@composius/payload-plugin-auth 1.0.0 → 1.0.1

package/README.md

@@ -83,6 +83,7 @@ export default buildConfig({
   restricts the operation to documents whose `ownerField` equals the user's id. The
   default `'id'` gives "self" access on the users collection; pass a relationship field
   name (`'author'`, `'owner'`, …) for other collections.
+- `isAuthenticated` — allows any authenticated user.
 - `isAdmin` — allows only the plugin's `adminRole` (follows the option, default `'admin'`).
 - `isAdminOrHasRole(...roles)` — allows the plugin's `adminRole` or any of the given roles.
 - `isAuthenticatedOrPublished` — allows any authenticated user, and restricts the

package/dist/index.d.ts

@@ -4,6 +4,8 @@ import { Access, FieldAccess, Config } from 'payload';
 declare const hasRole: (...roles: string[]) => Access;
 /** Field-level variant of {@link hasRole} (field access cannot return a query). */
 declare const hasRoleFieldLevel: (...roles: string[]) => FieldAccess;
+/** Collection access allowing any authenticated user. */
+declare const isAuthenticated: Access;
 /** Collection access allowing only users with the plugin's `adminRole` (default `'admin'`). */
 declare const isAdmin: Access;
 /** Collection access allowing the plugin's `adminRole` or any of the given roles. */
@@ -65,4 +67,4 @@ type ComposiusPayloadPluginAuthConfig = {
 
 declare const ComposiusPayloadPluginAuth: (pluginOptions?: ComposiusPayloadPluginAuthConfig) => (config: Config) => Config;
 
-export { ComposiusPayloadPluginAuth, type ComposiusPayloadPluginAuthConfig, type Role, type UsersAccess, hasRole, hasRoleFieldLevel, hasRoleOrOwner, isAdmin, isAdminOrHasRole, isAuthenticatedOrPublished };
+export { ComposiusPayloadPluginAuth, type ComposiusPayloadPluginAuthConfig, type Role, type UsersAccess, hasRole, hasRoleFieldLevel, hasRoleOrOwner, isAdmin, isAdminOrHasRole, isAuthenticated, isAuthenticatedOrPublished };

package/dist/index.js

@@ -15,6 +15,7 @@ var hasRoleFieldLevel = (...roles) => ({ req: { user } }) => {
   const role = roleOf(user);
   return role !== void 0 && roles.includes(role);
 };
+var isAuthenticated = ({ req: { user } }) => Boolean(user);
 var isAdmin = ({ req: { user } }) => roleOf(user) === configuredAdminRole;
 var isAdminOrHasRole = (...roles) => ({ req: { user } }) => {
   const role = roleOf(user);
@@ -263,6 +264,7 @@ export {
   hasRoleOrOwner,
   isAdmin,
   isAdminOrHasRole,
+  isAuthenticated,
   isAuthenticatedOrPublished
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/access.ts","../src/collections/Users.ts","../src/translations/en.ts","../src/translations/fr.ts","../src/translations/index.ts","../src/index.ts"],"sourcesContent":["import type { Access, FieldAccess } from 'payload'\n\nconst roleOf = (user: unknown): string | undefined => {\n  const role = (user as { role?: unknown } | null | undefined)?.role\n  return typeof role === 'string' ? role : undefined\n}\n\nlet configuredAdminRole = 'admin'\n\n/**\n * Set by the plugin factory to the configured `adminRole` option, so that\n * `isAdmin`/`isAdminOrHasRole` follow it. Not meant to be called directly.\n */\nexport const setAdminRole = (role: string): void => {\n  configuredAdminRole = role\n}\n\n/** Collection access allowing only users whose `role` is one of the given values. */\nexport const hasRole =\n  (...roles: string[]): Access =>\n  ({ req: { user } }) => {\n    const role = roleOf(user)\n    return role !== undefined && roles.includes(role)\n  }\n\n/** Field-level variant of {@link hasRole} (field access cannot return a query). */\nexport const hasRoleFieldLevel =\n  (...roles: string[]): FieldAccess =>\n  ({ req: { user } }) => {\n    const role = roleOf(user)\n    return role !== undefined && roles.includes(role)\n  }\n\n/** Collection access allowing only users with the plugin's `adminRole` (default `'admin'`). */\nexport const isAdmin: Access = ({ req: { user } }) => roleOf(user) === configuredAdminRole\n\n/** Collection access allowing the plugin's `adminRole` or any of the given roles. */\nexport const isAdminOrHasRole =\n  (...roles: string[]): Access =>\n  ({ req: { user } }) => {\n    const role = roleOf(user)\n    return role !== undefined && (role === configuredAdminRole || roles.includes(role))\n  }\n\n/**\n * Collection access allowing authenticated users to see everything, and the\n * public only published documents. For collections with drafts enabled\n * (`versions.drafts`), where Payload maintains the `_status` field.\n */\nexport const isAuthenticatedOrPublished: Access = ({ req: { user } }) => {\n  if (user) {\n    return true\n  }\n\n  return { _status: { equals: 'published' } }\n}\n\n/**\n * Collection access allowing users whose `role` is one of the given values, and\n * otherwise restricting the operation to documents the user owns: those whose\n * `ownerField` equals the user's id. Use `'id'` (the default) for the users\n * collection itself, or a relationship field name (e.g. `'owner'`, `'author'`)\n * for other collections.