@composius/payload-plugin-auth 0.1.1

package/README.md

@@ -0,0 +1,130 @@
+# @composius/payload-plugin-auth
+
+A [Payload CMS](https://payloadcms.com) plugin that turns a `users` collection into a
+role-based auth collection — configurable roles, sensible auth hardening, and exported
+access helpers (`hasRole`, `hasRoleOrOwner`) for use in your other collections.
+
+If the collection already exists in your config it is extended (your explicit settings
+win); otherwise it is created.
+
+## Fields
+
+| Field  | Type     | Notes                                                            |
+| ------ | -------- | ---------------------------------------------------------------- |
+| `name` | `text`   | required, used as admin title                                    |
+| `role` | `select` | required, saved to the JWT; only admins can set or change it     |
+
+Email and password are added by Payload's auth. The collection also sets:
+
+- Cookies: `secure` in production only (plain-http localhost logins keep working in dev), `sameSite: 'Lax'`.
+- Brute-force protection: 5 max login attempts, 15 minutes lock time.
+- Admin UI: the collection is hidden from users without the admin role.
+- Access: `create`/`delete` admin only, `read`/`update` admin or the user themselves.
+
+## Admin lockout protection
+
+- The **first user created is always given the admin role**, whatever was submitted —
+  otherwise the default role would apply (role changes are admin-only) and nobody could
+  ever manage users.
+- The **last admin cannot be deleted or demoted**; such operations fail with a 403.
+- `adminRole`/`defaultRole` values that are not in `roles` throw at config build time.
+
+## Requirements
+
+The following dependencies are required to be installed in your project before using this plugin:
+
+- `payload` (`^3.84.1`)
+
+```bash
+pnpm add payload
+```
+
+## Usage
+
+```ts
+import { buildConfig } from 'payload'
+import { ComposiusPayloadPluginAuth, hasRole, hasRoleOrOwner } from '@composius/payload-plugin-auth'
+
+export default buildConfig({
+  plugins: [
+    ComposiusPayloadPluginAuth({
+      // Custom roles: the role select offers these instead of the defaults
+      roles: [
+        { label: 'Admin', value: 'admin' },
+        { label: 'Author', value: 'author' },
+        { label: 'Member', value: 'member' },
+      ],
+      // New users become members; the very first user still becomes admin
+      defaultRole: 'member',
+    }),
+  ],
+  collections: [
+    {
+      slug: 'articles',
+      access: {
+        read: () => true,
+        create: hasRole('admin', 'author'),
+        // admins see everything, authors only the articles they authored
+        update: hasRoleOrOwner(['admin'], 'author'),
+        delete: hasRole('admin'),
+      },
+      fields: [{ name: 'author', type: 'relationship', relationTo: 'users' }],
+    },
+  ],
+  // ...
+})
+```
+
+### Access helpers
+
+- `hasRole(...roles)` — collection access allowing users whose `role` is one of the given values.
+- `hasRoleFieldLevel(...roles)` — the same check as field-level access (field access cannot return a query).
+- `hasRoleOrOwner(roles, ownerField = 'id')` — allows the given roles, and otherwise
+  restricts the operation to documents whose `ownerField` equals the user's id. The
+  default `'id'` gives "self" access on the users collection; pass a relationship field
+  name (`'author'`, `'owner'`, …) for other collections.
+
+## Options
+
+All optional — defaults shown as comments:
+
+```ts
+ComposiusPayloadPluginAuth({
+  // Access per operation. Defaults: create/delete = admin role,
+  // read/update = admin role or the user themselves.
+  access: { read, create, update, delete },
+
+  // Role value with full access to the users collection and admin UI.
+  adminRole: 'admin',
+
+  // Role value assigned to new users (except the very first, who becomes admin).
+  defaultRole: 'viewer',
+
+  // Selectable roles. Default: Admin, Editor, Viewer.
+  roles: [
+    { label: 'Admin', value: 'admin' },
+    { label: 'Editor', value: 'editor' },
+    { label: 'Viewer', value: 'viewer' },
+  ],
+
+  // Slug of the auth collection to extend or create.
+  slug: 'users',
+
+  // Keeps the collection schema but disables runtime behavior (default: false).
+  disabled: false,
+})
+```
+
+## Development
+
+From the monorepo root:
+
+```bash
+pnpm install
+pnpm dev:auth                                        # dev Payload app with this plugin
+pnpm vitest run packages/payload-plugin-auth/test    # unit tests
+pnpm vitest run dev/configs/auth                     # integration tests
+pnpm --filter @composius/payload-plugin-auth build  # build to dist/
+```
+
+See the [root README](../../README.md) for the release flow.

