@delmaredigital/payload-puck 0.8.2 → 0.9.0

package/dist/endpoints/index.js

@@ -9,6 +9,7 @@
  */ import { APIError } from 'payload';
 import { unsetHomepage, HomepageConflictError } from '../plugin/hooks/isHomepageUnique.js';
 import { resolveLocale } from '../utils/locale.js';
+import { payloadErrorStatus } from '../utils/payloadErrors.js';
 import { mapRootPropsToPayloadFields, deepMerge } from '../api/utils/mapRootProps.js';
 /**
  * Merge a Puck save payload's `data` with the Payload fields derived from its
@@ -61,7 +62,7 @@ import { mapRootPropsToPayloadFields, deepMerge } from '../api/utils/mapRootProp
             return Response.json({
                 error: error instanceof Error ? error.message : 'List failed'
             }, {
-                status: 500
+                status: payloadErrorStatus(error) ?? 500
             });
         }
     };
@@ -103,7 +104,7 @@ import { mapRootPropsToPayloadFields, deepMerge } from '../api/utils/mapRootProp
             return Response.json({
                 error: error instanceof Error ? error.message : 'Create failed'
             }, {
-                status: 500
+                status: payloadErrorStatus(error) ?? 500
             });
         }
     };
@@ -144,7 +145,7 @@ import { mapRootPropsToPayloadFields, deepMerge } from '../api/utils/mapRootProp
             return Response.json({
                 error: error instanceof Error ? error.message : 'Get failed'
             }, {
-                status: 500
+                status: payloadErrorStatus(error) ?? 500
             });
         }
     };
@@ -262,7 +263,7 @@ import { mapRootPropsToPayloadFields, deepMerge } from '../api/utils/mapRootProp
             return Response.json({
                 error: error instanceof Error ? error.message : 'Update failed'
             }, {
-                status: 500
+                status: payloadErrorStatus(error) ?? 500
             });
         }
     };
@@ -297,7 +298,7 @@ import { mapRootPropsToPayloadFields, deepMerge } from '../api/utils/mapRootProp
             return Response.json({
                 error: error instanceof Error ? error.message : 'Delete failed'
             }, {
-                status: 500
+                status: payloadErrorStatus(error) ?? 500
             });
         }
     };
@@ -343,7 +344,7 @@ import { mapRootPropsToPayloadFields, deepMerge } from '../api/utils/mapRootProp
             return Response.json({
                 error: error instanceof Error ? error.message : 'Versions failed'
             }, {
-                status: 500
+                status: payloadErrorStatus(error) ?? 500
             });
         }
     };
@@ -390,7 +391,7 @@ import { mapRootPropsToPayloadFields, deepMerge } from '../api/utils/mapRootProp
             return Response.json({
                 error: error instanceof Error ? error.message : 'Restore failed'
             }, {
-                status: 500
+                status: payloadErrorStatus(error) ?? 500
             });
         }
     };

package/dist/endpoints/prompts.js

@@ -1,4 +1,11 @@
+import { payloadErrorStatus } from '../utils/payloadErrors.js';
 /**
+ * Access control: every handler passes `overrideAccess: false` and `req` to
+ * Payload's local API, so the collection's own `access` rules and field-level
+ * access are enforced against the calling user. The `if (!req.user)` gate is
+ * authentication only — it is not a substitute for authorization, and relying on
+ * it alone was the bug in GHSA-rrx7-m589-5wfq.
+ */ /**
  * Collection slug for AI prompts
  * Matches the auto-generated collection from createPuckPlugin
  */ const COLLECTION = 'puck-ai-prompts';
@@ -18,6 +25,8 @@
         try {
             const result = await req.payload.find({
                 collection: COLLECTION,
+                req,
+                overrideAccess: false,
                 sort: 'order',
                 limit: 100
             });
@@ -27,7 +36,7 @@
             return Response.json({
                 error: e instanceof Error ? e.message : 'Failed to list prompts'
             }, {
-                status: 500
+                status: payloadErrorStatus(e) ?? 500
             });
         }
     };
@@ -57,6 +66,8 @@
             }
             const doc = await req.payload.create({
                 collection: COLLECTION,
+                req,
+                overrideAccess: false,
                 data
             });
             return Response.json(doc);
@@ -65,7 +76,7 @@
             return Response.json({
                 error: e instanceof Error ? e.message : 'Failed to create prompt'
             }, {
-                status: 500
+                status: payloadErrorStatus(e) ?? 500
             });
         }
     };
@@ -103,6 +114,8 @@
             }
             const doc = await req.payload.update({
                 collection: COLLECTION,
+                req,
+                overrideAccess: false,
                 id,
                 data
             });
@@ -112,7 +125,7 @@
             return Response.json({
                 error: e instanceof Error ? e.message : 'Failed to update prompt'
             }, {
-                status: 500
+                status: payloadErrorStatus(e) ?? 500
             });
         }
     };
@@ -141,6 +154,8 @@
         try {
             await req.payload.delete({
                 collection: COLLECTION,
+                req,
+                overrideAccess: false,
                 id
             });
             return Response.json({
@@ -151,7 +166,7 @@
             return Response.json({
                 error: e instanceof Error ? e.message : 'Failed to delete prompt'
             }, {
-                status: 500
+                status: payloadErrorStatus(e) ?? 500
             });
         }
     };

