From c9fc27a778856820bb8df6fd52cc5f5c68e59a4e Mon Sep 17 00:00:00 2001
From: Giuseppe Criscione <18699708+giuscris@users.noreply.github.com>
Date: Sat, 12 Jul 2025 17:25:41 +0200
Subject: [PATCH 01/10] Prepend panel permissions names with `panel.`

---
 .../src/Panel/Controllers/BackupController.php   |  6 +++---
 .../src/Panel/Controllers/CacheController.php    |  2 +-
 .../Panel/Controllers/DashboardController.php    |  2 +-
 .../src/Panel/Controllers/FilesController.php    | 12 ++++++------
 .../src/Panel/Controllers/OptionsController.php  |  6 +++---
 .../src/Panel/Controllers/PagesController.php    | 14 +++++++-------
 .../Panel/Controllers/StatisticsController.php   |  2 +-
 .../src/Panel/Controllers/ToolsController.php    |  8 ++++----
 .../src/Panel/Controllers/UpdatesController.php  |  4 ++--
 .../src/Panel/Controllers/UsersController.php    |  8 ++++----
 formwork/src/Panel/Navigation/NavigationItem.php |  4 ++--
 formwork/src/Users/Permissions.php               |  6 +-----
 panel/config/navigation.php                      | 16 ++++++++--------
 panel/views/dashboard/index.php                  | 10 +++++-----
 panel/views/files/edit.php                       |  8 ++++----
 panel/views/files/index.php                      |  4 ++--
 panel/views/options/tabs.php                     |  4 ++--
 panel/views/pages/editor.php                     |  2 +-
 panel/views/pages/index.php                      |  4 ++--
 panel/views/pages/tree.php                       |  4 ++--
 panel/views/partials/files/file/item.php         |  8 ++++----
 panel/views/partials/files/file/list.php         |  8 ++++----
 panel/views/partials/sidebar.php                 |  4 ++--
 panel/views/tools/tabs.php                       |  4 ++--
 panel/views/users/index.php                      |  4 ++--
 site/users/roles/admin.yaml                      | 11 +----------
 site/users/roles/user.yaml                       |  6 +++---
 27 files changed, 79 insertions(+), 92 deletions(-)

