@10x-media/impersonation 0.1.0-beta.0

package/dist/ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.js","names":[],"sources":["../src/ids.ts"],"sourcesContent":["import type { CollectionSlug, Payload } from 'payload'\n\nimport type { UserLabel } from './types'\n\n/** Payload ids are strings on Mongo and numbers on Postgres; compare as text. */\nexport const idsEqual = (a: unknown, b: unknown): boolean =>\n\ta != null && b != null && String(a) === String(b)\n\nexport const asId = (value: unknown): number | string | null => {\n\tif (typeof value === 'number' && Number.isFinite(value)) {\n\t\treturn value\n\t}\n\tif (typeof value === 'string' && value.length > 0) {\n\t\treturn value\n\t}\n\treturn null\n}\n\n/** Index `payload.collections` with a runtime slug. Generated types are a closed Record. */\nexport const collectionBySlug = (payload: Payload, slug: string) =>\n\tpayload.collections[slug as CollectionSlug]\n\n/**\n * Display name for a user doc: its collection's `useAsTitle` value, else the\n * email. Snapshotted on the session row so every surface shows the same name.\n */\nexport const userTitle = (\n\tpayload: Payload,\n\tslug: string,\n\tdoc: null | Record<string, unknown> | undefined\n): string | undefined => {\n\tconst field = collectionBySlug(payload, slug)?.config.admin?.useAsTitle\n\tconst value = field && field !== 'id' ? doc?.[field] : undefined\n\tif (typeof value === 'string' && value.trim()) {\n\t\treturn value.trim()\n\t}\n\tif (typeof value === 'number') {\n\t\treturn String(value)\n\t}\n\treturn typeof doc?.email === 'string' && doc.email ? doc.email : undefined\n}\n\n/** Pick the snapshotted title or email per `ui.userLabel`; either falls back to the other. */\nexport const labelUser = (\n\tmode: UserLabel,\n\tuser: { email?: null | string; title?: null | string }\n): string | undefined =>\n\t(mode === 'email' ? user.email || user.title : user.title || user.email) || undefined\n"],"mappings":";;AAKA,MAAa,YAAY,GAAY,MACpC,KAAK,QAAQ,KAAK,QAAQ,OAAO,CAAC,MAAM,OAAO,CAAC;AAEjD,MAAa,QAAQ,UAA2C;CAC/D,IAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GACrD,OAAO;CAER,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAC/C,OAAO;CAER,OAAO;AACR;;AAGA,MAAa,oBAAoB,SAAkB,SAClD,QAAQ,YAAY;;;;;AAMrB,MAAa,aACZ,SACA,MACA,QACwB;CACxB,MAAM,QAAQ,iBAAiB,SAAS,IAAI,GAAG,OAAO,OAAO;CAC7D,MAAM,QAAQ,SAAS,UAAU,OAAO,MAAM,SAAS,KAAA;CACvD,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,GAC3C,OAAO,MAAM,KAAK;CAEnB,IAAI,OAAO,UAAU,UACpB,OAAO,OAAO,KAAK;CAEpB,OAAO,OAAO,KAAK,UAAU,YAAY,IAAI,QAAQ,IAAI,QAAQ,KAAA;AAClE;;AAGA,MAAa,aACZ,MACA,UAEC,SAAS,UAAU,KAAK,SAAS,KAAK,QAAQ,KAAK,SAAS,KAAK,UAAU,KAAA"}

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+import { ImpersonationPluginOptions } from "./types.js";
+import { ImpersonationStatus, getImpersonation } from "./getImpersonation.js";
+import { closeStaleImpersonations } from "./session/closeStale.js";
+import { PLUGIN_SLUG } from "./plugin/constants.js";
+
+//#region src/index.d.ts
+declare module 'payload' {
+  interface RegisteredPlugins {
+    '@10x-media/impersonation': ImpersonationPluginOptions;
+  }
+}
+/**
+ * Let an authorised account sign in as another user without their password.
+ * After start, `req.user` is the target. Every session is a closed-never-deleted
+ * row. Access is always a host function; the plugin never compares roles.
+ */
+declare const impersonation: (options: ImpersonationPluginOptions) => import("payload").Plugin;
+//#endregion
+export { type ImpersonationPluginOptions, type ImpersonationStatus, PLUGIN_SLUG, type ImpersonationPluginOptions as PluginOptions, closeStaleImpersonations, getImpersonation, impersonation };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,55 @@
+import { PLUGIN_SLUG } from "./plugin/constants.js";
+import { setRegistry } from "./plugin/registry.js";
+import { getImpersonation } from "./getImpersonation.js";
+import { assertHookedAuthCollections } from "./plugin/assertTargets.js";
+import { decorateAuthStrategies } from "./plugin/decorateAuth.js";
+import { normalizeOptions } from "./plugin/normalizeOptions.js";
+import { registerAdmin } from "./plugin/registerAdmin.js";
+import { registerCollection } from "./plugin/registerCollection.js";
+import { registerEndpoints } from "./plugin/registerEndpoints.js";
+import { registerHooks } from "./plugin/registerHooks.js";
+import { closeStaleImpersonations } from "./session/closeStale.js";
+import { registerRetention } from "./plugin/registerRetention.js";
+import { registerTranslations } from "./plugin/registerTranslations.js";
+import { definePlugin } from "payload";
+//#region src/index.ts
+/**
+* Let an authorised account sign in as another user without their password.
+* After start, `req.user` is the target. Every session is a closed-never-deleted
+* row. Access is always a host function; the plugin never compares roles.
+*/
+const impersonation = definePlugin({
+	slug: PLUGIN_SLUG,
+	plugin: ({ config, plugins: _plugins, ...options }) => {
+		if (options.disabled === true) return config;
+		const resolved = normalizeOptions(options, config);
+		const hookedAuthSlugs = (config.collections ?? []).filter((collection) => Boolean(collection.auth)).map(({ slug }) => slug);
+		registerTranslations(config, options.translations);
+		setRegistry(config, resolved);
+		registerCollection(config, resolved);
+		registerEndpoints(config, resolved);
+		registerHooks(config, resolved);
+		registerAdmin(config, resolved);
+		registerRetention(config, resolved);
+		const priorOnInit = config.onInit;
+		config.onInit = async (payload) => {
+			assertHookedAuthCollections(payload, resolved, hookedAuthSlugs);
+			if (resolved.maxDuration === void 0) payload.logger.warn("@10x-media/impersonation: maxDuration is unset. An impersonation never expires on its own because refresh keeps extending the minted session.");
+			decorateAuthStrategies(payload, resolved);
+			try {
+				await closeStaleImpersonations(payload);
+			} catch (error) {
+				payload.logger.error({
+					err: error,
+					msg: "@10x-media/impersonation: closeStaleImpersonations failed during onInit"
+				});
+			}
+			await priorOnInit?.(payload);
+		};
+		return config;
+	}
+});
+//#endregion
+export { PLUGIN_SLUG, closeStaleImpersonations, getImpersonation, impersonation };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["import { type Config, definePlugin } from 'payload'\n\nimport { getImpersonation } from './getImpersonation'\nimport { assertHookedAuthCollections } from './plugin/assertTargets'\nimport { PLUGIN_SLUG } from './plugin/constants'\nimport { decorateAuthStrategies } from './plugin/decorateAuth'\nimport { normalizeOptions } from './plugin/normalizeOptions'\nimport { registerAdmin } from './plugin/registerAdmin'\nimport { registerCollection } from './plugin/registerCollection'\nimport { registerEndpoints } from './plugin/registerEndpoints'\nimport { registerHooks } from './plugin/registerHooks'\nimport { registerRetention } from './plugin/registerRetention'\nimport { registerTranslations } from './plugin/registerTranslations'\nimport { setRegistry } from './plugin/registry'\nimport { closeStaleImpersonations } from './session/closeStale'\nimport type { ImpersonationPluginOptions } from './types'\n\nexport type { ImpersonationStatus } from './getImpersonation'\nexport { PLUGIN_SLUG } from './plugin/constants'\nexport type {\n\tImpersonationPluginOptions,\n\tImpersonationPluginOptions as PluginOptions,\n} from './types'\nexport { closeStaleImpersonations, getImpersonation }\n\ndeclare module 'payload' {\n\tinterface RegisteredPlugins {\n\t\t'@10x-media/impersonation': ImpersonationPluginOptions\n\t}\n}\n\n/**\n * Let an authorised account sign in as another user without their password.\n * After start, `req.user` is the target. Every session is a closed-never-deleted\n * row. Access is always a host function; the plugin never compares roles.\n */\nexport const impersonation = definePlugin<ImpersonationPluginOptions>({\n\tslug: PLUGIN_SLUG,\n\tplugin: ({ config, plugins: _plugins, ...options }): Config => {\n\t\tif (options.disabled === true) {\n\t\t\treturn config\n\t\t}\n\n\t\tconst resolved = normalizeOptions(options, config)\n\t\tconst hookedAuthSlugs = (config.collections ?? [])\n\t\t\t.filter((collection) => Boolean(collection.auth))\n\t\t\t.map(({ slug }) => slug)\n\t\tregisterTranslations(config, options.translations)\n\t\tsetRegistry(config, resolved)\n\t\tregisterCollection(config, resolved)\n\t\tregisterEndpoints(config, resolved)\n\t\tregisterHooks(config, resolved)\n\t\tregisterAdmin(config, resolved)\n\t\tregisterRetention(config, resolved)\n\n\t\tconst priorOnInit = config.onInit\n\t\tconfig.onInit = async (payload) => {\n\t\t\tassertHookedAuthCollections(payload, resolved, hookedAuthSlugs)\n\n\t\t\tif (resolved.maxDuration === undefined) {\n\t\t\t\tpayload.logger.warn(\n\t\t\t\t\t'@10x-media/impersonation: maxDuration is unset. An impersonation never expires on its own because refresh keeps extending the minted session.'\n\t\t\t\t)\n\t\t\t}\n\n\t\t\tdecorateAuthStrategies(payload, resolved)\n\n\t\t\ttry {\n\t\t\t\tawait closeStaleImpersonations(payload)\n\t\t\t} catch (error) {\n\t\t\t\tpayload.logger.error({\n\t\t\t\t\terr: error,\n\t\t\t\t\tmsg: '@10x-media/impersonation: closeStaleImpersonations failed during onInit',\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tawait priorOnInit?.(payload)\n\t\t}\n\n\t\treturn config\n\t},\n})\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoCA,MAAa,gBAAgB,aAAyC;CACrE,MAAM;CACN,SAAS,EAAE,QAAQ,SAAS,UAAU,GAAG,cAAsB;EAC9D,IAAI,QAAQ,aAAa,MACxB,OAAO;EAGR,MAAM,WAAW,iBAAiB,SAAS,MAAM;EACjD,MAAM,mBAAmB,OAAO,eAAe,CAAC,GAC9C,QAAQ,eAAe,QAAQ,WAAW,IAAI,CAAC,EAC/C,KAAK,EAAE,WAAW,IAAI;EACxB,qBAAqB,QAAQ,QAAQ,YAAY;EACjD,YAAY,QAAQ,QAAQ;EAC5B,mBAAmB,QAAQ,QAAQ;EACnC,kBAAkB,QAAQ,QAAQ;EAClC,cAAc,QAAQ,QAAQ;EAC9B,cAAc,QAAQ,QAAQ;EAC9B,kBAAkB,QAAQ,QAAQ;EAElC,MAAM,cAAc,OAAO;EAC3B,OAAO,SAAS,OAAO,YAAY;GAClC,4BAA4B,SAAS,UAAU,eAAe;GAE9D,IAAI,SAAS,gBAAgB,KAAA,GAC5B,QAAQ,OAAO,KACd,+IACD;GAGD,uBAAuB,SAAS,QAAQ;GAExC,IAAI;IACH,MAAM,yBAAyB,OAAO;GACvC,SAAS,OAAO;IACf,QAAQ,OAAO,MAAM;KACpB,KAAK;KACL,KAAK;IACN,CAAC;GACF;GAEA,MAAM,cAAc,OAAO;EAC5B;EAEA,OAAO;CACR;AACD,CAAC"}

