@10x-media/dual-session 0.1.0-beta.0

package/CHANGELOG.md

@@ -0,0 +1,27 @@
+# @10x-media/dual-session
+
+## 0.1.0-beta.0
+
+### Minor Changes
+
+- Initial beta of `@10x-media/dual-session`: give each Payload auth collection its own session cookie, so an admin session and a frontend session can live in one browser at once.
+
+  Payload signs every collection's token into a single config-wide `${cookiePrefix}-token`, so a customer logging in on the website overwrites the editor's admin session, and logging into the admin panel logs them out of the website. This plugin moves the collections you name onto cookies of their own.
+
+  - **Shadowed endpoints**: the six auth routes that write a cookie (`/login`, `/logout`, `/refresh-token`, `/me`, `/reset-password`, `/first-register`) are replaced by handlers that delegate to the same core operations, so hooks, lockout, sessions and verification are unchanged and only the cookie name differs. Endpoints that never touch a cookie are left alone.
+  - **A strategy that mirrors core's**: same CSRF gate, same `verify` check, same session `sid` check, reading the isolated cookie instead of the shared one. It stands down for an `Authorization` header, so `jwtOrder` and API keys keep the precedence core gives them.
+  - **Auth scopes**: an optional Next proxy (`@10x-media/dual-session/proxy`) stamps each request with the session it may authenticate against, resolved from the admin route and the `Referer`/`Sec-Fetch-Site` pair, so the admin panel and the website get different answers from the same REST URL. Without it, `adminSessionPriority` keeps the admin panel reachable.
+  - **Ranked sessions**: list order decides which isolated collection wins when a visitor holds several at once, independently of config order.
+  - **Per-collection cookie names**, and `disabled` for opting out per environment.
+  - **Custom auth**: declared strategies keep first refusal, and `generateIsolatedAuthCookie` is the one-line replacement for `generatePayloadCookie` in an OAuth callback or server action. `resolveIsolatedCookieName` answers with the name alone.
+  - **The admin panel is untouched**: the collection behind `admin.user` keeps the shared cookie, written byte for byte as core writes it.
+
+  Requires Payload `^3.83.0`. Next is optional and only needed for the proxy.
+
+- Support one auth collection with roles backing both sessions, via an `isolate` predicate.
+
+  A collection entry now accepts `isolate: (user) => boolean`, which decides per user rather than per collection which cookie a session lands in. Users it returns `false` for keep the shared `${cookiePrefix}-token`, so projects with a single `users` collection gated by `access.admin` can hold an editor's admin session and a website visitor's session in one browser. This is also the only way to list the collection named by `admin.user`: listing it without a predicate still throws, and giving that entry the `admin` scope now throws too, because an isolated cookie answering admin-scoped requests would outrank the admin's own session.
+
+  The shared cookie the plugin writes for a non-isolated user is the same string `generatePayloadCookie` produces, so the admin half is core behaviour untouched. All six shadowed endpoints resolve the cookie from the user in front of them, except `first-register`, which always writes the shared cookie because the first user has no roles yet to classify. In development, a login routed to the isolated cookie for a user who would pass `access.admin` logs a warning, so a predicate that disagrees with the admin gate is not silent.
+
+  `generateIsolatedAuthCookie` and `resolveIsolatedCookieName` take an optional `user`, required for a collection configured with `isolate`. They throw rather than guess which cookie to write.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 10x Media GmbH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,83 @@
+![Banner](./assets/banner.jpg)
+
+# @10x-media/dual-session
+
+Give each Payload auth collection its own session cookie, so an admin session and a frontend session can coexist. Payload signs every collection's token into one config-wide `payload-token`, which means a customer logging in on your website overwrites the editor's admin session in the same browser, and back again. This plugin moves the collections you name onto cookies of their own.
+
+[![npm](https://img.shields.io/npm/v/@10x-media/dual-session?style=flat-square)](https://www.npmjs.com/package/@10x-media/dual-session)
+
+Part of the [@10x-media Payload plugins](https://github.com/10x-media/payload-plugins) collection. In beta: published under the `beta` dist-tag until a stable 1.0.
+
+> [!WARNING]
+> **Experimental.** This plugin changes how sessions are established, which is not a place where a subtle bug announces itself. It is covered by unit, integration and end-to-end tests against Payload's real routing on both Mongo and Postgres, but auth surfaces differ a lot between projects and yours may take a path none of those cover. Try it in staging first, and [report anything that looks off](https://github.com/10x-media/payload-plugins/issues).
+
+## Features
+
+- **One cookie per collection**: `payload-customers-token` alongside `payload-token`, so both sessions are live at once.
+- **Core operations, not reimplementations**: the six cookie-writing auth endpoints are shadowed by replacements that delegate to the same Payload operations, so hooks, lockout, sessions and verification are unchanged.
+- **A strategy that mirrors Payload's own**: same CSRF gate, same `verify` check, same session `sid` check. It just reads a different cookie.
+- **Request attribution via an optional Next proxy**, so the admin panel and the website get different answers from the same REST URL.
+- **Ranked frontend sessions**: list order decides which one wins when a visitor holds several.
+- **Works with your own SSO**: declared strategies keep first refusal, and `generateIsolatedAuthCookie` is the one-line swap for `generatePayloadCookie` in a custom OAuth callback.
+- **One collection with roles, too**: an `isolate` predicate splits a single `users` collection so editors keep the shared cookie and website visitors get their own.
+- **The admin panel is left alone**: the collection behind `admin.user` keeps the shared cookie, byte for byte as core writes it.
+
+## Before you install
+
+If another auth plugin is already in the config (OAuth, magic links, passkeys, SSO, 2FA), check it first. This plugin owns a collection's auth endpoints and decides where its cookie is written, so anything that writes the session cookie itself or declares its own `/login` on the same collection conflicts, silently. Plugins that only read `req.user` or add a strategy compose fine. [Other plugins that touch auth](https://docs.10xmedia.de/dual-session/limits#other-plugins-that-touch-auth) has the two-minute check and the ways out.
+
+## Quick start
+
+```bash
+pnpm add @10x-media/dual-session@beta
+```
+
+```ts
+// payload.config.ts
+import { buildConfig } from 'payload'
+import { dualSession } from '@10x-media/dual-session'
+
+export default buildConfig({
+  admin: { user: 'users' },
+  collections: [users, customers],
+  plugins: [dualSession({ collections: ['customers'] })],
+})
+```
+
+```ts
+// proxy.ts (middleware.ts on Next 15)
+import { createAuthScopeProxy } from '@10x-media/dual-session/proxy'
+
+export default createAuthScopeProxy()
+
+export const config = {
+  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+}
+```
+
+The matcher must cover `/api`; the widely copied default excludes it, which leaves every REST call unattributed.
+
+If editors and website visitors are one collection told apart by a `roles` field, split it by user instead of by collection:
+
+```ts
+dualSession({
+  collections: [{ slug: 'users', isolate: (user) => !checkRole(['admin', 'editor'], user) }],
+})
+```
+
+## Documentation
+
+Full documentation at [docs.10xmedia.de](https://docs.10xmedia.de/dual-session):
+
+- [Overview](https://docs.10xmedia.de/dual-session)
+- [Quick start](https://docs.10xmedia.de/dual-session/quick-start)
+- [One collection, two sessions](https://docs.10xmedia.de/dual-session/role-split)
+- [Scopes](https://docs.10xmedia.de/dual-session/scopes)
+- [Frontends and clients](https://docs.10xmedia.de/dual-session/clients)
+- [Custom auth](https://docs.10xmedia.de/dual-session/custom-auth)
+- [Configuration](https://docs.10xmedia.de/dual-session/configuration)
+- [Limits](https://docs.10xmedia.de/dual-session/limits)
+
+## License
+
+[MIT](./LICENSE). Copyright 10x Media GmbH.

