email =
+          typeof args?.data?.email === 'string' ? args.data.email.toLowerCase().trim() : null
+        if (!email) return
+        const { docs } = await req.payload.find({
+          collection: 'users',
+          where: { email: { equals: email } },
+          limit: 1,
+          depth: 0,
+          overrideAccess: true,
+        })
+        const user = docs[0] as { id: number; role?: string } | undefined
+        if (user?.role !== 'admin') return
+        await req.payload.db.updateOne({
+          collection: 'users',
+          id: user.id,
+          data: { lockUntil: null, loginAttempts: 0 },
+        })
+      },
+    ],
+    // Signup must never mint VIP/admin accounts or set Stripe IDs. Local-API
+    // activation (payment success) passes context.systemActivation to bypass.
+    beforeChange: [
+      ({ data, req, operation, context, originalDoc }) => {
+        const trusted = req.user?.role === 'admin' || context?.systemActivation === true
+        if (!trusted) {
+          delete data.stripeCustomerId
+          delete data.verificationToken
+          delete data.emailVerified
+          // `onboarded` is intentionally self-writable: the member wizard
+          // PATCHes { level, onboarded: true } on its own account. Signup
+          // still cannot pre-set it — the create branch below forces false.
+          if (operation === 'create') {
+            data.role = 'free'
+            data.emailVerified = false
+            data.onboarded = false
+            if (data.termsVersion) data.termsAcceptedAt = new Date().toISOString()
+          } else if ('role' in data) {
+            // keep current role — non-admins can never change it, but the
+            // field must stay present or required-validation fails
+            data.role = originalDoc.role
+          }
+        }
+        return data
+      },
+    ],
+  },
+  fields: [
+    {
+      name: 'fullName',
+      type: 'text',
+      label: 'Full Name',
+    },
+    { name: 'termsVersion', type: 'text', label: 'Terms version', admin: { hidden: true } },
+    { name: 'termsAcceptedAt', type: 'date', label: 'Terms accepted at', admin: { hidden: true } },
+    {
+      name: 'interest',
+      type: 'select',
+      label: 'Interest (from member onboarding)',
+      options: [
+        { label: 'الوكلاء وتنسيقهم', value: 'الوكلاء' },
+        { label: 'الاسترجاع وRAG', value: 'RAG' },
+        { label: 'الأتمتة للأعمال', value: 'الأتمتة' },
+        { label: 'النماذج المفتوحة', value: 'النماذج المفتوحة' },
+      ],
+    },
+    {
+      name: 'level',
+      type: 'select',
+      label: 'Experience level',
+      options: [
+        { label: 'مبتدئ', value: 'مبتدئ' },
+        { label: 'متوسط', value: 'متوسط' },
+        { label: 'متقدم', value: 'متقدم' },
+      ],
+    },
+    {
+      name: 'goal',
+      type: 'select',
+      label: 'Goal (from VIP onboarding)',
+      options: [
+        { label: 'بناء مشروع ذكاء اصطناعي', value: 'بناء مشروع ذكاء اصطناعي' },
+        { label: 'تطوير مساري المهني', value: 'تطوير مساري المهني' },
+        { label: 'أتمتة العمل', value: 'أتمتة العمل' },
+        { label: 'فهم الوكلاء بعمق', value: 'فهم الوكلاء بعمق' },
+      ],
+    },
+    {
+      name: 'prefs',
+      type: 'json',
+      label: 'Notification prefs',
+      admin: { description: 'weekly/trackUpdates/replies switches (VIP onboarding)' },
+    },
+    { name: 'emailVerified', type: 'checkbox', defaultValue: false, label: 'Email verified' },
+    {
+      name: 'verificationToken',
+      type: 'text',
+      hidden: true,
+      admin: { readOnly: true, description: 'Email verification token (hashed at rest not required for this flow)' },
+    },
+    { name: 'onboarded', type: 'checkbox', defaultValue: false, label: 'Onboarding completed' },
+    {
+      name: 'role',
+      type: 'select',
+      required: true,
+      defaultValue: 'free',
+      options: [
+        { label: 'Free', value: 'free' },
+        { label: 'VIP', value: 'vip' },
+        { label: 'Admin', value: 'admin' },
+      ],
+    },
+    {
+      name: 'stripeCustomerId',
+      type: 'text',
+      label: 'Stripe Customer ID',
+      admin: { readOnly: true, position: 'sidebar' },
+    },
+  ],
+}
+
+export default Users