package/dist/plugin/assertTargets.js

@@ -0,0 +1,23 @@
+import { collectionBySlug } from "../ids.js";
+//#region src/plugin/assertTargets.ts
+/**
+* Auth collections that exist on the booted instance but were missing when this
+* plugin ran. `relationTo` and `afterLogout` snapshot `config.collections`, so a
+* later plugin's collection would be startable and then fail open on logout.
+*/
+const missingHookedAuthSlugs = (liveAuthSlugs, hookedAuthSlugs, targets) => {
+	const hooked = new Set(hookedAuthSlugs);
+	return (targets ?? liveAuthSlugs).filter((slug) => !hooked.has(slug));
+};
+const liveAuthSlugsOf = (payload, recordsSlug) => Object.values(payload.collections).filter((collection) => collection.config.auth && collection.config.slug !== recordsSlug).map((collection) => collection.config.slug);
+const assertHookedAuthCollections = (payload, options, hookedAuthSlugs) => {
+	if (options.targets) {
+		for (const slug of options.targets) if (!collectionBySlug(payload, slug)) throw new Error(`@10x-media/impersonation: target collection "${slug}" is not in the config. Register impersonation after plugins that add auth collections.`);
+	}
+	const first = missingHookedAuthSlugs(liveAuthSlugsOf(payload, options.collectionSlug), hookedAuthSlugs, options.targets)[0];
+	if (first) throw new Error(`@10x-media/impersonation: auth collection "${first}" was registered after this plugin. List impersonation after plugins that add auth collections.`);
+};
+//#endregion
+export { assertHookedAuthCollections };
+
+//# sourceMappingURL=assertTargets.js.map

package/dist/plugin/assertTargets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertTargets.js","names":[],"sources":["../../src/plugin/assertTargets.ts"],"sourcesContent":["import type { Payload } from 'payload'\n\nimport { collectionBySlug } from '../ids'\nimport type { ResolvedOptions } from '../types'\n\n/**\n * Auth collections that exist on the booted instance but were missing when this\n * plugin ran. `relationTo` and `afterLogout` snapshot `config.collections`, so a\n * later plugin's collection would be startable and then fail open on logout.\n */\nexport const missingHookedAuthSlugs = (\n\tliveAuthSlugs: string[],\n\thookedAuthSlugs: readonly string[],\n\ttargets: string[] | undefined\n): string[] => {\n\tconst hooked = new Set(hookedAuthSlugs)\n\tconst required = targets ?? liveAuthSlugs\n\treturn required.filter((slug) => !hooked.has(slug))\n}\n\nexport const liveAuthSlugsOf = (payload: Payload, recordsSlug: string): string[] =>\n\tObject.values(payload.collections)\n\t\t.filter((collection) => collection.config.auth && collection.config.slug !== recordsSlug)\n\t\t.map((collection) => collection.config.slug)\n\nexport const assertHookedAuthCollections = (\n\tpayload: Payload,\n\toptions: ResolvedOptions,\n\thookedAuthSlugs: readonly string[]\n): void => {\n\tif (options.targets) {\n\t\tfor (const slug of options.targets) {\n\t\t\tif (!collectionBySlug(payload, slug)) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`@10x-media/impersonation: target collection \"${slug}\" is not in the config. Register impersonation after plugins that add auth collections.`\n\t\t\t\t)\n\t\t\t}\n\t\t}\n\t}\n\n\tconst missing = missingHookedAuthSlugs(\n\t\tliveAuthSlugsOf(payload, options.collectionSlug),\n\t\thookedAuthSlugs,\n\t\toptions.targets\n\t)\n\tconst first = missing[0]\n\tif (first) {\n\t\tthrow new Error(\n\t\t\t`@10x-media/impersonation: auth collection \"${first}\" was registered after this plugin. List impersonation after plugins that add auth collections.`\n\t\t)\n\t}\n}\n"],"mappings":";;;;;;;AAUA,MAAa,0BACZ,eACA,iBACA,YACc;CACd,MAAM,SAAS,IAAI,IAAI,eAAe;CAEtC,QADiB,WAAW,eACZ,QAAQ,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC;AACnD;AAEA,MAAa,mBAAmB,SAAkB,gBACjD,OAAO,OAAO,QAAQ,WAAW,EAC/B,QAAQ,eAAe,WAAW,OAAO,QAAQ,WAAW,OAAO,SAAS,WAAW,EACvF,KAAK,eAAe,WAAW,OAAO,IAAI;AAE7C,MAAa,+BACZ,SACA,SACA,oBACU;CACV,IAAI,QAAQ;OACN,MAAM,QAAQ,QAAQ,SAC1B,IAAI,CAAC,iBAAiB,SAAS,IAAI,GAClC,MAAM,IAAI,MACT,gDAAgD,KAAK,wFACtD;CAAA;CAUH,MAAM,QALU,uBACf,gBAAgB,SAAS,QAAQ,cAAc,GAC/C,iBACA,QAAQ,OAEW,EAAE;CACtB,IAAI,OACH,MAAM,IAAI,MACT,8CAA8C,MAAM,gGACrD;AAEF"}

