@10x-media/impersonation 0.1.0-beta.0

package/CHANGELOG.md

@@ -0,0 +1,31 @@
+# @10x-media/impersonation
+
+## 0.1.0-beta.0
+
+### Minor Changes
+
+- Sessions collection accepts `collection.overrides`. `useImpersonation().targetFilters` is the filter map (the `targets` option is unchanged). `decorateRequests: false` still enforces `maxDuration`. The admin bar, switcher, and frontend banner pick up the review's layout and copy fixes.
+
+- Show the sessions collection only when `ui.sessionsCollection` is on, hide End session on a closed row, and clear impersonation cookies when a session hits its absolute expiry.
+
+- Replace the switcher row with your own card and end a session from the document controls.
+
+- Initial beta of `@10x-media/impersonation`: an authorised account can sign in as another user without their password. After start, `req.user` is the target. Every session is a closed-never-deleted row. Exit, logout, or remote terminate ends it.
+
+  - **Mandatory `access.impersonate`**: only the literal `true` allows. A Payload `Where` object is deny. Start also reads the target with `overrideAccess: false`.
+  - **Minted target session**: `db.findOne` + `addSessionToUser` + `jwtSign` + cookie. Active means an open row whose `targetSid` matches `req.user._sid`, so Payload refresh cannot hide the bar.
+  - **Plugin-owned origin gate** on cookie POSTs. JWT/Bearer skip it only when `jwtOrder` ranks that scheme before `cookie`.
+  - **Swap or parallel**: parallel only when `@10x-media/dual-session` isolated the target. Hint cookie is never trusted alone.
+  - **Admin UI**: Switch to user, Acting as bar (including `/admin/unauthorized`), document action, End session on the record.
+
+  Requires Payload `^3.83.0`. Dual-session is an optional peer.
+
+### Patch Changes
+
+- Keep the impersonation bar beside the nav, and collapse it to a chip that snaps to the edges of the content area.
+
+- Admin impersonation UI uses Payload's native drawer, confirmation modal, inputs, and theme tokens.
+
+- Rebuild the Impersonate UI (Payload SearchFilter, compact Button margins, card drawer/document actions, pagination, nav-aware bar, countdown), always register the provider with `useImpersonation`, add `filterTargets`, a frontend banner, opt-in retention, and skip session lookups on ordinary traffic.
+
+- Restore the impersonator's tenant cookie on exit, and set the target's when they belong to exactly one tenant.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 10x Media GmbH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,49 @@
+![Banner](./assets/banner.jpg)
+
+# @10x-media/impersonation
+
+Let an authorised account sign in as another user without their password, then return. Every session is recorded. After start, `req.user` is the target.
+
+[![npm](https://img.shields.io/npm/v/@10x-media/impersonation?style=flat-square)](https://www.npmjs.com/package/@10x-media/impersonation)
+
+Part of the [@10x-media Payload plugins](https://github.com/10x-media/payload-plugins) collection. In beta: published under the `beta` dist-tag until a stable 1.0.
+
+> [!WARNING]
+> **Experimental.** This plugin mints and revokes sessions. That is not a place where a subtle bug announces itself. It is covered by unit, integration and end-to-end tests against Payload's real routing on Mongo and Postgres, but auth surfaces differ a lot between projects. Try it in staging first, and [report anything that looks off](https://github.com/10x-media/payload-plugins/issues).
+
+## Quick start
+
+```bash
+pnpm add @10x-media/impersonation
+```
+
+```ts
+import { impersonation } from '@10x-media/impersonation'
+
+export default buildConfig({
+  plugins: [
+    impersonation({
+      access: {
+        impersonate: ({ req }) => req.user?.roles?.includes('admin') === true,
+      },
+    }),
+  ],
+})
+```
+
+`access.impersonate` is required. Only the literal `true` allows.
+
+The admin header gets **Impersonate**. Confirm, and you are that user until you exit. A bar on every admin route (including `/admin/unauthorized`) shows **Acting as** and **Return to**.
+
+## Documentation
+
+Full documentation at [docs.10xmedia.de](https://docs.10xmedia.de/impersonation):
+
+- [Overview](https://docs.10xmedia.de/impersonation)
+- [Quick start](https://docs.10xmedia.de/impersonation/quick-start)
+- [Configuration](https://docs.10xmedia.de/impersonation/configuration)
+- [Security](https://docs.10xmedia.de/impersonation/security)
+
+## License
+
+[MIT](./LICENSE). Copyright 10x Media GmbH.

package/dist/access/filterTargets.js

@@ -0,0 +1,51 @@
+//#region src/access/filterTargets.ts
+const isWhere = (value) => Boolean(value) && typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* Resolve the per-collection list filter for the current viewer. Collections
+* that return `false` (or anything other than `true` / a Where) are omitted.
+*/
+const resolveTargetFilters = async ({ collections, options, req }) => {
+	const out = {};
+	for (const slug of collections) {
+		if (!options.access.filterTargets) {
+			out[slug] = true;
+			continue;
+		}
+		let result;
+		try {
+			result = await options.access.filterTargets({
+				req,
+				targetCollection: slug
+			});
+		} catch (error) {
+			req.payload.logger.error({
+				err: error,
+				msg: `@10x-media/impersonation: access.filterTargets threw for "${slug}"`
+			});
+			continue;
+		}
+		if (result === true) {
+			out[slug] = true;
+			continue;
+		}
+		if (result === false || !isWhere(result)) continue;
+		out[slug] = result;
+	}
+	return out;
+};
+const targetMatchesFilter = async ({ collection, filter, req, targetId }) => {
+	if (filter === true) return true;
+	return (await req.payload.find({
+		collection,
+		depth: 0,
+		limit: 1,
+		overrideAccess: true,
+		pagination: false,
+		req,
+		where: { and: [{ id: { equals: targetId } }, filter] }
+	})).docs.length > 0;
+};
+//#endregion
+export { resolveTargetFilters, targetMatchesFilter };
+
+//# sourceMappingURL=filterTargets.js.map