package/dist/auth/authorization.js

@@ -0,0 +1,49 @@
+//#region src/auth/authorization.ts
+/** The `Authorization` prefixes `extractJWT` recognises, keyed by its `jwtOrder` entries. */
+const SCHEMES = {
+	Bearer: "Bearer ",
+	JWT: "JWT "
+};
+/**
+* The token an `Authorization` header carries, if Payload would read it ahead of a cookie.
+*
+* Mirrors `extractJWT` minus its cookie method: for an isolated collection the shared
+* `${cookiePrefix}-token` is never a valid source, so consulting core's extraction whole
+* would answer with another session's token. Schemes listed after `cookie` in `jwtOrder`
+* do not outrank it and are ignored.
+*/
+const extractAuthorizationToken = ({ headers, payload }) => {
+	const header = headers.get("Authorization");
+	if (!header) return;
+	for (const method of payload.config.auth.jwtOrder) {
+		if (method === "cookie") return;
+		const prefix = SCHEMES[method];
+		if (prefix && header.startsWith(prefix)) return header.slice(prefix.length);
+	}
+};
+/**
+* True when `Authorization` carries credentials Payload would honour ahead of a cookie.
+*
+* Two unrelated credentials share that header. An **API key** (`<slug> API-Key <key>`) is
+* matched by its own strategy, which sits directly behind a collection's declared ones and
+* owes nothing to `jwtOrder`. A **JWT** is read by `extractJWT`, where `jwtOrder` ranks the
+* `JWT` and `Bearer` schemes against the cookie and defaults to putting them first.
+*
+* The isolated strategy runs ahead of both, so without this check moving a collection onto
+* its own cookie would quietly invert that precedence: a request holding both an isolated
+* cookie and an `Authorization` header would resolve to the cookie's user where core
+* resolves to the header's.
+*/
+const hasPrecedingAuthorization = ({ headers, payload, slug }) => {
+	const header = headers.get("Authorization");
+	if (!header) return false;
+	if (payload.collections[slug]?.config.auth.useAPIKey && header.startsWith(`${slug} API-Key `)) return true;
+	return extractAuthorizationToken({
+		headers,
+		payload
+	}) !== void 0;
+};
+//#endregion
+export { extractAuthorizationToken, hasPrecedingAuthorization };
+
+//# sourceMappingURL=authorization.js.map

package/dist/auth/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","names":[],"sources":["../../src/auth/authorization.ts"],"sourcesContent":["import type { CollectionSlug, Payload } from 'payload'\n\n/** The `Authorization` prefixes `extractJWT` recognises, keyed by its `jwtOrder` entries. */\nconst SCHEMES: Partial<Record<string, string>> = {\n\tBearer: 'Bearer ',\n\tJWT: 'JWT ',\n}\n\n/**\n * The token an `Authorization` header carries, if Payload would read it ahead of a cookie.\n *\n * Mirrors `extractJWT` minus its cookie method: for an isolated collection the shared\n * `${cookiePrefix}-token` is never a valid source, so consulting core's extraction whole\n * would answer with another session's token. Schemes listed after `cookie` in `jwtOrder`\n * do not outrank it and are ignored.\n */\nexport const extractAuthorizationToken = ({\n\theaders,\n\tpayload,\n}: {\n\theaders: Headers\n\tpayload: Payload\n}): string | undefined => {\n\tconst header = headers.get('Authorization')\n\n\tif (!header) {\n\t\treturn undefined\n\t}\n\n\tfor (const method of payload.config.auth.jwtOrder) {\n\t\tif (method === 'cookie') {\n\t\t\treturn undefined\n\t\t}\n\n\t\tconst prefix = SCHEMES[method]\n\n\t\tif (prefix && header.startsWith(prefix)) {\n\t\t\treturn header.slice(prefix.length)\n\t\t}\n\t}\n\n\treturn undefined\n}\n\n/**\n * True when `Authorization` carries credentials Payload would honour ahead of a cookie.\n *\n * Two unrelated credentials share that header. An **API key** (`<slug> API-Key <key>`) is\n * matched by its own strategy, which sits directly behind a collection's declared ones and\n * owes nothing to `jwtOrder`. A **JWT** is read by `extractJWT`, where `jwtOrder` ranks the\n * `JWT` and `Bearer` schemes against the cookie and defaults to putting them first.\n *\n * The isolated strategy runs ahead of both, so without this check moving a collection onto\n * its own cookie would quietly invert that precedence: a request holding both an isolated\n * cookie and an `Authorization` header would resolve to the cookie's user where core\n * resolves to the header's.\n */\nexport const hasPrecedingAuthorization = ({\n\theaders,\n\tpayload,\n\tslug,\n}: {\n\theaders: Headers\n\tpayload: Payload\n\tslug: CollectionSlug\n}): boolean => {\n\tconst header = headers.get('Authorization')\n\n\tif (!header) {\n\t\treturn false\n\t}\n\n\tif (payload.collections[slug]?.config.auth.useAPIKey && header.startsWith(`${slug} API-Key `)) {\n\t\treturn true\n\t}\n\n\treturn extractAuthorizationToken({ headers, payload }) !== undefined\n}\n"],"mappings":";;AAGA,MAAM,UAA2C;CAChD,QAAQ;CACR,KAAK;AACN;;;;;;;;;AAUA,MAAa,6BAA6B,EACzC,SACA,cAIyB;CACzB,MAAM,SAAS,QAAQ,IAAI,eAAe;CAE1C,IAAI,CAAC,QACJ;CAGD,KAAK,MAAM,UAAU,QAAQ,OAAO,KAAK,UAAU;EAClD,IAAI,WAAW,UACd;EAGD,MAAM,SAAS,QAAQ;EAEvB,IAAI,UAAU,OAAO,WAAW,MAAM,GACrC,OAAO,OAAO,MAAM,OAAO,MAAM;CAEnC;AAGD;;;;;;;;;;;;;;AAeA,MAAa,6BAA6B,EACzC,SACA,SACA,WAKc;CACd,MAAM,SAAS,QAAQ,IAAI,eAAe;CAE1C,IAAI,CAAC,QACJ,OAAO;CAGR,IAAI,QAAQ,YAAY,OAAO,OAAO,KAAK,aAAa,OAAO,WAAW,GAAG,KAAK,UAAU,GAC3F,OAAO;CAGR,OAAO,0BAA0B;EAAE;EAAS;CAAQ,CAAC,MAAM,KAAA;AAC5D"}

package/dist/auth/cookies.d.ts

@@ -0,0 +1,27 @@
+import { CollectionSlug, SanitizedCollectionConfig, TypedUser } from "payload";
+
+//#region src/auth/cookies.d.ts
+type AuthConfig = SanitizedCollectionConfig['auth'];
+declare const getIsolatedCookieName: ({
+  cookiePrefix,
+  slug
+}: {
+  cookiePrefix: string;
+  slug: CollectionSlug;
+}) => string;
+/**
+ * Same shape as Payload's `generatePayloadCookie`, but with a caller-provided cookie name
+ * instead of the config-wide `${cookiePrefix}-token`.
+ */
+declare const generateIsolatedCookie: ({
+  authConfig,
+  name,
+  token
+}: {
+  authConfig: AuthConfig;
+  name: string;
+  token: string;
+}) => string;
+//#endregion
+export { generateIsolatedCookie, getIsolatedCookieName };
+//# sourceMappingURL=cookies.d.ts.map