package/dist/plugin/hooks/isHomepageUnique.js

@@ -50,9 +50,16 @@ import { APIError } from 'payload';
         const collectionSlug = options.collectionSlug || collection.slug;
         // Use locale from context (passed by endpoint handler) or fall back to req.locale
         const locale = context?.locale || req.locale;
-        // Query for existing homepage (excluding current document)
+        // Query for existing homepage (excluding current document).
+        //
+        // `overrideAccess: true` is deliberate. This hook runs *inside* an operation
+        // whose access Payload already checked, and it enforces a global invariant:
+        // only one page may be the homepage. Evaluating it against the editing user's
+        // read rules would let someone create a second homepage merely because they
+        // cannot see the first — a correctness bug, not a safeguard.
         const existingHomepage = await req.payload.find({
             collection: collectionSlug,
+            overrideAccess: true,
             ...locale ? {
                 locale: locale.toString()
             } : {},
@@ -91,8 +98,12 @@ import { APIError } from 'payload';
  * Unsets isHomepage on the specified page.
  * Used when swapping homepages.
  */ export async function unsetHomepage(payload, collectionSlug, pageId, locale) {
+    // Deliberate, for the same reason as the uniqueness query above: unsetting the
+    // previous homepage is invariant maintenance on behalf of an already-authorized
+    // edit, not a user-initiated write to that document.
     await payload.update({
         collection: collectionSlug,
+        overrideAccess: true,
         id: pageId,
         data: {
             isHomepage: false

package/dist/utils/payloadErrors.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Mapping Payload errors onto HTTP status codes.
+ *
+ * Payload's `APIError` (and its subclasses `Forbidden`, `NotFound`,
+ * `ValidationError`, ...) carries the status the response should use. Handlers
+ * that flatten everything to 500 turn an authorization *denial* into a server
+ * *error*, which hides the access-control layer working correctly, breaks client
+ * error handling, and pollutes error monitoring. That matters much more now that
+ * access control is actually enforced on these routes.
+ */
+/**
+ * Extract the HTTP status Payload intends for an error.
+ *
+ * The `instanceof` check is the fast path. The structural fallback exists
+ * because `payload` can legitimately be resolved more than once in a monorepo or
+ * under pnpm's linking, and a duplicated class identity would silently defeat
+ * `instanceof` — producing exactly the kind of environment-dependent flakiness
+ * this mapping is meant to remove.
+ *
+ * @returns the status code, or `null` if this is not a Payload API error.
+ */
+export declare function payloadErrorStatus(error: unknown): number | null;
+/**
+ * True when Payload rejected the operation because access control denied it.
+ *
+ * Used to keep denial responses free of internal detail — a 403 body should not
+ * describe which rule failed.
+ */
+export declare function isForbiddenError(error: unknown): boolean;
+/**
+ * Turn a Payload client error (4xx) into the response it should have produced.
+ *
+ * Returns `null` for anything that is not a Payload 4xx — including genuine 5xx
+ * faults — so callers fall through to their existing generic handling. Call it
+ * *after* any bespoke handling (`ValidationError`, `HomepageConflictError`) so
+ * those keep precedence.
+ *
+ * Payload marks user-facing errors with `isPublic`. Messages from errors that
+ * are not public are replaced with a generic one, so internal detail is never
+ * echoed back to the caller.
+ */
+export declare function payloadErrorResponse(error: unknown): Response | null;

