// GET /cms/admin/posts — list posts for the dashboard (author+).
// Admin sees all; an author sees only their own.
import "auth" as auth;
import "util" as util;
let g = auth::guard(ctx, ["admin", "author"]);
if !g.ok { return g.response; }
let user = g.user;

let posts = docs::collection("posts");
let is_admin = users::has_role(user.id, "admin");
let filter = #{ "$sort": #{ updated_at: -1 }, "$limit": 100 };
if !is_admin { filter.author_id = user.id; }

let rows = posts.find(filter);
let out = [];
for r in rows {
    let p = util::shape_doc(r);
    p.remove("body_md");
    out.push(p);
}
#{ statusCode: 200, body: #{ posts: out } }