\n */\nexport const hasRoleOrOwner =\n  (roles: string[], ownerField = 'id'): Access =>\n  ({ req: { user } }) => {\n    if (!user) {\n      return false\n    }\n\n    const role = roleOf(user)\n    if (role !== undefined && roles.includes(role)) {\n      return true\n    }\n\n    return { [ownerField]: { equals: user.id } }\n  }\n","import type { CollectionConfig, CollectionSlug, Field, PayloadRequest } from 'payload'\n\nimport { APIError } from 'payload'\n\nimport { hasRoleFieldLevel } from '../access.js'\nimport { label, translate } from '../translations/index.js'\nimport type { UsersOptions } from '../types.js'\n\nconst fieldNames = (fields: Field[]): string[] =>\n  fields.map((field) => (field as { name?: string }).name).filter((name): name is string =>\n    Boolean(name),\n  )\n\n/**\n * Extends an existing users collection with auth settings, role field, access\n * control and last-admin protections. Explicit settings already present on the\n * existing collection win over the plugin's; when there is no existing\n * collection, pass `undefined` to build one from scratch.\n */\nexport const withUsersAuth = (\n  existing: CollectionConfig | undefined,\n  { access, adminRole, defaultRole, roles, slug }: UsersOptions,\n): CollectionConfig => {\n  const collection = slug as CollectionSlug\n  const adminFieldLevel = hasRoleFieldLevel(adminRole)\n\n  const countAdmins = (req: PayloadRequest) =>\n    req.payload.count({\n      collection,\n      req,\n      where: { role: { equals: adminRole } },\n    })\n\n  const existingAuth = typeof existing?.auth === 'object' ? existing.auth : {}\n  const existingFieldNames = fieldNames(existing?.fields ?? [])\n\n  const addedFields: Field[] = [\n    // Email added by default\n    {\n      name: 'name',\n      type: 'text',\n      label: label((t) => t.fields.name),\n      required: true,\n    },\n    {\n      name: 'role',\n      type: 'select',\n      label: label((t) => t.fields.role),\n      options: roles,\n      defaultValue: defaultRole,\n      required: true,\n      saveToJWT: true,\n      access: {\n        // Users can update their own profile, but only admins can change roles\n        create: adminFieldLevel,\n        update: adminFieldLevel,\n      },\n    },\n  ]\n\n  return {\n    ...existing,\n    slug,\n    labels: existing?.labels ?? {\n      singular: label((t) => t.users.singular),\n      plural: label((t) => t.users.plural),\n    },\n    admin: {\n      useAsTitle: 'name',\n      defaultColumns: ['name', 'email', 'role', 'createdAt'],\n      hidden: ({ user }) => (user as { role?: string } | null)?.role !== adminRole,\n      ...existing?.admin,\n    },\n    auth: {\n      ...existingAuth,\n      cookies: {\n        // secure: true would break plain-http localhost logins in dev\n        secure: process.env.NODE_ENV === 'production',\n        sameSite: 'Lax',\n        ...existingAuth.cookies,\n      },\n      maxLoginAttempts: existingAuth.maxLoginAttempts ?? 5,\n      lockTime: existingAuth.lockTime ?? 15 * 60 * 1000, // 15 minutes\n    },\n    access: {\n      create: access.create,\n      read: access.read,\n      update: access.update,\n      delete: access.delete,\n      ...existing?.access,\n    },\n    hooks: {\n      ...existing?.hooks,\n      beforeChange: [\n        ...(existing?.hooks?.beforeChange ?? []),\n        async ({ data, operation, originalDoc, req }) => {\n          if (operation === 'create') {\n            // The very first user must get the admin role no matter what was\n            // submitted: role creation is admin-only, so a non-admin first\n            // user would leave the panel without anyone able to manage users.\n            const { totalDocs } = await req.payload.count({ collection, req })\n            if (totalDocs === 0) {\n              data.role = adminRole\n            }\n            return data\n          }\n\n          if (\n            operation === 'update' &&\n            originalDoc?.role === adminRole &&\n            typeof data?.role === 'string' &&\n            data.role !== adminRole\n          ) {\n            const { totalDocs } = await countAdmins(req)\n            if (totalDocs <= 1) {\n              throw new APIError(\n                translate(req.i18n?.language, (t) => t.errors.lastAdminRole),\n                403,\n              )\n            }\n          }\n\n          return data\n        },\n      ],\n      beforeDelete: [\n        ...(existing?.hooks?.beforeDelete ?? []),\n        async ({ id, req }) => {\n          const doc = await req.payload.findByID({ collection, id, depth: 0, req })\n          if ((doc as { role?: string } | null)?.role === adminRole) {\n            const { totalDocs } = await countAdmins(req)\n            if (totalDocs <= 1) {\n              throw new APIError(\n                translate(req.i18n?.language, (t) => t.errors.lastAdminDelete),\n                403,\n              )\n            }\n          }\n        },\n      ],\n    },\n    fields: [\n      ...