package/dist/index.d.ts

@@ -0,0 +1,58 @@
+import { Access, FieldAccess, Config } from 'payload';
+
+/** Collection access allowing only users whose `role` is one of the given values. */
+declare const hasRole: (...roles: string[]) => Access;
+/** Field-level variant of {@link hasRole} (field access cannot return a query). */
+declare const hasRoleFieldLevel: (...roles: string[]) => FieldAccess;
+/**
+ * Collection access allowing users whose `role` is one of the given values, and
+ * otherwise restricting the operation to documents the user owns: those whose
+ * `ownerField` equals the user's id. Use `'id'` (the default) for the users
+ * collection itself, or a relationship field name (e.g. `'owner'`, `'author'`)
+ * for other collections.
+ */
+declare const hasRoleOrOwner: (roles: string[], ownerField?: string) => Access;
+
+type Role = {
+    label: Record<string, string> | string;
+    value: string;
+};
+type UsersAccess = {
+    create?: Access;
+    delete?: Access;
+    read?: Access;
+    update?: Access;
+};
+type ComposiusPayloadPluginAuthConfig = {
+    /**
+     * Access control for the users collection, per operation.
+     * Defaults: `create`/`delete` require the admin role, `read`/`update` allow
+     * the admin role or the user themselves.
+     */
+    access?: UsersAccess;
+    /**
+     * Role value granting full access to the users collection and admin UI.
+     * Must be one of `roles`. Defaults to `'admin'`.
+     */
+    adminRole?: string;
+    /**
+     * Role value assigned to new users by default. Must be one of `roles`.
+     * Defaults to `'viewer'`.
+     */
+    defaultRole?: string;
+    disabled?: boolean;
+    /**
+     * Selectable roles for the `role` field.
+     * Defaults to Admin (`admin`), Editor (`editor`) and Viewer (`viewer`).
+     */
+    roles?: Role[];
+    /**
+     * Slug of the auth users collection to extend (created when it does not
+     * exist yet). Defaults to `'users'`.
+     */
+    slug?: string;
+};
+
+declare const ComposiusPayloadPluginAuth: (pluginOptions?: ComposiusPayloadPluginAuthConfig) => (config: Config) => Config;
+
+export { ComposiusPayloadPluginAuth, type ComposiusPayloadPluginAuthConfig, type Role, type UsersAccess, hasRole, hasRoleFieldLevel, hasRoleOrOwner };

package/dist/index.js

@@ -0,0 +1,252 @@
+// src/access.ts
+var roleOf = (user) => {
+  const role = user?.role;
+  return typeof role === "string" ? role : void 0;
+};
+var hasRole = (...roles) => ({ req: { user } }) => {
+  const role = roleOf(user);
+  return role !== void 0 && roles.includes(role);
+};
+var hasRoleFieldLevel = (...roles) => ({ req: { user } }) => {
+  const role = roleOf(user);
+  return role !== void 0 && roles.includes(role);
+};
+var hasRoleOrOwner = (roles, ownerField = "id") => ({ req: { user } }) => {
+  if (!user) {
+    return false;
+  }
+  const role = roleOf(user);
+  if (role !== void 0 && roles.includes(role)) {
+    return true;
+  }
+  return { [ownerField]: { equals: user.id } };
+};
+
+// src/collections/Users.ts
+import { APIError } from "payload";
+
+// src/translations/en.ts
+var en = {
+  errors: {
+    lastAdminDelete: "The last admin user cannot be deleted.",
+    lastAdminRole: "The last admin user cannot lose the admin role."
+  },
+  fields: {
+    name: "Name",
+    role: "Role"
+  },
+  roles: {
+    admin: "Admin",
+    editor: "Editor",
+    viewer: "Viewer"
+  },
+  users: {
+    plural: "Users",
+    singular: "User"
+  }
+};
+
+// src/translations/fr.ts
+var fr = {
+  errors: {
+    lastAdminDelete: "Le dernier utilisateur admin ne peut pas \xEAtre supprim\xE9.",
+    lastAdminRole: "Le dernier utilisateur admin ne peut pas perdre le r\xF4le d'admin."