package/dist/access/filterTargets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filterTargets.js","names":[],"sources":["../../src/access/filterTargets.ts"],"sourcesContent":["import type { CollectionSlug, PayloadRequest, Where } from 'payload'\n\nimport type { ResolvedOptions } from '../types'\n\nexport type TargetFilterMap = Record<string, true | Where>\n\nconst isWhere = (value: unknown): value is Where =>\n\tBoolean(value) && typeof value === 'object' && value !== null && !Array.isArray(value)\n\n/**\n * Resolve the per-collection list filter for the current viewer. Collections\n * that return `false` (or anything other than `true` / a Where) are omitted.\n */\nexport const resolveTargetFilters = async ({\n\tcollections,\n\toptions,\n\treq,\n}: {\n\tcollections: CollectionSlug[]\n\toptions: ResolvedOptions\n\treq: PayloadRequest\n}): Promise<TargetFilterMap> => {\n\tconst out: TargetFilterMap = {}\n\tfor (const slug of collections) {\n\t\tif (!options.access.filterTargets) {\n\t\t\tout[slug] = true\n\t\t\tcontinue\n\t\t}\n\t\tlet result: boolean | Where\n\t\ttry {\n\t\t\tresult = await options.access.filterTargets({ req, targetCollection: slug })\n\t\t} catch (error) {\n\t\t\treq.payload.logger.error({\n\t\t\t\terr: error,\n\t\t\t\tmsg: `@10x-media/impersonation: access.filterTargets threw for \"${slug}\"`,\n\t\t\t})\n\t\t\tcontinue\n\t\t}\n\t\tif (result === true) {\n\t\t\tout[slug] = true\n\t\t\tcontinue\n\t\t}\n\t\tif (result === false || !isWhere(result)) {\n\t\t\tcontinue\n\t\t}\n\t\tout[slug] = result\n\t}\n\treturn out\n}\n\nexport const targetMatchesFilter = async ({\n\tcollection,\n\tfilter,\n\treq,\n\ttargetId,\n}: {\n\tcollection: CollectionSlug\n\tfilter: true | Where\n\treq: PayloadRequest\n\ttargetId: number | string\n}): Promise<boolean> => {\n\tif (filter === true) {\n\t\treturn true\n\t}\n\tconst found = await req.payload.find({\n\t\tcollection,\n\t\tdepth: 0,\n\t\tlimit: 1,\n\t\toverrideAccess: true,\n\t\tpagination: false,\n\t\treq,\n\t\twhere: { and: [{ id: { equals: targetId } }, filter] },\n\t})\n\treturn found.docs.length > 0\n}\n"],"mappings":";AAMA,MAAM,WAAW,UAChB,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;;;;;AAMtF,MAAa,uBAAuB,OAAO,EAC1C,aACA,SACA,UAK+B;CAC/B,MAAM,MAAuB,CAAC;CAC9B,KAAK,MAAM,QAAQ,aAAa;EAC/B,IAAI,CAAC,QAAQ,OAAO,eAAe;GAClC,IAAI,QAAQ;GACZ;EACD;EACA,IAAI;EACJ,IAAI;GACH,SAAS,MAAM,QAAQ,OAAO,cAAc;IAAE;IAAK,kBAAkB;GAAK,CAAC;EAC5E,SAAS,OAAO;GACf,IAAI,QAAQ,OAAO,MAAM;IACxB,KAAK;IACL,KAAK,6DAA6D,KAAK;GACxE,CAAC;GACD;EACD;EACA,IAAI,WAAW,MAAM;GACpB,IAAI,QAAQ;GACZ;EACD;EACA,IAAI,WAAW,SAAS,CAAC,QAAQ,MAAM,GACtC;EAED,IAAI,QAAQ;CACb;CACA,OAAO;AACR;AAEA,MAAa,sBAAsB,OAAO,EACzC,YACA,QACA,KACA,eAMuB;CACvB,IAAI,WAAW,MACd,OAAO;CAWR,QAAO,MATa,IAAI,QAAQ,KAAK;EACpC;EACA,OAAO;EACP,OAAO;EACP,gBAAgB;EAChB,YAAY;EACZ;EACA,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,SAAS,EAAE,GAAG,MAAM,EAAE;CACtD,CAAC,GACY,KAAK,SAAS;AAC5B"}

package/dist/auth/cookies.js

@@ -0,0 +1,49 @@
+import { generateCookie, generateExpiredPayloadCookie, getCookieExpiration } from "payload/shared";
+//#region src/auth/cookies.ts
+const resolveSameSite = (sameSite) => {
+	if (typeof sameSite === "string") return sameSite;
+	return sameSite ? "Strict" : void 0;
+};
+const sharedCookieName = (cookiePrefix) => `${cookiePrefix}-token`;
+const writeCookie = ({ authConfig, httpOnly = true, name, value }) => generateCookie({
+	name,
+	domain: authConfig.cookies.domain ?? void 0,
+	expires: getCookieExpiration({ seconds: authConfig.tokenExpiration }),
+	httpOnly,
+	path: "/",
+	returnCookieAsObject: false,
+	sameSite: resolveSameSite(authConfig.cookies.sameSite),
+	secure: authConfig.cookies.secure,
+	value
+});
+const generateHintCookie = ({ authConfig, name, value }) => writeCookie({
+	authConfig,
+	name,
+	value
+});
+const expireCookie = ({ authConfig, httpOnly = true, name }) => generateCookie({
+	name,
+	domain: authConfig.cookies.domain ?? void 0,
+	expires: /* @__PURE__ */ new Date(Date.now() - 1e3),
+	httpOnly,
+	path: "/",
+	returnCookieAsObject: false,
+	sameSite: resolveSameSite(authConfig.cookies.sameSite),
+	secure: authConfig.cookies.secure,
+	value: ""
+});
+const expirePayloadCookie = ({ authConfig, cookiePrefix }) => generateExpiredPayloadCookie({
+	collectionAuthConfig: authConfig,
+	cookiePrefix
+});
+const expireCookies = ({ authConfig, cookiePrefix, names }) => names.map((name) => name === sharedCookieName(cookiePrefix) ? expirePayloadCookie({
+	authConfig,
+	cookiePrefix
+}) : expireCookie({
+	authConfig,
+	name
+}));
+//#endregion
+export { expireCookie, expireCookies, expirePayloadCookie, generateHintCookie, sharedCookieName, writeCookie };
+
+//# sourceMappingURL=cookies.js.map

package/dist/auth/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","names":[],"sources":["../../src/auth/cookies.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from 'payload'\nimport { generateCookie, generateExpiredPayloadCookie, getCookieExpiration } from 'payload/shared'\n\ntype AuthConfig = SanitizedCollectionConfig['auth']\n\nconst resolveSameSite = (sameSite: AuthConfig['cookies']['sameSite']) => {\n\tif (typeof sameSite === 'string') {\n\t\treturn sameSite\n\t}\n\treturn sameSite ? ('Strict' as const) : undefined\n}\n\nexport const sharedCookieName = (cookiePrefix: string) => `${cookiePrefix}-token`\n\nexport const writeCookie = ({\n\tauthConfig,\n\thttpOnly = true,\n\tname,\n\tvalue,\n}: {\n\tauthConfig: AuthConfig\n\thttpOnly?: boolean\n\tname: string\n\tvalue: string\n}) =>\n\tgenerateCookie<false>({\n\t\tname,\n\t\tdomain: authConfig.cookies.domain ?? undefined,\n\t\texpires: getCookieExpiration({ seconds: authConfig.tokenExpiration }),\n\t\thttpOnly,\n\t\tpath: '/',\n\t\treturnCookieAsObject: false,\n\t\tsameSite: resolveSameSite(authConfig.cookies.sameSite),\n\t\tsecure: authConfig.cookies.secure,\n\t\tvalue,\n\t})\n\nexport const generateHintCookie = ({\n\tauthConfig,\n\tname,\n\tvalue,\n}: {\n\tauthConfig: AuthConfig\n\tname: string\n\tvalue: string\n}) => writeCookie({ authConfig, name, value })\n\nexport const expireCookie = ({\n\tauthConfig,\n\thttpOnly = true,\n\tname,\n}: {\n\tauthConfig: AuthConfig\n\thttpOnly?: boolean\n\tname: string\n}) =>\n\tgenerateCookie<false>({\n\t\tname,\n\t\tdomain: authConfig.cookies.domain ?? undefined,\n\t\texpires: new Date(Date.now() - 1000),\n\t\thttpOnly,\n\t\tpath: '/',\n\t\treturnCookieAsObject: false,\n\t\tsameSite: resolveSameSite(authConfig.cookies.sameSite),\n\t\tsecure: authConfig.cookies.secure,\n\t\tvalue: '',\n\t})\n\nexport const expirePayloadCookie = ({\n\tauthConfig,\n\tcookiePrefix,\n}: {\n\tauthConfig: AuthConfig\n\tcookiePrefix: string\n}) => generateExpiredPayloadCookie({ collectionAuthConfig: authConfig, cookiePrefix })\n\nexport const expireCookies = ({\n\tauthConfig,\n\tcookiePrefix,\n\tnames,\n}: {\n\tauthConfig: AuthConfig\n\tcookiePrefix: string\n\tnames: string[]\n}): string[] =>\n\tnames.map((name) =>\n\t\tname === sharedCookieName(cookiePrefix)\n\t\t\t? expirePayloadCookie({ authConfig, cookiePrefix })\n\t\t\t: expireCookie({ authConfig, name })\n\t)\n"],"mappings":";;AAKA,MAAM,mBAAmB,aAAgD;CACxE,IAAI,OAAO,aAAa,UACvB,OAAO;CAER,OAAO,WAAY,WAAqB,KAAA;AACzC;AAEA,MAAa,oBAAoB,iBAAyB,GAAG,aAAa;AAE1E,MAAa,eAAe,EAC3B,YACA,WAAW,MACX,MACA,YAOA,eAAsB;CACrB;CACA,QAAQ,WAAW,QAAQ,UAAU,KAAA;CACrC,SAAS,oBAAoB,EAAE,SAAS,WAAW,gBAAgB,CAAC;CACpE;CACA,MAAM;CACN,sBAAsB;CACtB,UAAU,gBAAgB,WAAW,QAAQ,QAAQ;CACrD,QAAQ,WAAW,QAAQ;CAC3B;AACD,CAAC;AAEF,MAAa,sBAAsB,EAClC,YACA,MACA,YAKK,YAAY;CAAE;CAAY;CAAM;AAAM,CAAC;AAE7C,MAAa,gBAAgB,EAC5B,YACA,WAAW,MACX,WAMA,eAAsB;CACrB;CACA,QAAQ,WAAW,QAAQ,UAAU,KAAA;CACrC,yBAAS,IAAI,KAAK,KAAK,IAAI,IAAI,GAAI;CACnC;CACA,MAAM;CACN,sBAAsB;CACtB,UAAU,gBAAgB,WAAW,QAAQ,QAAQ;CACrD,QAAQ,WAAW,QAAQ;CAC3B,OAAO;AACR,CAAC;AAEF,MAAa,uBAAuB,EACnC,YACA,mBAIK,6BAA6B;CAAE,sBAAsB;CAAY;AAAa,CAAC;AAErF,MAAa,iBAAiB,EAC7B,YACA,cACA,YAMA,MAAM,KAAK,SACV,SAAS,iBAAiB,YAAY,IACnC,oBAAoB;CAAE;CAAY;AAAa,CAAC,IAChD,aAAa;CAAE;CAAY;AAAK,CAAC,CACrC"}