(existing?.fields ?? []),\n      ...addedFields.filter(\n        (field) => !existingFieldNames.includes((field as { name?: string }).name ?? ''),\n      ),\n    ],\n  }\n}\n","export const en = {\n  errors: {\n    lastAdminDelete: 'The last admin user cannot be deleted.',\n    lastAdminRole: 'The last admin user cannot lose the admin role.',\n  },\n  fields: {\n    name: 'Name',\n    role: 'Role',\n  },\n  roles: {\n    admin: 'Admin',\n    editor: 'Editor',\n    viewer: 'Viewer',\n  },\n  users: {\n    plural: 'Users',\n    singular: 'User',\n  },\n}\n","import type { Translation } from './index.js'\n\nexport const fr: Translation = {\n  errors: {\n    lastAdminDelete: 'Le dernier utilisateur admin ne peut pas être supprimé.',\n    lastAdminRole: \"Le dernier utilisateur admin ne peut pas perdre le rôle d'admin.\",\n  },\n  fields: {\n    name: 'Nom',\n    role: 'Rôle',\n  },\n  roles: {\n    admin: 'Admin',\n    editor: 'Éditeur',\n    viewer: 'Lecteur',\n  },\n  users: {\n    plural: 'Utilisateurs',\n    singular: 'Utilisateur',\n  },\n}\n","import { en } from './en.js'\nimport { fr } from './fr.js'\n\nexport type Translation = typeof en\n\nconst translations: Record<string, Translation> = { en, fr }\n\n/** Builds a Payload label record ({ en, fr }) from a translation key selector. */\nexport const label = (pick: (t: Translation) => string): Record<string, string> => ({\n  en: pick(en),\n  fr: pick(fr),\n})\n\n/** Resolves a translation for a runtime language (e.g. `req.i18n.language`), falling back to English. */\nexport const translate = (\n  language: string | undefined,\n  pick: (t: Translation) => string,\n): string => pick(translations[language ?? 'en'] ?? en)\n","import type { Config } from 'payload'\n\nimport {\n  hasRole,\n  hasRoleFieldLevel,\n  hasRoleOrOwner,\n  isAdmin,\n  isAdminOrHasRole,\n  isAuthenticatedOrPublished,\n  setAdminRole,\n} from './access.js'\nimport { withUsersAuth } from './collections/Users.js'\nimport { label } from './translations/index.js'\nimport type { Role, UsersAccess, ComposiusPayloadPluginAuthConfig } from './types.js'\n\nexport {\n  hasRole,\n  hasRoleFieldLevel,\n  hasRoleOrOwner,\n  isAdmin,\n  isAdminOrHasRole,\n  isAuthenticatedOrPublished,\n}\nexport type { Role, UsersAccess, ComposiusPayloadPluginAuthConfig }\n\nconst defaultRoles: Role[] = [\n  { label: label((t) => t.roles.admin), value: 'admin' },\n  { label: label((t) => t.roles.editor), value: 'editor' },\n  { label: label((t) => t.roles.viewer), value: 'viewer' },\n]\n\nexport const ComposiusPayloadPluginAuth =\n  (pluginOptions: ComposiusPayloadPluginAuthConfig = {}) =>\n  (config: Config): Config => {\n    const slug = pluginOptions.slug ?? 'users'\n    const roles = pluginOptions.roles ?? defaultRoles\n    const adminRole = pluginOptions.adminRole ?? 'admin'\n    const defaultRole = pluginOptions.defaultRole ?? 'viewer'\n\n    // A wrong role value here would lock everyone out of the users collection\n    // (or hand new users an invalid role), so fail at config build time.\n    const roleValues = roles.map((role) => role.value)\n    if (!roleValues.includes(adminRole)) {\n      throw new Error(\n        `ComposiusPayloadPluginAuth: adminRole \"${adminRole}\" is not one of the configured roles (${roleValues.join(', ')})`,\n      )\n    }\n    if (!roleValues.includes(defaultRole)) {\n      throw new Error(\n        `ComposiusPayloadPluginAuth: defaultRole \"${defaultRole}\" is not one of the configured roles (${roleValues.join(', ')})`,\n      )\n    }\n\n    // Keep the exported isAdmin/isAdminOrHasRole helpers in sync with the option.\n    setAdminRole(adminRole)\n\n    const adminOrSelf = hasRoleOrOwner([adminRole], 'id')\n\n    const access = {\n      create: pluginOptions.access?.create ?? isAdmin,\n      delete: pluginOptions.access?.delete ?? isAdmin,\n      read: pluginOptions.access?.read ?? adminOrSelf,\n      update: pluginOptions.access?.update ?? adminOrSelf,\n    }\n\n    if (!config.collections) {\n      config.collections = []\n    }\n\n    const existingIndex = config.collections.findIndex((collection) => collection.slug === slug)\n    const users = withUsersAuth(\n      existingIndex === -1 ? undefined : config.collections[existingIndex],\n      { access, adminRole, defaultRole, roles, slug },\n    )\n\n    if (existingIndex === -1) {\n      config.collections.push(users)\n    } else {\n      config.collections[existingIndex] = users\n    }\n\n    /**\n     * If the plugin is disabled, we still want to keep added collections/fields so the database schema is consistent which is important for migrations.