+  },
+  fields: {
+    name: "Nom",
+    role: "R\xF4le"
+  },
+  roles: {
+    admin: "Admin",
+    editor: "\xC9diteur",
+    viewer: "Lecteur"
+  },
+  users: {
+    plural: "Utilisateurs",
+    singular: "Utilisateur"
+  }
+};
+
+// src/translations/index.ts
+var translations = { en, fr };
+var label = (pick) => ({
+  en: pick(en),
+  fr: pick(fr)
+});
+var translate = (language, pick) => pick(translations[language ?? "en"] ?? en);
+
+// src/collections/Users.ts
+var fieldNames = (fields) => fields.map((field) => field.name).filter(
+  (name) => Boolean(name)
+);
+var withUsersAuth = (existing, { access, adminRole, defaultRole, roles, slug }) => {
+  const collection = slug;
+  const adminFieldLevel = hasRoleFieldLevel(adminRole);
+  const countAdmins = (req) => req.payload.count({
+    collection,
+    req,
+    where: { role: { equals: adminRole } }
+  });
+  const existingAuth = typeof existing?.auth === "object" ? existing.auth : {};
+  const existingFieldNames = fieldNames(existing?.fields ?? []);
+  const addedFields = [
+    // Email added by default
+    {
+      name: "name",
+      type: "text",
+      label: label((t) => t.fields.name),
+      required: true
+    },
+    {
+      name: "role",
+      type: "select",
+      label: label((t) => t.fields.role),
+      options: roles,
+      defaultValue: defaultRole,
+      required: true,
+      saveToJWT: true,
+      access: {
+        // Users can update their own profile, but only admins can change roles
+        create: adminFieldLevel,
+        update: adminFieldLevel
+      }
+    }
+  ];
+  return {
+    ...existing,
+    slug,
+    labels: existing?.labels ?? {
+      singular: label((t) => t.users.singular),
+      plural: label((t) => t.users.plural)
+    },
+    admin: {
+      useAsTitle: "name",
+      defaultColumns: ["name", "email", "role", "createdAt"],
+      hidden: ({ user }) => user?.role !== adminRole,
+      ...existing?.admin
+    },
+    auth: {
+      ...existingAuth,
+      cookies: {
+        // secure: true would break plain-http localhost logins in dev
+        secure: process.env.NODE_ENV === "production",
+        sameSite: "Lax",
+        ...existingAuth.cookies
+      },
+      maxLoginAttempts: existingAuth.maxLoginAttempts ?? 5,
+      lockTime: existingAuth.lockTime ?? 15 * 60 * 1e3
+      // 15 minutes
+    },
+    access: {
+      create: access.create,
+      read: access.read,
+      update: access.update,
+      delete: access.delete,
+      ...existing?.access
+    },
+    hooks: {
+      ...existing?.hooks,
+      beforeChange: [
+        ...existing?.hooks?.beforeChange ?? [],
+        async ({ data, operation, originalDoc, req }) => {
+          if (operation === "create") {
+            const { totalDocs } = await req.payload.count({ collection, req });
+            if (totalDocs === 0) {
+              data.role = adminRole;
+            }
+            return data;
+          }
+          if (operation === "update" && originalDoc?.role === adminRole && typeof data?.role === "string" && data.role !== adminRole) {
+            const { totalDocs } = await countAdmins(req);
+            if (totalDocs <= 1) {
+              throw new APIError(
+                translate(req.i18n?.language, (t) => t.errors.lastAdminRole),
+                403
+              );
+            }
+          }
+          return data;
+        }
+      ],
+      beforeDelete: [
+        ...existing?.hooks?.beforeDelete ?? [],
+        async ({ id, req }) => {
+          const doc = await req.payload.findByID({ collection, id, depth: 0, req });
+          if (doc?.role === adminRole) {
+            const { totalDocs } = await countAdmins(req);
+            if (totalDocs <= 1) {
+              throw new APIError(
+                translate(req.i18n?.language, (t) => t.errors.lastAdminDelete),
+                403