package/dist/auth/expiryCookies.js

@@ -0,0 +1,59 @@
+import { collectionBySlug } from "../ids.js";
+import { relationOf } from "../session/resolve.js";
+import { expireCookie, expirePayloadCookie } from "./cookies.js";
+import { isolatedCookieNameFor } from "./mode.js";
+//#region src/auth/expiryCookies.ts
+/**
+* Set-Cookie values for an absolute expiry. Parallel expiry does not clear the
+* shared impersonator token. Swap expiry does, because start overwrote it.
+*/
+const absoluteExpiryCookies = async ({ options, payload, row, sid, user }) => {
+	const impersonator = relationOf(row.impersonator);
+	const target = relationOf(row.target);
+	const isImpersonatorRequest = sid === row.impersonatorSid && sid !== row.targetSid;
+	const targetAuth = target ? collectionBySlug(payload, target.collection)?.config.auth : void 0;
+	const impersonatorAuth = impersonator && collectionBySlug(payload, impersonator.collection)?.config.auth || collectionBySlug(payload, payload.config.admin.user)?.config.auth;
+	const cookieAuth = targetAuth ?? impersonatorAuth;
+	if (!cookieAuth) return [];
+	const cookies = [expireCookie({
+		authConfig: cookieAuth,
+		name: options.hintCookieName
+	})];
+	if (row.mode === "parallel" && target && targetAuth) {
+		const slotUser = isImpersonatorRequest ? await findSlotUser(payload, target) : user;
+		const isolatedName = await isolatedCookieNameFor({
+			collection: target.collection,
+			payload,
+			user: slotUser
+		});
+		if (isolatedName) cookies.push(expireCookie({
+			authConfig: targetAuth,
+			name: isolatedName
+		}));
+		return cookies;
+	}
+	if (impersonatorAuth) cookies.push(expirePayloadCookie({
+		authConfig: impersonatorAuth,
+		cookiePrefix: payload.config.cookiePrefix
+	}));
+	return cookies;
+};
+const findSlotUser = async (payload, target) => {
+	try {
+		return await payload.findByID({
+			id: target.id,
+			collection: target.collection,
+			depth: 0,
+			overrideAccess: true
+		});
+	} catch {
+		return {
+			collection: target.collection,
+			id: target.id
+		};
+	}
+};
+//#endregion
+export { absoluteExpiryCookies };
+
+//# sourceMappingURL=expiryCookies.js.map

package/dist/auth/expiryCookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expiryCookies.js","names":[],"sources":["../../src/auth/expiryCookies.ts"],"sourcesContent":["import type { CollectionSlug, Payload, TypedUser } from 'payload'\n\nimport { collectionBySlug } from '../ids'\nimport { relationOf } from '../session/resolve'\nimport type { ImpersonationRecord, ResolvedOptions } from '../types'\nimport { expireCookie, expirePayloadCookie } from './cookies'\nimport { isolatedCookieNameFor } from './mode'\n\n/**\n * Set-Cookie values for an absolute expiry. Parallel expiry does not clear the\n * shared impersonator token. Swap expiry does, because start overwrote it.\n */\nexport const absoluteExpiryCookies = async ({\n\toptions,\n\tpayload,\n\trow,\n\tsid,\n\tuser,\n}: {\n\toptions: ResolvedOptions\n\tpayload: Payload\n\trow: ImpersonationRecord\n\tsid: string\n\tuser: TypedUser\n}): Promise<string[]> => {\n\tconst impersonator = relationOf(row.impersonator)\n\tconst target = relationOf(row.target)\n\tconst isImpersonatorRequest = sid === row.impersonatorSid && sid !== row.targetSid\n\tconst targetAuth = target ? collectionBySlug(payload, target.collection)?.config.auth : undefined\n\tconst impersonatorAuth =\n\t\t(impersonator && collectionBySlug(payload, impersonator.collection)?.config.auth) ||\n\t\tcollectionBySlug(payload, payload.config.admin.user)?.config.auth\n\tconst cookieAuth = targetAuth ?? impersonatorAuth\n\tif (!cookieAuth) {\n\t\treturn []\n\t}\n\n\tconst cookies = [expireCookie({ authConfig: cookieAuth, name: options.hintCookieName })]\n\n\tif (row.mode === 'parallel' && target && targetAuth) {\n\t\tconst slotUser = isImpersonatorRequest ? await findSlotUser(payload, target) : user\n\t\tconst isolatedName = await isolatedCookieNameFor({\n\t\t\tcollection: target.collection as CollectionSlug,\n\t\t\tpayload,\n\t\t\tuser: slotUser,\n\t\t})\n\t\tif (isolatedName) {\n\t\t\tcookies.push(expireCookie({ authConfig: targetAuth, name: isolatedName }))\n\t\t}\n\t\treturn cookies\n\t}\n\n\tif (impersonatorAuth) {\n\t\tcookies.push(\n\t\t\texpirePayloadCookie({\n\t\t\t\tauthConfig: impersonatorAuth,\n\t\t\t\tcookiePrefix: payload.config.cookiePrefix,\n\t\t\t})\n\t\t)\n\t}\n\treturn cookies\n}\n\nconst findSlotUser = async (\n\tpayload: Payload,\n\ttarget: { collection: string; id: number | string }\n): Promise<TypedUser> => {\n\ttry {\n\t\treturn (await payload.findByID({\n\t\t\tid: target.id,\n\t\t\tcollection: target.collection as CollectionSlug,\n\t\t\tdepth: 0,\n\t\t\toverrideAccess: true,\n\t\t})) as TypedUser\n\t} catch {\n\t\treturn { collection: target.collection, id: target.id } as TypedUser\n\t}\n}\n"],"mappings":";;;;;;;;;AAYA,MAAa,wBAAwB,OAAO,EAC3C,SACA,SACA,KACA,KACA,WAOwB;CACxB,MAAM,eAAe,WAAW,IAAI,YAAY;CAChD,MAAM,SAAS,WAAW,IAAI,MAAM;CACpC,MAAM,wBAAwB,QAAQ,IAAI,mBAAmB,QAAQ,IAAI;CACzE,MAAM,aAAa,SAAS,iBAAiB,SAAS,OAAO,UAAU,GAAG,OAAO,OAAO,KAAA;CACxF,MAAM,mBACJ,gBAAgB,iBAAiB,SAAS,aAAa,UAAU,GAAG,OAAO,QAC5E,iBAAiB,SAAS,QAAQ,OAAO,MAAM,IAAI,GAAG,OAAO;CAC9D,MAAM,aAAa,cAAc;CACjC,IAAI,CAAC,YACJ,OAAO,CAAC;CAGT,MAAM,UAAU,CAAC,aAAa;EAAE,YAAY;EAAY,MAAM,QAAQ;CAAe,CAAC,CAAC;CAEvF,IAAI,IAAI,SAAS,cAAc,UAAU,YAAY;EACpD,MAAM,WAAW,wBAAwB,MAAM,aAAa,SAAS,MAAM,IAAI;EAC/E,MAAM,eAAe,MAAM,sBAAsB;GAChD,YAAY,OAAO;GACnB;GACA,MAAM;EACP,CAAC;EACD,IAAI,cACH,QAAQ,KAAK,aAAa;GAAE,YAAY;GAAY,MAAM;EAAa,CAAC,CAAC;EAE1E,OAAO;CACR;CAEA,IAAI,kBACH,QAAQ,KACP,oBAAoB;EACnB,YAAY;EACZ,cAAc,QAAQ,OAAO;CAC9B,CAAC,CACF;CAED,OAAO;AACR;AAEA,MAAM,eAAe,OACpB,SACA,WACwB;CACxB,IAAI;EACH,OAAQ,MAAM,QAAQ,SAAS;GAC9B,IAAI,OAAO;GACX,YAAY,OAAO;GACnB,OAAO;GACP,gBAAgB;EACjB,CAAC;CACF,QAAQ;EACP,OAAO;GAAE,YAAY,OAAO;GAAY,IAAI,OAAO;EAAG;CACvD;AACD"}