package/dist/utils/payloadErrors.js

@@ -0,0 +1,69 @@
+/**
+ * Mapping Payload errors onto HTTP status codes.
+ *
+ * Payload's `APIError` (and its subclasses `Forbidden`, `NotFound`,
+ * `ValidationError`, ...) carries the status the response should use. Handlers
+ * that flatten everything to 500 turn an authorization *denial* into a server
+ * *error*, which hides the access-control layer working correctly, breaks client
+ * error handling, and pollutes error monitoring. That matters much more now that
+ * access control is actually enforced on these routes.
+ */ import { APIError } from 'payload';
+/**
+ * Extract the HTTP status Payload intends for an error.
+ *
+ * The `instanceof` check is the fast path. The structural fallback exists
+ * because `payload` can legitimately be resolved more than once in a monorepo or
+ * under pnpm's linking, and a duplicated class identity would silently defeat
+ * `instanceof` — producing exactly the kind of environment-dependent flakiness
+ * this mapping is meant to remove.
+ *
+ * @returns the status code, or `null` if this is not a Payload API error.
+ */ export function payloadErrorStatus(error) {
+    if (error instanceof APIError && typeof error.status === 'number') {
+        return error.status;
+    }
+    if (error instanceof Error) {
+        const candidate = error;
+        if (typeof candidate.status === 'number' && candidate.status >= 400 && candidate.status <= 599 && typeof candidate.isOperational === 'boolean') {
+            return candidate.status;
+        }
+    }
+    return null;
+}
+/**
+ * True when Payload rejected the operation because access control denied it.
+ *
+ * Used to keep denial responses free of internal detail — a 403 body should not
+ * describe which rule failed.
+ */ export function isForbiddenError(error) {
+    return payloadErrorStatus(error) === 403;
+}
+const CLIENT_ERROR_MESSAGES = {
+    400: 'Bad request',
+    401: 'Unauthorized',
+    403: 'Forbidden',
+    404: 'Not found',
+    409: 'Conflict'
+};
+/**
+ * Turn a Payload client error (4xx) into the response it should have produced.
+ *
+ * Returns `null` for anything that is not a Payload 4xx — including genuine 5xx
+ * faults — so callers fall through to their existing generic handling. Call it
+ * *after* any bespoke handling (`ValidationError`, `HomepageConflictError`) so
+ * those keep precedence.
+ *
+ * Payload marks user-facing errors with `isPublic`. Messages from errors that
+ * are not public are replaced with a generic one, so internal detail is never
+ * echoed back to the caller.
+ */ export function payloadErrorResponse(error) {
+    const status = payloadErrorStatus(error);
+    if (status === null || status < 400 || status >= 500) return null;
+    const isPublic = error instanceof Error && error.isPublic === true;
+    const message = isPublic && error.message ? error.message : CLIENT_ERROR_MESSAGES[status] ?? 'Request failed';
+    return Response.json({
+        error: message
+    }, {
+        status
+    });
+}

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.8.2";
+export declare const VERSION = "0.9.0";

package/dist/version.js

@@ -1,2 +1,2 @@
 // Auto-generated by scripts/generate-version.js - do not edit manually
-export const VERSION = '0.8.2';
+export const VERSION = '0.9.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delmaredigital/payload-puck",
-  "version": "0.8.2",
+  "version": "0.9.0",
   "description": "Puck visual page builder plugin for Payload CMS",
   "type": "module",
   "license": "MIT",
@@ -145,37 +145,37 @@
     "@puckeditor/plugin-ai": "^0.8.2",
     "@puckeditor/plugin-heading-analyzer": "^0.23.0",
     "@radix-ui/react-popover": "^1.1.15",
-    "@tiptap/core": "^3.20.1",
-    "@tiptap/extension-color": "^3.20.1",
-    "@tiptap/extension-highlight": "^3.20.1",
-    "@tiptap/extension-link": "^3.20.1",
-    "@tiptap/extension-subscript": "^3.20.1",
-    "@tiptap/extension-superscript": "^3.20.1",
-    "@tiptap/extension-text-align": "^3.20.1",
-    "@tiptap/extension-text-style": "^3.20.1",
-    "@tiptap/extension-underline": "^3.20.1",
-    "@tiptap/react": "^3.20.1",
-    "@tiptap/starter-kit": "^3.20.1",
-    "html-react-parser": "^5.2.17",
-    "lucide-react": "^0.469.0"
+    "@tiptap/core": "^3.29.2",
+    "@tiptap/extension-color": "^3.29.2",
+    "@tiptap/extension-highlight": "^3.29.2",
+    "@tiptap/extension-link": "^3.29.2",
+    "@tiptap/extension-subscript": "^3.29.2",
+    "@tiptap/extension-superscript": "^3.29.2",
+    "@tiptap/extension-text-align": "^3.29.2",
+    "@tiptap/extension-text-style": "^3.29.2",
+    "@tiptap/extension-underline": "^3.29.2",
+    "@tiptap/react": "^3.29.2",
+    "@tiptap/starter-kit": "^3.29.2",
+    "html-react-parser": "^6.1.5",
+    "lucide-react": "^1.30.0"
   },
   "devDependencies": {
     "@payloadcms/next": "^3.87.1",
     "@payloadcms/ui": "^3.87.1",
     "@puckeditor/core": "^0.23.0",
-    "@swc/cli": "^0.6.0",
-    "@swc/core": "^1.15.18",
-    "@types/node": "^24.12.0",
-    "@types/react": "^19.2.14",
-    "@types/react-dom": "^19.2.3",
-    "@vitest/coverage-v8": "^3.2.7",
+    "@swc/cli": "^0.8.1",
+    "@swc/core": "^1.15.47",
+    "@types/node": "^26.1.2",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
+    "@vitest/coverage-v8": "^4.1.10",
     "copyfiles": "^2.4.1",
     "next": "^16.3.0",
     "payload": "^3.87.1",
-    "react": "^19.2.4",
-    "react-dom": "^19.2.4",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "typescript": "^5.9.3",
-    "vitest": "^3.2.7"
+    "vitest": "^4.1.10"
   },
   "keywords": [
     "payload",