+              );
+            }
+          }
+        }
+      ]
+    },
+    fields: [
+      ...existing?.fields ?? [],
+      ...addedFields.filter(
+        (field) => !existingFieldNames.includes(field.name ?? "")
+      )
+    ]
+  };
+};
+
+// src/index.ts
+var defaultRoles = [
+  { label: label((t) => t.roles.admin), value: "admin" },
+  { label: label((t) => t.roles.editor), value: "editor" },
+  { label: label((t) => t.roles.viewer), value: "viewer" }
+];
+var ComposiusPayloadPluginAuth = (pluginOptions = {}) => (config) => {
+  const slug = pluginOptions.slug ?? "users";
+  const roles = pluginOptions.roles ?? defaultRoles;
+  const adminRole = pluginOptions.adminRole ?? "admin";
+  const defaultRole = pluginOptions.defaultRole ?? "viewer";
+  const roleValues = roles.map((role) => role.value);
+  if (!roleValues.includes(adminRole)) {
+    throw new Error(
+      `ComposiusPayloadPluginAuth: adminRole "${adminRole}" is not one of the configured roles (${roleValues.join(", ")})`
+    );
+  }
+  if (!roleValues.includes(defaultRole)) {
+    throw new Error(
+      `ComposiusPayloadPluginAuth: defaultRole "${defaultRole}" is not one of the configured roles (${roleValues.join(", ")})`
+    );
+  }
+  const admin = hasRole(adminRole);
+  const adminOrSelf = hasRoleOrOwner([adminRole], "id");
+  const access = {
+    create: pluginOptions.access?.create ?? admin,
+    delete: pluginOptions.access?.delete ?? admin,
+    read: pluginOptions.access?.read ?? adminOrSelf,
+    update: pluginOptions.access?.update ?? adminOrSelf
+  };
+  if (!config.collections) {
+    config.collections = [];
+  }
+  const existingIndex = config.collections.findIndex(
+    (collection) => collection.slug === slug
+  );
+  const users = withUsersAuth(
+    existingIndex === -1 ? void 0 : config.collections[existingIndex],
+    { access, adminRole, defaultRole, roles, slug }
+  );
+  if (existingIndex === -1) {
+    config.collections.push(users);
+  } else {
+    config.collections[existingIndex] = users;
+  }
+  if (pluginOptions.disabled) {
+    return config;
+  }
+  return config;
+};
+export {
+  ComposiusPayloadPluginAuth,
+  hasRole,
+  hasRoleFieldLevel,
+  hasRoleOrOwner
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access.ts","../src/collections/Users.ts","../src/translations/en.ts","../src/translations/fr.ts","../src/translations/index.ts","../src/index.ts"],"sourcesContent":["import type { Access, FieldAccess } from 'payload'\n\nconst roleOf = (user: unknown): string | undefined => {\n  const role = (user as { role?: unknown } | null | undefined)?.role\n  return typeof role === 'string' ? role : undefined\n}\n\n/** Collection access allowing only users whose `role` is one of the given values. */\nexport const hasRole =\n  (...roles: string[]): Access =>\n  ({ req: { user } }) => {\n    const role = roleOf(user)\n    return role !== undefined && roles.includes(role)\n  }\n\n/** Field-level variant of {@link hasRole} (field access cannot return a query). */\nexport const hasRoleFieldLevel =\n  (...roles: string[]): FieldAccess =>\n  ({ req: { user } }) => {\n    const role = roleOf(user)\n    return role !== undefined && roles.includes(role)\n  }\n\n/**\n * Collection access allowing users whose `role` is one of the given values, and\n * otherwise restricting the operation to documents the user owns: those whose\n * `ownerField` equals the user's id. Use `'id'` (the default) for the users\n * collection itself, or a relationship field name (e.g. `'owner'`, `'author'`)\n * for other collections.\n */\nexport const hasRoleOrOwner =\n  (roles: string[], ownerField = 'id'): Access =>\n  ({ req: { user } }) => {\n    if (!user) {\n      return false\n    }\n\n    const role = roleOf(user)\n    if (role !