diff --git a/formwork/src/Panel/Controllers/BackupController.php b/formwork/src/Panel/Controllers/BackupController.php
index dad9523f2..2f2b2bec5 100644
--- a/formwork/src/Panel/Controllers/BackupController.php
+++ b/formwork/src/Panel/Controllers/BackupController.php
@@ -20,7 +20,7 @@ final class BackupController extends AbstractController
      */
     public function make(): JsonResponse|Response
     {
-        if (!$this->hasPermission('backup.make')) {
+        if (!$this->hasPermission('panel.backup.make')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -47,7 +47,7 @@ public function make(): JsonResponse|Response
      */
     public function download(RouteParams $routeParams): Response
     {
-        if (!$this->hasPermission('backup.download')) {
+        if (!$this->hasPermission('panel.backup.download')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -68,7 +68,7 @@ public function download(RouteParams $routeParams): Response
      */
     public function delete(RouteParams $routeParams): Response
     {
-        if (!$this->hasPermission('backup.download')) {
+        if (!$this->hasPermission('panel.backup.download')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
diff --git a/formwork/src/Panel/Controllers/CacheController.php b/formwork/src/Panel/Controllers/CacheController.php
index 00aa4d5e6..2d6d5fe69 100644
--- a/formwork/src/Panel/Controllers/CacheController.php
+++ b/formwork/src/Panel/Controllers/CacheController.php
@@ -15,7 +15,7 @@ final class CacheController extends AbstractController
      */
     public function clear(RouteParams $routeParams, AbstractCache $cache): JsonResponse|Response
     {
-        if (!$this->hasPermission('cache.clear')) {
+        if (!$this->hasPermission('panel.cache.clear')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
diff --git a/formwork/src/Panel/Controllers/DashboardController.php b/formwork/src/Panel/Controllers/DashboardController.php
index e97a58509..10e1c36f6 100644
--- a/formwork/src/Panel/Controllers/DashboardController.php
+++ b/formwork/src/Panel/Controllers/DashboardController.php
@@ -13,7 +13,7 @@ final class DashboardController extends AbstractController
      */
     public function index(Statistics $statistics): Response
     {
-        if (!$this->hasPermission('dashboard')) {
+        if (!$this->hasPermission('panel.dashboard')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
diff --git a/formwork/src/Panel/Controllers/FilesController.php b/formwork/src/Panel/Controllers/FilesController.php
index e41971518..6f4940a25 100644
--- a/formwork/src/Panel/Controllers/FilesController.php
+++ b/formwork/src/Panel/Controllers/FilesController.php
@@ -31,7 +31,7 @@ final class FilesController extends AbstractController
      */
     public function index(): Response
     {
-        if (!$this->hasPermission('files.index')) {
+        if (!$this->hasPermission('panel.files.index')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -46,7 +46,7 @@ public function index(): Response
      */
     public function upload(): Response
     {
-        if (!$this->hasPermission('files.upload')) {
+        if (!$this->hasPermission('panel.files.upload')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -87,7 +87,7 @@ public function upload(): Response
      */
     public function edit(RouteParams $routeParams): Response
     {
-        if (!$this->hasPermission('files.edit')) {
+        if (!$this->hasPermission('panel.files.edit')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -139,7 +139,7 @@ public function edit(RouteParams $routeParams): Response
      */
     public function delete(RouteParams $routeParams): JsonResponse|Response
     {
-        if (!$this->hasPermission('files.delete')) {
+        if (!$this->hasPermission('panel.files.delete')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -171,7 +171,7 @@ public function delete(RouteParams $routeParams): JsonResponse|Response
      */
     public function rename(RouteParams $routeParams, FileFactory $fileFactory): JsonResponse|Response
     {
-        if (!$this->hasPermission('files.rename')) {
+        if (!$this->hasPermission('panel.files.rename')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -240,7 +240,7 @@ public function rename(RouteParams $routeParams, FileFactory $fileFactory): Json
      */
     public function replace(RouteParams $routeParams): JsonResponse|Response
     {
-        if (!$this->hasPermission('files.replace')) {
+        if (!$this->hasPermission('panel.files.replace')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
diff --git a/formwork/src/Panel/Controllers/OptionsController.php b/formwork/src/Panel/Controllers/OptionsController.php
index e9a922d91..306900e60 100644
--- a/formwork/src/Panel/Controllers/OptionsController.php
+++ b/formwork/src/Panel/Controllers/OptionsController.php
@@ -26,7 +26,7 @@ final class OptionsController extends AbstractController
      */
     public function index(): Response
     {
-        if (!$this->hasPermission('options.site')) {
+        if (!$this->hasPermission('panel.options.site')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -38,7 +38,7 @@ public function index(): Response
      */
     public function systemOptions(Schemes $schemes): Response
     {
-        if (!$this->hasPermission('options.system')) {
+        if (!$this->hasPermission('panel.options.system')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -81,7 +81,7 @@ public function systemOptions(Schemes $schemes): Response
      */
     public function siteOptions(Schemes $schemes): Response
     {
-        if (!$this->hasPermission('options.site')) {
+        if (!$this->hasPermission('panel.options.site')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
diff --git a/formwork/src/Panel/Controllers/PagesController.php b/formwork/src/Panel/Controllers/PagesController.php
index 8701d884c..d58d0a85a 100644
--- a/formwork/src/Panel/Controllers/PagesController.php
+++ b/formwork/src/Panel/Controllers/PagesController.php
@@ -33,7 +33,7 @@ final class PagesController extends AbstractController
      */
     public function index(): Response
     {
-        if (!$this->hasPermission('pages.index')) {
+        if (!$this->hasPermission('panel.pages.index')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -52,7 +52,7 @@ public function index(): Response
                 'includeChildren' => true,
                 'class'           => 'pages-tree-root',
                 'parent'          => '.',
-                'orderable'       => $this->panel->user()->permissions()->has('pages.reorder'),
+                'orderable'       => $this->panel->user()->permissions()->has('panel.pages.reorder'),
                 'headers'         => true,
             ]),
         ]));
@@ -63,7 +63,7 @@ public function index(): Response
      */
     public function create(PageFactory $pageFactory): Response
     {
-        if (!$this->hasPermission('pages.create')) {
+        if (!$this->hasPermission('panel.pages.create')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -98,7 +98,7 @@ public function create(PageFactory $pageFactory): Response
      */
     public function edit(RouteParams $routeParams): Response
     {
-        if (!$this->hasPermission('pages.edit')) {
+        if (!$this->hasPermission('panel.pages.edit')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -241,7 +241,7 @@ public function preview(RouteParams $routeParams): Response
      */
     public function reorder(): JsonResponse|Response
     {
-        if (!$this->hasPermission('pages.reorder')) {
+        if (!$this->hasPermission('panel.pages.reorder')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -284,7 +284,7 @@ public function reorder(): JsonResponse|Response
      */
     public function delete(RouteParams $routeParams): Response
     {
-        if (!$this->hasPermission('pages.delete')) {
+        if (!$this->hasPermission('panel.pages.delete')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -333,7 +333,7 @@ public function delete(RouteParams $routeParams): Response
      */
     public function upload(RouteParams $routeParams): Response|JsonResponse
     {
-        if (!$this->hasPermission('files.upload')) {
+        if (!$this->hasPermission('panel.files.upload')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
diff --git a/formwork/src/Panel/Controllers/StatisticsController.php b/formwork/src/Panel/Controllers/StatisticsController.php
index 2384ed294..6ed1f8157 100644
--- a/formwork/src/Panel/Controllers/StatisticsController.php
+++ b/formwork/src/Panel/Controllers/StatisticsController.php
@@ -13,7 +13,7 @@ final class StatisticsController extends AbstractController
      */
     public function index(Statistics $statistics): Response
     {
-        if (!$this->hasPermission('statistics')) {
+        if (!$this->hasPermission('panel.statistics')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
diff --git a/formwork/src/Panel/Controllers/ToolsController.php b/formwork/src/Panel/Controllers/ToolsController.php
index 8075e4778..9423aeb2f 100644
--- a/formwork/src/Panel/Controllers/ToolsController.php
+++ b/formwork/src/Panel/Controllers/ToolsController.php
@@ -24,7 +24,7 @@ final class ToolsController extends AbstractController
      */
     public function index(): Response
     {
-        if (!$this->hasPermission('tools.backups')) {
+        if (!$this->hasPermission('panel.tools.backups')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -36,7 +36,7 @@ public function index(): Response
      */
     public function backups(): Response
     {
-        if (!$this->hasPermission('tools.backups')) {
+        if (!$this->hasPermission('panel.tools.backups')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -64,7 +64,7 @@ public function backups(): Response
      */
     public function updates(): Response
     {
-        if (!$this->hasPermission('tools.updates')) {
+        if (!$this->hasPermission('panel.tools.updates')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -83,7 +83,7 @@ public function updates(): Response
      */
     public function info(): Response
     {
-        if (!$this->hasPermission('tools.info')) {
+        if (!$this->hasPermission('panel.tools.info')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
diff --git a/formwork/src/Panel/Controllers/UpdatesController.php b/formwork/src/Panel/Controllers/UpdatesController.php
index ae1ec6c1a..096b2e8ba 100644
--- a/formwork/src/Panel/Controllers/UpdatesController.php
+++ b/formwork/src/Panel/Controllers/UpdatesController.php
@@ -18,7 +18,7 @@ final class UpdatesController extends AbstractController
      */
     public function check(Updater $updater): JsonResponse|Response
     {
-        if (!$this->hasPermission('updates.check')) {
+        if (!$this->hasPermission('panel.updates.check')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -45,7 +45,7 @@ public function check(Updater $updater): JsonResponse|Response
      */
     public function update(Updater $updater, AbstractCache $cache): JsonResponse|Response
     {
-        if (!$this->hasPermission('updates.update')) {
+        if (!$this->hasPermission('panel.updates.update')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
diff --git a/formwork/src/Panel/Controllers/UsersController.php b/formwork/src/Panel/Controllers/UsersController.php
index c054b96dd..5d5a51882 100644
--- a/formwork/src/Panel/Controllers/UsersController.php
+++ b/formwork/src/Panel/Controllers/UsersController.php
@@ -25,7 +25,7 @@ final class UsersController extends AbstractController
      */
     public function index(): Response
     {
-        if (!$this->hasPermission('users.index')) {
+        if (!$this->hasPermission('panel.users.index')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -40,7 +40,7 @@ public function index(): Response
      */
     public function create(): Response
     {
-        if (!$this->hasPermission('users.create')) {
+        if (!$this->hasPermission('panel.users.create')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -89,7 +89,7 @@ public function create(): Response
      */
     public function delete(RouteParams $routeParams): Response
     {
-        if (!$this->hasPermission('users.delete')) {
+        if (!$this->hasPermission('panel.users.delete')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
@@ -129,7 +129,7 @@ public function delete(RouteParams $routeParams): Response
      */
     public function deleteImage(RouteParams $routeParams): Response
     {
-        if (!$this->hasPermission('users.deleteImage')) {
+        if (!$this->hasPermission('panel.users.deleteImage')) {
             return $this->forward(ErrorsController::class, 'forbidden');
         }
 
diff --git a/formwork/src/Panel/Navigation/NavigationItem.php b/formwork/src/Panel/Navigation/NavigationItem.php
index 4a4a44540..d7d1cfae6 100644
--- a/formwork/src/Panel/Navigation/NavigationItem.php
+++ b/formwork/src/Panel/Navigation/NavigationItem.php
@@ -44,9 +44,9 @@ public function uri(): string
     /**
      * Get navigation item permissions
      */
-    public function permissions(): string
+    public function permissions(): ?string
     {
-        return $this->data['permissions'] ?? '*';
+        return $this->data['permissions'];
     }
 
     /**
diff --git a/formwork/src/Users/Permissions.php b/formwork/src/Users/Permissions.php
index 767174eb9..2033aa92e 100644
--- a/formwork/src/Users/Permissions.php
+++ b/formwork/src/Users/Permissions.php
@@ -34,10 +34,6 @@ public function __construct(array $permissions)
      */
     public function has(string $permission): bool
     {
-        if ($permission === '*') {
-            return true;
-        }
-
         if (array_key_exists($permission, $this->permissions)) {
             return $this->permissions[$permission];
         }
@@ -45,7 +41,7 @@ public function has(string $permission): bool
         // If $permission is not found try with the upper level one (super permission),
         // e.g. try with 'options' if 'options.updates' is not found
 