package/dist/auth/cookies.js

@@ -0,0 +1,53 @@
+import { generateCookie, getCookieExpiration } from "payload/shared";
+//#region src/auth/cookies.ts
+/** Mirrors Payload's own `sameSite` normalisation in `generatePayloadCookie`. */
+const resolveSameSite = (sameSite) => {
+	if (typeof sameSite === "string") return sameSite;
+	return sameSite ? "Strict" : void 0;
+};
+const getIsolatedCookieName = ({ cookiePrefix, slug }) => `${cookiePrefix}-${slug}-token`;
+/** Payload's config-wide auth cookie, the one every non-isolated session lives in. */
+const getSharedCookieName = (cookiePrefix) => `${cookiePrefix}-token`;
+/**
+* The cookie a given user's session belongs in, or `undefined` when there is no user to
+* ask about.
+*
+* This is the whole of the role-split model: the cookie is a function of the user, not of
+* the collection. Without an `isolate` predicate every session of the collection is
+* isolated, which is the two-collection case. With one, the users it rejects stay on the
+* shared cookie, and because `generateIsolatedCookie` under the shared name reproduces
+* `generatePayloadCookie` exactly, those sessions are indistinguishable from core's.
+*/
+const resolveSlotCookieName = ({ entry, sharedName, user }) => {
+	if (!user) return;
+	return entry.isolate && !entry.isolate(user) ? sharedName : entry.cookieName;
+};
+/**
+* Same shape as Payload's `generatePayloadCookie`, but with a caller-provided cookie name
+* instead of the config-wide `${cookiePrefix}-token`.
+*/
+const generateIsolatedCookie = ({ authConfig, name, token }) => generateCookie({
+	name,
+	domain: authConfig.cookies.domain ?? void 0,
+	expires: getCookieExpiration({ seconds: authConfig.tokenExpiration }),
+	httpOnly: true,
+	path: "/",
+	returnCookieAsObject: false,
+	sameSite: resolveSameSite(authConfig.cookies.sameSite),
+	secure: authConfig.cookies.secure,
+	value: token
+});
+const generateExpiredIsolatedCookie = ({ authConfig, name }) => generateCookie({
+	name,
+	domain: authConfig.cookies.domain ?? void 0,
+	expires: /* @__PURE__ */ new Date(Date.now() - 1e3),
+	httpOnly: true,
+	path: "/",
+	returnCookieAsObject: false,
+	sameSite: resolveSameSite(authConfig.cookies.sameSite),
+	secure: authConfig.cookies.secure
+});
+//#endregion
+export { generateExpiredIsolatedCookie, generateIsolatedCookie, getIsolatedCookieName, getSharedCookieName, resolveSlotCookieName };
+
+//# sourceMappingURL=cookies.js.map

package/dist/auth/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","names":[],"sources":["../../src/auth/cookies.ts"],"sourcesContent":["import type { CollectionSlug, SanitizedCollectionConfig, TypedUser } from 'payload'\nimport { generateCookie, getCookieExpiration } from 'payload/shared'\n\nimport type { ResolvedIsolatedCollection } from '../types'\n\ntype AuthConfig = SanitizedCollectionConfig['auth']\n\n/** Mirrors Payload's own `sameSite` normalisation in `generatePayloadCookie`. */\nconst resolveSameSite = (sameSite: AuthConfig['cookies']['sameSite']) => {\n\tif (typeof sameSite === 'string') {\n\t\treturn sameSite\n\t}\n\treturn sameSite ? ('Strict' as const) : undefined\n}\n\nexport const getIsolatedCookieName = ({\n\tcookiePrefix,\n\tslug,\n}: {\n\tcookiePrefix: string\n\tslug: CollectionSlug\n}) => `${cookiePrefix}-${slug}-token`\n\n/** Payload's config-wide auth cookie, the one every non-isolated session lives in. */\nexport const getSharedCookieName = (cookiePrefix: string) => `${cookiePrefix}-token`\n\n/**\n * The cookie a given user's session belongs in, or `undefined` when there is no user to\n * ask about.\n *\n * This is the whole of the role-split model: the cookie is a function of the user, not of\n * the collection. Without an `isolate` predicate every session of the collection is\n * isolated, which is the two-collection case. With one, the users it rejects stay on the\n * shared cookie, and because `generateIsolatedCookie` under the shared name reproduces\n * `generatePayloadCookie` exactly, those sessions are indistinguishable from core's.\n */\nexport const resolveSlotCookieName = ({\n\tentry,\n\tsharedName,\n\tuser,\n}: {\n\tentry: Pick<ResolvedIsolatedCollection, 'cookieName' | 'isolate'>\n\tsharedName: string\n\tuser: null | TypedUser | undefined\n}): string | undefined => {\n\tif (!user) {\n\t\treturn undefined\n\t}\n\n\treturn entry.isolate && !entry.isolate(user) ? sharedName : entry.cookieName\n}\n\n/**\n * Same shape as Payload's `generatePayloadCookie`, but with a caller-provided cookie name\n * instead of the config-wide `${cookiePrefix}-token`.\n */\nexport const generateIsolatedCookie = ({\n\tauthConfig,\n\tname,\n\ttoken,\n}: {\n\tauthConfig: AuthConfig\n\tname: string\n\ttoken: string\n}) =>\n\tgenerateCookie<false>({\n\t\tname,\n\t\tdomain: authConfig.cookies.domain ?? undefined,\n\t\texpires: getCookieExpiration({ seconds: authConfig.tokenExpiration }),\n\t\thttpOnly: true,\n\t\tpath: '/',\n\t\treturnCookieAsObject: false,\n\t\tsameSite: resolveSameSite(authConfig.cookies.sameSite),\n\t\tsecure: authConfig.cookies.secure,\n\t\tvalue: token,\n\t})\n\nexport const generateExpiredIsolatedCookie = ({\n\tauthConfig,\n\tname,\n}: {\n\tauthConfig: AuthConfig\n\tname: string\n}) =>\n\tgenerateCookie<false>({\n\t\tname,\n\t\tdomain: authConfig.cookies.domain ?? undefined,\n\t\texpires: new Date(Date.now() - 1000),\n\t\thttpOnly: true,\n\t\tpath: '/',\n\t\treturnCookieAsObject: false,\n\t\tsameSite: resolveSameSite(authConfig.cookies.sameSite),\n\t\tsecure: authConfig.cookies.secure,\n\t})\n"],"mappings":";;;AAQA,MAAM,mBAAmB,aAAgD;CACxE,IAAI,OAAO,aAAa,UACvB,OAAO;CAER,OAAO,WAAY,WAAqB,KAAA;AACzC;AAEA,MAAa,yBAAyB,EACrC,cACA,WAIK,GAAG,aAAa,GAAG,KAAK;;AAG9B,MAAa,uBAAuB,iBAAyB,GAAG,aAAa;;;;;;;;;;;AAY7E,MAAa,yBAAyB,EACrC,OACA,YACA,WAKyB;CACzB,IAAI,CAAC,MACJ;CAGD,OAAO,MAAM,WAAW,CAAC,MAAM,QAAQ,IAAI,IAAI,aAAa,MAAM;AACnE;;;;;AAMA,MAAa,0BAA0B,EACtC,YACA,MACA,YAMA,eAAsB;CACrB;CACA,QAAQ,WAAW,QAAQ,UAAU,KAAA;CACrC,SAAS,oBAAoB,EAAE,SAAS,WAAW,gBAAgB,CAAC;CACpE,UAAU;CACV,MAAM;CACN,sBAAsB;CACtB,UAAU,gBAAgB,WAAW,QAAQ,QAAQ;CACrD,QAAQ,WAAW,QAAQ;CAC3B,OAAO;AACR,CAAC;AAEF,MAAa,iCAAiC,EAC7C,YACA,WAKA,eAAsB;CACrB;CACA,QAAQ,WAAW,QAAQ,UAAU,KAAA;CACrC,yBAAS,IAAI,KAAK,KAAK,IAAI,IAAI,GAAI;CACnC,UAAU;CACV,MAAM;CACN,sBAAsB;CACtB,UAAU,gBAAgB,WAAW,QAAQ,QAAQ;CACrD,QAAQ,WAAW,QAAQ;AAC5B,CAAC"}