\n     */\n    if (pluginOptions.disabled) {\n      return config\n    }\n\n    return config\n  }\n"],"mappings":";AAEA,IAAM,SAAS,CAAC,SAAsC;AACpD,QAAM,OAAQ,MAAgD;AAC9D,SAAO,OAAO,SAAS,WAAW,OAAO;AAC3C;AAEA,IAAI,sBAAsB;AAMnB,IAAM,eAAe,CAAC,SAAuB;AAClD,wBAAsB;AACxB;AAGO,IAAM,UACX,IAAI,UACJ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;AACrB,QAAM,OAAO,OAAO,IAAI;AACxB,SAAO,SAAS,UAAa,MAAM,SAAS,IAAI;AAClD;AAGK,IAAM,oBACX,IAAI,UACJ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;AACrB,QAAM,OAAO,OAAO,IAAI;AACxB,SAAO,SAAS,UAAa,MAAM,SAAS,IAAI;AAClD;AAGK,IAAM,UAAkB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,OAAO,IAAI,MAAM;AAGhE,IAAM,mBACX,IAAI,UACJ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;AACrB,QAAM,OAAO,OAAO,IAAI;AACxB,SAAO,SAAS,WAAc,SAAS,uBAAuB,MAAM,SAAS,IAAI;AACnF;AAOK,IAAM,6BAAqC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;AACvE,MAAI,MAAM;AACR,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,SAAS,EAAE,QAAQ,YAAY,EAAE;AAC5C;AASO,IAAM,iBACX,CAAC,OAAiB,aAAa,SAC/B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;AACrB,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,OAAO,IAAI;AACxB,MAAI,SAAS,UAAa,MAAM,SAAS,IAAI,GAAG;AAC9C,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,CAAC,UAAU,GAAG,EAAE,QAAQ,KAAK,GAAG,EAAE;AAC7C;;;AC3EF,SAAS,gBAAgB;;;ACFlB,IAAM,KAAK;AAAA,EAChB,QAAQ;AAAA,IACN,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AAAA,EACA,OAAO;AAAA,IACL,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,OAAO;AAAA,IACL,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AACF;;;AChBO,IAAM,KAAkB;AAAA,EAC7B,QAAQ;AAAA,IACN,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AAAA,EACA,OAAO;AAAA,IACL,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,OAAO;AAAA,IACL,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AACF;;;ACfA,IAAM,eAA4C,EAAE,IAAI,GAAG;AAGpD,IAAM,QAAQ,CAAC,UAA8D;AAAA,EAClF,IAAI,KAAK,EAAE;AAAA,EACX,IAAI,KAAK,EAAE;AACb;AAGO,IAAM,YAAY,CACvB,UACA,SACW,KAAK,aAAa,YAAY,IAAI,KAAK,EAAE;;;AHTtD,IAAM,aAAa,CAAC,WAClB,OAAO,IAAI,CAAC,UAAW,MAA4B,IAAI,EAAE;AAAA,EAAO,CAAC,SAC/D,QAAQ,IAAI;AACd;AAQK,IAAM,gBAAgB,CAC3B,UACA,EAAE,QAAQ,WAAW,aAAa,OAAO,KAAK,MACzB;AACrB,QAAM,aAAa;AACnB,QAAM,kBAAkB,kBAAkB,SAAS;AAEnD,QAAM,cAAc,CAAC,QACnB,IAAI,QAAQ,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA,OAAO,EAAE,MAAM,EAAE,QAAQ,UAAU,EAAE;AAAA,EACvC,CAAC;AAEH,QAAM,eAAe,OAAO,UAAU,SAAS,WAAW,SAAS,OAAO,CAAC;AAC3E,QAAM,qBAAqB,WAAW,UAAU,UAAU,CAAC,CAAC;AAE5D,QAAM,cAAuB;AAAA;AAAA,IAE3B;AAAA,MACE,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI;AAAA,MACjC,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI;AAAA,MACjC,SAAS;AAAA,MACT,cAAc;AAAA,MACd,UAAU;AAAA,MACV,WAAW;AAAA,MACX,QAAQ;AAAA;AAAA,QAEN,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,QAAQ,UAAU,UAAU;AAAA,MAC1B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,QAAQ;AAAA,MACvC,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,MAAM;AAAA,IACrC;AAAA,IACA,OAAO;AAAA,MACL,YAAY;AAAA,MACZ,gBAAgB,CAAC,QAAQ,SAAS,QAAQ,WAAW;AAAA,MACrD,QAAQ,CAAC,EAAE,KAAK,MAAO,MAAmC,SAAS;AAAA,MACnE,GAAG,UAAU;AAAA,IACf;AAAA,IACA,MAAM;AAAA,MACJ,GAAG;AAAA,MACH,SAAS;AAAA;AAAA,QAEP,QAAQ,QAAQ,IAAI,aAAa;AAAA,QACjC,UAAU;AAAA,QACV,GAAG,aAAa;AAAA,MAClB;AAAA,MACA,kBAAkB,aAAa,oBAAoB;AAAA,MACnD,UAAU,aAAa,YAAY,KAAK,KAAK;AAAA;AAAA,IAC/C;AAAA,IACA,QAAQ;AAAA,MACN,QAAQ,OAAO;AAAA,MACf,MAAM,OAAO;AAAA,MACb,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,GAAG,UAAU;AAAA,IACf;AAAA,IACA,OAAO;AAAA,MACL,GAAG,UAAU;AAAA,MACb,cAAc;AAAA,QACZ,GAAI,UAAU,OAAO,gBAAgB,CAAC;AAAA,QACtC,OAAO,EAAE,MAAM,WAAW,aAAa,IAAI,MAAM;AAC/C,cAAI,cAAc,UAAU;AAI1B,kBAAM,EAAE,UAAU,IAAI,MAAM,IAAI,QAAQ,MAAM,EAAE,YAAY,IAAI,CAAC;AACjE,gBAAI,cAAc,GAAG;AACnB,mBAAK,OAAO;AAAA,YACd;AACA,mBAAO;AAAA,UACT;AAEA,cACE,cAAc,YACd,aAAa,SAAS,aACtB,OAAO,MAAM,SAAS,YACtB,KAAK,SAAS,WACd;AACA,kBAAM,EAAE,UAAU,IAAI,MAAM,YAAY,GAAG;AAC3C,gBAAI,aAAa,GAAG;AAClB,oBAAM,IAAI;AAAA,gBACR,UAAU,IAAI,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,aAAa;AAAA,gBAC3D;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAEA,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,MACA,cAAc;AAAA,QACZ,GAAI,UAAU,OAAO,gBAAgB,CAAC;AAAA,QACtC,OAAO,EAAE,IAAI,IAAI,MAAM;AACrB,gBAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,YAAY,IAAI,OAAO,GAAG,IAAI,CAAC;AACxE,cAAK,KAAkC,SAAS,WAAW;AACzD,kBAAM,EAAE,UAAU,IAAI,MAAM,YAAY,GAAG;AAC3C,gBAAI,aAAa,GAAG;AAClB,oBAAM,IAAI;AAAA,gBACR,UAAU,IAAI,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,eAAe;AAAA,gBAC7D;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,GAAI,UAAU,UAAU,CAAC;AAAA,MACzB,GAAG,YAAY;AAAA,QACb,CAAC,UAAU,CAAC,mBAAmB,SAAU,MAA4B,QAAQ,EAAE;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AACF;;;AI3HA,IAAM,eAAuB;AAAA,EAC3B,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,KAAK,GAAG,OAAO,QAAQ;AAAA,EACrD,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,MAAM,GAAG,OAAO,SAAS;AAAA,EACvD,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,MAAM,GAAG,OAAO,SAAS;AACzD;AAEO,IAAM,6BACX,CAAC,gBAAkD,CAAC,MACpD,CAAC,WAA2B;AAC1B,QAAM,OAAO,cAAc