-        $superPermission = Str::before($permission, '.');
+        $superPermission = Str::beforeLast($permission, '.');
 
         if ($superPermission !== $permission) {
             return $this->has($superPermission);
diff --git a/panel/config/navigation.php b/panel/config/navigation.php
index 0da5fd608..b8541ab1f 100644
--- a/panel/config/navigation.php
+++ b/panel/config/navigation.php
@@ -7,49 +7,49 @@
     'dashboard' => [
         'label'       => $translation->translate('panel.dashboard.dashboard'),
         'uri'         => '/dashboard/',
-        'permissions' => 'dashboard',
+        'permissions' => 'panel.dashboard',
         'badge'       => null,
     ],
     'pages' => [
         'label'       => $translation->translate('panel.pages.pages'),
         'uri'         => '/pages/',
-        'permissions' => 'pages',
+        'permissions' => 'panel.pages',
         'badge'       => $site->descendants()->count(),
     ],
     'files' => [
         'label'       => $translation->translate('panel.files.files'),
         'uri'         => '/files/',
-        'permissions' => 'files',
+        'permissions' => 'panel.files',
         'badge'       => null,
     ],
     'statistics' => [
         'label'       => $translation->translate('panel.statistics.statistics'),
         'uri'         => '/statistics/',
-        'permissions' => 'statistics',
+        'permissions' => 'panel.statistics',
         'badge'       => null,
     ],
     'users' => [
         'label'       => $translation->translate('panel.users.users'),
         'uri'         => '/users/',
-        'permissions' => 'users',
+        'permissions' => 'panel.users',
         'badge'       => $site->users()->count(),
     ],
     'options' => [
         'label'       => $translation->translate('panel.options.options'),
         'uri'         => '/options/',
-        'permissions' => 'options',
+        'permissions' => 'panel.options',
         'badge'       => null,
     ],
     'tools' => [
         'label'       => $translation->translate('panel.tools.tools'),
         'uri'         => '/tools/',
-        'permissions' => 'tools',
+        'permissions' => 'panel.tools',
         'badge'       => null,
     ],
     'logout' => [
         'label'       => $translation->translate('panel.login.logout'),
         'uri'         => '/logout/',
-        'permissions' => '*',
+        'permissions' => null,
         'badge'       => null,
     ],
 ];
diff --git a/panel/views/dashboard/index.php b/panel/views/dashboard/index.php
index 79feb87f9..310efe343 100644
--- a/panel/views/dashboard/index.php
+++ b/panel/views/dashboard/index.php
@@ -16,10 +16,10 @@
                 <div class="section-header">
                     <div class="caption"><?= $this->translate('panel.dashboard.quickActions') ?></div>
                 </div>
-                <?php if ($panel->user()->permissions()->has('pages.create')) : ?>
+                <?php if ($panel->user()->permissions()->has('panel.pages.create')) : ?>
                     <button type="button" class="button button-accent mb-4" data-modal="newPageModal"><?= $this->icon('plus-circle') ?> <?= $this->translate('panel.pages.newPage') ?></button>
                 <?php endif ?>
-                <?php if ($panel->user()->permissions()->has('cache.clear')) : ?>
+                <?php if ($panel->user()->permissions()->has('panel.cache.clear')) : ?>
                     <div class="dropdown mb-4">
                         <div class="button-group">
                             <button type="button" class="button button-secondary" data-command="clear-cache"><?= $this->icon('cache-clear') ?> <?= $this->translate('panel.cache.clear') ?></button>
@@ -31,10 +31,10 @@
                         </div>
                     </div>
                 <?php endif ?>
-                <?php if ($panel->user()->permissions()->has('backup')) : ?>
+                <?php if ($panel->user()->permissions()->has('panel.backup')) : ?>
                     <button type="button" class="button button-secondary mb-4" data-command="make-backup"><?= $this->icon('clock-rotate-left') ?> <?= $this->translate('panel.backup.backup') ?></button>
                 <?php endif ?>
-                <?php if ($panel->user()->permissions()->has('options.updates')) : ?>
+                <?php if ($panel->user()->permissions()->has('panel.options.updates')) : ?>
                     <a class="button button-secondary mb-4" role="button" href="<?= $panel->uri('/tools/updates/') ?>"><?= $this->icon('arrows-rotate-clockwise') ?> <?= $this->translate('panel.updates.check') ?></a>
                 <?php endif ?>
             </section>
@@ -64,4 +64,4 @@
         </div>
         <?= $lastModifiedPages ?>
     </section>
-</div>
+</div>
\ No newline at end of file
diff --git a/panel/views/files/edit.php b/panel/views/files/edit.php
index 4932dfc0a..54baf171a 100644
--- a/panel/views/files/edit.php
+++ b/panel/views/files/edit.php
@@ -21,13 +21,13 @@
         <div>
             <a class="<?= $this->classes(['button', 'button-link', 'show-from-md', 'disabled' => !$previousFile]) ?>" role="button" <?php if ($previousFile) : ?>href="<?= $this->uri($app->router()->generate('panel.files.edit', ['model' => $model->getModelIdentifier(), 'id' => $model->route(), 'filename' => $previousFile->name()])) ?>" <?php endif ?> title="<?= $this->translate('panel.files.previous') ?>" aria-label="<?= $this->translate('panel.files.previous') ?>"><?= $this->icon('chevron-left') ?></a>
             <a class="<?= $this->classes(['button', 'button-link', 'show-from-md', 'disabled' => !$nextFile]) ?>" role="button" <?php if ($nextFile) : ?>href="<?= $this->uri($app->router()->generate('panel.files.edit', ['model' => $model->getModelIdentifier(), 'id' => $model->route(), 'filename' => $nextFile->name()])) ?>" <?php endif ?> title="<?= $this->translate('panel.files.next') ?>" aria-label="<?= $this->translate('panel.files.next') ?>"><?= $this->icon('chevron-right') ?></a>
-            <?php if ($panel->user()->permissions()->has('pages.renameFiles')) : ?>
+            <?php if ($panel->user()->permissions()->has('panel.pages.renameFiles')) : ?>
                 <button type="button" class="button button-link" data-modal="renameFileModal" data-modal-action="<?= $this->uri($app->router()->generate('panel.files.rename', ['model' => $model->getModelIdentifier(), 'id' => $model->route(), 'filename' => $file->name()])) ?>" data-filename="<?= $file->name() ?>" title="<?= $this->translate('panel.pages.renameFile')  ?>" aria-label="<?= $this->translate('panel.pages.renameFile')  ?>"><?= $this->icon('pencil') ?></button>
             <?php endif ?>
-            <?php if ($panel->user()->permissions()->has('pages.replaceFiles')) : ?>
+            <?php if ($panel->user()->permissions()->has('panel.pages.replaceFiles')) : ?>
                 <button type="button" class="button button-link" data-command="replaceFile" data-action="<?= $this->uri($app->router()->generate('panel.files.replace', ['model' => $model->getModelIdentifier(), 'id' => $model->route(), 'filename' => $file->name()])) ?>" data-extension=".<?= $file->extension() ?>" title="<?= $this->translate('panel.pages.replaceFile')  ?>" aria-label="<?= $this->translate('panel.pages.replaceFile')  ?>"><?= $this->icon('cloud-upload') ?></button>