== undefined && roles.includes(role)) {\n      return true\n    }\n\n    return { [ownerField]: { equals: user.id } }\n  }\n","import type { CollectionConfig, CollectionSlug, Field, PayloadRequest } from 'payload'\n\nimport { APIError } from 'payload'\n\nimport { hasRoleFieldLevel } from '../access.js'\nimport { label, translate } from '../translations/index.js'\nimport type { UsersOptions } from '../types.js'\n\nconst fieldNames = (fields: Field[]): string[] =>\n  fields.map((field) => (field as { name?: string }).name).filter((name): name is string =>\n    Boolean(name),\n  )\n\n/**\n * Extends an existing users collection with auth settings, role field, access\n * control and last-admin protections. Explicit settings already present on the\n * existing collection win over the plugin's; when there is no existing\n * collection, pass `undefined` to build one from scratch.\n */\nexport const withUsersAuth = (\n  existing: CollectionConfig | undefined,\n  { access, adminRole, defaultRole, roles, slug }: UsersOptions,\n): CollectionConfig => {\n  const collection = slug as CollectionSlug\n  const adminFieldLevel = hasRoleFieldLevel(adminRole)\n\n  const countAdmins = (req: PayloadRequest) =>\n    req.payload.count({\n      collection,\n      req,\n      where: { role: { equals: adminRole } },\n    })\n\n  const existingAuth = typeof existing?.auth === 'object' ? existing.auth : {}\n  const existingFieldNames = fieldNames(existing?.fields ?? [])\n\n  const addedFields: Field[] = [\n    // Email added by default\n    {\n      name: 'name',\n      type: 'text',\n      label: label((t) => t.fields.name),\n      required: true,\n    },\n    {\n      name: 'role',\n      type: 'select',\n      label: label((t) => t.fields.role),\n      options: roles,\n      defaultValue: defaultRole,\n      required: true,\n      saveToJWT: true,\n      access: {\n        // Users can update their own profile, but only admins can change roles\n        create: adminFieldLevel,\n        update: adminFieldLevel,\n      },\n    },\n  ]\n\n  return {\n    ...existing,\n    slug,\n    labels: existing?.labels ?? {\n      singular: label((t) => t.users.singular),\n      plural: label((t) => t.users.plural),\n    },\n    admin: {\n      useAsTitle: 'name',\n      defaultColumns: ['name', 'email', 'role', 'createdAt'],\n      hidden: ({ user }) => (user as { role?: string } | null)?.role !== adminRole,\n      ...existing?.admin,\n    },\n    auth: {\n      ...existingAuth,\n      cookies: {\n        // secure: true would break plain-http localhost logins in dev\n        secure: process.env.NODE_ENV === 'production',\n        sameSite: 'Lax',\n        ...existingAuth.cookies,\n      },\n      maxLoginAttempts: existingAuth.maxLoginAttempts ?? 5,\n      lockTime: existingAuth.lockTime ?? 15 * 60 * 1000, // 15 minutes\n    },\n    access: {\n      create: access.create,\n      read: access.read,\n      update: access.update,\n      delete: access.delete,\n      ...existing?.access,\n    },\n    hooks: {\n      ...existing?.hooks,\n      beforeChange: [\n        ...(existing?.hooks?.beforeChange ?? []),\n        async ({ data, operation, originalDoc, req }) => {\n          if (operation === 'create') {\n            // The very first user must get the admin role no matter what was\n            // submitted: role creation is admin-only, so a non-admin first\n            // user would leave the panel without anyone able to manage users.\n            const { totalDocs } = await req.payload.count({ collection, req })\n            if (totalDocs === 0) {\n              data.role = adminRole\n            }\n            return data\n          }\n\n          if (\n            operation === 'update' &&\n            originalDoc?.role === adminRole &&\n            typeof data?.role === 'string' &&\n            data.role !