package/dist/plugin/constants.d.ts

@@ -0,0 +1,6 @@
+//#region src/plugin/constants.d.ts
+/** This plugin's registered slug, used to find its options on a booted config. */
+declare const PLUGIN_SLUG = "@10x-media/impersonation";
+//#endregion
+export { PLUGIN_SLUG };
+//# sourceMappingURL=constants.d.ts.map

package/dist/plugin/constants.js

@@ -0,0 +1,20 @@
+//#region src/plugin/constants.ts
+/** This plugin's registered slug, used to find its options on a booted config. */
+const PLUGIN_SLUG = "@10x-media/impersonation";
+/** `config.custom` key the resolved options live under. */
+const REGISTRY_KEY = PLUGIN_SLUG;
+const DEFAULT_COLLECTION_SLUG = "impersonation-sessions";
+const DEFAULT_API_PATH = "/impersonation";
+const DEFAULT_HINT_COOKIE = "impersonation-hint";
+const DEFAULT_COOKIE_PREFIX = "payload";
+const defaultClearOnSwitch = (cookiePrefix) => [`${cookiePrefix}-tenant`];
+/** Client POSTs that busy-gate a control abort after this. */
+const CLIENT_FETCH_TIMEOUT_MS = 15e3;
+const ADMIN_GROUP = "System";
+/** Prefixed onto minted target sids so decorateAuth can skip the DB on normal traffic. */
+const IMPERSONATION_SID_PREFIX = "imp_";
+const RESERVED_API_SEGMENTS = ["graphql", "graphql-playground"];
+//#endregion
+export { ADMIN_GROUP, CLIENT_FETCH_TIMEOUT_MS, DEFAULT_API_PATH, DEFAULT_COLLECTION_SLUG, DEFAULT_COOKIE_PREFIX, DEFAULT_HINT_COOKIE, IMPERSONATION_SID_PREFIX, PLUGIN_SLUG, REGISTRY_KEY, RESERVED_API_SEGMENTS, defaultClearOnSwitch };
+
+//# sourceMappingURL=constants.js.map

package/dist/plugin/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","names":[],"sources":["../../src/plugin/constants.ts"],"sourcesContent":["/** This plugin's registered slug, used to find its options on a booted config. */\nexport const PLUGIN_SLUG = '@10x-media/impersonation'\n\n/** `config.custom` key the resolved options live under. */\nexport const REGISTRY_KEY = PLUGIN_SLUG\n\nexport const DEFAULT_COLLECTION_SLUG = 'impersonation-sessions'\nexport const DEFAULT_API_PATH = '/impersonation'\nexport const DEFAULT_HINT_COOKIE = 'impersonation-hint'\nexport const DEFAULT_COOKIE_PREFIX = 'payload'\nexport const defaultClearOnSwitch = (cookiePrefix: string) => [`${cookiePrefix}-tenant`]\nexport const REASON_MAX_LENGTH = 500\n/** Client POSTs that busy-gate a control abort after this. */\nexport const CLIENT_FETCH_TIMEOUT_MS = 15_000\nexport const ADMIN_GROUP = 'System'\n/** Prefixed onto minted target sids so decorateAuth can skip the DB on normal traffic. */\nexport const IMPERSONATION_SID_PREFIX = 'imp_'\nexport const SWITCHER_PAGE_SIZE = 20\n\nexport const RESERVED_API_SEGMENTS = ['graphql', 'graphql-playground'] as const\n"],"mappings":";;AACA,MAAa,cAAc;;AAG3B,MAAa,eAAe;AAE5B,MAAa,0BAA0B;AACvC,MAAa,mBAAmB;AAChC,MAAa,sBAAsB;AACnC,MAAa,wBAAwB;AACrC,MAAa,wBAAwB,iBAAyB,CAAC,GAAG,aAAa,QAAQ;;AAGvF,MAAa,0BAA0B;AACvC,MAAa,cAAc;;AAE3B,MAAa,2BAA2B;AAGxC,MAAa,wBAAwB,CAAC,WAAW,oBAAoB"}

package/dist/plugin/decorateAuth.js

@@ -0,0 +1,99 @@
+import { cachedFindOpenBySid, isPastAbsoluteExpiry, relationOf } from "../session/resolve.js";
+import { absoluteExpiryCookies } from "../auth/expiryCookies.js";
+import { closeAndRevoke } from "../session/close.js";
+import { boundSid } from "../types.js";
+import { shouldLookupImpersonation } from "./lookup.js";
+//#region src/plugin/decorateAuth.ts
+/**
+* Runtime wrap of `payload.authStrategies` (assembled in `init()`, not a config
+* field). Collection strategies run before `local-jwt` and return on the first
+* user, so decorating only a collection strategy would miss every local-jwt
+* login.
+*
+* No sid cache. A negative hit on the impersonator's sid would go stale the
+* moment they start (findOpenBySid also matches impersonatorSid). Terminate
+* must be visible on the next request, so positives stay uncached too.
+*/
+const decorateAuthStrategies = (payload, options) => {
+	payload.authStrategies = payload.authStrategies.map((strategy) => wrapStrategy({
+		options,
+		payload,
+		strategy
+	}));
+};
+const wrapStrategy = ({ options, payload, strategy }) => ({
+	name: strategy.name,
+	authenticate: async (args) => {
+		const result = await strategy.authenticate(args);
+		const user = result.user;
+		const sid = boundSid(user, options.session.binding);
+		if (!user || !sid) return result;
+		if (!shouldLookupImpersonation({
+			headers: args.headers,
+			options,
+			sid
+		})) return result;
+		const row = await cachedFindOpenBySid(sid, options, payload);
+		if (!row) return result;
+		if (isPastAbsoluteExpiry(row)) return expireAbsoluteCap({
+			canSetHeaders: args.canSetHeaders,
+			options,
+			payload,
+			result,
+			row,
+			sid,
+			user
+		});
+		const impersonator = relationOf(row.impersonator);
+		const target = relationOf(row.target);
+		if (options.decorateRequests && impersonator && target && sid === row.targetSid) user._impersonation = {
+			absoluteExpiresAt: row.absoluteExpiresAt ?? null,
+			id: row.id,
+			impersonator,
+			impersonatorEmail: row.impersonatorEmail,
+			impersonatorLocale: row.impersonatorLocale,
+			impersonatorTitle: row.impersonatorTitle,
+			mode: row.mode,
+			reason: row.reason,
+			startedAt: row.startedAt,
+			target,
+			targetEmail: row.targetEmail,
+			targetTitle: row.targetTitle
+		};
+		return result;
+	}
+});
+/**
+* Parallel expiry must not clear `${cookiePrefix}-token`. That cookie is still
+* the impersonator. Swap expiry clears it because it was overwritten on start.
+*/
+const expireAbsoluteCap = async ({ canSetHeaders, options, payload, result, row, sid, user }) => {
+	await closeAndRevoke({
+		endedBy: "expired",
+		options,
+		payload,
+		record: row
+	});
+	const isImpersonatorRequest = sid === row.impersonatorSid && sid !== row.targetSid;
+	if (!canSetHeaders) return isImpersonatorRequest ? result : { user: null };
+	const headers = result.responseHeaders ?? new Headers();
+	for (const cookie of await absoluteExpiryCookies({
+		options,
+		payload,
+		row,
+		sid,
+		user
+	})) headers.append("Set-Cookie", cookie);
+	if (isImpersonatorRequest) return {
+		...result,
+		responseHeaders: headers
+	};
+	return {
+		responseHeaders: headers,
+		user: null
+	};
+};
+//#endregion
+export { decorateAuthStrategies };
+
+//# sourceMappingURL=decorateAuth.js.map