             <?php endif ?>
-            <?php if ($panel->user()->permissions()->has('pages.deleteFiles')) : ?>
+            <?php if ($panel->user()->permissions()->has('panel.pages.deleteFiles')) : ?>
                 <button type="button" class="button button-link" data-modal="deleteFileModal" data-modal-action="<?= $this->uri($app->router()->generate('panel.files.delete', ['model' => $model->getModelIdentifier(), 'id' => $model->route(), 'filename' => $file->name()])) ?>" title="<?= $this->translate('panel.pages.deleteFile')  ?>" aria-label="<?= $this->translate('panel.pages.deleteFile')  ?>"><?= $this->icon('trash') ?></button>
             <?php endif ?>
             <?php if (!$file->fields()->isEmpty()): ?>
@@ -115,4 +115,4 @@
     <?php if (!$file->fields()->isEmpty()): ?>
         <?php $this->insert('fields', ['fields' => $file->fields()]) ?>
     <?php endif ?>
-</form>
+</form>
\ No newline at end of file
diff --git a/panel/views/files/index.php b/panel/views/files/index.php
index ffe438bb2..f3411e45c 100644
--- a/panel/views/files/index.php
+++ b/panel/views/files/index.php
@@ -5,7 +5,7 @@
     <div class="header">
         <div class="header-title"><?= $this->translate('panel.files.files') ?></div>
         <div>
-            <?php if ($panel->user()->permissions()->has('files.upload')) : ?>
+            <?php if ($panel->user()->permissions()->has('panel.files.upload')) : ?>
                 <button type="button" class="button button-accent" data-modal="uploadFileModal"><?= $this->icon('cloud-upload') ?> <?= $this->translate('panel.files.upload') ?></button>
             <?php endif ?>
         </div>
@@ -16,4 +16,4 @@
             <?php $this->insert('partials.files.file.list', ['name' => 'view-files', 'files' => $files, 'columns' => ['parent', 'date', 'size']]) ?>
         </div>
     </div>
-</div>
+</div>
\ No newline at end of file
diff --git a/panel/views/options/tabs.php b/panel/views/options/tabs.php
index 1f0aa3d4a..2651be70a 100644
--- a/panel/views/options/tabs.php
+++ b/panel/views/options/tabs.php
@@ -1,7 +1,7 @@
 <div class="tabs">
     <?php foreach ($tabs as $tab) : ?>
-        <?php if ($panel->user()->permissions()->has('options.' . $tab)) : ?>
+        <?php if ($panel->user()->permissions()->has('panel.options.' . $tab)) : ?>
             <a class="<?= $this->classes(['tabs-tab', 'active' => $tab === $current]) ?>" href="<?= $panel->uri('/options/' . $tab . '/') ?>"><?= $this->translate('panel.options.' . $tab) ?></a>
         <?php endif ?>
     <?php endforeach ?>
-</div>
+</div>
\ No newline at end of file
diff --git a/panel/views/pages/editor.php b/panel/views/pages/editor.php
index f6d0c7f52..3835e26eb 100644
--- a/panel/views/pages/editor.php
+++ b/panel/views/pages/editor.php
@@ -27,7 +27,7 @@
             <a class="<?= $this->classes(['button', 'button-link', 'show-from-md', 'disabled' => !$nextPage]) ?>" role="button" <?php if ($nextPage) : ?>href="<?= $panel->uri('/pages/' . trim($nextPage->route(), '/') . '/edit/') ?>" <?php endif ?> title="<?= $this->translate('panel.pages.next') ?>" aria-label="<?= $this->translate('panel.pages.next') ?>"><?= $this->icon('chevron-right') ?></a>
             <a class="<?= $this->classes(['button', 'button-link', 'disabled' => !$page->published() || !$page->routable()]) ?>" role="button" <?php if ($page->published() && $page->routable()) : ?>href="<?= $page->uri(includeLanguage: $currentLanguage ?: true) ?>" <?php endif ?> target="formwork-view-page-<?= $page->uid() ?>" title="<?= $this->translate('panel.pages.viewPage') ?>" aria-label="<?= $this->translate('panel.pages.viewPage') ?>"><?= $this->icon('arrow-right-up-box') ?></a>
             <button type="submit" class="<?= $this->classes(['button', 'button-link', 'disabled' => !$page->routable()]) ?>" data-command="preview" formaction="<?= $panel->uri('/pages/' . trim($page->route(), '/') . '/preview/') ?>" formtarget="formwork-preview-<?= $page->uid() ?>" title="<?= $this->translate('panel.pages.preview') ?>" aria-label="<?= $this->translate('panel.pages.preview') ?>"><?= $this->icon('eye') ?></button>
-            <?php if ($panel->user()->permissions()->has('pages.delete')) : ?>
+            <?php if ($panel->user()->permissions()->has('panel.pages.delete')) : ?>
                 <button type="button" class="button button-link" data-modal="deletePageModal" data-modal-action="<?= $panel->uri('/pages/' . trim($page->route(), '/') . '/delete/' . ($currentLanguage ? 'language/' . $currentLanguage . '/' : '')) ?>" title="<?= $this->translate('panel.pages.deletePage') ?>" aria-label="<?= $this->translate('panel.pages.deletePage') ?>" <?php if (!$page->isDeletable()) : ?> disabled<?php endif ?>><?= $this->icon('trash') ?></button>
             <?php endif ?>
             <?php if ($site->languages()->hasMultiple()) : ?>
diff --git a/panel/views/pages/index.php b/panel/views/pages/index.php
index c1f0303c6..533e6672b 100644
--- a/panel/views/pages/index.php
+++ b/panel/views/pages/index.php
@@ -5,7 +5,7 @@
 <div class="header">
     <div class="header-title"><?= $this->translate('panel.pages.pages') ?> <span class="badge"><?= $app->site()->descendants()->count() ?></span></div>
     <div>
-        <?php if ($panel->user()->permissions()->has('pages.create')) : ?>
+        <?php if ($panel->user()->permissions()->has('panel.pages.create')) : ?>
             <button type="button" class="button button-accent" data-modal="newPageModal"><?= $this->icon('plus-circle') ?> <?= $this->translate('panel.pages.newPage') ?></button>
         <?php endif ?>
     </div>
@@ -26,4 +26,4 @@
         </div>
     </div>
     <?= $pagesTree ?>
-</section>
+</section>
\ No newline at end of file
diff --git a/panel/views/pages/tree.php b/panel/views/pages/tree.php
index 61a41d6b5..a8f92d387 100644
--- a/panel/views/pages/tree.php
+++ b/panel/views/pages/tree.php
@@ -62,7 +62,7 @@
                 </div>
                 <div class="pages-tree-item-cell page-actions">
                     <a class="<?= $this->classes(['button', 'button-link', 'disabled' => !$page->published() || !$page->routable()]) ?>" role="button" <?php if ($page->published() && $page->routable()) : ?>href="<?= $page->uri(includeLanguage: false) ?>" <?php endif ?> target="formwork-view-page-<?= $page->uid() ?>" title="<?= $this->translate('panel.pages.viewPage') ?>" aria-label="<?= $this->translate('panel.pages.viewPage') ?>"><?= $this->icon('arrow-right-up-box') ?></a>
-                    <?php if ($panel->user()->permissions()->has('pages.delete')) : ?>
+                    <?php if ($panel->user()->permissions()->has('panel.pages.delete')) : ?>
                         <button type="button" class="button button-link" data-modal="deletePageModal" data-modal-action="<?= $panel->uri('/pages/' . trim($page->route(), '/') . '/delete/') ?>" title="<?= $this->translate('panel.pages.deletePage') ?>" aria-label="<?= $this->translate('panel.pages.deletePage') ?>" <?php if (!$page->isDeletable()) : ?> disabled<?php endif ?>><?= $this->icon('trash') ?></button>
                     <?php endif ?>
                 </div>
@@ -79,4 +79,4 @@
             <?php endif ?>
         </li>
     <?php endforeach ?>
-</ul>
+</ul>
\ No newline at end of file