== adminRole\n          ) {\n            const { totalDocs } = await countAdmins(req)\n            if (totalDocs <= 1) {\n              throw new APIError(\n                translate(req.i18n?.language, (t) => t.errors.lastAdminRole),\n                403,\n              )\n            }\n          }\n\n          return data\n        },\n      ],\n      beforeDelete: [\n        ...(existing?.hooks?.beforeDelete ?? []),\n        async ({ id, req }) => {\n          const doc = await req.payload.findByID({ collection, id, depth: 0, req })\n          if ((doc as { role?: string } | null)?.role === adminRole) {\n            const { totalDocs } = await countAdmins(req)\n            if (totalDocs <= 1) {\n              throw new APIError(\n                translate(req.i18n?.language, (t) => t.errors.lastAdminDelete),\n                403,\n              )\n            }\n          }\n        },\n      ],\n    },\n    fields: [\n      ...(existing?.fields ?? []),\n      ...addedFields.filter(\n        (field) => !existingFieldNames.includes((field as { name?: string }).name ?? ''),\n      ),\n    ],\n  }\n}\n","export const en = {\n  errors: {\n    lastAdminDelete: 'The last admin user cannot be deleted.',\n    lastAdminRole: 'The last admin user cannot lose the admin role.',\n  },\n  fields: {\n    name: 'Name',\n    role: 'Role',\n  },\n  roles: {\n    admin: 'Admin',\n    editor: 'Editor',\n    viewer: 'Viewer',\n  },\n  users: {\n    plural: 'Users',\n    singular: 'User',\n  },\n}\n","import type { Translation } from './index.js'\n\nexport const fr: Translation = {\n  errors: {\n    lastAdminDelete: 'Le dernier utilisateur admin ne peut pas être supprimé.',\n    lastAdminRole: \"Le dernier utilisateur admin ne peut pas perdre le rôle d'admin.\",\n  },\n  fields: {\n    name: 'Nom',\n    role: 'Rôle',\n  },\n  roles: {\n    admin: 'Admin',\n    editor: 'Éditeur',\n    viewer: 'Lecteur',\n  },\n  users: {\n    plural: 'Utilisateurs',\n    singular: 'Utilisateur',\n  },\n}\n","import { en } from './en.js'\nimport { fr } from './fr.js'\n\nexport type Translation = typeof en\n\nconst translations: Record<string, Translation> = { en, fr }\n\n/** Builds a Payload label record ({ en, fr }) from a translation key selector. */\nexport const label = (pick: (t: Translation) => string): Record<string, string> => ({\n  en: pick(en),\n  fr: pick(fr),\n})\n\n/** Resolves a translation for a runtime language (e.g. `req.i18n.language`), falling back to English. */\nexport const translate = (\n  language: string | undefined,\n  pick: (t: Translation) => string,\n): string => pick(translations[language ?? 'en'] ?? en)\n","import type { Config } from 'payload'\n\nimport { hasRole, hasRoleFieldLevel, hasRoleOrOwner } from './access.js'\nimport { withUsersAuth } from './collections/Users.js'\nimport { label } from './translations/index.js'\nimport type { Role, UsersAccess, ComposiusPayloadPluginAuthConfig } from './types.js'\n\nexport { hasRole, hasRoleFieldLevel, hasRoleOrOwner }\nexport type { Role, UsersAccess, ComposiusPayloadPluginAuthConfig }\n\nconst defaultRoles: Role[] = [\n  { label: label((t) => t.roles.admin), value: 'admin' },\n  { label: label((t) => t.roles.editor), value: 'editor' },\n  { label: label((t) => t.roles.viewer), value: 'viewer' },\n]\n\nexport const ComposiusPayloadPluginAuth =\n  (pluginOptions: ComposiusPayloadPluginAuthConfig = {}) =>\n  (config: Config): Config => {\n    const slug = pluginOptions.slug ?? 'users'\n    const roles = pluginOptions.roles ?? defaultRoles\n    const adminRole = pluginOptions.adminRole ?? 'admin'\n    const defaultRole = pluginOptions.defaultRole ?? 'viewer'\n\n    // A wrong role value here would lock everyone out of the users collection\n    // (or hand new users an invalid role), so fail at config build time.