package/dist/auth/issue.js

@@ -0,0 +1,126 @@
+import { sharedCookieName } from "./cookies.js";
+import { isolatedAuthCookie, resolveMode } from "./mode.js";
+import { IMPERSONATION_SID_PREFIX } from "../plugin/constants.js";
+import { getFieldsToSign, jwtSign } from "payload";
+import { generatePayloadCookie } from "payload/shared";
+//#region src/auth/issue.ts
+const tokenExpirationOf = (auth) => {
+	if (auth === true || auth === false) return 7200;
+	return auth.tokenExpiration ?? 7200;
+};
+/**
+* Mint a target session with a prefixed sid so decorateAuth can skip the DB
+* on requests that cannot be impersonation.
+*/
+const mintPrefixedSession = async ({ collection, collectionConfig, payload, raw, req }) => {
+	if (typeof collectionConfig.auth === "object" && collectionConfig.auth.useSessions === false) throw new Error(`@10x-media/impersonation: "${collection}" did not mint a session id (useSessions is off)`);
+	const now = /* @__PURE__ */ new Date();
+	const sid = `${IMPERSONATION_SID_PREFIX}${crypto.randomUUID()}`;
+	const sessions = [...(raw.sessions ?? []).filter((session) => new Date(session.expiresAt) > now), {
+		createdAt: now.toISOString(),
+		expiresAt: new Date(now.getTime() + tokenExpirationOf(collectionConfig.auth) * 1e3).toISOString(),
+		id: sid
+	}];
+	await payload.db.updateOne({
+		collection,
+		data: { sessions },
+		id: raw.id,
+		req,
+		returning: false
+	});
+	raw.sessions = sessions;
+	return sid;
+};
+const issueSession = async ({ collection, payload, req, userId }) => {
+	const registered = payload.collections[collection];
+	if (!registered) throw new Error(`@10x-media/impersonation: collection "${collection}" is not registered`);
+	const collectionConfig = registered.config;
+	const raw = await payload.db.findOne({
+		collection,
+		req,
+		where: { id: { equals: userId } }
+	});
+	if (!raw) throw new Error(`@10x-media/impersonation: target ${collection}/${userId} was not found`);
+	raw.collection = collectionConfig.slug;
+	const sid = await mintPrefixedSession({
+		collection,
+		collectionConfig,
+		payload,
+		raw,
+		req
+	});
+	const { exp, token } = await jwtSign({
+		fieldsToSign: getFieldsToSign({
+			collectionConfig,
+			email: raw.email ?? "",
+			sid,
+			user: raw
+		}),
+		secret: payload.secret,
+		tokenExpiration: tokenExpirationOf(collectionConfig.auth)
+	});
+	const { cookieName, isolated } = await resolveMode({
+		collection,
+		payload,
+		user: raw
+	});
+	return {
+		cookie: isolated ? await isolatedAuthCookie({
+			collection,
+			payload,
+			token,
+			user: raw
+		}) ?? generatePayloadCookie({
+			collectionAuthConfig: collectionConfig.auth,
+			cookiePrefix: payload.config.cookiePrefix,
+			token
+		}) : generatePayloadCookie({
+			collectionAuthConfig: collectionConfig.auth,
+			cookiePrefix: payload.config.cookiePrefix,
+			token
+		}),
+		cookieName: isolated ? cookieName : sharedCookieName(payload.config.cookiePrefix),
+		exp,
+		mode: isolated ? "parallel" : "swap",
+		sid,
+		token,
+		user: raw
+	};
+};
+const resignSession = async ({ collection, payload, req, sid, userId }) => {
+	const registered = payload.collections[collection];
+	if (!registered) return null;
+	const collectionConfig = registered.config;
+	const raw = await payload.db.findOne({
+		collection,
+		req,
+		where: { id: { equals: userId } }
+	});
+	if (!raw) return null;
+	const session = (raw.sessions ?? []).find((entry) => entry.id === sid);
+	if (!session) return null;
+	if (new Date(session.expiresAt).getTime() <= Date.now()) return null;
+	const { exp, token } = await jwtSign({
+		fieldsToSign: getFieldsToSign({
+			collectionConfig,
+			email: raw.email ?? "",
+			sid,
+			user: raw
+		}),
+		secret: payload.secret,
+		tokenExpiration: tokenExpirationOf(collectionConfig.auth)
+	});
+	return {
+		cookie: generatePayloadCookie({
+			collectionAuthConfig: collectionConfig.auth,
+			cookiePrefix: payload.config.cookiePrefix,
+			token
+		}),
+		exp,
+		token
+	};
+};
+//#endregion
+export { issueSession, resignSession };
+
+//# sourceMappingURL=issue.js.map