package/dist/auth/csrf.js

@@ -0,0 +1,18 @@
+//#region src/auth/csrf.ts
+/**
+* Port of the CSRF gate Payload applies to its own cookie token extraction
+* (`extractJWT`'s `cookie` method). Isolated cookies must be held to the same
+* standard, otherwise moving a collection off the shared cookie would quietly
+* weaken its CSRF protection.
+*/
+const isCookieAuthAllowed = ({ headers, payload }) => {
+	const origin = headers.get("Origin");
+	if (origin) return payload.config.csrf.length === 0 || payload.config.csrf.includes(origin);
+	if (payload.config.csrf.length === 0) return true;
+	const secFetchSite = headers.get("Sec-Fetch-Site");
+	return secFetchSite === "same-origin" || secFetchSite === "same-site" || secFetchSite === "none";
+};
+//#endregion
+export { isCookieAuthAllowed };
+
+//# sourceMappingURL=csrf.js.map

package/dist/auth/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","names":[],"sources":["../../src/auth/csrf.ts"],"sourcesContent":["import type { Payload } from 'payload'\n\n/**\n * Port of the CSRF gate Payload applies to its own cookie token extraction\n * (`extractJWT`'s `cookie` method). Isolated cookies must be held to the same\n * standard, otherwise moving a collection off the shared cookie would quietly\n * weaken its CSRF protection.\n */\nexport const isCookieAuthAllowed = ({\n\theaders,\n\tpayload,\n}: {\n\theaders: Headers\n\tpayload: Payload\n}): boolean => {\n\tconst origin = headers.get('Origin')\n\n\t// Origin present, validate against the csrf allowlist\n\tif (origin) {\n\t\treturn payload.config.csrf.length === 0 || payload.config.csrf.includes(origin)\n\t}\n\n\t// No Origin and no csrf configured, so there is no allowlist to enforce\n\tif (payload.config.csrf.length === 0) {\n\t\treturn true\n\t}\n\n\t// No Origin with csrf configured, fall back to Sec-Fetch-Site\n\tconst secFetchSite = headers.get('Sec-Fetch-Site')\n\n\t// Allow same-origin, same-site, and direct navigations (none)\n\treturn secFetchSite === 'same-origin' || secFetchSite === 'same-site' || secFetchSite === 'none'\n}\n"],"mappings":";;;;;;;AAQA,MAAa,uBAAuB,EACnC,SACA,cAIc;CACd,MAAM,SAAS,QAAQ,IAAI,QAAQ;CAGnC,IAAI,QACH,OAAO,QAAQ,OAAO,KAAK,WAAW,KAAK,QAAQ,OAAO,KAAK,SAAS,MAAM;CAI/E,IAAI,QAAQ,OAAO,KAAK,WAAW,GAClC,OAAO;CAIR,MAAM,eAAe,QAAQ,IAAI,gBAAgB;CAGjD,OAAO,iBAAiB,iBAAiB,iBAAiB,eAAe,iBAAiB;AAC3F"}