,QAAQ;AACnC,QAAM,QAAQ,cAAc,SAAS;AACrC,QAAM,YAAY,cAAc,aAAa;AAC7C,QAAM,cAAc,cAAc,eAAe;AAIjD,QAAM,aAAa,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK;AACjD,MAAI,CAAC,WAAW,SAAS,SAAS,GAAG;AACnC,UAAM,IAAI;AAAA,MACR,0CAA0C,SAAS,yCAAyC,WAAW,KAAK,IAAI,CAAC;AAAA,IACnH;AAAA,EACF;AACA,MAAI,CAAC,WAAW,SAAS,WAAW,GAAG;AACrC,UAAM,IAAI;AAAA,MACR,4CAA4C,WAAW,yCAAyC,WAAW,KAAK,IAAI,CAAC;AAAA,IACvH;AAAA,EACF;AAGA,eAAa,SAAS;AAEtB,QAAM,cAAc,eAAe,CAAC,SAAS,GAAG,IAAI;AAEpD,QAAM,SAAS;AAAA,IACb,QAAQ,cAAc,QAAQ,UAAU;AAAA,IACxC,QAAQ,cAAc,QAAQ,UAAU;AAAA,IACxC,MAAM,cAAc,QAAQ,QAAQ;AAAA,IACpC,QAAQ,cAAc,QAAQ,UAAU;AAAA,EAC1C;AAEA,MAAI,CAAC,OAAO,aAAa;AACvB,WAAO,cAAc,CAAC;AAAA,EACxB;AAEA,QAAM,gBAAgB,OAAO,YAAY,UAAU,CAAC,eAAe,WAAW,SAAS,IAAI;AAC3F,QAAM,QAAQ;AAAA,IACZ,kBAAkB,KAAK,SAAY,OAAO,YAAY,aAAa;AAAA,IACnE,EAAE,QAAQ,WAAW,aAAa,OAAO,KAAK;AAAA,EAChD;AAEA,MAAI,kBAAkB,IAAI;AACxB,WAAO,YAAY,KAAK,KAAK;AAAA,EAC/B,OAAO;AACL,WAAO,YAAY,aAAa,IAAI;AAAA,EACtC;AAKA,MAAI,cAAc,UAAU;AAC1B,WAAO;AAAA,EACT;AAEA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/access.ts","../src/collections/Users.ts","../src/translations/en.ts","../src/translations/fr.ts","../src/translations/index.ts","../src/index.ts"],"sourcesContent":["import type { Access, FieldAccess } from 'payload'\n\nconst roleOf = (user: unknown): string | undefined => {\n  const role = (user as { role?: unknown } | null | undefined)?.role\n  return typeof role === 'string' ? role : undefined\n}\n\nlet configuredAdminRole = 'admin'\n\n/**\n * Set by the plugin factory to the configured `adminRole` option, so that\n * `isAdmin`/`isAdminOrHasRole` follow it. Not meant to be called directly.\n */\nexport const setAdminRole = (role: string): void => {\n  configuredAdminRole = role\n}\n\n/** Collection access allowing only users whose `role` is one of the given values. */\nexport const hasRole =\n  (...roles: string[]): Access =>\n  ({ req: { user } }) => {\n    const role = roleOf(user)\n    return role !== undefined && roles.includes(role)\n  }\n\n/** Field-level variant of {@link hasRole} (field access cannot return a query). */\nexport const hasRoleFieldLevel =\n  (...roles: string[]): FieldAccess =>\n  ({ req: { user } }) => {\n    const role = roleOf(user)\n    return role !== undefined && roles.includes(role)\n  }\n\n/** Collection access allowing any authenticated user. */\nexport const isAuthenticated: Access = ({ req: { user } }) => Boolean(user)\n\n/** Collection access allowing only users with the plugin's `adminRole` (default `'admin'`). */\nexport const isAdmin: Access = ({ req: { user } }) => roleOf(user) === configuredAdminRole\n\n/** Collection access allowing the plugin's `adminRole` or any of the given roles. */\nexport const isAdminOrHasRole =\n  (...roles: string[]): Access =>\n  ({ req: { user } }) => {\n    const role = roleOf(user)\n    return role !== undefined && (role === configuredAdminRole || roles.includes(role))\n  }\n\n/**\n * Collection access allowing authenticated users to see everything, and the\n * public only published documents. For collections with drafts enabled\n * (`versions.drafts`), where Payload maintains the `_status` field.\n */\nexport const isAuthenticatedOrPublished: Access = ({ req: { user } }) => {\n  if (user) {\n    return true\n  }\n\n  return { _status: { equals: 'published' } }\n}\n\n/**\n * Collection access allowing users whose `role` is one of the given values, and\n * otherwise restricting the operation to documents the user owns: those whose\n * `ownerField` equals the user's id. Use `'id'` (the default) for the users\n * collection itself, or a relationship field name (e.g. `'owner'`, `'author'`)\n * for other collections.\n */\nexport const hasRoleOrOwner =\n  (roles: string[], ownerField = 'id'): Access =>\n  ({ req: { user } }) => {\n    if (!user) {\n      return false\n    }\n\n    const role = roleOf(user)\n    if (role !== undefined && roles.includes(role)) {\n      return true\n    }\n\n    return { [ownerField]: { equals: user.id } }\n  }\n","import type { CollectionConfig, CollectionSlug, Field, PayloadRequest } from 'payload'\n\nimport { APIError } from 'payload'\n\nimport { hasRoleFieldLevel } from '../access.js'\nimport { label, translate } from '../translations/index.js'\nimport type { UsersOptions } from '../types.js'\n\nconst fieldNames = (fields: Field[]): string[] =>\n  fields.map((field) => (field as { name?: string }).name).filter((name): name is string =>\n    Boolean(name),\n  )\n\n/**\n * Extends an existing users collection with auth settings, role field, access\n * control and last-admin protections. Explicit settings already present on the\n * existing collection win over the plugin's; when there is no existing\n * collection, pass `undefined` to build one from scratch.