diff --git a/panel/views/partials/files/file/item.php b/panel/views/partials/files/file/item.php
index fbcc8c437..b709f4a5a 100644
--- a/panel/views/partials/files/file/item.php
+++ b/panel/views/partials/files/file/item.php
@@ -29,16 +29,16 @@
             <div class="dropdown-menu" id="dropdown-<?= $file->hash() ?>">
                 <a class="dropdown-item" data-command="infoFile" href="<?= $this->uri($app->router()->generate('panel.files.edit', ['model' => $model->getModelIdentifier(), 'id' => $model->route(), 'filename' => $file->name()])) ?>"><?= $this->icon('info-circle') ?> <?= $this->translate('panel.files.info') ?></a>
                 <a class="dropdown-item" data-command="previewFile" href="<?= $file->uri() ?>" target="formwork-preview-file-<?= $file->hash() ?>"><?= $this->icon('eye') ?> <?= $this->translate('panel.pages.previewFile') ?></a>
-                <?php if ($panel->user()->permissions()->has('pages.renameFiles')) : ?>
+                <?php if ($panel->user()->permissions()->has('panel.pages.renameFiles')) : ?>
                     <a class="dropdown-item" data-command="renameFile" data-modal="renameFileItemModal" data-action="<?= $this->uri($app->router()->generate('panel.files.rename', ['model' => $model->getModelIdentifier(), 'id' => $model->route(), 'filename' => $file->name()])) ?>"><?= $this->icon('pencil') ?> <?= $this->translate('panel.pages.renameFile') ?></a>
                 <?php endif ?>
-                <?php if ($panel->user()->permissions()->has('pages.replaceFiles')) : ?>
+                <?php if ($panel->user()->permissions()->has('panel.pages.replaceFiles')) : ?>
                     <a class="dropdown-item" data-command="replaceFile" data-action="<?= $this->uri($app->router()->generate('panel.files.replace', ['model' => $model->getModelIdentifier(), 'id' => $model->route(), 'filename' => $file->name()])) ?>" data-mimetype="<?= $file->mimeType() ?>"><?= $this->icon('cloud-upload') ?> <?= $this->translate('panel.pages.replaceFile') ?></a>
                 <?php endif ?>
-                <?php if ($panel->user()->permissions()->has('pages.deleteFiles')) : ?>
+                <?php if ($panel->user()->permissions()->has('panel.pages.deleteFiles')) : ?>
                     <a class="dropdown-item" data-command="deleteFile" data-modal="deleteFileItemModal" data-action="<?= $this->uri($app->router()->generate('panel.files.delete', ['model' => $model->getModelIdentifier(), 'id' => $model->route(), 'filename' => $file->name()])) ?>"><?= $this->icon('trash') ?> <?= $this->translate('panel.pages.deleteFile') ?></a>
                 <?php endif ?>
             </div>
         </div>
     </div>
-</div>
+</div>
\ No newline at end of file
diff --git a/panel/views/partials/files/file/list.php b/panel/views/partials/files/file/list.php
index ba51254da..fded2543a 100644
--- a/panel/views/partials/files/file/list.php
+++ b/panel/views/partials/files/file/list.php
@@ -55,17 +55,17 @@
                 <div class="dropdown-menu" id="">
                     <a class="dropdown-item" data-command="infoFile" href=""><?= $this->icon('info-circle') ?> <?= $this->translate('panel.files.info') ?></a>
                     <a class="dropdown-item" data-command="previewFile" href="" target=""><?= $this->icon('eye') ?> <?= $this->translate('panel.pages.previewFile') ?></a>
-                    <?php if ($panel->user()->permissions()->has('pages.renameFiles')) : ?>
+                    <?php if ($panel->user()->permissions()->has('panel.pages.renameFiles')) : ?>
                         <a class="dropdown-item" data-command="renameFile" data-modal="renameFileItemModal" data-action=""><?= $this->icon('pencil') ?> <?= $this->translate('panel.pages.renameFile') ?></a>
                     <?php endif ?>
-                    <?php if ($panel->user()->permissions()->has('pages.replaceFiles')) : ?>
+                    <?php if ($panel->user()->permissions()->has('panel.pages.replaceFiles')) : ?>
                         <a class="dropdown-item" data-command="replaceFile" data-action="" data-mimetype=""><?= $this->icon('cloud-upload') ?> <?= $this->translate('panel.pages.replaceFile') ?></a>
                     <?php endif ?>
-                    <?php if ($panel->user()->permissions()->has('pages.deleteFiles')) : ?>
+                    <?php if ($panel->user()->permissions()->has('panel.pages.deleteFiles')) : ?>
                         <a class="dropdown-item" data-command="deleteFile" data-modal="deleteFileItemModal" data-action=""><?= $this->icon('trash') ?> <?= $this->translate('panel.pages.deleteFile') ?></a>
                     <?php endif ?>
                 </div>
             </div>
         </div>
     </div>
-</template>
+</template>
\ No newline at end of file
diff --git a/panel/views/partials/sidebar.php b/panel/views/partials/sidebar.php
index 76838f7a7..acc12a2e1 100644
--- a/panel/views/partials/sidebar.php
+++ b/panel/views/partials/sidebar.php
@@ -16,7 +16,7 @@
         <div class="caption mb-8"><?= $this->translate('panel.manage') ?></div>
         <ul class="sidebar-navigation">
             <?php foreach ($panel->navigation() as $item) : ?>
-                <?php if ($panel->user()->permissions()->has($item->permissions())) : ?>
+                <?php if ($item->permissions() === null || $panel->user()->permissions()->has($item->permissions())) : ?>
                     <li class="<?= $this->classes(['active' => $location === $item->id()]) ?>">
                         <a href="<?= $panel->uri($item->uri()) ?>"><?= $this->escape($item->label()) ?></a>
                         <?php if ($item->badge()) : ?>
@@ -27,4 +27,4 @@
             <?php endforeach ?>
         </ul>
     </nav>
-</div>
+</div>
\ No newline at end of file
diff --git a/panel/views/tools/tabs.php b/panel/views/tools/tabs.php
index 8602512c3..6fd8ca56c 100644
--- a/panel/views/tools/tabs.php
+++ b/panel/views/tools/tabs.php
@@ -1,7 +1,7 @@
 <div class="tabs">
     <?php foreach ($tabs as $tab) : ?>
-        <?php if ($panel->user()->permissions()->has('tools.' . $tab)) : ?>
+        <?php if ($panel->user()->permissions()->has('panel.tools.' . $tab)) : ?>
             <a class="<?= $this->classes(['tabs-tab', 'active' => $tab === $current]) ?>" href="<?= $panel->uri('/tools/' . $tab . '/') ?>"><?= $this->translate('panel.tools.' . $tab) ?></a>
         <?php endif ?>
     <?php endforeach ?>
-</div>
+</div>
\ No newline at end of file
diff --git a/panel/views/users/index.php b/panel/views/users/index.php
index 665b0d13b..59a75f84a 100644
--- a/panel/views/users/index.php
+++ b/panel/views/users/index.php
@@ -5,7 +5,7 @@
 <div class="header">
     <div class="header-title"><?= $this->translate('panel.users.users') ?> <span class="badge"><?= $users->count() ?></span></div>
     <div>
-        <button type="button" class="button button-accent" data-modal="newUserModal" <?php if (!$panel->user()->permissions()->has('users.create')) : ?> disabled<?php endif ?>><?= $this->icon('plus-circle') ?> <?= $this->translate('panel.users.newUser') ?></button>
+        <button type="button" class="button button-accent" data-modal="newUserModal" <?php if (!$panel->user()->permissions()->has('panel.users.create')) : ?> disabled<?php endif ?>><?= $this->icon('plus-circle') ?> <?= $this->translate('panel.users.newUser') ?></button>
     </div>
 </div>
 