package/dist/auth/issue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue.js","names":[],"sources":["../../src/auth/issue.ts"],"sourcesContent":["import type { CollectionSlug, Payload, PayloadRequest, TypedUser } from 'payload'\nimport { getFieldsToSign, jwtSign } from 'payload'\nimport { generatePayloadCookie } from 'payload/shared'\n\nimport { IMPERSONATION_SID_PREFIX } from '../plugin/constants'\nimport type { IssuedSession, SessionIssueArgs } from '../types'\nimport { sharedCookieName } from './cookies'\nimport { isolatedAuthCookie, resolveMode } from './mode'\n\ntype RawUser = TypedUser & {\n\temail?: string\n\tsessions?: { createdAt?: null | string; expiresAt: string; id: string }[] | null\n}\n\nconst tokenExpirationOf = (auth: boolean | { tokenExpiration?: number; useSessions?: boolean }) => {\n\tif (auth === true || auth === false) {\n\t\treturn 7200\n\t}\n\treturn auth.tokenExpiration ?? 7200\n}\n\n/**\n * Mint a target session with a prefixed sid so decorateAuth can skip the DB\n * on requests that cannot be impersonation.\n */\nconst mintPrefixedSession = async ({\n\tcollection,\n\tcollectionConfig,\n\tpayload,\n\traw,\n\treq,\n}: {\n\tcollection: CollectionSlug\n\tcollectionConfig: { auth: boolean | { tokenExpiration?: number; useSessions?: boolean } }\n\tpayload: Payload\n\traw: RawUser\n\treq: PayloadRequest\n}): Promise<string> => {\n\tif (typeof collectionConfig.auth === 'object' && collectionConfig.auth.useSessions === false) {\n\t\tthrow new Error(\n\t\t\t`@10x-media/impersonation: \"${collection}\" did not mint a session id (useSessions is off)`\n\t\t)\n\t}\n\n\tconst now = new Date()\n\tconst sid = `${IMPERSONATION_SID_PREFIX}${crypto.randomUUID()}`\n\tconst sessions = [\n\t\t...(raw.sessions ?? []).filter((session) => new Date(session.expiresAt) > now),\n\t\t{\n\t\t\tcreatedAt: now.toISOString(),\n\t\t\texpiresAt: new Date(\n\t\t\t\tnow.getTime() + tokenExpirationOf(collectionConfig.auth) * 1000\n\t\t\t).toISOString(),\n\t\t\tid: sid,\n\t\t},\n\t]\n\tawait payload.db.updateOne({\n\t\tcollection,\n\t\tdata: { sessions },\n\t\tid: raw.id,\n\t\treq,\n\t\treturning: false,\n\t})\n\traw.sessions = sessions as RawUser['sessions']\n\treturn sid\n}\n\nexport const issueSession = async ({\n\tcollection,\n\tpayload,\n\treq,\n\tuserId,\n}: SessionIssueArgs): Promise<IssuedSession> => {\n\tconst registered = payload.collections[collection]\n\tif (!registered) {\n\t\tthrow new Error(`@10x-media/impersonation: collection \"${collection}\" is not registered`)\n\t}\n\n\tconst collectionConfig = registered.config\n\tconst raw = (await payload.db.findOne({\n\t\tcollection: collection as CollectionSlug,\n\t\treq,\n\t\twhere: { id: { equals: userId } },\n\t})) as null | RawUser\n\n\tif (!raw) {\n\t\tthrow new Error(`@10x-media/impersonation: target ${collection}/${userId} was not found`)\n\t}\n\n\traw.collection = collectionConfig.slug as TypedUser['collection']\n\tconst sid = await mintPrefixedSession({\n\t\tcollection: collection as CollectionSlug,\n\t\tcollectionConfig,\n\t\tpayload,\n\t\traw,\n\t\treq,\n\t})\n\n\tconst fieldsToSign = getFieldsToSign({\n\t\tcollectionConfig,\n\t\temail: raw.email ?? '',\n\t\tsid,\n\t\tuser: raw,\n\t})\n\tconst { exp, token } = await jwtSign({\n\t\tfieldsToSign,\n\t\tsecret: payload.secret,\n\t\ttokenExpiration: tokenExpirationOf(collectionConfig.auth),\n\t})\n\n\tconst { cookieName, isolated } = await resolveMode({ collection, payload, user: raw })\n\tconst cookie = isolated\n\t\t? ((await isolatedAuthCookie({ collection, payload, token, user: raw })) ??\n\t\t\tgeneratePayloadCookie({\n\t\t\t\tcollectionAuthConfig: collectionConfig.auth,\n\t\t\t\tcookiePrefix: payload.config.cookiePrefix,\n\t\t\t\ttoken,\n\t\t\t}))\n\t\t: generatePayloadCookie({\n\t\t\t\tcollectionAuthConfig: collectionConfig.auth,\n\t\t\t\tcookiePrefix: payload.config.cookiePrefix,\n\t\t\t\ttoken,\n\t\t\t})\n\n\treturn {\n\t\tcookie,\n\t\tcookieName: isolated ? cookieName : sharedCookieName(payload.config.cookiePrefix),\n\t\texp,\n\t\tmode: isolated ? 'parallel' : 'swap',\n\t\tsid,\n\t\ttoken,\n\t\tuser: raw,\n\t}\n}\n\nexport const resignSession = async ({\n\tcollection,\n\tpayload,\n\treq,\n\tsid,\n\tuserId,\n}: {\n\tcollection: CollectionSlug\n\tpayload: Payload\n\treq: PayloadRequest\n\tsid: string\n\tuserId: number | string\n}): Promise<{ cookie: string; exp: number; token: string } | null> => {\n\tconst registered = payload.collections[collection]\n\tif (!registered) {\n\t\treturn null\n\t}\n\n\tconst collectionConfig = registered.config\n\tconst raw = (await payload.db.findOne({\n\t\tcollection: collection as CollectionSlug,\n\t\treq,\n\t\twhere: { id: { equals: userId } },\n\t})) as null | RawUser\n\n\tif (!raw) {\n\t\treturn null\n\t}\n\n\tconst session = (raw.sessions ?? []).find((entry) => entry.id === sid)\n\tif (!session) {\n\t\treturn null\n\t}\n\n\tconst expiresAt = new Date(session.expiresAt as Date | string)\n\tif (expiresAt.getTime() <= Date.now()) {\n\t\treturn null\n\t}\n\n\tconst fieldsToSign = getFieldsToSign({\n\t\tcollectionConfig,\n\t\temail: raw.email ?? '',\n\t\tsid,\n\t\tuser: raw,\n\t})\n\tconst { exp, token } = await jwtSign({\n\t\tfieldsToSign,\n\t\tsecret: payload.secret,\n\t\ttokenExpiration: tokenExpirationOf(collectionConfig.auth),\n\t})\n\n\treturn {\n\t\tcookie: generatePayloadCookie({\n\t\t\tcollectionAuthConfig: collectionConfig.auth,\n\t\t\tcookiePrefix: payload.config.cookiePrefix,\n\t\t\ttoken,\n\t\t}),\n\t\texp,\n\t\ttoken,\n\t}\n}\n"],"mappings":";;;;;;AAcA,MAAM,qBAAqB,SAAwE;CAClG,IAAI,SAAS,QAAQ,SAAS,OAC7B,OAAO;CAER,OAAO,KAAK,mBAAmB;AAChC;;;;;AAMA,MAAM,sBAAsB,OAAO,EAClC,YACA,kBACA,SACA,KACA,UAOsB;CACtB,IAAI,OAAO,iBAAiB,SAAS,YAAY,iBAAiB,KAAK,gBAAgB,OACtF,MAAM,IAAI,MACT,8BAA8B,WAAW,iDAC1C;CAGD,MAAM,sBAAM,IAAI,KAAK;CACrB,MAAM,MAAM,GAAG,2BAA2B,OAAO,WAAW;CAC5D,MAAM,WAAW,CAChB,IAAI,IAAI,YAAY,CAAC,GAAG,QAAQ,YAAY,IAAI,KAAK,QAAQ,SAAS,IAAI,GAAG,GAC7E;EACC,WAAW,IAAI,YAAY;EAC3B,WAAW,IAAI,KACd,IAAI,QAAQ,IAAI,kBAAkB,iBAAiB,IAAI,IAAI,GAC5D,EAAE,YAAY;EACd,IAAI;CACL,CACD;CACA,MAAM,QAAQ,GAAG,UAAU;EAC1B;EACA,MAAM,EAAE,SAAS;EACjB,IAAI,IAAI;EACR;EACA,WAAW;CACZ,CAAC;CACD,IAAI,WAAW;CACf,OAAO;AACR;AAEA,MAAa,eAAe,OAAO,EAClC,YACA,SACA,KACA,aAC+C;CAC/C,MAAM,aAAa,QAAQ,YAAY;CACvC,IAAI,CAAC,YACJ,MAAM,IAAI,MAAM,yCAAyC,WAAW,oBAAoB;CAGzF,MAAM,mBAAmB,WAAW;CACpC,MAAM,MAAO,MAAM,QAAQ,GAAG,QAAQ;EACzB;EACZ;EACA,OAAO,EAAE,IAAI,EAAE,QAAQ,OAAO,EAAE;CACjC,CAAC;CAED,IAAI,CAAC,KACJ,MAAM,IAAI,MAAM,oCAAoC,WAAW,GAAG,OAAO,eAAe;CAGzF,IAAI,aAAa,iBAAiB;CAClC,MAAM,MAAM,MAAM,oBAAoB;EACzB;EACZ;EACA;EACA;EACA;CACD,CAAC;CAQD,MAAM,EAAE,KAAK,UAAU,MAAM,QAAQ;EACpC,cAPoB,gBAAgB;GACpC;GACA,OAAO,IAAI,SAAS;GACpB;GACA,MAAM;EACP,CAEY;EACX,QAAQ,QAAQ;EAChB,iBAAiB,kBAAkB,iBAAiB,IAAI;CACzD,CAAC;CAED,MAAM,EAAE,YAAY,aAAa,MAAM,YAAY;EAAE;EAAY;EAAS,MAAM;CAAI,CAAC;CAcrF,OAAO;EACN,QAdc,WACV,MAAM,mBAAmB;GAAE;GAAY;GAAS;GAAO,MAAM;EAAI,CAAC,KACrE,sBAAsB;GACrB,sBAAsB,iBAAiB;GACvC,cAAc,QAAQ,OAAO;GAC7B;EACD,CAAC,IACA,sBAAsB;GACtB,sBAAsB,iBAAiB;GACvC,cAAc,QAAQ,OAAO;GAC7B;EACD,CAAC;EAIF,YAAY,WAAW,aAAa,iBAAiB,QAAQ,OAAO,YAAY;EAChF;EACA,MAAM,WAAW,aAAa;EAC9B;EACA;EACA,MAAM;CACP;AACD;AAEA,MAAa,gBAAgB,OAAO,EACnC,YACA,SACA,KACA,KACA,aAOqE;CACrE,MAAM,aAAa,QAAQ,YAAY;CACvC,IAAI,CAAC,YACJ,OAAO;CAGR,MAAM,mBAAmB,WAAW;CACpC,MAAM,MAAO,MAAM,QAAQ,GAAG,QAAQ;EACzB;EACZ;EACA,OAAO,EAAE,IAAI,EAAE,QAAQ,OAAO,EAAE;CACjC,CAAC;CAED,IAAI,CAAC,KACJ,OAAO;CAGR,MAAM,WAAW,IAAI,YAAY,CAAC,GAAG,MAAM,UAAU,MAAM,OAAO,GAAG;CACrE,IAAI,CAAC,SACJ,OAAO;CAIR,IAAI,IADkB,KAAK,QAAQ,SACvB,EAAE,QAAQ,KAAK,KAAK,IAAI,GACnC,OAAO;CASR,MAAM,EAAE,KAAK,UAAU,MAAM,QAAQ;EACpC,cAPoB,gBAAgB;GACpC;GACA,OAAO,IAAI,SAAS;GACpB;GACA,MAAM;EACP,CAEY;EACX,QAAQ,QAAQ;EAChB,iBAAiB,kBAAkB,iBAAiB,IAAI;CACzD,CAAC;CAED,OAAO;EACN,QAAQ,sBAAsB;GAC7B,sBAAsB,iBAAiB;GACvC,cAAc,QAAQ,OAAO;GAC7B;EACD,CAAC;EACD;EACA;CACD;AACD"}