package/dist/plugin/decorateAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decorateAuth.js","names":[],"sources":["../../src/plugin/decorateAuth.ts"],"sourcesContent":["import type { AuthStrategy, Payload } from 'payload'\n\nimport { absoluteExpiryCookies } from '../auth/expiryCookies'\nimport { closeAndRevoke } from '../session/close'\nimport { cachedFindOpenBySid, isPastAbsoluteExpiry, relationOf } from '../session/resolve'\nimport type {\n\tImpersonatedUser,\n\tImpersonationActor,\n\tImpersonationRecord,\n\tResolvedOptions,\n} from '../types'\nimport { boundSid } from '../types'\nimport { shouldLookupImpersonation } from './lookup'\n\n/**\n * Runtime wrap of `payload.authStrategies` (assembled in `init()`, not a config\n * field). Collection strategies run before `local-jwt` and return on the first\n * user, so decorating only a collection strategy would miss every local-jwt\n * login.\n *\n * No sid cache. A negative hit on the impersonator's sid would go stale the\n * moment they start (findOpenBySid also matches impersonatorSid). Terminate\n * must be visible on the next request, so positives stay uncached too.\n */\nexport const decorateAuthStrategies = (payload: Payload, options: ResolvedOptions): void => {\n\tpayload.authStrategies = payload.authStrategies.map((strategy) =>\n\t\twrapStrategy({ options, payload, strategy })\n\t)\n}\n\nconst wrapStrategy = ({\n\toptions,\n\tpayload,\n\tstrategy,\n}: {\n\toptions: ResolvedOptions\n\tpayload: Payload\n\tstrategy: AuthStrategy\n}): AuthStrategy => ({\n\tname: strategy.name,\n\tauthenticate: async (args) => {\n\t\tconst result = await strategy.authenticate(args)\n\t\tconst user = result.user as ImpersonatedUser | null\n\t\tconst sid = boundSid(user, options.session.binding)\n\t\tif (!user || !sid) {\n\t\t\treturn result\n\t\t}\n\n\t\tif (!shouldLookupImpersonation({ headers: args.headers, options, sid })) {\n\t\t\treturn result\n\t\t}\n\n\t\tconst row = await cachedFindOpenBySid(sid, options, payload)\n\t\tif (!row) {\n\t\t\treturn result\n\t\t}\n\n\t\tif (isPastAbsoluteExpiry(row)) {\n\t\t\treturn expireAbsoluteCap({\n\t\t\t\tcanSetHeaders: args.canSetHeaders,\n\t\t\t\toptions,\n\t\t\t\tpayload,\n\t\t\t\tresult,\n\t\t\t\trow,\n\t\t\t\tsid,\n\t\t\t\tuser,\n\t\t\t})\n\t\t}\n\n\t\tconst impersonator = relationOf(row.impersonator)\n\t\tconst target = relationOf(row.target)\n\t\tif (options.decorateRequests && impersonator && target && sid === row.targetSid) {\n\t\t\tconst actor: ImpersonationActor = {\n\t\t\t\tabsoluteExpiresAt: row.absoluteExpiresAt ?? null,\n\t\t\t\tid: row.id,\n\t\t\t\timpersonator,\n\t\t\t\timpersonatorEmail: row.impersonatorEmail,\n\t\t\t\timpersonatorLocale: row.impersonatorLocale,\n\t\t\t\timpersonatorTitle: row.impersonatorTitle,\n\t\t\t\tmode: row.mode,\n\t\t\t\treason: row.reason,\n\t\t\t\tstartedAt: row.startedAt,\n\t\t\t\ttarget,\n\t\t\t\ttargetEmail: row.targetEmail,\n\t\t\t\ttargetTitle: row.targetTitle,\n\t\t\t}\n\t\t\tuser._impersonation = actor\n\t\t}\n\n\t\treturn result\n\t},\n})\n\n/**\n * Parallel expiry must not clear `${cookiePrefix}-token`. That cookie is still\n * the impersonator. Swap expiry clears it because it was overwritten on start.\n */\nconst expireAbsoluteCap = async ({\n\tcanSetHeaders,\n\toptions,\n\tpayload,\n\tresult,\n\trow,\n\tsid,\n\tuser,\n}: {\n\tcanSetHeaders: boolean | undefined\n\toptions: ResolvedOptions\n\tpayload: Payload\n\tresult: Awaited<ReturnType<AuthStrategy['authenticate']>>\n\trow: ImpersonationRecord\n\tsid: string\n\tuser: ImpersonatedUser\n}): Promise<Awaited<ReturnType<AuthStrategy['authenticate']>>> => {\n\tawait closeAndRevoke({ endedBy: 'expired', options, payload, record: row })\n\n\tconst isImpersonatorRequest = sid === row.impersonatorSid && sid !== row.targetSid\n\tif (!canSetHeaders) {\n\t\treturn isImpersonatorRequest ? result : { user: null }\n\t}\n\n\tconst headers = result.responseHeaders ?? new Headers()\n\tfor (const cookie of await absoluteExpiryCookies({ options, payload, row, sid, user })) {\n\t\theaders.append('Set-Cookie', cookie)\n\t}\n\tif (isImpersonatorRequest) {\n\t\treturn { ...result, responseHeaders: headers }\n\t}\n\treturn { responseHeaders: headers, user: null }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAwBA,MAAa,0BAA0B,SAAkB,YAAmC;CAC3F,QAAQ,iBAAiB,QAAQ,eAAe,KAAK,aACpD,aAAa;EAAE;EAAS;EAAS;CAAS,CAAC,CAC5C;AACD;AAEA,MAAM,gBAAgB,EACrB,SACA,SACA,gBAKoB;CACpB,MAAM,SAAS;CACf,cAAc,OAAO,SAAS;EAC7B,MAAM,SAAS,MAAM,SAAS,aAAa,IAAI;EAC/C,MAAM,OAAO,OAAO;EACpB,MAAM,MAAM,SAAS,MAAM,QAAQ,QAAQ,OAAO;EAClD,IAAI,CAAC,QAAQ,CAAC,KACb,OAAO;EAGR,IAAI,CAAC,0BAA0B;GAAE,SAAS,KAAK;GAAS;GAAS;EAAI,CAAC,GACrE,OAAO;EAGR,MAAM,MAAM,MAAM,oBAAoB,KAAK,SAAS,OAAO;EAC3D,IAAI,CAAC,KACJ,OAAO;EAGR,IAAI,qBAAqB,GAAG,GAC3B,OAAO,kBAAkB;GACxB,eAAe,KAAK;GACpB;GACA;GACA;GACA;GACA;GACA;EACD,CAAC;EAGF,MAAM,eAAe,WAAW,IAAI,YAAY;EAChD,MAAM,SAAS,WAAW,IAAI,MAAM;EACpC,IAAI,QAAQ,oBAAoB,gBAAgB,UAAU,QAAQ,IAAI,WAerE,KAAK,iBAAiB;GAbrB,mBAAmB,IAAI,qBAAqB;GAC5C,IAAI,IAAI;GACR;GACA,mBAAmB,IAAI;GACvB,oBAAoB,IAAI;GACxB,mBAAmB,IAAI;GACvB,MAAM,IAAI;GACV,QAAQ,IAAI;GACZ,WAAW,IAAI;GACf;GACA,aAAa,IAAI;GACjB,aAAa,IAAI;EAEQ;EAG3B,OAAO;CACR;AACD;;;;;AAMA,MAAM,oBAAoB,OAAO,EAChC,eACA,SACA,SACA,QACA,KACA,KACA,WASiE;CACjE,MAAM,eAAe;EAAE,SAAS;EAAW;EAAS;EAAS,QAAQ;CAAI,CAAC;CAE1E,MAAM,wBAAwB,QAAQ,IAAI,mBAAmB,QAAQ,IAAI;CACzE,IAAI,CAAC,eACJ,OAAO,wBAAwB,SAAS,EAAE,MAAM,KAAK;CAGtD,MAAM,UAAU,OAAO,mBAAmB,IAAI,QAAQ;CACtD,KAAK,MAAM,UAAU,MAAM,sBAAsB;EAAE;EAAS;EAAS;EAAK;EAAK;CAAK,CAAC,GACpF,QAAQ,OAAO,cAAc,MAAM;CAEpC,IAAI,uBACH,OAAO;EAAE,GAAG;EAAQ,iBAAiB;CAAQ;CAE9C,OAAO;EAAE,iBAAiB;EAAS,MAAM;CAAK;AAC/C"}