package/dist/auth/endpoints.js

@@ -0,0 +1,284 @@
+import { extractAuthorizationToken } from "./authorization.js";
+import { generateExpiredIsolatedCookie, generateIsolatedCookie, getSharedCookieName, resolveSlotCookieName } from "./cookies.js";
+import { warnIfAdminMisclassified } from "./misclassification.js";
+import { addDataAndFileToRequest, addLocalesToRequestFromData, headersWithCors, loginOperation, logoutOperation, meOperation, refreshOperation, registerFirstUserOperation, resetPasswordOperation, sanitizeJoinParams, sanitizePopulateParam, sanitizeSelectParam } from "payload";
+import { isNumber, parseCookies } from "payload/shared";
+//#region src/auth/endpoints.ts
+const getDepth = (req) => {
+	const depth = req.query.depth ?? req.searchParams.get("depth");
+	return isNumber(depth) ? Number(depth) : void 0;
+};
+/**
+* Payload wraps its own auth endpoints with `wrapInternalEndpoints`, which parses the
+* body onto `req.data`. Custom endpoints are not wrapped, so replacements have to do
+* it themselves.
+*/
+const prepareWrite = async (req) => {
+	await addDataAndFileToRequest(req);
+	addLocalesToRequestFromData(req);
+};
+const getString = (req, key) => typeof req.data?.[key] === "string" ? req.data[key] : "";
+/**
+* The core auth operations type the user they return loosely (`Record<string, unknown>` on
+* some paths, the collection's own doc on others), while `TypedUser` is the union across
+* every auth collection. It is the same object either way.
+*/
+const asUser = (user) => user;
+/**
+* Replacements for the built-in auth endpoints that read from and write to a
+* collection-scoped cookie. Each one delegates to the same core operation the built-in
+* handler uses, so behaviour (hooks, lockout, sessions, verification) is unchanged.
+* Only the cookie name differs.
+*
+* Payload appends its built-in endpoints *after* the ones declared on the collection,
+* and `handleEndpoints` matches the first entry that fits. Declaring these on the
+* collection therefore shadows the built-ins.
+*
+* Which cookie a handler touches is a question about the user, not about the collection,
+* so every handler that writes one asks {@link resolveSlotCookieName} first. With no
+* `isolate` predicate the answer is always the isolated cookie and these behave exactly as
+* before; with one, the users it rejects are written to the shared cookie in the same bytes
+* core would have written.
+*/
+const buildIsolatedAuthEndpoints = ({ entry }) => {
+	const { slug } = entry;
+	const getCollection = (req) => {
+		const collection = req.payload.collections[slug];
+		if (!collection) throw new Error(`dualSession: collection "${slug}" is not registered on payload.`);
+		return collection;
+	};
+	const slotFor = (req, user) => resolveSlotCookieName({
+		entry,
+		sharedName: getSharedCookieName(req.payload.config.cookiePrefix),
+		user
+	});
+	return [
+		{
+			method: "post",
+			path: "/login",
+			handler: async (req) => {
+				await prepareWrite(req);
+				const collection = getCollection(req);
+				const authConfig = collection.config.auth;
+				const result = await loginOperation({
+					collection,
+					data: authConfig.loginWithUsername !== false ? {
+						email: getString(req, "email"),
+						password: getString(req, "password"),
+						username: getString(req, "username")
+					} : {
+						email: getString(req, "email"),
+						password: getString(req, "password")
+					},
+					depth: getDepth(req),
+					req
+				});
+				const headers = headersWithCors({
+					headers: new Headers(),
+					req
+				});
+				const user = asUser(result.user);
+				const name = slotFor(req, user);
+				if (result.token && name) {
+					headers.set("Set-Cookie", generateIsolatedCookie({
+						authConfig,
+						name,
+						token: result.token
+					}));
+					await warnIfAdminMisclassified({
+						collection,
+						cookieName: name,
+						entry,
+						req,
+						user
+					});
+				}
+				if (authConfig.removeTokenFromResponses) delete result.token;
+				return Response.json({
+					message: req.t("authentication:passed"),
+					...result
+				}, {
+					headers,
+					status: 200
+				});
+			}
+		},
+		{
+			method: "post",
+			path: "/logout",
+			handler: async (req) => {
+				await prepareWrite(req);
+				const collection = getCollection(req);
+				const headers = headersWithCors({
+					headers: new Headers(),
+					req
+				});
+				if (!await logoutOperation({
+					allSessions: req.searchParams.get("allSessions") === "true",
+					collection,
+					req
+				})) return Response.json({ message: req.t("error:logoutFailed") }, {
+					headers,
+					status: 400
+				});
+				const name = slotFor(req, req.user);
+				if (name) headers.set("Set-Cookie", generateExpiredIsolatedCookie({
+					authConfig: collection.config.auth,
+					name
+				}));
+				return Response.json({ message: req.t("authentication:logoutSuccessful") }, {
+					headers,
+					status: 200
+				});
+			}
+		},
+		{
+			method: "post",
+			path: "/refresh-token",
+			handler: async (req) => {
+				await prepareWrite(req);
+				const collection = getCollection(req);
+				const authConfig = collection.config.auth;
+				const headers = headersWithCors({
+					headers: new Headers(),
+					req
+				});
+				const { refreshedToken, ...result } = await refreshOperation({
+					collection,
+					req
+				});
+				const name = slotFor(req, req.user);
+				if (result.setCookie && refreshedToken && name) headers.set("Set-Cookie", generateIsolatedCookie({
+					authConfig,
+					name,
+					token: refreshedToken
+				}));
+				return Response.json({
+					message: req.t("authentication:tokenRefreshSuccessful"),
+					...result,
+					...authConfig.removeTokenFromResponses ? {} : { refreshedToken }
+				}, {
+					headers,
+					status: 200
+				});
+			}
+		},
+		{
+			method: "get",
+			path: "/me",
+			handler: async (req) => {
+				const collection = getCollection(req);
+				const { joins, populate, select } = req.query;
+				const slot = slotFor(req, req.user);
+				const result = await meOperation({
+					collection,
+					currentToken: (slot ? parseCookies(req.headers).get(slot) : void 0) ?? extractAuthorizationToken({
+						headers: req.headers,
+						payload: req.payload
+					}),
+					depth: getDepth(req),
+					draft: (req.query.draft ?? req.searchParams.get("draft")) === "true",
+					joins: sanitizeJoinParams(joins),
+					populate: sanitizePopulateParam(populate),
+					req,
+					select: sanitizeSelectParam(select)
+				});
+				if (collection.config.auth.removeTokenFromResponses) delete result.token;
+				return Response.json({
+					...result,
+					message: req.t("authentication:account")
+				}, {
+					headers: headersWithCors({
+						headers: new Headers(),
+						req
+					}),
+					status: 200
+				});
+			}
+		},
+		{
+			method: "post",
+			path: "/reset-password",
+			handler: async (req) => {
+				await prepareWrite(req);
+				const collection = getCollection(req);
+				const authConfig = collection.config.auth;
+				const result = await resetPasswordOperation({
+					collection,
+					data: {
+						password: getString(req, "password"),
+						token: getString(req, "token")
+					},
+					depth: getDepth(req),
+					req
+				});
+				const headers = headersWithCors({
+					headers: new Headers(),
+					req
+				});
+				const name = slotFor(req, asUser(result.user));
+				if (result.token && name) headers.set("Set-Cookie", generateIsolatedCookie({
+					authConfig,
+					name,
+					token: result.token
+				}));
+				if (authConfig.removeTokenFromResponses) delete result.token;
+				return Response.json({
+					message: req.t("authentication:passwordResetSuccessfully"),
+					...result
+				}, {
+					headers,
+					status: 200
+				});
+			}
+		},
+		{
+			method: "post",
+			path: "/first-register",
+			handler: async (req) => {
+				await prepareWrite(req);
+				const collection = getCollection(req);
+				const authConfig = collection.config.auth;
+				const authData = authConfig.loginWithUsername !== false ? {
+					email: getString(req, "email"),
+					password: getString(req, "password"),
+					username: getString(req, "username")
+				} : {
+					email: getString(req, "email"),
+					password: getString(req, "password")
+				};
+				const result = await registerFirstUserOperation({
+					collection,
+					data: {
+						...req.data,
+						...authData
+					},
+					req
+				});
+				const headers = headersWithCors({
+					headers: new Headers(),
+					req
+				});
+				const name = slug === req.payload.config.admin.user ? getSharedCookieName(req.payload.config.cookiePrefix) : slotFor(req, asUser(result.user));
+				if (result.token && name) headers.set("Set-Cookie", generateIsolatedCookie({
+					authConfig,
+					name,
+					token: result.token
+				}));
+				return Response.json({
+					exp: result.exp,
+					message: req.t("authentication:successfullyRegisteredFirstUser"),
+					token: authConfig.removeTokenFromResponses ? void 0 : result.token,
+					user: result.user
+				}, {
+					headers,
+					status: 200
+				});
+			}
+		}
+	];
+};
+//#endregion
+export { buildIsolatedAuthEndpoints };
+
+//# sourceMappingURL=endpoints.js.map