package/dist/auth/mode.js

@@ -0,0 +1,69 @@
+import { sharedCookieName } from "./cookies.js";
+//#region src/auth/mode.ts
+const loadDualSession = async () => {
+	try {
+		const mod = await import("@10x-media/dual-session");
+		return {
+			generateIsolatedAuthCookie: mod.generateIsolatedAuthCookie,
+			resolveIsolatedCookieName: mod.resolveIsolatedCookieName
+		};
+	} catch {
+		return null;
+	}
+};
+/**
+* Parallel only when dual-session isolated this user onto a cookie other than
+* the shared `${cookiePrefix}-token`. A role-split collection returns the shared
+* name for some users, which is swap.
+*/
+const resolveMode = async ({ collection, payload, user }) => {
+	const shared = sharedCookieName(payload.config.cookiePrefix);
+	const dual = await loadDualSession();
+	if (!dual) return {
+		cookieName: shared,
+		isolated: false
+	};
+	try {
+		const name = dual.resolveIsolatedCookieName({
+			collection,
+			payload,
+			user
+		});
+		if (name && name !== shared) return {
+			cookieName: name,
+			isolated: true
+		};
+	} catch {
+		return {
+			cookieName: shared,
+			isolated: false
+		};
+	}
+	return {
+		cookieName: shared,
+		isolated: false
+	};
+};
+/** Isolated cookie name for this user, or undefined when mode is swap. */
+const isolatedCookieNameFor = async (args) => {
+	const { cookieName, isolated } = await resolveMode(args);
+	return isolated ? cookieName : void 0;
+};
+const isolatedAuthCookie = async ({ collection, payload, token, user }) => {
+	const dual = await loadDualSession();
+	if (!dual) return;
+	try {
+		return dual.generateIsolatedAuthCookie({
+			collection,
+			payload,
+			token,
+			user
+		});
+	} catch {
+		return;
+	}
+};
+//#endregion
+export { isolatedAuthCookie, isolatedCookieNameFor, resolveMode };
+
+//# sourceMappingURL=mode.js.map