\n    const roleValues = roles.map((role) => role.value)\n    if (!roleValues.includes(adminRole)) {\n      throw new Error(\n        `ComposiusPayloadPluginAuth: adminRole \"${adminRole}\" is not one of the configured roles (${roleValues.join(', ')})`,\n      )\n    }\n    if (!roleValues.includes(defaultRole)) {\n      throw new Error(\n        `ComposiusPayloadPluginAuth: defaultRole \"${defaultRole}\" is not one of the configured roles (${roleValues.join(', ')})`,\n      )\n    }\n\n    const admin = hasRole(adminRole)\n    const adminOrSelf = hasRoleOrOwner([adminRole], 'id')\n\n    const access = {\n      create: pluginOptions.access?.create ?? admin,\n      delete: pluginOptions.access?.delete ?? admin,\n      read: pluginOptions.access?.read ?? adminOrSelf,\n      update: pluginOptions.access?.update ?? adminOrSelf,\n    }\n\n    if (!config.collections) {\n      config.collections = []\n    }\n\n    const existingIndex = config.collections.findIndex(\n      (collection) => collection.slug === slug,\n    )\n    const users = withUsersAuth(\n      existingIndex === -1 ? undefined : config.collections[existingIndex],\n      { access, adminRole, defaultRole, roles, slug },\n    )\n\n    if (existingIndex === -1) {\n      config.collections.push(users)\n    } else {\n      config.collections[existingIndex] = users\n    }\n\n    /**\n     * If the plugin is disabled, we still want to keep added collections/fields so the database schema is consistent which is important for migrations.\n     */\n    if (pluginOptions.disabled) {\n      return config\n    }\n\n    return config\n  }\n"],"mappings":";AAEA,IAAM,SAAS,CAAC,SAAsC;AACpD,QAAM,OAAQ,MAAgD;AAC9D,SAAO,OAAO,SAAS,WAAW,OAAO;AAC3C;AAGO,IAAM,UACX,IAAI,UACJ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;AACrB,QAAM,OAAO,OAAO,IAAI;AACxB,SAAO,SAAS,UAAa,MAAM,SAAS,IAAI;AAClD;AAGK,IAAM,oBACX,IAAI,UACJ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;AACrB,QAAM,OAAO,OAAO,IAAI;AACxB,SAAO,SAAS,UAAa,MAAM,SAAS,IAAI;AAClD;AASK,IAAM,iBACX,CAAC,OAAiB,aAAa,SAC/B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;AACrB,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,OAAO,IAAI;AACxB,MAAI,SAAS,UAAa,MAAM,SAAS,IAAI,GAAG;AAC9C,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,CAAC,UAAU,GAAG,EAAE,QAAQ,KAAK,GAAG,EAAE;AAC7C;;;ACzCF,SAAS,gBAAgB;;;ACFlB,IAAM,KAAK;AAAA,EAChB,QAAQ;AAAA,IACN,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AAAA,EACA,OAAO;AAAA,IACL,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,OAAO;AAAA,IACL,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AACF;;;AChBO,IAAM,KAAkB;AAAA,EAC7B,QAAQ;AAAA,IACN,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AAAA,EACA,OAAO;AAAA,IACL,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,OAAO;AAAA,IACL,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AACF;;;ACfA,IAAM,eAA4C,EAAE,IAAI,GAAG;AAGpD,IAAM,QAAQ,CAAC,UAA8D;AAAA,EAClF,IAAI,KAAK,EAAE;AAAA,EACX,IAAI,KAAK,EAAE;AACb;AAGO,IAAM,YAAY,CACvB,UACA,SACW,KAAK,aAAa,YAAY,IAAI,KAAK,EAAE;;;AHTtD,IAAM,aAAa,CAAC,WAClB,OAAO,IAAI,CAAC,UAAW,MAA4B,IAAI,EAAE;AAAA,EAAO,CAAC,SAC/D,QAAQ,IAAI;AACd;AAQK,IAAM,gBAAgB,CAC3B,UACA,EAAE,QAAQ,WAAW,aAAa,OAAO,KAAK,MACzB;AACrB,QAAM,aAAa;AACnB,QAAM,kBAAkB,kBAAkB,SAAS;AAEnD,QAAM,cAAc,CAAC,QACnB,IAAI,QAAQ,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA,OAAO,EAAE,MAAM,EAAE,QAAQ,UAAU,EAAE;AAAA,EACvC,CAAC;AAEH,QAAM,eAAe,OAAO,UAAU,SAAS,WAAW,SAAS,OAAO,CAAC;AAC3E,QAAM,qBAAqB,WAAW,UAAU,UAAU,CAAC,CAAC;AAE5D,QAAM,cAAuB;AAAA;AAAA,IAE3B;AAAA,MACE,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI;AAAA,MACjC,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI;AAAA,MACjC,SAAS;AAAA,MACT,cAAc;AAAA,MACd,UAAU;AAAA,MACV,WAAW;AAAA,MACX,QAAQ;AAAA;AAAA,QAEN,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,QAAQ,UAAU,UAAU;AAAA,MAC1B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,QAAQ;AAAA,MACvC,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,MAAM;AAAA,IACrC;AAAA,IACA,OAAO;AAAA,MACL,YAAY;AAAA,MACZ,gBAAgB,CAAC,QAAQ,SAAS,QAAQ,WAAW;AAAA,MACrD,QAAQ,CAAC,EAAE,KAAK,MAAO,MAAmC,SAAS;AAAA,MACnE,GAAG,UAAU;AAAA,IACf;AAAA,IACA,MAAM;AAAA,MACJ,GAAG;AAAA,MACH,SAAS;AAAA;AAAA,QAEP,QAAQ,QAAQ,IAAI,aAAa;AAAA,QACjC,UAAU;AAAA,QACV,GAAG,aAAa;AAAA,MAClB;AAAA,MACA,kBAAkB,aAAa,oBAAoB;AAAA,MACnD,UAAU,aAAa,YAAY,KAAK,KAAK;AAAA;AAAA,IAC/C;AAAA,IACA,QAAQ;AAAA,MACN,QAAQ,OAAO;AAAA,MACf,MAAM,OAAO;AAAA,MACb,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,GAAG,UAAU;AAAA,IACf;AAAA,IACA,OAAO;AAAA,MACL,GAAG,UAAU;AAAA,MACb,cAAc;AAAA,QACZ,GAAI,UAAU,OAAO,gBAAgB,CAAC;AAAA,QACtC,OAAO,EAAE,MAAM,WAAW,aAAa,IAAI,MAAM;AAC/C,cAAI,cAAc,UAAU;AAI1B,kBAAM,EAAE,UAAU,IAAI,MAAM,IAAI,QAAQ,MAAM,EAAE,YAAY,IAAI,CAAC;AACjE,gBAAI,cAAc,GAAG;AACnB,mBAAK,OAAO;AAAA,YACd;AACA,mBAAO;AAAA,UACT;AAEA,cACE,cAAc,YACd,aAAa,SAAS,aACtB,OAAO,MAAM,SAAS,YACtB,KAAK,SAAS,WACd;AACA,kBAAM,EAAE,UAAU,IAAI,MAAM,YAAY,GAAG;AAC3C,gBAAI,aAAa,GAAG;AAClB,oBAAM,IAAI;AAAA,gBACR,UAAU,IAAI,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,aAAa;AAAA,gBAC3D;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAEA,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,MACA,cAAc;AAAA,QACZ,GAAI,UAAU,OAAO,gBAAgB,CAAC;AAAA,QACtC,OAAO,EAAE,IAAI,IAAI,MAAM;AACrB,gBAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,YAAY,IAAI,OAAO,GAAG,IAAI,CAAC;AACxE,cAAK,KAAkC,SAAS,WAAW;AACzD,kBAAM,EAAE,UAAU,IAAI,MAAM,YAAY,GAAG;AAC3C,gBAAI,aAAa,GAAG;AAClB,oBAAM,IAAI;AAAA,gBACR,UAAU,IAAI,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,eAAe;AAAA,gBAC7D;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,GAAI,UAAU,UAAU,CAAC;AAAA,MACzB,GAAG,YAAY;AAAA,QACb,CAAC,UAAU,CAAC,mBAAmB,SAAU,MAA4B,QAAQ,EAAE;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AACF;;;AI1IA,IAAM,eAAuB;AAAA,EAC3B,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,KAAK,GAAG,OAAO,QAAQ;AAAA,EACrD,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,MAAM,GAAG,OAAO,SAAS;AAAA,EACvD,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,MAAM,GAAG,OAAO,SAAS;AACzD;AAEO,IAAM,6BACX,CAAC,gBAAkD,CAAC,MACpD,CAAC,WAA2B;AAC1B,QAAM,OAAO,cAAc,QAAQ;AACnC,QAAM,QAAQ,cAAc,SAAS;AACrC,QAAM,YAAY,cAAc,aAAa;AAC7C,QAAM,cAAc,cAAc,eAAe;AAIjD,QAAM,aAAa,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK;AACjD,MAAI,CAAC,WAAW,SAAS,SAAS,GAAG;AACnC,UAAM,IAAI;AAAA,MACR,0CAA0C,SAAS,yCAAyC,WAAW,KAAK,IAAI,CAAC;AAAA,IACnH;AAAA,EACF;AACA,MAAI,CAAC,WAAW,SAAS,WAAW,GAAG;AACrC,UAAM,IAAI;AAAA,MACR,4CAA4C,WAAW,yCAAyC,WAAW,KAAK,IAAI,CAAC;AAAA,IACvH;AAAA,EACF;AAEA,QAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAM,cAAc,eAAe,CAAC,SAAS,GAAG,IAAI;AAEpD,QAAM,SAAS;AAAA,IACb,QAAQ,cAAc,QAAQ,UAAU;AAAA,IACxC,QAAQ,cAAc,QAAQ,UAAU;AAAA,IACxC,MAAM,cAAc,QAAQ,QAAQ;AAAA,IACpC,QAAQ,cAAc,QAAQ,UAAU;AAAA,EAC1C;AAEA,MAAI,CAAC,OAAO,aAAa;AACvB,WAAO,cAAc,CAAC;AAAA,EACxB;AAEA,QAAM,gBAAgB,OAAO,YAAY;AAAA,IACvC,CAAC,eAAe,WAAW,SAAS;AAAA,EACtC;AACA,QAAM,QAAQ;AAAA,IACZ,kBAAkB,KAAK,SAAY,OAAO,YAAY,aAAa;AAAA,IACnE,EAAE,QAAQ,WAAW,aAAa,OAAO,KAAK;AAAA,EAChD;AAEA,MAAI,kBAAkB,IAAI;AACxB,WAAO,YAAY,KAAK,KAAK;AAAA,EAC/B,OAAO;AACL,WAAO,YAAY,aAAa,IAAI;AAAA,EACtC;AAKA,MAAI,cAAc,UAAU;AAC1B,WAAO;AAAA,EACT;AAEA,SAAO;AACT;","names":[]}

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@composius/payload-plugin-auth",
+  "version": "0.1.1",
+  "description": "Users auth collection with configurable roles and role-based access helpers",
+  "license": "MIT",
+  "author": {
+    "name": "Composius"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Composius/payload-plugins",
+    "directory": "packages/payload-plugin-auth"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "payload": "3.84.1",
+    "rimraf": "3.0.2",
+    "tsup": "8.5.0",
+    "typescript": "5.7.3"
+  },
+  "peerDependencies": {
+    "payload": "^3.84.1"
+  },
+  "engines": {
+    "node": ">=20.9.0",
+    "pnpm": "^9 || ^10 || ^11"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "scripts": {
+    "build": "tsup",
+    "clean": "rimraf {dist,*.tsbuildinfo}"
+  }
+}