\n */\nexport const withUsersAuth = (\n  existing: CollectionConfig | undefined,\n  { access, adminRole, defaultRole, roles, slug }: UsersOptions,\n): CollectionConfig => {\n  const collection = slug as CollectionSlug\n  const adminFieldLevel = hasRoleFieldLevel(adminRole)\n\n  const countAdmins = (req: PayloadRequest) =>\n    req.payload.count({\n      collection,\n      req,\n      where: { role: { equals: adminRole } },\n    })\n\n  const existingAuth = typeof existing?.auth === 'object' ? existing.auth : {}\n  const existingFieldNames = fieldNames(existing?.fields ?? [])\n\n  const addedFields: Field[] = [\n    // Email added by default\n    {\n      name: 'name',\n      type: 'text',\n      label: label((t) => t.fields.name),\n      required: true,\n    },\n    {\n      name: 'role',\n      type: 'select',\n      label: label((t) => t.fields.role),\n      options: roles,\n      defaultValue: defaultRole,\n      required: true,\n      saveToJWT: true,\n      access: {\n        // Users can update their own profile, but only admins can change roles\n        create: adminFieldLevel,\n        update: adminFieldLevel,\n      },\n    },\n  ]\n\n  return {\n    ...existing,\n    slug,\n    labels: existing?.labels ?? {\n      singular: label((t) => t.users.singular),\n      plural: label((t) => t.users.plural),\n    },\n    admin: {\n      useAsTitle: 'name',\n      defaultColumns: ['name', 'email', 'role', 'createdAt'],\n      hidden: ({ user }) => (user as { role?: string } | null)?.role !== adminRole,\n      ...existing?.admin,\n    },\n    auth: {\n      ...existingAuth,\n      cookies: {\n        // secure: true would break plain-http localhost logins in dev\n        secure: process.env.NODE_ENV === 'production',\n        sameSite: 'Lax',\n        ...existingAuth.cookies,\n      },\n      maxLoginAttempts: existingAuth.maxLoginAttempts ?? 5,\n      lockTime: existingAuth.lockTime ?? 15 * 60 * 1000, // 15 minutes\n    },\n    access: {\n      create: access.create,\n      read: access.read,\n      update: access.update,\n      delete: access.delete,\n      ...existing?.access,\n    },\n    hooks: {\n      ...existing?.hooks,\n      beforeChange: [\n        ...(existing?.hooks?.beforeChange ?? []),\n        async ({ data, operation, originalDoc, req }) => {\n          if (operation === 'create') {\n            // The very first user must get the admin role no matter what was\n            // submitted: role creation is admin-only, so a non-admin first\n            // user would leave the panel without anyone able to manage users.\n            const { totalDocs } = await req.payload.count({ collection, req })\n            if (totalDocs === 0) {\n              data.role = adminRole\n            }\n            return data\n          }\n\n          if (\n            operation === 'update' &&\n            originalDoc?.role === adminRole &&\n            typeof data?.role === 'string' &&\n            data.role !== adminRole\n          ) {\n            const { totalDocs } = await countAdmins(req)\n            if (totalDocs <= 1) {\n              throw new APIError(\n                translate(req.i18n?.language, (t) => t.errors.lastAdminRole),\n                403,\n              )\n            }\n          }\n\n          return data\n        },\n      ],\n      beforeDelete: [\n        ...(existing?.hooks?.beforeDelete ?? []),\n        async ({ id, req }) => {\n          const doc = await req.payload.findByID({ collection, id, depth: 0, req })\n          if ((doc as { role?: string } | null)?.role === adminRole) {\n            const { totalDocs } = await countAdmins(req)\n            if (totalDocs <= 1) {\n              throw new APIError(\n                translate(req.i18n?.language, (t) => t.errors.lastAdminDelete),\n                403,\n              )\n            }\n          }\n        },\n      ],\n    },\n    fields: [\n      ...(existing?.fields ?? []),\n      ...addedFields.filter(\n        (field) => !existingFieldNames.includes((field as { name?: string }).name ?? ''),\n      ),\n    ],\n  }\n}\n","export const en = {\n  errors: {\n    lastAdminDelete: 'The last admin user cannot be deleted.',\n    lastAdminRole: 'The last admin user cannot lose the admin role.',\n  },\n  fields: {\n    name: 'Name',\n    role: 'Role',\n  },\n  roles: {\n    admin: 'Admin',\n    editor: 'Editor',\n    viewer: 'Viewer',\n  },\n  users: {\n    plural: 'Users',\n    singular: 'User',\n  },\n}\n","import type { Translation } from './index.js'\n\nexport const fr: Translation = {\n  errors: {\n    lastAdminDelete: 'Le dernier utilisateur admin ne peut pas être supprimé.',\n    lastAdminRole: \"Le dernier utilisateur admin ne peut pas perdre le rôle d'admin.