@@ -33,4 +33,4 @@
             </div>
         <?php endforeach ?>
     </div>
-</section>
+</section>
\ No newline at end of file
diff --git a/site/users/roles/admin.yaml b/site/users/roles/admin.yaml
index 2245cd60e..f0ab0023b 100644
--- a/site/users/roles/admin.yaml
+++ b/site/users/roles/admin.yaml
@@ -1,13 +1,4 @@
 title: '{{user.role.admin}}'
 
 permissions:
-    dashboard: true
-    cache: true
-    backup: true
-    pages: true
-    files: true
-    options: true
-    updates: true
-    users: true
-    statistics: true
-    tools: true
+    panel: true
diff --git a/site/users/roles/user.yaml b/site/users/roles/user.yaml
index 518332f2d..0a0b0a4d2 100644
--- a/site/users/roles/user.yaml
+++ b/site/users/roles/user.yaml
@@ -1,6 +1,6 @@
 title: '{{user.role.user}}'
 
 permissions:
-    dashboard: true
-    pages: true
-    files: true
+    panel.dashboard: true
+    panel.pages: true
+    panel.files: true

From 4c0122151d6cb7e492d8d98852e71578e40208d4 Mon Sep 17 00:00:00 2001
From: Giuseppe Criscione <18699708+giuscris@users.noreply.github.com>
Date: Sat, 12 Jul 2025 17:40:41 +0200
Subject: [PATCH 02/10] Remove the possibility for administators to change the
 password of other users

---
 formwork/src/Panel/Controllers/UsersController.php | 6 ++++--
 formwork/src/Users/User.php                        | 3 ---
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/formwork/src/Panel/Controllers/UsersController.php b/formwork/src/Panel/Controllers/UsersController.php
index 5d5a51882..af9f01462 100644
--- a/formwork/src/Panel/Controllers/UsersController.php
+++ b/formwork/src/Panel/Controllers/UsersController.php
@@ -177,8 +177,10 @@ public function profile(RouteParams $routeParams): Response
 
         $fields->setModel($user);
 
-        // Disable password and/or role fields if they cannot be changed
-        $fields->get('password')->set('disabled', !$this->panel->user()->canChangePasswordOf($user));
+        // Hide password field if the user cannot change it
+        $fields->get('password')->set('visible', $this->panel->user()->canChangePasswordOf($user));
+
+        // Disable role field if it cannot be changed
         $fields->get('role')->set('disabled', !$this->panel->user()->canChangeRoleOf($user));
 
         if ($this->request->method() === RequestMethod::POST) {
diff --git a/formwork/src/Users/User.php b/formwork/src/Users/User.php
index 336b8f2a0..955794670 100644
--- a/formwork/src/Users/User.php
+++ b/formwork/src/Users/User.php
@@ -201,9 +201,6 @@ public function canChangeOptionsOf(User $user): bool
      */
     public function canChangePasswordOf(User $user): bool
     {
-        if ($this->isAdmin()) {
-            return true;
-        }
         return $user->isLoggedIn();
     }
 

From 7c5f58ee03132dc086352c923ae16418bf26c584 Mon Sep 17 00:00:00 2001
From: Giuseppe Criscione <18699708+giuscris@users.noreply.github.com>
Date: Sat, 12 Jul 2025 17:45:58 +0200
Subject: [PATCH 03/10] Remove default permissions

---
 formwork/src/Users/Permissions.php | 20 +-------------------
 1 file changed, 1 insertion(+), 19 deletions(-)

diff --git a/formwork/src/Users/Permissions.php b/formwork/src/Users/Permissions.php
index 2033aa92e..0b98d204d 100644
--- a/formwork/src/Users/Permissions.php
+++ b/formwork/src/Users/Permissions.php
@@ -6,28 +6,10 @@
 
 class Permissions
 {
-    /**
-     * The permission values
-     *
-     * @var array<string, bool>
-     */
-    protected array $permissions = [
-        'dashboard' => false,
-        'cache'     => false,
-        'backup'    => false,
-        'pages'     => false,
-        'options'   => false,
-        'updates'   => false,
-        'users'     => false,
-    ];
-
     /**
      * @param array<string, bool> $permissions
      */
-    public function __construct(array $permissions)
-    {
-        $this->permissions = [...$this->permissions, ...$permissions];
-    }
+    public function __construct(protected array $permissions) {}
 
     /**
      * Return whether a permission is granted

From 7614cf23c283d795cde6b9dbb82dd7f19d429b50 Mon Sep 17 00:00:00 2001
From: Giuseppe Criscione <18699708+giuscris@users.noreply.github.com>
Date: Sat, 12 Jul 2025 17:56:27 +0200
Subject: [PATCH 04/10] Remove disabled state from user scheme

---
 site/schemes/users/user.yaml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/site/schemes/users/user.yaml b/site/schemes/users/user.yaml
index 5e5dc9b2f..60f2498eb 100644
--- a/site/schemes/users/user.yaml
+++ b/site/schemes/users/user.yaml
@@ -22,7 +22,6 @@ fields:
         type: password
         label: '{{user.password}}'
         placeholder: '{{user.password.placeholder}}'
-        disabled: true
         minLength: 8
         autocomplete: new-password
 
@@ -37,7 +36,6 @@ fields:
     role:
         type: select
         label: '{{user.role}}'
-        disabled: true
         options@: site.users.availableRoles
 
     colorScheme:

From d19aeb7e68d74a439f22e873b1e11173c9547254 Mon Sep 17 00:00:00 2001
From: Giuseppe Criscione <18699708+giuscris@users.noreply.github.com>
Date: Sat, 12 Jul 2025 18:07:56 +0200
Subject: [PATCH 05/10] Remove link to site options from panel header if
 permissions are missing