package/dist/plugin/lookup.js

@@ -0,0 +1,23 @@
+import "./constants.js";
+import { parseCookies } from "payload/shared";
+//#region src/plugin/lookup.ts
+/**
+* Whether this authenticated request can belong to an impersonation row.
+* Custom `session.issue` skips the prefix, so those hosts always look up.
+*/
+const shouldLookupImpersonation = ({ headers, options, sid }) => {
+	if (options.session.issue) return true;
+	if (sid.startsWith("imp_")) return true;
+	return parseCookies(headers).has(options.hintCookieName);
+};
+const readHintCookie = async (name) => {
+	try {
+		return (await (await import("next/headers")).cookies()).get(name)?.value;
+	} catch {
+		return;
+	}
+};
+//#endregion
+export { readHintCookie, shouldLookupImpersonation };
+
+//# sourceMappingURL=lookup.js.map

package/dist/plugin/lookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lookup.js","names":[],"sources":["../../src/plugin/lookup.ts"],"sourcesContent":["import { parseCookies } from 'payload/shared'\n\nimport type { ResolvedOptions } from '../types'\nimport { IMPERSONATION_SID_PREFIX } from './constants'\n\n/**\n * Whether this authenticated request can belong to an impersonation row.\n * Custom `session.issue` skips the prefix, so those hosts always look up.\n */\nexport const shouldLookupImpersonation = ({\n\theaders,\n\toptions,\n\tsid,\n}: {\n\theaders: Headers\n\toptions: Pick<ResolvedOptions, 'hintCookieName' | 'session'>\n\tsid: string\n}): boolean => {\n\tif (options.session.issue) {\n\t\treturn true\n\t}\n\tif (sid.startsWith(IMPERSONATION_SID_PREFIX)) {\n\t\treturn true\n\t}\n\treturn parseCookies(headers).has(options.hintCookieName)\n}\n\nexport const readHintCookie = async (name: string): Promise<string | undefined> => {\n\ttry {\n\t\tconst spec: string = 'next/headers'\n\t\tconst mod = (await import(spec)) as {\n\t\t\tcookies: () =>\n\t\t\t\t| { get: (key: string) => { value?: string } | undefined }\n\t\t\t\t| Promise<{ get: (key: string) => { value?: string } | undefined }>\n\t\t}\n\t\tconst store = await mod.cookies()\n\t\treturn store.get(name)?.value\n\t} catch {\n\t\treturn undefined\n\t}\n}\n"],"mappings":";;;;;;;AASA,MAAa,6BAA6B,EACzC,SACA,SACA,UAKc;CACd,IAAI,QAAQ,QAAQ,OACnB,OAAO;CAER,IAAI,IAAI,WAAA,MAAmC,GAC1C,OAAO;CAER,OAAO,aAAa,OAAO,EAAE,IAAI,QAAQ,cAAc;AACxD;AAEA,MAAa,iBAAiB,OAAO,SAA8C;CAClF,IAAI;EAQH,QAAO,OADa,MALD,OAAO,iBAKF,QAAQ,GACnB,IAAI,IAAI,GAAG;CACzB,QAAQ;EACP;CACD;AACD"}

package/dist/plugin/normalizeOptions.js

@@ -0,0 +1,83 @@
+import { RESERVED_API_SEGMENTS, defaultClearOnSwitch } from "./constants.js";
+//#region src/plugin/normalizeOptions.ts
+const PREFIX = "@10x-media/impersonation:";
+const resolveAdminUserSlug = (config) => config.admin?.user ?? (config.collections ?? []).find(({ auth }) => Boolean(auth))?.slug ?? "users";
+const authObject = (collection) => {
+	if (!collection?.auth) return null;
+	return typeof collection.auth === "object" ? collection.auth : {};
+};
+const firstApiSegment = (apiPath) => apiPath.replace(/^\//, "").split("/").filter(Boolean)[0] ?? "";
+const resolveUi = (ui) => {
+	if (ui === false) return {
+		bar: false,
+		cardEmail: false,
+		documentAction: false,
+		headerAction: false,
+		recordAction: false,
+		sessionsCollection: false,
+		userLabel: "title"
+	};
+	return {
+		bar: ui?.bar !== false,
+		card: ui?.card,
+		cardEmail: ui?.cardEmail !== false,
+		documentAction: ui?.documentAction !== false,
+		headerAction: ui?.headerAction !== false,
+		recordAction: ui?.recordAction !== false,
+		sessionsCollection: ui?.sessionsCollection === true,
+		userLabel: ui?.userLabel === "email" ? "email" : "title"
+	};
+};
+/**
+* Fill defaults and refuse a config that cannot bind or revoke sessions.
+* `disabled: true` never reaches here.
+*/
+const normalizeOptions = (options, config) => {
+	if (typeof options.access?.impersonate !== "function") throw new Error(`${PREFIX} access.impersonate must be a function`);
+	const cookiePrefix = config.cookiePrefix ?? "payload";
+	const collectionSlug = options.collectionSlug ?? "impersonation-sessions";
+	const apiPath = options.apiPath ?? "/impersonation";
+	const hintCookieName = options.hintCookieName ?? "impersonation-hint";
+	if (hintCookieName.startsWith(cookiePrefix)) throw new Error(`${PREFIX} hintCookieName "${hintCookieName}" must not start with cookiePrefix "${cookiePrefix}". @payloadcms/next refresh/logout take the first cookie whose name starts with the prefix.`);
+	const segment = firstApiSegment(apiPath);
+	const occupied = new Set([
+		...RESERVED_API_SEGMENTS,
+		collectionSlug,
+		...(config.collections ?? []).map(({ slug }) => slug),
+		...(config.globals ?? []).map(({ slug }) => slug)
+	]);
+	if (!segment || occupied.has(segment)) throw new Error(`${PREFIX} apiPath "${apiPath}" collides with a collection, global, or reserved route segment "${segment}". handleEndpoints would treat it as that collection and drop these endpoints.`);
+	const adminSlug = resolveAdminUserSlug(config);
+	const adminAuth = authObject((config.collections ?? []).find(({ slug }) => slug === adminSlug));
+	if (adminAuth?.useSessions === false) throw new Error(`${PREFIX} the admin collection "${adminSlug}" has useSessions: false, so there is no sid to bind or revoke.`);
+	if (adminAuth?.disableLocalStrategy) throw new Error(`${PREFIX} the admin collection "${adminSlug}" has disableLocalStrategy, so the plugin cannot mint or restore a session.`);
+	const deleteAfterDays = options.retention ? options.retention.deleteAfterDays : void 0;
+	if (options.retention && (typeof deleteAfterDays !== "number" || !Number.isFinite(deleteAfterDays) || deleteAfterDays <= 0)) throw new Error(`${PREFIX} retention.deleteAfterDays must be a positive finite number.`);
+	return {
+		access: {
+			filterTargets: options.access.filterTargets,
+			impersonate: options.access.impersonate,
+			readRecords: options.access.readRecords ?? (() => false),
+			terminate: options.access.terminate ?? (() => false)
+		},
+		apiPath,
+		collectionSlug,
+		collectionOverrides: options.collection?.overrides,
+		cookies: { clearOnSwitch: options.cookies?.clearOnSwitch ?? defaultClearOnSwitch(cookiePrefix) },
+		decorateRequests: options.decorateRequests !== false,
+		hintCookieName,
+		maxDuration: options.maxDuration,
+		onEnd: options.onEnd,
+		onStart: options.onStart,
+		reason: options.reason ?? "off",
+		retention: options.retention ? options.retention : void 0,
+		security: { trustedOrigins: options.security?.trustedOrigins ?? [] },
+		session: options.session ?? {},
+		targets: options.targets,
+		ui: resolveUi(options.ui)
+	};
+};
+//#endregion
+export { normalizeOptions };
+
+//# sourceMappingURL=normalizeOptions.js.map