package/dist/auth/mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode.js","names":[],"sources":["../../src/auth/mode.ts"],"sourcesContent":["import type { CollectionSlug, Payload, TypedUser } from 'payload'\n\nimport { sharedCookieName } from './cookies'\n\nexport type DualSessionHelpers = {\n\tgenerateIsolatedAuthCookie: (args: {\n\t\tcollection: CollectionSlug\n\t\tpayload: Payload\n\t\ttoken: string\n\t\tuser?: null | TypedUser\n\t}) => string\n\tresolveIsolatedCookieName: (args: {\n\t\tcollection: CollectionSlug\n\t\tpayload: Payload\n\t\tuser?: null | TypedUser\n\t}) => string | undefined\n}\n\nconst loadDualSession = async (): Promise<DualSessionHelpers | null> => {\n\ttry {\n\t\tconst mod = await import('@10x-media/dual-session')\n\t\treturn {\n\t\t\tgenerateIsolatedAuthCookie: mod.generateIsolatedAuthCookie,\n\t\t\tresolveIsolatedCookieName: mod.resolveIsolatedCookieName,\n\t\t}\n\t} catch {\n\t\treturn null\n\t}\n}\n\n/**\n * Parallel only when dual-session isolated this user onto a cookie other than\n * the shared `${cookiePrefix}-token`. A role-split collection returns the shared\n * name for some users, which is swap.\n */\nexport const resolveMode = async ({\n\tcollection,\n\tpayload,\n\tuser,\n}: {\n\tcollection: CollectionSlug\n\tpayload: Payload\n\tuser: TypedUser\n}): Promise<{ cookieName: string; isolated: boolean }> => {\n\tconst shared = sharedCookieName(payload.config.cookiePrefix)\n\tconst dual = await loadDualSession()\n\tif (!dual) {\n\t\treturn { cookieName: shared, isolated: false }\n\t}\n\n\ttry {\n\t\tconst name = dual.resolveIsolatedCookieName({ collection, payload, user })\n\t\tif (name && name !== shared) {\n\t\t\treturn { cookieName: name, isolated: true }\n\t\t}\n\t} catch {\n\t\treturn { cookieName: shared, isolated: false }\n\t}\n\n\treturn { cookieName: shared, isolated: false }\n}\n\n/** Isolated cookie name for this user, or undefined when mode is swap. */\nexport const isolatedCookieNameFor = async (args: {\n\tcollection: CollectionSlug\n\tpayload: Payload\n\tuser: TypedUser\n}): Promise<string | undefined> => {\n\tconst { cookieName, isolated } = await resolveMode(args)\n\treturn isolated ? cookieName : undefined\n}\n\nexport const isolatedAuthCookie = async ({\n\tcollection,\n\tpayload,\n\ttoken,\n\tuser,\n}: {\n\tcollection: CollectionSlug\n\tpayload: Payload\n\ttoken: string\n\tuser: TypedUser\n}): Promise<string | undefined> => {\n\tconst dual = await loadDualSession()\n\tif (!dual) {\n\t\treturn undefined\n\t}\n\ttry {\n\t\treturn dual.generateIsolatedAuthCookie({ collection, payload, token, user })\n\t} catch {\n\t\treturn undefined\n\t}\n}\n"],"mappings":";;AAkBA,MAAM,kBAAkB,YAAgD;CACvE,IAAI;EACH,MAAM,MAAM,MAAM,OAAO;EACzB,OAAO;GACN,4BAA4B,IAAI;GAChC,2BAA2B,IAAI;EAChC;CACD,QAAQ;EACP,OAAO;CACR;AACD;;;;;;AAOA,MAAa,cAAc,OAAO,EACjC,YACA,SACA,WAKyD;CACzD,MAAM,SAAS,iBAAiB,QAAQ,OAAO,YAAY;CAC3D,MAAM,OAAO,MAAM,gBAAgB;CACnC,IAAI,CAAC,MACJ,OAAO;EAAE,YAAY;EAAQ,UAAU;CAAM;CAG9C,IAAI;EACH,MAAM,OAAO,KAAK,0BAA0B;GAAE;GAAY;GAAS;EAAK,CAAC;EACzE,IAAI,QAAQ,SAAS,QACpB,OAAO;GAAE,YAAY;GAAM,UAAU;EAAK;CAE5C,QAAQ;EACP,OAAO;GAAE,YAAY;GAAQ,UAAU;EAAM;CAC9C;CAEA,OAAO;EAAE,YAAY;EAAQ,UAAU;CAAM;AAC9C;;AAGA,MAAa,wBAAwB,OAAO,SAIT;CAClC,MAAM,EAAE,YAAY,aAAa,MAAM,YAAY,IAAI;CACvD,OAAO,WAAW,aAAa,KAAA;AAChC;AAEA,MAAa,qBAAqB,OAAO,EACxC,YACA,SACA,OACA,WAMkC;CAClC,MAAM,OAAO,MAAM,gBAAgB;CACnC,IAAI,CAAC,MACJ;CAED,IAAI;EACH,OAAO,KAAK,2BAA2B;GAAE;GAAY;GAAS;GAAO;EAAK,CAAC;CAC5E,QAAQ;EACP;CACD;AACD"}

package/dist/auth/origin.js

@@ -0,0 +1,55 @@
+//#region src/auth/origin.ts
+/**
+* Cookie POSTs that start, exit, or end a session must be same-origin. This is
+* deliberately stricter than Payload's `extractJWT` cookie CSRF gate and than
+* dual-session's `isCookieAuthAllowed`: `same-site` is denied so a subdomain XSS
+* cannot start an impersonation. JWT/Bearer skip this gate only when that
+* scheme ranks before `cookie` and the header carries a non-empty token. An
+* empty `JWT ` / `Bearer ` prefix must not skip: Payload then authenticates
+* the cookie.
+*
+* Never reads `X-Forwarded-Host` or `X-Forwarded-Proto`.
+*/
+const verifyMutationOrigin = ({ headers, options, payload }) => {
+	const authorization = headers.get("Authorization") ?? "";
+	const jwtOrder = payload.config.auth?.jwtOrder ?? [
+		"JWT",
+		"Bearer",
+		"cookie"
+	];
+	const cookieRank = jwtOrder.indexOf("cookie");
+	const ranksBeforeCookie = (scheme) => {
+		const rank = jwtOrder.indexOf(scheme);
+		return rank !== -1 && (cookieRank === -1 || rank < cookieRank);
+	};
+	const headerToken = (scheme) => {
+		const prefix = `${scheme} `;
+		if (!authorization.startsWith(prefix)) return "";
+		return authorization.slice(prefix.length).trim();
+	};
+	if (headerToken("JWT") && ranksBeforeCookie("JWT")) return true;
+	if (headerToken("Bearer") && ranksBeforeCookie("Bearer")) return true;
+	const secFetchSite = headers.get("Sec-Fetch-Site");
+	if (secFetchSite === "cross-site" || secFetchSite === "same-site") return false;
+	if (secFetchSite === "same-origin") return true;
+	const origin = headers.get("Origin");
+	if (!origin) return false;
+	const allowlist = [...new Set([
+		payload.config.serverURL,
+		...payload.config.csrf ?? [],
+		...options.security.trustedOrigins
+	].filter((value) => Boolean(value)))];
+	if (allowlist.length > 0) return allowlist.includes(origin);
+	try {
+		return new URL(origin).host === (headers.get("host") ?? "");
+	} catch {
+		return false;
+	}
+};
+const isJsonContentType = (headers) => {
+	return (headers.get("content-type") ?? "").toLowerCase().includes("application/json");
+};
+//#endregion
+export { isJsonContentType, verifyMutationOrigin };
+
+//# sourceMappingURL=origin.js.map