package/dist/auth/endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.js","names":[],"sources":["../../src/auth/endpoints.ts"],"sourcesContent":["import {\n\ttype AuthCollectionSlug,\n\taddDataAndFileToRequest,\n\taddLocalesToRequestFromData,\n\ttype Endpoint,\n\theadersWithCors,\n\tloginOperation,\n\tlogoutOperation,\n\tmeOperation,\n\ttype PayloadRequest,\n\trefreshOperation,\n\tregisterFirstUserOperation,\n\tresetPasswordOperation,\n\tsanitizeJoinParams,\n\tsanitizePopulateParam,\n\tsanitizeSelectParam,\n\ttype TypedUser,\n} from 'payload'\nimport { isNumber, parseCookies } from 'payload/shared'\n\nimport type { ResolvedIsolatedCollection } from '../types'\nimport { extractAuthorizationToken } from './authorization'\nimport {\n\tgenerateExpiredIsolatedCookie,\n\tgenerateIsolatedCookie,\n\tgetSharedCookieName,\n\tresolveSlotCookieName,\n} from './cookies'\nimport { warnIfAdminMisclassified } from './misclassification'\n\nconst getDepth = (req: PayloadRequest) => {\n\tconst depth = req.query.depth ?? req.searchParams.get('depth')\n\treturn isNumber(depth) ? Number(depth) : undefined\n}\n\n/**\n * Payload wraps its own auth endpoints with `wrapInternalEndpoints`, which parses the\n * body onto `req.data`. Custom endpoints are not wrapped, so replacements have to do\n * it themselves.\n */\nconst prepareWrite = async (req: PayloadRequest) => {\n\tawait addDataAndFileToRequest(req)\n\taddLocalesToRequestFromData(req)\n}\n\nconst getString = (req: PayloadRequest, key: string) =>\n\ttypeof req.data?.[key] === 'string' ? (req.data[key] as string) : ''\n\n/**\n * The core auth operations type the user they return loosely (`Record<string, unknown>` on\n * some paths, the collection's own doc on others), while `TypedUser` is the union across\n * every auth collection. It is the same object either way.\n */\nconst asUser = (user: unknown) => user as TypedUser | undefined\n\n/**\n * Replacements for the built-in auth endpoints that read from and write to a\n * collection-scoped cookie. Each one delegates to the same core operation the built-in\n * handler uses, so behaviour (hooks, lockout, sessions, verification) is unchanged.\n * Only the cookie name differs.\n *\n * Payload appends its built-in endpoints *after* the ones declared on the collection,\n * and `handleEndpoints` matches the first entry that fits. Declaring these on the\n * collection therefore shadows the built-ins.\n *\n * Which cookie a handler touches is a question about the user, not about the collection,\n * so every handler that writes one asks {@link resolveSlotCookieName} first. With no\n * `isolate` predicate the answer is always the isolated cookie and these behave exactly as\n * before; with one, the users it rejects are written to the shared cookie in the same bytes\n * core would have written.\n */\nexport const buildIsolatedAuthEndpoints = ({\n\tentry,\n}: {\n\tentry: ResolvedIsolatedCollection\n}): Endpoint[] => {\n\tconst { slug } = entry\n\n\tconst getCollection = (req: PayloadRequest) => {\n\t\tconst collection = req.payload.collections[slug]\n\t\tif (!collection) {\n\t\t\tthrow new Error(`dualSession: collection \"${slug}\" is not registered on payload.`)\n\t\t}\n\t\treturn collection\n\t}\n\n\tconst slotFor = (req: PayloadRequest, user: null | TypedUser | undefined) =>\n\t\tresolveSlotCookieName({\n\t\t\tentry,\n\t\t\tsharedName: getSharedCookieName(req.payload.config.cookiePrefix),\n\t\t\tuser,\n\t\t})\n\n\treturn [\n\t\t{\n\t\t\tmethod: 'post',\n\t\t\tpath: '/login',\n\t\t\thandler: async (req) => {\n\t\t\t\tawait prepareWrite(req)\n\n\t\t\t\tconst collection = getCollection(req)\n\t\t\t\tconst authConfig = collection.config.auth\n\n\t\t\t\tconst data =\n\t\t\t\t\tauthConfig.loginWithUsername !== false\n\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\temail: getString(req, 'email'),\n\t\t\t\t\t\t\t\tpassword: getString(req, 'password'),\n\t\t\t\t\t\t\t\tusername: getString(req, 'username'),\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t: { email: getString(req, 'email'), password: getString(req, 'password') }\n\n\t\t\t\tconst result = await loginOperation<AuthCollectionSlug>({\n\t\t\t\t\tcollection,\n\t\t\t\t\tdata,\n\t\t\t\t\tdepth: getDepth(req),\n\t\t\t\t\treq,\n\t\t\t\t})\n\n\t\t\t\tconst headers = headersWithCors({ headers: new Headers(), req })\n\t\t\t\tconst user = asUser(result.user)\n\t\t\t\tconst name = slotFor(req, user)\n\n\t\t\t\tif (result.token && name) {\n\t\t\t\t\theaders.set(\n\t\t\t\t\t\t'Set-Cookie',\n\t\t\t\t\t\tgenerateIsolatedCookie({ authConfig, name, token: result.token })\n\t\t\t\t\t)\n\n\t\t\t\t\tawait warnIfAdminMisclassified({ collection, cookieName: name, entry, req, user })\n\t\t\t\t}\n\n\t\t\t\tif (authConfig.removeTokenFromResponses) {\n\t\t\t\t\tdelete result.token\n\t\t\t\t}\n\n\t\t\t\treturn Response.json(\n\t\t\t\t\t{ message: req.t('authentication:passed'), ...result },\n\t\t\t\t\t{ headers, status: 200 }\n\t\t\t\t)\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tmethod: 'post',\n\t\t\tpath: '/logout',\n\t\t\thandler: async (req) => {\n\t\t\t\tawait prepareWrite(req)\n\n\t\t\t\tconst collection = getCollection(req)\n\t\t\t\tconst headers = headersWithCors({ headers: new Headers(), req })\n\n\t\t\t\tconst result = await logoutOperation({\n\t\t\t\t\tallSessions: req.searchParams.get('allSessions') === 'true',\n\t\t\t\t\tcollection,\n\t\t\t\t\treq,\n\t\t\t\t})\n\n\t\t\t\tif (!result) {\n\t\t\t\t\treturn Response.json({ message: req.t('error:logoutFailed') }, { headers, status: 400 })\n\t\t\t\t}\n\n\t\t\t\t// `logoutOperation` refuses without a user, so by here `req.user` is this\n\t\t\t\t// collection's and the slot is always resolvable.