\",\n  },\n  fields: {\n    name: 'Nom',\n    role: 'Rôle',\n  },\n  roles: {\n    admin: 'Admin',\n    editor: 'Éditeur',\n    viewer: 'Lecteur',\n  },\n  users: {\n    plural: 'Utilisateurs',\n    singular: 'Utilisateur',\n  },\n}\n","import { en } from './en.js'\nimport { fr } from './fr.js'\n\nexport type Translation = typeof en\n\nconst translations: Record<string, Translation> = { en, fr }\n\n/** Builds a Payload label record ({ en, fr }) from a translation key selector. */\nexport const label = (pick: (t: Translation) => string): Record<string, string> => ({\n  en: pick(en),\n  fr: pick(fr),\n})\n\n/** Resolves a translation for a runtime language (e.g. `req.i18n.language`), falling back to English. */\nexport const translate = (\n  language: string | undefined,\n  pick: (t: Translation) => string,\n): string => pick(translations[language ?? 'en'] ?? en)\n","import type { Config } from 'payload'\n\nimport {\n  hasRole,\n  hasRoleFieldLevel,\n  hasRoleOrOwner,\n  isAdmin,\n  isAdminOrHasRole,\n  isAuthenticated,\n  isAuthenticatedOrPublished,\n  setAdminRole,\n} from './access.js'\nimport { withUsersAuth } from './collections/Users.js'\nimport { label } from './translations/index.js'\nimport type { Role, UsersAccess, ComposiusPayloadPluginAuthConfig } from './types.js'\n\nexport {\n  hasRole,\n  hasRoleFieldLevel,\n  hasRoleOrOwner,\n  isAdmin,\n  isAdminOrHasRole,\n  isAuthenticated,\n  isAuthenticatedOrPublished,\n}\nexport type { Role, UsersAccess, ComposiusPayloadPluginAuthConfig }\n\nconst defaultRoles: Role[] = [\n  { label: label((t) => t.roles.admin), value: 'admin' },\n  { label: label((t) => t.roles.editor), value: 'editor' },\n  { label: label((t) => t.roles.viewer), value: 'viewer' },\n]\n\nexport const ComposiusPayloadPluginAuth =\n  (pluginOptions: ComposiusPayloadPluginAuthConfig = {}) =>\n  (config: Config): Config => {\n    const slug = pluginOptions.slug ?? 'users'\n    const roles = pluginOptions.roles ?? defaultRoles\n    const adminRole = pluginOptions.adminRole ?? 'admin'\n    const defaultRole = pluginOptions.defaultRole ?? 'viewer'\n\n    // A wrong role value here would lock everyone out of the users collection\n    // (or hand new users an invalid role), so fail at config build time.\n    const roleValues = roles.map((role) => role.value)\n    if (!roleValues.includes(adminRole)) {\n      throw new Error(\n        `ComposiusPayloadPluginAuth: adminRole \"${adminRole}\" is not one of the configured roles (${roleValues.join(', ')})`,\n      )\n    }\n    if (!roleValues.includes(defaultRole)) {\n      throw new Error(\n        `ComposiusPayloadPluginAuth: defaultRole \"${defaultRole}\" is not one of the configured roles (${roleValues.join(', ')})`,\n      )\n    }\n\n    // Keep the exported isAdmin/isAdminOrHasRole helpers in sync with the option.\n    setAdminRole(adminRole)\n\n    const adminOrSelf = hasRoleOrOwner([adminRole], 'id')\n\n    const access = {\n      create: pluginOptions.access?.create ?? isAdmin,\n      delete: pluginOptions.access?.delete ?? isAdmin,\n      read: pluginOptions.access?.read ?? adminOrSelf,\n      update: pluginOptions.access?.update ?? adminOrSelf,\n    }\n\n    if (!config.collections) {\n      config.collections = []\n    }\n\n    const existingIndex = config.collections.findIndex((collection) => collection.slug === slug)\n    const users = withUsersAuth(\n      existingIndex === -1 ? undefined : config.collections[existingIndex],\n      { access, adminRole, defaultRole, roles, slug },\n    )\n\n    if (existingIndex === -1) {\n      config.collections.push(users)\n    } else {\n      config.collections[existingIndex] = users\n    }\n\n    /**\n     * If the plugin is disabled, we still want to keep added collections/fields so the database schema is consistent which is important for migrations.\n     */\n    if (pluginOptions.disabled) {\n      return config\n    }\n\n    return config\n  }\n"],"mappings":";AAEA,IAAM,SAAS,CAAC,SAAsC;AACpD,QAAM,OAAQ,MAAgD;AAC9D,SAAO,OAAO,SAAS,WAAW,OAAO;AAC3C;AAEA,IAAI,sBAAsB;AAMnB,IAAM,eAAe,CAAC,SAAuB;AAClD,wBAAsB;AACxB;AAGO,IAAM,UACX,IAAI,UACJ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;AACrB,QAAM,OAAO,OAAO,IAAI;AACxB,SAAO,SAAS,UAAa,MAAM,SAAS,IAAI;AAClD;AAGK,IAAM,oBACX,IAAI,UACJ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;AACrB,QAAM,OAAO,OAAO,IAAI;AACxB,SAAO,SAAS,UAAa,MAAM,SAAS,IAAI;AAClD;AAGK,IAAM,kBAA0B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,IAAI;AAGnE,IAAM,UAAkB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,OAAO,IAAI,MAAM;AAGhE,IAAM,mBACX,IAAI,UACJ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;AACrB,QAAM,OAAO,OAAO,IAAI;AACxB,SAAO,SAAS,WAAc,SAAS,uBAAuB,MAAM,SAAS,IAAI;AACnF;AAOK,IAAM,6BAAqC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;AACvE,MAAI,MAAM;AACR,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,SAAS,EAAE,QAAQ,YAAY,EAAE;AAC5C;AASO,IAAM,iBACX,CAAC,OAAiB,aAAa,SAC/B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;AACrB,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,OAAO,IAAI;AACxB,MAAI,SAAS,UAAa,MAAM,SAAS,IAAI,GAAG;AAC9C,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,CAAC,UAAU,GAAG,EAAE,QAAQ,KAAK,GAAG,EAAE;AAC7C;;;AC9EF,SAAS,gBAAgB;;;ACFlB