package/dist/plugin/normalizeOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalizeOptions.js","names":[],"sources":["../../src/plugin/normalizeOptions.ts"],"sourcesContent":["import type { CollectionConfig, CollectionSlug, Config } from 'payload'\n\nimport type { EnabledOptions, ResolvedOptions, ResolvedUi } from '../types'\nimport {\n\tDEFAULT_API_PATH,\n\tDEFAULT_COLLECTION_SLUG,\n\tDEFAULT_COOKIE_PREFIX,\n\tDEFAULT_HINT_COOKIE,\n\tdefaultClearOnSwitch,\n\tRESERVED_API_SEGMENTS,\n} from './constants'\n\nconst PREFIX = '@10x-media/impersonation:'\n\nexport const resolveAdminUserSlug = (config: Config): string =>\n\tconfig.admin?.user ??\n\t(config.collections ?? []).find(({ auth }) => Boolean(auth))?.slug ??\n\t'users'\n\nconst authObject = (collection: CollectionConfig | undefined) => {\n\tif (!collection?.auth) {\n\t\treturn null\n\t}\n\treturn typeof collection.auth === 'object' ? collection.auth : {}\n}\n\nconst firstApiSegment = (apiPath: string): string =>\n\tapiPath.replace(/^\\//, '').split('/').filter(Boolean)[0] ?? ''\n\nconst resolveUi = (ui: EnabledOptions['ui']): ResolvedUi => {\n\tif (ui === false) {\n\t\treturn {\n\t\t\tbar: false,\n\t\t\tcardEmail: false,\n\t\t\tdocumentAction: false,\n\t\t\theaderAction: false,\n\t\t\trecordAction: false,\n\t\t\tsessionsCollection: false,\n\t\t\tuserLabel: 'title',\n\t\t}\n\t}\n\treturn {\n\t\tbar: ui?.bar !== false,\n\t\tcard: ui?.card,\n\t\tcardEmail: ui?.cardEmail !== false,\n\t\tdocumentAction: ui?.documentAction !== false,\n\t\theaderAction: ui?.headerAction !== false,\n\t\trecordAction: ui?.recordAction !== false,\n\t\tsessionsCollection: ui?.sessionsCollection === true,\n\t\tuserLabel: ui?.userLabel === 'email' ? 'email' : 'title',\n\t}\n}\n\n/**\n * Fill defaults and refuse a config that cannot bind or revoke sessions.\n * `disabled: true` never reaches here.\n */\nexport const normalizeOptions = (options: EnabledOptions, config: Config): ResolvedOptions => {\n\tif (typeof options.access?.impersonate !== 'function') {\n\t\tthrow new Error(`${PREFIX} access.impersonate must be a function`)\n\t}\n\n\tconst cookiePrefix = config.cookiePrefix ?? DEFAULT_COOKIE_PREFIX\n\tconst collectionSlug = (options.collectionSlug ?? DEFAULT_COLLECTION_SLUG) as CollectionSlug\n\tconst apiPath = options.apiPath ?? DEFAULT_API_PATH\n\tconst hintCookieName = options.hintCookieName ?? DEFAULT_HINT_COOKIE\n\n\tif (hintCookieName.startsWith(cookiePrefix)) {\n\t\tthrow new Error(\n\t\t\t`${PREFIX} hintCookieName \"${hintCookieName}\" must not start with cookiePrefix \"${cookiePrefix}\". @payloadcms/next refresh/logout take the first cookie whose name starts with the prefix.`\n\t\t)\n\t}\n\n\tconst segment = firstApiSegment(apiPath)\n\tconst occupied = new Set<string>([\n\t\t...RESERVED_API_SEGMENTS,\n\t\tcollectionSlug,\n\t\t...(config.collections ?? []).map(({ slug }) => slug),\n\t\t...(config.globals ?? []).map(({ slug }) => slug),\n\t])\n\tif (!segment || occupied.has(segment)) {\n\t\tthrow new Error(\n\t\t\t`${PREFIX} apiPath \"${apiPath}\" collides with a collection, global, or reserved route segment \"${segment}\". handleEndpoints would treat it as that collection and drop these endpoints.`\n\t\t)\n\t}\n\n\tconst adminSlug = resolveAdminUserSlug(config)\n\tconst adminCollection = (config.collections ?? []).find(({ slug }) => slug === adminSlug)\n\tconst adminAuth = authObject(adminCollection)\n\tif (adminAuth?.useSessions === false) {\n\t\tthrow new Error(\n\t\t\t`${PREFIX} the admin collection \"${adminSlug}\" has useSessions: false, so there is no sid to bind or revoke.`\n\t\t)\n\t}\n\tif (adminAuth?.disableLocalStrategy) {\n\t\tthrow new Error(\n\t\t\t`${PREFIX} the admin collection \"${adminSlug}\" has disableLocalStrategy, so the plugin cannot mint or restore a session.`\n\t\t)\n\t}\n\n\tconst deleteAfterDays = options.retention ? options.retention.deleteAfterDays : undefined\n\tif (\n\t\toptions.retention &&\n\t\t(typeof deleteAfterDays !== 'number' ||\n\t\t\t!Number.isFinite(deleteAfterDays) ||\n\t\t\tdeleteAfterDays <= 0)\n\t) {\n\t\tthrow new Error(`${PREFIX} retention.deleteAfterDays must be a positive finite number.`)\n\t}\n\n\treturn {\n\t\taccess: {\n\t\t\tfilterTargets: options.access.filterTargets,\n\t\t\timpersonate: options.access.impersonate,\n\t\t\treadRecords: options.access.readRecords ?? (() => false),\n\t\t\tterminate: options.access.terminate ?? (() => false),\n\t\t},\n\t\tapiPath,\n\t\tcollectionSlug,\n\t\tcollectionOverrides: options.collection?.overrides,\n\t\tcookies: {\n\t\t\tclearOnSwitch: options.cookies?.clearOnSwitch ?? defaultClearOnSwitch(cookiePrefix),\n\t\t},\n\t\tdecorateRequests: options.decorateRequests !== false,\n\t\thintCookieName,\n\t\tmaxDuration: options.maxDuration,\n\t\tonEnd: options.onEnd,\n\t\tonStart: options.onStart,\n\t\treason: options.reason ?? 'off',\n\t\tretention: options.retention ? options.retention : undefined,\n\t\tsecurity: { trustedOrigins: options.security?.trustedOrigins ?? [] },\n\t\tsession: options.session ?? {},\n\t\ttargets: options.targets,\n\t\tui: resolveUi(options.ui),\n\t}\n}\n"],"mappings":";;AAYA,MAAM,SAAS;AAEf,MAAa,wBAAwB,WACpC,OAAO,OAAO,SACb,OAAO,eAAe,CAAC,GAAG,MAAM,EAAE,WAAW,QAAQ,IAAI,CAAC,GAAG,QAC9D;AAED,MAAM,cAAc,eAA6C;CAChE,IAAI,CAAC,YAAY,MAChB,OAAO;CAER,OAAO,OAAO,WAAW,SAAS,WAAW,WAAW,OAAO,CAAC;AACjE;AAEA,MAAM,mBAAmB,YACxB,QAAQ,QAAQ,OAAO,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,MAAM;AAE7D,MAAM,aAAa,OAAyC;CAC3D,IAAI,OAAO,OACV,OAAO;EACN,KAAK;EACL,WAAW;EACX,gBAAgB;EAChB,cAAc;EACd,cAAc;EACd,oBAAoB;EACpB,WAAW;CACZ;CAED,OAAO;EACN,KAAK,IAAI,QAAQ;EACjB,MAAM,IAAI;EACV,WAAW,IAAI,cAAc;EAC7B,gBAAgB,IAAI,mBAAmB;EACvC,cAAc,IAAI,iBAAiB;EACnC,cAAc,IAAI,iBAAiB;EACnC,oBAAoB,IAAI,uBAAuB;EAC/C,WAAW,IAAI,cAAc,UAAU,UAAU;CAClD;AACD;;;;;AAMA,MAAa,oBAAoB,SAAyB,WAAoC;CAC7F,IAAI,OAAO,QAAQ,QAAQ,gBAAgB,YAC1C,MAAM,IAAI,MAAM,GAAG,OAAO,uCAAuC;CAGlE,MAAM,eAAe,OAAO,gBAAA;CAC5B,MAAM,iBAAkB,QAAQ,kBAAA;CAChC,MAAM,UAAU,QAAQ,WAAA;CACxB,MAAM,iBAAiB,QAAQ,kBAAA;CAE/B,IAAI,eAAe,WAAW,YAAY,GACzC,MAAM,IAAI,MACT,GAAG,OAAO,mBAAmB,eAAe,sCAAsC,aAAa,4FAChG;CAGD,MAAM,UAAU,gBAAgB,OAAO;CACvC,MAAM,WAAW,IAAI,IAAY;EAChC,GAAG;EACH;EACA,IAAI,OAAO,eAAe,CAAC,GAAG,KAAK,EAAE,WAAW,IAAI;EACpD,IAAI,OAAO,WAAW,CAAC,GAAG,KAAK,EAAE,WAAW,IAAI;CACjD,CAAC;CACD,IAAI,CAAC,WAAW,SAAS,IAAI,OAAO,GACnC,MAAM,IAAI,MACT,GAAG,OAAO,YAAY,QAAQ,mEAAmE,QAAQ,+EAC1G;CAGD,MAAM,YAAY,qBAAqB,MAAM;CAE7C,MAAM,YAAY,YADO,OAAO,eAAe,CAAC,GAAG,MAAM,EAAE,WAAW,SAAS,SACpC,CAAC;CAC5C,IAAI,WAAW,gBAAgB,OAC9B,MAAM,IAAI,MACT,GAAG,OAAO,yBAAyB,UAAU,gEAC9C;CAED,IAAI,WAAW,sBACd,MAAM,IAAI,MACT,GAAG,OAAO,yBAAyB,UAAU,4EAC9C;CAGD,MAAM,kBAAkB,QAAQ,YAAY,QAAQ,UAAU,kBAAkB,KAAA;CAChF,IACC,QAAQ,cACP,OAAO,oBAAoB,YAC3B,CAAC,OAAO,SAAS,eAAe,KAChC,mBAAmB,IAEpB,MAAM,IAAI,MAAM,GAAG,OAAO,6DAA6D;CAGxF,OAAO;EACN,QAAQ;GACP,eAAe,QAAQ,OAAO;GAC9B,aAAa,QAAQ,OAAO;GAC5B,aAAa,QAAQ,OAAO,sBAAsB;GAClD,WAAW,QAAQ,OAAO,oBAAoB;EAC/C;EACA;EACA;EACA,qBAAqB,QAAQ,YAAY;EACzC,SAAS,EACR,eAAe,QAAQ,SAAS,iBAAiB,qBAAqB,YAAY,EACnF;EACA,kBAAkB,QAAQ,qBAAqB;EAC/C;EACA,aAAa,QAAQ;EACrB,OAAO,QAAQ;EACf,SAAS,QAAQ;EACjB,QAAQ,QAAQ,UAAU;EAC1B,WAAW,QAAQ,YAAY,QAAQ,YAAY,KAAA;EACnD,UAAU,EAAE,gBAAgB,QAAQ,UAAU,kBAAkB,CAAC,EAAE;EACnE,SAAS,QAAQ,WAAW,CAAC;EAC7B,SAAS,QAAQ;EACjB,IAAI,UAAU,QAAQ,EAAE;CACzB;AACD"}