\n\t\t\t\tconst name = slotFor(req, req.user)\n\n\t\t\t\tif (name) {\n\t\t\t\t\theaders.set(\n\t\t\t\t\t\t'Set-Cookie',\n\t\t\t\t\t\tgenerateExpiredIsolatedCookie({ authConfig: collection.config.auth, name })\n\t\t\t\t\t)\n\t\t\t\t}\n\n\t\t\t\treturn Response.json(\n\t\t\t\t\t{ message: req.t('authentication:logoutSuccessful') },\n\t\t\t\t\t{ headers, status: 200 }\n\t\t\t\t)\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tmethod: 'post',\n\t\t\tpath: '/refresh-token',\n\t\t\thandler: async (req) => {\n\t\t\t\tawait prepareWrite(req)\n\n\t\t\t\tconst collection = getCollection(req)\n\t\t\t\tconst authConfig = collection.config.auth\n\t\t\t\tconst headers = headersWithCors({ headers: new Headers(), req })\n\n\t\t\t\tconst { refreshedToken, ...result } = await refreshOperation({ collection, req })\n\t\t\t\tconst name = slotFor(req, req.user)\n\n\t\t\t\tif (result.setCookie && refreshedToken && name) {\n\t\t\t\t\theaders.set(\n\t\t\t\t\t\t'Set-Cookie',\n\t\t\t\t\t\tgenerateIsolatedCookie({ authConfig, name, token: refreshedToken })\n\t\t\t\t\t)\n\t\t\t\t}\n\n\t\t\t\treturn Response.json(\n\t\t\t\t\t{\n\t\t\t\t\t\tmessage: req.t('authentication:tokenRefreshSuccessful'),\n\t\t\t\t\t\t...result,\n\t\t\t\t\t\t...(authConfig.removeTokenFromResponses ? {} : { refreshedToken }),\n\t\t\t\t\t},\n\t\t\t\t\t{ headers, status: 200 }\n\t\t\t\t)\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tmethod: 'get',\n\t\t\tpath: '/me',\n\t\t\thandler: async (req) => {\n\t\t\t\tconst collection = getCollection(req)\n\t\t\t\tconst { joins, populate, select } = req.query as {\n\t\t\t\t\tjoins?: Parameters<typeof sanitizeJoinParams>[0]\n\t\t\t\t} & Record<string, unknown>\n\n\t\t\t\t// The built-in handler reads the token via `extractJWT`, which only knows about\n\t\t\t\t// the shared cookie, which would report the admin's token back to a frontend user.\n\t\t\t\t// With no cookie in this user's slot the request was authenticated by something\n\t\t\t\t// else (an `Authorization` header, a custom strategy), so fall back to core's own\n\t\t\t\t// extraction rather than reporting no token at all.\n\t\t\t\tconst slot = slotFor(req, req.user)\n\t\t\t\tconst currentToken =\n\t\t\t\t\t(slot ? parseCookies(req.headers).get(slot) : undefined) ??\n\t\t\t\t\textractAuthorizationToken({ headers: req.headers, payload: req.payload })\n\n\t\t\t\tconst result = await meOperation({\n\t\t\t\t\tcollection,\n\t\t\t\t\tcurrentToken,\n\t\t\t\t\tdepth: getDepth(req),\n\t\t\t\t\tdraft: (req.query.draft ?? req.searchParams.get('draft')) === 'true',\n\t\t\t\t\tjoins: sanitizeJoinParams(joins),\n\t\t\t\t\tpopulate: sanitizePopulateParam(populate),\n\t\t\t\t\treq,\n\t\t\t\t\tselect: sanitizeSelectParam(select),\n\t\t\t\t})\n\n\t\t\t\tif (collection.config.auth.removeTokenFromResponses) {\n\t\t\t\t\tdelete result.token\n\t\t\t\t}\n\n\t\t\t\treturn Response.json(\n\t\t\t\t\t{ ...result, message: req.t('authentication:account') },\n\t\t\t\t\t{ headers: headersWithCors({ headers: new Headers(), req }), status: 200 }\n\t\t\t\t)\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tmethod: 'post',\n\t\t\tpath: '/reset-password',\n\t\t\thandler: async (req) => {\n\t\t\t\tawait prepareWrite(req)\n\n\t\t\t\tconst collection = getCollection(req)\n\t\t\t\tconst authConfig = collection.config.auth\n\n\t\t\t\tconst result = await resetPasswordOperation({\n\t\t\t\t\tcollection,\n\t\t\t\t\tdata: { password: getString(req, 'password'), token: getString(req, 'token') },\n\t\t\t\t\tdepth: getDepth(req),\n\t\t\t\t\treq,\n\t\t\t\t})\n\n\t\t\t\tconst headers = headersWithCors({ headers: new Headers(), req })\n\t\t\t\tconst name = slotFor(req, asUser(result.user))\n\n\t\t\t\tif (result.token && name) {\n\t\t\t\t\theaders.set(\n\t\t\t\t\t\t'Set-Cookie',\n\t\t\t\t\t\tgenerateIsolatedCookie({ authConfig, name, token: result.token })\n\t\t\t\t\t)\n\t\t\t\t}\n\n\t\t\t\tif (authConfig.removeTokenFromResponses) {\n\t\t\t\t\tdelete result.token\n\t\t\t\t}\n\n\t\t\t\treturn Response.json(\n\t\t\t\t\t{ message: req.t('authentication:passwordResetSuccessfully'), ...result },\n\t\t\t\t\t{ headers, status: 200 }\n\t\t\t\t)\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tmethod: 'post',\n\t\t\tpath: '/first-register',\n\t\t\thandler: async (req) => {\n\t\t\t\tawait prepareWrite(req)\n\n\t\t\t\tconst collection = getCollection(req)\n\t\t\t\tconst authConfig = collection.config.auth\n\n\t\t\t\tconst authData =\n\t\t\t\t\tauthConfig.loginWithUsername !== false\n\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\temail: getString(req, 'email'),\n\t\t\t\t\t\t\t\tpassword: getString(req, 'password'),\n\t\t\t\t\t\t\t\tusername: getString(req, 'username'),\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t: { email: getString(req, 'email'), password: getString(req, 'password') }\n\n\t\t\t\tconst result = await registerFirstUserOperation({\n\t\t\t\t\tcollection,\n\t\t\t\t\tdata: { ...req.data, ...authData },\n\t\t\t\t\treq,\n\t\t\t\t})\n\n\t\t\t\tconst headers = headersWithCors({ headers: new Headers(), req })\n\n\t\t\t\t// The very first user of the collection that backs the admin panel is created to\n\t\t\t\t// get *into* it, and has no roles yet for a predicate to read, so this one always\n\t\t\t\t// writes the shared cookie rather than asking.