,IAAM,KAAK;AAAA,EAChB,QAAQ;AAAA,IACN,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AAAA,EACA,OAAO;AAAA,IACL,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,OAAO;AAAA,IACL,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AACF;;;AChBO,IAAM,KAAkB;AAAA,EAC7B,QAAQ;AAAA,IACN,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AAAA,EACA,OAAO;AAAA,IACL,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,OAAO;AAAA,IACL,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AACF;;;ACfA,IAAM,eAA4C,EAAE,IAAI,GAAG;AAGpD,IAAM,QAAQ,CAAC,UAA8D;AAAA,EAClF,IAAI,KAAK,EAAE;AAAA,EACX,IAAI,KAAK,EAAE;AACb;AAGO,IAAM,YAAY,CACvB,UACA,SACW,KAAK,aAAa,YAAY,IAAI,KAAK,EAAE;;;AHTtD,IAAM,aAAa,CAAC,WAClB,OAAO,IAAI,CAAC,UAAW,MAA4B,IAAI,EAAE;AAAA,EAAO,CAAC,SAC/D,QAAQ,IAAI;AACd;AAQK,IAAM,gBAAgB,CAC3B,UACA,EAAE,QAAQ,WAAW,aAAa,OAAO,KAAK,MACzB;AACrB,QAAM,aAAa;AACnB,QAAM,kBAAkB,kBAAkB,SAAS;AAEnD,QAAM,cAAc,CAAC,QACnB,IAAI,QAAQ,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA,OAAO,EAAE,MAAM,EAAE,QAAQ,UAAU,EAAE;AAAA,EACvC,CAAC;AAEH,QAAM,eAAe,OAAO,UAAU,SAAS,WAAW,SAAS,OAAO,CAAC;AAC3E,QAAM,qBAAqB,WAAW,UAAU,UAAU,CAAC,CAAC;AAE5D,QAAM,cAAuB;AAAA;AAAA,IAE3B;AAAA,MACE,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI;AAAA,MACjC,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI;AAAA,MACjC,SAAS;AAAA,MACT,cAAc;AAAA,MACd,UAAU;AAAA,MACV,WAAW;AAAA,MACX,QAAQ;AAAA;AAAA,QAEN,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,QAAQ,UAAU,UAAU;AAAA,MAC1B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,QAAQ;AAAA,MACvC,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,MAAM;AAAA,IACrC;AAAA,IACA,OAAO;AAAA,MACL,YAAY;AAAA,MACZ,gBAAgB,CAAC,QAAQ,SAAS,QAAQ,WAAW;AAAA,MACrD,QAAQ,CAAC,EAAE,KAAK,MAAO,MAAmC,SAAS;AAAA,MACnE,GAAG,UAAU;AAAA,IACf;AAAA,IACA,MAAM;AAAA,MACJ,GAAG;AAAA,MACH,SAAS;AAAA;AAAA,QAEP,QAAQ,QAAQ,IAAI,aAAa;AAAA,QACjC,UAAU;AAAA,QACV,GAAG,aAAa;AAAA,MAClB;AAAA,MACA,kBAAkB,aAAa,oBAAoB;AAAA,MACnD,UAAU,aAAa,YAAY,KAAK,KAAK;AAAA;AAAA,IAC/C;AAAA,IACA,QAAQ;AAAA,MACN,QAAQ,OAAO;AAAA,MACf,MAAM,OAAO;AAAA,MACb,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,GAAG,UAAU;AAAA,IACf;AAAA,IACA,OAAO;AAAA,MACL,GAAG,UAAU;AAAA,MACb,cAAc;AAAA,QACZ,GAAI,UAAU,OAAO,gBAAgB,CAAC;AAAA,QACtC,OAAO,EAAE,MAAM,WAAW,aAAa,IAAI,MAAM;AAC/C,cAAI,cAAc,UAAU;AAI1B,kBAAM,EAAE,UAAU,IAAI,MAAM,IAAI,QAAQ,MAAM,EAAE,YAAY,IAAI,CAAC;AACjE,gBAAI,cAAc,GAAG;AACnB,mBAAK,OAAO;AAAA,YACd;AACA,mBAAO;AAAA,UACT;AAEA,cACE,cAAc,YACd,aAAa,SAAS,aACtB,OAAO,MAAM,SAAS,YACtB,KAAK,SAAS,WACd;AACA,kBAAM,EAAE,UAAU,IAAI,MAAM,YAAY,GAAG;AAC3C,gBAAI,aAAa,GAAG;AAClB,oBAAM,IAAI;AAAA,gBACR,UAAU,IAAI,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,aAAa;AAAA,gBAC3D;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAEA,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,MACA,cAAc;AAAA,QACZ,GAAI,UAAU,OAAO,gBAAgB,CAAC;AAAA,QACtC,OAAO,EAAE,IAAI,IAAI,MAAM;AACrB,gBAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,YAAY,IAAI,OAAO,GAAG,IAAI,CAAC;AACxE,cAAK,KAAkC,SAAS,WAAW;AACzD,kBAAM,EAAE,UAAU,IAAI,MAAM,YAAY,GAAG;AAC3C,gBAAI,aAAa,GAAG;AAClB,oBAAM,IAAI;AAAA,gBACR,UAAU,IAAI,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,eAAe;AAAA,gBAC7D;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,GAAI,UAAU,UAAU,CAAC;AAAA,MACzB,GAAG,YAAY;AAAA,QACb,CAAC,UAAU,CAAC,mBAAmB,SAAU,MAA4B,QAAQ,EAAE;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AACF;;;AIzHA,IAAM,eAAuB;AAAA,EAC3B,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,KAAK,GAAG,OAAO,QAAQ;AAAA,EACrD,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,MAAM,GAAG,OAAO,SAAS;AAAA,EACvD,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,MAAM,GAAG,OAAO,SAAS;AACzD;AAEO,IAAM,6BACX,CAAC,gBAAkD,CAAC,MACpD,CAAC,WAA2B;AAC1B,QAAM,OAAO,cAAc,QAAQ;AACnC,QAAM,QAAQ,cAAc,SAAS;AACrC,QAAM,YAAY,cAAc,aAAa;AAC7C,QAAM,cAAc,cAAc,eAAe;AAIjD,QAAM,aAAa,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK;AACjD,MAAI,CAAC,WAAW,SAAS,SAAS,GAAG;AACnC,UAAM,IAAI;AAAA,MACR,0CAA0C,SAAS,yCAAyC,WAAW,KAAK,IAAI,CAAC;AAAA,IACnH;AAAA,EACF;AACA,MAAI,CAAC,WAAW,SAAS,WAAW,GAAG;AACrC,UAAM,IAAI;AAAA,MACR,4CAA4C,WAAW,yCAAyC,WAAW,KAAK,IAAI,CAAC;AAAA,IACvH;AAAA,EACF;AAGA,eAAa,SAAS;AAEtB,QAAM,cAAc,eAAe,CAAC,SAAS,GAAG,IAAI;AAEpD,QAAM,SAAS;AAAA,IACb,QAAQ,cAAc,QAAQ,UAAU;AAAA,IACxC,QAAQ,cAAc,QAAQ,UAAU;AAAA,IACxC,MAAM,cAAc,QAAQ,QAAQ;AAAA,IACpC,QAAQ,cAAc,QAAQ,UAAU;AAAA,EAC1C;AAEA,MAAI,CAAC,OAAO,aAAa;AACvB,WAAO,cAAc,CAAC;AAAA,EACxB;AAEA,QAAM,gBAAgB,OAAO,YAAY,UAAU,CAAC,eAAe,WAAW,SAAS,IAAI;AAC3F,QAAM,QAAQ;AAAA,IACZ,kBAAkB,KAAK,SAAY,OAAO,YAAY,aAAa;AAAA,IACnE,EAAE,QAAQ,WAAW,aAAa,OAAO,KAAK;AAAA,EAChD;AAEA,MAAI,kBAAkB,IAAI;AACxB,WAAO,YAAY,KAAK,KAAK;AAAA,EAC/B,OAAO;AACL,WAAO,YAAY,aAAa,IAAI;AAAA,EACtC;AAKA,MAAI,cAAc,UAAU;AAC1B,WAAO;AAAA,EACT;AAEA,SAAO;AACT;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@composius/payload-plugin-auth",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Users auth collection with configurable roles and role-based access helpers",
   "license": "MIT",
   "author": {