package/dist/plugin/registerAdmin.js

@@ -0,0 +1,49 @@
+import { isStartableAuthCollection } from "./startable.js";
+//#region src/plugin/registerAdmin.ts
+const pathOf = (component) => {
+	if (typeof component === "string") return component;
+	if (component && typeof component === "object" && "path" in component) return component.exportName ? `${component.path}#${component.exportName}` : component.path;
+};
+const ACTION = "@10x-media/impersonation/rsc#ImpersonationAction";
+const PROVIDER = "@10x-media/impersonation/rsc#ImpersonationProvider";
+const DOCUMENT_ACTION = "@10x-media/impersonation/client#ImpersonationDocumentButton";
+const registerAdmin = (config, options) => {
+	config.admin ??= {};
+	config.admin.components ??= {};
+	config.admin.components.providers = [...config.admin.components.providers ?? [], PROVIDER];
+	const cardPath = options.ui.card ? pathOf(options.ui.card) : void 0;
+	if (cardPath) config.admin.dependencies = {
+		...config.admin.dependencies,
+		"impersonation-card": {
+			path: cardPath,
+			type: "component"
+		}
+	};
+	if (options.ui.headerAction) config.admin.components.actions = [...config.admin.components.actions ?? [], ACTION];
+	if (!options.ui.documentAction) return;
+	config.collections = (config.collections ?? []).map((collection) => {
+		if (!isStartableAuthCollection(collection, options)) return collection;
+		return withDocumentAction(collection);
+	});
+};
+const withDocumentAction = (collection) => {
+	const edit = collection.admin?.components?.edit;
+	const existing = edit && typeof edit === "object" && "beforeDocumentControls" in edit ? edit.beforeDocumentControls : void 0;
+	return {
+		...collection,
+		admin: {
+			...collection.admin,
+			components: {
+				...collection.admin?.components,
+				edit: {
+					...typeof edit === "object" ? edit : {},
+					beforeDocumentControls: [...existing ?? [], DOCUMENT_ACTION]
+				}
+			}
+		}
+	};
+};
+//#endregion
+export { registerAdmin };
+
+//# sourceMappingURL=registerAdmin.js.map

