fix: restrict public content API access by status and role

docs/api-reference.md

@@ -332,10 +332,13 @@ Retrieve all content items with pagination.
 
 **Authentication:** None required
 
+Anonymous, viewer, and author requests return published content only. Admin and editor requests may filter by other statuses.
+
 **Cache Headers:** Cached for 5 minutes (API cache tier)
 
 **Query Parameters:**
 - `limit` (optional): Maximum number of items to return (default: 50, max: 100)
+- `status` (optional): Content status filter for admin/editor requests. Anonymous, viewer, and author requests are limited to published results.
 
 ```bash
 curl -X GET "http://localhost:8787/api/content?limit=10"
@@ -397,13 +400,16 @@ Retrieve content for a specific collection.
 
 **Authentication:** None required
 
+Anonymous, viewer, and author requests return published content only. Admin and editor requests may filter by other statuses.
+
 **Cache Headers:** Cached for 5 minutes (API cache tier)
 
 **Path Parameters:**
 - `collection` (required): Collection name (e.g., "blog-posts")
 
 **Query Parameters:**
 - `limit` (optional): Maximum number of items to return (default: 50, max: 100)
+- `status` (optional): Content status filter for admin/editor requests. Anonymous, viewer, and author requests are limited to published results.
 
 ```bash
 curl -X GET "http://localhost:8787/api/collections/blog-posts/content?limit=25"

packages/core/dist/chunk-DMZI7OU3.cjs → packages/core/dist/chunk-5HMR2SJW.cjs

@@ -421,7 +421,7 @@ function buildQuery(table, filter) {
 // package.json
 var package_default = {
   name: "@sonicjs-cms/core",
-  version: "2.7.0",
+  version: "2.8.0",
   description: "Core framework for SonicJS headless CMS - Edge-first, TypeScript-native CMS built for Cloudflare Workers",
   type: "module",
   main: "./dist/index.cjs",
@@ -617,5 +617,5 @@ exports.renderTemplate = renderTemplate;
 exports.sanitizeInput = sanitizeInput;
 exports.sanitizeObject = sanitizeObject;
 exports.templateRenderer = templateRenderer;
-//# sourceMappingURL=chunk-DMZI7OU3.cjs.map
-//# sourceMappingURL=chunk-DMZI7OU3.cjs.map
+//# sourceMappingURL=chunk-5HMR2SJW.cjs.map
+//# sourceMappingURL=chunk-5HMR2SJW.cjs.map

packages/core/dist/chunk-6RABGLOO.cjs → packages/core/dist/chunk-BFYSKTYG.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
 var chunkMPT5PA6U_cjs = require('./chunk-MPT5PA6U.cjs');
-var chunk2YRNPIU4_cjs = require('./chunk-2YRNPIU4.cjs');
+var chunkJT364ZTS_cjs = require('./chunk-JT364ZTS.cjs');
 var chunkRCQ2HIQD_cjs = require('./chunk-RCQ2HIQD.cjs');
 var jwt = require('hono/jwt');
 var cookie = require('hono/cookie');
@@ -20,7 +20,7 @@ function bootstrapMiddleware(config = {}) {
     try {
       console.log("[Bootstrap] Starting system initialization...");
       console.log("[Bootstrap] Running database migrations...");
-      const migrationService = new chunk2YRNPIU4_cjs.MigrationService(c.env.DB);
+      const migrationService = new chunkJT364ZTS_cjs.MigrationService(c.env.DB);
       await migrationService.runPendingMigrations();
       console.log("[Bootstrap] Syncing collection configurations...");
       try {
@@ -239,5 +239,5 @@ exports.requirePermission = requirePermission;
 exports.requireRole = requireRole;
 exports.securityHeaders = securityHeaders;
 exports.securityLoggingMiddleware = securityLoggingMiddleware;
-//# sourceMappingURL=chunk-6RABGLOO.cjs.map
-//# sourceMappingURL=chunk-6RABGLOO.cjs.map
+//# sourceMappingURL=chunk-BFYSKTYG.cjs.map
+//# sourceMappingURL=chunk-BFYSKTYG.cjs.map