\n\t\t\t\tconst name =\n\t\t\t\t\tslug === req.payload.config.admin.user\n\t\t\t\t\t\t? getSharedCookieName(req.payload.config.cookiePrefix)\n\t\t\t\t\t\t: slotFor(req, asUser(result.user))\n\n\t\t\t\tif (result.token && name) {\n\t\t\t\t\theaders.set(\n\t\t\t\t\t\t'Set-Cookie',\n\t\t\t\t\t\tgenerateIsolatedCookie({ authConfig, name, token: result.token })\n\t\t\t\t\t)\n\t\t\t\t}\n\n\t\t\t\treturn Response.json(\n\t\t\t\t\t{\n\t\t\t\t\t\texp: result.exp,\n\t\t\t\t\t\tmessage: req.t('authentication:successfullyRegisteredFirstUser'),\n\t\t\t\t\t\ttoken: authConfig.removeTokenFromResponses ? undefined : result.token,\n\t\t\t\t\t\tuser: result.user,\n\t\t\t\t\t},\n\t\t\t\t\t{ headers, status: 200 }\n\t\t\t\t)\n\t\t\t},\n\t\t},\n\t]\n}\n"],"mappings":";;;;;;AA8BA,MAAM,YAAY,QAAwB;CACzC,MAAM,QAAQ,IAAI,MAAM,SAAS,IAAI,aAAa,IAAI,OAAO;CAC7D,OAAO,SAAS,KAAK,IAAI,OAAO,KAAK,IAAI,KAAA;AAC1C;;;;;;AAOA,MAAM,eAAe,OAAO,QAAwB;CACnD,MAAM,wBAAwB,GAAG;CACjC,4BAA4B,GAAG;AAChC;AAEA,MAAM,aAAa,KAAqB,QACvC,OAAO,IAAI,OAAO,SAAS,WAAY,IAAI,KAAK,OAAkB;;;;;;AAOnE,MAAM,UAAU,SAAkB;;;;;;;;;;;;;;;;;AAkBlC,MAAa,8BAA8B,EAC1C,YAGiB;CACjB,MAAM,EAAE,SAAS;CAEjB,MAAM,iBAAiB,QAAwB;EAC9C,MAAM,aAAa,IAAI,QAAQ,YAAY;EAC3C,IAAI,CAAC,YACJ,MAAM,IAAI,MAAM,4BAA4B,KAAK,gCAAgC;EAElF,OAAO;CACR;CAEA,MAAM,WAAW,KAAqB,SACrC,sBAAsB;EACrB;EACA,YAAY,oBAAoB,IAAI,QAAQ,OAAO,YAAY;EAC/D;CACD,CAAC;CAEF,OAAO;EACN;GACC,QAAQ;GACR,MAAM;GACN,SAAS,OAAO,QAAQ;IACvB,MAAM,aAAa,GAAG;IAEtB,MAAM,aAAa,cAAc,GAAG;IACpC,MAAM,aAAa,WAAW,OAAO;IAWrC,MAAM,SAAS,MAAM,eAAmC;KACvD;KACA,MAVA,WAAW,sBAAsB,QAC9B;MACA,OAAO,UAAU,KAAK,OAAO;MAC7B,UAAU,UAAU,KAAK,UAAU;MACnC,UAAU,UAAU,KAAK,UAAU;KACpC,IACC;MAAE,OAAO,UAAU,KAAK,OAAO;MAAG,UAAU,UAAU,KAAK,UAAU;KAAE;KAK1E,OAAO,SAAS,GAAG;KACnB;IACD,CAAC;IAED,MAAM,UAAU,gBAAgB;KAAE,SAAS,IAAI,QAAQ;KAAG;IAAI,CAAC;IAC/D,MAAM,OAAO,OAAO,OAAO,IAAI;IAC/B,MAAM,OAAO,QAAQ,KAAK,IAAI;IAE9B,IAAI,OAAO,SAAS,MAAM;KACzB,QAAQ,IACP,cACA,uBAAuB;MAAE;MAAY;MAAM,OAAO,OAAO;KAAM,CAAC,CACjE;KAEA,MAAM,yBAAyB;MAAE;MAAY,YAAY;MAAM;MAAO;MAAK;KAAK,CAAC;IAClF;IAEA,IAAI,WAAW,0BACd,OAAO,OAAO;IAGf,OAAO,SAAS,KACf;KAAE,SAAS,IAAI,EAAE,uBAAuB;KAAG,GAAG;IAAO,GACrD;KAAE;KAAS,QAAQ;IAAI,CACxB;GACD;EACD;EACA;GACC,QAAQ;GACR,MAAM;GACN,SAAS,OAAO,QAAQ;IACvB,MAAM,aAAa,GAAG;IAEtB,MAAM,aAAa,cAAc,GAAG;IACpC,MAAM,UAAU,gBAAgB;KAAE,SAAS,IAAI,QAAQ;KAAG;IAAI,CAAC;IAQ/D,IAAI,CAAC,MANgB,gBAAgB;KACpC,aAAa,IAAI,aAAa,IAAI,aAAa,MAAM;KACrD;KACA;IACD,CAAC,GAGA,OAAO,SAAS,KAAK,EAAE,SAAS,IAAI,EAAE,oBAAoB,EAAE,GAAG;KAAE;KAAS,QAAQ;IAAI,CAAC;IAKxF,MAAM,OAAO,QAAQ,KAAK,IAAI,IAAI;IAElC,IAAI,MACH,QAAQ,IACP,cACA,8BAA8B;KAAE,YAAY,WAAW,OAAO;KAAM;IAAK,CAAC,CAC3E;IAGD,OAAO,SAAS,KACf,EAAE,SAAS,IAAI,EAAE,iCAAiC,EAAE,GACpD;KAAE;KAAS,QAAQ;IAAI,CACxB;GACD;EACD;EACA;GACC,QAAQ;GACR,MAAM;GACN,SAAS,OAAO,QAAQ;IACvB,MAAM,aAAa,GAAG;IAEtB,MAAM,aAAa,cAAc,GAAG;IACpC,MAAM,aAAa,WAAW,OAAO;IACrC,MAAM,UAAU,gBAAgB;KAAE,SAAS,IAAI,QAAQ;KAAG;IAAI,CAAC;IAE/D,MAAM,EAAE,gBAAgB,GAAG,WAAW,MAAM,iBAAiB;KAAE;KAAY;IAAI,CAAC;IAChF,MAAM,OAAO,QAAQ,KAAK,IAAI,IAAI;IAElC,IAAI,OAAO,aAAa,kBAAkB,MACzC,QAAQ,IACP,cACA,uBAAuB;KAAE;KAAY;KAAM,OAAO;IAAe,CAAC,CACnE;IAGD,OAAO,SAAS,KACf;KACC,SAAS,IAAI,EAAE,uCAAuC;KACtD,GAAG;KACH,GAAI,WAAW,2BAA2B,CAAC,IAAI,EAAE,eAAe;IACjE,GACA;KAAE;KAAS,QAAQ;IAAI,CACxB;GACD;EACD;EACA;GACC,QAAQ;GACR,MAAM;GACN,SAAS,OAAO,QAAQ;IACvB,MAAM,aAAa,cAAc,GAAG;IACpC,MAAM,EAAE,OAAO,UAAU,WAAW,IAAI;IASxC,MAAM,OAAO,QAAQ,KAAK,IAAI,IAAI;IAKlC,MAAM,SAAS,MAAM,YAAY;KAChC;KACA,eALC,OAAO,aAAa,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,KAAA,MAC9C,0BAA0B;MAAE,SAAS,IAAI;MAAS,SAAS,IAAI;KAAQ,CAAC;KAKxE,OAAO,SAAS,GAAG;KACnB,QAAQ,IAAI,MAAM,SAAS,IAAI,aAAa,IAAI,OAAO,OAAO;KAC9D,OAAO,mBAAmB,KAAK;KAC/B,UAAU,sBAAsB,QAAQ;KACxC;KACA,QAAQ,oBAAoB,MAAM;IACnC,CAAC;IAED,IAAI,WAAW,OAAO,KAAK,0BAC1B,OAAO,OAAO;IAGf,OAAO,SAAS,KACf;KAAE,GAAG;KAAQ,SAAS,IAAI,EAAE,wBAAwB;IAAE,GACtD;KAAE,SAAS,gBAAgB;MAAE,SAAS,IAAI,QAAQ;MAAG;KAAI,CAAC;KAAG,QAAQ;IAAI,CAC1E;GACD;EACD;EACA;GACC,QAAQ;GACR,MAAM;GACN,SAAS,OAAO,QAAQ;IACvB,MAAM,aAAa,GAAG;IAEtB,MAAM,aAAa,cAAc,GAAG;IACpC,MAAM,aAAa,WAAW,OAAO;IAErC,MAAM,SAAS,MAAM,uBAAuB;KAC3C;KACA,MAAM;MAAE,UAAU,UAAU,KAAK,UAAU;MAAG,OAAO,UAAU,KAAK,OAAO;KAAE;KAC7E,OAAO,SAAS,GAAG;KACnB;IACD,CAAC;IAED,MAAM,UAAU,gBAAgB;KAAE,SAAS,IAAI,QAAQ;KAAG;IAAI,CAAC;IAC/D,MAAM,OAAO,QAAQ,KAAK,OAAO,OAAO,IAAI,CAAC;IAE7C,IAAI,OAAO,SAAS,MACnB,QAAQ,IACP,cACA,uBAAuB;KAAE;KAAY;KAAM,OAAO,OAAO;IAAM,CAAC,CACjE;IAGD,IAAI,WAAW,0BACd,OAAO,OAAO;IAGf,OAAO,SAAS,KACf;KAAE,SAAS,IAAI,EAAE,0CAA0C;KAAG,GAAG;IAAO,GACxE;KAAE;KAAS,QAAQ;IAAI,CACxB;GACD;EACD;EACA;GACC,QAAQ;GACR,MAAM;GACN,SAAS,OAAO,QAAQ;IACvB,MAAM,aAAa,GAAG;IAEtB,MAAM,aAAa,cAAc,GAAG;IACpC,MAAM,aAAa,WAAW,OAAO;IAErC,MAAM,WACL,WAAW,sBAAsB,QAC9B;KACA,OAAO,UAAU,KAAK,OAAO;KAC7B,UAAU,UAAU,KAAK,UAAU;KACnC,UAAU,UAAU,KAAK,UAAU;IACpC,IACC;KAAE,OAAO,UAAU,KAAK,OAAO;KAAG,UAAU,UAAU,KAAK,UAAU;IAAE;IAE3E,MAAM,SAAS,MAAM,2BAA2B;KAC/C;KACA,MAAM;MAAE,GAAG,IAAI;MAAM,GAAG;KAAS;KACjC;IACD,CAAC;IAED,MAAM,UAAU,gBAAgB;KAAE,SAAS,IAAI,QAAQ;KAAG;IAAI,CAAC;IAK/D,MAAM,OACL,SAAS,IAAI,QAAQ,OAAO,MAAM,OAC/B,oBAAoB,IAAI,QAAQ,OAAO,YAAY,IACnD,QAAQ,KAAK,OAAO,OAAO,IAAI,CAAC;IAEpC,IAAI,OAAO,SAAS,MACnB,QAAQ,IACP,cACA,uBAAuB;KAAE;KAAY;KAAM,OAAO,OAAO;IAAM,CAAC,CACjE;IAGD,OAAO,SAAS,KACf;KACC,KAAK,OAAO;KACZ,SAAS,IAAI,EAAE,gDAAgD;KAC/D,OAAO,WAAW,2BAA2B,KAAA,IAAY,OAAO;KAChE,MAAM,OAAO;IACd,GACA;KAAE;KAAS,QAAQ;IAAI,CACxB;GACD;EACD;CACD;AACD"}