package/dist/plugin/registerAdmin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registerAdmin.js","names":[],"sources":["../../src/plugin/registerAdmin.ts"],"sourcesContent":["import type { CollectionConfig, Config, PayloadComponent } from 'payload'\n\nimport type { ResolvedOptions } from '../types'\nimport { isStartableAuthCollection } from './startable'\n\nexport const pathOf = (component: PayloadComponent): string | undefined => {\n\tif (typeof component === 'string') {\n\t\treturn component\n\t}\n\tif (component && typeof component === 'object' && 'path' in component) {\n\t\treturn component.exportName ? `${component.path}#${component.exportName}` : component.path\n\t}\n\treturn undefined\n}\n\nconst ACTION = '@10x-media/impersonation/rsc#ImpersonationAction'\nconst PROVIDER = '@10x-media/impersonation/rsc#ImpersonationProvider'\nconst DOCUMENT_ACTION = '@10x-media/impersonation/client#ImpersonationDocumentButton'\n\nexport const registerAdmin = (config: Config, options: ResolvedOptions): void => {\n\tconfig.admin ??= {}\n\tconfig.admin.components ??= {}\n\tconfig.admin.components.providers = [...(config.admin.components.providers ?? []), PROVIDER]\n\n\tconst cardPath = options.ui.card ? pathOf(options.ui.card) : undefined\n\tif (cardPath) {\n\t\tconfig.admin.dependencies = {\n\t\t\t...config.admin.dependencies,\n\t\t\t'impersonation-card': { path: cardPath, type: 'component' },\n\t\t}\n\t}\n\tif (options.ui.headerAction) {\n\t\tconfig.admin.components.actions = [...(config.admin.components.actions ?? []), ACTION]\n\t}\n\n\tif (!options.ui.documentAction) {\n\t\treturn\n\t}\n\n\tconfig.collections = (config.collections ?? []).map((collection) => {\n\t\tif (!isStartableAuthCollection(collection, options)) {\n\t\t\treturn collection\n\t\t}\n\t\treturn withDocumentAction(collection)\n\t})\n}\n\nconst withDocumentAction = (collection: CollectionConfig): CollectionConfig => {\n\tconst edit = collection.admin?.components?.edit\n\tconst existing = (\n\t\tedit && typeof edit === 'object' && 'beforeDocumentControls' in edit\n\t\t\t? edit.beforeDocumentControls\n\t\t\t: undefined\n\t) as string[] | undefined\n\n\treturn {\n\t\t...collection,\n\t\tadmin: {\n\t\t\t...collection.admin,\n\t\t\tcomponents: {\n\t\t\t\t...collection.admin?.components,\n\t\t\t\tedit: {\n\t\t\t\t\t...(typeof edit === 'object' ? edit : {}),\n\t\t\t\t\tbeforeDocumentControls: [...(existing ?? []), DOCUMENT_ACTION],\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t}\n}\n"],"mappings":";;AAKA,MAAa,UAAU,cAAoD;CAC1E,IAAI,OAAO,cAAc,UACxB,OAAO;CAER,IAAI,aAAa,OAAO,cAAc,YAAY,UAAU,WAC3D,OAAO,UAAU,aAAa,GAAG,UAAU,KAAK,GAAG,UAAU,eAAe,UAAU;AAGxF;AAEA,MAAM,SAAS;AACf,MAAM,WAAW;AACjB,MAAM,kBAAkB;AAExB,MAAa,iBAAiB,QAAgB,YAAmC;CAChF,OAAO,UAAU,CAAC;CAClB,OAAO,MAAM,eAAe,CAAC;CAC7B,OAAO,MAAM,WAAW,YAAY,CAAC,GAAI,OAAO,MAAM,WAAW,aAAa,CAAC,GAAI,QAAQ;CAE3F,MAAM,WAAW,QAAQ,GAAG,OAAO,OAAO,QAAQ,GAAG,IAAI,IAAI,KAAA;CAC7D,IAAI,UACH,OAAO,MAAM,eAAe;EAC3B,GAAG,OAAO,MAAM;EAChB,sBAAsB;GAAE,MAAM;GAAU,MAAM;EAAY;CAC3D;CAED,IAAI,QAAQ,GAAG,cACd,OAAO,MAAM,WAAW,UAAU,CAAC,GAAI,OAAO,MAAM,WAAW,WAAW,CAAC,GAAI,MAAM;CAGtF,IAAI,CAAC,QAAQ,GAAG,gBACf;CAGD,OAAO,eAAe,OAAO,eAAe,CAAC,GAAG,KAAK,eAAe;EACnE,IAAI,CAAC,0BAA0B,YAAY,OAAO,GACjD,OAAO;EAER,OAAO,mBAAmB,UAAU;CACrC,CAAC;AACF;AAEA,MAAM,sBAAsB,eAAmD;CAC9E,MAAM,OAAO,WAAW,OAAO,YAAY;CAC3C,MAAM,WACL,QAAQ,OAAO,SAAS,YAAY,4BAA4B,OAC7D,KAAK,yBACL,KAAA;CAGJ,OAAO;EACN,GAAG;EACH,OAAO;GACN,GAAG,WAAW;GACd,YAAY;IACX,GAAG,WAAW,OAAO;IACrB,MAAM;KACL,GAAI,OAAO,SAAS,WAAW,OAAO,CAAC;KACvC,wBAAwB,CAAC,GAAI,YAAY,CAAC,GAAI,eAAe;IAC9D;GACD;EACD;CACD;AACD"}

package/dist/plugin/registerCollection.js

@@ -0,0 +1,183 @@
+import { ADMIN_GROUP } from "./constants.js";
+import { keys } from "../translations/keys.js";
+import { labelForKey } from "../translations/server.js";
+//#region src/plugin/registerCollection.ts
+const deny = () => false;
+const buildRecordsCollection = ({ authSlugs, options }) => {
+	const relationTo = authSlugs.length > 0 ? authSlugs : ["users"];
+	return {
+		slug: options.collectionSlug,
+		access: {
+			create: deny,
+			delete: deny,
+			read: options.access.readRecords,
+			update: deny
+		},
+		admin: {
+			defaultColumns: [
+				"target",
+				"impersonator",
+				"startedAt",
+				"endedAt",
+				"endedBy"
+			],
+			group: ADMIN_GROUP,
+			hidden: !options.ui.sessionsCollection,
+			useAsTitle: "targetTitle",
+			...options.ui.recordAction ? { components: { edit: { beforeDocumentControls: ["@10x-media/impersonation/client#EndSessionMenuItem"] } } } : {}
+		},
+		fields: [
+			{
+				name: "impersonator",
+				type: "relationship",
+				label: labelForKey(keys.fieldImpersonator),
+				relationTo,
+				required: true
+			},
+			{
+				name: "target",
+				type: "relationship",
+				label: labelForKey(keys.fieldTarget),
+				relationTo,
+				required: true
+			},
+			{
+				name: "impersonatorEmail",
+				type: "text",
+				index: true
+			},
+			{
+				name: "targetEmail",
+				type: "text",
+				index: true
+			},
+			{
+				name: "impersonatorTitle",
+				type: "text"
+			},
+			{
+				name: "targetTitle",
+				type: "text"
+			},
+			{
+				name: "mode",
+				type: "select",
+				label: labelForKey(keys.fieldMode),
+				options: [{
+					label: "swap",
+					value: "swap"
+				}, {
+					label: "parallel",
+					value: "parallel"
+				}],
+				required: true
+			},
+			{
+				name: "targetSid",
+				type: "text",
+				index: true,
+				required: true
+			},
+			{
+				name: "impersonatorSid",
+				type: "text",
+				index: true,
+				required: true
+			},
+			{
+				name: "impersonatorTenantCookie",
+				type: "text"
+			},
+			{
+				name: "startedAt",
+				type: "date",
+				label: labelForKey(keys.fieldStartedAt),
+				required: true
+			},
+			{
+				name: "endedAt",
+				type: "date",
+				index: true,
+				label: labelForKey(keys.fieldEndedAt)
+			},
+			{
+				name: "endedBy",
+				type: "select",
+				label: labelForKey(keys.fieldEndedBy),
+				options: [
+					{
+						label: "exit",
+						value: "exit"
+					},
+					{
+						label: "logout",
+						value: "logout"
+					},
+					{
+						label: "terminated",
+						value: "terminated"
+					},
+					{
+						label: "expired",
+						value: "expired"
+					},
+					{
+						label: "impersonatorGone",
+						value: "impersonatorGone"
+					},
+					{
+						label: "targetGone",
+						value: "targetGone"
+					},
+					{
+						label: "failed",
+						value: "failed"
+					}
+				]
+			},
+			{
+				name: "reason",
+				maxLength: 500,
+				type: "text",
+				label: labelForKey(keys.fieldReason)
+			},
+			{
+				name: "ip",
+				type: "text"
+			},
+			{
+				name: "userAgent",
+				type: "text"
+			},
+			{
+				name: "impersonatorLocale",
+				type: "text"
+			},
+			{
+				name: "absoluteExpiresAt",
+				type: "date"
+			},
+			{
+				name: "targetLocked",
+				type: "checkbox"
+			}
+		],
+		indexes: [{ fields: ["targetSid", "endedAt"] }, { fields: ["impersonatorSid", "endedAt"] }],
+		labels: {
+			plural: labelForKey(keys.collectionPlural),
+			singular: labelForKey(keys.collectionSingular)
+		},
+		timestamps: true
+	};
+};
+const registerCollection = (config, options) => {
+	const built = buildRecordsCollection({
+		authSlugs: (config.collections ?? []).filter((collection) => Boolean(collection.auth)).map(({ slug }) => slug),
+		options
+	});
+	config.collections = [...config.collections ?? [], options.collectionOverrides ? options.collectionOverrides(built) : built];
+};
+//#endregion
+export { registerCollection };
+
+//# sourceMappingURL=registerCollection.js.map