package/dist/auth/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.js","names":[],"sources":["../../src/auth/origin.ts"],"sourcesContent":["import type { Payload } from 'payload'\n\nimport type { ResolvedOptions } from '../types'\n\n/**\n * Cookie POSTs that start, exit, or end a session must be same-origin. This is\n * deliberately stricter than Payload's `extractJWT` cookie CSRF gate and than\n * dual-session's `isCookieAuthAllowed`: `same-site` is denied so a subdomain XSS\n * cannot start an impersonation. JWT/Bearer skip this gate only when that\n * scheme ranks before `cookie` and the header carries a non-empty token. An\n * empty `JWT ` / `Bearer ` prefix must not skip: Payload then authenticates\n * the cookie.\n *\n * Never reads `X-Forwarded-Host` or `X-Forwarded-Proto`.\n */\nexport const verifyMutationOrigin = ({\n\theaders,\n\toptions,\n\tpayload,\n}: {\n\theaders: Headers\n\toptions: Pick<ResolvedOptions, 'security'>\n\tpayload: Payload\n}): boolean => {\n\tconst authorization = headers.get('Authorization') ?? ''\n\tconst jwtOrder = payload.config.auth?.jwtOrder ?? ['JWT', 'Bearer', 'cookie']\n\tconst cookieRank = jwtOrder.indexOf('cookie')\n\tconst ranksBeforeCookie = (scheme: 'Bearer' | 'JWT') => {\n\t\tconst rank = jwtOrder.indexOf(scheme)\n\t\treturn rank !== -1 && (cookieRank === -1 || rank < cookieRank)\n\t}\n\tconst headerToken = (scheme: 'Bearer' | 'JWT') => {\n\t\tconst prefix = `${scheme} `\n\t\tif (!authorization.startsWith(prefix)) {\n\t\t\treturn ''\n\t\t}\n\t\treturn authorization.slice(prefix.length).trim()\n\t}\n\n\tif (headerToken('JWT') && ranksBeforeCookie('JWT')) {\n\t\treturn true\n\t}\n\tif (headerToken('Bearer') && ranksBeforeCookie('Bearer')) {\n\t\treturn true\n\t}\n\n\tconst secFetchSite = headers.get('Sec-Fetch-Site')\n\tif (secFetchSite === 'cross-site' || secFetchSite === 'same-site') {\n\t\treturn false\n\t}\n\tif (secFetchSite === 'same-origin') {\n\t\treturn true\n\t}\n\n\tconst origin = headers.get('Origin')\n\tif (!origin) {\n\t\treturn false\n\t}\n\n\tconst allowlist = [\n\t\t...new Set(\n\t\t\t[\n\t\t\t\tpayload.config.serverURL,\n\t\t\t\t...(payload.config.csrf ?? []),\n\t\t\t\t...options.security.trustedOrigins,\n\t\t\t].filter((value): value is string => Boolean(value))\n\t\t),\n\t]\n\n\tif (allowlist.length > 0) {\n\t\treturn allowlist.includes(origin)\n\t}\n\n\ttry {\n\t\treturn new URL(origin).host === (headers.get('host') ?? '')\n\t} catch {\n\t\treturn false\n\t}\n}\n\nexport const isJsonContentType = (headers: Headers): boolean => {\n\tconst value = headers.get('content-type') ?? ''\n\treturn value.toLowerCase().includes('application/json')\n}\n"],"mappings":";;;;;;;;;;;;AAeA,MAAa,wBAAwB,EACpC,SACA,SACA,cAKc;CACd,MAAM,gBAAgB,QAAQ,IAAI,eAAe,KAAK;CACtD,MAAM,WAAW,QAAQ,OAAO,MAAM,YAAY;EAAC;EAAO;EAAU;CAAQ;CAC5E,MAAM,aAAa,SAAS,QAAQ,QAAQ;CAC5C,MAAM,qBAAqB,WAA6B;EACvD,MAAM,OAAO,SAAS,QAAQ,MAAM;EACpC,OAAO,SAAS,OAAO,eAAe,MAAM,OAAO;CACpD;CACA,MAAM,eAAe,WAA6B;EACjD,MAAM,SAAS,GAAG,OAAO;EACzB,IAAI,CAAC,cAAc,WAAW,MAAM,GACnC,OAAO;EAER,OAAO,cAAc,MAAM,OAAO,MAAM,EAAE,KAAK;CAChD;CAEA,IAAI,YAAY,KAAK,KAAK,kBAAkB,KAAK,GAChD,OAAO;CAER,IAAI,YAAY,QAAQ,KAAK,kBAAkB,QAAQ,GACtD,OAAO;CAGR,MAAM,eAAe,QAAQ,IAAI,gBAAgB;CACjD,IAAI,iBAAiB,gBAAgB,iBAAiB,aACrD,OAAO;CAER,IAAI,iBAAiB,eACpB,OAAO;CAGR,MAAM,SAAS,QAAQ,IAAI,QAAQ;CACnC,IAAI,CAAC,QACJ,OAAO;CAGR,MAAM,YAAY,CACjB,GAAG,IAAI,IACN;EACC,QAAQ,OAAO;EACf,GAAI,QAAQ,OAAO,QAAQ,CAAC;EAC5B,GAAG,QAAQ,SAAS;CACrB,EAAE,QAAQ,UAA2B,QAAQ,KAAK,CAAC,CACpD,CACD;CAEA,IAAI,UAAU,SAAS,GACtB,OAAO,UAAU,SAAS,MAAM;CAGjC,IAAI;EACH,OAAO,IAAI,IAAI,MAAM,EAAE,UAAU,QAAQ,IAAI,MAAM,KAAK;CACzD,QAAQ;EACP,OAAO;CACR;AACD;AAEA,MAAa,qBAAqB,YAA8B;CAE/D,QADc,QAAQ,IAAI,cAAc,KAAK,IAChC,YAAY,EAAE,SAAS,kBAAkB;AACvD"}

package/dist/auth/revoke.js

@@ -0,0 +1,24 @@
+//#region src/auth/revoke.ts
+const revokeSession = async ({ collection, payload, req, sid, userId }) => {
+	const raw = await payload.db.findOne({
+		collection,
+		req,
+		where: { id: { equals: userId } }
+	});
+	if (!raw?.sessions?.length) return;
+	const sessions = raw.sessions.filter((session) => session.id !== sid);
+	await payload.db.updateOne({
+		id: raw.id,
+		collection,
+		data: {
+			sessions,
+			updatedAt: null
+		},
+		req,
+		returning: false
+	});
+};
+//#endregion
+export { revokeSession };
+
+//# sourceMappingURL=revoke.js.map

package/dist/auth/revoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.js","names":[],"sources":["../../src/auth/revoke.ts"],"sourcesContent":["import type { CollectionSlug, PayloadRequest } from 'payload'\n\nimport type { SessionRevokeArgs } from '../types'\n\ntype SessionEntry = { id: string }\n\nexport const revokeSession = async ({\n\tcollection,\n\tpayload,\n\treq,\n\tsid,\n\tuserId,\n}: SessionRevokeArgs): Promise<void> => {\n\tconst raw = (await payload.db.findOne({\n\t\tcollection: collection as CollectionSlug,\n\t\treq,\n\t\twhere: { id: { equals: userId } },\n\t})) as { id: number | string; sessions?: SessionEntry[] } | null\n\n\tif (!raw?.sessions?.length) {\n\t\treturn\n\t}\n\n\tconst sessions = raw.sessions.filter((session) => session.id !== sid)\n\tawait payload.db.updateOne({\n\t\tid: raw.id,\n\t\tcollection: collection as CollectionSlug,\n\t\tdata: { sessions, updatedAt: null },\n\t\treq: req as PayloadRequest,\n\t\treturning: false,\n\t})\n}\n"],"mappings":";AAMA,MAAa,gBAAgB,OAAO,EACnC,YACA,SACA,KACA,KACA,aACuC;CACvC,MAAM,MAAO,MAAM,QAAQ,GAAG,QAAQ;EACzB;EACZ;EACA,OAAO,EAAE,IAAI,EAAE,QAAQ,OAAO,EAAE;CACjC,CAAC;CAED,IAAI,CAAC,KAAK,UAAU,QACnB;CAGD,MAAM,WAAW,IAAI,SAAS,QAAQ,YAAY,QAAQ,OAAO,GAAG;CACpE,MAAM,QAAQ,GAAG,UAAU;EAC1B,IAAI,IAAI;EACI;EACZ,MAAM;GAAE;GAAU,WAAW;EAAK;EAC7B;EACL,WAAW;CACZ,CAAC;AACF"}