---
 panel/views/layouts/panel.php | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/panel/views/layouts/panel.php b/panel/views/layouts/panel.php
index dd94d3b84..ca3e4b828 100644
--- a/panel/views/layouts/panel.php
+++ b/panel/views/layouts/panel.php
@@ -21,7 +21,11 @@
     <header class="panel-header">
         <span class="show-from-sm text-color-gray-dark"><?= $this->translate('panel.panel') ?></span>
         <span class="show-from-sm ml-5 mr-2 text-color-gray-medium">/</span>
-        <span class="flex-grow-1"><a class="button button-link text-size-md" href="<?= $panel->uri('/options/site/') ?>"><?= $this->icon('globe') ?> <span class="ml-2"><?= $this->escape($site->title()) ?></span></a></span>
+        <?php if ($panel->user()->permissions()->has('panel.options.site')) : ?>
+            <span class="flex-grow-1"><a class="button button-link text-size-md" href="<?= $panel->uri('/options/site/') ?>"><?= $this->icon('globe') ?> <span class="ml-2"><?= $this->escape($site->title()) ?></span></a></span>
+        <?php else : ?>
+            <span class="flex-grow-1"><span class="pl-4"><?= $this->icon('globe') ?> <span class="ml-2"><?= $this->escape($site->title()) ?></span></span></span>
+        <?php endif ?>
         <a href="<?= $site->uri() ?>" class="button button-link text-size-md" target="formwork-view-site"><span class="show-from-xs"><?= $this->translate('panel.viewSite') ?></span> <?= $this->icon('arrow-right-up-box') ?></a>
     </header>
     <main class="panel-main">
@@ -36,4 +40,4 @@
     <?php $this->insert('partials.scripts') ?>
 </body>
 
-</html>
\ No newline at end of file
+</html>

From 0d35ffacf794f87947e8000be70789ab252951eb Mon Sep 17 00:00:00 2001
From: Giuseppe Criscione <18699708+giuscris@users.noreply.github.com>
Date: Sat, 12 Jul 2025 18:08:43 +0200
Subject: [PATCH 06/10] Add missing permissions checks

---
 formwork/src/Panel/Controllers/PagesController.php | 6 +++++-
 formwork/src/Panel/Controllers/UsersController.php | 4 ++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/formwork/src/Panel/Controllers/PagesController.php b/formwork/src/Panel/Controllers/PagesController.php
index d58d0a85a..c66d0c8dd 100644
--- a/formwork/src/Panel/Controllers/PagesController.php
+++ b/formwork/src/Panel/Controllers/PagesController.php
@@ -209,6 +209,10 @@ public function edit(RouteParams $routeParams): Response
      */
     public function preview(RouteParams $routeParams): Response
     {
+        if (!$this->hasPermission('panel.pages.preview')) {
+            return $this->forward(ErrorsController::class, 'forbidden');
+        }
+
         $page = $this->site->findPage($routeParams->get('page'));
 
         if ($page === null) {
@@ -390,7 +394,7 @@ public function upload(RouteParams $routeParams): Response|JsonResponse
                 'replace' => $this->router->generate('panel.files.replace', ['model' => $page->getModelIdentifier(), 'id' => $page->route(), 'filename' => $file->name()]),
                 'delete'  => $this->router->generate('panel.files.delete', ['model' => $page->getModelIdentifier(), 'id' => $page->route(), 'filename' => $file->name()]),
             ], fn(string $route): string => Uri::make([], Path::join([$this->request->root(), $route]))),
-        ]), );
+        ]),);
     }
 
     /**
diff --git a/formwork/src/Panel/Controllers/UsersController.php b/formwork/src/Panel/Controllers/UsersController.php
index af9f01462..491a7e206 100644
--- a/formwork/src/Panel/Controllers/UsersController.php
+++ b/formwork/src/Panel/Controllers/UsersController.php
@@ -164,6 +164,10 @@ public function deleteImage(RouteParams $routeParams): Response
      */
     public function profile(RouteParams $routeParams): Response
     {
+        if (!$this->hasPermission('panel.users.profile')) {
+            return $this->forward(ErrorsController::class, 'forbidden');
+        }
+
         $scheme = $this->app->schemes()->get('users.user');
 
         $fields = $scheme->fields();

From 0203cb0396a1828934b60b0df871c30dff43f385 Mon Sep 17 00:00:00 2001
From: Giuseppe Criscione <18699708+giuscris@users.noreply.github.com>
Date: Sat, 12 Jul 2025 18:12:47 +0200
Subject: [PATCH 07/10] Remove permissions from `user` role (to allow future
 use for frontend users)

---
 formwork/src/Services/Loaders/UsersServiceLoader.php | 4 ++--
 site/users/roles/user.yaml                           | 5 -----
 2 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/formwork/src/Services/Loaders/UsersServiceLoader.php b/formwork/src/Services/Loaders/UsersServiceLoader.php
index d59f9058f..de1bebdef 100644
--- a/formwork/src/Services/Loaders/UsersServiceLoader.php
+++ b/formwork/src/Services/Loaders/UsersServiceLoader.php
@@ -38,11 +38,11 @@ private function loadRoles(): void
         $this->roleCollection = new RoleCollection();
         foreach (FileSystem::listFiles($path = $this->config->get('system.users.paths.roles')) as $file) {
             /**
-             * @var array{title: string, permissions: array<string, bool>}
+             * @var array{title: string, permissions?: array<string, bool>}
              */
             $data = Yaml::parseFile(FileSystem::joinPaths($path, $file));
             $id = FileSystem::name($file);
-            $permissions = new Permissions($data['permissions']);
+            $permissions = new Permissions($data['permissions'] ?? []);
             $this->roleCollection->set($id, new Role($id, $data['title'], $permissions, $this->translations));
         }
     }
diff --git a/site/users/roles/user.yaml b/site/users/roles/user.yaml
index 0a0b0a4d2..0b3b54d97 100644
--- a/site/users/roles/user.yaml
+++ b/site/users/roles/user.yaml
@@ -1,6 +1 @@
 title: '{{user.role.user}}'
-
-permissions:
-    panel.dashboard: true
-    panel.pages: true
-    panel.files: true

From a7fc563692143ac362d2f04d6023bd334248b84e Mon Sep 17 00:00:00 2001
From: Giuseppe Criscione <18699708+giuscris@users.noreply.github.com>
Date: Sat, 12 Jul 2025 18:13:00 +0200
Subject: [PATCH 08/10] Add `editor` role

---
 formwork/translations/de.yaml | 1 +
 formwork/translations/en.yaml | 1 +
 formwork/translations/es.yaml | 1 +
 formwork/translations/fr.yaml | 1 +
 formwork/translations/it.yaml | 1 +
 formwork/translations/pl.yaml | 1 +
 formwork/translations/pt.yaml | 1 +
 formwork/translations/ru.yaml | 1 +
 formwork/translations/uk.yaml | 1 +
 site/users/roles/editor.yaml  | 8 ++++++++
 10 files changed, 17 insertions(+)
 create mode 100644 site/users/roles/editor.yaml

diff --git a/formwork/translations/de.yaml b/formwork/translations/de.yaml
index 3112249a1..757c52a04 100644
--- a/formwork/translations/de.yaml
+++ b/formwork/translations/de.yaml
@@ -115,6 +115,7 @@ user.password: Passwort
 user.password.placeholder: Geben Sie ein neues Passwort ein, um es zu ändern...
 user.role: Rolle
 user.role.admin: Administrator
+user.role.editor: Redakteur
 user.role.user: Benutzer
 user.user: Benutzer
 user.username: Benutzername
diff --git a/formwork/translations/en.yaml b/formwork/translations/en.yaml
index 5c2c013b9..bd9afea3a 100644
--- a/formwork/translations/en.yaml
+++ b/formwork/translations/en.yaml
@@ -115,6 +115,7 @@ user.password: Password
 user.password.placeholder: Type a new password to change...
 user.role: Role
 user.role.admin: Administrator
+user.role.editor: Editor
 user.role.user: User
 user.user: User
 user.username: Username
diff --git a/formwork/translations/es.yaml b/formwork/translations/es.yaml
index 6e051b06f..8e8a27d22 100644
--- a/formwork/translations/es.yaml
+++ b/formwork/translations/es.yaml
@@ -115,6 +115,7 @@ user.password: Contraseña
 user.password.placeholder: Escribe una nueva contraseña para cambiar...
 user.role: Rol
 user.role.admin: Administrador
+user.role.editor: Editor
 user.role.user: Usuario
 user.user: Usuario
 user.username: Nombre de usuario
diff --git a/formwork/translations/fr.yaml b/formwork/translations/fr.yaml
index 2ae2cb5ca..c2296adb9 100644
--- a/formwork/translations/fr.yaml
+++ b/formwork/translations/fr.yaml
@@ -115,6 +115,7 @@ user.password: Mot de passe
 user.password.placeholder: Tapez un nouveau mot de passe pour le modifier...
 user.role: Rôle
 user.role.admin: Administrateur
+user.role.editor: Éditeur
 user.role.user: Éditeur
 user.user: Utilisateur
 user.username: Nom d’utilisateur
diff --git a/formwork/translations/it.yaml b/formwork/translations/it.yaml
index f19bbfd66..da9c68c32 100644
--- a/formwork/translations/it.yaml
+++ b/formwork/translations/it.yaml
@@ -115,6 +115,7 @@ user.password: Password
 user.password.placeholder: Inserisci una nuova password per cambiarla...
 user.role: Ruolo
 user.role.admin: Amministratore
+user.role.editor: Editor
 user.role.user: Utente
 user.user: Utente
 user.username: Nome utente
diff --git a/formwork/translations/pl.yaml b/formwork/translations/pl.yaml
index c0620b004..f4193f6f5 100644
--- a/formwork/translations/pl.yaml
+++ b/formwork/translations/pl.yaml
@@ -115,6 +115,7 @@ user.password: Hasło
 user.password.placeholder: Wpisz nowe hasło, aby je zmienić...
 user.role: Rola
 user.role.admin: Administrator
+user.role.editor: Edytor
 user.role.user: Użytkownik
 user.user: Użytkownik
 user.username: Nazwa użytkownika
diff --git a/formwork/translations/pt.yaml b/formwork/translations/pt.yaml
index 2b528a0b6..f528b064c 100644
--- a/formwork/translations/pt.yaml
+++ b/formwork/translations/pt.yaml
@@ -115,6 +115,7 @@ user.password: Password
 user.password.placeholder: Insira nova password para alterar...
 user.role: Cargo
 user.role.admin: Administrador
+user.role.editor: Editor
 user.role.user: Utilizador
 user.user: Utilizador
 user.username: Nome do utilizador
diff --git a/formwork/translations/ru.yaml b/formwork/translations/ru.yaml
index 7571727a5..274751406 100644
--- a/formwork/translations/ru.yaml
+++ b/formwork/translations/ru.yaml
@@ -115,6 +115,7 @@ user.password: Пароль
 user.password.placeholder: Введите новый пароль для изменения ...
 user.role: Роль
 user.role.admin: Администратор
+user.role.editor: Редактор
 user.role.user: Пользователь
 user.user: Пользователь
 user.username: Имя пользователя
diff --git a/formwork/translations/uk.yaml b/formwork/translations/uk.yaml
index 58df69fb4..8c1c00113 100644
--- a/formwork/translations/uk.yaml
+++ b/formwork/translations/uk.yaml
@@ -115,6 +115,7 @@ user.password: Пароль
 user.password.placeholder: Введіть новий пароль для зміни...
 user.role: Роль
 user.role.admin: Адміністратор
+user.role.editor: Редактор
 user.role.user: Користувач
 user.user: Користувач
 user.username: Ім'я користувача
diff --git a/site/users/roles/editor.yaml b/site/users/roles/editor.yaml
new file mode 100644
index 000000000..10c21f7ce
--- /dev/null
+++ b/site/users/roles/editor.yaml
@@ -0,0 +1,8 @@
+title: '{{user.role.editor}}'
+
+permissions:
+    panel.dashboard: true
+    panel.files: true
+    panel.pages: true
+    panel.statistics: true
+    panel.users: true

From 34d68b9e9a16825cb619037eef135644a8907c8c Mon Sep 17 00:00:00 2001
From: Giuseppe Criscione <18699708+giuscris@users.noreply.github.com>
Date: Sat, 12 Jul 2025 18:26:38 +0200
Subject: [PATCH 09/10] Update formwork/translations/fr.yaml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 formwork/translations/fr.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/formwork/translations/fr.yaml b/formwork/translations/fr.yaml
index c2296adb9..3071cc25d 100644
--- a/formwork/translations/fr.yaml
+++ b/formwork/translations/fr.yaml
@@ -116,7 +116,7 @@ user.password.placeholder: Tapez un nouveau mot de passe pour le modifier...
 user.role: Rôle
 user.role.admin: Administrateur
 user.role.editor: Éditeur
-user.role.user: Éditeur
+user.role.user: Utilisateur
 user.user: Utilisateur
 user.username: Nom d’utilisateur
 zip.error.alreadyExists: L’archive existe déjà

From a414d7887d9b2d1c6217d579c63a30b376fdbd5f Mon Sep 17 00:00:00 2001
From: Giuseppe Criscione <18699708+giuscris@users.noreply.github.com>
Date: Sat, 12 Jul 2025 18:27:33 +0200
Subject: [PATCH 10/10] Fix spacing

---
 formwork/src/Panel/Controllers/PagesController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/formwork/src/Panel/Controllers/PagesController.php b/formwork/src/Panel/Controllers/PagesController.php
index c66d0c8dd..751c3a37b 100644
--- a/formwork/src/Panel/Controllers/PagesController.php
+++ b/formwork/src/Panel/Controllers/PagesController.php
@@ -394,7 +394,7 @@ public function upload(RouteParams $routeParams): Response|JsonResponse
                 'replace' => $this->router->generate('panel.files.replace', ['model' => $page->getModelIdentifier(), 'id' => $page->route(), 'filename' => $file->name()]),
                 'delete'  => $this->router->generate('panel.files.delete', ['model' => $page->getModelIdentifier(), 'id' => $page->route(), 'filename' => $file->name()]),
             ], fn(string $route): string => Uri::make([], Path::join([$this->request->root(), $route]))),
-        ]),);
+        ]), );
     }
 
     /**